- Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With hundreds of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
+ Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
Secure ANY cloud at AI Speed at prowler.com
@@ -21,7 +21,7 @@
-
+
@@ -41,7 +41,7 @@
# Description
-**Prowler** is the world’s most widely used _Open-Source Cloud Security Platform_ that automates security and compliance across **any cloud environment**. With hundreds of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to _“Secure ANY Cloud at AI Speed”_. Prowler delivers **AI-driven**, **customizable**, and **easy-to-use** assessments, dashboards, reports, and integrations, making cloud security **simple**, **scalable**, and **cost-effective** for organizations of any size.
+**Prowler** is the world’s most widely used _Open-Source Cloud Security Platform_ that automates security and compliance across **any cloud environment**. With thousands of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to _“Secure ANY Cloud at AI Speed”_. Prowler delivers **AI-driven**, **customizable**, and **easy-to-use** assessments, dashboards, reports, and integrations, making cloud security **simple**, **scalable**, and **cost-effective** for organizations of any size.
Prowler includes hundreds of built-in controls to ensure compliance with standards and frameworks, including:
@@ -54,16 +54,16 @@ Prowler includes hundreds of built-in controls to ensure compliance with standar
- **National Security Standards:** ENS (Spanish National Security Scheme) and KISA ISMS-P (Korean)
- **Custom Security Frameworks:** Tailored to your needs
-## Prowler App / Prowler Cloud
+## Prowler Cloud & Prowler Local Server
-Prowler App / [Prowler Cloud](https://cloud.prowler.com/) is a web-based application that simplifies running Prowler across your cloud provider accounts. It provides a user-friendly interface to visualize the results and streamline your security assessments.
+[Prowler Cloud](https://cloud.prowler.com/) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.
-
+
->For more details, refer to the [Prowler App Documentation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#prowler-app-installation)
+>For more details, refer to the [Prowler Local Server documentation](https://docs.prowler.com/getting-started/installation/prowler-app)
## Prowler CLI
@@ -73,26 +73,45 @@ prowler
-## Prowler Dashboard
+## Prowler Local Dashboard
```console
prowler dashboard
```
-
+
## Attack Paths
-Attack Paths automatically extends every completed AWS scan with a Neo4j graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan and therefore requires:
+Attack Paths automatically extends every completed AWS scan with a graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan.
-- An accessible Neo4j instance (the Docker Compose files already ships a `neo4j` service).
-- The following environment variables so Django and Celery can connect:
+Two graph backends are supported as the long-lived sink:
- | Variable | Description | Default |
- | --- | --- | --- |
- | `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
- | `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
- | `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
+- **Neo4j** (default; the Docker Compose files already ship a `neo4j` service).
+- **Amazon Neptune** (cloud-managed; opt-in).
+
+Select the sink with `ATTACK_PATHS_SINK_DATABASE` (`neo4j` or `neptune`; default `neo4j`).
+
+> Note: Cartography ingestion always uses a temporary Neo4j database, regardless of the configured sink. The `NEO4J_*` variables below must remain set even when `ATTACK_PATHS_SINK_DATABASE=neptune`.
+
+### Neo4j sink
+
+| Variable | Description | Default |
+| --- | --- | --- |
+| `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
+| `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
+| `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
+
+### Neptune sink
+
+| Variable | Description | Default |
+| --- | --- | --- |
+| `NEPTUNE_WRITER_ENDPOINT` | Bolt host for the Neptune writer instance. Required when sink is `neptune`. | _empty_ |
+| `NEPTUNE_READER_ENDPOINT` | Optional reader endpoint for read-only queries. Falls back to the writer when unset. | _empty_ |
+| `NEPTUNE_PORT` | Bolt port exposed by Neptune. | `8182` |
+| `AWS_REGION` | Region the Neptune cluster lives in. Required when sink is `neptune`. | _empty_ |
+
+Neptune authenticates with SigV4 using the standard boto3 credential chain. The worker's IAM role (or `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) supplies the credentials. There is no Neptune password variable.
Every AWS provider scan will enqueue an Attack Paths ingestion job automatically. Other cloud providers will be added in future iterations.
@@ -102,29 +121,30 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
> For the most accurate and up-to-date information about checks, services, frameworks, and categories, visit [**Prowler Hub**](https://hub.prowler.com).
-| Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) | Support | Interface |
+| Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
|---|---|---|---|---|---|---|
-| AWS | 613 | 86 | 46 | 19 | Official | UI, API, CLI |
-| Azure | 190 | 22 | 20 | 16 | Official | UI, API, CLI |
-| GCP | 109 | 20 | 18 | 12 | Official | UI, API, CLI |
-| Kubernetes | 90 | 7 | 7 | 11 | Official | UI, API, CLI |
-| GitHub | 24 | 3 | 1 | 5 | Official | UI, API, CLI |
-| M365 | 107 | 10 | 4 | 10 | Official | UI, API, CLI |
-| OCI | 52 | 14 | 4 | 10 | Official | UI, API, CLI |
-| Alibaba Cloud | 63 | 9 | 5 | 9 | Official | UI, API, CLI |
-| Cloudflare | 29 | 3 | 1 | 5 | Official | UI, API, CLI |
+| AWS | 615 | 86 | 47 | 19 | Official | UI, API, CLI |
+| Azure | 190 | 22 | 21 | 16 | Official | UI, API, CLI |
+| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
+| Kubernetes | 90 | 7 | 8 | 11 | Official | UI, API, CLI |
+| GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
+| M365 | 109 | 10 | 6 | 10 | Official | UI, API, CLI |
+| OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
+| Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
+| Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
| IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
-| MongoDB Atlas | 10 | 3 | 0 | 8 | Official | UI, API, CLI |
+| MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
| LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
| Image | N/A | N/A | N/A | N/A | Official | CLI, API |
-| Google Workspace | 65 | 11 | 2 | 6 | Official | UI, API, CLI |
-| OpenStack | 34 | 5 | 0 | 9 | Official | UI, API, CLI |
-| Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
-| Okta | 29 | 8 | 1 | 2 | Official | UI, API, CLI |
-| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 0 | 4 | Unofficial | CLI |
-| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 0 | 3 | Unofficial | CLI |
-| NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
+| Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
+| OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
+| Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
+| Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
+| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |
+| E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
+| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |
+| NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |
> [!Note]
> The numbers in the table are updated periodically.
@@ -140,11 +160,11 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
# 💻 Installation
-## Prowler App
+## Prowler Local Server
-Prowler App offers flexible installation methods tailored to various environments:
+Prowler Local Server offers flexible installation methods tailored to various environments:
-> For detailed instructions on using Prowler App, refer to the [Prowler App Usage Guide](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app/).
+> For detailed instructions on using Prowler Local Server, refer to the [usage guide](https://docs.prowler.com/user-guide/tutorials/prowler-app).
### Docker Compose
@@ -177,7 +197,7 @@ docker compose up -d
> [!WARNING]
> 🔒 For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
-Once configured, access the Prowler App at http://localhost:3000. Sign up using your email and password to get started.
+Once configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.
### Common Issues with Docker Pull Installation
@@ -249,7 +269,7 @@ pnpm run build
pnpm start
```
-> Once configured, access the Prowler App at http://localhost:3000. Sign up using your email and password to get started.
+> Once configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.
#### Pre-commit Hooks Setup
@@ -267,7 +287,7 @@ Prowler CLI is available as a project in [PyPI](https://pypi.org/project/prowler
pip install prowler
prowler -v
```
->For further guidance, refer to [https://docs.prowler.com](https://docs.prowler.com/projects/prowler-open-source/en/latest/#prowler-cli-installation)
+>For further guidance, refer to [https://docs.prowler.com](https://docs.prowler.com/getting-started/installation/prowler-cli)
### Containers
@@ -287,7 +307,7 @@ The container images are available here:
- Prowler CLI:
- [DockerHub](https://hub.docker.com/r/prowlercloud/prowler/tags)
- [AWS Public ECR](https://gallery.ecr.aws/prowler-cloud/prowler)
-- Prowler App:
+- Prowler Local Server:
- [DockerHub - Prowler UI](https://hub.docker.com/r/prowlercloud/prowler-ui/tags)
- [DockerHub - Prowler API](https://hub.docker.com/r/prowlercloud/prowler-api/tags)
@@ -337,17 +357,55 @@ Full configuration, per-provider authentication, and SARIF examples: [Prowler Gi
# ✏️ High level architecture
-## Prowler App
-**Prowler App** is composed of four key components:
+## Prowler Local Server
+**Prowler Local Server** is composed of four key components:
- **Prowler UI**: A web-based interface, built with Next.js, providing a user-friendly experience for executing Prowler scans and visualizing results.
- **Prowler API**: A backend service, developed with Django REST Framework, responsible for running Prowler scans and storing the generated results.
- **Prowler SDK**: A Python SDK designed to extend the functionality of the Prowler CLI for advanced capabilities.
- **Prowler MCP Server**: A Model Context Protocol server that provides AI tools for Lighthouse, the AI-powered security assistant. This is a critical dependency for Lighthouse functionality.
-
+```mermaid
+flowchart TB
+ user([User / Security Team])
+ cli([Prowler CLI])
-
+ subgraph APP["Prowler Local Server"]
+ ui["Prowler UI (Next.js)"]
+ api["Prowler API (Django REST Framework)"]
+ worker["API Worker (Celery)"]
+ beat["API Scheduler (Celery Beat)"]
+ mcp["Prowler MCP Server (Lighthouse AI tools)"]
+ end
+
+ sdk["Prowler SDK (Python)"]
+
+ subgraph DATA["Data Layer"]
+ pg[("PostgreSQL")]
+ valkey[("Valkey / Redis")]
+ neo4j[("Neo4j")]
+ end
+
+ providers["Providers"]
+
+ user --> ui
+ user --> cli
+ ui -->|REST| api
+ ui -->|MCP HTTP| mcp
+ mcp -->|REST| api
+ api --> pg
+ api --> valkey
+ beat -->|enqueue jobs| valkey
+ valkey -->|dispatch| worker
+ worker --> pg
+ worker -->|Attack Paths| neo4j
+ worker -->|invokes| sdk
+ cli --> sdk
+
+ sdk --> providers
+```
+
+
## Prowler CLI
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 3d7abfab2e..1b26c2b014 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,6 +2,107 @@
All notable changes to the **Prowler API** are documented in this file.
+
+
+## [1.36.0] (Prowler v5.35.0)
+
+### 🐞 Fixed
+
+- `attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults [(#12009)](https://github.com/prowler-cloud/prowler/pull/12009)
+- Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error [(#12019)](https://github.com/prowler-cloud/prowler/pull/12019)
+
+### 🔐 Security
+
+- Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
+- Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications [(#12013)](https://github.com/prowler-cloud/prowler/pull/12013)
+
+---
+
+## [1.35.0] (Prowler v5.34.0)
+
+### 🐞 Fixed
+
+- `rls_transaction` now falls back directly to the primary DB for connection-level mid-query read replica failures via `execute_wrapper`, reducing non-streaming read crashes during replica recovery [(#10379)](https://github.com/prowler-cloud/prowler/pull/10379)
+- RBAC permission gates now combine permissions from every role assigned to a user in the active tenant [(#11979)](https://github.com/prowler-cloud/prowler/pull/11979)
+- `attack-paths-cleanup-stale-scans` now retries worker pings and checks recent scan activity before failing scans and removing temporary databases [(#11986)](https://github.com/prowler-cloud/prowler/pull/11986)
+
+### 🔐 Security
+
+- User role relationship updates are limited to the active tenant to preserve role assignments in other tenants [(#11903)](https://github.com/prowler-cloud/prowler/pull/11903)
+- `api` container image removes the unused Debian `libxml2` runtime package and scopes the `CVE-2026-13221` Trivy exception to unaffected Perl 5.36 packages [(#11991)](https://github.com/prowler-cloud/prowler/pull/11991)
+
+---
+
+## [1.34.2] (Prowler v5.33.2)
+
+### 🐞 Fixed
+
+- Attack Paths graph mutations now retry transient Neptune concurrency and deadline failures, while Neo4j mutations use managed transaction retries [(#11968)](https://github.com/prowler-cloud/prowler/pull/11968)
+- Attack Paths scans now use bounded child node identifiers for normalized list values in Neo4j and Neptune, preventing Neo4j RANGE index key size failures [(#11969)](https://github.com/prowler-cloud/prowler/pull/11969)
+- `scan-summary` aggregation now upserts summaries in deterministic conflict-key order, preventing PostgreSQL deadlocks during concurrent reaggregation [(#11971)](https://github.com/prowler-cloud/prowler/pull/11971)
+
+---
+
+## [1.34.1] (Prowler v5.33.1)
+
+### 🐞 Fixed
+
+- Session tokens are rejected after account password updates [(#11914)](https://github.com/prowler-cloud/prowler/pull/11914)
+- Jira dispatch task results now surface user-facing Jira failure messages [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+- AWS Attack Paths privilege escalation queries no longer fail on Neo4j with `Aggregation column contains implicit grouping expressions` [(#11939)](https://github.com/prowler-cloud/prowler/pull/11939)
+
+### 🔐 Security
+
+- OpenAI-compatible Lighthouse provider base URLs are restricted before connection checks [(#11940)](https://github.com/prowler-cloud/prowler/pull/11940)
+- `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS` environment variable to allow internal hosts as OpenAI-compatible Lighthouse AI base URLs [(#11942)](https://github.com/prowler-cloud/prowler/pull/11942)
+
+---
+
+## [1.34.0] (Prowler v5.33.0)
+
+### 🚀 Added
+
+- Compliance PDF reports no longer require provider credentials: findings are enriched from the provider metadata stored in the database, so reports generate even after the provider secret is deleted or its credentials become invalid [(#11845)](https://github.com/prowler-cloud/prowler/pull/11845)
+
+### 🐞 Fixed
+
+- Provider scans now queue behind active provider scans instead of dispatching concurrently, and resource failed-finding counters retry database conflicts with stable row locking [(#11848)](https://github.com/prowler-cloud/prowler/pull/11848)
+
+---
+
+## [1.33.1] (Prowler v5.32.1)
+
+### 🐞 Fixed
+
+- Attack Paths: Scan rows now have database defaults for `is_migrated` and `sink_backend` so `scan-perform-scheduled` inserts survive deploy skew [(#11826)](https://github.com/prowler-cloud/prowler/pull/11826)
+- Invited users now keep their invitation context when completing authentication with Google, GitHub, or SAML, so the invitation is accepted during login [(#11752)](https://github.com/prowler-cloud/prowler/pull/11752)
+
+### 🔐 Security
+
+- User profile updates now allow users to update their own account while requiring user-management permissions to update other users in the same tenant [(#11792)](https://github.com/prowler-cloud/prowler/pull/11792)
+- Kubernetes provider credentials now reject kubeconfigs using `exec` authentication in Prowler Cloud, preventing user-supplied commands from running on Cloud workers [(#11753)](https://github.com/prowler-cloud/prowler/pull/11753)
+
+---
+
+## [1.33.0] (Prowler v5.32.0)
+
+### 🚀 Added
+
+- Timestamp precision support for `/api/v1/findings` `inserted_at` and `updated_at` filters [(#11754)](https://github.com/prowler-cloud/prowler/pull/11754)
+
+### 🔄 Changed
+
+- Attack Paths: AWS Neptune is now supported as a persistent sink database, selectable via `ATTACK_PATHS_SINK_DATABASE=neptune` (default `neo4j`), Cartography's (bumped to 0.138.1) per-scan ingest database stays on Neo4j [(#11524)](https://github.com/prowler-cloud/prowler/pull/11524)
+- Attack Paths: Scan task now checks the ingest Neo4j database and configured graph sink before starting graph ingestion [(#11743)](https://github.com/prowler-cloud/prowler/pull/11743)
+- Disable PowerShell telemetry in the API container image [(#11746)](https://github.com/prowler-cloud/prowler/pull/11746)
+
+### 🐞 Fixed
+
+- Attack Paths: Provider graph cleanup now deletes Neo4j and Neptune relationships in directed batches before deleting nodes [(#11755)](https://github.com/prowler-cloud/prowler/pull/11755)
+- `scan-perform` no longer reports an error when a provider is deleted during a running scan [(#11696)](https://github.com/prowler-cloud/prowler/pull/11696)
+
+---
+
## [1.32.1] (Prowler v5.31.1)
### 🐞 Fixed
diff --git a/api/Dockerfile b/api/Dockerfile
index bb9da0b280..8d6923bbfc 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,11 +1,13 @@
-FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS build
+FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build
LABEL maintainer="https://github.com/prowler-cloud/api"
ARG POWERSHELL_VERSION=7.5.0
ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
+# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
-ARG TRIVY_VERSION=0.71.0
+ARG TRIVY_VERSION=0.71.2
ENV TRIVY_VERSION=${TRIVY_VERSION}
ARG ZIZMOR_VERSION=1.24.1
@@ -102,6 +104,24 @@ RUN uv sync --locked --no-install-project && \
RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py
+USER root
+
+# Remove build-only packages from the final image after Python dependencies are installed.
+RUN apt-get purge -y --auto-remove \
+ gcc \
+ g++ \
+ make \
+ libxml2-dev \
+ libxmlsec1-dev \
+ libxmlsec1-openssl \
+ pkg-config \
+ libtool \
+ libxslt1-dev \
+ python3-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+USER prowler
+
COPY --chown=prowler:prowler src/backend/ ./backend/
COPY --chown=prowler:prowler docker-entrypoint.sh ./docker-entrypoint.sh
diff --git a/tests/__init__.py b/api/changelog.d/.gitkeep
similarity index 100%
rename from tests/__init__.py
rename to api/changelog.d/.gitkeep
diff --git a/api/changelog.d/README.md b/api/changelog.d/README.md
new file mode 100644
index 0000000000..0853174f30
--- /dev/null
+++ b/api/changelog.d/README.md
@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `..md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.
diff --git a/api/changelog.d/oci-regionless-api-legacy-region.changed.md b/api/changelog.d/oci-regionless-api-legacy-region.changed.md
new file mode 100644
index 0000000000..087b027c88
--- /dev/null
+++ b/api/changelog.d/oci-regionless-api-legacy-region.changed.md
@@ -0,0 +1 @@
+OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 4036aac9a9..607a8c7348 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -58,7 +58,7 @@ dependencies = [
"matplotlib (==3.10.8)",
"reportlab (==4.4.10)",
"neo4j (==6.1.0)",
- "cartography (==0.135.0)",
+ "cartography (==0.138.1)",
"gevent (==25.9.1)",
"werkzeug (==3.1.7)",
"sqlparse (==0.5.5)",
@@ -71,7 +71,7 @@ name = "prowler-api"
package-mode = false
# Needed for the SDK compatibility
requires-python = ">=3.11,<3.13"
-version = "1.33.0"
+version = "1.37.0"
# Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
# target-version tracks this project's lowest supported Python.
@@ -193,7 +193,7 @@ constraint-dependencies = [
"blinker==1.9.0",
"boto3==1.40.61",
"botocore==1.40.61",
- "cartography==0.135.0",
+ "cartography==0.138.1",
"celery==5.6.2",
"certifi==2026.1.4",
"cffi==2.0.0",
@@ -218,7 +218,6 @@ constraint-dependencies = [
"debugpy==1.8.20",
"decorator==5.2.1",
"defusedxml==0.7.1",
- "detect-secrets==1.5.0",
"dill==0.4.1",
"distro==1.9.0",
"dj-rest-auth==7.0.1",
@@ -301,6 +300,7 @@ constraint-dependencies = [
"jsonschema==4.23.0",
"jsonschema-specifications==2025.9.1",
"keystoneauth1==5.13.0",
+ "kingfisher-bin==1.104.0",
"kiwisolver==1.4.9",
"knack==0.11.0",
"kombu==5.6.2",
@@ -447,7 +447,7 @@ constraint-dependencies = [
"wcwidth==0.5.3",
"websocket-client==1.9.0",
"werkzeug==3.1.7",
- "workos==6.0.4",
+ "workos==6.0.8",
"wrapt==1.17.3",
"xlsxwriter==3.2.9",
"xmlsec==1.3.17",
@@ -458,8 +458,13 @@ constraint-dependencies = [
"zope-interface==8.2",
"zstd==1.5.7.3"
]
-# prowler@master needs okta==3.4.2; cartography 0.135.0 declares okta<1.0.0 for an
-# integration prowler does not import.
+# prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
+# Attack Paths does not ingest Okta today, so override the Cartography
+# dependency to the Prowler pin.
+#
+# prowler@master needs azure-mgmt-containerservice==34.1.0, but cartography
+# 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
+# ingest Azure today, so override the Cartography dependency to the Prowler pin.
#
# prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
# The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
@@ -475,6 +480,7 @@ constraint-dependencies = [
# that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
override-dependencies = [
"okta==3.4.2",
+ "azure-mgmt-containerservice==34.1.0",
"microsoft-kiota-abstractions==1.9.9",
"dulwich==1.2.5",
"pyjwt[crypto]==2.13.0"
diff --git a/api/src/backend/api/adapters.py b/api/src/backend/api/adapters.py
index cbd6795731..99ab88bf81 100644
--- a/api/src/backend/api/adapters.py
+++ b/api/src/backend/api/adapters.py
@@ -1,3 +1,5 @@
+from allauth.account.models import EmailAddress
+from allauth.core.exceptions import ImmediateHttpResponse
from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
from api.db_router import MainRouter
from api.db_utils import rls_transaction
@@ -9,7 +11,9 @@ from api.models import (
User,
UserRoleRelationship,
)
+from api.utils import accept_invitation_for_user
from django.db import transaction
+from django.http import HttpResponseForbidden
class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
@@ -20,9 +24,30 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
except User.DoesNotExist:
return None
+ @staticmethod
+ def _get_invitation_token(request):
+ for source_name in ("data", "POST"):
+ data = getattr(request, source_name, None) or {}
+ if not hasattr(data, "get"):
+ continue
+ invitation_token = data.get("invitation_token")
+ if invitation_token:
+ return invitation_token
+
+ wrapped_request = getattr(request, "_request", None)
+ if wrapped_request and wrapped_request is not request:
+ return ProwlerSocialAccountAdapter._get_invitation_token(wrapped_request)
+
+ return None
+
def pre_social_login(self, request, sociallogin):
- # Link existing accounts with the same email address
- email = sociallogin.account.extra_data.get("email")
+ # The provider account is already bound, so no email-based linking is needed.
+ if sociallogin.account.pk:
+ return
+
+ # Prefer the normalized email populated by allauth. GitHub can return the
+ # primary email separately from the profile stored in extra_data.
+ email = sociallogin.user.email or sociallogin.account.extra_data.get("email")
if sociallogin.provider.id == "saml":
# For SAML, the asserted NameID email cannot be trusted on its own:
# any tenant can claim any email domain in its SAML configuration. To
@@ -63,6 +88,17 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
if email:
existing_user = self.get_user_by_email(email)
if existing_user:
+ email_is_verified = EmailAddress.objects.filter(
+ user=existing_user,
+ email__iexact=email,
+ verified=True,
+ ).exists()
+ provider_verified_email = any(
+ address.verified and address.email.casefold() == email.casefold()
+ for address in sociallogin.email_addresses
+ )
+ if not email_is_verified or not provider_verified_email:
+ raise ImmediateHttpResponse(HttpResponseForbidden())
sociallogin.connect(request, existing_user)
def save_user(self, request, sociallogin, form=None):
@@ -83,29 +119,38 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
user.name = social_account_name
user.save(using=MainRouter.admin_db)
- tenant = Tenant.objects.using(MainRouter.admin_db).create(
- name=f"{user.email.split('@')[0]} default tenant"
- )
- with rls_transaction(str(tenant.id)):
- Membership.objects.using(MainRouter.admin_db).create(
- user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
- )
- role = Role.objects.using(MainRouter.admin_db).create(
- name="admin",
- tenant_id=tenant.id,
- manage_users=True,
- manage_account=True,
- manage_billing=True,
- manage_providers=True,
- manage_integrations=True,
- manage_scans=True,
- unlimited_visibility=True,
- )
- UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+ invitation_token = self._get_invitation_token(request)
+ if invitation_token:
+ invitation, _ = accept_invitation_for_user(
user=user,
- role=role,
- tenant_id=tenant.id,
+ invitation_token=invitation_token,
)
+ request.prowler_invitation_token = invitation_token
+ request.prowler_invitation_tenant_id = str(invitation.tenant_id)
+ else:
+ tenant = Tenant.objects.using(MainRouter.admin_db).create(
+ name=f"{user.email.split('@')[0]} default tenant"
+ )
+ with rls_transaction(str(tenant.id)):
+ Membership.objects.using(MainRouter.admin_db).create(
+ user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
+ )
+ role = Role.objects.using(MainRouter.admin_db).create(
+ name="admin",
+ tenant_id=tenant.id,
+ manage_users=True,
+ manage_account=True,
+ manage_billing=True,
+ manage_providers=True,
+ manage_integrations=True,
+ manage_scans=True,
+ unlimited_visibility=True,
+ )
+ UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+ user=user,
+ role=role,
+ tenant_id=tenant.id,
+ )
else:
request.session["saml_user_created"] = str(user.id)
diff --git a/api/src/backend/api/apps.py b/api/src/backend/api/apps.py
index 90ba96c124..1aa0f8f54f 100644
--- a/api/src/backend/api/apps.py
+++ b/api/src/backend/api/apps.py
@@ -42,9 +42,6 @@ class ApiConfig(AppConfig):
):
self._ensure_crypto_keys()
- # Neo4j driver is created lazily on first use (see api.attack_paths.database).
- # App init never contacts Neo4j, so a Neo4j outage cannot block API startup.
-
def _ensure_crypto_keys(self):
"""
Orchestrator method that ensures all required cryptographic keys are present.
diff --git a/api/src/backend/api/attack_paths/cypher_sanitizer.py b/api/src/backend/api/attack_paths/cypher_sanitizer.py
index f08172114e..35752b3ec9 100644
--- a/api/src/backend/api/attack_paths/cypher_sanitizer.py
+++ b/api/src/backend/api/attack_paths/cypher_sanitizer.py
@@ -4,10 +4,10 @@ Cypher sanitizer for custom (user-supplied) Attack Paths queries.
Two responsibilities:
1. **Validation** - reject queries containing SSRF or dangerous procedure
- patterns (defense-in-depth; the primary control is ``neo4j.READ_ACCESS``).
+ patterns (defense-in-depth; the primary control is `neo4j.READ_ACCESS`).
2. **Provider-scoped label injection** - inject a dynamic
- ``_Provider_{uuid}`` label into every node pattern so the database can
+ `_Provider_{uuid}` label into every node pattern so the database can
use its native label index for provider isolation.
Label-injection pipeline:
@@ -25,13 +25,13 @@ from rest_framework.exceptions import ValidationError
from tasks.jobs.attack_paths.config import get_provider_label
# Step 1 - String / comment protection
-# Single combined regex: strings first, then line comments.
+# Single combined regex: strings first, then line comments
# The regex engine finds the leftmost match, so a string like 'https://prowler.com'
-# is consumed as a string before the // inside it can match as a comment.
+# is consumed as a string before the // inside it can match as a comment
_PROTECTED_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
# Step 2 - Clause splitting
-# OPTIONAL MATCH must come before MATCH to avoid partial matching.
+# `OPTIONAL MATCH` must come before `MATCH` to avoid partial matching
_CLAUSE_RE = re.compile(
r"\b(OPTIONAL\s+MATCH|MATCH|WHERE|RETURN|WITH|ORDER\s+BY"
r"|SKIP|LIMIT|UNION|UNWIND|CALL)\b",
@@ -39,10 +39,10 @@ _CLAUSE_RE = re.compile(
)
# Pass A - Labeled node patterns (all segments)
-# Matches node patterns that have at least one :Label.
-# (? str:
node pattern.
"""
label = get_provider_label(provider_id)
+ return inject_label(cypher, label)
+
+
+def inject_label(cypher: str, label: str) -> str:
+ """Rewrite a Cypher query to append a label to every node pattern."""
# Step 1: Protect strings and comments (single pass, leftmost-first)
protected: list[str] = []
@@ -134,9 +139,7 @@ def inject_provider_label(cypher: str, provider_id: str) -> str:
return work
-# ---------------------------------------------------------------------------
# Validation
-# ---------------------------------------------------------------------------
# Patterns that indicate SSRF or dangerous procedure calls
# Defense-in-depth layer - the primary control is `neo4j.READ_ACCESS`
diff --git a/api/src/backend/api/attack_paths/database.py b/api/src/backend/api/attack_paths/database.py
index 4745cf79a1..3ef55b7eca 100644
--- a/api/src/backend/api/attack_paths/database.py
+++ b/api/src/backend/api/attack_paths/database.py
@@ -1,261 +1,33 @@
-import atexit
-import logging
-import threading
-from collections.abc import Iterator
-from contextlib import contextmanager
+"""Backwards-compatible facade over the ingest and sink modules.
+
+Historically this module owned a single Neo4j driver used for both the
+cartography temp database and the per-tenant sink database. The port to AWS
+Neptune split those roles: the cartography ingest (temp) database is always
+Neo4j and lives in `api.attack_paths.ingest`; the sink is configurable
+(Neo4j or Neptune) and lives in `api.attack_paths.sink`. This shim preserves
+the public API that `tasks/` and `api/v1/views.py` already depend on, and
+dispatches to the right module by database-name prefix.
+
+A database name starting with `db-tmp-scan-` is a cartography temp DB and
+routes to ingest. Everything else routes to the configured sink.
+"""
+
+from contextlib import AbstractContextManager
from typing import Any
from uuid import UUID
-import neo4j
-import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession
+import neo4j # noqa: F401 - kept for tests that patch api.attack_paths.database.neo4j
+from api.attack_paths import ingest
+from api.attack_paths import sink as sink_module
from config.env import env
-from django.conf import settings
-from tasks.jobs.attack_paths.config import (
- BATCH_SIZE,
- PROVIDER_RESOURCE_LABEL,
- get_provider_label,
+from django.conf import (
+ settings, # noqa: F401 - kept for tests that patch ...database.settings
)
-# Without this Celery goes crazy with Neo4j logging
-logging.getLogger("neo4j").setLevel(logging.ERROR)
-logging.getLogger("neo4j").propagate = False
-
-SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
- "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
-)
-READ_QUERY_TIMEOUT_SECONDS = env.int(
- "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
-)
MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
-# Shorter than CONN_ACQUISITION_TIMEOUT — the driver requires acquisition to be
-# the longer of the two (it may include opening a new connection).
-CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
-CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
-READ_EXCEPTION_CODES = [
- "Neo.ClientError.Statement.AccessMode",
- "Neo.ClientError.Procedure.ProcedureNotFound",
-]
-CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
-# Module-level process-wide driver singleton
-_driver: neo4j.Driver | None = None
-_lock = threading.Lock()
-
-# Base Neo4j functions
-
-
-def get_uri() -> str:
- host = settings.DATABASES["neo4j"]["HOST"]
- port = settings.DATABASES["neo4j"]["PORT"]
- return f"bolt://{host}:{port}"
-
-
-def init_driver() -> neo4j.Driver:
- global _driver
- if _driver is not None:
- return _driver
-
- with _lock:
- if _driver is None:
- uri = get_uri()
- config = settings.DATABASES["neo4j"]
-
- driver = neo4j.GraphDatabase.driver(
- uri,
- auth=(config["USER"], config["PASSWORD"]),
- keep_alive=True,
- max_connection_lifetime=7200,
- connection_timeout=CONNECTION_TIMEOUT,
- connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
- max_connection_pool_size=50,
- )
- # Publish the singleton only after connectivity is verified so a
- # failed probe does not leave an unverified driver behind. Close the
- # driver on failure so a repeatedly-probed outage cannot leak pools.
- try:
- driver.verify_connectivity()
- except Exception:
- driver.close()
- raise
- _driver = driver
-
- # Register cleanup handler (only runs once since we're inside the _driver is None block)
- atexit.register(close_driver)
-
- return _driver
-
-
-def get_driver() -> neo4j.Driver:
- return init_driver()
-
-
-def close_driver() -> None: # TODO: Use it
- global _driver
- with _lock:
- if _driver is not None:
- try:
- _driver.close()
-
- finally:
- _driver = None
-
-
-@contextmanager
-def get_session(
- database: str | None = None, default_access_mode: str | None = None
-) -> Iterator[RetryableSession]:
- session_wrapper: RetryableSession | None = None
-
- try:
- session_wrapper = RetryableSession(
- session_factory=lambda: get_driver().session(
- database=database, default_access_mode=default_access_mode
- ),
- max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
- )
- yield session_wrapper
-
- except neo4j.exceptions.Neo4jError as exc:
- if (
- default_access_mode == neo4j.READ_ACCESS
- and exc.code
- and exc.code in READ_EXCEPTION_CODES
- ):
- message = "Read query not allowed"
- code = READ_EXCEPTION_CODES[0]
- raise WriteQueryNotAllowedException(message=message, code=code)
-
- message = exc.message if exc.message is not None else str(exc)
-
- if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
- raise ClientStatementException(message=message, code=exc.code)
-
- raise GraphDatabaseQueryException(message=message, code=exc.code)
-
- finally:
- if session_wrapper is not None:
- session_wrapper.close()
-
-
-def execute_read_query(
- database: str,
- cypher: str,
- parameters: dict[str, Any] | None = None,
-) -> neo4j.graph.Graph:
- with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
-
- def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
- result = tx.run(
- cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
- )
- return result.graph()
-
- return session.execute_read(_run)
-
-
-def create_database(database: str) -> None:
- query = "CREATE DATABASE $database IF NOT EXISTS"
- parameters = {"database": database}
-
- with get_session() as session:
- session.run(query, parameters)
-
-
-def drop_database(database: str) -> None:
- query = f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA"
-
- with get_session() as session:
- session.run(query)
-
-
-def drop_subgraph(database: str, provider_id: str) -> int:
- """
- Delete all nodes for a provider from the tenant database.
-
- Deletes relationships then nodes in batches (not `DETACH DELETE`) so a dense
- provider's graph cannot exceed Neo4j's transaction memory limit.
- Silently returns 0 if the database doesn't exist.
- """
- provider_label = get_provider_label(provider_id)
- deleted_nodes = 0
-
- try:
- with get_session(database) as session:
- # Phase 1: delete relationships incident to provider nodes in batches.
- deleted_count = 1
- while deleted_count > 0:
- result = session.run(
- f"""
- MATCH (:`{provider_label}`)-[r]-()
- WITH DISTINCT r LIMIT $batch_size
- DELETE r
- RETURN COUNT(r) AS deleted_rels_count
- """,
- {"batch_size": BATCH_SIZE},
- )
- deleted_count = result.single().get("deleted_rels_count", 0)
-
- # Phase 2: delete the now relationship-free nodes in batches.
- deleted_count = 1
- while deleted_count > 0:
- result = session.run(
- f"""
- MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
- WITH n LIMIT $batch_size
- DELETE n
- RETURN COUNT(n) AS deleted_nodes_count
- """,
- {"batch_size": BATCH_SIZE},
- )
- deleted_count = result.single().get("deleted_nodes_count", 0)
- deleted_nodes += deleted_count
-
- except GraphDatabaseQueryException as exc:
- if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
- return 0
- raise
-
- return deleted_nodes
-
-
-def has_provider_data(database: str, provider_id: str) -> bool:
- """
- Check if any ProviderResource node exists for this provider.
-
- Returns `False` if the database doesn't exist.
- """
- provider_label = get_provider_label(provider_id)
- query = f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
-
- try:
- with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
- result = session.run(query)
- return result.single() is not None
-
- except GraphDatabaseQueryException as exc:
- if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
- return False
- raise
-
-
-def clear_cache(database: str) -> None:
- query = "CALL db.clearQueryCaches()"
-
- try:
- with get_session(database) as session:
- session.run(query)
-
- except GraphDatabaseQueryException as exc:
- logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
-
-
-# Neo4j functions related to Prowler + Cartography
-
-
-def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
- prefix = "tmp-scan" if temporary else "tenant"
- return f"db-{prefix}-{str(entity_id).lower()}"
+TEMP_DB_PREFIX = "db-tmp-scan-"
+DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
# Exceptions
@@ -270,13 +42,190 @@ class GraphDatabaseQueryException(Exception):
def __str__(self) -> str:
if self.code:
return f"{self.code}: {self.message}"
-
return self.message
+class NeptuneWriteRetryExhaustedException(GraphDatabaseQueryException):
+ pass
+
+
class WriteQueryNotAllowedException(GraphDatabaseQueryException):
pass
class ClientStatementException(GraphDatabaseQueryException):
pass
+
+
+# Routing
+
+
+def _is_ingest_database(database: str | None) -> bool:
+ return bool(database) and database.startswith(TEMP_DB_PREFIX)
+
+
+# Driver lifecycle
+
+
+def init_driver() -> Any:
+ """Initialize the configured sink backend.
+
+ The ingest driver (Neo4j for cartography temp DBs) stays lazy: it is
+ only initialized when a temp-DB operation actually runs, which never
+ happens on API pods.
+ """
+ return sink_module.init()
+
+
+def close_driver() -> None:
+ """Close every driver held by this process."""
+ sink_module.close()
+ ingest.close_driver()
+
+
+def get_driver() -> neo4j.Driver:
+ """Return the sink backend's underlying driver.
+
+ Only meaningful for the Neo4j sink (where the backend has a single Neo4j
+ driver). On Neptune this returns the writer driver. Kept for tests and
+ legacy call-sites; prefer `get_session` for new code.
+ """
+ backend = sink_module.get_backend()
+
+ # Neo4jSink exposes get_driver(); NeptuneSink exposes get_writer()
+ if hasattr(backend, "get_driver"):
+ return backend.get_driver()
+
+ if hasattr(backend, "get_writer"):
+ return backend.get_writer()
+
+ raise RuntimeError("Active sink backend does not expose a driver handle")
+
+
+def verify_connectivity() -> None:
+ """Raise if the configured graph database is unreachable on the API read path.
+
+ Backend-agnostic entry point for the readiness probe: Neo4j verifies its
+ driver, Neptune verifies the reader endpoint.
+ """
+ sink_module.get_backend().verify_connectivity()
+
+
+def verify_scan_databases_available() -> None:
+ """Raise if either graph database needed by an Attack Paths scan is unavailable."""
+ errors: list[str] = []
+ first_error: Exception | None = None
+
+ try:
+ ingest.get_driver().verify_connectivity()
+ except Exception as exc:
+ errors.append(f"ingest Neo4j: {exc}")
+ first_error = exc
+
+ try:
+ get_driver().verify_connectivity()
+ except Exception as exc:
+ errors.append(f"sink {settings.ATTACK_PATHS_SINK_DATABASE}: {exc}")
+ if first_error is None:
+ first_error = exc
+
+ if errors:
+ raise RuntimeError(
+ "Attack Paths graph database unavailable before scan start: "
+ + "; ".join(errors)
+ ) from first_error
+
+
+def get_uri() -> str:
+ """Return the sink URI. Retained for backwards compatibility."""
+ if settings.ATTACK_PATHS_SINK_DATABASE == "neptune":
+ cfg = settings.DATABASES["neptune"]
+ return f"bolt+s://{cfg['WRITER_ENDPOINT']}:{cfg['PORT']}"
+
+ cfg = settings.DATABASES["neo4j"]
+ return f"bolt://{cfg['HOST']}:{cfg['PORT']}"
+
+
+def get_ingest_uri() -> str:
+ """Neo4j URI for the cartography temp (ingest) database, which is always
+ Neo4j regardless of the configured sink."""
+ return ingest.get_uri()
+
+
+# Session API
+
+
+def get_session(
+ database: str | None = None,
+ default_access_mode: str | None = None,
+) -> AbstractContextManager:
+ """Return a session against the right backend.
+
+ - `database` names starting with `db-tmp-scan-` always go to ingest.
+ - No database name → ingest (used for CREATE / DROP DATABASE admin ops).
+ - Any other name → sink.
+ """
+ if _is_ingest_database(database) or database is None:
+ return ingest.get_session(
+ database=database, default_access_mode=default_access_mode
+ )
+
+ return sink_module.get_backend().get_session(
+ database=database, default_access_mode=default_access_mode
+ )
+
+
+def execute_read_query(
+ database: str,
+ cypher: str,
+ parameters: dict[str, Any] | None = None,
+) -> neo4j.graph.Graph:
+ """Read-only query against the sink."""
+ return sink_module.get_backend().execute_read_query(database, cypher, parameters)
+
+
+def create_database(database: str) -> None:
+ """Create a database. Temp DBs always land on ingest (Neo4j).
+
+ On the Neo4j sink, tenant DBs also route to ingest because both drivers
+ connect to the same Neo4j cluster. On the Neptune sink, tenant DB creates
+ are no-ops.
+ """
+ if _is_ingest_database(database):
+ ingest.create_database(database)
+ return
+
+ sink_module.get_backend().create_database(database)
+
+
+def drop_database(database: str) -> None:
+ """Drop a database. Mirrors `create_database` routing."""
+ if _is_ingest_database(database):
+ ingest.drop_database(database)
+ return
+
+ sink_module.get_backend().drop_database(database)
+
+
+def drop_subgraph(database: str, provider_id: str) -> int:
+ return sink_module.get_backend().drop_subgraph(database, provider_id)
+
+
+def has_provider_data(database: str, provider_id: str) -> bool:
+ return sink_module.get_backend().has_provider_data(database, provider_id)
+
+
+def clear_cache(database: str) -> None:
+ if _is_ingest_database(database):
+ ingest.clear_cache(database)
+ return
+
+ sink_module.get_backend().clear_cache(database)
+
+
+# Name helper
+
+
+def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
+ prefix = "tmp-scan" if temporary else "tenant"
+ return f"db-{prefix}-{str(entity_id).lower()}"
diff --git a/api/src/backend/api/attack_paths/ingest/__init__.py b/api/src/backend/api/attack_paths/ingest/__init__.py
new file mode 100644
index 0000000000..5833b8b373
--- /dev/null
+++ b/api/src/backend/api/attack_paths/ingest/__init__.py
@@ -0,0 +1,29 @@
+"""Cartography ingest layer.
+
+Public surface for the per-scan Neo4j temp database driver. Implementation
+lives in `api.attack_paths.ingest.driver`.
+"""
+
+from api.attack_paths.ingest.driver import (
+ clear_cache,
+ close_driver,
+ create_database,
+ drop_database,
+ get_driver,
+ get_session,
+ get_uri,
+ init_driver,
+ run_cypher,
+)
+
+__all__ = [
+ "clear_cache",
+ "close_driver",
+ "create_database",
+ "drop_database",
+ "get_driver",
+ "get_session",
+ "get_uri",
+ "init_driver",
+ "run_cypher",
+]
diff --git a/api/src/backend/api/attack_paths/ingest/driver.py b/api/src/backend/api/attack_paths/ingest/driver.py
new file mode 100644
index 0000000000..1b05c721e7
--- /dev/null
+++ b/api/src/backend/api/attack_paths/ingest/driver.py
@@ -0,0 +1,187 @@
+"""Cartography ingest driver: per-scan throw-away Neo4j database.
+
+Cartography writes each scan's graph into a throw-away Neo4j database named
+`db-tmp-scan-{scan_uuid}`. This is always Neo4j, regardless of the configured
+sink: Neptune is single-database and cannot host per-scan throw-away
+databases. This module owns the Neo4j driver used for those temp DBs and the
+admin ops they need (CREATE / DROP DATABASE).
+"""
+
+import atexit
+import logging
+import threading
+from collections.abc import Iterator
+from contextlib import contextmanager
+from typing import Any
+
+import neo4j
+import neo4j.exceptions
+from api.attack_paths.retryable_session import RetryableSession
+from config.env import env
+from django.conf import settings
+
+logging.getLogger("neo4j").setLevel(logging.ERROR)
+logging.getLogger("neo4j").propagate = False
+
+SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
+ "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
+)
+CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
+# TCP connect timeout, ordered below the acquisition timeout so an unreachable
+# host can't pin a worker on a temp-DB op longer than this.
+CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
+MAX_CONNECTION_LIFETIME = env.int("NEO4J_MAX_CONNECTION_LIFETIME", default=7200)
+MAX_CONNECTION_POOL_SIZE = env.int("NEO4J_MAX_CONNECTION_POOL_SIZE", default=50)
+
+_driver: neo4j.Driver | None = None
+_lock = threading.Lock()
+
+
+def _neo4j_config() -> dict:
+ return settings.DATABASES["neo4j"]
+
+
+def get_uri() -> str:
+ """Bolt URI for the Neo4j temp (ingest) database. Always Neo4j."""
+ config = _neo4j_config()
+ host = config["HOST"]
+ port = config["PORT"]
+ if not host or not port:
+ raise RuntimeError(
+ "NEO4J_HOST / NEO4J_PORT must be set to use the attack-paths "
+ "temp database. Workers require Neo4j env even when the sink is Neptune."
+ )
+
+ return f"bolt://{host}:{port}"
+
+
+def init_driver() -> neo4j.Driver:
+ """Initialize the temp-database Neo4j driver. Idempotent."""
+ global _driver
+ if _driver is not None:
+ return _driver
+
+ with _lock:
+ if _driver is None:
+ config = _neo4j_config()
+ _driver = neo4j.GraphDatabase.driver(
+ get_uri(),
+ auth=(config["USER"], config["PASSWORD"]),
+ keep_alive=True,
+ max_connection_lifetime=MAX_CONNECTION_LIFETIME,
+ connection_timeout=CONNECTION_TIMEOUT,
+ connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
+ max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
+ )
+ # Best-effort connectivity check: a Neo4j that is down at boot must
+ # not crash the worker. The driver reconnects lazily on first use.
+ try:
+ _driver.verify_connectivity()
+
+ except Exception:
+ logging.warning(
+ "Neo4j temp-database unreachable at init; continuing with a "
+ "lazily-reconnecting driver",
+ exc_info=True,
+ )
+
+ atexit.register(close_driver)
+
+ return _driver
+
+
+def get_driver() -> neo4j.Driver:
+ return init_driver()
+
+
+def close_driver() -> None:
+ global _driver
+ with _lock:
+ if _driver is not None:
+ try:
+ _driver.close()
+ finally:
+ _driver = None
+
+
+@contextmanager
+def get_session(
+ database: str | None = None,
+ default_access_mode: str | None = None,
+) -> Iterator[RetryableSession]:
+ """Session against the Neo4j temp-database cluster. Used for temp DB sessions
+ and for admin operations (CREATE / DROP DATABASE) when `database` is None."""
+ from api.attack_paths.database import (
+ ClientStatementException,
+ GraphDatabaseQueryException,
+ WriteQueryNotAllowedException,
+ )
+
+ READ_EXCEPTION_CODES = [
+ "Neo.ClientError.Statement.AccessMode",
+ "Neo.ClientError.Procedure.ProcedureNotFound",
+ ]
+ CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
+
+ session_wrapper: RetryableSession | None = None
+ try:
+ session_wrapper = RetryableSession(
+ session_factory=lambda: get_driver().session(
+ database=database, default_access_mode=default_access_mode
+ ),
+ max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
+ )
+ yield session_wrapper
+
+ except neo4j.exceptions.Neo4jError as exc:
+ if (
+ default_access_mode == neo4j.READ_ACCESS
+ and exc.code
+ and exc.code in READ_EXCEPTION_CODES
+ ):
+ raise WriteQueryNotAllowedException(
+ message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
+ )
+
+ message = exc.message if exc.message is not None else str(exc)
+ if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
+ raise ClientStatementException(message=message, code=exc.code)
+ raise GraphDatabaseQueryException(message=message, code=exc.code)
+
+ finally:
+ if session_wrapper is not None:
+ session_wrapper.close()
+
+
+def create_database(database: str) -> None:
+ """Create a database on the Neo4j cluster. Used for temp scan DBs."""
+ with get_session() as session:
+ session.run("CREATE DATABASE $database IF NOT EXISTS", {"database": database})
+
+
+def drop_database(database: str) -> None:
+ """Drop a database on the Neo4j cluster. Used for temp scan DBs."""
+ with get_session() as session:
+ session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")
+
+
+def clear_cache(database: str) -> None:
+ """Best-effort cache clear for a Neo4j database."""
+ from api.attack_paths.database import GraphDatabaseQueryException
+
+ try:
+ with get_session(database) as session:
+ session.run("CALL db.clearQueryCaches()")
+
+ except GraphDatabaseQueryException as exc:
+ logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
+
+
+def run_cypher(
+ database: str | None,
+ cypher: str,
+ parameters: dict[str, Any] | None = None,
+) -> Any:
+ """Execute Cypher directly without the context manager. Thin helper."""
+ with get_session(database) as session:
+ return session.run(cypher, parameters or {})
diff --git a/api/src/backend/api/attack_paths/queries/aws.py b/api/src/backend/api/attack_paths/queries/aws.py
index d9792845c0..60660a1632 100644
--- a/api/src/backend/api/attack_paths/queries/aws.py
+++ b/api/src/backend/api/attack_paths/queries/aws.py
@@ -6,7 +6,6 @@ from api.attack_paths.queries.types import (
from tasks.jobs.attack_paths.config import PROWLER_FINDING_LABEL
# Custom Attack Path Queries
-# --------------------------
AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS = AttackPathsQueryDefinition(
id="aws-internet-exposed-ec2-sensitive-s3-access",
@@ -22,14 +21,18 @@ AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS = AttackPathsQueryDefinition(
WHERE ec2.exposed_internet = true
AND ipi.toport = 22
- MATCH path_role = (r:AWSRole)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE ANY(x IN stmt.resource WHERE x CONTAINS s3.name)
- AND ANY(x IN stmt.action WHERE toLower(x) =~ 's3:(listbucket|getobject).*')
+ MATCH path_role = (r:AWSRole)-[:POLICY]->(pol:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value CONTAINS s3.name
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) STARTS WITH 's3:listbucket'
+ OR toLower(act.value) STARTS WITH 's3:getobject'
MATCH path_assume_role = (ec2)-[p:STS_ASSUMEROLE_ALLOW*1..9]-(r:AWSRole)
OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(ec2)
+ WITH DISTINCT path_s3, path_ec2, path_role, path_assume_role, internet, can_access
WITH collect(path_s3) + collect(path_ec2) + collect(path_role) + collect(path_assume_role) AS paths,
head(collect(internet)) AS internet, collect(can_access) AS can_access
UNWIND paths AS p
@@ -37,7 +40,7 @@ AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -59,7 +62,6 @@ AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS = AttackPathsQueryDefinition(
# Basic Resource Queries
-# ----------------------
AWS_RDS_INSTANCES = AttackPathsQueryDefinition(
id="aws-rds-instances",
@@ -76,7 +78,7 @@ AWS_RDS_INSTANCES = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -99,7 +101,7 @@ AWS_RDS_UNENCRYPTED_STORAGE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -122,7 +124,7 @@ AWS_S3_ANONYMOUS_ACCESS_BUCKETS = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -136,17 +138,18 @@ AWS_IAM_STATEMENTS_ALLOW_ALL_ACTIONS = AttackPathsQueryDefinition(
description="Find IAM policy statements that allow all actions via '*' within the selected account.",
provider="aws",
cypher=f"""
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(x IN stmt.action WHERE x = '*')
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(pol:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE act.value = '*'
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]->(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -160,17 +163,18 @@ AWS_IAM_STATEMENTS_ALLOW_DELETE_POLICY = AttackPathsQueryDefinition(
description="Find IAM policy statements that allow the iam:DeletePolicy action within the selected account.",
provider="aws",
cypher=f"""
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(x IN stmt.action WHERE x = "iam:DeletePolicy")
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(pol:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE act.value = 'iam:DeletePolicy'
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -184,17 +188,18 @@ AWS_IAM_STATEMENTS_ALLOW_CREATE_ACTIONS = AttackPathsQueryDefinition(
description="Find IAM policy statements that allow actions containing 'create' within the selected account.",
provider="aws",
cypher=f"""
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = "Allow"
- AND any(x IN stmt.action WHERE toLower(x) CONTAINS "create")
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(pol:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) CONTAINS 'create'
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -203,7 +208,6 @@ AWS_IAM_STATEMENTS_ALLOW_CREATE_ACTIONS = AttackPathsQueryDefinition(
# Network Exposure Queries
-# ------------------------
AWS_EC2_INSTANCES_INTERNET_EXPOSED = AttackPathsQueryDefinition(
id="aws-ec2-instances-internet-exposed",
@@ -223,7 +227,7 @@ AWS_EC2_INSTANCES_INTERNET_EXPOSED = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -249,7 +253,7 @@ AWS_SECURITY_GROUPS_OPEN_INTERNET_FACING = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -274,7 +278,7 @@ AWS_CLASSIC_ELB_INTERNET_EXPOSED = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -299,7 +303,7 @@ AWS_ELBV2_INTERNET_EXPOSED = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -327,7 +331,7 @@ AWS_PUBLIC_IP_RESOURCE_LOOKUP = AttackPathsQueryDefinition(
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
""",
@@ -343,7 +347,6 @@ AWS_PUBLIC_IP_RESOURCE_LOOKUP = AttackPathsQueryDefinition(
# Privilege Escalation Queries (based on pathfinding.cloud research)
# https://github.com/DataDog/pathfinding.cloud
-# -------------------------------------------------------------------
# APPRUNNER-001
AWS_APPRUNNER_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
@@ -358,31 +361,27 @@ AWS_APPRUNNER_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find apprunner:CreateService permission
- MATCH (principal)--(apprunner_policy:AWSPolicy)--(stmt_apprunner:AWSPolicyStatement)
- WHERE stmt_apprunner.effect = 'Allow'
- AND any(action IN stmt_apprunner.action WHERE
- toLower(action) = 'apprunner:createservice'
- OR toLower(action) = 'apprunner:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(apprunner_policy:AWSPolicy)-[:STATEMENT]->(stmt_apprunner:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_apprunner)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['apprunner:*', 'apprunner:createservice']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust App Runner tasks service (can be passed to App Runner)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'tasks.apprunner.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -390,7 +389,7 @@ AWS_APPRUNNER_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -410,25 +409,24 @@ AWS_APPRUNNER_PRIVESC_UPDATE_SERVICE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with apprunner:UpdateService permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(update_policy:AWSPolicy)--(stmt_update:AWSPolicyStatement)
- WHERE stmt_update.effect = 'Allow'
- AND any(action IN stmt_update.action WHERE
- toLower(action) = 'apprunner:updateservice'
- OR toLower(action) = 'apprunner:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(update_policy:AWSPolicy)-[:STATEMENT]->(stmt_update:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_update)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['apprunner:*', 'apprunner:updateservice']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find existing App Runner services with roles attached (potential targets)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'tasks.apprunner.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -448,49 +446,41 @@ AWS_BEDROCK_PRIVESC_PASSROLE_CODE_INTERPRETER = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find bedrock-agentcore:CreateCodeInterpreter permission
- MATCH (principal)--(bedrock_policy:AWSPolicy)--(stmt_bedrock:AWSPolicyStatement)
- WHERE stmt_bedrock.effect = 'Allow'
- AND any(action IN stmt_bedrock.action WHERE
- toLower(action) = 'bedrock-agentcore:createcodeinterpreter'
- OR toLower(action) = 'bedrock-agentcore:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(bedrock_policy:AWSPolicy)-[:STATEMENT]->(stmt_bedrock:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_bedrock)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['bedrock-agentcore:*', 'bedrock-agentcore:createcodeinterpreter']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find bedrock-agentcore:StartCodeInterpreterSession permission
- MATCH (principal)--(session_policy:AWSPolicy)--(stmt_session:AWSPolicyStatement)
- WHERE stmt_session.effect = 'Allow'
- AND any(action IN stmt_session.action WHERE
- toLower(action) = 'bedrock-agentcore:startcodeinterpretersession'
- OR toLower(action) = 'bedrock-agentcore:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(session_policy:AWSPolicy)-[:STATEMENT]->(stmt_session:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_session)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['bedrock-agentcore:*', 'bedrock-agentcore:startcodeinterpretersession']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find bedrock-agentcore:InvokeCodeInterpreter permission
- MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
- WHERE stmt_invoke.effect = 'Allow'
- AND any(action IN stmt_invoke.action WHERE
- toLower(action) = 'bedrock-agentcore:invokecodeinterpreter'
- OR toLower(action) = 'bedrock-agentcore:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(invoke_policy:AWSPolicy)-[:STATEMENT]->(stmt_invoke:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_invoke)-[:HAS_ACTION]->(act4:AWSPolicyStatementActionItem)
+ WHERE toLower(act4.value) IN ['bedrock-agentcore:*', 'bedrock-agentcore:invokecodeinterpreter']
+ OR act4.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust the Bedrock AgentCore service (can be passed to a code interpreter)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'bedrock-agentcore.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -498,7 +488,7 @@ AWS_BEDROCK_PRIVESC_PASSROLE_CODE_INTERPRETER = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -518,34 +508,31 @@ AWS_BEDROCK_PRIVESC_INVOKE_CODE_INTERPRETER = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with bedrock-agentcore:StartCodeInterpreterSession permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(session_policy:AWSPolicy)--(stmt_session:AWSPolicyStatement)
- WHERE stmt_session.effect = 'Allow'
- AND any(action IN stmt_session.action WHERE
- toLower(action) = 'bedrock-agentcore:startcodeinterpretersession'
- OR toLower(action) = 'bedrock-agentcore:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(session_policy:AWSPolicy)-[:STATEMENT]->(stmt_session:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_session)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['bedrock-agentcore:*', 'bedrock-agentcore:startcodeinterpretersession']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
// Find bedrock-agentcore:InvokeCodeInterpreter permission
- MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
- WHERE stmt_invoke.effect = 'Allow'
- AND any(action IN stmt_invoke.action WHERE
- toLower(action) = 'bedrock-agentcore:invokecodeinterpreter'
- OR toLower(action) = 'bedrock-agentcore:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(invoke_policy:AWSPolicy)-[:STATEMENT]->(stmt_invoke:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_invoke)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['bedrock-agentcore:*', 'bedrock-agentcore:invokecodeinterpreter']
+ OR act2.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust the Bedrock AgentCore service (already attached to existing code interpreters)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'bedrock-agentcore.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -565,31 +552,27 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACK = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find cloudformation:CreateStack permission
- MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
- WHERE stmt_cfn.effect = 'Allow'
- AND any(action IN stmt_cfn.action WHERE
- toLower(action) = 'cloudformation:createstack'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(cfn_policy:AWSPolicy)-[:STATEMENT]->(stmt_cfn:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_cfn)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['cloudformation:*', 'cloudformation:createstack']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust CloudFormation service (can be passed to CloudFormation)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -597,7 +580,7 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACK = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -617,25 +600,24 @@ AWS_CLOUDFORMATION_PRIVESC_UPDATE_STACK = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with cloudformation:UpdateStack permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(update_policy:AWSPolicy)--(stmt_update:AWSPolicyStatement)
- WHERE stmt_update.effect = 'Allow'
- AND any(action IN stmt_update.action WHERE
- toLower(action) = 'cloudformation:updatestack'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(update_policy:AWSPolicy)-[:STATEMENT]->(stmt_update:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_update)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['cloudformation:*', 'cloudformation:updatestack']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust CloudFormation service (already attached to existing stacks)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -655,40 +637,34 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACKSET = AttackPathsQueryDefinition
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find cloudformation:CreateStackSet permission
- MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
- WHERE stmt_cfn.effect = 'Allow'
- AND any(action IN stmt_cfn.action WHERE
- toLower(action) = 'cloudformation:createstackset'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(cfn_policy:AWSPolicy)-[:STATEMENT]->(stmt_cfn:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_cfn)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['cloudformation:*', 'cloudformation:createstackset']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find cloudformation:CreateStackInstances permission
- MATCH (principal)--(cfn_instances_policy:AWSPolicy)--(stmt_cfn_instances:AWSPolicyStatement)
- WHERE stmt_cfn_instances.effect = 'Allow'
- AND any(action IN stmt_cfn_instances.action WHERE
- toLower(action) = 'cloudformation:createstackinstances'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(cfn_instances_policy:AWSPolicy)-[:STATEMENT]->(stmt_cfn_instances:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_cfn_instances)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['cloudformation:*', 'cloudformation:createstackinstances']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust CloudFormation service (can be passed as execution role)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -696,7 +672,7 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACKSET = AttackPathsQueryDefinition
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -716,31 +692,27 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_UPDATE_STACKSET = AttackPathsQueryDefinition
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find cloudformation:UpdateStackSet permission
- MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
- WHERE stmt_cfn.effect = 'Allow'
- AND any(action IN stmt_cfn.action WHERE
- toLower(action) = 'cloudformation:updatestackset'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(cfn_policy:AWSPolicy)-[:STATEMENT]->(stmt_cfn:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_cfn)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['cloudformation:*', 'cloudformation:updatestackset']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust CloudFormation service (can be passed as execution role)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -748,7 +720,7 @@ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_UPDATE_STACKSET = AttackPathsQueryDefinition
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -768,34 +740,31 @@ AWS_CLOUDFORMATION_PRIVESC_CHANGESET = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with cloudformation:CreateChangeSet permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'cloudformation:createchangeset'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['cloudformation:*', 'cloudformation:createchangeset']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
// Find cloudformation:ExecuteChangeSet permission
- MATCH (principal)--(exec_policy:AWSPolicy)--(stmt_exec:AWSPolicyStatement)
- WHERE stmt_exec.effect = 'Allow'
- AND any(action IN stmt_exec.action WHERE
- toLower(action) = 'cloudformation:executechangeset'
- OR toLower(action) = 'cloudformation:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(exec_policy:AWSPolicy)-[:STATEMENT]->(stmt_exec:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_exec)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['cloudformation:*', 'cloudformation:executechangeset']
+ OR act2.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust CloudFormation service (already attached to existing stacks)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -815,40 +784,34 @@ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find codebuild:CreateProject permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'codebuild:createproject'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['codebuild:*', 'codebuild:createproject']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find codebuild:StartBuild permission
- MATCH (principal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
- WHERE stmt_build.effect = 'Allow'
- AND any(action IN stmt_build.action WHERE
- toLower(action) = 'codebuild:startbuild'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(build_policy:AWSPolicy)-[:STATEMENT]->(stmt_build:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_build)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['codebuild:*', 'codebuild:startbuild']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust CodeBuild service (can be passed to CodeBuild)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -856,7 +819,7 @@ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -876,25 +839,24 @@ AWS_CODEBUILD_PRIVESC_START_BUILD = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with codebuild:StartBuild permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
- WHERE stmt_build.effect = 'Allow'
- AND any(action IN stmt_build.action WHERE
- toLower(action) = 'codebuild:startbuild'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(build_policy:AWSPolicy)-[:STATEMENT]->(stmt_build:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_build)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['codebuild:*', 'codebuild:startbuild']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust CodeBuild service (already attached to existing projects)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -914,25 +876,24 @@ AWS_CODEBUILD_PRIVESC_START_BUILD_BATCH = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with codebuild:StartBuildBatch permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
- WHERE stmt_build.effect = 'Allow'
- AND any(action IN stmt_build.action WHERE
- toLower(action) = 'codebuild:startbuildbatch'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(build_policy:AWSPolicy)-[:STATEMENT]->(stmt_build:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_build)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['codebuild:*', 'codebuild:startbuildbatch']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust CodeBuild service (already attached to existing projects)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -952,40 +913,34 @@ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT_BATCH = AttackPathsQueryDefinition
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find codebuild:CreateProject permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'codebuild:createproject'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['codebuild:*', 'codebuild:createproject']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find codebuild:StartBuildBatch permission
- MATCH (principal)--(batch_policy:AWSPolicy)--(stmt_batch:AWSPolicyStatement)
- WHERE stmt_batch.effect = 'Allow'
- AND any(action IN stmt_batch.action WHERE
- toLower(action) = 'codebuild:startbuildbatch'
- OR toLower(action) = 'codebuild:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(batch_policy:AWSPolicy)-[:STATEMENT]->(stmt_batch:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_batch)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['codebuild:*', 'codebuild:startbuildbatch']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust CodeBuild service (can be passed to CodeBuild)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -993,7 +948,7 @@ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT_BATCH = AttackPathsQueryDefinition
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1013,50 +968,42 @@ AWS_DATAPIPELINE_PRIVESC_PASSROLE_CREATE_PIPELINE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find datapipeline:CreatePipeline permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'datapipeline:createpipeline'
- OR toLower(action) = 'datapipeline:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['datapipeline:*', 'datapipeline:createpipeline']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find datapipeline:PutPipelineDefinition permission
- MATCH (principal)--(put_policy:AWSPolicy)--(stmt_put:AWSPolicyStatement)
- WHERE stmt_put.effect = 'Allow'
- AND any(action IN stmt_put.action WHERE
- toLower(action) = 'datapipeline:putpipelinedefinition'
- OR toLower(action) = 'datapipeline:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(put_policy:AWSPolicy)-[:STATEMENT]->(stmt_put:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_put)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['datapipeline:*', 'datapipeline:putpipelinedefinition']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find datapipeline:ActivatePipeline permission
- MATCH (principal)--(activate_policy:AWSPolicy)--(stmt_activate:AWSPolicyStatement)
- WHERE stmt_activate.effect = 'Allow'
- AND any(action IN stmt_activate.action WHERE
- toLower(action) = 'datapipeline:activatepipeline'
- OR toLower(action) = 'datapipeline:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(activate_policy:AWSPolicy)-[:STATEMENT]->(stmt_activate:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_activate)-[:HAS_ACTION]->(act4:AWSPolicyStatementActionItem)
+ WHERE toLower(act4.value) IN ['datapipeline:*', 'datapipeline:activatepipeline']
+ OR act4.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Data Pipeline or EMR service (can be passed to DataPipeline)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted_principal:AWSPrincipal)
WHERE trusted_principal.arn IN ['datapipeline.amazonaws.com', 'elasticmapreduce.amazonaws.com']
- AND any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1064,7 +1011,7 @@ AWS_DATAPIPELINE_PRIVESC_PASSROLE_CREATE_PIPELINE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1084,31 +1031,27 @@ AWS_EC2_PRIVESC_PASSROLE_IAM = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find ec2:RunInstances permission
- MATCH (principal)--(ec2_policy:AWSPolicy)--(stmt_ec2:AWSPolicyStatement)
- WHERE stmt_ec2.effect = 'Allow'
- AND any(action IN stmt_ec2.action WHERE
- toLower(action) = 'ec2:runinstances'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(ec2_policy:AWSPolicy)-[:STATEMENT]->(stmt_ec2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_ec2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['ec2:*', 'ec2:runinstances']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust EC2 service (can be passed to EC2)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ec2.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1116,7 +1059,7 @@ AWS_EC2_PRIVESC_PASSROLE_IAM = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1136,43 +1079,38 @@ AWS_EC2_PRIVESC_MODIFY_INSTANCE_ATTRIBUTE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with ec2:ModifyInstanceAttribute permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(modify_policy:AWSPolicy)--(stmt_modify:AWSPolicyStatement)
- WHERE stmt_modify.effect = 'Allow'
- AND any(action IN stmt_modify.action WHERE
- toLower(action) = 'ec2:modifyinstanceattribute'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(modify_policy:AWSPolicy)-[:STATEMENT]->(stmt_modify:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_modify)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ec2:*', 'ec2:modifyinstanceattribute']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
// Find ec2:StopInstances permission (can be same or different policy)
- MATCH (principal)--(stop_policy:AWSPolicy)--(stmt_stop:AWSPolicyStatement)
- WHERE stmt_stop.effect = 'Allow'
- AND any(action IN stmt_stop.action WHERE
- toLower(action) = 'ec2:stopinstances'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(stop_policy:AWSPolicy)-[:STATEMENT]->(stmt_stop:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_stop)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['ec2:*', 'ec2:stopinstances']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, path_principal
// Find ec2:StartInstances permission (can be same or different policy)
- MATCH (principal)--(start_policy:AWSPolicy)--(stmt_start:AWSPolicyStatement)
- WHERE stmt_start.effect = 'Allow'
- AND any(action IN stmt_start.action WHERE
- toLower(action) = 'ec2:startinstances'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(start_policy:AWSPolicy)-[:STATEMENT]->(stmt_start:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_start)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['ec2:*', 'ec2:startinstances']
+ OR act3.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find EC2 instances with instance profiles (potential targets)
MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1192,31 +1130,27 @@ AWS_EC2_PRIVESC_PASSROLE_SPOT_INSTANCES = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find ec2:RequestSpotInstances permission
- MATCH (principal)--(spot_policy:AWSPolicy)--(stmt_spot:AWSPolicyStatement)
- WHERE stmt_spot.effect = 'Allow'
- AND any(action IN stmt_spot.action WHERE
- toLower(action) = 'ec2:requestspotinstances'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(spot_policy:AWSPolicy)-[:STATEMENT]->(stmt_spot:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_spot)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['ec2:*', 'ec2:requestspotinstances']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust EC2 service (can be passed to EC2 spot instances)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ec2.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1224,7 +1158,7 @@ AWS_EC2_PRIVESC_PASSROLE_SPOT_INSTANCES = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1244,34 +1178,31 @@ AWS_EC2_PRIVESC_LAUNCH_TEMPLATE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with ec2:CreateLaunchTemplateVersion permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'ec2:createlaunchtemplateversion'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ec2:*', 'ec2:createlaunchtemplateversion']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
// Find ec2:ModifyLaunchTemplate permission
- MATCH (principal)--(modify_policy:AWSPolicy)--(stmt_modify:AWSPolicyStatement)
- WHERE stmt_modify.effect = 'Allow'
- AND any(action IN stmt_modify.action WHERE
- toLower(action) = 'ec2:modifylaunchtemplate'
- OR toLower(action) = 'ec2:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(modify_policy:AWSPolicy)-[:STATEMENT]->(stmt_modify:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_modify)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['ec2:*', 'ec2:modifylaunchtemplate']
+ OR act2.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find launch templates in the account (potential targets)
MATCH path_target = (aws)--(template:LaunchTemplate)
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1291,25 +1222,24 @@ AWS_EC2INSTANCECONNECT_PRIVESC_SEND_SSH_PUBLIC_KEY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with ec2-instance-connect:SendSSHPublicKey permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(connect_policy:AWSPolicy)--(stmt_connect:AWSPolicyStatement)
- WHERE stmt_connect.effect = 'Allow'
- AND any(action IN stmt_connect.action WHERE
- toLower(action) = 'ec2-instance-connect:sendsshpublickey'
- OR toLower(action) = 'ec2-instance-connect:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(connect_policy:AWSPolicy)-[:STATEMENT]->(stmt_connect:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_connect)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ec2-instance-connect:*', 'ec2-instance-connect:sendsshpublickey']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find EC2 instances with attached roles (targets for credential theft via IMDS)
MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1328,58 +1258,46 @@ AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
link="https://pathfinding.cloud/paths/ecs-001",
),
cypher=f"""
- // Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PassRole permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:CreateCluster permission
- MATCH (principal)--(cluster_policy:AWSPolicy)--(stmt_cluster:AWSPolicyStatement)
- WHERE stmt_cluster.effect = 'Allow'
- AND any(action IN stmt_cluster.action WHERE
- toLower(action) = 'ecs:createcluster'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:CreateCluster (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:createcluster']
+ OR a2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RegisterTaskDefinition permission
- MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
- WHERE stmt_taskdef.effect = 'Allow'
- AND any(action IN stmt_taskdef.action WHERE
- toLower(action) = 'ecs:registertaskdefinition'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RegisterTaskDefinition (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a3:AWSPolicyStatementActionItem)
+ WHERE toLower(a3.value) IN ['ecs:*', 'ecs:registertaskdefinition']
+ OR a3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:CreateService permission
- MATCH (principal)--(service_policy:AWSPolicy)--(stmt_service:AWSPolicyStatement)
- WHERE stmt_service.effect = 'Allow'
- AND any(action IN stmt_service.action WHERE
- toLower(action) = 'ecs:createservice'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:CreateService (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a4:AWSPolicyStatementActionItem)
+ WHERE toLower(a4.value) IN ['ecs:*', 'ecs:createservice']
+ OR a4.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ // Target: a role trusting ECS tasks that the passrole resource can target
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1398,58 +1316,48 @@ AWS_ECS_PRIVESC_PASSROLE_RUN_TASK = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PassRole permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
- // Find ecs:CreateCluster permission
- MATCH (principal)--(cluster_policy:AWSPolicy)--(stmt_cluster:AWSPolicyStatement)
- WHERE stmt_cluster.effect = 'Allow'
- AND any(action IN stmt_cluster.action WHERE
- toLower(action) = 'ecs:createcluster'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Collapse: one row per (passrole chain), independent of how many action items matched
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RegisterTaskDefinition permission
- MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
- WHERE stmt_taskdef.effect = 'Allow'
- AND any(action IN stmt_taskdef.action WHERE
- toLower(action) = 'ecs:registertaskdefinition'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:CreateCluster exists on the principal -> collapse back to one row
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(s2:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:createcluster']
+ OR a2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RunTask permission
- MATCH (principal)--(runtask_policy:AWSPolicy)--(stmt_runtask:AWSPolicyStatement)
- WHERE stmt_runtask.effect = 'Allow'
- AND any(action IN stmt_runtask.action WHERE
- toLower(action) = 'ecs:runtask'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RegisterTaskDefinition exists on the principal
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(s3:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a3:AWSPolicyStatementActionItem)
+ WHERE toLower(a3.value) IN ['ecs:*', 'ecs:registertaskdefinition']
+ OR a3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ // Gate: ecs:RunTask exists on the principal
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(s4:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a4:AWSPolicyStatementActionItem)
+ WHERE toLower(a4.value) IN ['ecs:*', 'ecs:runtask']
+ OR a4.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
+
+ // Target: a role that trusts ECS tasks and that the passrole resource can target
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1468,49 +1376,40 @@ AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE_EXISTING_CLUSTER = AttackPathsQueryDefin
),
provider="aws",
cypher=f"""
- // Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PassRole permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RegisterTaskDefinition permission
- MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
- WHERE stmt_taskdef.effect = 'Allow'
- AND any(action IN stmt_taskdef.action WHERE
- toLower(action) = 'ecs:registertaskdefinition'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RegisterTaskDefinition (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:registertaskdefinition']
+ OR a2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:CreateService permission
- MATCH (principal)--(service_policy:AWSPolicy)--(stmt_service:AWSPolicyStatement)
- WHERE stmt_service.effect = 'Allow'
- AND any(action IN stmt_service.action WHERE
- toLower(action) = 'ecs:createservice'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:CreateService (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a3:AWSPolicyStatementActionItem)
+ WHERE toLower(a3.value) IN ['ecs:*', 'ecs:createservice']
+ OR a3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ // Target: a role trusting ECS tasks that the passrole resource can target
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1529,49 +1428,40 @@ AWS_ECS_PRIVESC_PASSROLE_RUN_TASK_EXISTING_CLUSTER = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PassRole permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RegisterTaskDefinition permission
- MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
- WHERE stmt_taskdef.effect = 'Allow'
- AND any(action IN stmt_taskdef.action WHERE
- toLower(action) = 'ecs:registertaskdefinition'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RegisterTaskDefinition (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:registertaskdefinition']
+ OR a2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RunTask permission
- MATCH (principal)--(runtask_policy:AWSPolicy)--(stmt_runtask:AWSPolicyStatement)
- WHERE stmt_runtask.effect = 'Allow'
- AND any(action IN stmt_runtask.action WHERE
- toLower(action) = 'ecs:runtask'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RunTask (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a3:AWSPolicyStatementActionItem)
+ WHERE toLower(a3.value) IN ['ecs:*', 'ecs:runtask']
+ OR a3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ // Target: a role trusting ECS tasks that the passrole resource can target
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1590,49 +1480,40 @@ AWS_ECS_PRIVESC_PASSROLE_START_TASK_EXISTING_CLUSTER = AttackPathsQueryDefinitio
),
provider="aws",
cypher=f"""
- // Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PassRole permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:RegisterTaskDefinition permission
- MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
- WHERE stmt_taskdef.effect = 'Allow'
- AND any(action IN stmt_taskdef.action WHERE
- toLower(action) = 'ecs:registertaskdefinition'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:RegisterTaskDefinition (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:registertaskdefinition']
+ OR a2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find ecs:StartTask permission
- MATCH (principal)--(starttask_policy:AWSPolicy)--(stmt_starttask:AWSPolicyStatement)
- WHERE stmt_starttask.effect = 'Allow'
- AND any(action IN stmt_starttask.action WHERE
- toLower(action) = 'ecs:starttask'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:StartTask (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a3:AWSPolicyStatementActionItem)
+ WHERE toLower(a3.value) IN ['ecs:*', 'ecs:starttask']
+ OR a3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
- // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ // Target: a role trusting ECS tasks that the passrole resource can target
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1651,35 +1532,30 @@ AWS_ECS_PRIVESC_EXECUTE_COMMAND = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with ecs:ExecuteCommand permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(exec_policy:AWSPolicy)--(stmt_exec:AWSPolicyStatement)
- WHERE stmt_exec.effect = 'Allow'
- AND any(action IN stmt_exec.action WHERE
- toLower(action) = 'ecs:executecommand'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Find principals with ecs:ExecuteCommand permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(exec_policy:AWSPolicy)-[:STATEMENT]->(stmt_exec:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_exec)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ecs:*', 'ecs:executecommand']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
- // Find ecs:DescribeTasks permission (required by AWS CLI to get container runtime ID)
- MATCH (principal)--(describe_policy:AWSPolicy)--(stmt_describe:AWSPolicyStatement)
- WHERE stmt_describe.effect = 'Allow'
- AND any(action IN stmt_describe.action WHERE
- toLower(action) = 'ecs:describetasks'
- OR toLower(action) = 'ecs:*'
- OR action = '*'
- )
+ // Gate: ecs:DescribeTasks (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(a2:AWSPolicyStatementActionItem)
+ WHERE toLower(a2.value) IN ['ecs:*', 'ecs:describetasks']
+ OR a2.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
- // Find roles that trust ECS tasks service (already attached to running tasks)
+ // Target: roles already attached to running tasks (trust ECS tasks service)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1699,31 +1575,27 @@ AWS_GLUE_PRIVESC_PASSROLE_DEV_ENDPOINT = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:CreateDevEndpoint permission
- MATCH (principal)--(glue_policy:AWSPolicy)--(stmt_glue:AWSPolicyStatement)
- WHERE stmt_glue.effect = 'Allow'
- AND any(action IN stmt_glue.action WHERE
- toLower(action) = 'glue:createdevendpoint'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(glue_policy:AWSPolicy)-[:STATEMENT]->(stmt_glue:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_glue)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['glue:*', 'glue:createdevendpoint']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Glue service (can be passed to Glue)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1731,7 +1603,7 @@ AWS_GLUE_PRIVESC_PASSROLE_DEV_ENDPOINT = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1751,25 +1623,24 @@ AWS_GLUE_PRIVESC_UPDATE_DEV_ENDPOINT = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with glue:UpdateDevEndpoint permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'glue:updatedevendpoint'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['glue:*', 'glue:updatedevendpoint']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find roles that trust Glue service (already attached to existing dev endpoints)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1789,40 +1660,34 @@ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:CreateJob permission
- MATCH (principal)--(createjob_policy:AWSPolicy)--(stmt_createjob:AWSPolicyStatement)
- WHERE stmt_createjob.effect = 'Allow'
- AND any(action IN stmt_createjob.action WHERE
- toLower(action) = 'glue:createjob'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(createjob_policy:AWSPolicy)-[:STATEMENT]->(stmt_createjob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_createjob)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['glue:*', 'glue:createjob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:StartJobRun permission
- MATCH (principal)--(startjob_policy:AWSPolicy)--(stmt_startjob:AWSPolicyStatement)
- WHERE stmt_startjob.effect = 'Allow'
- AND any(action IN stmt_startjob.action WHERE
- toLower(action) = 'glue:startjobrun'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(startjob_policy:AWSPolicy)-[:STATEMENT]->(stmt_startjob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_startjob)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['glue:*', 'glue:startjobrun']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Glue service (can be passed to Glue jobs)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1830,7 +1695,7 @@ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1850,40 +1715,34 @@ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB_TRIGGER = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:CreateJob permission
- MATCH (principal)--(createjob_policy:AWSPolicy)--(stmt_createjob:AWSPolicyStatement)
- WHERE stmt_createjob.effect = 'Allow'
- AND any(action IN stmt_createjob.action WHERE
- toLower(action) = 'glue:createjob'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(createjob_policy:AWSPolicy)-[:STATEMENT]->(stmt_createjob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_createjob)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['glue:*', 'glue:createjob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:CreateTrigger permission
- MATCH (principal)--(trigger_policy:AWSPolicy)--(stmt_trigger:AWSPolicyStatement)
- WHERE stmt_trigger.effect = 'Allow'
- AND any(action IN stmt_trigger.action WHERE
- toLower(action) = 'glue:createtrigger'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(trigger_policy:AWSPolicy)-[:STATEMENT]->(stmt_trigger:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_trigger)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['glue:*', 'glue:createtrigger']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Glue service (can be passed to Glue jobs)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1891,7 +1750,7 @@ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB_TRIGGER = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1911,40 +1770,34 @@ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:UpdateJob permission
- MATCH (principal)--(updatejob_policy:AWSPolicy)--(stmt_updatejob:AWSPolicyStatement)
- WHERE stmt_updatejob.effect = 'Allow'
- AND any(action IN stmt_updatejob.action WHERE
- toLower(action) = 'glue:updatejob'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(updatejob_policy:AWSPolicy)-[:STATEMENT]->(stmt_updatejob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_updatejob)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['glue:*', 'glue:updatejob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:StartJobRun permission
- MATCH (principal)--(startjob_policy:AWSPolicy)--(stmt_startjob:AWSPolicyStatement)
- WHERE stmt_startjob.effect = 'Allow'
- AND any(action IN stmt_startjob.action WHERE
- toLower(action) = 'glue:startjobrun'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(startjob_policy:AWSPolicy)-[:STATEMENT]->(stmt_startjob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_startjob)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['glue:*', 'glue:startjobrun']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Glue service (can be passed to Glue jobs)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -1952,7 +1805,7 @@ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -1972,40 +1825,34 @@ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB_TRIGGER = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:UpdateJob permission
- MATCH (principal)--(updatejob_policy:AWSPolicy)--(stmt_updatejob:AWSPolicyStatement)
- WHERE stmt_updatejob.effect = 'Allow'
- AND any(action IN stmt_updatejob.action WHERE
- toLower(action) = 'glue:updatejob'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(updatejob_policy:AWSPolicy)-[:STATEMENT]->(stmt_updatejob:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_updatejob)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['glue:*', 'glue:updatejob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find glue:CreateTrigger permission
- MATCH (principal)--(trigger_policy:AWSPolicy)--(stmt_trigger:AWSPolicyStatement)
- WHERE stmt_trigger.effect = 'Allow'
- AND any(action IN stmt_trigger.action WHERE
- toLower(action) = 'glue:createtrigger'
- OR toLower(action) = 'glue:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(trigger_policy:AWSPolicy)-[:STATEMENT]->(stmt_trigger:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_trigger)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['glue:*', 'glue:createtrigger']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Glue service (can be passed to Glue jobs)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2013,7 +1860,7 @@ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB_TRIGGER = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2033,22 +1880,20 @@ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:CreatePolicyVersion permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createpolicyversion'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createpolicyversion']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find customer-managed policies attached to the same principal that can be overwritten
MATCH path_target = (aws)--(target_policy:AWSPolicy)--(principal)
WHERE target_policy.arn CONTAINS $provider_uid
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_policy.arn CONTAINS resource
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR target_policy.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2056,7 +1901,7 @@ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2076,22 +1921,20 @@ AWS_IAM_PRIVESC_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:CreateAccessKey permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createaccesskey'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createaccesskey']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target users that the principal can create access keys for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2099,7 +1942,7 @@ AWS_IAM_PRIVESC_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2118,45 +1961,39 @@ AWS_IAM_PRIVESC_DELETE_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:CreateAccessKey permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createaccesskey'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:CreateAccessKey permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createaccesskey']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:DeleteAccessKey permission
- MATCH (principal)--(delete_policy:AWSPolicy)--(stmt_delete:AWSPolicyStatement)
- WHERE stmt_delete.effect = 'Allow'
- AND any(action IN stmt_delete.action WHERE
- toLower(action) = 'iam:deleteaccesskey'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:DeleteAccessKey permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:deleteaccesskey']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target users that the principal can rotate access keys for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
- AND any(resource IN stmt_delete.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2176,22 +2013,20 @@ AWS_IAM_PRIVESC_CREATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:CreateLoginProfile permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createloginprofile'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createloginprofile']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target users that the principal can create login profiles for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2199,7 +2034,7 @@ AWS_IAM_PRIVESC_CREATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2219,19 +2054,16 @@ AWS_IAM_PRIVESC_PUT_ROLE_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find roles with iam:PutRolePolicy permission scoped to themselves
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR role.arn CONTAINS resource
- OR resource CONTAINS role.name
- )
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putrolepolicy']
+ OR act.value = '*'
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS role.name
+ OR role.arn CONTAINS res.value
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2239,7 +2071,7 @@ AWS_IAM_PRIVESC_PUT_ROLE_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2259,22 +2091,20 @@ AWS_IAM_PRIVESC_UPDATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:UpdateLoginProfile permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:updateloginprofile'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:updateloginprofile']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target users that the principal can update login profiles for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2282,7 +2112,7 @@ AWS_IAM_PRIVESC_UPDATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2302,19 +2132,16 @@ AWS_IAM_PRIVESC_PUT_USER_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find users with iam:PutUserPolicy permission scoped to themselves
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putuserpolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR user.arn CONTAINS resource
- OR resource CONTAINS user.name
- )
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putuserpolicy']
+ OR act.value = '*'
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS user.name
+ OR user.arn CONTAINS res.value
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2322,7 +2149,7 @@ AWS_IAM_PRIVESC_PUT_USER_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2342,19 +2169,16 @@ AWS_IAM_PRIVESC_ATTACH_USER_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find users with iam:AttachUserPolicy permission scoped to themselves
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachuserpolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR user.arn CONTAINS resource
- OR resource CONTAINS user.name
- )
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachuserpolicy']
+ OR act.value = '*'
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS user.name
+ OR user.arn CONTAINS res.value
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2362,7 +2186,7 @@ AWS_IAM_PRIVESC_ATTACH_USER_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2382,19 +2206,16 @@ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find roles with iam:AttachRolePolicy permission scoped to themselves
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR role.arn CONTAINS resource
- OR resource CONTAINS role.name
- )
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachrolepolicy']
+ OR act.value = '*'
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS role.name
+ OR role.arn CONTAINS res.value
+ WITH DISTINCT path
WITH collect(path) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2402,7 +2223,7 @@ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2422,22 +2243,20 @@ AWS_IAM_PRIVESC_ATTACH_GROUP_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find users with iam:AttachGroupPolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachgrouppolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachgrouppolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, user, stmt, path_principal
// Find groups the user is a member of and can attach policies to
- MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_group.arn CONTAINS resource
- OR resource CONTAINS target_group.name
- )
+ MATCH path_target = (aws)--(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_group.name
+ OR target_group.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2445,7 +2264,7 @@ AWS_IAM_PRIVESC_ATTACH_GROUP_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2465,22 +2284,20 @@ AWS_IAM_PRIVESC_PUT_GROUP_POLICY = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find users with iam:PutGroupPolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putgrouppolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putgrouppolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, user, stmt, path_principal
// Find groups the user is a member of and can put policies on
- MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_group.arn CONTAINS resource
- OR resource CONTAINS target_group.name
- )
+ MATCH path_target = (aws)--(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_group.name
+ OR target_group.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2488,7 +2305,7 @@ AWS_IAM_PRIVESC_PUT_GROUP_POLICY = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2507,31 +2324,30 @@ AWS_IAM_PRIVESC_UPDATE_ASSUME_ROLE_POLICY = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:UpdateAssumeRolePolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:updateassumerolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:UpdateAssumeRolePolicy permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:updateassumerolepolicy']
+ OR act.value = '*'
- // Find target roles whose trust policy can be modified
+ // Collapse the action-item fan-out: one row per (statement chain), not per matching action
+ WITH DISTINCT aws, stmt, path_principal
+
+ // Find target roles whose trust policy this statement's resource can target
MATCH path_target = (aws)--(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2551,22 +2367,20 @@ AWS_IAM_PRIVESC_ADD_USER_TO_GROUP = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:AddUserToGroup permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:addusertogroup'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:addusertogroup']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target groups the principal can add users to
- MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_group.arn CONTAINS resource
- OR resource CONTAINS target_group.name
- )
+ MATCH path_target = (aws)--(target_group:AWSGroup)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_group.name
+ OR target_group.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2574,7 +2388,7 @@ AWS_IAM_PRIVESC_ADD_USER_TO_GROUP = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2594,22 +2408,20 @@ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:AttachRolePolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachrolepolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target roles the principal can assume and attach policies to
MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2617,7 +2429,7 @@ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2636,45 +2448,39 @@ AWS_IAM_PRIVESC_ATTACH_USER_POLICY_CREATE_ACCESS_KEY = AttackPathsQueryDefinitio
),
provider="aws",
cypher=f"""
- // Find principals with iam:AttachUserPolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachuserpolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:AttachUserPolicy permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachuserpolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:CreateAccessKey permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'iam:createaccesskey'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:CreateAccessKey permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:createaccesskey']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target users the principal can attach policies to and create keys for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2694,23 +2500,21 @@ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_ASSUME_ROLE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:CreatePolicyVersion permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createpolicyversion'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createpolicyversion']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target roles the principal can assume that have customer-managed policies the principal can modify
MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
MATCH (target_role)--(target_policy:AWSPolicy)
WHERE target_policy.arn CONTAINS $provider_uid
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_policy.arn CONTAINS resource
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR target_policy.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2718,7 +2522,7 @@ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_ASSUME_ROLE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2738,22 +2542,20 @@ AWS_IAM_PRIVESC_PUT_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PutRolePolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putrolepolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target roles the principal can assume and put inline policies on
MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -2761,7 +2563,7 @@ AWS_IAM_PRIVESC_PUT_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2780,45 +2582,39 @@ AWS_IAM_PRIVESC_PUT_USER_POLICY_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:PutUserPolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putuserpolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PutUserPolicy permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putuserpolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:CreateAccessKey permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'iam:createaccesskey'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:CreateAccessKey permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:createaccesskey']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target users the principal can put policies on and create keys for
MATCH path_target = (aws)--(target_user:AWSUser)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR target_user.arn CONTAINS resource
- OR resource CONTAINS target_user.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_user.name
+ OR target_user.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2837,45 +2633,39 @@ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_UPDATE_ASSUME_ROLE = AttackPathsQueryDefiniti
),
provider="aws",
cypher=f"""
- // Find principals with iam:AttachRolePolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:attachrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:AttachRolePolicy permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:attachrolepolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:UpdateAssumeRolePolicy permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'iam:updateassumerolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:UpdateAssumeRolePolicy permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:updateassumerolepolicy']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target roles the principal can attach policies to and update trust policy for
MATCH path_target = (aws)--(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2894,46 +2684,40 @@ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_UPDATE_ASSUME_ROLE = AttackPathsQueryDefin
),
provider="aws",
cypher=f"""
- // Find principals with iam:CreatePolicyVersion permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:createpolicyversion'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:CreatePolicyVersion permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:createpolicyversion']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:UpdateAssumeRolePolicy permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'iam:updateassumerolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:UpdateAssumeRolePolicy permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:updateassumerolepolicy']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target roles with customer-managed policies the principal can modify and update trust policy for
MATCH path_target = (aws)--(target_role:AWSRole)
- WHERE any(resource IN stmt2.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
- MATCH (target_role)--(target_policy:AWSPolicy)
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res2.value
+ MATCH (target_role)-[:POLICY]->(target_policy:AWSPolicy)
WHERE target_policy.arn CONTAINS $provider_uid
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_policy.arn CONTAINS resource
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR target_policy.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -2952,45 +2736,39 @@ AWS_IAM_PRIVESC_PUT_ROLE_POLICY_UPDATE_ASSUME_ROLE = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with iam:PutRolePolicy permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:putrolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find principals with iam:PutRolePolicy permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:putrolepolicy']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find iam:UpdateAssumeRolePolicy permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'iam:updateassumerolepolicy'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ // Find iam:UpdateAssumeRolePolicy permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['iam:*', 'iam:updateassumerolepolicy']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find target roles the principal can put inline policies on and update trust policy for
MATCH path_target = (aws)--(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3010,40 +2788,34 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:CreateFunction permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'lambda:createfunction'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['lambda:*', 'lambda:createfunction']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:InvokeFunction permission
- MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
- WHERE stmt_invoke.effect = 'Allow'
- AND any(action IN stmt_invoke.action WHERE
- toLower(action) = 'lambda:invokefunction'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(invoke_policy:AWSPolicy)-[:STATEMENT]->(stmt_invoke:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_invoke)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['lambda:*', 'lambda:invokefunction']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Lambda service (can be passed to Lambda)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3051,7 +2823,7 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3071,40 +2843,34 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_EVENT_SOURCE = AttackPathsQueryDefin
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:CreateFunction permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'lambda:createfunction'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['lambda:*', 'lambda:createfunction']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:CreateEventSourceMapping permission
- MATCH (principal)--(event_policy:AWSPolicy)--(stmt_event:AWSPolicyStatement)
- WHERE stmt_event.effect = 'Allow'
- AND any(action IN stmt_event.action WHERE
- toLower(action) = 'lambda:createeventsourcemapping'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(event_policy:AWSPolicy)-[:STATEMENT]->(stmt_event:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_event)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['lambda:*', 'lambda:createeventsourcemapping']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Lambda service (can be passed to Lambda)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3112,7 +2878,7 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_EVENT_SOURCE = AttackPathsQueryDefin
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3132,22 +2898,20 @@ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with lambda:UpdateFunctionCode permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'lambda:updatefunctioncode'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['lambda:*', 'lambda:updatefunctioncode']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find existing Lambda functions with execution roles
- MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR lambda_fn.arn CONTAINS resource
- OR resource CONTAINS lambda_fn.name
- )
+ MATCH path_target = (aws)--(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS lambda_fn.name
+ OR lambda_fn.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3155,7 +2919,7 @@ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3174,45 +2938,39 @@ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_INVOKE = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with lambda:UpdateFunctionCode permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'lambda:updatefunctioncode'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ // Find principals with lambda:UpdateFunctionCode permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['lambda:*', 'lambda:updatefunctioncode']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find lambda:InvokeFunction permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'lambda:invokefunction'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ // Find lambda:InvokeFunction permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['lambda:*', 'lambda:invokefunction']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find existing Lambda functions with execution roles
- MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR lambda_fn.arn CONTAINS resource
- OR resource CONTAINS lambda_fn.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR lambda_fn.arn CONTAINS resource
- OR resource CONTAINS lambda_fn.name
- )
+ MATCH path_target = (aws)--(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS lambda_fn.name
+ OR lambda_fn.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS lambda_fn.name
+ OR lambda_fn.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3231,45 +2989,39 @@ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_ADD_PERMISSION = AttackPathsQueryDefinit
),
provider="aws",
cypher=f"""
- // Find principals with lambda:UpdateFunctionCode permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'lambda:updatefunctioncode'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ // Find principals with lambda:UpdateFunctionCode permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['lambda:*', 'lambda:updatefunctioncode']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find lambda:AddPermission permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'lambda:addpermission'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ // Find lambda:AddPermission permission (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['lambda:*', 'lambda:addpermission']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt, stmt2, path_principal
// Find existing Lambda functions with execution roles
- MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR lambda_fn.arn CONTAINS resource
- OR resource CONTAINS lambda_fn.name
- )
- AND any(resource IN stmt2.resource WHERE
- resource = '*'
- OR lambda_fn.arn CONTAINS resource
- OR resource CONTAINS lambda_fn.name
- )
+ MATCH path_target = (aws)--(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS lambda_fn.name
+ OR lambda_fn.arn CONTAINS res.value
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
+ WHERE res2.value = '*'
+ OR res2.value CONTAINS lambda_fn.name
+ OR lambda_fn.arn CONTAINS res2.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3289,40 +3041,34 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_ADD_PERMISSION = AttackPathsQueryDef
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:CreateFunction permission
- MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
- WHERE stmt_create.effect = 'Allow'
- AND any(action IN stmt_create.action WHERE
- toLower(action) = 'lambda:createfunction'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(create_policy:AWSPolicy)-[:STATEMENT]->(stmt_create:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_create)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['lambda:*', 'lambda:createfunction']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find lambda:AddPermission permission
- MATCH (principal)--(perm_policy:AWSPolicy)--(stmt_perm:AWSPolicyStatement)
- WHERE stmt_perm.effect = 'Allow'
- AND any(action IN stmt_perm.action WHERE
- toLower(action) = 'lambda:addpermission'
- OR toLower(action) = 'lambda:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(perm_policy:AWSPolicy)-[:STATEMENT]->(stmt_perm:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_perm)-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['lambda:*', 'lambda:addpermission']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust Lambda service (can be passed to Lambda)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3330,7 +3076,7 @@ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_ADD_PERMISSION = AttackPathsQueryDef
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3350,31 +3096,27 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_NOTEBOOK = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find sagemaker:CreateNotebookInstance permission
- MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
- WHERE stmt_sm.effect = 'Allow'
- AND any(action IN stmt_sm.action WHERE
- toLower(action) = 'sagemaker:createnotebookinstance'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(sm_policy:AWSPolicy)-[:STATEMENT]->(stmt_sm:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_sm)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['sagemaker:*', 'sagemaker:createnotebookinstance']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust SageMaker service (can be passed to SageMaker)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3382,7 +3124,7 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_NOTEBOOK = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3402,31 +3144,27 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_TRAINING_JOB = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find sagemaker:CreateTrainingJob permission
- MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
- WHERE stmt_sm.effect = 'Allow'
- AND any(action IN stmt_sm.action WHERE
- toLower(action) = 'sagemaker:createtrainingjob'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(sm_policy:AWSPolicy)-[:STATEMENT]->(stmt_sm:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_sm)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['sagemaker:*', 'sagemaker:createtrainingjob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust SageMaker service (can be passed to SageMaker)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3434,7 +3172,7 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_TRAINING_JOB = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3454,31 +3192,27 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_PROCESSING_JOB = AttackPathsQueryDefinitio
provider="aws",
cypher=f"""
// Find principals with iam:PassRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
- WHERE stmt_passrole.effect = 'Allow'
- AND any(action IN stmt_passrole.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(passrole_policy:AWSPolicy)-[:STATEMENT]->(stmt_passrole:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_passrole)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['iam:*', 'iam:passrole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find sagemaker:CreateProcessingJob permission
- MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
- WHERE stmt_sm.effect = 'Allow'
- AND any(action IN stmt_sm.action WHERE
- toLower(action) = 'sagemaker:createprocessingjob'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ MATCH (principal)-[:POLICY]->(sm_policy:AWSPolicy)-[:STATEMENT]->(stmt_sm:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt_sm)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['sagemaker:*', 'sagemaker:createprocessingjob']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt_passrole, path_principal
// Find roles that trust SageMaker service (can be passed to SageMaker)
MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
- WHERE any(resource IN stmt_passrole.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt_passrole)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3486,7 +3220,7 @@ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_PROCESSING_JOB = AttackPathsQueryDefinitio
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3506,22 +3240,20 @@ AWS_SAGEMAKER_PRIVESC_PRESIGNED_NOTEBOOK_URL = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with sagemaker:CreatePresignedNotebookInstanceUrl permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'sagemaker:createpresignednotebookinstanceurl'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['sagemaker:*', 'sagemaker:createpresignednotebookinstanceurl']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find existing SageMaker notebook instances with execution roles
- MATCH path_target = (aws)-[:RESOURCE]->(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR notebook.arn CONTAINS resource
- OR resource CONTAINS notebook.notebook_instance_name
- )
+ MATCH path_target = (aws)--(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS notebook.notebook_instance_name
+ OR notebook.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3529,7 +3261,7 @@ AWS_SAGEMAKER_PRIVESC_PRESIGNED_NOTEBOOK_URL = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3548,58 +3280,46 @@ AWS_SAGEMAKER_PRIVESC_LIFECYCLE_CONFIG_NOTEBOOK = AttackPathsQueryDefinition(
),
provider="aws",
cypher=f"""
- // Find principals with sagemaker:CreateNotebookInstanceLifecycleConfig permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'sagemaker:createnotebookinstancelifecycleconfig'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ // Find principals with sagemaker:CreateNotebookInstanceLifecycleConfig permission (this IS path_principal)
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['sagemaker:*', 'sagemaker:createnotebookinstancelifecycleconfig']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, path_principal
- // Find sagemaker:UpdateNotebookInstance permission
- MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
- WHERE stmt2.effect = 'Allow'
- AND any(action IN stmt2.action WHERE
- toLower(action) = 'sagemaker:updatenotebookinstance'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ // Gate: sagemaker:UpdateNotebookInstance (keep stmt2: its resource is checked)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+ WHERE toLower(act2.value) IN ['sagemaker:*', 'sagemaker:updatenotebookinstance']
+ OR act2.value = '*'
+ WITH DISTINCT aws, principal, stmt2, path_principal
- // Find sagemaker:StopNotebookInstance permission
- MATCH (principal)--(policy3:AWSPolicy)--(stmt3:AWSPolicyStatement)
- WHERE stmt3.effect = 'Allow'
- AND any(action IN stmt3.action WHERE
- toLower(action) = 'sagemaker:stopnotebookinstance'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ // Gate: sagemaker:StopNotebookInstance (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+ WHERE toLower(act3.value) IN ['sagemaker:*', 'sagemaker:stopnotebookinstance']
+ OR act3.value = '*'
+ WITH DISTINCT aws, principal, stmt2, path_principal
- // Find sagemaker:StartNotebookInstance permission
- MATCH (principal)--(policy4:AWSPolicy)--(stmt4:AWSPolicyStatement)
- WHERE stmt4.effect = 'Allow'
- AND any(action IN stmt4.action WHERE
- toLower(action) = 'sagemaker:startnotebookinstance'
- OR toLower(action) = 'sagemaker:*'
- OR action = '*'
- )
+ // Gate: sagemaker:StartNotebookInstance (existence only)
+ MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(act4:AWSPolicyStatementActionItem)
+ WHERE toLower(act4.value) IN ['sagemaker:*', 'sagemaker:startnotebookinstance']
+ OR act4.value = '*'
+ WITH DISTINCT aws, principal, stmt2, path_principal
// Find existing SageMaker notebook instances with execution roles
- MATCH path_target = (aws)-[:RESOURCE]->(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
- WHERE any(resource IN stmt2.resource WHERE
- resource = '*'
- OR notebook.arn CONTAINS resource
- OR resource CONTAINS notebook.notebook_instance_name
- )
+ MATCH path_target = (aws)--(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
+ MATCH (stmt2)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS notebook.notebook_instance_name
+ OR notebook.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3619,25 +3339,24 @@ AWS_SSM_PRIVESC_START_SESSION = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with ssm:StartSession permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'ssm:startsession'
- OR toLower(action) = 'ssm:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ssm:*', 'ssm:startsession']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find EC2 instances with attached roles (targets for credential theft via IMDS)
MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3657,25 +3376,24 @@ AWS_SSM_PRIVESC_SEND_COMMAND = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with ssm:SendCommand permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'ssm:sendcommand'
- OR toLower(action) = 'ssm:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['ssm:*', 'ssm:sendcommand']
+ OR act.value = '*'
+ WITH aws, collect(DISTINCT path_principal) AS principal_paths
// Find EC2 instances with attached roles (targets for credential theft via IMDS)
MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
- WITH collect(path_principal) + collect(path_target) AS paths
+ WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+ WITH principal_paths + target_paths AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3695,22 +3413,20 @@ AWS_STS_PRIVESC_ASSUME_ROLE = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with sts:AssumeRole permission
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'sts:assumerole'
- OR toLower(action) = 'sts:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['sts:*', 'sts:assumerole']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
// Find target roles the principal can assume (bidirectional trust via Cartography)
MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
- WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
@@ -3718,7 +3434,7 @@ AWS_STS_PRIVESC_ASSUME_ROLE = AttackPathsQueryDefinition(
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -3726,7 +3442,6 @@ AWS_STS_PRIVESC_ASSUME_ROLE = AttackPathsQueryDefinition(
)
# AWS Queries List
-# ----------------
AWS_QUERIES: list[AttackPathsQueryDefinition] = [
AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS,
diff --git a/api/src/backend/api/attack_paths/queries/aws_deprecated.py b/api/src/backend/api/attack_paths/queries/aws_deprecated.py
new file mode 100644
index 0000000000..b94c329202
--- /dev/null
+++ b/api/src/backend/api/attack_paths/queries/aws_deprecated.py
@@ -0,0 +1,3819 @@
+# TODO: drop after Neptune cutover
+#
+# Pre-cutover query catalog for AWS scans whose graph data was written under
+# the previous schema, where list-typed policy properties were serialised as
+# comma-delimited strings on the parent node. The registry routes scans with
+# `is_migrated=False` to this module; all other scans use `aws.py`. Both
+# files expose the same query IDs and parameter shapes so the API surface
+# stays uniform across the cutover window. This file is deleted, along with
+# `AttackPathsScan.is_migrated`, once the legacy data is fully drained.
+from api.attack_paths.queries.types import (
+ AttackPathsQueryAttribution,
+ AttackPathsQueryDefinition,
+ AttackPathsQueryParameterDefinition,
+)
+from tasks.jobs.attack_paths.config import PROWLER_FINDING_LABEL
+
+# Custom Attack Path Queries
+# --------------------------
+
+AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS = AttackPathsQueryDefinition(
+ id="aws-internet-exposed-ec2-sensitive-s3-access",
+ name="Internet-Exposed EC2 with Sensitive S3 Access",
+ short_description="Find SSH-exposed EC2 instances that can assume roles to read tagged sensitive S3 buckets.",
+ description="Detect EC2 instances with SSH exposed to the internet that can assume higher-privileged roles to read tagged sensitive S3 buckets despite bucket-level public access blocks.",
+ provider="aws",
+ cypher=f"""
+ MATCH path_s3 = (aws:AWSAccount {{id: $provider_uid}})--(s3:S3Bucket)--(t:AWSTag)
+ WHERE toLower(t.key) = toLower($tag_key) AND toLower(t.value) = toLower($tag_value)
+
+ MATCH path_ec2 = (aws)--(ec2:EC2Instance)--(sg:EC2SecurityGroup)--(ipi:IpPermissionInbound)
+ WHERE ec2.exposed_internet = true
+ AND ipi.toport = 22
+
+ MATCH path_role = (r:AWSRole)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE ANY(x IN stmt.resource WHERE x CONTAINS s3.name)
+ AND ANY(x IN stmt.action WHERE toLower(x) =~ 's3:(listbucket|getobject).*')
+
+ MATCH path_assume_role = (ec2)-[p:STS_ASSUMEROLE_ALLOW*1..9]-(r:AWSRole)
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(ec2)
+
+ WITH collect(path_s3) + collect(path_ec2) + collect(path_role) + collect(path_assume_role) AS paths,
+ head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[
+ AttackPathsQueryParameterDefinition(
+ name="tag_key",
+ label="Tag key",
+ description="Tag key to filter the S3 bucket, e.g. DataClassification.",
+ placeholder="DataClassification",
+ ),
+ AttackPathsQueryParameterDefinition(
+ name="tag_value",
+ label="Tag value",
+ description="Tag value to filter the S3 bucket, e.g. Sensitive.",
+ placeholder="Sensitive",
+ ),
+ ],
+)
+
+
+# Basic Resource Queries
+# ----------------------
+
+AWS_RDS_INSTANCES = AttackPathsQueryDefinition(
+ id="aws-rds-instances",
+ name="RDS Instances Inventory",
+ short_description="List all provisioned RDS database instances in the account.",
+ description="List the selected AWS account alongside the RDS instances it owns.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(rds:RDSInstance)
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+AWS_RDS_UNENCRYPTED_STORAGE = AttackPathsQueryDefinition(
+ id="aws-rds-unencrypted-storage",
+ name="Unencrypted RDS Instances",
+ short_description="Find RDS instances with storage encryption disabled.",
+ description="Find RDS instances with storage encryption disabled within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(rds:RDSInstance)
+ WHERE rds.storage_encrypted = false
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+AWS_S3_ANONYMOUS_ACCESS_BUCKETS = AttackPathsQueryDefinition(
+ id="aws-s3-anonymous-access-buckets",
+ name="S3 Buckets with Anonymous Access",
+ short_description="Find S3 buckets that allow anonymous access.",
+ description="Find S3 buckets that allow anonymous access within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(s3:S3Bucket)
+ WHERE s3.anonymous_access = true
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+AWS_IAM_STATEMENTS_ALLOW_ALL_ACTIONS = AttackPathsQueryDefinition(
+ id="aws-iam-statements-allow-all-actions",
+ name="IAM Statements Allowing All Actions",
+ short_description="Find IAM policy statements that allow all actions via wildcard (*).",
+ description="Find IAM policy statements that allow all actions via '*' within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(x IN stmt.action WHERE x = '*')
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+AWS_IAM_STATEMENTS_ALLOW_DELETE_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-statements-allow-delete-policy",
+ name="IAM Statements Allowing Policy Deletion",
+ short_description="Find IAM policy statements that allow iam:DeletePolicy.",
+ description="Find IAM policy statements that allow the iam:DeletePolicy action within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(x IN stmt.action WHERE x = "iam:DeletePolicy")
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+AWS_IAM_STATEMENTS_ALLOW_CREATE_ACTIONS = AttackPathsQueryDefinition(
+ id="aws-iam-statements-allow-create-actions",
+ name="IAM Statements Allowing Create Actions",
+ short_description="Find IAM policy statements that allow any create action.",
+ description="Find IAM policy statements that allow actions containing 'create' within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = "Allow"
+ AND any(x IN stmt.action WHERE toLower(x) CONTAINS "create")
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+
+# Network Exposure Queries
+# ------------------------
+
+AWS_EC2_INSTANCES_INTERNET_EXPOSED = AttackPathsQueryDefinition(
+ id="aws-ec2-instances-internet-exposed",
+ name="Internet-Exposed EC2 Instances",
+ short_description="Find EC2 instances flagged as exposed to the internet.",
+ description="Find EC2 instances flagged as exposed to the internet within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(ec2:EC2Instance)
+ WHERE ec2.exposed_internet = true
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(ec2)
+
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[],
+)
+
+AWS_SECURITY_GROUPS_OPEN_INTERNET_FACING = AttackPathsQueryDefinition(
+ id="aws-security-groups-open-internet-facing",
+ name="Open Security Groups on Internet-Facing Resources",
+ short_description="Find internet-facing resources with security groups allowing inbound from 0.0.0.0/0.",
+ description="Find internet-facing resources associated with security groups that allow inbound access from '0.0.0.0/0'.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(ec2:EC2Instance)--(sg:EC2SecurityGroup)--(ipi:IpPermissionInbound)--(ir:IpRange)
+ WHERE ec2.exposed_internet = true
+ AND ir.range = "0.0.0.0/0"
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(ec2)
+
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[],
+)
+
+AWS_CLASSIC_ELB_INTERNET_EXPOSED = AttackPathsQueryDefinition(
+ id="aws-classic-elb-internet-exposed",
+ name="Internet-Exposed Classic Load Balancers",
+ short_description="Find Classic Load Balancers exposed to the internet with their listeners.",
+ description="Find Classic Load Balancers exposed to the internet along with their listeners.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(elb:LoadBalancer)--(listener:ELBListener)
+ WHERE elb.exposed_internet = true
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(elb)
+
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[],
+)
+
+AWS_ELBV2_INTERNET_EXPOSED = AttackPathsQueryDefinition(
+ id="aws-elbv2-internet-exposed",
+ name="Internet-Exposed ALB/NLB Load Balancers",
+ short_description="Find ELBv2 (ALB/NLB) load balancers exposed to the internet with their listeners.",
+ description="Find ELBv2 load balancers exposed to the internet along with their listeners.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(elbv2:LoadBalancerV2)--(listener:ELBV2Listener)
+ WHERE elbv2.exposed_internet = true
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(elbv2)
+
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[],
+)
+
+AWS_PUBLIC_IP_RESOURCE_LOOKUP = AttackPathsQueryDefinition(
+ id="aws-public-ip-resource-lookup",
+ name="Resource Lookup by Public IP",
+ short_description="Find the AWS resource associated with a given public IP address.",
+ description="Given a public IP address, find the related AWS resource and its adjacent node within the selected account.",
+ provider="aws",
+ cypher=f"""
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})-[r]-(x)-[q]-(y)
+ WHERE (x:EC2PrivateIp AND x.public_ip = $ip)
+ OR (x:EC2Instance AND x.publicipaddress = $ip)
+ OR (x:NetworkInterface AND x.public_ip = $ip)
+ OR (x:ElasticIPAddress AND x.public_ip = $ip)
+
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(x)
+
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr, internet, can_access
+ """,
+ parameters=[
+ AttackPathsQueryParameterDefinition(
+ name="ip",
+ label="IP address",
+ description="Public IP address, e.g. 192.0.2.0.",
+ placeholder="192.0.2.0",
+ ),
+ ],
+)
+
+# Privilege Escalation Queries (based on pathfinding.cloud research)
+# https://github.com/DataDog/pathfinding.cloud
+# -------------------------------------------------------------------
+
+# APPRUNNER-001
+AWS_APPRUNNER_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
+ id="aws-apprunner-privesc-passrole-create-service",
+ name="App Runner Service Creation with Privileged Role (APPRUNNER-001)",
+ short_description="Create an App Runner service with a privileged IAM role to gain its permissions.",
+ description="Detect principals who can pass IAM roles and create App Runner services. This allows creating a service with a privileged role attached, gaining that role's permissions via StartCommand execution, a container web shell, or a malicious apprunner.yaml configuration.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - APPRUNNER-001 - iam:PassRole + apprunner:CreateService",
+ link="https://pathfinding.cloud/paths/apprunner-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find apprunner:CreateService permission
+ MATCH (principal)--(apprunner_policy:AWSPolicy)--(stmt_apprunner:AWSPolicyStatement)
+ WHERE stmt_apprunner.effect = 'Allow'
+ AND any(action IN stmt_apprunner.action WHERE
+ toLower(action) = 'apprunner:createservice'
+ OR toLower(action) = 'apprunner:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust App Runner tasks service (can be passed to App Runner)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'tasks.apprunner.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# APPRUNNER-002
+AWS_APPRUNNER_PRIVESC_UPDATE_SERVICE = AttackPathsQueryDefinition(
+ id="aws-apprunner-privesc-update-service",
+ name="App Runner Service Update for Role Access (APPRUNNER-002)",
+ short_description="Update an existing App Runner service to leverage its already-attached privileged role.",
+ description="Detect principals who can update existing App Runner services. This allows modifying a service's configuration to execute arbitrary code with the service's already-attached IAM role, without requiring iam:PassRole. Exploitation methods include injecting a malicious StartCommand, updating to a container image with a web shell, or pointing to a repository with a malicious apprunner.yaml file.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - APPRUNNER-002 - apprunner:UpdateService",
+ link="https://pathfinding.cloud/paths/apprunner-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with apprunner:UpdateService permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(update_policy:AWSPolicy)--(stmt_update:AWSPolicyStatement)
+ WHERE stmt_update.effect = 'Allow'
+ AND any(action IN stmt_update.action WHERE
+ toLower(action) = 'apprunner:updateservice'
+ OR toLower(action) = 'apprunner:*'
+ OR action = '*'
+ )
+
+ // Find existing App Runner services with roles attached (potential targets)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'tasks.apprunner.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# BEDROCK-001
+AWS_BEDROCK_PRIVESC_PASSROLE_CODE_INTERPRETER = AttackPathsQueryDefinition(
+ id="aws-bedrock-privesc-passrole-code-interpreter",
+ name="Bedrock Code Interpreter with Privileged Role (BEDROCK-001)",
+ short_description="Create a Bedrock AgentCore Code Interpreter with a privileged role attached.",
+ description="Detect principals who can pass IAM roles and create Bedrock AgentCore Code Interpreters. This allows creating a code interpreter with a privileged role attached, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - BEDROCK-001 - iam:PassRole + bedrock-agentcore:CreateCodeInterpreter + bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+ link="https://pathfinding.cloud/paths/bedrock-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find bedrock-agentcore:CreateCodeInterpreter permission
+ MATCH (principal)--(bedrock_policy:AWSPolicy)--(stmt_bedrock:AWSPolicyStatement)
+ WHERE stmt_bedrock.effect = 'Allow'
+ AND any(action IN stmt_bedrock.action WHERE
+ toLower(action) = 'bedrock-agentcore:createcodeinterpreter'
+ OR toLower(action) = 'bedrock-agentcore:*'
+ OR action = '*'
+ )
+
+ // Find bedrock-agentcore:StartCodeInterpreterSession permission
+ MATCH (principal)--(session_policy:AWSPolicy)--(stmt_session:AWSPolicyStatement)
+ WHERE stmt_session.effect = 'Allow'
+ AND any(action IN stmt_session.action WHERE
+ toLower(action) = 'bedrock-agentcore:startcodeinterpretersession'
+ OR toLower(action) = 'bedrock-agentcore:*'
+ OR action = '*'
+ )
+
+ // Find bedrock-agentcore:InvokeCodeInterpreter permission
+ MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
+ WHERE stmt_invoke.effect = 'Allow'
+ AND any(action IN stmt_invoke.action WHERE
+ toLower(action) = 'bedrock-agentcore:invokecodeinterpreter'
+ OR toLower(action) = 'bedrock-agentcore:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust the Bedrock AgentCore service (can be passed to a code interpreter)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'bedrock-agentcore.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# BEDROCK-002
+AWS_BEDROCK_PRIVESC_INVOKE_CODE_INTERPRETER = AttackPathsQueryDefinition(
+ id="aws-bedrock-privesc-invoke-code-interpreter",
+ name="Bedrock Code Interpreter Session Hijacking (BEDROCK-002)",
+ short_description="Start a session on an existing Bedrock code interpreter to exfiltrate its privileged role credentials.",
+ description="Detect principals who can start sessions and invoke code on existing Bedrock AgentCore code interpreters. This allows executing arbitrary Python code within an interpreter that has a privileged role attached, gaining that role's credentials via the MicroVM Metadata Service without requiring iam:PassRole.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - BEDROCK-002 - bedrock-agentcore:StartCodeInterpreterSession + bedrock-agentcore:InvokeCodeInterpreter",
+ link="https://pathfinding.cloud/paths/bedrock-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with bedrock-agentcore:StartCodeInterpreterSession permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(session_policy:AWSPolicy)--(stmt_session:AWSPolicyStatement)
+ WHERE stmt_session.effect = 'Allow'
+ AND any(action IN stmt_session.action WHERE
+ toLower(action) = 'bedrock-agentcore:startcodeinterpretersession'
+ OR toLower(action) = 'bedrock-agentcore:*'
+ OR action = '*'
+ )
+
+ // Find bedrock-agentcore:InvokeCodeInterpreter permission
+ MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
+ WHERE stmt_invoke.effect = 'Allow'
+ AND any(action IN stmt_invoke.action WHERE
+ toLower(action) = 'bedrock-agentcore:invokecodeinterpreter'
+ OR toLower(action) = 'bedrock-agentcore:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust the Bedrock AgentCore service (already attached to existing code interpreters)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'bedrock-agentcore.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CLOUDFORMATION-001
+AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACK = AttackPathsQueryDefinition(
+ id="aws-cloudformation-privesc-passrole-create-stack",
+ name="CloudFormation Stack Creation with Privileged Role (CLOUDFORMATION-001)",
+ short_description="Create a CloudFormation stack with a privileged role to provision arbitrary AWS resources.",
+ description="Detect principals who can pass IAM roles and create CloudFormation stacks. This allows launching a stack with a malicious template that executes with the passed role's permissions, enabling creation of resources like IAM users, Lambda functions, or EC2 instances controlled by the attacker.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CLOUDFORMATION-001 - iam:PassRole + cloudformation:CreateStack",
+ link="https://pathfinding.cloud/paths/cloudformation-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find cloudformation:CreateStack permission
+ MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
+ WHERE stmt_cfn.effect = 'Allow'
+ AND any(action IN stmt_cfn.action WHERE
+ toLower(action) = 'cloudformation:createstack'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CloudFormation service (can be passed to CloudFormation)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CLOUDFORMATION-002
+AWS_CLOUDFORMATION_PRIVESC_UPDATE_STACK = AttackPathsQueryDefinition(
+ id="aws-cloudformation-privesc-update-stack",
+ name="CloudFormation Stack Update for Role Access (CLOUDFORMATION-002)",
+ short_description="Update an existing CloudFormation stack to leverage its already-attached privileged service role.",
+ description="Detect principals who can update existing CloudFormation stacks. This allows modifying a stack's template to add new resources (such as IAM roles with admin access) that are created with the stack's already-attached service role permissions, without requiring iam:PassRole.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CLOUDFORMATION-002 - cloudformation:UpdateStack",
+ link="https://pathfinding.cloud/paths/cloudformation-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with cloudformation:UpdateStack permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(update_policy:AWSPolicy)--(stmt_update:AWSPolicyStatement)
+ WHERE stmt_update.effect = 'Allow'
+ AND any(action IN stmt_update.action WHERE
+ toLower(action) = 'cloudformation:updatestack'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CloudFormation service (already attached to existing stacks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CLOUDFORMATION-003
+AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACKSET = AttackPathsQueryDefinition(
+ id="aws-cloudformation-privesc-passrole-create-stackset",
+ name="CloudFormation StackSet Creation with Privileged Role (CLOUDFORMATION-003)",
+ short_description="Create a CloudFormation StackSet with a privileged execution role to provision arbitrary resources across accounts.",
+ description="Detect principals who can pass IAM roles, create CloudFormation StackSets, and deploy stack instances. This allows creating a StackSet with a malicious template and a privileged execution role, then deploying instances that create resources (such as IAM roles with admin access) using that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CLOUDFORMATION-003 - iam:PassRole + cloudformation:CreateStackSet + cloudformation:CreateStackInstances",
+ link="https://pathfinding.cloud/paths/cloudformation-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find cloudformation:CreateStackSet permission
+ MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
+ WHERE stmt_cfn.effect = 'Allow'
+ AND any(action IN stmt_cfn.action WHERE
+ toLower(action) = 'cloudformation:createstackset'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find cloudformation:CreateStackInstances permission
+ MATCH (principal)--(cfn_instances_policy:AWSPolicy)--(stmt_cfn_instances:AWSPolicyStatement)
+ WHERE stmt_cfn_instances.effect = 'Allow'
+ AND any(action IN stmt_cfn_instances.action WHERE
+ toLower(action) = 'cloudformation:createstackinstances'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CloudFormation service (can be passed as execution role)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CLOUDFORMATION-004
+AWS_CLOUDFORMATION_PRIVESC_PASSROLE_UPDATE_STACKSET = AttackPathsQueryDefinition(
+ id="aws-cloudformation-privesc-passrole-update-stackset",
+ name="CloudFormation StackSet Update with Privileged Role (CLOUDFORMATION-004)",
+ short_description="Update an existing CloudFormation StackSet to inject malicious resources using a privileged execution role.",
+ description="Detect principals who can pass IAM roles and update CloudFormation StackSets. This allows modifying an existing StackSet's template to add resources (such as IAM roles with admin access) that are provisioned by the StackSet's privileged execution role across target accounts.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CLOUDFORMATION-004 - iam:PassRole + cloudformation:UpdateStackSet",
+ link="https://pathfinding.cloud/paths/cloudformation-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find cloudformation:UpdateStackSet permission
+ MATCH (principal)--(cfn_policy:AWSPolicy)--(stmt_cfn:AWSPolicyStatement)
+ WHERE stmt_cfn.effect = 'Allow'
+ AND any(action IN stmt_cfn.action WHERE
+ toLower(action) = 'cloudformation:updatestackset'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CloudFormation service (can be passed as execution role)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CLOUDFORMATION-005
+AWS_CLOUDFORMATION_PRIVESC_CHANGESET = AttackPathsQueryDefinition(
+ id="aws-cloudformation-privesc-changeset",
+ name="CloudFormation Change Set Privilege Escalation (CLOUDFORMATION-005)",
+ short_description="Create and execute a change set on an existing stack to leverage its privileged service role.",
+ description="Detect principals who can create and execute CloudFormation change sets. This allows modifying an existing stack's template through a staged change set, inheriting the stack's already-attached service role permissions to provision arbitrary resources without requiring iam:PassRole.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CLOUDFORMATION-005 - cloudformation:CreateChangeSet + cloudformation:ExecuteChangeSet",
+ link="https://pathfinding.cloud/paths/cloudformation-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with cloudformation:CreateChangeSet permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'cloudformation:createchangeset'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find cloudformation:ExecuteChangeSet permission
+ MATCH (principal)--(exec_policy:AWSPolicy)--(stmt_exec:AWSPolicyStatement)
+ WHERE stmt_exec.effect = 'Allow'
+ AND any(action IN stmt_exec.action WHERE
+ toLower(action) = 'cloudformation:executechangeset'
+ OR toLower(action) = 'cloudformation:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CloudFormation service (already attached to existing stacks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CODEBUILD-001
+AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT = AttackPathsQueryDefinition(
+ id="aws-codebuild-privesc-passrole-create-project",
+ name="CodeBuild Project Creation with Privileged Role (CODEBUILD-001)",
+ short_description="Create a CodeBuild project with a privileged role to execute arbitrary code via a malicious buildspec.",
+ description="Detect principals who can pass IAM roles, create CodeBuild projects, and start builds. This allows creating a project with a privileged role attached and executing arbitrary code through a malicious buildspec, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CODEBUILD-001 - iam:PassRole + codebuild:CreateProject + codebuild:StartBuild",
+ link="https://pathfinding.cloud/paths/codebuild-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find codebuild:CreateProject permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'codebuild:createproject'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find codebuild:StartBuild permission
+ MATCH (principal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
+ WHERE stmt_build.effect = 'Allow'
+ AND any(action IN stmt_build.action WHERE
+ toLower(action) = 'codebuild:startbuild'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CodeBuild service (can be passed to CodeBuild)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CODEBUILD-002
+AWS_CODEBUILD_PRIVESC_START_BUILD = AttackPathsQueryDefinition(
+ id="aws-codebuild-privesc-start-build",
+ name="CodeBuild Buildspec Override for Role Access (CODEBUILD-002)",
+ short_description="Start a build on an existing CodeBuild project with a buildspec override to execute code with its privileged role.",
+ description="Detect principals who can start builds on existing CodeBuild projects. This allows overriding the buildspec with malicious commands that execute with the project's already-attached service role permissions, without requiring iam:PassRole or codebuild:CreateProject.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CODEBUILD-002 - codebuild:StartBuild",
+ link="https://pathfinding.cloud/paths/codebuild-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with codebuild:StartBuild permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
+ WHERE stmt_build.effect = 'Allow'
+ AND any(action IN stmt_build.action WHERE
+ toLower(action) = 'codebuild:startbuild'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CodeBuild service (already attached to existing projects)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CODEBUILD-003
+AWS_CODEBUILD_PRIVESC_START_BUILD_BATCH = AttackPathsQueryDefinition(
+ id="aws-codebuild-privesc-start-build-batch",
+ name="CodeBuild Batch Buildspec Override for Role Access (CODEBUILD-003)",
+ short_description="Start a batch build on an existing CodeBuild project with a buildspec override to execute code with its privileged role.",
+ description="Detect principals who can start batch builds on existing CodeBuild projects. This allows overriding the buildspec with malicious commands that execute with the project's already-attached service role permissions, without requiring iam:PassRole or codebuild:CreateProject.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CODEBUILD-003 - codebuild:StartBuildBatch",
+ link="https://pathfinding.cloud/paths/codebuild-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with codebuild:StartBuildBatch permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(build_policy:AWSPolicy)--(stmt_build:AWSPolicyStatement)
+ WHERE stmt_build.effect = 'Allow'
+ AND any(action IN stmt_build.action WHERE
+ toLower(action) = 'codebuild:startbuildbatch'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CodeBuild service (already attached to existing projects)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# CODEBUILD-004
+AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT_BATCH = AttackPathsQueryDefinition(
+ id="aws-codebuild-privesc-passrole-create-project-batch",
+ name="CodeBuild Batch Project Creation with Privileged Role (CODEBUILD-004)",
+ short_description="Create a CodeBuild project configured for batch builds with a privileged role to execute arbitrary code via a malicious buildspec.",
+ description="Detect principals who can pass IAM roles, create CodeBuild projects, and start batch builds. This allows creating a project with a privileged role attached and executing arbitrary code through a malicious batch buildspec, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - CODEBUILD-004 - iam:PassRole + codebuild:CreateProject + codebuild:StartBuildBatch",
+ link="https://pathfinding.cloud/paths/codebuild-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find codebuild:CreateProject permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'codebuild:createproject'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find codebuild:StartBuildBatch permission
+ MATCH (principal)--(batch_policy:AWSPolicy)--(stmt_batch:AWSPolicyStatement)
+ WHERE stmt_batch.effect = 'Allow'
+ AND any(action IN stmt_batch.action WHERE
+ toLower(action) = 'codebuild:startbuildbatch'
+ OR toLower(action) = 'codebuild:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust CodeBuild service (can be passed to CodeBuild)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# DATAPIPELINE-001
+AWS_DATAPIPELINE_PRIVESC_PASSROLE_CREATE_PIPELINE = AttackPathsQueryDefinition(
+ id="aws-datapipeline-privesc-passrole-create-pipeline",
+ name="Data Pipeline Creation with Privileged Role (DATAPIPELINE-001)",
+ short_description="Create a Data Pipeline with a privileged role to execute arbitrary commands on provisioned infrastructure.",
+ description="Detect principals who can pass IAM roles, create Data Pipelines, define pipeline objects, and activate them. This allows creating a pipeline with a privileged role attached and executing arbitrary commands on the provisioned EC2 instances or EMR clusters, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - DATAPIPELINE-001 - iam:PassRole + datapipeline:CreatePipeline + datapipeline:PutPipelineDefinition + datapipeline:ActivatePipeline",
+ link="https://pathfinding.cloud/paths/datapipeline-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find datapipeline:CreatePipeline permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'datapipeline:createpipeline'
+ OR toLower(action) = 'datapipeline:*'
+ OR action = '*'
+ )
+
+ // Find datapipeline:PutPipelineDefinition permission
+ MATCH (principal)--(put_policy:AWSPolicy)--(stmt_put:AWSPolicyStatement)
+ WHERE stmt_put.effect = 'Allow'
+ AND any(action IN stmt_put.action WHERE
+ toLower(action) = 'datapipeline:putpipelinedefinition'
+ OR toLower(action) = 'datapipeline:*'
+ OR action = '*'
+ )
+
+ // Find datapipeline:ActivatePipeline permission
+ MATCH (principal)--(activate_policy:AWSPolicy)--(stmt_activate:AWSPolicyStatement)
+ WHERE stmt_activate.effect = 'Allow'
+ AND any(action IN stmt_activate.action WHERE
+ toLower(action) = 'datapipeline:activatepipeline'
+ OR toLower(action) = 'datapipeline:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Data Pipeline or EMR service (can be passed to DataPipeline)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted_principal:AWSPrincipal)
+ WHERE trusted_principal.arn IN ['datapipeline.amazonaws.com', 'elasticmapreduce.amazonaws.com']
+ AND any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# EC2-001
+AWS_EC2_PRIVESC_PASSROLE_IAM = AttackPathsQueryDefinition(
+ id="aws-ec2-privesc-passrole-iam",
+ name="EC2 Instance Launch with Privileged Role (EC2-001)",
+ short_description="Launch EC2 instances with privileged IAM roles to gain their permissions via IMDS.",
+ description="Detect principals who can launch EC2 instances with privileged IAM roles attached. This allows gaining the permissions of the passed role by accessing the EC2 instance metadata service.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - EC2-001 - iam:PassRole + ec2:RunInstances",
+ link="https://pathfinding.cloud/paths/ec2-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ec2:RunInstances permission
+ MATCH (principal)--(ec2_policy:AWSPolicy)--(stmt_ec2:AWSPolicyStatement)
+ WHERE stmt_ec2.effect = 'Allow'
+ AND any(action IN stmt_ec2.action WHERE
+ toLower(action) = 'ec2:runinstances'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust EC2 service (can be passed to EC2)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ec2.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# EC2-002
+AWS_EC2_PRIVESC_MODIFY_INSTANCE_ATTRIBUTE = AttackPathsQueryDefinition(
+ id="aws-ec2-privesc-modify-instance-attribute",
+ name="EC2 Role Hijacking via UserData Injection (EC2-002)",
+ short_description="Inject malicious scripts into EC2 instance userData to gain the attached role's permissions.",
+ description="Detect principals who can modify EC2 instance userData, stop, and start instances. This allows injecting malicious scripts that execute on instance restart, gaining the permissions of the instance's attached IAM role.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - EC2-002 - ec2:ModifyInstanceAttribute + ec2:StopInstances + ec2:StartInstances",
+ link="https://pathfinding.cloud/paths/ec2-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ec2:ModifyInstanceAttribute permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(modify_policy:AWSPolicy)--(stmt_modify:AWSPolicyStatement)
+ WHERE stmt_modify.effect = 'Allow'
+ AND any(action IN stmt_modify.action WHERE
+ toLower(action) = 'ec2:modifyinstanceattribute'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find ec2:StopInstances permission (can be same or different policy)
+ MATCH (principal)--(stop_policy:AWSPolicy)--(stmt_stop:AWSPolicyStatement)
+ WHERE stmt_stop.effect = 'Allow'
+ AND any(action IN stmt_stop.action WHERE
+ toLower(action) = 'ec2:stopinstances'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find ec2:StartInstances permission (can be same or different policy)
+ MATCH (principal)--(start_policy:AWSPolicy)--(stmt_start:AWSPolicyStatement)
+ WHERE stmt_start.effect = 'Allow'
+ AND any(action IN stmt_start.action WHERE
+ toLower(action) = 'ec2:startinstances'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find EC2 instances with instance profiles (potential targets)
+ MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# EC2-003
+AWS_EC2_PRIVESC_PASSROLE_SPOT_INSTANCES = AttackPathsQueryDefinition(
+ id="aws-ec2-privesc-passrole-spot-instances",
+ name="Spot Instance Launch with Privileged Role (EC2-003)",
+ short_description="Launch EC2 Spot Instances with privileged IAM roles to gain their permissions via IMDS.",
+ description="Detect principals who can pass IAM roles and request EC2 Spot Instances. This allows launching a spot instance with a privileged role attached, gaining that role's permissions via the instance metadata service.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - EC2-003 - iam:PassRole + ec2:RequestSpotInstances",
+ link="https://pathfinding.cloud/paths/ec2-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ec2:RequestSpotInstances permission
+ MATCH (principal)--(spot_policy:AWSPolicy)--(stmt_spot:AWSPolicyStatement)
+ WHERE stmt_spot.effect = 'Allow'
+ AND any(action IN stmt_spot.action WHERE
+ toLower(action) = 'ec2:requestspotinstances'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust EC2 service (can be passed to EC2 spot instances)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ec2.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# EC2-004
+AWS_EC2_PRIVESC_LAUNCH_TEMPLATE = AttackPathsQueryDefinition(
+ id="aws-ec2-privesc-launch-template",
+ name="Launch Template Poisoning for Role Access (EC2-004)",
+ short_description="Inject malicious userData into launch templates that reference privileged roles, no PassRole needed.",
+ description="Detect principals who can create new launch template versions and modify launch templates. This allows injecting malicious user data into existing templates that already reference privileged IAM roles, without requiring iam:PassRole permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - EC2-004 - ec2:CreateLaunchTemplateVersion + ec2:ModifyLaunchTemplate",
+ link="https://pathfinding.cloud/paths/ec2-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ec2:CreateLaunchTemplateVersion permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'ec2:createlaunchtemplateversion'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find ec2:ModifyLaunchTemplate permission
+ MATCH (principal)--(modify_policy:AWSPolicy)--(stmt_modify:AWSPolicyStatement)
+ WHERE stmt_modify.effect = 'Allow'
+ AND any(action IN stmt_modify.action WHERE
+ toLower(action) = 'ec2:modifylaunchtemplate'
+ OR toLower(action) = 'ec2:*'
+ OR action = '*'
+ )
+
+ // Find launch templates in the account (potential targets)
+ MATCH path_target = (aws)--(template:LaunchTemplate)
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# EC2INSTANCECONNECT-003
+AWS_EC2INSTANCECONNECT_PRIVESC_SEND_SSH_PUBLIC_KEY = AttackPathsQueryDefinition(
+ id="aws-ec2instanceconnect-privesc-send-ssh-public-key",
+ name="EC2 Instance Connect SSH Access for Role Credentials (EC2INSTANCECONNECT-003)",
+ short_description="Push a temporary SSH key to an EC2 instance via Instance Connect to access its attached role credentials through IMDS.",
+ description="Detect principals who can send SSH public keys via EC2 Instance Connect. This allows establishing an SSH session on a running EC2 instance and retrieving the attached IAM role's temporary credentials from the Instance Metadata Service (IMDS), gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - EC2INSTANCECONNECT-003 - ec2-instance-connect:SendSSHPublicKey",
+ link="https://pathfinding.cloud/paths/ec2instanceconnect-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ec2-instance-connect:SendSSHPublicKey permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(connect_policy:AWSPolicy)--(stmt_connect:AWSPolicyStatement)
+ WHERE stmt_connect.effect = 'Allow'
+ AND any(action IN stmt_connect.action WHERE
+ toLower(action) = 'ec2-instance-connect:sendsshpublickey'
+ OR toLower(action) = 'ec2-instance-connect:*'
+ OR action = '*'
+ )
+
+ // Find EC2 instances with attached roles (targets for credential theft via IMDS)
+ MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-001
+AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-passrole-create-service",
+ name="ECS Service Creation with Privileged Role (ECS-001 - New Cluster)",
+ short_description="Create an ECS cluster and service with a privileged Fargate task role to execute arbitrary code.",
+ description="Detect principals who can pass IAM roles, create ECS clusters, register task definitions, and create services. This allows creating a Fargate task with a privileged role attached, gaining that role's permissions to execute arbitrary code via the container.",
+ provider="aws",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-001 - iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:CreateService",
+ link="https://pathfinding.cloud/paths/ecs-001",
+ ),
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ecs:CreateCluster permission
+ MATCH (principal)--(cluster_policy:AWSPolicy)--(stmt_cluster:AWSPolicyStatement)
+ WHERE stmt_cluster.effect = 'Allow'
+ AND any(action IN stmt_cluster.action WHERE
+ toLower(action) = 'ecs:createcluster'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RegisterTaskDefinition permission
+ MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
+ WHERE stmt_taskdef.effect = 'Allow'
+ AND any(action IN stmt_taskdef.action WHERE
+ toLower(action) = 'ecs:registertaskdefinition'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:CreateService permission
+ MATCH (principal)--(service_policy:AWSPolicy)--(stmt_service:AWSPolicyStatement)
+ WHERE stmt_service.effect = 'Allow'
+ AND any(action IN stmt_service.action WHERE
+ toLower(action) = 'ecs:createservice'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-002
+AWS_ECS_PRIVESC_PASSROLE_RUN_TASK = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-passrole-run-task",
+ name="ECS Task Execution with Privileged Role (ECS-002 - New Cluster)",
+ short_description="Create an ECS cluster and run a one-off Fargate task with a privileged role to execute arbitrary code.",
+ description="Detect principals who can pass IAM roles, create ECS clusters, register task definitions, and run tasks. This allows creating a Fargate task with a privileged role attached, gaining that role's permissions to execute arbitrary code via the container. Unlike ecs:CreateService, ecs:RunTask executes the task once without creating a persistent service.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-002 - iam:PassRole + ecs:CreateCluster + ecs:RegisterTaskDefinition + ecs:RunTask",
+ link="https://pathfinding.cloud/paths/ecs-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ecs:CreateCluster permission
+ MATCH (principal)--(cluster_policy:AWSPolicy)--(stmt_cluster:AWSPolicyStatement)
+ WHERE stmt_cluster.effect = 'Allow'
+ AND any(action IN stmt_cluster.action WHERE
+ toLower(action) = 'ecs:createcluster'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RegisterTaskDefinition permission
+ MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
+ WHERE stmt_taskdef.effect = 'Allow'
+ AND any(action IN stmt_taskdef.action WHERE
+ toLower(action) = 'ecs:registertaskdefinition'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RunTask permission
+ MATCH (principal)--(runtask_policy:AWSPolicy)--(stmt_runtask:AWSPolicyStatement)
+ WHERE stmt_runtask.effect = 'Allow'
+ AND any(action IN stmt_runtask.action WHERE
+ toLower(action) = 'ecs:runtask'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-003
+AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE_EXISTING_CLUSTER = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-passrole-create-service-existing-cluster",
+ name="ECS Service Creation with Privileged Role (ECS-003 - Existing Cluster)",
+ short_description="Deploy a Fargate service with a privileged role on an existing ECS cluster.",
+ description="Detect principals who can pass IAM roles, register ECS task definitions, and create services on existing clusters. Unlike ECS-001, this does not require ecs:CreateCluster since it targets clusters that already exist. The attacker registers a task definition with a privileged role and launches it as a Fargate service, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-003 - iam:PassRole + ecs:RegisterTaskDefinition + ecs:CreateService",
+ link="https://pathfinding.cloud/paths/ecs-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RegisterTaskDefinition permission
+ MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
+ WHERE stmt_taskdef.effect = 'Allow'
+ AND any(action IN stmt_taskdef.action WHERE
+ toLower(action) = 'ecs:registertaskdefinition'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:CreateService permission
+ MATCH (principal)--(service_policy:AWSPolicy)--(stmt_service:AWSPolicyStatement)
+ WHERE stmt_service.effect = 'Allow'
+ AND any(action IN stmt_service.action WHERE
+ toLower(action) = 'ecs:createservice'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-004
+AWS_ECS_PRIVESC_PASSROLE_RUN_TASK_EXISTING_CLUSTER = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-passrole-run-task-existing-cluster",
+ name="ECS Task Execution with Privileged Role (ECS-004 - Existing Cluster)",
+ short_description="Run a one-off Fargate task with a privileged role on an existing ECS cluster.",
+ description="Detect principals who can pass IAM roles, register ECS task definitions, and run tasks on existing clusters. Unlike ECS-002, this does not require ecs:CreateCluster since it targets clusters that already exist. The attacker registers a task definition with a privileged role and runs it as a one-off Fargate task, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-004 - iam:PassRole + ecs:RegisterTaskDefinition + ecs:RunTask",
+ link="https://pathfinding.cloud/paths/ecs-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RegisterTaskDefinition permission
+ MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
+ WHERE stmt_taskdef.effect = 'Allow'
+ AND any(action IN stmt_taskdef.action WHERE
+ toLower(action) = 'ecs:registertaskdefinition'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RunTask permission
+ MATCH (principal)--(runtask_policy:AWSPolicy)--(stmt_runtask:AWSPolicyStatement)
+ WHERE stmt_runtask.effect = 'Allow'
+ AND any(action IN stmt_runtask.action WHERE
+ toLower(action) = 'ecs:runtask'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-005
+AWS_ECS_PRIVESC_PASSROLE_START_TASK_EXISTING_CLUSTER = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-passrole-start-task-existing-cluster",
+ name="ECS Task Start with Privileged Role on EC2 (ECS-005 - Existing Cluster)",
+ short_description="Register a task definition with a privileged role and start it on an EC2 container instance to execute arbitrary code.",
+ description="Detect principals who can pass IAM roles, register ECS task definitions, and start tasks on existing EC2 container instances. Unlike ecs:RunTask which works with both EC2 and Fargate, ecs:StartTask is specific to EC2 launch types and requires specifying an existing container instance ARN. The attacker registers a task definition with a privileged role and starts it on a container instance, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-005 - iam:PassRole + ecs:RegisterTaskDefinition + ecs:StartTask",
+ link="https://pathfinding.cloud/paths/ecs-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find ecs:RegisterTaskDefinition permission
+ MATCH (principal)--(taskdef_policy:AWSPolicy)--(stmt_taskdef:AWSPolicyStatement)
+ WHERE stmt_taskdef.effect = 'Allow'
+ AND any(action IN stmt_taskdef.action WHERE
+ toLower(action) = 'ecs:registertaskdefinition'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:StartTask permission
+ MATCH (principal)--(starttask_policy:AWSPolicy)--(stmt_starttask:AWSPolicyStatement)
+ WHERE stmt_starttask.effect = 'Allow'
+ AND any(action IN stmt_starttask.action WHERE
+ toLower(action) = 'ecs:starttask'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (can be passed to ECS tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# ECS-006
+AWS_ECS_PRIVESC_EXECUTE_COMMAND = AttackPathsQueryDefinition(
+ id="aws-ecs-privesc-execute-command",
+ name="ECS Exec Container Hijacking for Role Credentials (ECS-006)",
+ short_description="Shell into a running ECS container via ECS Exec to steal the attached task role's credentials.",
+ description="Detect principals who can execute commands in running ECS containers and describe tasks. This allows establishing an interactive shell session in a container where ECS Exec is enabled, then retrieving the task role's temporary credentials from the container metadata service, without requiring iam:PassRole.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - ECS-006 - ecs:ExecuteCommand + ecs:DescribeTasks",
+ link="https://pathfinding.cloud/paths/ecs-006",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ecs:ExecuteCommand permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(exec_policy:AWSPolicy)--(stmt_exec:AWSPolicyStatement)
+ WHERE stmt_exec.effect = 'Allow'
+ AND any(action IN stmt_exec.action WHERE
+ toLower(action) = 'ecs:executecommand'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find ecs:DescribeTasks permission (required by AWS CLI to get container runtime ID)
+ MATCH (principal)--(describe_policy:AWSPolicy)--(stmt_describe:AWSPolicyStatement)
+ WHERE stmt_describe.effect = 'Allow'
+ AND any(action IN stmt_describe.action WHERE
+ toLower(action) = 'ecs:describetasks'
+ OR toLower(action) = 'ecs:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust ECS tasks service (already attached to running tasks)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-001
+AWS_GLUE_PRIVESC_PASSROLE_DEV_ENDPOINT = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-passrole-dev-endpoint",
+ name="Glue Dev Endpoint with Privileged Role (GLUE-001)",
+ short_description="Create a Glue development endpoint with a privileged role attached to gain its permissions.",
+ description="Detect principals who can pass IAM roles and create Glue development endpoints. This allows creating a dev endpoint with a privileged role attached, gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-001 - iam:PassRole + glue:CreateDevEndpoint",
+ link="https://pathfinding.cloud/paths/glue-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find glue:CreateDevEndpoint permission
+ MATCH (principal)--(glue_policy:AWSPolicy)--(stmt_glue:AWSPolicyStatement)
+ WHERE stmt_glue.effect = 'Allow'
+ AND any(action IN stmt_glue.action WHERE
+ toLower(action) = 'glue:createdevendpoint'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (can be passed to Glue)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-002
+AWS_GLUE_PRIVESC_UPDATE_DEV_ENDPOINT = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-update-dev-endpoint",
+ name="Glue Dev Endpoint SSH Hijacking via Update (GLUE-002)",
+ short_description="Update an existing Glue development endpoint to inject an SSH public key and access its attached role credentials.",
+ description="Detect principals who can update Glue development endpoints. This allows adding an attacker-controlled SSH public key to an existing dev endpoint that already has a privileged role attached, then SSHing into it to steal the role's temporary credentials without requiring iam:PassRole.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-002 - glue:UpdateDevEndpoint",
+ link="https://pathfinding.cloud/paths/glue-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with glue:UpdateDevEndpoint permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'glue:updatedevendpoint'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (already attached to existing dev endpoints)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-003
+AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-passrole-create-job",
+ name="Glue Job Creation with Privileged Role (GLUE-003)",
+ short_description="Create a Glue job with a privileged role and start it to execute arbitrary code with that role's permissions.",
+ description="Detect principals who can pass IAM roles, create Glue jobs, and start job runs. This allows creating a Python shell job with a privileged role attached and executing arbitrary code that modifies IAM permissions, a cost-effective alternative to Glue development endpoints.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-003 - iam:PassRole + glue:CreateJob + glue:StartJobRun",
+ link="https://pathfinding.cloud/paths/glue-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find glue:CreateJob permission
+ MATCH (principal)--(createjob_policy:AWSPolicy)--(stmt_createjob:AWSPolicyStatement)
+ WHERE stmt_createjob.effect = 'Allow'
+ AND any(action IN stmt_createjob.action WHERE
+ toLower(action) = 'glue:createjob'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find glue:StartJobRun permission
+ MATCH (principal)--(startjob_policy:AWSPolicy)--(stmt_startjob:AWSPolicyStatement)
+ WHERE stmt_startjob.effect = 'Allow'
+ AND any(action IN stmt_startjob.action WHERE
+ toLower(action) = 'glue:startjobrun'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (can be passed to Glue jobs)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-004
+AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB_TRIGGER = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-passrole-create-job-trigger",
+ name="Glue Job Creation with Scheduled Trigger and Privileged Role (GLUE-004)",
+ short_description="Create a Glue job with a privileged role and a scheduled trigger to persistently execute arbitrary code.",
+ description="Detect principals who can pass IAM roles, create Glue jobs, and create triggers with automatic activation. Unlike manual execution via StartJobRun, this creates a persistent attack by scheduling the job to run repeatedly, making it harder to detect and remediate.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-004 - iam:PassRole + glue:CreateJob + glue:CreateTrigger",
+ link="https://pathfinding.cloud/paths/glue-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find glue:CreateJob permission
+ MATCH (principal)--(createjob_policy:AWSPolicy)--(stmt_createjob:AWSPolicyStatement)
+ WHERE stmt_createjob.effect = 'Allow'
+ AND any(action IN stmt_createjob.action WHERE
+ toLower(action) = 'glue:createjob'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find glue:CreateTrigger permission
+ MATCH (principal)--(trigger_policy:AWSPolicy)--(stmt_trigger:AWSPolicyStatement)
+ WHERE stmt_trigger.effect = 'Allow'
+ AND any(action IN stmt_trigger.action WHERE
+ toLower(action) = 'glue:createtrigger'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (can be passed to Glue jobs)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-005
+AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-passrole-update-job",
+ name="Glue Job Hijacking via Update with Privileged Role (GLUE-005)",
+ short_description="Update an existing Glue job to attach a privileged role and inject malicious code, then start it to gain that role's permissions.",
+ description="Detect principals who can pass IAM roles, update existing Glue jobs, and start job runs. This allows modifying an existing job's role and script to execute arbitrary code with elevated privileges, a stealthier variant of job creation since it reuses existing infrastructure rather than creating new resources.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-005 - iam:PassRole + glue:UpdateJob + glue:StartJobRun",
+ link="https://pathfinding.cloud/paths/glue-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find glue:UpdateJob permission
+ MATCH (principal)--(updatejob_policy:AWSPolicy)--(stmt_updatejob:AWSPolicyStatement)
+ WHERE stmt_updatejob.effect = 'Allow'
+ AND any(action IN stmt_updatejob.action WHERE
+ toLower(action) = 'glue:updatejob'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find glue:StartJobRun permission
+ MATCH (principal)--(startjob_policy:AWSPolicy)--(stmt_startjob:AWSPolicyStatement)
+ WHERE stmt_startjob.effect = 'Allow'
+ AND any(action IN stmt_startjob.action WHERE
+ toLower(action) = 'glue:startjobrun'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (can be passed to Glue jobs)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# GLUE-006
+AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB_TRIGGER = AttackPathsQueryDefinition(
+ id="aws-glue-privesc-passrole-update-job-trigger",
+ name="Glue Job Hijacking with Scheduled Trigger and Privileged Role (GLUE-006)",
+ short_description="Update an existing Glue job to attach a privileged role and inject malicious code, then create a scheduled trigger for persistent automated execution.",
+ description="Detect principals who can pass IAM roles, update existing Glue jobs, and create triggers with automatic activation. This combines the stealth of modifying existing infrastructure with the persistence of scheduled automation, creating a recurring backdoor that re-executes even after remediation attempts.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - GLUE-006 - iam:PassRole + glue:UpdateJob + glue:CreateTrigger",
+ link="https://pathfinding.cloud/paths/glue-006",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find glue:UpdateJob permission
+ MATCH (principal)--(updatejob_policy:AWSPolicy)--(stmt_updatejob:AWSPolicyStatement)
+ WHERE stmt_updatejob.effect = 'Allow'
+ AND any(action IN stmt_updatejob.action WHERE
+ toLower(action) = 'glue:updatejob'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find glue:CreateTrigger permission
+ MATCH (principal)--(trigger_policy:AWSPolicy)--(stmt_trigger:AWSPolicyStatement)
+ WHERE stmt_trigger.effect = 'Allow'
+ AND any(action IN stmt_trigger.action WHERE
+ toLower(action) = 'glue:createtrigger'
+ OR toLower(action) = 'glue:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Glue service (can be passed to Glue jobs)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-001
+AWS_IAM_PRIVESC_CREATE_POLICY_VERSION = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-create-policy-version",
+ name="Policy Version Override for Self-Escalation (IAM-001)",
+ short_description="Create a new version of an attached policy with administrative permissions, instantly escalating the principal's own privileges.",
+ description="Detect principals who can create new policy versions. If a customer-managed policy is already attached to a principal and that principal has iam:CreatePolicyVersion on that policy, they can replace its contents with a fully permissive policy and set it as the default, gaining immediate administrative access.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-001 - iam:CreatePolicyVersion",
+ link="https://pathfinding.cloud/paths/iam-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreatePolicyVersion permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createpolicyversion'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find customer-managed policies attached to the same principal that can be overwritten
+ MATCH path_target = (aws)--(target_policy:AWSPolicy)--(principal)
+ WHERE target_policy.arn CONTAINS $provider_uid
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_policy.arn CONTAINS resource
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-002
+AWS_IAM_PRIVESC_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-create-access-key",
+ name="Access Key Creation for Lateral Movement (IAM-002)",
+ short_description="Create access keys for other IAM users to gain their permissions and move laterally across the account.",
+ description="Detect principals who can create access keys for other IAM users. This allows generating new credentials for any target user within the resource scope, immediately gaining that user's permissions without needing their password or existing keys.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-002 - iam:CreateAccessKey",
+ link="https://pathfinding.cloud/paths/iam-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreateAccessKey permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createaccesskey'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users that the principal can create access keys for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-003
+AWS_IAM_PRIVESC_DELETE_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-delete-create-access-key",
+ name="Access Key Rotation Attack for Lateral Movement (IAM-003)",
+ short_description="Delete and recreate access keys for other IAM users to bypass the two-key limit and gain their permissions.",
+ description="Detect principals who can both delete and create access keys for other IAM users. This variation of IAM-002 handles the scenario where a target user already has the maximum of two access keys by first deleting one, then creating a replacement under the attacker's control.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-003 - iam:CreateAccessKey + iam:DeleteAccessKey",
+ link="https://pathfinding.cloud/paths/iam-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreateAccessKey permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createaccesskey'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:DeleteAccessKey permission
+ MATCH (principal)--(delete_policy:AWSPolicy)--(stmt_delete:AWSPolicyStatement)
+ WHERE stmt_delete.effect = 'Allow'
+ AND any(action IN stmt_delete.action WHERE
+ toLower(action) = 'iam:deleteaccesskey'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users that the principal can rotate access keys for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+ AND any(resource IN stmt_delete.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-004
+AWS_IAM_PRIVESC_CREATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-create-login-profile",
+ name="Console Login Profile Creation for Lateral Movement (IAM-004)",
+ short_description="Create console login profiles for other IAM users to access the AWS Console with their permissions.",
+ description="Detect principals who can create console login profiles for other IAM users. By setting a known password on a target user that lacks a login profile, the attacker gains AWS Console access with that user's permissions without needing their existing credentials.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-004 - iam:CreateLoginProfile",
+ link="https://pathfinding.cloud/paths/iam-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreateLoginProfile permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createloginprofile'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users that the principal can create login profiles for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-005
+AWS_IAM_PRIVESC_PUT_ROLE_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-role-policy",
+ name="Inline Policy Injection for Self-Escalation (IAM-005)",
+ short_description="Attach an inline policy with administrative permissions to your own role, instantly escalating privileges.",
+ description="Detect roles that can use iam:PutRolePolicy on themselves. A role with this permission can attach an inline policy granting any permissions, including full administrative access, without needing to modify or assume any other resource.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-005 - iam:PutRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find roles with iam:PutRolePolicy permission scoped to themselves
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR role.arn CONTAINS resource
+ OR resource CONTAINS role.name
+ )
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-006
+AWS_IAM_PRIVESC_UPDATE_LOGIN_PROFILE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-update-login-profile",
+ name="Console Password Override for Lateral Movement (IAM-006)",
+ short_description="Change the console password of other IAM users to log in as them and gain their permissions.",
+ description="Detect principals who can update console login profiles for other IAM users. By resetting a target user's password, the attacker gains AWS Console access with that user's permissions. Unlike IAM-004, this targets users who already have a login profile configured.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-006 - iam:UpdateLoginProfile",
+ link="https://pathfinding.cloud/paths/iam-006",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:UpdateLoginProfile permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:updateloginprofile'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users that the principal can update login profiles for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-007
+AWS_IAM_PRIVESC_PUT_USER_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-user-policy",
+ name="Inline Policy Injection on User for Self-Escalation (IAM-007)",
+ short_description="Attach an inline policy with administrative permissions to your own IAM user, instantly escalating privileges.",
+ description="Detect IAM users that can use iam:PutUserPolicy on themselves. A user with this permission can attach an inline policy granting any permissions, including full administrative access, without needing to modify or assume any other resource. This is the user equivalent of IAM-005 (PutRolePolicy).",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-007 - iam:PutUserPolicy",
+ link="https://pathfinding.cloud/paths/iam-007",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find users with iam:PutUserPolicy permission scoped to themselves
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putuserpolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR user.arn CONTAINS resource
+ OR resource CONTAINS user.name
+ )
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-008
+AWS_IAM_PRIVESC_ATTACH_USER_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-user-policy",
+ name="Managed Policy Attachment on User for Self-Escalation (IAM-008)",
+ short_description="Attach existing managed policies with administrative permissions to your own IAM user, instantly escalating privileges.",
+ description="Detect IAM users that can use iam:AttachUserPolicy on themselves. A user with this permission can attach any existing managed policy, including AdministratorAccess, to themselves without needing to modify or assume any other resource. Unlike IAM-007 (PutUserPolicy), this requires an existing managed policy with elevated permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-008 - iam:AttachUserPolicy",
+ link="https://pathfinding.cloud/paths/iam-008",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find users with iam:AttachUserPolicy permission scoped to themselves
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachuserpolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR user.arn CONTAINS resource
+ OR resource CONTAINS user.name
+ )
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-009
+AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-role-policy",
+ name="Managed Policy Attachment on Role for Self-Escalation (IAM-009)",
+ short_description="Attach existing managed policies with administrative permissions to your own IAM role, instantly escalating privileges.",
+ description="Detect IAM roles that can use iam:AttachRolePolicy on themselves. A role with this permission can attach any existing managed policy, including AdministratorAccess, to itself without needing to modify or assume any other resource. Unlike IAM-005 (PutRolePolicy), this requires an existing managed policy with elevated permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-009 - iam:AttachRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-009",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find roles with iam:AttachRolePolicy permission scoped to themselves
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(role:AWSRole)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR role.arn CONTAINS resource
+ OR resource CONTAINS role.name
+ )
+
+ WITH collect(path) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-010
+AWS_IAM_PRIVESC_ATTACH_GROUP_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-group-policy",
+ name="Managed Policy Attachment on Group for Self-Escalation (IAM-010)",
+ short_description="Attach existing managed policies with administrative permissions to a group you belong to, escalating privileges for all group members.",
+ description="Detect IAM users that can use iam:AttachGroupPolicy on a group they are a member of. A user with this permission can attach any existing managed policy, including AdministratorAccess, to a group they belong to, immediately escalating privileges for all group members.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-010 - iam:AttachGroupPolicy",
+ link="https://pathfinding.cloud/paths/iam-010",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find users with iam:AttachGroupPolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachgrouppolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find groups the user is a member of and can attach policies to
+ MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_group.arn CONTAINS resource
+ OR resource CONTAINS target_group.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-011
+AWS_IAM_PRIVESC_PUT_GROUP_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-group-policy",
+ name="Inline Policy Injection on Group for Self-Escalation (IAM-011)",
+ short_description="Attach an inline policy with administrative permissions to a group you belong to, escalating privileges for all group members.",
+ description="Detect IAM users that can use iam:PutGroupPolicy on a group they are a member of. A user with this permission can attach an inline policy granting any permissions to a group they belong to, immediately escalating privileges for all group members. Unlike IAM-010, this does not require an existing managed policy.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-011 - iam:PutGroupPolicy",
+ link="https://pathfinding.cloud/paths/iam-011",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find users with iam:PutGroupPolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(user:AWSUser)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putgrouppolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find groups the user is a member of and can put policies on
+ MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)<-[:MEMBER_AWS_GROUP]-(user)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_group.arn CONTAINS resource
+ OR resource CONTAINS target_group.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-012
+AWS_IAM_PRIVESC_UPDATE_ASSUME_ROLE_POLICY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-update-assume-role-policy",
+ name="Trust Policy Hijacking for Role Assumption (IAM-012)",
+ short_description="Modify a role's trust policy to allow yourself to assume it, gaining the role's permissions.",
+ description="Detect principals who can update the assume role policy (trust policy) of other IAM roles. By modifying a target role's trust policy to trust the attacker's principal, the attacker can then assume the role and gain all its permissions, including potential administrative access.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-012 - iam:UpdateAssumeRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-012",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:UpdateAssumeRolePolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:updateassumerolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles whose trust policy can be modified
+ MATCH path_target = (aws)--(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-013
+AWS_IAM_PRIVESC_ADD_USER_TO_GROUP = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-add-user-to-group",
+ name="Group Membership Hijacking for Privilege Escalation (IAM-013)",
+ short_description="Add yourself to a privileged IAM group to inherit its permissions, gaining access to all policies attached to the group.",
+ description="Detect principals who can add users to IAM groups. By adding themselves to a group with elevated permissions such as AdministratorAccess, the attacker immediately inherits all policies attached to that group. The level of access gained depends on the permissions of the target group.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-013 - iam:AddUserToGroup",
+ link="https://pathfinding.cloud/paths/iam-013",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:AddUserToGroup permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:addusertogroup'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target groups the principal can add users to
+ MATCH path_target = (aws)-[:RESOURCE]->(target_group:AWSGroup)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_group.arn CONTAINS resource
+ OR resource CONTAINS target_group.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-014
+AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-role-policy-assume-role",
+ name="Managed Policy Attachment with Role Assumption for Lateral Movement (IAM-014)",
+ short_description="Attach administrative managed policies to another role you can assume, then assume it to gain elevated privileges.",
+ description="Detect principals who can attach managed policies to a different IAM role and also assume that role. By attaching AdministratorAccess to a target role and then assuming it, the attacker gains full administrative access. This is a variation of IAM-009 for lateral movement where the principal targets another assumable role instead of their own.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-014 - iam:AttachRolePolicy + sts:AssumeRole",
+ link="https://pathfinding.cloud/paths/iam-014",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:AttachRolePolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can assume and attach policies to
+ MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-015
+AWS_IAM_PRIVESC_ATTACH_USER_POLICY_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-user-policy-create-access-key",
+ name="Managed Policy Attachment with Access Key Creation for Lateral Movement (IAM-015)",
+ short_description="Attach administrative managed policies to another IAM user and create access keys for them to gain programmatic access with elevated privileges.",
+ description="Detect principals who can attach managed policies to another IAM user and also create access keys for that user. By attaching AdministratorAccess to a target user and creating access keys, the attacker gains programmatic access with the target user's elevated permissions. This combines IAM-008 (AttachUserPolicy) with IAM-002 (CreateAccessKey) for lateral movement.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-015 - iam:AttachUserPolicy + iam:CreateAccessKey",
+ link="https://pathfinding.cloud/paths/iam-015",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:AttachUserPolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachuserpolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:CreateAccessKey permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'iam:createaccesskey'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users the principal can attach policies to and create keys for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-016
+AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-create-policy-version-assume-role",
+ name="Policy Version Override with Role Assumption for Lateral Movement (IAM-016)",
+ short_description="Create a new version of a customer-managed policy attached to another role with administrative permissions, then assume that role to gain elevated access.",
+ description="Detect principals who can create new versions of customer-managed policies attached to other roles and also assume those roles. By creating a new policy version with administrative permissions on a policy attached to a target role, then assuming that role, the attacker gains full administrative access. This is a variation of IAM-001 for lateral movement where the modified policy is attached to an assumable role rather than the attacker's own principal.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-016 - iam:CreatePolicyVersion + sts:AssumeRole",
+ link="https://pathfinding.cloud/paths/iam-016",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreatePolicyVersion permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createpolicyversion'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can assume that have customer-managed policies the principal can modify
+ MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
+ MATCH (target_role)--(target_policy:AWSPolicy)
+ WHERE target_policy.arn CONTAINS $provider_uid
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_policy.arn CONTAINS resource
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-017
+AWS_IAM_PRIVESC_PUT_ROLE_POLICY_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-role-policy-assume-role",
+ name="Inline Policy Injection with Role Assumption for Lateral Movement (IAM-017)",
+ short_description="Attach an inline policy with administrative permissions to another role you can assume, then assume it to gain elevated privileges.",
+ description="Detect principals who can add inline policies to a different IAM role and also assume that role. By adding an inline policy granting administrative permissions to a target role and then assuming it, the attacker gains full administrative access. This is a variation of IAM-005 for lateral movement where the principal targets another assumable role instead of their own.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-017 - iam:PutRolePolicy + sts:AssumeRole",
+ link="https://pathfinding.cloud/paths/iam-017",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PutRolePolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can assume and put inline policies on
+ MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-018
+AWS_IAM_PRIVESC_PUT_USER_POLICY_CREATE_ACCESS_KEY = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-user-policy-create-access-key",
+ name="Inline Policy Injection with Access Key Creation for Lateral Movement (IAM-018)",
+ short_description="Attach an inline policy with administrative permissions to another IAM user and create access keys for them to gain programmatic access with elevated privileges.",
+ description="Detect principals who can add inline policies to another IAM user and also create access keys for that user. By adding an administrative inline policy to a target user and creating access keys, the attacker gains programmatic access with the target user's elevated permissions. This combines IAM-007 (PutUserPolicy) with IAM-002 (CreateAccessKey) for lateral movement.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-018 - iam:PutUserPolicy + iam:CreateAccessKey",
+ link="https://pathfinding.cloud/paths/iam-018",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PutUserPolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putuserpolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:CreateAccessKey permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'iam:createaccesskey'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target users the principal can put policies on and create keys for
+ MATCH path_target = (aws)--(target_user:AWSUser)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR target_user.arn CONTAINS resource
+ OR resource CONTAINS target_user.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-019
+AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_UPDATE_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-attach-role-policy-update-assume-role",
+ name="Managed Policy Attachment with Trust Policy Hijacking for Privilege Escalation (IAM-019)",
+ short_description="Attach administrative managed policies to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access.",
+ description="Detect principals who can attach managed policies to an IAM role and also update that role's trust policy. By attaching AdministratorAccess and modifying the trust policy to allow the attacker, the principal can then assume the role without needing pre-existing sts:AssumeRole permission. This combines IAM-009 (AttachRolePolicy) with IAM-012 (UpdateAssumeRolePolicy).",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-019 - iam:AttachRolePolicy + iam:UpdateAssumeRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-019",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:AttachRolePolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:attachrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:UpdateAssumeRolePolicy permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'iam:updateassumerolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can attach policies to and update trust policy for
+ MATCH path_target = (aws)--(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-020
+AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_UPDATE_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-create-policy-version-update-assume-role",
+ name="Policy Version Override with Trust Policy Hijacking for Privilege Escalation (IAM-020)",
+ short_description="Create a new version of a customer-managed policy attached to a role with administrative permissions and modify its trust policy to assume it, without prior assume-role access.",
+ description="Detect principals who can create new versions of customer-managed policies attached to roles and also update those roles' trust policies. By creating an administrative policy version and modifying the trust policy to allow the attacker, the principal can assume the role without needing pre-existing sts:AssumeRole permission. This combines IAM-001 (CreatePolicyVersion) with IAM-012 (UpdateAssumeRolePolicy).",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-020 - iam:CreatePolicyVersion + iam:UpdateAssumeRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-020",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:CreatePolicyVersion permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:createpolicyversion'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:UpdateAssumeRolePolicy permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'iam:updateassumerolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles with customer-managed policies the principal can modify and update trust policy for
+ MATCH path_target = (aws)--(target_role:AWSRole)
+ WHERE any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+ MATCH (target_role)--(target_policy:AWSPolicy)
+ WHERE target_policy.arn CONTAINS $provider_uid
+ AND any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_policy.arn CONTAINS resource
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# IAM-021
+AWS_IAM_PRIVESC_PUT_ROLE_POLICY_UPDATE_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-iam-privesc-put-role-policy-update-assume-role",
+ name="Inline Policy Injection with Trust Policy Hijacking for Privilege Escalation (IAM-021)",
+ short_description="Add an inline policy with administrative permissions to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access.",
+ description="Detect principals who can add inline policies to an IAM role and also update that role's trust policy. By adding an administrative inline policy and modifying the trust policy to allow the attacker, the principal can then assume the role without needing pre-existing sts:AssumeRole permission. This combines IAM-005 (PutRolePolicy) with IAM-012 (UpdateAssumeRolePolicy).",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - IAM-021 - iam:PutRolePolicy + iam:UpdateAssumeRolePolicy",
+ link="https://pathfinding.cloud/paths/iam-021",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PutRolePolicy permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'iam:putrolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find iam:UpdateAssumeRolePolicy permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'iam:updateassumerolepolicy'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can put inline policies on and update trust policy for
+ MATCH path_target = (aws)--(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-001
+AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-passrole-create-function",
+ name="Lambda Function Creation with Privileged Role (LAMBDA-001)",
+ short_description="Create a Lambda function with a privileged IAM role and invoke it to execute code with that role's permissions.",
+ description="Detect principals who can create Lambda functions with privileged IAM roles and invoke them. By passing a privileged role to a new Lambda function and invoking it, the attacker executes code with the role's permissions, gaining access to any resources the role can access.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-001 - iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction",
+ link="https://pathfinding.cloud/paths/lambda-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find lambda:CreateFunction permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'lambda:createfunction'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find lambda:InvokeFunction permission
+ MATCH (principal)--(invoke_policy:AWSPolicy)--(stmt_invoke:AWSPolicyStatement)
+ WHERE stmt_invoke.effect = 'Allow'
+ AND any(action IN stmt_invoke.action WHERE
+ toLower(action) = 'lambda:invokefunction'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Lambda service (can be passed to Lambda)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-002
+AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_EVENT_SOURCE = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-passrole-create-function-event-source",
+ name="Lambda Function Creation with Event Source Trigger (LAMBDA-002)",
+ short_description="Create a Lambda function with a privileged IAM role and an event source mapping to trigger it automatically, executing code with the role's permissions.",
+ description="Detect principals who can create Lambda functions with privileged IAM roles and configure event source mappings to trigger them. By passing a privileged role to a new Lambda function and creating an event source mapping (DynamoDB stream, Kinesis, SQS), the attacker executes code with elevated privileges without needing to invoke the function directly.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-002 - iam:PassRole + lambda:CreateFunction + lambda:CreateEventSourceMapping",
+ link="https://pathfinding.cloud/paths/lambda-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find lambda:CreateFunction permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'lambda:createfunction'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find lambda:CreateEventSourceMapping permission
+ MATCH (principal)--(event_policy:AWSPolicy)--(stmt_event:AWSPolicyStatement)
+ WHERE stmt_event.effect = 'Allow'
+ AND any(action IN stmt_event.action WHERE
+ toLower(action) = 'lambda:createeventsourcemapping'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Lambda service (can be passed to Lambda)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-003
+AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-update-function-code",
+ name="Lambda Function Code Injection (LAMBDA-003)",
+ short_description="Modify the code of an existing Lambda function to execute arbitrary commands with the function's execution role permissions.",
+ description="Detect principals who can update the code of existing Lambda functions. By replacing a Lambda function's code with malicious code, the attacker executes arbitrary commands with the privileges of the function's execution role when it is next invoked, either manually or via automatic triggers.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-003 - lambda:UpdateFunctionCode",
+ link="https://pathfinding.cloud/paths/lambda-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with lambda:UpdateFunctionCode permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'lambda:updatefunctioncode'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find existing Lambda functions with execution roles
+ MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR lambda_fn.arn CONTAINS resource
+ OR resource CONTAINS lambda_fn.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-004
+AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_INVOKE = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-update-function-code-invoke",
+ name="Lambda Function Code Injection with Direct Invocation (LAMBDA-004)",
+ short_description="Modify the code of an existing Lambda function and invoke it directly to execute arbitrary commands with the function's execution role permissions.",
+ description="Detect principals who can update the code of existing Lambda functions and invoke them. By replacing a Lambda function's code with malicious code and invoking it directly, the attacker executes arbitrary commands with the privileges of the function's execution role immediately, without waiting for automatic triggers.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-004 - lambda:UpdateFunctionCode + lambda:InvokeFunction",
+ link="https://pathfinding.cloud/paths/lambda-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with lambda:UpdateFunctionCode permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'lambda:updatefunctioncode'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find lambda:InvokeFunction permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'lambda:invokefunction'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find existing Lambda functions with execution roles
+ MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR lambda_fn.arn CONTAINS resource
+ OR resource CONTAINS lambda_fn.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR lambda_fn.arn CONTAINS resource
+ OR resource CONTAINS lambda_fn.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-005
+AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_ADD_PERMISSION = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-update-function-code-add-permission",
+ name="Lambda Function Code Injection with Resource Policy Grant (LAMBDA-005)",
+ short_description="Modify the code of an existing Lambda function and grant yourself invocation permission via its resource-based policy to execute code with the function's execution role.",
+ description="Detect principals who can update the code of existing Lambda functions and add permissions to their resource-based policies. By replacing a Lambda function's code and granting themselves invoke access through the resource-based policy, the attacker executes malicious code with the function's execution role without needing lambda:InvokeFunction as an IAM permission.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-005 - lambda:UpdateFunctionCode + lambda:AddPermission",
+ link="https://pathfinding.cloud/paths/lambda-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with lambda:UpdateFunctionCode permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'lambda:updatefunctioncode'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find lambda:AddPermission permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'lambda:addpermission'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find existing Lambda functions with execution roles
+ MATCH path_target = (aws)-[:RESOURCE]->(lambda_fn:AWSLambda)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR lambda_fn.arn CONTAINS resource
+ OR resource CONTAINS lambda_fn.name
+ )
+ AND any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR lambda_fn.arn CONTAINS resource
+ OR resource CONTAINS lambda_fn.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# LAMBDA-006
+AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_ADD_PERMISSION = AttackPathsQueryDefinition(
+ id="aws-lambda-privesc-passrole-create-function-add-permission",
+ name="Lambda Function Creation with Resource Policy Invocation (LAMBDA-006)",
+ short_description="Create a Lambda function with a privileged IAM role and grant yourself invocation permission via its resource-based policy to execute code with the role's permissions.",
+ description="Detect principals who can create Lambda functions with privileged IAM roles and add permissions to their resource-based policies. By passing a privileged role to a new Lambda function and granting themselves invoke access through the resource-based policy, the attacker executes malicious code with elevated privileges without needing lambda:InvokeFunction as an IAM permission.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - LAMBDA-006 - iam:PassRole + lambda:CreateFunction + lambda:AddPermission",
+ link="https://pathfinding.cloud/paths/lambda-006",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find lambda:CreateFunction permission
+ MATCH (principal)--(create_policy:AWSPolicy)--(stmt_create:AWSPolicyStatement)
+ WHERE stmt_create.effect = 'Allow'
+ AND any(action IN stmt_create.action WHERE
+ toLower(action) = 'lambda:createfunction'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find lambda:AddPermission permission
+ MATCH (principal)--(perm_policy:AWSPolicy)--(stmt_perm:AWSPolicyStatement)
+ WHERE stmt_perm.effect = 'Allow'
+ AND any(action IN stmt_perm.action WHERE
+ toLower(action) = 'lambda:addpermission'
+ OR toLower(action) = 'lambda:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust Lambda service (can be passed to Lambda)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'lambda.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SAGEMAKER-001
+AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_NOTEBOOK = AttackPathsQueryDefinition(
+ id="aws-sagemaker-privesc-passrole-create-notebook",
+ name="SageMaker Notebook Creation with Privileged Role (SAGEMAKER-001)",
+ short_description="Create a SageMaker notebook instance with a privileged IAM role to execute arbitrary code with the role's permissions via the Jupyter environment.",
+ description="Detect principals who can create SageMaker notebook instances with privileged IAM roles. By passing a privileged role to a new notebook instance, the attacker gains shell access through the Jupyter environment and can execute arbitrary commands with the role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SAGEMAKER-001 - iam:PassRole + sagemaker:CreateNotebookInstance",
+ link="https://pathfinding.cloud/paths/sagemaker-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:CreateNotebookInstance permission
+ MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
+ WHERE stmt_sm.effect = 'Allow'
+ AND any(action IN stmt_sm.action WHERE
+ toLower(action) = 'sagemaker:createnotebookinstance'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust SageMaker service (can be passed to SageMaker)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SAGEMAKER-002
+AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_TRAINING_JOB = AttackPathsQueryDefinition(
+ id="aws-sagemaker-privesc-passrole-create-training-job",
+ name="SageMaker Training Job Creation with Privileged Role (SAGEMAKER-002)",
+ short_description="Create a SageMaker training job with a privileged IAM role to execute arbitrary container code with the role's permissions.",
+ description="Detect principals who can create SageMaker training jobs with privileged IAM roles. By passing a privileged role to a new training job with a malicious training script or container, the attacker executes code with elevated privileges and can exfiltrate credentials or modify AWS resources.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SAGEMAKER-002 - iam:PassRole + sagemaker:CreateTrainingJob",
+ link="https://pathfinding.cloud/paths/sagemaker-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:CreateTrainingJob permission
+ MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
+ WHERE stmt_sm.effect = 'Allow'
+ AND any(action IN stmt_sm.action WHERE
+ toLower(action) = 'sagemaker:createtrainingjob'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust SageMaker service (can be passed to SageMaker)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SAGEMAKER-003
+AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_PROCESSING_JOB = AttackPathsQueryDefinition(
+ id="aws-sagemaker-privesc-passrole-create-processing-job",
+ name="SageMaker Processing Job Creation with Privileged Role (SAGEMAKER-003)",
+ short_description="Create a SageMaker processing job with a privileged IAM role to execute arbitrary container code with the role's permissions.",
+ description="Detect principals who can create SageMaker processing jobs with privileged IAM roles. By passing a privileged role to a new processing job with a malicious script or container, the attacker executes code with elevated privileges and can exfiltrate credentials or modify AWS resources.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SAGEMAKER-003 - iam:PassRole + sagemaker:CreateProcessingJob",
+ link="https://pathfinding.cloud/paths/sagemaker-003",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with iam:PassRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(passrole_policy:AWSPolicy)--(stmt_passrole:AWSPolicyStatement)
+ WHERE stmt_passrole.effect = 'Allow'
+ AND any(action IN stmt_passrole.action WHERE
+ toLower(action) = 'iam:passrole'
+ OR toLower(action) = 'iam:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:CreateProcessingJob permission
+ MATCH (principal)--(sm_policy:AWSPolicy)--(stmt_sm:AWSPolicyStatement)
+ WHERE stmt_sm.effect = 'Allow'
+ AND any(action IN stmt_sm.action WHERE
+ toLower(action) = 'sagemaker:createprocessingjob'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find roles that trust SageMaker service (can be passed to SageMaker)
+ MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'sagemaker.amazonaws.com'}})
+ WHERE any(resource IN stmt_passrole.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SAGEMAKER-004
+AWS_SAGEMAKER_PRIVESC_PRESIGNED_NOTEBOOK_URL = AttackPathsQueryDefinition(
+ id="aws-sagemaker-privesc-presigned-notebook-url",
+ name="SageMaker Presigned Notebook URL for Privilege Escalation (SAGEMAKER-004)",
+ short_description="Generate a presigned URL to access an existing SageMaker notebook instance and execute code with its execution role's permissions.",
+ description="Detect principals who can generate presigned URLs to access existing SageMaker notebook instances. By accessing the Jupyter environment via a presigned URL, the attacker can execute arbitrary code with the permissions of the notebook's execution role without creating any new resources.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SAGEMAKER-004 - sagemaker:CreatePresignedNotebookInstanceUrl",
+ link="https://pathfinding.cloud/paths/sagemaker-004",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with sagemaker:CreatePresignedNotebookInstanceUrl permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'sagemaker:createpresignednotebookinstanceurl'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find existing SageMaker notebook instances with execution roles
+ MATCH path_target = (aws)-[:RESOURCE]->(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR notebook.arn CONTAINS resource
+ OR resource CONTAINS notebook.notebook_instance_name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SAGEMAKER-005
+AWS_SAGEMAKER_PRIVESC_LIFECYCLE_CONFIG_NOTEBOOK = AttackPathsQueryDefinition(
+ id="aws-sagemaker-privesc-lifecycle-config-notebook",
+ name="SageMaker Notebook Lifecycle Config Injection (SAGEMAKER-005)",
+ short_description="Inject a malicious lifecycle configuration into an existing SageMaker notebook to execute code with the notebook's execution role during startup.",
+ description="Detect principals who can inject malicious lifecycle configurations into existing SageMaker notebook instances. By stopping a notebook, attaching a malicious lifecycle config, and restarting it, the attacker executes arbitrary code with the notebook's execution role permissions during startup.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SAGEMAKER-005 - sagemaker:CreateNotebookInstanceLifecycleConfig + sagemaker:StopNotebookInstance + sagemaker:UpdateNotebookInstance + sagemaker:StartNotebookInstance",
+ link="https://pathfinding.cloud/paths/sagemaker-005",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with sagemaker:CreateNotebookInstanceLifecycleConfig permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'sagemaker:createnotebookinstancelifecycleconfig'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:UpdateNotebookInstance permission
+ MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)
+ WHERE stmt2.effect = 'Allow'
+ AND any(action IN stmt2.action WHERE
+ toLower(action) = 'sagemaker:updatenotebookinstance'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:StopNotebookInstance permission
+ MATCH (principal)--(policy3:AWSPolicy)--(stmt3:AWSPolicyStatement)
+ WHERE stmt3.effect = 'Allow'
+ AND any(action IN stmt3.action WHERE
+ toLower(action) = 'sagemaker:stopnotebookinstance'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find sagemaker:StartNotebookInstance permission
+ MATCH (principal)--(policy4:AWSPolicy)--(stmt4:AWSPolicyStatement)
+ WHERE stmt4.effect = 'Allow'
+ AND any(action IN stmt4.action WHERE
+ toLower(action) = 'sagemaker:startnotebookinstance'
+ OR toLower(action) = 'sagemaker:*'
+ OR action = '*'
+ )
+
+ // Find existing SageMaker notebook instances with execution roles
+ MATCH path_target = (aws)-[:RESOURCE]->(notebook:AWSSageMakerNotebookInstance)-[:HAS_EXECUTION_ROLE]->(target_role:AWSRole)
+ WHERE any(resource IN stmt2.resource WHERE
+ resource = '*'
+ OR notebook.arn CONTAINS resource
+ OR resource CONTAINS notebook.notebook_instance_name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SSM-001
+AWS_SSM_PRIVESC_START_SESSION = AttackPathsQueryDefinition(
+ id="aws-ssm-privesc-start-session",
+ name="SSM Session Access for EC2 Role Credentials (SSM-001)",
+ short_description="Start an SSM session on an EC2 instance to access its attached role credentials through IMDS.",
+ description="Detect principals who can start SSM sessions on EC2 instances. This allows establishing a shell session on a running EC2 instance and retrieving the attached IAM role's temporary credentials from the Instance Metadata Service (IMDS), gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SSM-001 - ssm:StartSession",
+ link="https://pathfinding.cloud/paths/ssm-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ssm:StartSession permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'ssm:startsession'
+ OR toLower(action) = 'ssm:*'
+ OR action = '*'
+ )
+
+ // Find EC2 instances with attached roles (targets for credential theft via IMDS)
+ MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# SSM-002
+AWS_SSM_PRIVESC_SEND_COMMAND = AttackPathsQueryDefinition(
+ id="aws-ssm-privesc-send-command",
+ name="SSM Send Command for EC2 Role Credentials (SSM-002)",
+ short_description="Execute commands on an EC2 instance via SSM Run Command to access its attached role credentials through IMDS.",
+ description="Detect principals who can send SSM commands to EC2 instances. This allows executing arbitrary commands on a running EC2 instance and retrieving the attached IAM role's temporary credentials from the Instance Metadata Service (IMDS), gaining that role's permissions.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - SSM-002 - ssm:SendCommand",
+ link="https://pathfinding.cloud/paths/ssm-002",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with ssm:SendCommand permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'ssm:sendcommand'
+ OR toLower(action) = 'ssm:*'
+ OR action = '*'
+ )
+
+ // Find EC2 instances with attached roles (targets for credential theft via IMDS)
+ MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# STS-001
+AWS_STS_PRIVESC_ASSUME_ROLE = AttackPathsQueryDefinition(
+ id="aws-sts-privesc-assume-role",
+ name="Role Assumption for Privilege Escalation (STS-001)",
+ short_description="Assume IAM roles with elevated permissions by exploiting bidirectional trust between the starting principal and the target role.",
+ description="Detect principals who can assume other IAM roles via sts:AssumeRole. When a principal has sts:AssumeRole permission and the target role's trust policy allows the principal to assume it (bidirectional trust), the attacker gains all permissions of the target role. This enables privilege escalation when the target role has higher privileges than the starting principal.",
+ attribution=AttackPathsQueryAttribution(
+ text="pathfinding.cloud - STS-001 - sts:AssumeRole",
+ link="https://pathfinding.cloud/paths/sts-001",
+ ),
+ provider="aws",
+ cypher=f"""
+ // Find principals with sts:AssumeRole permission
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+ WHERE stmt.effect = 'Allow'
+ AND any(action IN stmt.action WHERE
+ toLower(action) = 'sts:assumerole'
+ OR toLower(action) = 'sts:*'
+ OR action = '*'
+ )
+
+ // Find target roles the principal can assume (bidirectional trust via Cartography)
+ MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
+ WHERE any(resource IN stmt.resource WHERE
+ resource = '*'
+ OR target_role.arn CONTAINS resource
+ OR resource CONTAINS target_role.name
+ )
+
+ WITH collect(path_principal) + collect(path_target) AS paths
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
+
+ WITH paths, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+
+ OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
+ """,
+ parameters=[],
+)
+
+# AWS Queries List
+# ----------------
+
+AWS_DEPRECATED_QUERIES: list[AttackPathsQueryDefinition] = [
+ AWS_INTERNET_EXPOSED_EC2_SENSITIVE_S3_ACCESS,
+ AWS_RDS_INSTANCES,
+ AWS_RDS_UNENCRYPTED_STORAGE,
+ AWS_S3_ANONYMOUS_ACCESS_BUCKETS,
+ AWS_IAM_STATEMENTS_ALLOW_ALL_ACTIONS,
+ AWS_IAM_STATEMENTS_ALLOW_DELETE_POLICY,
+ AWS_IAM_STATEMENTS_ALLOW_CREATE_ACTIONS,
+ AWS_EC2_INSTANCES_INTERNET_EXPOSED,
+ AWS_SECURITY_GROUPS_OPEN_INTERNET_FACING,
+ AWS_CLASSIC_ELB_INTERNET_EXPOSED,
+ AWS_ELBV2_INTERNET_EXPOSED,
+ AWS_PUBLIC_IP_RESOURCE_LOOKUP,
+ AWS_APPRUNNER_PRIVESC_PASSROLE_CREATE_SERVICE,
+ AWS_APPRUNNER_PRIVESC_UPDATE_SERVICE,
+ AWS_BEDROCK_PRIVESC_PASSROLE_CODE_INTERPRETER,
+ AWS_BEDROCK_PRIVESC_INVOKE_CODE_INTERPRETER,
+ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACK,
+ AWS_CLOUDFORMATION_PRIVESC_UPDATE_STACK,
+ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_CREATE_STACKSET,
+ AWS_CLOUDFORMATION_PRIVESC_PASSROLE_UPDATE_STACKSET,
+ AWS_CLOUDFORMATION_PRIVESC_CHANGESET,
+ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT,
+ AWS_CODEBUILD_PRIVESC_START_BUILD,
+ AWS_CODEBUILD_PRIVESC_START_BUILD_BATCH,
+ AWS_CODEBUILD_PRIVESC_PASSROLE_CREATE_PROJECT_BATCH,
+ AWS_DATAPIPELINE_PRIVESC_PASSROLE_CREATE_PIPELINE,
+ AWS_EC2_PRIVESC_PASSROLE_IAM,
+ AWS_EC2_PRIVESC_MODIFY_INSTANCE_ATTRIBUTE,
+ AWS_EC2_PRIVESC_PASSROLE_SPOT_INSTANCES,
+ AWS_EC2_PRIVESC_LAUNCH_TEMPLATE,
+ AWS_EC2INSTANCECONNECT_PRIVESC_SEND_SSH_PUBLIC_KEY,
+ AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE,
+ AWS_ECS_PRIVESC_PASSROLE_RUN_TASK,
+ AWS_ECS_PRIVESC_PASSROLE_CREATE_SERVICE_EXISTING_CLUSTER,
+ AWS_ECS_PRIVESC_PASSROLE_RUN_TASK_EXISTING_CLUSTER,
+ AWS_ECS_PRIVESC_PASSROLE_START_TASK_EXISTING_CLUSTER,
+ AWS_ECS_PRIVESC_EXECUTE_COMMAND,
+ AWS_GLUE_PRIVESC_PASSROLE_DEV_ENDPOINT,
+ AWS_GLUE_PRIVESC_UPDATE_DEV_ENDPOINT,
+ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB,
+ AWS_GLUE_PRIVESC_PASSROLE_CREATE_JOB_TRIGGER,
+ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB,
+ AWS_GLUE_PRIVESC_PASSROLE_UPDATE_JOB_TRIGGER,
+ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION,
+ AWS_IAM_PRIVESC_CREATE_ACCESS_KEY,
+ AWS_IAM_PRIVESC_DELETE_CREATE_ACCESS_KEY,
+ AWS_IAM_PRIVESC_CREATE_LOGIN_PROFILE,
+ AWS_IAM_PRIVESC_PUT_ROLE_POLICY,
+ AWS_IAM_PRIVESC_UPDATE_LOGIN_PROFILE,
+ AWS_IAM_PRIVESC_PUT_USER_POLICY,
+ AWS_IAM_PRIVESC_ATTACH_USER_POLICY,
+ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY,
+ AWS_IAM_PRIVESC_ATTACH_GROUP_POLICY,
+ AWS_IAM_PRIVESC_PUT_GROUP_POLICY,
+ AWS_IAM_PRIVESC_UPDATE_ASSUME_ROLE_POLICY,
+ AWS_IAM_PRIVESC_ADD_USER_TO_GROUP,
+ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_ASSUME_ROLE,
+ AWS_IAM_PRIVESC_ATTACH_USER_POLICY_CREATE_ACCESS_KEY,
+ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_ASSUME_ROLE,
+ AWS_IAM_PRIVESC_PUT_ROLE_POLICY_ASSUME_ROLE,
+ AWS_IAM_PRIVESC_PUT_USER_POLICY_CREATE_ACCESS_KEY,
+ AWS_IAM_PRIVESC_ATTACH_ROLE_POLICY_UPDATE_ASSUME_ROLE,
+ AWS_IAM_PRIVESC_CREATE_POLICY_VERSION_UPDATE_ASSUME_ROLE,
+ AWS_IAM_PRIVESC_PUT_ROLE_POLICY_UPDATE_ASSUME_ROLE,
+ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION,
+ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_EVENT_SOURCE,
+ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE,
+ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_INVOKE,
+ AWS_LAMBDA_PRIVESC_UPDATE_FUNCTION_CODE_ADD_PERMISSION,
+ AWS_LAMBDA_PRIVESC_PASSROLE_CREATE_FUNCTION_ADD_PERMISSION,
+ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_NOTEBOOK,
+ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_TRAINING_JOB,
+ AWS_SAGEMAKER_PRIVESC_PASSROLE_CREATE_PROCESSING_JOB,
+ AWS_SAGEMAKER_PRIVESC_PRESIGNED_NOTEBOOK_URL,
+ AWS_SAGEMAKER_PRIVESC_LIFECYCLE_CONFIG_NOTEBOOK,
+ AWS_SSM_PRIVESC_START_SESSION,
+ AWS_SSM_PRIVESC_SEND_COMMAND,
+ AWS_STS_PRIVESC_ASSUME_ROLE,
+]
diff --git a/api/src/backend/api/attack_paths/queries/registry.py b/api/src/backend/api/attack_paths/queries/registry.py
index d055b842fd..358b1d6aed 100644
--- a/api/src/backend/api/attack_paths/queries/registry.py
+++ b/api/src/backend/api/attack_paths/queries/registry.py
@@ -1,12 +1,14 @@
from api.attack_paths.queries.aws import AWS_QUERIES
+
+# TODO: drop after Neptune cutover
+from api.attack_paths.queries.aws_deprecated import AWS_DEPRECATED_QUERIES
from api.attack_paths.queries.types import AttackPathsQueryDefinition
-# Query definitions organized by provider
+# Query definitions for scans synced with the current schema.
_QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
"aws": AWS_QUERIES,
}
-# Flat lookup by query ID for O(1) access
_QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
definition.id: definition
for definitions in _QUERY_DEFINITIONS.values()
@@ -14,11 +16,45 @@ _QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
}
-def get_queries_for_provider(provider: str) -> list[AttackPathsQueryDefinition]:
- """Get all attack path queries for a specific provider."""
- return _QUERY_DEFINITIONS.get(provider, [])
+# TODO: drop after Neptune cutover
+#
+# Query definitions for pre-cutover scans (`AttackPathsScan.is_migrated=False`)
+# whose graph data was written under the previous schema. Both maps expose the
+# same query IDs so the API contract is identical regardless of which set is
+# routed to.
+_DEPRECATED_QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
+ "aws": AWS_DEPRECATED_QUERIES,
+}
+
+_DEPRECATED_QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
+ definition.id: definition
+ for definitions in _DEPRECATED_QUERY_DEFINITIONS.values()
+ for definition in definitions
+}
-def get_query_by_id(query_id: str) -> AttackPathsQueryDefinition | None:
- """Get a specific attack path query by its ID."""
- return _QUERIES_BY_ID.get(query_id)
+def get_queries_for_provider(
+ provider: str,
+ is_migrated: bool = True,
+) -> list[AttackPathsQueryDefinition]:
+ """Get all attack path queries for a provider.
+
+ `is_migrated` selects the catalog: True for scans synced with the current
+ schema, False for pre-cutover scans still using the legacy graph shape.
+ # TODO: drop the `is_migrated` parameter after Neptune cutover
+ """
+ catalog = _QUERY_DEFINITIONS if is_migrated else _DEPRECATED_QUERY_DEFINITIONS
+ return catalog.get(provider, [])
+
+
+def get_query_by_id(
+ query_id: str,
+ is_migrated: bool = True,
+) -> AttackPathsQueryDefinition | None:
+ """Get a specific attack path query by ID.
+
+ `is_migrated` selects the catalog (see `get_queries_for_provider`).
+ # TODO: drop the `is_migrated` parameter after Neptune cutover
+ """
+ by_id = _QUERIES_BY_ID if is_migrated else _DEPRECATED_QUERIES_BY_ID
+ return by_id.get(query_id)
diff --git a/api/src/backend/api/attack_paths/retryable_session.py b/api/src/backend/api/attack_paths/retryable_session.py
index 16f0d9e31a..e7e78e9798 100644
--- a/api/src/backend/api/attack_paths/retryable_session.py
+++ b/api/src/backend/api/attack_paths/retryable_session.py
@@ -1,4 +1,6 @@
import logging
+import random
+import time
from collections.abc import Callable
from typing import Any
@@ -8,18 +10,44 @@ import neo4j.exceptions
logger = logging.getLogger(__name__)
+class RetryExhaustedError(Exception):
+ def __init__(
+ self,
+ *,
+ retry_context: str,
+ method_name: str,
+ attempts: int,
+ elapsed_seconds: float,
+ last_error: Exception,
+ ) -> None:
+ self.retry_context = retry_context
+ self.method_name = method_name
+ self.attempts = attempts
+ self.elapsed_seconds = elapsed_seconds
+ self.last_error = last_error
+ last_message = getattr(last_error, "message", None) or str(last_error)
+ super().__init__(
+ f"{retry_context} {method_name} failed after {attempts} attempts over "
+ f"{elapsed_seconds:.3f}s. Last error: {last_message}"
+ )
+
+
class RetryableSession:
- """
- Wrapper around `neo4j.Session` that retries `neo4j.exceptions.ServiceUnavailable` errors.
- """
+ """Wrapper around ``neo4j.Session`` with a refreshable retry policy."""
def __init__(
self,
session_factory: Callable[[], neo4j.Session],
max_retries: int,
+ retry_if: Callable[[Exception], bool] | None = None,
+ initial_retry_delay_seconds: float = 0,
+ retry_context: str | None = None,
) -> None:
self._session_factory = session_factory
self._max_retries = max(0, max_retries)
+ self._retry_if = retry_if
+ self._initial_retry_delay_seconds = max(0.0, initial_retry_delay_seconds)
+ self._retry_context = retry_context
self._session = self._session_factory()
def close(self) -> None:
@@ -50,30 +78,75 @@ class RetryableSession:
def _call_with_retry(self, method_name: str, *args: Any, **kwargs: Any) -> Any:
attempt = 0
last_exc: Exception | None = None
+ started_at = time.monotonic()
while attempt <= self._max_retries:
try:
method = getattr(self._session, method_name)
return method(*args, **kwargs)
- except (
- BrokenPipeError,
- ConnectionResetError,
- neo4j.exceptions.ServiceUnavailable,
- ) as exc: # pragma: no cover - depends on infra
+ except Exception as exc:
+ if not self._should_retry(exc):
+ raise
+
last_exc = exc
attempt += 1
if attempt > self._max_retries:
+ if self._retry_context is not None:
+ raise RetryExhaustedError(
+ retry_context=self._retry_context,
+ method_name=method_name,
+ attempts=attempt,
+ elapsed_seconds=time.monotonic() - started_at,
+ last_error=exc,
+ ) from exc
raise
- logger.warning(
- f"Neo4j session {method_name} failed with {type(exc).__name__} ({attempt}/{self._max_retries} attempts). Retrying..."
- )
+ delay = self._retry_delay(attempt)
+ if self._retry_context is not None:
+ error_message = getattr(exc, "message", None) or str(exc)
+ logger.warning(
+ "%s %s failed with %s: %s; retry %s/%s in %.3fs",
+ self._retry_context,
+ method_name,
+ type(exc).__name__,
+ error_message,
+ attempt,
+ self._max_retries,
+ delay,
+ )
+ else:
+ logger.warning(
+ "Graph session %s failed with %s; retry %s/%s in %.3fs",
+ method_name,
+ type(exc).__name__,
+ attempt,
+ self._max_retries,
+ delay,
+ )
self._refresh_session()
+ if delay:
+ time.sleep(delay)
raise last_exc if last_exc else RuntimeError("Unexpected retry loop exit")
+ def _should_retry(self, exc: Exception) -> bool:
+ if isinstance(
+ exc,
+ (
+ BrokenPipeError,
+ ConnectionResetError,
+ neo4j.exceptions.ServiceUnavailable,
+ ),
+ ):
+ return True
+ return self._retry_if(exc) if self._retry_if else False
+
+ def _retry_delay(self, attempt: int) -> float:
+ max_delay = self._initial_retry_delay_seconds * (2**attempt)
+ return random.uniform(max_delay / 2, max_delay) if max_delay else 0
+
def _refresh_session(self) -> None:
if self._session is not None:
try:
diff --git a/api/src/backend/api/attack_paths/sink/__init__.py b/api/src/backend/api/attack_paths/sink/__init__.py
new file mode 100644
index 0000000000..b90fd6e442
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/__init__.py
@@ -0,0 +1,28 @@
+"""Attack-paths sink database layer.
+
+The sink is the persistent store where attack-paths graphs live after a scan
+finishes. Currently selectable between Neo4j (OSS / local dev default) and
+AWS Neptune (hosted dev/staging/prod). Backend is picked by the
+`ATTACK_PATHS_SINK_DATABASE` setting at process init.
+
+This package exposes the public factory API; the implementation lives in
+`api.attack_paths.sink.factory`.
+"""
+
+from api.attack_paths.sink.factory import (
+ SinkBackend,
+ close,
+ get_backend,
+ get_backend_for_name,
+ get_backend_for_scan,
+ init,
+)
+
+__all__ = [
+ "SinkBackend",
+ "close",
+ "get_backend",
+ "get_backend_for_name",
+ "get_backend_for_scan",
+ "init",
+]
diff --git a/api/src/backend/api/attack_paths/sink/base.py b/api/src/backend/api/attack_paths/sink/base.py
new file mode 100644
index 0000000000..0134e0a41f
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/base.py
@@ -0,0 +1,94 @@
+"""Protocol every sink backend must implement."""
+
+from contextlib import AbstractContextManager
+from typing import Any, Protocol
+
+import neo4j
+
+
+class SinkDatabase(Protocol):
+ """Contract for the persistent attack-paths graph store.
+
+ The `database` argument is an opaque identifier passed through from the
+ legacy `database.py` API surface. On Neo4j it is the per-tenant database
+ name (e.g. `db-tenant-{uuid}`). On Neptune it is ignored (the cluster
+ has a single graph, and isolation is label-based).
+ """
+
+ sync_batch_size: int
+
+ def init(self) -> None: ...
+
+ def close(self) -> None: ...
+
+ def verify_connectivity(self) -> None:
+ """Raise if the backend the API read path uses is unreachable.
+
+ Neo4j verifies its single driver. Neptune verifies the reader
+ driver (the endpoint the API serves reads from); on single-endpoint
+ clusters the reader aliases the writer, so that path is covered too.
+ Used by the readiness probe; must not block longer than the caller's
+ probe budget.
+ """
+ ...
+
+ def get_session(
+ self,
+ database: str | None = None,
+ default_access_mode: str | None = None,
+ ) -> AbstractContextManager: ...
+
+ def execute_read_query(
+ self,
+ database: str,
+ cypher: str,
+ parameters: dict[str, Any] | None = None,
+ ) -> neo4j.graph.Graph: ...
+
+ def create_database(self, database: str) -> None: ...
+
+ def drop_database(self, database: str) -> None: ...
+
+ def drop_subgraph(self, database: str, provider_id: str) -> int: ...
+
+ def has_provider_data(self, database: str, provider_id: str) -> bool: ...
+
+ def clear_cache(self, database: str) -> None: ...
+
+ def ensure_sync_indexes(self, database: str) -> None:
+ """Create any index needed for the sync write path.
+
+ Called once at the start of each provider sync; must be idempotent.
+ Neo4j creates a `_provider_element_id` index on `_ProviderResource`;
+ Neptune is a no-op (its `~id` lookup needs no index).
+ """
+ ...
+
+ def write_nodes(
+ self,
+ database: str,
+ labels: str,
+ rows: list[dict[str, Any]],
+ ) -> None:
+ """Upsert a batch of nodes into the sink.
+
+ `labels` is a pre-rendered Cypher label string ready to drop after
+ the node variable (e.g. `` `AWSUser`:`_ProviderResource`:`_Tenant_x` ``).
+ Each row carries `provider_element_id` and `props`.
+ """
+ ...
+
+ def write_relationships(
+ self,
+ database: str,
+ rel_type: str,
+ provider_id: str,
+ rows: list[dict[str, Any]],
+ ) -> None:
+ """Upsert a batch of relationships into the sink.
+
+ Each row carries `start_element_id`, `end_element_id`,
+ `provider_element_id` and `props`. `rel_type` is the relationship
+ type (already a valid Cypher identifier).
+ """
+ ...
diff --git a/api/src/backend/api/attack_paths/sink/drop.py b/api/src/backend/api/attack_paths/sink/drop.py
new file mode 100644
index 0000000000..be13a394f5
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/drop.py
@@ -0,0 +1,81 @@
+"""Shared batched deletion helpers for sink backends."""
+
+import logging
+import time
+from typing import Any
+
+RELATIONSHIP_DELETE_QUERY_TEMPLATES = {
+ "outgoing relationship": """
+ MATCH (n:`{provider_label}`)-[r]->()
+ WITH r LIMIT $batch_size
+ DELETE r
+ RETURN COUNT(r) AS deleted_rels_count
+ """,
+ "incoming relationship": """
+ MATCH (n:`{provider_label}`)<-[r]-()
+ WITH r LIMIT $batch_size
+ DELETE r
+ RETURN COUNT(r) AS deleted_rels_count
+ """,
+}
+
+NODE_DELETE_QUERY_TEMPLATE = """
+ MATCH (n:{provider_resource_label}:`{provider_label}`)
+ WITH n LIMIT $batch_size
+ DELETE n
+ RETURN COUNT(n) AS deleted_nodes_count
+ """
+
+
+def delete_batches(
+ *,
+ session: Any,
+ logger: logging.Logger,
+ log_target: str,
+ provider_id: str,
+ query: str,
+ phase: str,
+ count_key: str,
+ total_key: str,
+ deleted_key: str,
+ initial_total: int,
+ batch_size: int,
+ drop_t0: float,
+) -> tuple[int, int]:
+ def delete_batch(tx: Any) -> int:
+ record = tx.run(query, {"batch_size": batch_size}).single()
+ return (record[count_key] if record else 0) or 0
+
+ deleted_total = initial_total
+ batches = 0
+ while True:
+ logger.info(
+ "Deleting %s batch from %s "
+ "(provider=%s, batch=%s, total_%s=%s, elapsed=%.3fs)",
+ phase,
+ log_target,
+ provider_id,
+ batches + 1,
+ total_key,
+ deleted_total,
+ time.perf_counter() - drop_t0,
+ )
+ deleted = session.execute_write(delete_batch)
+ if deleted == 0:
+ return deleted_total, batches
+
+ batches += 1
+ deleted_total += deleted
+ logger.info(
+ "Deleted %s batch from %s "
+ "(provider=%s, batch=%s, %s=%s, total_%s=%s, elapsed=%.3fs)",
+ phase,
+ log_target,
+ provider_id,
+ batches,
+ deleted_key,
+ deleted,
+ total_key,
+ deleted_total,
+ time.perf_counter() - drop_t0,
+ )
diff --git a/api/src/backend/api/attack_paths/sink/factory.py b/api/src/backend/api/attack_paths/sink/factory.py
new file mode 100644
index 0000000000..ad2116fa40
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/factory.py
@@ -0,0 +1,134 @@
+"""Sink backend factory and process-wide handle cache.
+
+Picks the active backend from `settings.ATTACK_PATHS_SINK_DATABASE` at first
+use, holds the active backend plus any secondary backends needed to serve
+scans written under the previous configuration, and tears them all down on
+process shutdown. Imported via `from api.attack_paths import sink as
+sink_module`.
+"""
+
+import threading
+from enum import StrEnum, auto
+
+from api.attack_paths.sink.base import SinkDatabase
+from api.models import AttackPathsScan
+from django.conf import settings
+
+# Backend names
+
+
+class SinkBackend(StrEnum):
+ NEO4J = auto()
+ NEPTUNE = auto()
+
+
+# Backend cache
+
+_backend: SinkDatabase | None = None
+_secondary_backends: dict[SinkBackend, SinkDatabase] = {}
+_lock = threading.Lock()
+
+
+def _resolve_setting() -> SinkBackend:
+ raw = settings.ATTACK_PATHS_SINK_DATABASE.lower()
+ try:
+ return SinkBackend(raw)
+
+ except ValueError:
+ valid = sorted(b.value for b in SinkBackend)
+ raise RuntimeError(
+ f"ATTACK_PATHS_SINK_DATABASE must be one of {valid}; got {raw!r}"
+ )
+
+
+def _build_backend(name: SinkBackend) -> SinkDatabase:
+ if name is SinkBackend.NEO4J:
+ from api.attack_paths.sink.neo4j import Neo4jSink
+
+ return Neo4jSink()
+
+ if name is SinkBackend.NEPTUNE:
+ from api.attack_paths.sink.neptune import NeptuneSink
+
+ return NeptuneSink()
+
+ raise RuntimeError(f"Unknown sink backend {name!r}")
+
+
+# Lifecycle
+
+
+def init(name: SinkBackend | str | None = None) -> SinkDatabase:
+ """Initialize the configured sink backend. Idempotent."""
+ global _backend
+ if _backend is not None:
+ return _backend
+
+ with _lock:
+ if _backend is None:
+ resolved = SinkBackend(name) if name else _resolve_setting()
+ backend = _build_backend(resolved)
+ backend.init()
+ _backend = backend
+
+ return _backend
+
+
+def close() -> None:
+ """Close the active backend and every cached secondary backend."""
+ global _backend
+ with _lock:
+ backends = [
+ b for b in (_backend, *_secondary_backends.values()) if b is not None
+ ]
+ _backend = None
+ _secondary_backends.clear()
+
+ for backend in backends:
+ try:
+ backend.close()
+
+ except Exception: # pragma: no cover - best-effort
+ pass
+
+
+def get_backend() -> SinkDatabase:
+ """Return the active sink. Initializes on first call."""
+ return init()
+
+
+# Per-scan routing
+
+
+def get_backend_for_scan(scan: AttackPathsScan) -> SinkDatabase:
+ """Route reads by the sink that stores this scan's graph."""
+ raw_backend = getattr(scan, "sink_backend", SinkBackend.NEO4J.value)
+ if not isinstance(raw_backend, str):
+ raw_backend = SinkBackend.NEO4J.value
+ return get_backend_for_name(raw_backend)
+
+
+def get_backend_for_name(name: SinkBackend | str) -> SinkDatabase:
+ """Return the backend named by persisted scan metadata."""
+ resolved = SinkBackend(name)
+ if resolved is _resolve_setting():
+ return get_backend()
+
+ return _build_backend_cached(resolved)
+
+
+def _build_backend_cached(name: SinkBackend) -> SinkDatabase:
+ # TODO: drop after Neptune cutover
+ # Needed only during cutover to serve Neo4j-written scans from a Neptune-
+ # configured API pod (and vice versa). Once every scan is on Neptune,
+ # `get_backend_for_scan` becomes a one-liner returning `get_backend()`.
+ if name in _secondary_backends:
+ return _secondary_backends[name]
+
+ with _lock:
+ if name not in _secondary_backends:
+ backend = _build_backend(name)
+ backend.init()
+ _secondary_backends[name] = backend
+
+ return _secondary_backends[name]
diff --git a/api/src/backend/api/attack_paths/sink/neo4j.py b/api/src/backend/api/attack_paths/sink/neo4j.py
new file mode 100644
index 0000000000..c820ed9d93
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/neo4j.py
@@ -0,0 +1,419 @@
+"""Neo4j sink implementation.
+
+Owns a Neo4j driver independent from the staging driver. On OSS and local dev
+this is the only sink; on hosted deployments it runs only as a legacy read
+path while phase-1 drains tenant DBs.
+"""
+
+import atexit
+import logging
+import threading
+import time
+from collections.abc import Iterator
+from contextlib import AbstractContextManager, contextmanager
+from typing import Any
+
+import neo4j
+import neo4j.exceptions
+from api.attack_paths.retryable_session import RetryableSession
+from api.attack_paths.sink.base import SinkDatabase
+from api.attack_paths.sink.drop import (
+ NODE_DELETE_QUERY_TEMPLATE,
+ RELATIONSHIP_DELETE_QUERY_TEMPLATES,
+ delete_batches,
+)
+from config.env import env
+from django.conf import settings
+
+logging.getLogger("neo4j").setLevel(logging.ERROR)
+logging.getLogger("neo4j").propagate = False
+
+logger = logging.getLogger(__name__)
+
+SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
+ "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
+)
+READ_QUERY_TIMEOUT_SECONDS = env.int(
+ "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
+)
+CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
+# TCP connect timeout, ordered below the acquisition timeout so an unreachable
+# host can't pin a request or the readiness probe longer than this.
+CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
+MAX_CONNECTION_LIFETIME = env.int("NEO4J_MAX_CONNECTION_LIFETIME", default=7200)
+MAX_CONNECTION_POOL_SIZE = env.int("NEO4J_MAX_CONNECTION_POOL_SIZE", default=50)
+
+READ_EXCEPTION_CODES = [
+ "Neo.ClientError.Statement.AccessMode",
+ "Neo.ClientError.Procedure.ProcedureNotFound",
+]
+CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
+DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
+
+
+class Neo4jSink(SinkDatabase):
+ """Neo4j-backed sink. Multi-database cluster; tenant isolation is physical."""
+
+ sync_batch_size = env.int("ATTACK_PATHS_NEO4J_SYNC_BATCH_SIZE", default=1000)
+
+ def __init__(self) -> None:
+ self._driver: neo4j.Driver | None = None
+ self._lock = threading.Lock()
+ self._atexit_registered = False
+
+ # Driver
+
+ def _config(self) -> dict:
+ return settings.DATABASES["neo4j"]
+
+ def _uri(self) -> str:
+ cfg = self._config()
+ host = cfg["HOST"]
+ port = cfg["PORT"]
+ if not host or not port:
+ raise RuntimeError(
+ "NEO4J_HOST / NEO4J_PORT must be set when ATTACK_PATHS_SINK_DATABASE=neo4j"
+ )
+ return f"bolt://{host}:{port}"
+
+ def init(self) -> neo4j.Driver:
+ if self._driver is not None:
+ return self._driver
+ with self._lock:
+ if self._driver is None:
+ cfg = self._config()
+ self._driver = neo4j.GraphDatabase.driver(
+ self._uri(),
+ auth=(cfg["USER"], cfg["PASSWORD"]),
+ keep_alive=True,
+ max_connection_lifetime=MAX_CONNECTION_LIFETIME,
+ connection_timeout=CONNECTION_TIMEOUT,
+ connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
+ max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
+ )
+ # Eager connectivity check is best-effort:
+ # A Neo4j that is down at boot must not crash the process, same degradation model as Postgres
+ # The driver reconnects lazily on first use
+ # /health/ready surfaces the outage until it recovers
+ try:
+ self._driver.verify_connectivity()
+
+ except Exception:
+ logger.warning(
+ "Neo4j sink unreachable at init; continuing with a lazily-reconnecting driver",
+ exc_info=True,
+ )
+
+ if not self._atexit_registered:
+ atexit.register(self.close)
+ self._atexit_registered = True
+ return self._driver
+
+ def _get_driver(self) -> neo4j.Driver:
+ return self.init()
+
+ def verify_connectivity(self) -> None:
+ self._get_driver().verify_connectivity()
+
+ def close(self) -> None:
+ with self._lock:
+ if self._driver is not None:
+ try:
+ self._driver.close()
+ finally:
+ self._driver = None
+
+ # Sessions
+
+ @contextmanager
+ def get_session(
+ self,
+ database: str | None = None,
+ default_access_mode: str | None = None,
+ ) -> Iterator[RetryableSession]:
+ from api.attack_paths.database import (
+ ClientStatementException,
+ GraphDatabaseQueryException,
+ WriteQueryNotAllowedException,
+ )
+
+ session_wrapper: RetryableSession | None = None
+ try:
+ session_wrapper = RetryableSession(
+ session_factory=lambda: self._get_driver().session(
+ database=database, default_access_mode=default_access_mode
+ ),
+ max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
+ )
+ yield session_wrapper
+
+ except neo4j.exceptions.Neo4jError as exc:
+ if (
+ default_access_mode == neo4j.READ_ACCESS
+ and exc.code
+ and exc.code in READ_EXCEPTION_CODES
+ ):
+ raise WriteQueryNotAllowedException(
+ message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
+ )
+
+ message = exc.message if exc.message is not None else str(exc)
+ if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
+ raise ClientStatementException(message=message, code=exc.code)
+ raise GraphDatabaseQueryException(message=message, code=exc.code)
+
+ finally:
+ if session_wrapper is not None:
+ session_wrapper.close()
+
+ # Operations
+
+ def execute_read_query(
+ self,
+ database: str,
+ cypher: str,
+ parameters: dict[str, Any] | None = None,
+ ) -> neo4j.graph.Graph:
+ with self.get_session(
+ database, default_access_mode=neo4j.READ_ACCESS
+ ) as session:
+
+ def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
+ result = tx.run(
+ cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
+ )
+ return result.graph()
+
+ return session.execute_read(_run)
+
+ def create_database(self, database: str) -> None:
+ with self.get_session() as session:
+ session.run(
+ "CREATE DATABASE $database IF NOT EXISTS", {"database": database}
+ )
+
+ def drop_database(self, database: str) -> None:
+ with self.get_session() as session:
+ session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")
+
+ def drop_subgraph(self, database: str, provider_id: str) -> int:
+ """Delete all nodes for a provider from a tenant database, batched.
+
+ Deletes relationships then nodes in batches (not `DETACH DELETE`) so a
+ dense provider's graph cannot exceed Neo4j's transaction memory limit.
+ Silently returns 0 if the database doesn't exist.
+ """
+ from api.attack_paths.database import GraphDatabaseQueryException
+ from tasks.jobs.attack_paths.config import (
+ GRAPH_MUTATION_BATCH_SIZE,
+ PROVIDER_RESOURCE_LABEL,
+ get_provider_label,
+ )
+
+ provider_label = get_provider_label(provider_id)
+ deleted_nodes = deleted_relationships = 0
+ relationship_batches = node_batches = 0
+ drop_t0 = time.perf_counter()
+
+ logger.info(
+ "Dropping provider graph from Neo4j sink database %s "
+ "(provider=%s, provider_label=%s)",
+ database,
+ provider_id,
+ provider_label,
+ )
+
+ try:
+ logger.info(
+ "Opening Neo4j sink session for provider graph drop "
+ "(database=%s, provider=%s)",
+ database,
+ provider_id,
+ )
+ with self.get_session(database) as session:
+ logger.info(
+ "Opened Neo4j sink session for provider graph drop "
+ "(database=%s, provider=%s)",
+ database,
+ provider_id,
+ )
+ log_target = f"Neo4j sink database {database}"
+ for (
+ phase,
+ query_template,
+ ) in RELATIONSHIP_DELETE_QUERY_TEMPLATES.items():
+ deleted_relationships, phase_batches = delete_batches(
+ session=session,
+ logger=logger,
+ log_target=log_target,
+ provider_id=provider_id,
+ query=query_template.format(provider_label=provider_label),
+ phase=phase,
+ count_key="deleted_rels_count",
+ total_key="rels",
+ deleted_key="deleted_rels",
+ initial_total=deleted_relationships,
+ batch_size=GRAPH_MUTATION_BATCH_SIZE,
+ drop_t0=drop_t0,
+ )
+ relationship_batches += phase_batches
+
+ deleted_nodes, node_batches = delete_batches(
+ session=session,
+ logger=logger,
+ log_target=log_target,
+ provider_id=provider_id,
+ query=NODE_DELETE_QUERY_TEMPLATE.format(
+ provider_label=provider_label,
+ provider_resource_label=PROVIDER_RESOURCE_LABEL,
+ ),
+ phase="node",
+ count_key="deleted_nodes_count",
+ total_key="nodes",
+ deleted_key="deleted_nodes",
+ initial_total=0,
+ batch_size=GRAPH_MUTATION_BATCH_SIZE,
+ drop_t0=drop_t0,
+ )
+
+ except GraphDatabaseQueryException as exc:
+ if exc.code == DATABASE_NOT_FOUND_CODE:
+ logger.info(
+ "Skipped provider graph drop from Neo4j sink database %s "
+ "(provider=%s, reason=database_not_found, elapsed=%.3fs)",
+ database,
+ provider_id,
+ time.perf_counter() - drop_t0,
+ )
+ return 0
+ raise
+
+ logger.info(
+ "Finished dropping provider graph from Neo4j sink database %s "
+ "(provider=%s, relationship_batches=%s, deleted_rels=%s, "
+ "node_batches=%s, deleted_nodes=%s, elapsed=%.3fs)",
+ database,
+ provider_id,
+ relationship_batches,
+ deleted_relationships,
+ node_batches,
+ deleted_nodes,
+ time.perf_counter() - drop_t0,
+ )
+ return deleted_nodes
+
+ def has_provider_data(self, database: str, provider_id: str) -> bool:
+ from api.attack_paths.database import GraphDatabaseQueryException
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_RESOURCE_LABEL,
+ get_provider_label,
+ )
+
+ provider_label = get_provider_label(provider_id)
+ query = (
+ f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
+ )
+ try:
+ with self.get_session(
+ database, default_access_mode=neo4j.READ_ACCESS
+ ) as session:
+ result = session.run(query)
+ return result.single() is not None
+
+ except GraphDatabaseQueryException as exc:
+ if exc.code == DATABASE_NOT_FOUND_CODE:
+ return False
+ raise
+
+ def clear_cache(self, database: str) -> None:
+ from api.attack_paths.database import GraphDatabaseQueryException
+
+ try:
+ with self.get_session(database) as session:
+ session.run("CALL db.clearQueryCaches()")
+ except GraphDatabaseQueryException as exc:
+ logger.warning(
+ f"Failed to clear query cache for database `{database}`: {exc}"
+ )
+
+ # Sync write path
+
+ def ensure_sync_indexes(self, database: str) -> None:
+ """Create the `_provider_element_id` lookup index on `_ProviderResource`.
+
+ Every synced node carries the `_ProviderResource` label, so a single
+ index covers both node-upserts and relationship endpoint MATCHes.
+ Without this index the rel sync degrades to a label scan per row and
+ large provider syncs become unworkable.
+ """
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_ELEMENT_ID_PROPERTY,
+ PROVIDER_RESOURCE_LABEL,
+ )
+
+ query = (
+ f"CREATE INDEX provider_element_id_idx IF NOT EXISTS "
+ f"FOR (n:`{PROVIDER_RESOURCE_LABEL}`) "
+ f"ON (n.`{PROVIDER_ELEMENT_ID_PROPERTY}`)"
+ )
+ with self.get_session(database) as session:
+ session.execute_write(lambda tx: tx.run(query).consume())
+
+ def write_nodes(
+ self,
+ database: str,
+ labels: str,
+ rows: list[dict[str, Any]],
+ ) -> None:
+ if not rows:
+ return
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_ELEMENT_ID_PROPERTY,
+ PROVIDER_RESOURCE_LABEL,
+ )
+
+ query = f"""
+ UNWIND $rows AS row
+ MERGE (n:`{PROVIDER_RESOURCE_LABEL}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}})
+ SET n:{labels}
+ SET n += row.props
+ """
+ with self.get_session(database) as session:
+ session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
+
+ def write_relationships(
+ self,
+ database: str,
+ rel_type: str,
+ provider_id: str,
+ rows: list[dict[str, Any]],
+ ) -> None:
+ if not rows:
+ return
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_ELEMENT_ID_PROPERTY,
+ PROVIDER_RESOURCE_LABEL,
+ get_provider_label,
+ )
+
+ provider_label = get_provider_label(provider_id)
+ query = f"""
+ UNWIND $rows AS row
+ MATCH (s:`{PROVIDER_RESOURCE_LABEL}`:`{provider_label}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.start_element_id}})
+ MATCH (t:`{PROVIDER_RESOURCE_LABEL}`:`{provider_label}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.end_element_id}})
+ MERGE (s)-[r:`{rel_type}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}}]->(t)
+ SET r += row.props
+ """
+ with self.get_session(database) as session:
+ session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
+
+ # For compatibility with test harnesses that patch the concrete driver
+ def get_driver(self) -> neo4j.Driver:
+ return self._get_driver()
+
+
+# Helper for tests / external callers that want a writer session specifically
+def get_read_session(
+ sink: Neo4jSink, database: str
+) -> AbstractContextManager[RetryableSession]:
+ return sink.get_session(database, default_access_mode=neo4j.READ_ACCESS)
diff --git a/api/src/backend/api/attack_paths/sink/neptune.py b/api/src/backend/api/attack_paths/sink/neptune.py
new file mode 100644
index 0000000000..022e3c8669
--- /dev/null
+++ b/api/src/backend/api/attack_paths/sink/neptune.py
@@ -0,0 +1,519 @@
+"""AWS Neptune sink implementation.
+
+Dual Bolt drivers: one against the writer endpoint for workers, one against
+the reader endpoint for the API read path. If `NEPTUNE_READER_ENDPOINT` is
+unset the reader falls back to the writer driver so single-node clusters work.
+
+Neptune is single-database. The `database` argument on the SinkDatabase
+protocol is ignored; tenant / provider isolation is enforced by labels that
+the sync step already writes on every node (see tasks/jobs/attack_paths/sync.py).
+
+SigV4 auth lives at the bottom of this file as `neptune_auth_provider`. The
+neo4j driver invokes the returned callable on each token refresh.
+"""
+
+import atexit
+import datetime
+import json
+import logging
+import threading
+import time
+from collections.abc import Callable, Iterator
+from contextlib import contextmanager
+from typing import Any
+from urllib.parse import urlsplit
+
+import neo4j
+import neo4j.exceptions
+from api.attack_paths.retryable_session import RetryableSession, RetryExhaustedError
+from api.attack_paths.sink.base import SinkDatabase
+from api.attack_paths.sink.drop import (
+ NODE_DELETE_QUERY_TEMPLATE,
+ RELATIONSHIP_DELETE_QUERY_TEMPLATES,
+ delete_batches,
+)
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.session import Session as BotoSession
+from config.env import env
+from django.conf import settings
+from neo4j.auth_management import AuthManagers, ExpiringAuth
+
+logging.getLogger("neo4j").setLevel(logging.ERROR)
+logging.getLogger("neo4j").propagate = False
+
+logger = logging.getLogger(__name__)
+
+SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
+ "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
+)
+READ_QUERY_TIMEOUT_SECONDS = env.int(
+ "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
+)
+# Neptune serverless cold-start can be >30s; give the driver room
+CONN_ACQUISITION_TIMEOUT = env.int("NEPTUNE_CONN_ACQUISITION_TIMEOUT", default=60)
+# TCP connect timeout, ordered below the acquisition timeout so an unreachable
+# endpoint can't pin a request or the readiness probe longer than this. Kept
+# generous: cold-start delays query execution, not the socket connect.
+CONNECTION_TIMEOUT = env.int("NEPTUNE_CONNECTION_TIMEOUT", default=10)
+# Roll connections hourly so SigV4 rotations and cert refreshes don't strand long-lived pool entries
+MAX_CONNECTION_LIFETIME = env.int("NEPTUNE_MAX_CONNECTION_LIFETIME", default=3600)
+MAX_CONNECTION_POOL_SIZE = env.int("NEPTUNE_MAX_CONNECTION_POOL_SIZE", default=50)
+NEPTUNE_WRITE_RETRY_DELAY_SECONDS = 2
+
+READ_EXCEPTION_CODES = [
+ "Neo.ClientError.Statement.AccessMode",
+ "Neo.ClientError.Procedure.ProcedureNotFound",
+]
+CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
+RETRYABLE_WRITE_ERROR_FRAGMENTS = (
+ "Operation failed due to conflicting concurrent operations",
+ "Operation terminated (deadline exceeded)",
+)
+
+# Refresh 60s before the 5-minute SigV4 window closes
+SIGV4_TOKEN_LIFETIME_MINUTES = 4
+
+
+def _is_retryable_write_error(exc: Exception) -> bool:
+ if not isinstance(exc, neo4j.exceptions.Neo4jError):
+ return False
+ message = exc.message or ""
+ return any(fragment in message for fragment in RETRYABLE_WRITE_ERROR_FRAGMENTS)
+
+
+class NeptuneSink(SinkDatabase):
+ """Neptune-backed sink. Single database; isolation is label-based."""
+
+ sync_batch_size = env.int("ATTACK_PATHS_NEPTUNE_SYNC_BATCH_SIZE", default=500)
+
+ def __init__(self) -> None:
+ self._writer: neo4j.Driver | None = None
+ self._reader: neo4j.Driver | None = None
+ self._lock = threading.Lock()
+ self._atexit_registered = False
+
+ # Config
+
+ def _config(self) -> dict:
+ return settings.DATABASES["neptune"]
+
+ def _bolt_uri(self, endpoint: str, port: str) -> str:
+ return f"bolt+s://{endpoint}:{port}"
+
+ def _https_url(self, endpoint: str, port: str) -> str:
+ return f"https://{endpoint}:{port}"
+
+ def _build_driver(self, endpoint: str) -> neo4j.Driver:
+ cfg = self._config()
+ port = cfg["PORT"]
+ region = cfg["REGION"]
+ if not endpoint or not region:
+ raise RuntimeError(
+ "NEPTUNE_WRITER_ENDPOINT and AWS_REGION must be set when "
+ "ATTACK_PATHS_SINK_DATABASE=neptune"
+ )
+ return neo4j.GraphDatabase.driver(
+ self._bolt_uri(endpoint, port),
+ auth=AuthManagers.bearer(
+ neptune_auth_provider(region, self._https_url(endpoint, port))
+ ),
+ keep_alive=True,
+ max_connection_lifetime=MAX_CONNECTION_LIFETIME,
+ connection_timeout=CONNECTION_TIMEOUT,
+ connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
+ max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
+ max_transaction_retry_time=0,
+ )
+
+ # Lifecycle
+
+ def init(self) -> None:
+ if self._writer is not None:
+ return
+ with self._lock:
+ if self._writer is None:
+ cfg = self._config()
+ writer_endpoint = cfg["WRITER_ENDPOINT"]
+ reader_endpoint = cfg["READER_ENDPOINT"] or writer_endpoint
+
+ # Eager connectivity checks are best-effort
+ # A Neptune that is down at boot must not crash the process, same degradation model as Postgres
+ # Drivers reconnect lazily on first use
+ # /health/ready surfaces the outage until it recovers
+ self._writer = self._build_driver(writer_endpoint)
+ self._verify_best_effort(self._writer, "writer")
+
+ if reader_endpoint == writer_endpoint:
+ self._reader = self._writer
+
+ else:
+ self._reader = self._build_driver(reader_endpoint)
+ self._verify_best_effort(self._reader, "reader")
+
+ if not self._atexit_registered:
+ atexit.register(self.close)
+ self._atexit_registered = True
+
+ def close(self) -> None:
+ with self._lock:
+ # `Driver.close()` is idempotent, so closing the same driver twice
+ # (when reader aliases writer on single-endpoint configs) is safe
+ for driver in (self._reader, self._writer):
+ if driver is None:
+ continue
+ try:
+ driver.close()
+ except Exception: # pragma: no cover - best-effort
+ pass
+ self._writer = None
+ self._reader = None
+
+ # Sessions
+
+ def _get_writer(self) -> neo4j.Driver:
+ self.init()
+ assert self._writer is not None
+ return self._writer
+
+ def _get_reader(self) -> neo4j.Driver:
+ self.init()
+ assert self._reader is not None
+ return self._reader
+
+ @staticmethod
+ def _verify_best_effort(driver: neo4j.Driver, role: str) -> None:
+ try:
+ driver.verify_connectivity()
+
+ except Exception:
+ logger.warning(
+ "Neptune %s endpoint unreachable at init; continuing with a lazily-reconnecting driver",
+ role,
+ exc_info=True,
+ )
+
+ def verify_connectivity(self) -> None:
+ # The API read path uses the reader driver
+ # On single-endpoint clusters it aliases the writer, so this also covers the writer
+ # A writer-only outage is a workers' concern (no HTTP probe there) and deliberately does not fail API readiness
+ self._get_reader().verify_connectivity()
+
+ @contextmanager
+ def get_session(
+ self,
+ database: str | None = None, # noqa: ARG002 - ignored on Neptune
+ default_access_mode: str | None = None,
+ ) -> Iterator[RetryableSession]:
+ from api.attack_paths.database import (
+ ClientStatementException,
+ GraphDatabaseQueryException,
+ NeptuneWriteRetryExhaustedException,
+ WriteQueryNotAllowedException,
+ )
+
+ driver = (
+ self._get_reader()
+ if default_access_mode == neo4j.READ_ACCESS
+ else self._get_writer()
+ )
+
+ session_wrapper: RetryableSession | None = None
+ try:
+ is_write_session = default_access_mode != neo4j.READ_ACCESS
+ session_wrapper = RetryableSession(
+ session_factory=lambda: driver.session(
+ default_access_mode=default_access_mode
+ ),
+ max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
+ retry_if=_is_retryable_write_error if is_write_session else None,
+ initial_retry_delay_seconds=(
+ NEPTUNE_WRITE_RETRY_DELAY_SECONDS if is_write_session else 0
+ ),
+ retry_context="Neptune write" if is_write_session else None,
+ )
+ yield session_wrapper
+
+ except RetryExhaustedError as exc:
+ last_error = exc.last_error
+ raise NeptuneWriteRetryExhaustedException(
+ message=str(exc),
+ code=getattr(last_error, "code", None),
+ ) from last_error
+
+ except neo4j.exceptions.Neo4jError as exc:
+ if (
+ default_access_mode == neo4j.READ_ACCESS
+ and exc.code
+ and exc.code in READ_EXCEPTION_CODES
+ ):
+ raise WriteQueryNotAllowedException(
+ message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
+ )
+
+ message = exc.message if exc.message is not None else str(exc)
+ if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
+ raise ClientStatementException(message=message, code=exc.code)
+ raise GraphDatabaseQueryException(message=message, code=exc.code)
+
+ finally:
+ if session_wrapper is not None:
+ session_wrapper.close()
+
+ # Operations
+
+ def execute_read_query(
+ self,
+ database: str, # noqa: ARG002 - ignored on Neptune
+ cypher: str,
+ parameters: dict[str, Any] | None = None,
+ ) -> neo4j.graph.Graph:
+ with self.get_session(default_access_mode=neo4j.READ_ACCESS) as session:
+
+ def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
+ result = tx.run(
+ cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
+ )
+ return result.graph()
+
+ return session.execute_read(_run)
+
+ def create_database(self, database: str) -> None: # noqa: ARG002
+ # Neptune clusters are single-database; there is nothing to create.
+ return None
+
+ def drop_database(self, database: str) -> None: # noqa: ARG002
+ # Neptune clusters are single-database; there is nothing to drop.
+ return None
+
+ def drop_subgraph(self, database: str, provider_id: str) -> int: # noqa: ARG002
+ """Delete a provider's subgraph in two bounded phases.
+
+ Neptune write transactions are capped at ~2 minutes. A naive
+ `DETACH DELETE` on a label-scanned batch grows unbounded with graph
+ density (one node can drag thousands of relationships into the same
+ transaction). Instead:
+
+ 1. Delete relationships incident to provider nodes, one fixed-size
+ batch per transaction.
+ 2. Delete the now-orphaned nodes, one fixed-size batch per transaction.
+
+ Each transaction does work proportional to `batch_size`, never to the
+ graph's branching factor.
+ """
+ from tasks.jobs.attack_paths.config import (
+ GRAPH_MUTATION_BATCH_SIZE,
+ PROVIDER_RESOURCE_LABEL,
+ get_provider_label,
+ )
+
+ provider_label = get_provider_label(provider_id)
+ deleted_relationships = 0
+ relationship_batches = 0
+ node_batches = 0
+ drop_t0 = time.perf_counter()
+
+ logger.info(
+ "Dropping provider graph from Neptune sink "
+ "(provider=%s, provider_label=%s)",
+ provider_id,
+ provider_label,
+ )
+
+ logger.info(
+ "Opening Neptune writer session for provider graph drop (provider=%s)",
+ provider_id,
+ )
+ with self.get_session() as session:
+ logger.info(
+ "Opened Neptune writer session for provider graph drop (provider=%s)",
+ provider_id,
+ )
+ for phase, query_template in RELATIONSHIP_DELETE_QUERY_TEMPLATES.items():
+ deleted_relationships, phase_batches = delete_batches(
+ session=session,
+ logger=logger,
+ log_target="Neptune sink",
+ provider_id=provider_id,
+ query=query_template.format(provider_label=provider_label),
+ phase=phase,
+ count_key="deleted_rels_count",
+ total_key="rels",
+ deleted_key="deleted_rels",
+ initial_total=deleted_relationships,
+ batch_size=GRAPH_MUTATION_BATCH_SIZE,
+ drop_t0=drop_t0,
+ )
+ relationship_batches += phase_batches
+
+ deleted_nodes, node_batches = delete_batches(
+ session=session,
+ logger=logger,
+ log_target="Neptune sink",
+ provider_id=provider_id,
+ query=NODE_DELETE_QUERY_TEMPLATE.format(
+ provider_label=provider_label,
+ provider_resource_label=PROVIDER_RESOURCE_LABEL,
+ ),
+ phase="node",
+ count_key="deleted_nodes_count",
+ total_key="nodes",
+ deleted_key="deleted_nodes",
+ initial_total=0,
+ batch_size=GRAPH_MUTATION_BATCH_SIZE,
+ drop_t0=drop_t0,
+ )
+
+ logger.info(
+ "Finished dropping provider graph from Neptune sink "
+ "(provider=%s, relationship_batches=%s, deleted_rels=%s, "
+ "node_batches=%s, deleted_nodes=%s, elapsed=%.3fs)",
+ provider_id,
+ relationship_batches,
+ deleted_relationships,
+ node_batches,
+ deleted_nodes,
+ time.perf_counter() - drop_t0,
+ )
+ return deleted_nodes
+
+ def has_provider_data(self, database: str, provider_id: str) -> bool: # noqa: ARG002
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_RESOURCE_LABEL,
+ get_provider_label,
+ )
+
+ provider_label = get_provider_label(provider_id)
+ query = (
+ f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
+ )
+ with self.get_session(default_access_mode=neo4j.READ_ACCESS) as session:
+ result = session.run(query)
+ return result.single() is not None
+
+ def clear_cache(self, database: str) -> None: # noqa: ARG002
+ # Neptune has no user-facing cache-clear procedure; no-op.
+ return None
+
+ # Sync write path
+
+ def ensure_sync_indexes(self, database: str) -> None: # noqa: ARG002
+ # Neptune routes node and relationship lookups through `~id`, which is the cluster's primary key
+ # No additional index is needed or supported
+ return None
+
+ def write_nodes(
+ self,
+ database: str, # noqa: ARG002
+ labels: str,
+ rows: list[dict[str, Any]],
+ ) -> None:
+ if not rows:
+ return
+ from tasks.jobs.attack_paths.config import (
+ PROVIDER_ELEMENT_ID_PROPERTY,
+ PROVIDER_RESOURCE_LABEL,
+ )
+
+ # MERGE on `~id` is the documented and engine-optimized idempotent
+ # upsert pattern for Neptune openCypher. The label inside the MERGE
+ # matters: Neptune assigns a default `vertex` label to any node
+ # created without an explicit one, so we pin `_ProviderResource`
+ # (which every synced node carries anyway) at MERGE-time. Additional
+ # labels are added after
+ #
+ # We also write `_provider_element_id` as a regular property so
+ # non-sync code (drop_subgraph, query helpers) keeps a stable contract
+ # that doesn't know about `~id`
+ query = f"""
+ UNWIND $rows AS row
+ MERGE (n:`{PROVIDER_RESOURCE_LABEL}` {{`~id`: row.provider_element_id}})
+ SET n:{labels}
+ SET n += row.props
+ SET n.`{PROVIDER_ELEMENT_ID_PROPERTY}` = row.provider_element_id
+ """
+ with self.get_session() as session:
+ session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
+
+ def write_relationships(
+ self,
+ database: str, # noqa: ARG002
+ rel_type: str,
+ provider_id: str, # noqa: ARG002 - encoded in start/end `~id` already
+ rows: list[dict[str, Any]],
+ ) -> None:
+ if not rows:
+ return
+ from tasks.jobs.attack_paths.config import PROVIDER_ELEMENT_ID_PROPERTY
+
+ # `id(n) = $value` is Neptune's parameterized fast path; both endpoint
+ # MATCHes resolve in O(1) via the system `~id`, so per-row work stays
+ # bounded regardless of batch size
+ query = f"""
+ UNWIND $rows AS row
+ MATCH (s) WHERE id(s) = row.start_element_id
+ MATCH (e) WHERE id(e) = row.end_element_id
+ MERGE (s)-[r:`{rel_type}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}}]->(e)
+ SET r += row.props
+ """
+ with self.get_session() as session:
+ session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
+
+ # Test helpers
+
+ def get_writer(self) -> neo4j.Driver:
+ return self._get_writer()
+
+ def get_reader(self) -> neo4j.Driver:
+ return self._get_reader()
+
+
+# SigV4 auth provider
+
+
+class _NeptuneAuthToken(neo4j.Auth):
+ """Neo4j Auth backed by a SigV4-signed GET to `/opencypher`."""
+
+ def __init__(self, region: str, url: str) -> None:
+ session = BotoSession()
+ credentials = session.get_credentials()
+ if credentials is None:
+ raise RuntimeError(
+ "No AWS credentials available for Neptune SigV4 signing. "
+ "Ensure the boto3 credential chain can resolve."
+ )
+ credentials = credentials.get_frozen_credentials()
+
+ request = AWSRequest(method="GET", url=url + "/opencypher")
+ # SigV4 canonical Host must carry the real `host:port`
+ # Neptune runs on a non-default port (8182), so `.hostname` would drop it and break signing
+ request.headers.add_header("Host", urlsplit(url).netloc)
+ SigV4Auth(credentials, "neptune-db", region).add_auth(request)
+
+ auth_obj = {
+ header: request.headers[header]
+ for header in (
+ "Authorization",
+ "X-Amz-Date",
+ "X-Amz-Security-Token",
+ "Host",
+ )
+ if header in request.headers
+ }
+ auth_obj["HttpMethod"] = "GET"
+
+ super().__init__("basic", "username", json.dumps(auth_obj))
+
+
+def neptune_auth_provider(region: str, https_url: str) -> Callable[[], ExpiringAuth]:
+ """Return a callable the neo4j driver can invoke to refresh credentials."""
+
+ def _provider() -> ExpiringAuth:
+ token = _NeptuneAuthToken(region, https_url)
+ expires_at = (
+ datetime.datetime.now(datetime.UTC)
+ + datetime.timedelta(minutes=SIGV4_TOKEN_LIFETIME_MINUTES)
+ ).timestamp()
+ return ExpiringAuth(auth=token, expires_at=expires_at)
+
+ return _provider
diff --git a/api/src/backend/api/attack_paths/views_helpers.py b/api/src/backend/api/attack_paths/views_helpers.py
index bfb077abd0..1c1d3e7888 100644
--- a/api/src/backend/api/attack_paths/views_helpers.py
+++ b/api/src/backend/api/attack_paths/views_helpers.py
@@ -5,6 +5,7 @@ from typing import Any
import neo4j
from api.attack_paths import AttackPathsQueryDefinition
from api.attack_paths import database as graph_database
+from api.attack_paths import sink as sink_module
from api.attack_paths.cypher_sanitizer import (
inject_provider_label,
validate_custom_query,
@@ -14,7 +15,9 @@ from api.attack_paths.queries.schema import (
RAW_SCHEMA_URL,
get_cartography_schema_query,
)
+from api.models import AttackPathsScan
from config.custom_logging import BackendLogger
+from config.env import env
from rest_framework.exceptions import APIException, PermissionDenied, ValidationError
from tasks.jobs.attack_paths.config import (
INTERNAL_LABELS,
@@ -26,6 +29,10 @@ from tasks.jobs.attack_paths.config import (
logger = logging.getLogger(BackendLogger.API)
+def _custom_query_timeout_ms() -> int:
+ return env.int("ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30) * 1000
+
+
# Predefined query helpers
@@ -102,13 +109,13 @@ def execute_query(
definition: AttackPathsQueryDefinition,
parameters: dict[str, Any],
provider_id: str,
+ scan: AttackPathsScan,
) -> dict[str, Any]:
try:
- graph = graph_database.execute_read_query(
- database=database_name,
- cypher=definition.cypher,
- parameters=parameters,
- )
+ # TODO: drop after Neptune cutover
+ # Route reads by the scan row's recorded sink, not by current settings.
+ backend = sink_module.get_backend_for_scan(scan)
+ graph = backend.execute_read_query(database_name, definition.cypher, parameters)
return _serialize_graph(graph, provider_id)
except graph_database.WriteQueryNotAllowedException:
@@ -142,22 +149,31 @@ def execute_custom_query(
database_name: str,
cypher: str,
provider_id: str,
+ scan: AttackPathsScan,
) -> dict[str, Any]:
# Defense-in-depth for custom queries:
- # 1. neo4j.READ_ACCESS — prevents mutations at the driver level
- # 2. inject_provider_label() — regex-based label injection scopes node patterns
- # 3. _serialize_graph() — post-query filter drops nodes without the provider label
+ # 1. `neo4j.READ_ACCESS` - prevents mutations at the driver level
+ # 2. `inject_provider_label()` - regex-based label injection scopes node patterns
+ # 3. `_serialize_graph()` - post-query filter drops nodes without the provider label
+ # 4. `USING QUERY:TIMEOUTMILLISECONDS` on Neptune - server-side runaway cutoff
#
# Layer 2 is best-effort (regex can't fully parse Cypher);
# layer 3 is the safety net that guarantees provider isolation.
validate_custom_query(cypher)
cypher = inject_provider_label(cypher, provider_id)
+ # TODO: drop after Neptune cutover
+ backend = sink_module.get_backend_for_scan(scan)
+
+ # Neptune enforces a cluster-level query timeout; prepending the hint
+ # makes the limit explicit and matches the client-side read timeout.
+ # Applies only when the scan's graph lives in Neptune.
+ if getattr(scan, "sink_backend", None) == "neptune":
+ timeout_ms = _custom_query_timeout_ms()
+ cypher = f"USING QUERY:TIMEOUTMILLISECONDS {timeout_ms}\n{cypher}"
+
try:
- graph = graph_database.execute_read_query(
- database=database_name,
- cypher=cypher,
- )
+ graph = backend.execute_read_query(database_name, cypher, None)
serialized = _serialize_graph(graph, provider_id)
return _truncate_graph(serialized)
@@ -180,10 +196,11 @@ def execute_custom_query(
def get_cartography_schema(
- database_name: str, provider_id: str
+ database_name: str, provider_id: str, scan: AttackPathsScan
) -> dict[str, str] | None:
try:
- with graph_database.get_session(
+ backend = sink_module.get_backend_for_scan(scan)
+ with backend.get_session(
database_name, default_access_mode=neo4j.READ_ACCESS
) as session:
result = session.run(get_cartography_schema_query(provider_id))
diff --git a/api/src/backend/api/db_utils.py b/api/src/backend/api/db_utils.py
index 2c378f2ea8..b6d3fdada1 100644
--- a/api/src/backend/api/db_utils.py
+++ b/api/src/backend/api/db_utils.py
@@ -2,7 +2,7 @@ import re
import secrets
import time
import uuid
-from contextlib import contextmanager
+from contextlib import ExitStack, contextmanager, nullcontext
from datetime import UTC, datetime, timedelta
from api.db_router import (
@@ -48,6 +48,140 @@ REPLICA_MAX_ATTEMPTS = env.int("POSTGRES_REPLICA_MAX_ATTEMPTS", default=3)
REPLICA_RETRY_BASE_DELAY = env.float("POSTGRES_REPLICA_RETRY_BASE_DELAY", default=0.5)
SET_CONFIG_QUERY = "SELECT set_config(%s, %s::text, TRUE);"
+SET_TRANSACTION_READ_ONLY_QUERY = "SET TRANSACTION READ ONLY;"
+
+REPLICA_CONNECTION_SQLSTATE_PREFIXES = ("08",)
+REPLICA_CONNECTION_SQLSTATES = {"57P01", "57P02", "57P03"}
+REPLICA_NON_FAILOVER_SQLSTATES = {"57014", "40001", "40P01"}
+REPLICA_CONNECTION_ERROR_MESSAGES = (
+ "ssl syscall",
+ "eof detected",
+ "server closed the connection",
+ "connection already closed",
+ "connection not open",
+ "could not connect to server",
+ "connection refused",
+ "connection reset",
+ "connection timed out",
+ "lost synchronization",
+ "terminating connection",
+ "database system is starting up",
+ "database system is shutting down",
+ "database system is in recovery mode",
+)
+REPLICA_NON_FAILOVER_ERROR_MESSAGES = (
+ "canceling statement due to user request",
+ "deadlock detected",
+ "could not serialize access",
+)
+
+
+def _iter_exception_chain(error: BaseException):
+ seen = set()
+ pending = [error]
+ while pending:
+ current = pending.pop(0)
+ if current is None or id(current) in seen:
+ continue
+ seen.add(id(current))
+ yield current
+
+ cause = getattr(current, "__cause__", None)
+ context = getattr(current, "__context__", None)
+ if cause is not None:
+ pending.append(cause)
+ if context is not None:
+ pending.append(context)
+ for arg in getattr(current, "args", ()):
+ if isinstance(arg, BaseException):
+ pending.append(arg)
+
+
+def _get_exception_sqlstate(error: BaseException) -> str | None:
+ for attr in ("pgcode", "sqlstate"):
+ sqlstate = getattr(error, attr, None)
+ if sqlstate:
+ return sqlstate
+
+ diag = getattr(error, "diag", None)
+ if diag is not None:
+ sqlstate = getattr(diag, "sqlstate", None)
+ if sqlstate:
+ return sqlstate
+ return None
+
+
+def _is_replica_connection_failure(error: BaseException) -> bool:
+ """
+ Return True only for replica failures where retrying on primary is safe.
+
+ Query cancellations, serialization failures, and deadlocks should surface to
+ callers because replaying them can hide real query or concurrency problems.
+ """
+ messages = []
+ sqlstates = set()
+
+ for chained_error in _iter_exception_chain(error):
+ sqlstate = _get_exception_sqlstate(chained_error)
+ if sqlstate:
+ sqlstates.add(sqlstate)
+ messages.append(str(chained_error).lower())
+
+ if sqlstates & REPLICA_NON_FAILOVER_SQLSTATES:
+ return False
+ if any(
+ sqlstate.startswith(REPLICA_CONNECTION_SQLSTATE_PREFIXES)
+ or sqlstate in REPLICA_CONNECTION_SQLSTATES
+ for sqlstate in sqlstates
+ ):
+ return True
+
+ message = " ".join(messages)
+ if any(marker in message for marker in REPLICA_NON_FAILOVER_ERROR_MESSAGES):
+ return False
+
+ return any(marker in message for marker in REPLICA_CONNECTION_ERROR_MESSAGES)
+
+
+def _strip_leading_sql_comments(sql: str) -> str:
+ if not isinstance(sql, str):
+ return ""
+
+ sql_text = sql.lstrip()
+ while True:
+ if sql_text.startswith("--"):
+ newline_index = sql_text.find("\n")
+ if newline_index == -1:
+ return ""
+ sql_text = sql_text[newline_index + 1 :].lstrip()
+ continue
+
+ if sql_text.startswith("/*"):
+ comment_end_index = sql_text.find("*/", 2)
+ if comment_end_index == -1:
+ return ""
+ sql_text = sql_text[comment_end_index + 2 :].lstrip()
+ continue
+
+ return sql_text
+
+
+def _is_safe_primary_replay(sql: str, many: bool) -> bool:
+ if many:
+ return False
+
+ sql_text = _strip_leading_sql_comments(sql)
+ if not re.match(r"(?is)^SELECT\b", sql_text):
+ return False
+
+ return not any(
+ re.search(pattern, sql_text, re.IGNORECASE | re.DOTALL)
+ for pattern in (
+ r"\bINTO\b",
+ r"\bFOR\s+(?:NO\s+KEY\s+)?UPDATE\b",
+ r"\bFOR\s+(?:KEY\s+)?SHARE\b",
+ )
+ )
@contextmanager
@@ -77,14 +211,36 @@ def rls_transaction(
retry_on_replica: bool = True,
):
"""
- Creates a new database transaction setting the given configuration value for Postgres RLS. It validates the
- if the value is a valid UUID.
+ Context manager that opens an RLS-scoped database transaction.
+
+ Sets a Postgres configuration variable (``set_config``) so that Row-Level
+ Security policies can filter by tenant. When *using* points to a read
+ replica and *retry_on_replica* is True, replica failures are handled in two
+ places:
+
+ 1. **Pre-yield** (connection-setup failures): the function retries
+ up to ``REPLICA_MAX_ATTEMPTS`` times on the replica, then falls
+ back to the primary DB.
+ 2. **Post-yield** (mid-query failures): an ``execute_wrapper``
+ intercepts connection-level ``OperationalError`` during
+ ``cursor.execute()`` calls and falls back directly to the primary DB
+ for single ``SELECT`` statements. The primary fallback transaction is
+ read-only, and unsafe statements keep raising the original error.
+ The wrapper swaps the inner cursor so ``fetchall()`` / ``fetchone()``
+ read from the new connection transparently.
+
+ Limitation: server-side cursors (``.iterator()``) fetch rows via
+ ``fetchmany()``, which the wrapper does not intercept. Call sites
+ that iterate large result sets with ``.iterator()`` on the replica
+ should add their own retry logic.
Args:
- value (str): Database configuration parameter value.
- parameter (str): Database configuration parameter name, by default is 'api.tenant_id'.
- using (str | None): Optional database alias to run the transaction against. Defaults to the
- active read alias (if any) or Django's default connection.
+ value: Database configuration parameter value (must be a valid UUID).
+ parameter: Database configuration parameter name.
+ using: Optional database alias. Defaults to the active read
+ alias or Django's default connection.
+ retry_on_replica: Whether replica setup failures can retry and
+ connection-level mid-query failures can fall back to primary.
"""
requested_alias = using or get_read_db_alias()
db_alias = requested_alias or DEFAULT_DB_ALIAS
@@ -92,54 +248,121 @@ def rls_transaction(
db_alias = DEFAULT_DB_ALIAS
alias = db_alias
- is_replica = READ_REPLICA_ALIAS and alias == READ_REPLICA_ALIAS
- max_attempts = REPLICA_MAX_ATTEMPTS if is_replica and retry_on_replica else 1
+ is_replica = bool(READ_REPLICA_ALIAS and alias == READ_REPLICA_ALIAS)
+ can_failover = is_replica and retry_on_replica
+ replica_alias = alias # captured before the loop mutates alias
+ max_attempts = (REPLICA_MAX_ATTEMPTS + 1) if can_failover else 1
- for attempt in range(1, max_attempts + 1):
- router_token = None
- yielded_cursor = False
+ # State shared between the generator and the _query_failover closure.
+ # The fallback transaction.atomic() is registered into fallback_stack
+ # via enter_context so its __exit__ runs when the outer with-ExitStack
+ # block exits, with the right exc_info. No manual __enter__/__exit__.
+ _fallback = {"succeeded": False, "token": None, "caller_exited_cleanly": False}
- # On final attempt, fallback to primary
- if attempt == max_attempts and is_replica:
- logger.warning(
- f"RLS transaction failed after {attempt - 1} attempts on replica, "
- f"falling back to primary DB"
- )
- alias = DEFAULT_DB_ALIAS
+ with ExitStack() as fallback_stack:
- conn = connections[alias]
- try:
- if alias != DEFAULT_DB_ALIAS:
- router_token = set_read_db_alias(alias)
+ def _query_failover(execute, sql, params, many, context):
+ """execute_wrapper: replay failed replica queries on the primary DB."""
+ try:
+ return execute(sql, params, many, context)
+ except OperationalError as err:
+ if not _is_replica_connection_failure(err):
+ raise
+ if not _is_safe_primary_replay(sql, many):
+ raise
- with transaction.atomic(using=alias):
- with conn.cursor() as cursor:
- try:
- # just in case the value is a UUID object
- uuid.UUID(str(value))
- except ValueError:
- raise ValidationError("Must be a valid UUID")
- cursor.execute(SET_CONFIG_QUERY, [parameter, value])
- yielded_cursor = True
- yield cursor
- return
- except OperationalError as e:
- if yielded_cursor:
- raise
- # If on primary or max attempts reached, raise
- if not is_replica or attempt == max_attempts:
- raise
+ try:
+ connections[replica_alias].close()
+ except Exception:
+ pass # Best-effort; connection may already be dead
- # Retry with exponential backoff
- delay = REPLICA_RETRY_BASE_DELAY * (2 ** (attempt - 1))
- logger.info(
- f"RLS transaction failed on replica (attempt {attempt}/{max_attempts}), "
- f"retrying in {delay}s. Error: {e}"
- )
- time.sleep(delay)
- finally:
- if router_token is not None:
- reset_read_db_alias(router_token)
+ logger.warning(
+ "Mid-query replica connection failure, falling back to primary DB"
+ )
+ primary = connections[DEFAULT_DB_ALIAS]
+ primary.ensure_connection()
+ fallback_stack.enter_context(transaction.atomic(using=DEFAULT_DB_ALIAS))
+
+ fallback_cursor = primary.cursor()
+ fallback_stack.callback(fallback_cursor.close)
+ fallback_cursor.execute(SET_TRANSACTION_READ_ONLY_QUERY)
+ fallback_cursor.execute(SET_CONFIG_QUERY, [parameter, value])
+ _fallback["token"] = set_read_db_alias(DEFAULT_DB_ALIAS)
+
+ fallback_cursor.execute(sql, params)
+
+ context["cursor"].db = primary
+ context["cursor"].cursor = fallback_cursor.cursor
+ _fallback["succeeded"] = True
+ return None
+
+ for attempt in range(1, max_attempts + 1):
+ router_token = None
+ yielded_cursor = False
+
+ # On final attempt, fall back to primary
+ if attempt == max_attempts and can_failover:
+ if attempt > 1:
+ logger.warning(
+ f"RLS transaction failed after {attempt - 1} attempts on replica, "
+ f"falling back to primary DB"
+ )
+ alias = DEFAULT_DB_ALIAS
+
+ conn = connections[alias]
+ try:
+ if alias != DEFAULT_DB_ALIAS:
+ router_token = set_read_db_alias(alias)
+
+ with transaction.atomic(using=alias):
+ with conn.cursor() as cursor:
+ try:
+ uuid.UUID(str(value))
+ except ValueError:
+ raise ValidationError("Must be a valid UUID")
+ cursor.execute(SET_CONFIG_QUERY, [parameter, value])
+
+ wrapper_cm = (
+ conn.execute_wrapper(_query_failover)
+ if can_failover and alias == replica_alias
+ else nullcontext()
+ )
+ with wrapper_cm:
+ yielded_cursor = True
+ yield cursor
+ _fallback["caller_exited_cleanly"] = True
+ return
+ except OperationalError as e:
+ if yielded_cursor:
+ if _fallback["succeeded"] and _fallback["caller_exited_cleanly"]:
+ # Caller's queries succeeded on primary via failover.
+ # This error is transaction.atomic() cleanup on the
+ # dead replica connection, suppress it.
+ return
+ raise
+
+ if not can_failover or attempt == max_attempts:
+ raise
+
+ try:
+ connections[alias].close()
+ except Exception:
+ pass # Best-effort; connection may already be dead
+
+ # Retry with exponential backoff
+ delay = REPLICA_RETRY_BASE_DELAY * (2 ** (attempt - 1))
+ logger.info(
+ f"RLS transaction failed on replica (attempt {attempt}/{max_attempts}), "
+ f"retrying in {delay}s. Error: {e}"
+ )
+ time.sleep(delay)
+ finally:
+ if _fallback["token"] is not None:
+ reset_read_db_alias(_fallback["token"])
+ _fallback["token"] = None
+
+ if router_token is not None:
+ reset_read_db_alias(router_token)
class CustomUserManager(BaseUserManager):
diff --git a/api/src/backend/api/decorators.py b/api/src/backend/api/decorators.py
index a055b2252f..2dd2d5fea4 100644
--- a/api/src/backend/api/decorators.py
+++ b/api/src/backend/api/decorators.py
@@ -1,12 +1,13 @@
import uuid
from functools import wraps
+from api.attack_paths.database import GraphDatabaseQueryException
from api.db_router import READ_REPLICA_ALIAS
from api.db_utils import POSTGRES_TENANT_VAR, SET_CONFIG_QUERY, rls_transaction
from api.exceptions import ProviderDeletedException
-from api.models import Provider, Scan
+from api.models import Membership, Provider, Scan, Tenant
from django.core.exceptions import ObjectDoesNotExist
-from django.db import DatabaseError, connection, transaction
+from django.db import DEFAULT_DB_ALIAS, DatabaseError, connection, transaction
from rest_framework_json_api.serializers import ValidationError
@@ -75,9 +76,11 @@ def handle_provider_deletion(func):
"""
Decorator that raises `ProviderDeletedException` if provider was deleted during execution.
- Catches `ObjectDoesNotExist` and `DatabaseError` (including `IntegrityError`), checks if
- provider still exists, and raises `ProviderDeletedException` if not. Otherwise,
- re-raises original exception.
+ Catches `ObjectDoesNotExist`, `DatabaseError` (including `IntegrityError`), and
+ `GraphDatabaseQueryException`, checks if provider still exists, and raises
+ `ProviderDeletedException` if not. Graph database errors also check whether the
+ tenant still exists and has memberships. Otherwise, re-raises the original
+ exception.
Requires `tenant_id` and `provider_id` in kwargs.
@@ -92,11 +95,16 @@ def handle_provider_deletion(func):
def wrapper(*args, **kwargs):
try:
return func(*args, **kwargs)
- except (ObjectDoesNotExist, DatabaseError):
+ except (ObjectDoesNotExist, DatabaseError, GraphDatabaseQueryException) as exc:
tenant_id = kwargs.get("tenant_id")
provider_id = kwargs.get("provider_id")
+ database_alias = (
+ DEFAULT_DB_ALIAS
+ if isinstance(exc, GraphDatabaseQueryException)
+ else READ_REPLICA_ALIAS
+ )
- with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
+ with rls_transaction(tenant_id, using=database_alias):
if provider_id is None:
scan_id = kwargs.get("scan_id")
if scan_id is None:
@@ -113,6 +121,13 @@ def handle_provider_deletion(func):
raise ProviderDeletedException(
f"Provider '{provider_id}' was deleted during the scan"
) from None
+ if isinstance(exc, GraphDatabaseQueryException) and (
+ not Tenant.objects.filter(pk=tenant_id).exists()
+ or not Membership.objects.filter(tenant_id=tenant_id).exists()
+ ):
+ raise ProviderDeletedException(
+ f"Tenant '{tenant_id}' was deleted during the scan"
+ ) from None
raise
return wrapper
diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py
index 740556329c..a7f888b453 100644
--- a/api/src/backend/api/filters.py
+++ b/api/src/backend/api/filters.py
@@ -67,6 +67,7 @@ from django_filters.rest_framework import (
)
from rest_framework_json_api.django_filters.backends import DjangoFilterBackend
from rest_framework_json_api.serializers import ValidationError
+from uuid6 import UUID
class CustomDjangoFilterBackend(DjangoFilterBackend):
@@ -672,35 +673,32 @@ class LatestResourceFilter(ProviderRelationshipFilterSet):
return queryset.filter(tags__text_search=value)
-class FindingFilter(CommonFindingFilters):
+FINDING_BASE_FILTER_FIELDS = {
+ "id": ["exact", "in"],
+ "uid": ["exact", "in"],
+ "scan": ["exact", "in"],
+ "delta": ["exact", "in"],
+ "status": ["exact", "in"],
+ "severity": ["exact", "in"],
+ "impact": ["exact", "in"],
+ "check_id": ["exact", "in", "icontains"],
+}
+
+
+class BaseFindingFilter(CommonFindingFilters):
+ DATE_FILTER_FIELDS = ()
+ DATE_FILTER_NAMES = ()
+ DATE_RANGE_HELP_TEXT = (
+ f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days."
+ )
+ DATE_FILTER_REQUIRED_DETAIL = "At least one date filter is required."
+
scan = UUIDFilter(method="filter_scan_id")
scan__in = UUIDInFilter(method="filter_scan_id_in")
- inserted_at = DateFilter(method="filter_inserted_at", lookup_expr="date")
- inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
- inserted_at__gte = DateFilter(
- method="filter_inserted_at_gte",
- help_text=f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
- )
- inserted_at__lte = DateFilter(
- method="filter_inserted_at_lte",
- help_text=f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
- )
-
class Meta:
model = Finding
- fields = {
- "id": ["exact", "in"],
- "uid": ["exact", "in"],
- "scan": ["exact", "in"],
- "delta": ["exact", "in"],
- "status": ["exact", "in"],
- "severity": ["exact", "in"],
- "impact": ["exact", "in"],
- "check_id": ["exact", "in", "icontains"],
- "inserted_at": ["date", "gte", "lte"],
- "updated_at": ["gte", "lte"],
- }
+ fields = FINDING_BASE_FILTER_FIELDS
filter_overrides = {
FindingDeltaEnumField: {
"filter_class": CharFilter,
@@ -723,17 +721,13 @@ class FindingFilter(CommonFindingFilters):
return queryset.filter(resource_services__contains=[value])
def filter_queryset(self, queryset):
- if not (self.data.get("scan") or self.data.get("scan__in")) and not (
- self.data.get("inserted_at")
- or self.data.get("inserted_at__date")
- or self.data.get("inserted_at__gte")
- or self.data.get("inserted_at__lte")
+ if not (self.data.get("scan") or self.data.get("scan__in")) and not any(
+ self.data.get(filter_name) for filter_name in self.DATE_FILTER_NAMES
):
raise ValidationError(
[
{
- "detail": "At least one date filter is required: filter[inserted_at], filter[inserted_at.gte], "
- "or filter[inserted_at.lte].",
+ "detail": self.DATE_FILTER_REQUIRED_DETAIL,
"status": 400,
"source": {"pointer": "/data/attributes/inserted_at"},
"code": "required",
@@ -742,31 +736,42 @@ class FindingFilter(CommonFindingFilters):
)
cleaned = self.form.cleaned_data
- exact_date = cleaned.get("inserted_at") or cleaned.get("inserted_at__date")
- gte_date = cleaned.get("inserted_at__gte") or exact_date
- lte_date = cleaned.get("inserted_at__lte") or exact_date
-
- if gte_date is None:
- gte_date = datetime.now(UTC).date()
- if lte_date is None:
- lte_date = datetime.now(UTC).date()
-
- if abs(lte_date - gte_date) > timedelta(
- days=settings.FINDINGS_MAX_DAYS_IN_RANGE
- ):
- raise ValidationError(
- [
- {
- "detail": f"The date range cannot exceed {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
- "status": 400,
- "source": {"pointer": "/data/attributes/inserted_at"},
- "code": "invalid",
- }
- ]
- )
+ for field_name in self.DATE_FILTER_FIELDS:
+ self.validate_datetime_filter_range(cleaned, field_name)
return super().filter_queryset(queryset)
+ def validate_datetime_filter_range(self, cleaned, field_name):
+ exact_value = cleaned.get(field_name) or cleaned.get(f"{field_name}__date")
+ gte_value = cleaned.get(f"{field_name}__gte") or exact_value
+ lte_value = cleaned.get(f"{field_name}__lte") or exact_value
+
+ if not (exact_value or gte_value or lte_value):
+ return
+
+ default_value = datetime.now(UTC).date()
+ gte_value = gte_value or default_value
+ lte_value = lte_value or default_value
+
+ gte_datetime = self.filter_value_to_datetime(gte_value, field_name)
+ lte_datetime = self.filter_value_to_datetime(lte_value, field_name)
+
+ if abs(lte_datetime - gte_datetime) <= timedelta(
+ days=settings.FINDINGS_MAX_DAYS_IN_RANGE
+ ):
+ return
+
+ raise ValidationError(
+ [
+ {
+ "detail": f"The date range cannot exceed {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
+ "status": 400,
+ "source": {"pointer": f"/data/attributes/{field_name}"},
+ "code": "invalid",
+ }
+ ]
+ )
+
# Convert filter values to UUIDv7 values for use with partitioning
def filter_scan_id(self, queryset, name, value):
try:
@@ -824,27 +829,169 @@ class FindingFilter(CommonFindingFilters):
datetime_value = self.maybe_date_to_datetime(value)
start = uuid7_start(datetime_to_uuid7(datetime_value))
end = uuid7_start(datetime_to_uuid7(datetime_value + timedelta(days=1)))
-
return queryset.filter(id__gte=start, id__lt=end)
def filter_inserted_at_gte(self, queryset, name, value):
datetime_value = self.maybe_date_to_datetime(value)
start = uuid7_start(datetime_to_uuid7(datetime_value))
-
return queryset.filter(id__gte=start)
def filter_inserted_at_lte(self, queryset, name, value):
datetime_value = self.maybe_date_to_datetime(value)
end = uuid7_start(datetime_to_uuid7(datetime_value + timedelta(days=1)))
-
return queryset.filter(id__lt=end)
@staticmethod
def maybe_date_to_datetime(value):
- dt = value
+ if isinstance(value, datetime):
+ return value
if isinstance(value, date):
- dt = datetime.combine(value, datetime.min.time(), tzinfo=UTC)
- return dt
+ return datetime.combine(value, datetime.min.time(), tzinfo=UTC)
+ if isinstance(value, str):
+ return parse(value)
+ return value
+
+ @classmethod
+ def filter_value_to_datetime(cls, value, field_name):
+ try:
+ datetime_value = cls.maybe_date_to_datetime(value)
+ except (TypeError, ValueError, OverflowError):
+ raise ValidationError(
+ [
+ {
+ "detail": "Enter a valid date or datetime.",
+ "status": 400,
+ "source": {"pointer": f"/data/attributes/{field_name}"},
+ "code": "invalid",
+ }
+ ]
+ )
+
+ if datetime_value.tzinfo is None:
+ return datetime_value.replace(tzinfo=UTC)
+ return datetime_value.astimezone(UTC)
+
+
+class FindingFilter(BaseFindingFilter):
+ DATE_FILTER_FIELDS = ("inserted_at", "updated_at")
+ DATE_FILTER_NAMES = (
+ "inserted_at",
+ "inserted_at__date",
+ "inserted_at__gte",
+ "inserted_at__lte",
+ "updated_at",
+ "updated_at__date",
+ "updated_at__gte",
+ "updated_at__lte",
+ )
+ DATE_FILTER_REQUIRED_DETAIL = (
+ "At least one date filter is required: filter[inserted_at], filter[updated_at], "
+ "filter[inserted_at.gte], filter[updated_at.gte], filter[inserted_at.lte], "
+ "or filter[updated_at.lte]."
+ )
+
+ inserted_at = CharFilter(method="filter_inserted_at")
+ inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
+ inserted_at__gte = CharFilter(
+ method="filter_inserted_at",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+ inserted_at__lte = CharFilter(
+ method="filter_inserted_at",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+ updated_at = CharFilter(method="filter_updated_at")
+ updated_at__date = DateFilter(method="filter_updated_at", lookup_expr="date")
+ updated_at__gte = CharFilter(
+ method="filter_updated_at",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+ updated_at__lte = CharFilter(
+ method="filter_updated_at",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+
+ class Meta(BaseFindingFilter.Meta):
+ fields = FINDING_BASE_FILTER_FIELDS | {
+ "inserted_at": ["date", "gte", "lte"],
+ "updated_at": ["date", "gte", "lte"],
+ }
+
+ def filter_inserted_at(self, queryset, name, value):
+ start, end = self.filter_value_to_datetime_bounds(value, "inserted_at")
+
+ if name.endswith("__gte"):
+ return queryset.filter(id__gte=self.datetime_to_uuid7_boundary(start))
+ if name.endswith("__lte"):
+ return queryset.filter(id__lt=self.datetime_to_uuid7_boundary(end))
+
+ return queryset.filter(
+ id__gte=self.datetime_to_uuid7_boundary(start),
+ id__lt=self.datetime_to_uuid7_boundary(end),
+ )
+
+ def filter_updated_at(self, queryset, name, value):
+ start, end = self.filter_value_to_datetime_bounds(value, "updated_at")
+
+ if name.endswith("__gte"):
+ return queryset.filter(updated_at__gte=start)
+ if name.endswith("__lte"):
+ return queryset.filter(updated_at__lt=end)
+
+ return queryset.filter(updated_at__gte=start, updated_at__lt=end)
+
+ @classmethod
+ def filter_value_to_datetime_bounds(cls, value, field_name):
+ start = cls.filter_value_to_datetime(value, field_name)
+ if cls.is_date_filter_value(value):
+ return start, start + timedelta(days=1)
+ return start, start + timedelta(milliseconds=1)
+
+ @staticmethod
+ def datetime_to_uuid7_boundary(datetime_value):
+ timestamp_ms = int(datetime_value.timestamp() * 1000) & 0xFFFFFFFFFFFF
+ uuid_int = timestamp_ms << 80
+ uuid_int |= 0x7 << 76
+ uuid_int |= 0x2 << 62
+ return UUID(int=uuid_int)
+
+ @staticmethod
+ def is_date_filter_value(value):
+ if isinstance(value, datetime):
+ return False
+ if isinstance(value, date):
+ return True
+ return isinstance(value, str) and len(value.strip()) == 10
+
+
+class FindingMetadataFilter(BaseFindingFilter):
+ DATE_FILTER_FIELDS = ("inserted_at",)
+ DATE_FILTER_NAMES = (
+ "inserted_at",
+ "inserted_at__date",
+ "inserted_at__gte",
+ "inserted_at__lte",
+ )
+ DATE_FILTER_REQUIRED_DETAIL = (
+ "At least one date filter is required: filter[inserted_at], filter[inserted_at.gte], "
+ "or filter[inserted_at.lte]."
+ )
+
+ inserted_at = DateFilter(method="filter_inserted_at", lookup_expr="date")
+ inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
+ inserted_at__gte = DateFilter(
+ method="filter_inserted_at_gte",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+ inserted_at__lte = DateFilter(
+ method="filter_inserted_at_lte",
+ help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
+ )
+
+ class Meta(BaseFindingFilter.Meta):
+ fields = FINDING_BASE_FILTER_FIELDS | {
+ "inserted_at": ["date", "gte", "lte"],
+ }
class LatestFindingFilter(CommonFindingFilters):
diff --git a/api/src/backend/api/health.py b/api/src/backend/api/health.py
index 691640c0bd..cca3bcef72 100644
--- a/api/src/backend/api/health.py
+++ b/api/src/backend/api/health.py
@@ -2,8 +2,9 @@
Format (draft-inadarei-api-health-check-06).
Liveness reports only process status. Readiness verifies that PostgreSQL,
-Valkey and Neo4j are reachable and returns per-dependency detail when any
-of them is unreachable.
+Valkey and the attack-paths graph store (Neo4j or Neptune, per
+``ATTACK_PATHS_SINK_DATABASE``) are reachable and returns per-dependency
+detail when any of them is unreachable.
"""
from __future__ import annotations
@@ -11,6 +12,8 @@ from __future__ import annotations
import logging
import threading
import time
+from concurrent.futures import ThreadPoolExecutor
+from concurrent.futures import TimeoutError as FuturesTimeoutError
from contextlib import suppress
from datetime import UTC, datetime
from typing import Any
@@ -37,9 +40,28 @@ STATUS_FAIL = "fail"
STATUS_WARN = "warn"
# Short socket timeout so a stuck Valkey cannot stall the probe.
-# Neo4j inherits its driver-level ``connection_acquisition_timeout``.
VALKEY_PROBE_TIMEOUT_SECONDS = 2
+# Probe-scoped budget for the graph database.
+# ``Driver.verify_connectivity()`` takes no timeout; its only bound is the
+# driver-level ``connection_acquisition_timeout`` (60s on Neptune). The
+# probe needs its own budget, independent of the workload driver, so a
+# graph-database outage cannot pin a worker thread (and the readiness lock)
+# for a minute.
+GRAPH_DB_PROBE_TIMEOUT_SECONDS = 5
+
+# Bounded pool that enforces ``GRAPH_DB_PROBE_TIMEOUT_SECONDS``. If the
+# graph database is unreachable the probe call blocks until the driver's
+# own acquisition timeout fires; we abandon the future after the budget and
+# report ``fail``. Orphaned tasks are capped by ``max_workers`` plus the 3s
+# readiness cache plus the per-IP throttle, so they cannot pile up: worst
+# case during a graph-database outage is every readiness call failing fast
+# in ``GRAPH_DB_PROBE_TIMEOUT_SECONDS`` with at most 2 background threads
+# stuck for <= the driver acquisition timeout.
+_graph_db_probe_executor = ThreadPoolExecutor(
+ max_workers=2, thread_name_prefix="health-graph-db-probe"
+)
+
# Brief cache window so high-frequency probes (ALB target groups, scrapers)
# do not stampede the actual dependency checks.
CACHE_CONTROL_HEADER = "max-age=3, must-revalidate"
@@ -109,11 +131,24 @@ def _probe_valkey() -> None:
client.close()
-def _probe_neo4j() -> None:
- # Lazy import: avoids pulling attack_paths into the boot import graph.
- from api.attack_paths.database import get_driver
+def _graph_db_component_id() -> str:
+ """Return the active graph database name for the ``componentId`` field."""
+ return settings.ATTACK_PATHS_SINK_DATABASE.strip().lower()
- get_driver().verify_connectivity()
+
+def _probe_graph_db() -> None:
+ # Lazy import: avoids pulling attack_paths into the boot import graph
+ from api.attack_paths.database import verify_connectivity
+
+ future = _graph_db_probe_executor.submit(verify_connectivity)
+ try:
+ future.result(timeout=GRAPH_DB_PROBE_TIMEOUT_SECONDS)
+ except FuturesTimeoutError as exc:
+ # Do not wait for the abandoned task; it ends when the driver's own acquisition timeout fires
+ future.cancel()
+ raise TimeoutError(
+ f"graph-db probe exceeded {GRAPH_DB_PROBE_TIMEOUT_SECONDS}s"
+ ) from exc
def _build_check_entry(
@@ -176,14 +211,18 @@ def _readiness_payload() -> tuple[dict[str, Any], int]:
):
return snapshot[1], snapshot[2]
+ graph_db_component_id = _graph_db_component_id()
+
postgres_result, postgres_ms = _measure("postgres", _probe_postgres)
valkey_result, valkey_ms = _measure("valkey", _probe_valkey)
- neo4j_result, neo4j_ms = _measure("neo4j", _probe_neo4j)
+ graph_db_result, graph_db_ms = _measure(graph_db_component_id, _probe_graph_db)
entries = [
_build_check_entry("postgres", "datastore", postgres_result, postgres_ms),
_build_check_entry("valkey", "datastore", valkey_result, valkey_ms),
- _build_check_entry("neo4j", "datastore", neo4j_result, neo4j_ms),
+ _build_check_entry(
+ graph_db_component_id, "datastore", graph_db_result, graph_db_ms
+ ),
]
overall = _aggregate_status(entries)
@@ -191,7 +230,7 @@ def _readiness_payload() -> tuple[dict[str, Any], int]:
payload["checks"] = {
"postgres:responseTime": [entries[0]],
"valkey:responseTime": [entries[1]],
- "neo4j:responseTime": [entries[2]],
+ "graphdb:responseTime": [entries[2]],
}
http_status = (
@@ -233,10 +272,10 @@ class LivenessView(APIView):
class ReadinessView(APIView):
"""Readiness probe.
- Returns 200 when PostgreSQL, Valkey and Neo4j all respond, or 503 with
- per-dependency detail when any of them is unreachable. Per-IP throttle
- plus the short in-process result cache cap the real dependency hits
- regardless of inbound traffic shape.
+ Returns 200 when PostgreSQL, Valkey and the attack-paths graph store
+ all respond, or 503 with per-dependency detail when any of them is
+ unreachable. Per-IP throttle plus the short in-process result cache cap
+ the real dependency hits regardless of inbound traffic shape.
"""
authentication_classes: list = []
diff --git a/api/src/backend/api/migrations/0096_attack_paths_scan_is_migrated.py b/api/src/backend/api/migrations/0096_attack_paths_scan_is_migrated.py
new file mode 100644
index 0000000000..75b3e2cac7
--- /dev/null
+++ b/api/src/backend/api/migrations/0096_attack_paths_scan_is_migrated.py
@@ -0,0 +1,24 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+ dependencies = [
+ ("api", "0095_reconcile_orphan_tasks_periodic_task"),
+ ]
+
+ operations = [
+ migrations.AddField(
+ model_name="attackpathsscan",
+ name="is_migrated",
+ field=models.BooleanField(default=False),
+ ),
+ migrations.AddField(
+ model_name="attackpathsscan",
+ name="sink_backend",
+ field=models.CharField(
+ choices=[("neo4j", "Neo4j"), ("neptune", "Neptune")],
+ default="neo4j",
+ max_length=16,
+ ),
+ ),
+ ]
diff --git a/api/src/backend/api/migrations/0097_attack_paths_scan_db_defaults.py b/api/src/backend/api/migrations/0097_attack_paths_scan_db_defaults.py
new file mode 100644
index 0000000000..8bcb43d50c
--- /dev/null
+++ b/api/src/backend/api/migrations/0097_attack_paths_scan_db_defaults.py
@@ -0,0 +1,25 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+ dependencies = [
+ ("api", "0096_attack_paths_scan_is_migrated"),
+ ]
+
+ operations = [
+ migrations.AlterField(
+ model_name="attackpathsscan",
+ name="is_migrated",
+ field=models.BooleanField(db_default=False, default=False),
+ ),
+ migrations.AlterField(
+ model_name="attackpathsscan",
+ name="sink_backend",
+ field=models.CharField(
+ choices=[("neo4j", "Neo4j"), ("neptune", "Neptune")],
+ db_default="neo4j",
+ default="neo4j",
+ max_length=16,
+ ),
+ ),
+ ]
diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py
index 47f9803b95..a280708d53 100644
--- a/api/src/backend/api/models.py
+++ b/api/src/backend/api/models.py
@@ -757,6 +757,10 @@ class Scan(RowLevelSecurityProtectedModel):
class AttackPathsScan(RowLevelSecurityProtectedModel):
+ class SinkBackendChoices(models.TextChoices):
+ NEO4J = "neo4j", "Neo4j"
+ NEPTUNE = "neptune", "Neptune"
+
objects = ActiveProviderManager()
all_objects = models.Manager()
@@ -805,6 +809,19 @@ class AttackPathsScan(RowLevelSecurityProtectedModel):
)
ingestion_exceptions = models.JSONField(default=dict, null=True, blank=True)
+ # True when the scan was synced with the current schema (list-typed
+ # properties materialised as child item nodes). False for pre-cutover scans
+ # still using the previous graph shape. Query catalog selection uses this
+ # flag; physical read routing uses sink_backend below.
+ # TODO: drop after Neptune cutover
+ is_migrated = models.BooleanField(default=False, db_default=False)
+ sink_backend = models.CharField(
+ choices=SinkBackendChoices.choices,
+ db_default=SinkBackendChoices.NEO4J,
+ default=SinkBackendChoices.NEO4J,
+ max_length=16,
+ )
+
class Meta(RowLevelSecurityProtectedModel.Meta):
db_table = "attack_paths_scans"
diff --git a/api/src/backend/api/rbac/permissions.py b/api/src/backend/api/rbac/permissions.py
index ef0475fefb..3458346a5f 100644
--- a/api/src/backend/api/rbac/permissions.py
+++ b/api/src/backend/api/rbac/permissions.py
@@ -34,7 +34,7 @@ class HasPermissions(BasePermission):
if not tenant_id:
return False
- user_roles = (
+ user_roles = list(
User.objects.using(MainRouter.admin_db)
.get(id=request.user.id)
.roles.using(MainRouter.admin_db)
@@ -43,11 +43,10 @@ class HasPermissions(BasePermission):
if not user_roles:
return False
- for perm in required_permissions:
- if not getattr(user_roles[0], perm.value, False):
- return False
-
- return True
+ return all(
+ any(getattr(role, permission.value, False) for role in user_roles)
+ for permission in required_permissions
+ )
def get_role(user: User, tenant_id: str) -> Role:
diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml
index 767a3aaf78..420ebb27cf 100644
--- a/api/src/backend/api/specs/v1.yaml
+++ b/api/src/backend/api/specs/v1.yaml
@@ -1,7 +1,7 @@
openapi: 3.0.3
info:
title: Prowler API
- version: 1.33.0
+ version: 1.37.0
description: |-
Prowler API specification.
@@ -9,7 +9,7 @@ info:
paths:
/api/v1/api-keys:
get:
- operationId: api_keys_list
+ operationId: api_v1_api_keys_list
description: Retrieve a list of API keys for the tenant, with filtering support.
summary: List API keys
parameters:
@@ -141,7 +141,7 @@ paths:
$ref: '#/components/schemas/PaginatedTenantApiKeyList'
description: ''
post:
- operationId: api_keys_create
+ operationId: api_v1_api_keys_create
description: Create a new API key for the tenant.
summary: Create a new API key
tags:
@@ -169,7 +169,7 @@ paths:
description: ''
/api/v1/api-keys/{id}:
get:
- operationId: api_keys_retrieve
+ operationId: api_v1_api_keys_retrieve
description: Fetch detailed information about a specific API key by its ID.
summary: Retrieve API key details
parameters:
@@ -220,7 +220,7 @@ paths:
$ref: '#/components/schemas/TenantApiKeyResponse'
description: ''
patch:
- operationId: api_keys_partial_update
+ operationId: api_v1_api_keys_partial_update
description: Modify certain fields of an existing API key without affecting
other settings.
summary: Partially update an API key
@@ -257,7 +257,7 @@ paths:
description: ''
/api/v1/api-keys/{id}/revoke:
delete:
- operationId: api_keys_revoke_destroy
+ operationId: api_v1_api_keys_revoke_destroy
description: Revoke an API key by its ID. This action is irreversible and will
prevent the key from being used.
summary: Revoke an API key
@@ -282,7 +282,7 @@ paths:
description: API key was successfully revoked
/api/v1/attack-paths-scans:
get:
- operationId: attack_paths_scans_list
+ operationId: api_v1_attack_paths_scans_list
description: Retrieve Attack Paths scans for the tenant with support for filtering,
ordering, and pagination.
summary: List Attack Paths scans
@@ -352,11 +352,26 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -370,10 +385,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -397,7 +412,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -411,10 +426,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -575,7 +590,7 @@ paths:
description: ''
/api/v1/attack-paths-scans/{id}:
get:
- operationId: attack_paths_scans_retrieve
+ operationId: api_v1_attack_paths_scans_retrieve
description: Fetch full details for a specific Attack Paths scan.
summary: Retrieve Attack Paths scan details
parameters:
@@ -635,7 +650,7 @@ paths:
description: ''
/api/v1/attack-paths-scans/{id}/queries:
get:
- operationId: attack_paths_scans_queries_retrieve
+ operationId: api_v1_attack_paths_scans_queries_retrieve
description: Retrieve the catalog of Attack Paths queries available for this
Attack Paths scan.
summary: List Attack Paths queries
@@ -698,7 +713,7 @@ paths:
description: No queries found for the selected provider
/api/v1/attack-paths-scans/{id}/queries/custom:
post:
- operationId: attack_paths_scans_queries_custom_create
+ operationId: api_v1_attack_paths_scans_queries_custom_create
description: Execute a raw openCypher query against the Attack Paths graph.
Results are filtered to the scan's provider and truncated to a maximum node
count.
@@ -745,7 +760,7 @@ paths:
description: Query execution failed due to a database error
/api/v1/attack-paths-scans/{id}/queries/run:
post:
- operationId: attack_paths_scans_queries_run_create
+ operationId: api_v1_attack_paths_scans_queries_run_create
description: Execute the selected Attack Paths query against the Attack Paths
graph and return the resulting subgraph.
summary: Execute an Attack Paths query
@@ -792,7 +807,7 @@ paths:
description: Attack Paths query execution failed due to a database error
/api/v1/attack-paths-scans/{id}/schema:
get:
- operationId: attack_paths_scans_schema_retrieve
+ operationId: api_v1_attack_paths_scans_schema_retrieve
description: Return the cartography provider, version, and links to the schema
documentation for the cloud provider associated with this Attack Paths scan.
summary: Retrieve cartography schema metadata
@@ -839,9 +854,11 @@ paths:
description: Unable to retrieve cartography schema due to a database error
/api/v1/compliance-overviews:
get:
- operationId: compliance_overviews_list
- description: Retrieve an overview of all the compliance in a given scan.
- summary: List compliance overviews for a scan
+ operationId: api_v1_compliance_overviews_list
+ description: Retrieve compliance overview data for a scan. When provider filters
+ are provided, the endpoint uses the latest completed scan for each matching
+ provider.
+ summary: List compliance overviews
parameters:
- in: query
name: fields[compliance-overviews]
@@ -900,6 +917,120 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_id]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_id__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_type]
+ schema:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ - in: query
+ name: filter[provider_type__in]
+ schema:
+ type: array
+ items:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ Multiple values may be separated by commas.
+
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ explode: false
+ style: form
- in: query
name: filter[region]
schema:
@@ -922,8 +1053,7 @@ paths:
schema:
type: string
format: uuid
- description: Related scan ID.
- required: true
+ description: Related scan ID. Required unless a provider filter is provided.
- name: filter[search]
required: false
in: query
@@ -998,7 +1128,7 @@ paths:
description: Compliance overviews generation task failed
/api/v1/compliance-overviews/attributes:
get:
- operationId: compliance_overviews_attributes_retrieve
+ operationId: api_v1_compliance_overviews_attributes_retrieve
description: Retrieve detailed attribute information for all requirements in
a specific compliance framework along with the associated check IDs for each
requirement.
@@ -1028,6 +1158,14 @@ paths:
type: string
description: Compliance framework ID to get attributes for.
required: true
+ - in: query
+ name: filter[scan_id]
+ schema:
+ type: string
+ format: uuid
+ description: Scan ID used to resolve the provider for multi-provider universal
+ frameworks (e.g. CSA CCM), so the returned check IDs match the scan's provider.
+ When omitted, the first provider that declares the framework is used.
tags:
- Compliance Overview
security:
@@ -1041,9 +1179,10 @@ paths:
description: Compliance attributes obtained successfully
/api/v1/compliance-overviews/metadata:
get:
- operationId: compliance_overviews_metadata_retrieve
- description: Fetch unique metadata values from a set of compliance overviews.
- This is useful for dynamic filtering.
+ operationId: api_v1_compliance_overviews_metadata_retrieve
+ description: Fetch unique metadata values from compliance overviews. This is
+ useful for dynamic filtering. When provider filters are provided, metadata
+ is computed from the latest completed scan for each matching provider.
summary: Retrieve metadata values from compliance overviews
parameters:
- in: query
@@ -1057,13 +1196,209 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[compliance_id]
+ schema:
+ type: string
+ - in: query
+ name: filter[compliance_id__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[framework]
+ schema:
+ type: string
+ - in: query
+ name: filter[framework__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[framework__iexact]
+ schema:
+ type: string
+ - in: query
+ name: filter[inserted_at]
+ schema:
+ type: string
+ format: date
+ - in: query
+ name: filter[inserted_at__date]
+ schema:
+ type: string
+ format: date
+ - in: query
+ name: filter[inserted_at__gte]
+ schema:
+ type: string
+ format: date-time
+ - in: query
+ name: filter[inserted_at__lte]
+ schema:
+ type: string
+ format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_id]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_id__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_type]
+ schema:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ - in: query
+ name: filter[provider_type__in]
+ schema:
+ type: array
+ items:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ Multiple values may be separated by commas.
+
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ explode: false
+ style: form
+ - in: query
+ name: filter[region]
+ schema:
+ type: string
+ - in: query
+ name: filter[region__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[region__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[scan_id]
schema:
type: string
format: uuid
- description: Related scan ID.
- required: true
+ description: Related scan ID. Required unless a provider filter is provided.
+ - name: filter[search]
+ required: false
+ in: query
+ description: A search term.
+ schema:
+ type: string
+ - in: query
+ name: filter[version]
+ schema:
+ type: string
+ - in: query
+ name: filter[version__icontains]
+ schema:
+ type: string
+ - name: sort
+ required: false
+ in: query
+ description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)'
+ schema:
+ type: array
+ items:
+ type: string
+ enum:
+ - compliance_id
+ - -compliance_id
+ explode: false
tags:
- Compliance Overview
security:
@@ -1100,11 +1435,12 @@ paths:
description: Compliance overviews generation task failed
/api/v1/compliance-overviews/requirements:
get:
- operationId: compliance_overviews_requirements_retrieve
- description: Retrieve a detailed overview of compliance requirements in a given
- scan, grouped by compliance framework. This endpoint provides requirement-level
- details and aggregates status across regions.
- summary: List compliance requirements overview for a scan
+ operationId: api_v1_compliance_overviews_requirements_retrieve
+ description: Retrieve a detailed overview of compliance requirements, grouped
+ by compliance framework. This endpoint provides requirement-level details
+ and aggregates status across regions. When provider filters are provided,
+ the endpoint uses the latest completed scan for each matching provider.
+ summary: List compliance requirements overview
parameters:
- in: query
name: fields[compliance-requirements-details]
@@ -1163,6 +1499,120 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_id]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_id__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_type]
+ schema:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ - in: query
+ name: filter[provider_type__in]
+ schema:
+ type: array
+ items:
+ type: string
+ x-spec-enum-id: 203afc16daac9b64
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ Multiple values may be separated by commas.
+
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ explode: false
+ style: form
- in: query
name: filter[region]
schema:
@@ -1185,8 +1635,7 @@ paths:
schema:
type: string
format: uuid
- description: Related scan ID.
- required: true
+ description: Related scan ID. Required unless a provider filter is provided.
- name: filter[search]
required: false
in: query
@@ -1249,7 +1698,7 @@ paths:
description: Compliance overviews generation task failed
/api/v1/finding-groups:
get:
- operationId: finding_groups_list
+ operationId: api_v1_finding_groups_list
description: "\n Retrieve aggregated findings grouped by check_id.\n\n\
\ Each group shows:\n - Aggregated status (FAIL if any non-muted\
\ failure)\n - Maximum severity across all findings\n - Resource\
@@ -1422,6 +1871,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -1454,10 +1918,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -1494,10 +1958,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -1799,7 +2263,7 @@ paths:
description: ''
/api/v1/finding-groups/{id}/resources:
get:
- operationId: finding_groups_resources_retrieve
+ operationId: api_v1_finding_groups_resources_retrieve
description: "\n Retrieve resources affected by a specific check (finding\
\ group).\n\n Returns individual resources with their current status,\
\ severity,\n and timing information including how long they have been\
@@ -1970,6 +2434,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -2002,10 +2481,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -2042,10 +2521,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -2342,12 +2821,12 @@ paths:
description: ''
/api/v1/finding-groups/latest:
get:
- operationId: finding_groups_latest_retrieve
+ operationId: api_v1_finding_groups_latest_retrieve
description: "\n Retrieve the latest available state for each finding\
\ group (check_id).\n\n This endpoint returns finding groups without\
\ requiring date filters,\n automatically using the latest available\
- \ data per check_id.\n All other filters (provider_id, provider_type,\
- \ check_id) are still supported.\n "
+ \ data per check_id.\n Provider, provider group, check, and computed\
+ \ filters are still supported.\n "
summary: List latest finding groups
parameters:
- in: query
@@ -2394,6 +2873,471 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[category]
+ schema:
+ type: string
+ - in: query
+ name: filter[category__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[check_id]
+ schema:
+ type: string
+ - in: query
+ name: filter[check_id__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[check_id__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[check_title__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[delta]
+ schema:
+ type: string
+ enum:
+ - changed
+ - new
+ description: |-
+ * `new` - New
+ * `changed` - Changed
+ - in: query
+ name: filter[impact]
+ schema:
+ type: string
+ enum:
+ - critical
+ - high
+ - informational
+ - low
+ - medium
+ description: |-
+ * `critical` - Critical
+ * `high` - High
+ * `medium` - Medium
+ * `low` - Low
+ * `informational` - Informational
+ - in: query
+ name: filter[muted]
+ schema:
+ type: boolean
+ description: If this filter is not provided, muted and non-muted findings
+ will be returned.
+ - in: query
+ name: filter[provider]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_alias]
+ schema:
+ type: string
+ - in: query
+ name: filter[provider_alias__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[provider_alias__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_id]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_id__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_type]
+ schema:
+ type: string
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ - in: query
+ name: filter[provider_type__in]
+ schema:
+ type: array
+ items:
+ type: string
+ enum:
+ - alibabacloud
+ - aws
+ - azure
+ - cloudflare
+ - gcp
+ - github
+ - googleworkspace
+ - iac
+ - image
+ - kubernetes
+ - m365
+ - mongodbatlas
+ - okta
+ - openstack
+ - oraclecloud
+ - vercel
+ description: |-
+ Multiple values may be separated by commas.
+
+ * `aws` - AWS
+ * `azure` - Azure
+ * `gcp` - GCP
+ * `kubernetes` - Kubernetes
+ * `m365` - M365
+ * `github` - GitHub
+ * `mongodbatlas` - MongoDB Atlas
+ * `iac` - IaC
+ * `oraclecloud` - Oracle Cloud Infrastructure
+ * `alibabacloud` - Alibaba Cloud
+ * `cloudflare` - Cloudflare
+ * `openstack` - OpenStack
+ * `image` - Image
+ * `googleworkspace` - Google Workspace
+ * `vercel` - Vercel
+ * `okta` - Okta
+ explode: false
+ style: form
+ - in: query
+ name: filter[provider_uid]
+ schema:
+ type: string
+ - in: query
+ name: filter[provider_uid__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[provider_uid__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[region]
+ schema:
+ type: string
+ - in: query
+ name: filter[region__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[region__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[resource_groups]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[resource_name]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_name__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_name__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[resource_type]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_type__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_type__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[resource_uid]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_uid__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[resource_uid__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[resources]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[scan]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[scan__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[service]
+ schema:
+ type: string
+ - in: query
+ name: filter[service__icontains]
+ schema:
+ type: string
+ - in: query
+ name: filter[service__in]
+ schema:
+ type: array
+ items:
+ type: string
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
+ - in: query
+ name: filter[severity]
+ schema:
+ type: string
+ enum:
+ - critical
+ - high
+ - informational
+ - low
+ - medium
+ description: |-
+ * `critical` - Critical
+ * `high` - High
+ * `medium` - Medium
+ * `low` - Low
+ * `informational` - Informational
+ - in: query
+ name: filter[status]
+ schema:
+ type: string
+ enum:
+ - FAIL
+ - MANUAL
+ - PASS
+ description: |-
+ * `FAIL` - Fail
+ * `PASS` - Pass
+ * `MANUAL` - Manual
+ - in: query
+ name: filter[uid]
+ schema:
+ type: string
+ - in: query
+ name: filter[updated_at]
+ schema:
+ type: string
+ format: date
+ - name: sort
+ required: false
+ in: query
+ description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)'
+ schema:
+ type: array
+ items:
+ type: string
+ enum:
+ - id
+ - -id
+ - check_id
+ - -check_id
+ - check_title
+ - -check_title
+ - check_description
+ - -check_description
+ - severity
+ - -severity
+ - status
+ - -status
+ - muted
+ - -muted
+ - impacted_providers
+ - -impacted_providers
+ - resources_fail
+ - -resources_fail
+ - resources_total
+ - -resources_total
+ - pass_count
+ - -pass_count
+ - fail_count
+ - -fail_count
+ - manual_count
+ - -manual_count
+ - pass_muted_count
+ - -pass_muted_count
+ - fail_muted_count
+ - -fail_muted_count
+ - manual_muted_count
+ - -manual_muted_count
+ - muted_count
+ - -muted_count
+ - new_count
+ - -new_count
+ - changed_count
+ - -changed_count
+ - new_fail_count
+ - -new_fail_count
+ - new_fail_muted_count
+ - -new_fail_muted_count
+ - new_pass_count
+ - -new_pass_count
+ - new_pass_muted_count
+ - -new_pass_muted_count
+ - new_manual_count
+ - -new_manual_count
+ - new_manual_muted_count
+ - -new_manual_muted_count
+ - changed_fail_count
+ - -changed_fail_count
+ - changed_fail_muted_count
+ - -changed_fail_muted_count
+ - changed_pass_count
+ - -changed_pass_count
+ - changed_pass_muted_count
+ - -changed_pass_muted_count
+ - changed_manual_count
+ - -changed_manual_count
+ - changed_manual_muted_count
+ - -changed_manual_muted_count
+ - first_seen_at
+ - -first_seen_at
+ - last_seen_at
+ - -last_seen_at
+ - failing_since
+ - -failing_since
+ explode: false
tags:
- Finding Groups
security:
@@ -2407,7 +3351,7 @@ paths:
description: ''
/api/v1/finding-groups/latest/{check_id}/resources:
get:
- operationId: finding_groups_latest_resources_retrieve
+ operationId: api_v1_finding_groups_latest_resources_retrieve
description: "\n Retrieve resources affected by a specific check (finding\
\ group) from the\n latest completed scan for each provider.\n\n \
\ Returns individual resources with their current status, severity,\n\
@@ -2561,6 +3505,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -2593,10 +3552,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -2633,10 +3592,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -2926,7 +3885,7 @@ paths:
description: ''
/api/v1/findings:
get:
- operationId: findings_list
+ operationId: api_v1_findings_list
description: Retrieve a list of all findings with options for filtering by various
criteria.
summary: List all findings
@@ -3068,13 +4027,11 @@ paths:
name: filter[inserted_at__gte]
schema:
type: string
- format: date
description: Maximum date range is 7 days.
- in: query
name: filter[inserted_at__lte]
schema:
type: string
- format: date
description: Maximum date range is 7 days.
- in: query
name: filter[muted]
@@ -3114,6 +4071,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -3133,7 +4105,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -3147,10 +4119,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -3174,7 +4146,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -3188,10 +4160,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -3422,6 +4394,10 @@ paths:
style: form
- in: query
name: filter[updated_at]
+ schema:
+ type: string
+ - in: query
+ name: filter[updated_at__date]
schema:
type: string
format: date
@@ -3429,12 +4405,12 @@ paths:
name: filter[updated_at__gte]
schema:
type: string
- format: date-time
+ description: Maximum date range is 7 days.
- in: query
name: filter[updated_at__lte]
schema:
type: string
- format: date-time
+ description: Maximum date range is 7 days.
- in: query
name: include
schema:
@@ -3492,7 +4468,7 @@ paths:
description: ''
/api/v1/findings/{id}:
get:
- operationId: findings_retrieve
+ operationId: api_v1_findings_retrieve
description: Fetch detailed information about a specific finding by its ID.
summary: Retrieve data from a specific finding
parameters:
@@ -3556,7 +4532,7 @@ paths:
description: ''
/api/v1/findings/findings_services_regions:
get:
- operationId: findings_findings_services_regions_retrieve
+ operationId: api_v1_findings_findings_services_regions_retrieve
description: Fetch services and regions affected in findings.
summary: Retrieve the services and regions that are impacted by findings
parameters:
@@ -3668,7 +4644,6 @@ paths:
name: filter[inserted_at]
schema:
type: string
- format: date
- in: query
name: filter[inserted_at__date]
schema:
@@ -3678,13 +4653,11 @@ paths:
name: filter[inserted_at__gte]
schema:
type: string
- format: date
description: Maximum date range is 7 days.
- in: query
name: filter[inserted_at__lte]
schema:
type: string
- format: date
description: Maximum date range is 7 days.
- in: query
name: filter[muted]
@@ -3724,6 +4697,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -3743,7 +4731,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -3757,10 +4745,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -3784,7 +4772,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -3798,10 +4786,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -4032,6 +5020,10 @@ paths:
style: form
- in: query
name: filter[updated_at]
+ schema:
+ type: string
+ - in: query
+ name: filter[updated_at__date]
schema:
type: string
format: date
@@ -4039,12 +5031,12 @@ paths:
name: filter[updated_at__gte]
schema:
type: string
- format: date-time
+ description: Maximum date range is 7 days.
- in: query
name: filter[updated_at__lte]
schema:
type: string
- format: date-time
+ description: Maximum date range is 7 days.
- name: sort
required: false
in: query
@@ -4079,7 +5071,7 @@ paths:
description: ''
/api/v1/findings/latest:
get:
- operationId: findings_latest_retrieve
+ operationId: api_v1_findings_latest_retrieve
description: Retrieve a list of the latest findings from the latest scans for
each provider with options for filtering by various criteria.
summary: List the latest findings
@@ -4242,6 +5234,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -4261,7 +5268,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -4275,10 +5282,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -4302,7 +5309,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -4316,10 +5323,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -4583,7 +5590,7 @@ paths:
description: ''
/api/v1/findings/metadata:
get:
- operationId: findings_metadata_retrieve
+ operationId: api_v1_findings_metadata_retrieve
description: Fetch unique metadata values from a set of findings. This is useful
for dynamic filtering.
summary: Retrieve metadata values from findings
@@ -4758,6 +5765,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -4777,7 +5799,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -4791,10 +5813,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -4818,7 +5840,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -4832,10 +5854,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -5112,7 +6134,7 @@ paths:
description: ''
/api/v1/findings/metadata/latest:
get:
- operationId: findings_metadata_latest_retrieve
+ operationId: api_v1_findings_metadata_latest_retrieve
description: Fetch unique metadata values from a set of findings from the latest
scans for each provider. This is useful for dynamic filtering.
summary: Retrieve metadata values from the latest findings
@@ -5262,6 +6284,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -5281,7 +6318,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -5295,10 +6332,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -5322,7 +6359,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -5336,10 +6373,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -5591,7 +6628,7 @@ paths:
description: ''
/api/v1/integrations:
get:
- operationId: integrations_list
+ operationId: api_v1_integrations_list
description: Retrieve a list of all configured integrations with options for
filtering by various criteria.
summary: List all integrations
@@ -5742,7 +6779,7 @@ paths:
$ref: '#/components/schemas/PaginatedIntegrationList'
description: ''
post:
- operationId: integrations_create
+ operationId: api_v1_integrations_create
description: Register a new integration with the system, providing necessary
configuration details.
summary: Create a new integration
@@ -5771,7 +6808,7 @@ paths:
description: ''
/api/v1/integrations/{integration_pk}/jira/dispatches:
post:
- operationId: integrations_jira_dispatches_create
+ operationId: api_v1_integrations_jira_dispatches_create
description: |-
Send a set of filtered findings to the given integration. At least one finding filter must be provided.
@@ -5844,7 +6881,7 @@ paths:
description: ''
/api/v1/integrations/{integration_pk}/jira/issue_types:
get:
- operationId: integrations_jira_issue_types_retrieve
+ operationId: api_v1_integrations_jira_issue_types_retrieve
description: Fetch the available issue types from Jira for a given project key
and update the integration configuration.
summary: Get available issue types for a Jira project
@@ -5885,7 +6922,7 @@ paths:
description: ''
/api/v1/integrations/{id}:
get:
- operationId: integrations_retrieve
+ operationId: api_v1_integrations_retrieve
description: Fetch detailed information about a specific integration by its
ID.
summary: Retrieve integration details
@@ -5939,7 +6976,7 @@ paths:
$ref: '#/components/schemas/IntegrationResponse'
description: ''
patch:
- operationId: integrations_partial_update
+ operationId: api_v1_integrations_partial_update
description: Modify certain fields of an existing integration without affecting
other settings.
summary: Partially update an integration
@@ -5975,7 +7012,7 @@ paths:
$ref: '#/components/schemas/IntegrationUpdateResponse'
description: ''
delete:
- operationId: integrations_destroy
+ operationId: api_v1_integrations_destroy
description: Remove an integration from the system by its ID.
summary: Delete an integration
parameters:
@@ -5995,7 +7032,7 @@ paths:
description: No response body
/api/v1/integrations/{id}/connection:
post:
- operationId: integrations_connection_create
+ operationId: api_v1_integrations_connection_create
description: Try to verify integration connection
summary: Check integration connection
parameters:
@@ -6034,7 +7071,7 @@ paths:
description: ''
/api/v1/invitations/accept:
post:
- operationId: invitations_accept_create
+ operationId: api_v1_invitations_accept_create
description: Accept an invitation to an existing tenant. This invitation cannot
be expired and the emails must match.
summary: Accept an invitation
@@ -6063,7 +7100,7 @@ paths:
description: ''
/api/v1/lighthouse-configurations:
get:
- operationId: lighthouse_configurations_list
+ operationId: api_v1_lighthouse_configurations_list
description: Retrieve a list of all Lighthouse AI configurations.
summary: List all Lighthouse AI configurations
parameters:
@@ -6136,7 +7173,7 @@ paths:
$ref: '#/components/schemas/PaginatedLighthouseConfigList'
description: ''
post:
- operationId: lighthouse_configurations_create
+ operationId: api_v1_lighthouse_configurations_create
description: Create a new Lighthouse AI configuration with the specified details.
summary: Create a new Lighthouse AI configuration
tags:
@@ -6165,7 +7202,7 @@ paths:
description: ''
/api/v1/lighthouse-configurations/{id}:
patch:
- operationId: lighthouse_configurations_partial_update
+ operationId: api_v1_lighthouse_configurations_partial_update
description: Update certain fields of an existing Lighthouse AI configuration.
summary: Partially update a Lighthouse AI configuration
parameters:
@@ -6199,7 +7236,7 @@ paths:
$ref: '#/components/schemas/LighthouseConfigUpdateResponse'
description: ''
delete:
- operationId: lighthouse_configurations_destroy
+ operationId: api_v1_lighthouse_configurations_destroy
description: Remove a Lighthouse AI configuration by its ID.
summary: Delete a Lighthouse AI configuration
parameters:
@@ -6218,7 +7255,7 @@ paths:
description: No response body
/api/v1/lighthouse-configurations/{id}/connection:
post:
- operationId: lighthouse_configurations_connection_create
+ operationId: api_v1_lighthouse_configurations_connection_create
description: Verify the connection to the OpenAI API for a specific Lighthouse
AI configuration.
summary: Check the connection to the OpenAI API
@@ -6257,7 +7294,7 @@ paths:
description: ''
/api/v1/lighthouse/configuration:
get:
- operationId: lighthouse_configuration_list
+ operationId: api_v1_lighthouse_configuration_list
description: Retrieve current tenant-level Lighthouse AI settings. Returns a
single configuration object.
summary: Get Lighthouse AI Tenant config
@@ -6332,7 +7369,7 @@ paths:
$ref: '#/components/schemas/PaginatedLighthouseTenantConfigList'
description: ''
patch:
- operationId: lighthouse_configuration_partial_update
+ operationId: api_v1_lighthouse_configuration_partial_update
description: Update tenant-level settings. Validates that the default provider
is configured and active and that default model IDs exist for the chosen providers.
Auto-creates configuration if it doesn't exist.
@@ -6362,7 +7399,7 @@ paths:
description: ''
/api/v1/lighthouse/models:
get:
- operationId: lighthouse_models_list
+ operationId: api_v1_lighthouse_models_list
description: List available LLM models per configured provider for the current
tenant.
summary: List all LLM models
@@ -6492,7 +7529,7 @@ paths:
description: ''
/api/v1/lighthouse/models/{id}:
get:
- operationId: lighthouse_models_retrieve
+ operationId: api_v1_lighthouse_models_retrieve
description: Get details for a specific LLM model.
summary: Retrieve LLM model details
parameters:
@@ -6533,7 +7570,7 @@ paths:
description: ''
/api/v1/lighthouse/providers:
get:
- operationId: lighthouse_providers_list
+ operationId: api_v1_lighthouse_providers_list
description: Retrieve all LLM provider configurations for the current tenant
summary: List all LLM provider configurations
parameters:
@@ -6648,7 +7685,7 @@ paths:
$ref: '#/components/schemas/PaginatedLighthouseProviderConfigList'
description: ''
post:
- operationId: lighthouse_providers_create
+ operationId: api_v1_lighthouse_providers_create
description: Create a per-tenant configuration for an LLM provider. Only one
configuration per provider type is allowed per tenant.
summary: Create LLM provider configuration
@@ -6677,7 +7714,7 @@ paths:
description: ''
/api/v1/lighthouse/providers/{id}:
get:
- operationId: lighthouse_providers_retrieve
+ operationId: api_v1_lighthouse_providers_retrieve
description: Get details for a specific provider configuration in the current
tenant.
summary: Retrieve LLM provider configuration
@@ -6718,7 +7755,7 @@ paths:
$ref: '#/components/schemas/LighthouseProviderConfigResponse'
description: ''
patch:
- operationId: lighthouse_providers_partial_update
+ operationId: api_v1_lighthouse_providers_partial_update
description: Partially update a provider configuration (e.g., base_url, is_active).
summary: Update LLM provider configuration
parameters:
@@ -6753,7 +7790,7 @@ paths:
$ref: '#/components/schemas/LighthouseProviderConfigUpdateResponse'
description: ''
delete:
- operationId: lighthouse_providers_destroy
+ operationId: api_v1_lighthouse_providers_destroy
description: Delete a provider configuration. Any tenant defaults that reference
this provider are cleared during deletion.
summary: Delete LLM provider configuration
@@ -6774,7 +7811,7 @@ paths:
description: No response body
/api/v1/lighthouse/providers/{id}/connection:
post:
- operationId: lighthouse_providers_connection_create
+ operationId: api_v1_lighthouse_providers_connection_create
description: Validate provider credentials asynchronously and toggle is_active.
summary: Check LLM provider connection
parameters:
@@ -6813,7 +7850,7 @@ paths:
description: ''
/api/v1/lighthouse/providers/{id}/refresh-models:
post:
- operationId: lighthouse_providers_refresh_models_create
+ operationId: api_v1_lighthouse_providers_refresh_models_create
description: Fetch available models for this provider configuration and upsert
into catalog. Supports OpenAI, OpenAI-compatible, and AWS Bedrock providers.
summary: Refresh LLM models catalog
@@ -6853,7 +7890,7 @@ paths:
description: ''
/api/v1/mute-rules:
get:
- operationId: mute_rules_list
+ operationId: api_v1_mute_rules_list
description: Retrieve a list of all mute rules with filtering options.
summary: List all mute rules
parameters:
@@ -6999,7 +8036,7 @@ paths:
$ref: '#/components/schemas/PaginatedMuteRuleList'
description: ''
post:
- operationId: mute_rules_create
+ operationId: api_v1_mute_rules_create
description: Create a new mute rule by providing finding IDs, name, and reason.
The rule will immediately mute the selected findings and launch a background
task to mute all historical findings with matching UIDs.
@@ -7029,7 +8066,7 @@ paths:
description: ''
/api/v1/mute-rules/{id}:
get:
- operationId: mute_rules_retrieve
+ operationId: api_v1_mute_rules_retrieve
description: Fetch detailed information about a specific mute rule by ID.
summary: Retrieve a mute rule
parameters:
@@ -7080,7 +8117,7 @@ paths:
$ref: '#/components/schemas/MuteRuleResponse'
description: ''
patch:
- operationId: mute_rules_partial_update
+ operationId: api_v1_mute_rules_partial_update
description: Update certain fields of an existing mute rule (e.g., name, reason,
enabled).
summary: Partially update a mute rule
@@ -7116,7 +8153,7 @@ paths:
$ref: '#/components/schemas/SerializerMetaclassResponse'
description: ''
delete:
- operationId: mute_rules_destroy
+ operationId: api_v1_mute_rules_destroy
description: 'Remove a mute rule from the system. Note: Previously muted findings
remain muted.'
summary: Delete a mute rule
@@ -7137,7 +8174,7 @@ paths:
description: No response body
/api/v1/overviews/attack-surfaces:
get:
- operationId: overviews_attack_surfaces_list
+ operationId: api_v1_overviews_attack_surfaces_list
description: Retrieve aggregated attack surface metrics from latest completed
scans per provider.
summary: Get attack surface overview
@@ -7156,6 +8193,21 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -7175,7 +8227,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7189,10 +8241,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7216,7 +8268,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7230,10 +8282,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -7304,7 +8356,7 @@ paths:
description: ''
/api/v1/overviews/categories:
get:
- operationId: overviews_categories_list
+ operationId: api_v1_overviews_categories_list
description: 'Retrieve aggregated category metrics from latest completed scans
per provider. Returns one row per category with total, failed, and new failed
findings counts, plus a severity breakdown showing failed findings per severity
@@ -7339,6 +8391,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -7358,7 +8425,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7372,10 +8439,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7399,7 +8466,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7413,10 +8480,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -7489,7 +8556,7 @@ paths:
description: ''
/api/v1/overviews/compliance-watchlist:
get:
- operationId: overviews_compliance_watchlist_list
+ operationId: api_v1_overviews_compliance_watchlist_list
description: 'Retrieve compliance metrics with FAIL-dominant aggregation. Without
filters: uses pre-aggregated TenantComplianceSummary. With provider filters:
queries ProviderComplianceScore with FAIL-dominant logic where any FAIL in
@@ -7512,6 +8579,21 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -7544,10 +8626,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7584,10 +8666,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -7662,7 +8744,7 @@ paths:
description: ''
/api/v1/overviews/findings:
get:
- operationId: overviews_findings_retrieve
+ operationId: api_v1_overviews_findings_retrieve
description: Fetch aggregated findings data across all providers, grouped by
various metrics such as passed, failed, muted, and total findings. This endpoint
calculates summary statistics based on the latest scans for each provider
@@ -7714,6 +8796,21 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -7733,7 +8830,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7747,10 +8844,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7774,7 +8871,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7788,10 +8885,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -7887,7 +8984,7 @@ paths:
description: ''
/api/v1/overviews/findings_severity:
get:
- operationId: overviews_findings_severity_retrieve
+ operationId: api_v1_overviews_findings_severity_retrieve
description: Retrieve an aggregated summary of findings grouped by severity
levels, such as low, medium, high, and critical. The response includes the
total count of findings for each severity, considering only the latest scans
@@ -7931,6 +9028,21 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -7950,7 +9062,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -7964,10 +9076,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -7991,7 +9103,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8005,10 +9117,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -8107,7 +9219,7 @@ paths:
description: ''
/api/v1/overviews/findings_severity/timeseries:
get:
- operationId: overviews_findings_severity_timeseries_retrieve
+ operationId: api_v1_overviews_findings_severity_timeseries_retrieve
description: Retrieve daily aggregated findings data grouped by severity levels
over a date range. Returns one data point per day with counts of failed findings
by severity (critical, high, medium, low, informational) and muted findings.
@@ -8143,6 +9255,21 @@ paths:
schema:
type: string
format: date
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -8175,10 +9302,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -8215,10 +9342,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -8285,7 +9412,7 @@ paths:
description: ''
/api/v1/overviews/providers:
get:
- operationId: overviews_providers_retrieve
+ operationId: api_v1_overviews_providers_retrieve
description: Retrieve an aggregated overview of findings and resources grouped
by providers. The response includes the count of passed, failed, and manual
findings, along with the total number of resources managed by each provider.
@@ -8319,7 +9446,7 @@ paths:
description: ''
/api/v1/overviews/providers/count:
get:
- operationId: overviews_providers_count_retrieve
+ operationId: api_v1_overviews_providers_count_retrieve
description: Retrieve the number of providers grouped by provider type. This
endpoint counts every provider in the tenant, including those without completed
scans.
@@ -8350,7 +9477,7 @@ paths:
description: ''
/api/v1/overviews/regions:
get:
- operationId: overviews_regions_retrieve
+ operationId: api_v1_overviews_regions_retrieve
description: Retrieve an aggregated summary of findings grouped by region. The
response includes the total, passed, failed, and muted findings for each region
based on the latest completed scans per provider. Standard overview filters
@@ -8394,6 +9521,21 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -8413,7 +9555,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8427,10 +9569,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -8454,7 +9596,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8468,10 +9610,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -8553,7 +9695,7 @@ paths:
description: ''
/api/v1/overviews/resource-groups:
get:
- operationId: overviews_resource_groups_list
+ operationId: api_v1_overviews_resource_groups_list
description: Retrieve aggregated resource group metrics from latest completed
scans per provider. Returns one row per resource group with total, failed,
and new failed findings counts, plus a severity breakdown showing failed findings
@@ -8576,6 +9718,21 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -8595,7 +9752,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8609,10 +9766,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -8636,7 +9793,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8650,10 +9807,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -8741,7 +9898,7 @@ paths:
description: ''
/api/v1/overviews/services:
get:
- operationId: overviews_services_retrieve
+ operationId: api_v1_overviews_services_retrieve
description: Retrieve an aggregated summary of findings grouped by service.
The response includes the total count of findings for each service, as long
as there are at least one finding for that service.
@@ -8782,6 +9939,21 @@ paths:
schema:
type: string
format: date-time
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -8801,7 +9973,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8815,10 +9987,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -8842,7 +10014,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -8856,10 +10028,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -8937,7 +10109,7 @@ paths:
description: ''
/api/v1/overviews/threatscore:
get:
- operationId: overviews_threatscore_retrieve
+ operationId: api_v1_overviews_threatscore_retrieve
description: Retrieve ThreatScore metrics. By default, returns the latest snapshot
for each provider. Use snapshot_id to retrieve a specific historical snapshot.
summary: Get ThreatScore snapshots
@@ -8968,6 +10140,38 @@ paths:
description: endpoint return only specific fields in the response on a per-type
basis by including a fields[TYPE] query parameter.
explode: false
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ description: Filter by provider group ID
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: string
+ description: Filter by multiple provider group IDs (comma-separated UUIDs)
+ - in: query
+ name: filter[provider_id]
+ schema:
+ type: string
+ format: uuid
+ description: Filter by specific provider ID
+ - in: query
+ name: filter[provider_id__in]
+ schema:
+ type: string
+ description: Filter by multiple provider IDs (comma-separated UUIDs)
+ - in: query
+ name: filter[provider_type]
+ schema:
+ type: string
+ description: Filter by provider type (aws, azure, gcp, etc.)
+ - in: query
+ name: filter[provider_type__in]
+ schema:
+ type: string
+ description: Filter by multiple provider types (comma-separated)
- in: query
name: include
schema:
@@ -8980,27 +10184,6 @@ paths:
description: include query parameter to allow the client to customize which
related resources should be returned.
explode: false
- - in: query
- name: provider_id
- schema:
- type: string
- format: uuid
- description: Filter by specific provider ID
- - in: query
- name: provider_id__in
- schema:
- type: string
- description: Filter by multiple provider IDs (comma-separated UUIDs)
- - in: query
- name: provider_type
- schema:
- type: string
- description: Filter by provider type (aws, azure, gcp, etc.)
- - in: query
- name: provider_type__in
- schema:
- type: string
- description: Filter by multiple provider types (comma-separated)
- in: query
name: snapshot_id
schema:
@@ -9021,7 +10204,7 @@ paths:
description: ''
/api/v1/processors:
get:
- operationId: processors_list
+ operationId: api_v1_processors_list
description: Retrieve a list of all configured processors with options for filtering
by various criteria.
summary: List all processors
@@ -9116,7 +10299,7 @@ paths:
$ref: '#/components/schemas/PaginatedProcessorList'
description: ''
post:
- operationId: processors_create
+ operationId: api_v1_processors_create
description: Register a new processor with the system, providing necessary configuration
details. There can only be one processor of each type per tenant.
summary: Create a new processor
@@ -9145,7 +10328,7 @@ paths:
description: ''
/api/v1/processors/{id}:
get:
- operationId: processors_retrieve
+ operationId: api_v1_processors_retrieve
description: Fetch detailed information about a specific processor by its ID.
summary: Retrieve processor details
parameters:
@@ -9183,7 +10366,7 @@ paths:
$ref: '#/components/schemas/ProcessorResponse'
description: ''
patch:
- operationId: processors_partial_update
+ operationId: api_v1_processors_partial_update
description: Modify certain fields of an existing processor without affecting
other settings.
summary: Partially update a processor
@@ -9219,7 +10402,7 @@ paths:
$ref: '#/components/schemas/ProcessorUpdateResponse'
description: ''
delete:
- operationId: processors_destroy
+ operationId: api_v1_processors_destroy
description: Remove a processor from the system by its ID.
summary: Delete a processor
parameters:
@@ -9239,7 +10422,7 @@ paths:
description: No response body
/api/v1/provider-groups:
get:
- operationId: provider_groups_list
+ operationId: api_v1_provider_groups_list
description: Retrieve a list of all provider groups with options for filtering
by various criteria.
summary: List all provider groups
@@ -9372,7 +10555,7 @@ paths:
$ref: '#/components/schemas/PaginatedProviderGroupList'
description: ''
post:
- operationId: provider_groups_create
+ operationId: api_v1_provider_groups_create
description: Add a new provider group to the system by providing the required
provider group details.
summary: Create a new provider group
@@ -9401,7 +10584,7 @@ paths:
description: ''
/api/v1/provider-groups/{id}:
get:
- operationId: provider_groups_retrieve
+ operationId: api_v1_provider_groups_retrieve
description: Fetch detailed information about a specific provider group by their
ID.
summary: Retrieve data from a provider group
@@ -9441,7 +10624,7 @@ paths:
$ref: '#/components/schemas/ProviderGroupResponse'
description: ''
patch:
- operationId: provider_groups_partial_update
+ operationId: api_v1_provider_groups_partial_update
description: Update certain fields of an existing provider group's information
without affecting other fields.
summary: Partially update a provider group
@@ -9477,7 +10660,7 @@ paths:
$ref: '#/components/schemas/SerializerMetaclassResponse'
description: ''
delete:
- operationId: provider_groups_destroy
+ operationId: api_v1_provider_groups_destroy
description: Remove a provider group from the system by their ID.
summary: Delete a provider group
parameters:
@@ -9497,7 +10680,7 @@ paths:
description: No response body
/api/v1/provider-groups/{id}/relationships/providers:
post:
- operationId: provider_groups_relationships_providers_create
+ operationId: api_v1_provider_groups_relationships_providers_create
description: Add a new provider_group-providers relationship to the system by
providing the required provider_group-providers details.
summary: Create a new provider_group-providers relationship
@@ -9523,7 +10706,7 @@ paths:
'400':
description: Bad request (e.g., relationship already exists)
patch:
- operationId: provider_groups_relationships_providers_partial_update
+ operationId: api_v1_provider_groups_relationships_providers_partial_update
description: Update the provider_group-providers relationship information without
affecting other fields.
summary: Partially update a provider_group-providers relationship
@@ -9547,7 +10730,7 @@ paths:
'204':
description: Relationship updated successfully
delete:
- operationId: provider_groups_relationships_providers_destroy
+ operationId: api_v1_provider_groups_relationships_providers_destroy
description: Remove the provider_group-providers relationship from the system
by their ID.
summary: Delete a provider_group-providers relationship
@@ -9560,7 +10743,7 @@ paths:
description: Relationship deleted successfully
/api/v1/providers:
get:
- operationId: providers_list
+ operationId: api_v1_providers_list
description: Retrieve a list of all providers with options for filtering by
various criteria.
summary: List all providers
@@ -9648,7 +10831,7 @@ paths:
name: filter[provider]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -9662,10 +10845,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -9689,7 +10872,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -9703,10 +10886,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -9728,11 +10911,26 @@ paths:
* `okta` - Okta
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -9746,10 +10944,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -9773,7 +10971,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -9787,10 +10985,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -9910,7 +11108,7 @@ paths:
$ref: '#/components/schemas/PaginatedProviderList'
description: ''
post:
- operationId: providers_create
+ operationId: api_v1_providers_create
description: Add a new provider to the system by providing the required provider
details.
summary: Create a new provider
@@ -9939,7 +11137,7 @@ paths:
description: ''
/api/v1/providers/{id}:
get:
- operationId: providers_retrieve
+ operationId: api_v1_providers_retrieve
description: Fetch detailed information about a specific provider by their ID.
summary: Retrieve data from a provider
parameters:
@@ -9992,7 +11190,7 @@ paths:
$ref: '#/components/schemas/ProviderResponse'
description: ''
patch:
- operationId: providers_partial_update
+ operationId: api_v1_providers_partial_update
description: Update certain fields of an existing provider's information without
affecting other fields.
summary: Partially update a provider
@@ -10028,7 +11226,7 @@ paths:
$ref: '#/components/schemas/SerializerMetaclassResponse'
description: ''
delete:
- operationId: providers_destroy
+ operationId: api_v1_providers_destroy
description: Remove a provider from the system by their ID.
summary: Delete a provider
parameters:
@@ -10067,7 +11265,7 @@ paths:
description: ''
/api/v1/providers/{id}/connection:
post:
- operationId: providers_connection_create
+ operationId: api_v1_providers_connection_create
description: Try to verify connection. For instance, Role & Credentials are
set correctly
summary: Check connection
@@ -10107,7 +11305,7 @@ paths:
description: ''
/api/v1/providers/secrets:
get:
- operationId: providers_secrets_list
+ operationId: api_v1_providers_secrets_list
description: Retrieve a list of all secrets with options for filtering by various
criteria.
summary: List all secrets
@@ -10199,7 +11397,7 @@ paths:
$ref: '#/components/schemas/PaginatedProviderSecretList'
description: ''
post:
- operationId: providers_secrets_create
+ operationId: api_v1_providers_secrets_create
description: Add a new secret to the system by providing the required secret
details.
summary: Create a new secret
@@ -10228,7 +11426,7 @@ paths:
description: ''
/api/v1/providers/secrets/{id}:
get:
- operationId: providers_secrets_retrieve
+ operationId: api_v1_providers_secrets_retrieve
description: Fetch detailed information about a specific secret by their ID.
summary: Retrieve data from a secret
parameters:
@@ -10266,7 +11464,7 @@ paths:
$ref: '#/components/schemas/ProviderSecretResponse'
description: ''
patch:
- operationId: providers_secrets_partial_update
+ operationId: api_v1_providers_secrets_partial_update
description: Update certain fields of an existing secret's information without
affecting other fields.
summary: Partially update a secret
@@ -10301,7 +11499,7 @@ paths:
$ref: '#/components/schemas/ProviderSecretUpdateResponse'
description: ''
delete:
- operationId: providers_secrets_destroy
+ operationId: api_v1_providers_secrets_destroy
description: Remove a secret from the system by their ID.
summary: Delete a secret
parameters:
@@ -10320,7 +11518,7 @@ paths:
description: No response body
/api/v1/resources:
get:
- operationId: resources_list
+ operationId: api_v1_resources_list
description: Retrieve a list of all resources with options for filtering by
various criteria. Resources are objects that are discovered by Prowler. They
can be anything from a single host to a whole VPC.
@@ -10444,6 +11642,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -10463,7 +11676,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -10477,10 +11690,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -10504,7 +11717,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -10518,10 +11731,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -10746,7 +11959,7 @@ paths:
description: ''
/api/v1/resources/{id}:
get:
- operationId: resources_retrieve
+ operationId: api_v1_resources_retrieve
description: Fetch detailed information about a specific resource by their ID.
A Resource is an object that is discovered by Prowler. It can be anything
from a single host to a whole VPC.
@@ -10810,7 +12023,7 @@ paths:
description: ''
/api/v1/resources/{id}/events:
get:
- operationId: resources_events_list
+ operationId: api_v1_resources_events_list
description: |-
Retrieve events showing modification history for a resource. Returns who modified the resource and when. Currently only available for AWS resources.
@@ -10891,7 +12104,7 @@ paths:
description: Provider service unavailable
/api/v1/resources/latest:
get:
- operationId: resources_latest_retrieve
+ operationId: api_v1_resources_latest_retrieve
description: Retrieve a list of the latest resources from the latest scans for
each provider with options for filtering by various criteria.
summary: List the latest resources
@@ -10999,6 +12212,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -11018,7 +12246,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11032,10 +12260,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -11059,7 +12287,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11073,10 +12301,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -11256,7 +12484,7 @@ paths:
description: ''
/api/v1/resources/metadata:
get:
- operationId: resources_metadata_retrieve
+ operationId: api_v1_resources_metadata_retrieve
description: Fetch unique metadata values from a set of resources. This is useful
for dynamic filtering.
summary: Retrieve metadata values from resources
@@ -11367,6 +12595,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -11386,7 +12629,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11400,10 +12643,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -11427,7 +12670,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11441,10 +12684,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -11645,7 +12888,7 @@ paths:
description: ''
/api/v1/resources/metadata/latest:
get:
- operationId: resources_metadata_latest_retrieve
+ operationId: api_v1_resources_metadata_latest_retrieve
description: Fetch unique metadata values from a set of resources from the latest
scans for each provider. This is useful for dynamic filtering.
summary: Retrieve metadata values from the latest resources
@@ -11741,6 +12984,21 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_id]
schema:
@@ -11760,7 +13018,7 @@ paths:
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11774,10 +13032,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -11801,7 +13059,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -11815,10 +13073,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -11986,7 +13244,7 @@ paths:
description: ''
/api/v1/roles:
get:
- operationId: roles_list
+ operationId: api_v1_roles_list
description: Retrieve a list of all roles with options for filtering by various
criteria.
summary: List all roles
@@ -12155,7 +13413,7 @@ paths:
$ref: '#/components/schemas/PaginatedRoleList'
description: ''
post:
- operationId: roles_create
+ operationId: api_v1_roles_create
description: Add a new role to the system by providing the required role details.
summary: Create a new role
tags:
@@ -12183,7 +13441,7 @@ paths:
description: ''
/api/v1/roles/{id}:
get:
- operationId: roles_retrieve
+ operationId: api_v1_roles_retrieve
description: Fetch detailed information about a specific role by their ID.
summary: Retrieve data from a role
parameters:
@@ -12230,7 +13488,7 @@ paths:
$ref: '#/components/schemas/RoleResponse'
description: ''
patch:
- operationId: roles_partial_update
+ operationId: api_v1_roles_partial_update
description: Update selected fields on an existing role. When changing the `users`
relationship of a role that grants MANAGE_ACCOUNT, the API blocks attempts
that would leave the tenant without any MANAGE_ACCOUNT assignees and prevents
@@ -12268,7 +13526,7 @@ paths:
$ref: '#/components/schemas/SerializerMetaclassResponse'
description: ''
delete:
- operationId: roles_destroy
+ operationId: api_v1_roles_destroy
description: Delete the specified role. The API rejects deletion of the last
role in the tenant that grants MANAGE_ACCOUNT.
summary: Delete a role
@@ -12289,7 +13547,7 @@ paths:
description: No response body
/api/v1/roles/{id}/relationships/provider_groups:
post:
- operationId: roles_relationships_provider_groups_create
+ operationId: api_v1_roles_relationships_provider_groups_create
description: Add a new role-provider_groups relationship to the system by providing
the required role-provider_groups details.
summary: Create a new role-provider_groups relationship
@@ -12315,7 +13573,7 @@ paths:
'400':
description: Bad request (e.g., relationship already exists)
patch:
- operationId: roles_relationships_provider_groups_partial_update
+ operationId: api_v1_roles_relationships_provider_groups_partial_update
description: Update the role-provider_groups relationship information without
affecting other fields.
summary: Partially update a role-provider_groups relationship
@@ -12339,7 +13597,7 @@ paths:
'204':
description: Relationship updated successfully
delete:
- operationId: roles_relationships_provider_groups_destroy
+ operationId: api_v1_roles_relationships_provider_groups_destroy
description: Remove the role-provider_groups relationship from the system by
their ID.
summary: Delete a role-provider_groups relationship
@@ -12352,7 +13610,7 @@ paths:
description: Relationship deleted successfully
/api/v1/saml-config:
get:
- operationId: saml_config_list
+ operationId: api_v1_saml_config_list
description: Returns all the SAML-based SSO configurations associated with the
current tenant.
summary: List all SSO configurations
@@ -12421,7 +13679,7 @@ paths:
$ref: '#/components/schemas/PaginatedSAMLConfigurationList'
description: ''
post:
- operationId: saml_config_create
+ operationId: api_v1_saml_config_create
description: Creates a new SAML SSO configuration for the current tenant, including
email domain and metadata XML.
summary: Create the SSO configuration
@@ -12450,7 +13708,7 @@ paths:
description: ''
/api/v1/saml-config/{id}:
get:
- operationId: saml_config_retrieve
+ operationId: api_v1_saml_config_retrieve
description: Returns the details of a specific SAML configuration belonging
to the current tenant.
summary: Retrieve SSO configuration details
@@ -12488,7 +13746,7 @@ paths:
$ref: '#/components/schemas/SAMLConfigurationResponse'
description: ''
patch:
- operationId: saml_config_partial_update
+ operationId: api_v1_saml_config_partial_update
description: Partially updates an existing SAML SSO configuration. Supports
changes to email domain and metadata XML.
summary: Update the SSO configuration
@@ -12524,7 +13782,7 @@ paths:
$ref: '#/components/schemas/SAMLConfigurationResponse'
description: ''
delete:
- operationId: saml_config_destroy
+ operationId: api_v1_saml_config_destroy
description: Deletes an existing SAML SSO configuration associated with the
current tenant.
summary: Delete the SSO configuration
@@ -12545,7 +13803,7 @@ paths:
description: No response body
/api/v1/scans:
get:
- operationId: scans_list
+ operationId: api_v1_scans_list
description: Retrieve a list of all scans with options for filtering by various
criteria.
summary: List all scans
@@ -12655,11 +13913,26 @@ paths:
description: Multiple values may be separated by commas.
explode: false
style: form
+ - in: query
+ name: filter[provider_groups]
+ schema:
+ type: string
+ format: uuid
+ - in: query
+ name: filter[provider_groups__in]
+ schema:
+ type: array
+ items:
+ type: string
+ format: uuid
+ description: Multiple values may be separated by commas.
+ explode: false
+ style: form
- in: query
name: filter[provider_type]
schema:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -12673,10 +13946,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
* `aws` - AWS
* `azure` - Azure
@@ -12700,7 +13973,7 @@ paths:
type: array
items:
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
enum:
- alibabacloud
- aws
@@ -12714,10 +13987,10 @@ paths:
- kubernetes
- m365
- mongodbatlas
+ - okta
- openstack
- oraclecloud
- vercel
- - okta
description: |-
Multiple values may be separated by commas.
@@ -12889,7 +14162,7 @@ paths:
$ref: '#/components/schemas/PaginatedScanList'
description: ''
post:
- operationId: scans_create
+ operationId: api_v1_scans_create
description: Trigger a manual scan by providing the required scan details. If
`scanner_args` are not provided, the system will automatically use the default
settings from the associated provider. If you do provide `scanner_args`, these
@@ -12937,7 +14210,7 @@ paths:
description: ''
/api/v1/scans/{id}:
get:
- operationId: scans_retrieve
+ operationId: api_v1_scans_retrieve
description: Fetch detailed information about a specific scan by its ID.
summary: Retrieve data from a specific scan
parameters:
@@ -12996,7 +14269,7 @@ paths:
$ref: '#/components/schemas/ScanResponse'
description: ''
patch:
- operationId: scans_partial_update
+ operationId: api_v1_scans_partial_update
description: Update certain fields of an existing scan without affecting other
fields.
summary: Partially update a scan
@@ -13033,7 +14306,7 @@ paths:
description: ''
/api/v1/scans/{id}/cis:
get:
- operationId: scans_cis_retrieve
+ operationId: api_v1_scans_cis_retrieve
description: Download the CIS Benchmark compliance report as a PDF file. When
a provider ships multiple CIS versions, the report is generated for the highest
available version.
@@ -13100,7 +14373,7 @@ paths:
has not started yet
/api/v1/scans/{id}/compliance/{name}:
get:
- operationId: scans_compliance_retrieve
+ operationId: api_v1_scans_compliance_retrieve
description: Download a specific compliance report (e.g., 'cis_1.4_aws') as
a CSV file.
summary: Retrieve compliance report as CSV
@@ -13145,10 +14418,11 @@ paths:
description: Compliance report not found, or the scan has no reports yet
/api/v1/scans/{id}/compliance/{name}/ocsf:
get:
- operationId: scans_compliance_ocsf_retrieve
+ operationId: api_v1_scans_compliance_ocsf_retrieve
description: Download a specific compliance report as an OCSF JSON file. Only
universal frameworks that declare an output configuration produce this artifact
- (currently 'dora' and 'csa_ccm_4.0'); any other framework returns 404.
+ (currently 'dora_2022_2554', 'csa_ccm_4.0' and 'cis_controls_8.1'); any other
+ framework returns 404.
summary: Retrieve compliance report as OCSF JSON
parameters:
- in: query
@@ -13174,7 +14448,7 @@ paths:
name: name
schema:
type: string
- description: The compliance report name, like 'dora'
+ description: The compliance report name, like 'dora_2022_2554'
required: true
tags:
- Scan
@@ -13192,7 +14466,7 @@ paths:
an OCSF export, or the scan has no reports yet
/api/v1/scans/{id}/csa:
get:
- operationId: scans_csa_retrieve
+ operationId: api_v1_scans_csa_retrieve
description: Download CSA Cloud Controls Matrix (CCM) v4.0 compliance report
as a PDF file.
summary: Retrieve CSA CCM compliance report
@@ -13258,7 +14532,7 @@ paths:
task has not started yet
/api/v1/scans/{id}/ens:
get:
- operationId: scans_ens_retrieve
+ operationId: api_v1_scans_ens_retrieve
description: Download ENS RD2022 compliance report (e.g., 'ens_rd2022_aws')
as a PDF file.
summary: Retrieve ENS RD2022 compliance report
@@ -13324,7 +14598,7 @@ paths:
has not started yet
/api/v1/scans/{id}/nis2:
get:
- operationId: scans_nis2_retrieve
+ operationId: api_v1_scans_nis2_retrieve
description: Download NIS2 compliance report (Directive (EU) 2022/2555) as a
PDF file.
summary: Retrieve NIS2 compliance report
@@ -13390,7 +14664,7 @@ paths:
task has not started yet
/api/v1/scans/{id}/report:
get:
- operationId: scans_report_retrieve
+ operationId: api_v1_scans_report_retrieve
description: Returns a ZIP file containing the requested report
summary: Download ZIP report
parameters:
@@ -13428,7 +14702,7 @@ paths:
not started yet
/api/v1/scans/{id}/threatscore:
get:
- operationId: scans_threatscore_retrieve
+ operationId: api_v1_scans_threatscore_retrieve
description: Download a specific threatscore report (e.g., 'prowler_threatscore_aws')
as a PDF file.
summary: Retrieve threatscore report
@@ -13494,7 +14768,7 @@ paths:
generation task has not started yet
/api/v1/schedules/daily:
post:
- operationId: schedules_daily_create
+ operationId: api_v1_schedules_daily_create
description: Schedules a daily scan for the specified provider. This endpoint
creates a periodic task that will execute a scan every 24 hours.
summary: Create a daily schedule scan for a given provider
@@ -13538,7 +14812,7 @@ paths:
description: ''
/api/v1/tasks:
get:
- operationId: tasks_list
+ operationId: api_v1_tasks_list
description: Retrieve a list of all tasks with options for filtering by name,
state, and other criteria.
summary: List all tasks
@@ -13638,7 +14912,7 @@ paths:
description: ''
/api/v1/tasks/{id}:
get:
- operationId: tasks_retrieve
+ operationId: api_v1_tasks_retrieve
description: Fetch detailed information about a specific task by its ID.
summary: Retrieve data from a specific task
parameters:
@@ -13678,7 +14952,7 @@ paths:
$ref: '#/components/schemas/TaskResponse'
description: ''
delete:
- operationId: tasks_destroy
+ operationId: api_v1_tasks_destroy
description: Try to revoke a task using its ID. Only tasks that are not yet
in progress can be revoked.
summary: Revoke a task
@@ -13718,7 +14992,7 @@ paths:
description: ''
/api/v1/tenants:
get:
- operationId: tenants_list
+ operationId: api_v1_tenants_list
description: Retrieve a list of all tenants with options for filtering by various
criteria.
summary: List all tenants
@@ -13824,7 +15098,7 @@ paths:
$ref: '#/components/schemas/PaginatedTenantList'
description: ''
post:
- operationId: tenants_create
+ operationId: api_v1_tenants_create
description: Add a new tenant to the system by providing the required tenant
details.
summary: Create a new tenant
@@ -13853,7 +15127,7 @@ paths:
description: ''
/api/v1/tenants/{id}:
get:
- operationId: tenants_retrieve
+ operationId: api_v1_tenants_retrieve
description: Fetch detailed information about a specific tenant by their ID.
summary: Retrieve data from a tenant
parameters:
@@ -13888,7 +15162,7 @@ paths:
$ref: '#/components/schemas/TenantResponse'
description: ''
patch:
- operationId: tenants_partial_update
+ operationId: api_v1_tenants_partial_update
description: Update certain fields of an existing tenant's information without
affecting other fields.
summary: Partially update a tenant
@@ -13924,7 +15198,7 @@ paths:
$ref: '#/components/schemas/TenantResponse'
description: ''
delete:
- operationId: tenants_destroy
+ operationId: api_v1_tenants_destroy
description: Remove a tenant from the system by their ID.
summary: Delete a tenant
parameters:
@@ -13944,7 +15218,7 @@ paths:
description: No response body
/api/v1/tenants/{tenant_pk}/memberships:
get:
- operationId: tenants_memberships_list
+ operationId: api_v1_tenants_memberships_list
description: List the membership details of users in a tenant you are a part
of.
summary: List tenant memberships
@@ -14062,7 +15336,7 @@ paths:
description: ''
/api/v1/tenants/{tenant_pk}/memberships/{id}:
delete:
- operationId: tenants_memberships_destroy
+ operationId: api_v1_tenants_memberships_destroy
description: 'Delete a user''s membership from a tenant. This action: (1) removes
the membership, (2) revokes all refresh tokens for the expelled user, (3)
removes their role grants for this tenant, (4) cleans up orphaned roles, and
@@ -14093,7 +15367,7 @@ paths:
description: No response body
/api/v1/tenants/invitations:
get:
- operationId: tenants_invitations_list
+ operationId: api_v1_tenants_invitations_list
description: Retrieve a list of all tenant invitations with options for filtering
by various criteria.
summary: List all invitations
@@ -14275,7 +15549,7 @@ paths:
$ref: '#/components/schemas/PaginatedInvitationList'
description: ''
post:
- operationId: tenants_invitations_create
+ operationId: api_v1_tenants_invitations_create
description: Add a new tenant invitation to the system by providing the required
invitation details. The invited user will have to accept the invitations or
create an account using the given code.
@@ -14305,7 +15579,7 @@ paths:
description: ''
/api/v1/tenants/invitations/{id}:
get:
- operationId: tenants_invitations_retrieve
+ operationId: api_v1_tenants_invitations_retrieve
description: Fetch detailed information about a specific invitation by its ID.
summary: Retrieve data from a tenant invitation
parameters:
@@ -14346,7 +15620,7 @@ paths:
$ref: '#/components/schemas/InvitationResponse'
description: ''
patch:
- operationId: tenants_invitations_partial_update
+ operationId: api_v1_tenants_invitations_partial_update
description: Update certain fields of an existing tenant invitation's information
without affecting other fields.
summary: Partially update a tenant invitation
@@ -14381,7 +15655,7 @@ paths:
$ref: '#/components/schemas/InvitationUpdateResponse'
description: ''
delete:
- operationId: tenants_invitations_destroy
+ operationId: api_v1_tenants_invitations_destroy
description: Revoke a tenant invitation from the system by their ID.
summary: Revoke a tenant invitation
parameters:
@@ -14400,7 +15674,7 @@ paths:
description: No response body
/api/v1/tokens:
post:
- operationId: tokens_create
+ operationId: api_v1_tokens_create
description: Obtain a token by providing valid credentials and an optional tenant
ID.
summary: Obtain a token
@@ -14430,7 +15704,7 @@ paths:
description: ''
/api/v1/tokens/refresh:
post:
- operationId: tokens_refresh_create
+ operationId: api_v1_tokens_refresh_create
description: Refresh an access token by providing a valid refresh token. Former
refresh tokens are invalidated when a new one is issued.
summary: Refresh a token
@@ -14460,7 +15734,7 @@ paths:
description: ''
/api/v1/tokens/switch:
post:
- operationId: tokens_switch_create
+ operationId: api_v1_tokens_switch_create
description: Switch tenant by providing a valid tenant ID. The authenticated
user must belong to the tenant.
summary: Switch tenant using a valid tenant ID
@@ -14489,7 +15763,7 @@ paths:
description: ''
/api/v1/users:
get:
- operationId: users_list
+ operationId: api_v1_users_list
description: Retrieve a list of all users with options for filtering by various
criteria.
summary: List all users
@@ -14620,7 +15894,7 @@ paths:
$ref: '#/components/schemas/PaginatedUserList'
description: ''
post:
- operationId: users_create
+ operationId: api_v1_users_create
description: Create a new user account by providing the necessary registration
details.
summary: Register a new user
@@ -14657,7 +15931,7 @@ paths:
description: ''
/api/v1/users/{id}:
get:
- operationId: users_retrieve
+ operationId: api_v1_users_retrieve
description: Fetch detailed information about an authenticated user.
summary: Retrieve a user's information
parameters:
@@ -14708,7 +15982,7 @@ paths:
$ref: '#/components/schemas/UserResponse'
description: ''
patch:
- operationId: users_partial_update
+ operationId: api_v1_users_partial_update
description: Partially update information about a user.
summary: Update user information
parameters:
@@ -14743,7 +16017,7 @@ paths:
$ref: '#/components/schemas/UserUpdateResponse'
description: ''
delete:
- operationId: users_destroy
+ operationId: api_v1_users_destroy
description: Remove the current user account from the system.
summary: Delete the user account
parameters:
@@ -14763,7 +16037,7 @@ paths:
description: No response body
/api/v1/users/{id}/relationships/roles:
post:
- operationId: users_relationships_roles_create
+ operationId: api_v1_users_relationships_roles_create
description: Add a new user-roles relationship to the system by providing the
required user-roles details.
summary: Create a new user-roles relationship
@@ -14789,7 +16063,7 @@ paths:
'400':
description: Bad request (e.g., relationship already exists)
patch:
- operationId: users_relationships_roles_partial_update
+ operationId: api_v1_users_relationships_roles_partial_update
description: Update the user-roles relationship information without affecting
other fields. If the update would remove MANAGE_ACCOUNT from the last remaining
user in the tenant, the API rejects the request with a 400 response.
@@ -14814,7 +16088,7 @@ paths:
'204':
description: Relationship updated successfully
delete:
- operationId: users_relationships_roles_destroy
+ operationId: api_v1_users_relationships_roles_destroy
description: Remove the user-roles relationship from the system by their ID.
If removing MANAGE_ACCOUNT would take it away from the last remaining user
in the tenant, the API rejects the request with a 400 response. Users also
@@ -14830,7 +16104,7 @@ paths:
description: Relationship deleted successfully
/api/v1/users/{user_pk}/memberships:
get:
- operationId: users_memberships_list
+ operationId: api_v1_users_memberships_list
description: Retrieve a list of all user memberships with options for filtering
by various criteria.
summary: List user memberships
@@ -14943,7 +16217,7 @@ paths:
description: ''
/api/v1/users/{user_pk}/memberships/{id}:
get:
- operationId: users_memberships_retrieve
+ operationId: api_v1_users_memberships_retrieve
description: Fetch detailed information about a specific user membership by
their ID.
summary: Retrieve membership data from the user
@@ -14988,7 +16262,7 @@ paths:
description: ''
/api/v1/users/me:
get:
- operationId: users_me_retrieve
+ operationId: api_v1_users_me_retrieve
description: Fetch detailed information about the authenticated user.
summary: Retrieve the current user's information
parameters:
@@ -20271,18 +21545,22 @@ components:
properties:
okta_client_id:
type: string
- description: Client ID of the Okta API Services app used for OAuth 2.0 private-key JWT authentication.
+ description: Client ID of the Okta API Services app used for
+ OAuth 2.0 private-key JWT authentication.
okta_private_key:
type: string
- description: PEM-encoded private key whose matching public key (JWK) is registered on the Okta service app.
+ description: PEM-encoded private key whose matching public
+ key (JWK) is registered on the Okta service app.
okta_scopes:
type: array
items:
type: string
- description: OAuth scopes to request. Optional; defaults to the minimum set required to run the currently enabled Okta checks.
+ description: OAuth scopes to request. Optional; defaults to
+ the minimum set required to run the currently enabled Okta
+ checks.
required:
- - okta_client_id
- - okta_private_key
+ - okta_client_id
+ - okta_private_key
- type: object
title: Vercel API Token
properties:
@@ -21314,7 +22592,7 @@ components:
* `googleworkspace` - Google Workspace
* `vercel` - Vercel
* `okta` - Okta
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
uid:
type: string
title: Unique identifier for the provider, set by the provider
@@ -21437,7 +22715,7 @@ components:
- vercel
- okta
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
description: |-
Type of provider to create.
@@ -21511,7 +22789,7 @@ components:
- vercel
- okta
type: string
- x-spec-enum-id: 91f917e0c3ab97e8
+ x-spec-enum-id: 203afc16daac9b64
description: |-
Type of provider to create.
@@ -22385,18 +23663,21 @@ components:
properties:
okta_client_id:
type: string
- description: Client ID of the Okta API Services app used for OAuth 2.0 private-key JWT authentication.
+ description: Client ID of the Okta API Services app used for OAuth
+ 2.0 private-key JWT authentication.
okta_private_key:
type: string
- description: PEM-encoded private key whose matching public key (JWK) is registered on the Okta service app.
+ description: PEM-encoded private key whose matching public key
+ (JWK) is registered on the Okta service app.
okta_scopes:
type: array
items:
type: string
- description: OAuth scopes to request. Optional; defaults to the minimum set required to run the currently enabled Okta checks.
+ description: OAuth scopes to request. Optional; defaults to the
+ minimum set required to run the currently enabled Okta checks.
required:
- - okta_client_id
- - okta_private_key
+ - okta_client_id
+ - okta_private_key
- type: object
title: Vercel API Token
properties:
@@ -22827,18 +24108,22 @@ components:
properties:
okta_client_id:
type: string
- description: Client ID of the Okta API Services app used for OAuth 2.0 private-key JWT authentication.
+ description: Client ID of the Okta API Services app used for
+ OAuth 2.0 private-key JWT authentication.
okta_private_key:
type: string
- description: PEM-encoded private key whose matching public key (JWK) is registered on the Okta service app.
+ description: PEM-encoded private key whose matching public
+ key (JWK) is registered on the Okta service app.
okta_scopes:
type: array
items:
type: string
- description: OAuth scopes to request. Optional; defaults to the minimum set required to run the currently enabled Okta checks.
+ description: OAuth scopes to request. Optional; defaults to
+ the minimum set required to run the currently enabled Okta
+ checks.
required:
- - okta_client_id
- - okta_private_key
+ - okta_client_id
+ - okta_private_key
- type: object
title: Vercel API Token
properties:
@@ -23279,18 +24564,21 @@ components:
properties:
okta_client_id:
type: string
- description: Client ID of the Okta API Services app used for OAuth 2.0 private-key JWT authentication.
+ description: Client ID of the Okta API Services app used for OAuth
+ 2.0 private-key JWT authentication.
okta_private_key:
type: string
- description: PEM-encoded private key whose matching public key (JWK) is registered on the Okta service app.
+ description: PEM-encoded private key whose matching public key
+ (JWK) is registered on the Okta service app.
okta_scopes:
type: array
items:
type: string
- description: OAuth scopes to request. Optional; defaults to the minimum set required to run the currently enabled Okta checks.
+ description: OAuth scopes to request. Optional; defaults to the
+ minimum set required to run the currently enabled Okta checks.
required:
- - okta_client_id
- - okta_private_key
+ - okta_client_id
+ - okta_private_key
- type: object
title: Vercel API Token
properties:
diff --git a/api/src/backend/api/sse/channelmanager.py b/api/src/backend/api/sse/channelmanager.py
index 9190d4ab16..84a9362a19 100644
--- a/api/src/backend/api/sse/channelmanager.py
+++ b/api/src/backend/api/sse/channelmanager.py
@@ -16,7 +16,7 @@ if TYPE_CHECKING:
class SSEChannelManager(DefaultChannelManager):
"""Connect `django-eventstream` to the platform's SSE viewsets."""
- def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]: # noqa: vulture
+ def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]:
"""Return the request's channels scoped to the active JWT tenant.
Args:
@@ -30,6 +30,7 @@ class SSEChannelManager(DefaultChannelManager):
The subset of `request.sse_channels` whose embedded tenant
matches the active request tenant.
"""
+ _ = view_kwargs
try:
request_tenant_id = UUID(str(getattr(request, "tenant_id", None)))
except (TypeError, ValueError):
diff --git a/api/src/backend/api/tests/integration/test_authentication.py b/api/src/backend/api/tests/integration/test_authentication.py
index 4d1c40fe23..67f498b238 100644
--- a/api/src/backend/api/tests/integration/test_authentication.py
+++ b/api/src/backend/api/tests/integration/test_authentication.py
@@ -1,3 +1,4 @@
+import json
import time
from datetime import UTC, datetime, timedelta
from uuid import uuid4
@@ -8,6 +9,23 @@ from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
from django.urls import reverse
from drf_simple_apikey.crypto import get_crypto
from rest_framework.test import APIClient
+from rest_framework_simplejwt.token_blacklist.models import (
+ BlacklistedToken,
+ OutstandingToken,
+)
+
+PASSWORD_CHANGE_PASSWORD = "InitialSecret123@"
+
+
+@pytest.fixture
+def password_change_user(tenants_fixture):
+ user = User.objects.create_user(
+ name="password_change_user",
+ email=f"password-change-{uuid4()}@prowler.com",
+ password=PASSWORD_CHANGE_PASSWORD,
+ )
+ Membership.objects.create(user=user, tenant=tenants_fixture[0])
+ return user
@pytest.mark.django_db
@@ -103,6 +121,120 @@ def test_refresh_token(create_test_user, tenants_fixture):
assert new_refresh_response.status_code == 200
+@pytest.mark.django_db
+def test_password_change_invalidates_existing_tokens(password_change_user):
+ client = APIClient()
+ new_password = "ChangedSecret123@"
+
+ access_token, refresh_token = get_api_tokens(
+ client, password_change_user.email, PASSWORD_CHANGE_PASSWORD
+ )
+ auth_headers = get_authorization_header(access_token)
+ outstanding_token_ids = list(
+ OutstandingToken.objects.filter(user=password_change_user).values_list(
+ "id", flat=True
+ )
+ )
+ assert outstanding_token_ids
+ assert not BlacklistedToken.objects.filter(
+ token_id__in=outstanding_token_ids
+ ).exists()
+
+ password_change_payload = {
+ "data": {
+ "type": "users",
+ "id": str(password_change_user.id),
+ "attributes": {"password": new_password},
+ }
+ }
+ password_change_response = client.patch(
+ reverse("user-detail", kwargs={"pk": password_change_user.id}),
+ data=json.dumps(password_change_payload),
+ headers=auth_headers,
+ content_type="application/vnd.api+json",
+ )
+ assert password_change_response.status_code == 200, password_change_response.json()
+ assert BlacklistedToken.objects.filter(
+ token_id__in=outstanding_token_ids
+ ).count() == len(outstanding_token_ids)
+
+ old_access_response = client.get(reverse("user-me"), headers=auth_headers)
+ assert old_access_response.status_code == 401
+
+ old_refresh_response = client.post(
+ reverse("token-refresh"),
+ data={
+ "data": {
+ "type": "tokens-refresh",
+ "attributes": {"refresh": refresh_token},
+ }
+ },
+ format="vnd.api+json",
+ )
+ assert old_refresh_response.status_code == 400
+
+ new_access_token, _ = get_api_tokens(
+ client, password_change_user.email, new_password
+ )
+ new_access_response = client.get(
+ reverse("user-me"), headers=get_authorization_header(new_access_token)
+ )
+ assert new_access_response.status_code == 200
+
+
+@pytest.mark.django_db
+def test_password_change_invalidates_rotated_refresh_token(
+ password_change_user,
+):
+ client = APIClient()
+ new_password = "ChangedSecret123@"
+
+ access_token, refresh_token = get_api_tokens(
+ client, password_change_user.email, PASSWORD_CHANGE_PASSWORD
+ )
+ rotated_refresh_response = client.post(
+ reverse("token-refresh"),
+ data={
+ "data": {
+ "type": "tokens-refresh",
+ "attributes": {"refresh": refresh_token},
+ }
+ },
+ format="vnd.api+json",
+ )
+ assert rotated_refresh_response.status_code == 200
+ rotated_refresh_token = rotated_refresh_response.json()["data"]["attributes"][
+ "refresh"
+ ]
+
+ password_change_payload = {
+ "data": {
+ "type": "users",
+ "id": str(password_change_user.id),
+ "attributes": {"password": new_password},
+ }
+ }
+ password_change_response = client.patch(
+ reverse("user-detail", kwargs={"pk": password_change_user.id}),
+ data=json.dumps(password_change_payload),
+ headers=get_authorization_header(access_token),
+ content_type="application/vnd.api+json",
+ )
+ assert password_change_response.status_code == 200, password_change_response.json()
+
+ old_rotated_refresh_response = client.post(
+ reverse("token-refresh"),
+ data={
+ "data": {
+ "type": "tokens-refresh",
+ "attributes": {"refresh": rotated_refresh_token},
+ }
+ },
+ format="vnd.api+json",
+ )
+ assert old_rotated_refresh_response.status_code == 400
+
+
@pytest.mark.django_db
def test_user_me_when_inviting_users(create_test_user, tenants_fixture, roles_fixture):
client = APIClient()
@@ -187,8 +319,9 @@ def test_user_me_when_inviting_users(create_test_user, tenants_fixture, roles_fi
@pytest.mark.django_db
class TestTokenSwitchTenant:
- def test_switch_tenant_with_valid_token(self, tenants_fixture, providers_fixture):
+ def test_switch_tenant_with_valid_token(self, tenants_fixture, aws_provider):
client = APIClient()
+ assert aws_provider
test_user = "test_email@prowler.com"
test_password = "Test_password1@"
@@ -1396,13 +1529,14 @@ class TestAPIKeyMultiTenantWorkflows:
assert me_response2.json()["data"]["id"] == str(user.id)
def test_api_key_cannot_access_different_tenant_resources(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""API key from one tenant cannot access resources from another tenant.
Verifies RLS enforcement after authentication ensures tenant isolation.
"""
client = APIClient()
+ assert aws_provider
user1 = User.objects.create_user(
name="tenant1_user",
diff --git a/api/src/backend/api/tests/integration/test_rls_transaction.py b/api/src/backend/api/tests/integration/test_rls_transaction.py
index bd46871586..ce026d4f58 100644
--- a/api/src/backend/api/tests/integration/test_rls_transaction.py
+++ b/api/src/backend/api/tests/integration/test_rls_transaction.py
@@ -1,8 +1,12 @@
"""Tests for rls_transaction retry and fallback logic."""
+from unittest.mock import patch
+
import pytest
-from api.db_utils import rls_transaction
-from django.db import DEFAULT_DB_ALIAS
+from api.db_utils import POSTGRES_TENANT_VAR, rls_transaction
+from conftest import TEST_REPLICA_ALIAS
+from django.db import DEFAULT_DB_ALIAS, OperationalError, connections
+from psycopg2 import OperationalError as Psycopg2OperationalError
from rest_framework_json_api.serializers import ValidationError
@@ -36,3 +40,35 @@ class TestRLSTransaction:
cursor.execute("SELECT current_setting(%s, true)", [custom_param])
result = cursor.fetchone()
assert result == (str(tenant.id),)
+
+ @pytest.mark.requires_test_replica_alias
+ @pytest.mark.django_db(
+ transaction=True, databases=[DEFAULT_DB_ALIAS, TEST_REPLICA_ALIAS]
+ )
+ def test_mid_query_replica_connection_loss_falls_back_to_primary(self, tenant):
+ """Real Django connection state: closed replica atomic falls back to primary."""
+ replica = connections[TEST_REPLICA_ALIAS]
+ sql = "SELECT current_setting(%s, true), %s"
+ params = [POSTGRES_TENANT_VAR, 42]
+ failed_once = {"value": False}
+
+ def close_replica_and_raise(execute, sql_arg, params_arg, many, context):
+ if not failed_once["value"] and sql_arg == sql:
+ failed_once["value"] = True
+ replica.close()
+ try:
+ raise Psycopg2OperationalError("SSL SYSCALL error: EOF detected")
+ except Psycopg2OperationalError as psycopg_error:
+ raise OperationalError(
+ "SSL SYSCALL error: EOF detected"
+ ) from psycopg_error
+ return execute(sql_arg, params_arg, many, context)
+
+ with patch("api.db_utils.READ_REPLICA_ALIAS", TEST_REPLICA_ALIAS):
+ with rls_transaction(str(tenant.id), using=TEST_REPLICA_ALIAS) as cursor:
+ with replica.execute_wrapper(close_replica_and_raise):
+ cursor.execute(sql, params)
+ result = cursor.fetchone()
+
+ assert failed_once["value"]
+ assert result == (str(tenant.id), 42)
diff --git a/api/src/backend/api/tests/test_adapters.py b/api/src/backend/api/tests/test_adapters.py
index 91d3bb054a..c86d3f5620 100644
--- a/api/src/backend/api/tests/test_adapters.py
+++ b/api/src/backend/api/tests/test_adapters.py
@@ -2,11 +2,18 @@ from types import SimpleNamespace
from unittest.mock import MagicMock, patch
import pytest
-from allauth.socialaccount.models import SocialLogin
+from allauth.account import app_settings as account_app_settings
+from allauth.account.models import EmailAddress
+from allauth.core import context
+from allauth.core.exceptions import ImmediateHttpResponse
+from allauth.socialaccount import app_settings as socialaccount_app_settings
+from allauth.socialaccount.internal.flows.login import complete_login
+from allauth.socialaccount.models import SocialAccount, SocialLogin
from api.adapters import ProwlerSocialAccountAdapter
from api.db_router import MainRouter
-from api.models import SAMLConfiguration
+from api.models import Invitation, Membership, SAMLConfiguration, Tenant
from django.contrib.auth import get_user_model
+from django.core import mail
User = get_user_model()
@@ -40,6 +47,7 @@ def _saml_request(rf, organization_slug):
def _saml_sociallogin(user):
sociallogin = MagicMock(spec=SocialLogin)
sociallogin.account = MagicMock()
+ sociallogin.account.pk = None
sociallogin.provider = MagicMock()
sociallogin.provider.id = "saml"
sociallogin.account.extra_data = {}
@@ -48,6 +56,59 @@ def _saml_sociallogin(user):
return sociallogin
+def _oauth_sociallogin(
+ user,
+ *,
+ provider="google",
+ provider_email_verified=True,
+ include_extra_email=True,
+):
+ sociallogin = MagicMock(spec=SocialLogin)
+ sociallogin.account = MagicMock()
+ sociallogin.account.pk = None
+ sociallogin.provider = MagicMock()
+ sociallogin.provider.id = provider
+ sociallogin.account.extra_data = (
+ {"email": user.email} if include_extra_email else {}
+ )
+ sociallogin.email_addresses = [
+ EmailAddress(
+ email=user.email,
+ verified=provider_email_verified,
+ primary=True,
+ )
+ ]
+ sociallogin.user = user
+ sociallogin.connect = MagicMock()
+ return sociallogin
+
+
+def _real_oauth_sociallogin(user, uid):
+ provider = MagicMock()
+ provider.id = "google"
+ provider.app = None
+ provider.get_settings.return_value = {}
+ return SocialLogin(
+ user=user,
+ account=SocialAccount(
+ provider="google",
+ uid=uid,
+ extra_data={"email": user.email},
+ ),
+ email_addresses=[EmailAddress(email=user.email, verified=True, primary=True)],
+ provider=provider,
+ )
+
+
+def _verify_local_email(user):
+ return EmailAddress.objects.create(
+ user=user,
+ email=user.email,
+ verified=True,
+ primary=True,
+ )
+
+
@pytest.mark.django_db
class TestProwlerSocialAccountAdapter:
def test_get_user_by_email_returns_user(self, create_test_user):
@@ -157,6 +218,7 @@ class TestProwlerSocialAccountAdapter:
sociallogin = MagicMock(spec=SocialLogin)
sociallogin.account = MagicMock()
+ sociallogin.account.pk = None
sociallogin.provider = MagicMock()
sociallogin.user = MagicMock()
sociallogin.user.email = ""
@@ -168,25 +230,157 @@ class TestProwlerSocialAccountAdapter:
sociallogin.connect.assert_not_called()
- def test_pre_social_login_non_saml_links_by_email(self, create_test_user, rf):
- """Non-SAML providers (e.g. Google/GitHub) still link to an existing
- local account by email; the tenant binding only applies to SAML."""
+ def test_pre_social_login_blocks_unverified_local_email(self, create_test_user, rf):
+ """A verified OAuth email must not claim an unverified local account."""
adapter = ProwlerSocialAccountAdapter()
+ sociallogin = _oauth_sociallogin(create_test_user)
- sociallogin = MagicMock(spec=SocialLogin)
- sociallogin.account = MagicMock()
- sociallogin.provider = MagicMock()
- sociallogin.provider.id = "google"
- sociallogin.account.extra_data = {"email": create_test_user.email}
- sociallogin.user = create_test_user
- sociallogin.connect = MagicMock()
+ with pytest.raises(ImmediateHttpResponse) as exc_info:
+ adapter.pre_social_login(rf.get("/"), sociallogin)
+
+ assert exc_info.value.response.status_code == 403
+ sociallogin.connect.assert_not_called()
+
+ def test_complete_oauth_login_does_not_link_unverified_local_email(
+ self, create_test_user, rf
+ ):
+ """Regression test for the complete pre-hijack account-linking flow."""
+ incoming_user = User(email=create_test_user.email)
+ incoming_user.set_unusable_password()
+ sociallogin = _real_oauth_sociallogin(
+ incoming_user,
+ uid="victim-google-account",
+ )
+ request = rf.get("/")
+ request.session = {}
+
+ with pytest.raises(ImmediateHttpResponse) as exc_info:
+ complete_login(request, sociallogin, raises=True)
+
+ assert exc_info.value.response.status_code == 403
+ assert not SocialAccount.objects.filter(
+ provider="google", uid="victim-google-account"
+ ).exists()
+
+ def test_pre_social_login_allows_already_connected_account(
+ self, create_test_user, rf
+ ):
+ """Existing provider bindings do not need to relink on every login."""
+ adapter = ProwlerSocialAccountAdapter()
+ sociallogin = _oauth_sociallogin(create_test_user)
+ sociallogin.account.pk = "existing-social-account"
adapter.pre_social_login(rf.get("/"), sociallogin)
- call_args = sociallogin.connect.call_args
- assert call_args is not None
- _, called_user = call_args[0]
- assert called_user.email == create_test_user.email
+ sociallogin.connect.assert_not_called()
+
+ def test_pre_social_login_blocks_unverified_provider_email(
+ self, create_test_user, rf
+ ):
+ """An OAuth provider must prove ownership of the matching email."""
+ _verify_local_email(create_test_user)
+ adapter = ProwlerSocialAccountAdapter()
+ sociallogin = _oauth_sociallogin(
+ create_test_user,
+ provider="github",
+ provider_email_verified=False,
+ )
+
+ with pytest.raises(ImmediateHttpResponse) as exc_info:
+ adapter.pre_social_login(rf.get("/"), sociallogin)
+
+ assert exc_info.value.response.status_code == 403
+ sociallogin.connect.assert_not_called()
+
+ def test_pre_social_login_links_verified_emails(self, create_test_user, rf):
+ _verify_local_email(create_test_user)
+ adapter = ProwlerSocialAccountAdapter()
+ sociallogin = _oauth_sociallogin(create_test_user)
+ request = rf.get("/")
+
+ adapter.pre_social_login(request, sociallogin)
+
+ sociallogin.connect.assert_called_once_with(request, create_test_user)
+
+ def test_verified_social_account_link_does_not_send_notification(
+ self, create_test_user, rf
+ ):
+ _verify_local_email(create_test_user)
+ sociallogin = _real_oauth_sociallogin(
+ create_test_user,
+ uid="verified-google-account",
+ )
+
+ request = rf.get("/")
+ with context.request_context(request):
+ ProwlerSocialAccountAdapter().pre_social_login(request, sociallogin)
+
+ assert SocialAccount.objects.filter(
+ provider="google",
+ uid="verified-google-account",
+ user=create_test_user,
+ ).exists()
+ assert mail.outbox == []
+
+ def test_pre_social_login_uses_verified_email_missing_from_extra_data(
+ self, create_test_user, rf
+ ):
+ """GitHub can return its verified primary email outside extra_data."""
+ _verify_local_email(create_test_user)
+ adapter = ProwlerSocialAccountAdapter()
+ sociallogin = _oauth_sociallogin(
+ create_test_user,
+ provider="github",
+ include_extra_email=False,
+ )
+ request = rf.get("/")
+
+ adapter.pre_social_login(request, sociallogin)
+
+ sociallogin.connect.assert_called_once_with(request, create_test_user)
+
+ def test_social_account_linking_settings_are_fail_closed(self):
+ assert not socialaccount_app_settings.EMAIL_AUTHENTICATION
+ assert not socialaccount_app_settings.EMAIL_AUTHENTICATION_AUTO_CONNECT
+ assert not account_app_settings.EMAIL_NOTIFICATIONS
+
+ def test_save_user_social_with_invitation_joins_invited_tenant(
+ self, rf, create_test_user, tenants_fixture
+ ):
+ adapter = ProwlerSocialAccountAdapter()
+ invited_tenant = tenants_fixture[2]
+ invited_email = "frank-invited@example.com"
+ invitation = Invitation.objects.create(
+ tenant=invited_tenant,
+ email=invited_email,
+ inviter=create_test_user,
+ )
+ request = rf.post("/", data={"invitation_token": invitation.token})
+ request.session = {}
+
+ sociallogin = MagicMock(spec=SocialLogin)
+ sociallogin.provider = MagicMock()
+ sociallogin.provider.id = "google"
+ sociallogin.account = MagicMock()
+ sociallogin.account.extra_data = {"name": "Frank"}
+
+ real_user = User.objects.create_user(
+ name="Frank", email=invited_email, password="Secret123!"
+ )
+ tenants_before = Tenant.objects.count()
+
+ with patch("api.adapters.super") as mock_super:
+ mock_super.return_value.save_user.return_value = real_user
+ adapter.save_user(request, sociallogin)
+
+ invitation.refresh_from_db()
+ assert invitation.state == Invitation.State.ACCEPTED
+ assert Tenant.objects.count() == tenants_before
+ assert Membership.objects.filter(
+ user=real_user,
+ tenant=invited_tenant,
+ role=Membership.RoleChoices.MEMBER,
+ ).exists()
def test_save_user_saml_sets_session_flag(self, rf):
adapter = ProwlerSocialAccountAdapter()
diff --git a/api/src/backend/api/tests/test_attack_paths.py b/api/src/backend/api/tests/test_attack_paths.py
index 30104a5a63..77bc01d255 100644
--- a/api/src/backend/api/tests/test_attack_paths.py
+++ b/api/src/backend/api/tests/test_attack_paths.py
@@ -92,7 +92,9 @@ def test_prepare_parameters_validates_cast(
def test_execute_query_serializes_graph(
- attack_paths_query_definition_factory, attack_paths_graph_stub_classes
+ attack_paths_query_definition_factory,
+ attack_paths_graph_stub_classes,
+ sink_backend_stub,
):
definition = attack_paths_query_definition_factory(
id="aws-rds",
@@ -135,18 +137,17 @@ def test_execute_query_serializes_graph(
database_name = "db-tenant-test-tenant-id"
- with patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- return_value=graph_result,
- ) as mock_execute_read_query:
- result = views_helpers.execute_query(
- database_name, definition, parameters, provider_id=provider_id
- )
+ sink_backend_stub.execute_read_query.return_value = graph_result
+ result = views_helpers.execute_query(
+ database_name,
+ definition,
+ parameters,
+ provider_id=provider_id,
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
+ )
- mock_execute_read_query.assert_called_once_with(
- database=database_name,
- cypher=definition.cypher,
- parameters=parameters,
+ sink_backend_stub.execute_read_query.assert_called_once_with(
+ database_name, definition.cypher, parameters
)
assert result["nodes"][0]["id"] == "node-1"
assert result["nodes"][0]["properties"]["complex"]["items"][0] == "value"
@@ -155,6 +156,7 @@ def test_execute_query_serializes_graph(
def test_execute_query_wraps_graph_errors(
attack_paths_query_definition_factory,
+ sink_backend_stub,
):
definition = attack_paths_query_definition_factory(
id="aws-rds",
@@ -167,16 +169,17 @@ def test_execute_query_wraps_graph_errors(
database_name = "db-tenant-test-tenant-id"
parameters = {"provider_uid": "123"}
- with (
- patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- side_effect=graph_database.GraphDatabaseQueryException("boom"),
- ),
- patch("api.attack_paths.views_helpers.logger") as mock_logger,
- ):
+ sink_backend_stub.execute_read_query.side_effect = (
+ graph_database.GraphDatabaseQueryException("boom")
+ )
+ with patch("api.attack_paths.views_helpers.logger") as mock_logger:
with pytest.raises(APIException):
views_helpers.execute_query(
- database_name, definition, parameters, provider_id="test-provider-123"
+ database_name,
+ definition,
+ parameters,
+ provider_id="test-provider-123",
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
)
mock_logger.error.assert_called_once()
@@ -184,6 +187,7 @@ def test_execute_query_wraps_graph_errors(
def test_execute_query_raises_permission_denied_on_read_only(
attack_paths_query_definition_factory,
+ sink_backend_stub,
):
definition = attack_paths_query_definition_factory(
id="aws-rds",
@@ -196,17 +200,20 @@ def test_execute_query_raises_permission_denied_on_read_only(
database_name = "db-tenant-test-tenant-id"
parameters = {"provider_uid": "123"}
- with patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- side_effect=graph_database.WriteQueryNotAllowedException(
+ sink_backend_stub.execute_read_query.side_effect = (
+ graph_database.WriteQueryNotAllowedException(
message="Read query not allowed",
code="Neo.ClientError.Statement.AccessMode",
- ),
- ):
- with pytest.raises(PermissionDenied):
- views_helpers.execute_query(
- database_name, definition, parameters, provider_id="test-provider-123"
- )
+ )
+ )
+ with pytest.raises(PermissionDenied):
+ views_helpers.execute_query(
+ database_name,
+ definition,
+ parameters,
+ provider_id="test-provider-123",
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
+ )
def test_serialize_graph_filters_by_provider_label(attack_paths_graph_stub_classes):
@@ -440,6 +447,7 @@ def test_normalize_custom_query_payload_passthrough_for_flat_dict():
def test_execute_custom_query_serializes_graph(
attack_paths_graph_stub_classes,
+ sink_backend_stub,
):
provider_id = "test-provider-123"
plabel = get_provider_label(provider_id)
@@ -453,50 +461,73 @@ def test_execute_custom_query_serializes_graph(
graph_result.nodes = [node_1, node_2]
graph_result.relationships = [relationship]
- with patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- return_value=graph_result,
- ) as mock_execute:
- result = views_helpers.execute_custom_query(
- "db-tenant-test", "MATCH (n) RETURN n", provider_id
- )
+ sink_backend_stub.execute_read_query.return_value = graph_result
+ result = views_helpers.execute_custom_query(
+ "db-tenant-test",
+ "MATCH (n) RETURN n",
+ provider_id,
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
+ )
- mock_execute.assert_called_once()
- call_kwargs = mock_execute.call_args[1]
- assert call_kwargs["database"] == "db-tenant-test"
+ sink_backend_stub.execute_read_query.assert_called_once()
+ call_args = sink_backend_stub.execute_read_query.call_args[0]
+ assert call_args[0] == "db-tenant-test"
# The cypher is rewritten with the provider label injection
- assert plabel in call_kwargs["cypher"]
+ assert plabel in call_args[1]
assert len(result["nodes"]) == 2
assert result["relationships"][0]["label"] == "OWNS"
assert result["truncated"] is False
assert result["total_nodes"] == 2
-def test_execute_custom_query_raises_permission_denied_on_write():
+def test_execute_custom_query_adds_timeout_for_neptune_scan(sink_backend_stub):
+ graph_result = MagicMock()
+ graph_result.nodes = []
+ graph_result.relationships = []
+ sink_backend_stub.execute_read_query.return_value = graph_result
+
with patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- side_effect=graph_database.WriteQueryNotAllowedException(
+ "api.attack_paths.views_helpers.sink_module.get_backend_for_scan",
+ return_value=sink_backend_stub,
+ ):
+ views_helpers.execute_custom_query(
+ "db-tenant-test",
+ "MATCH (n) RETURN n",
+ "provider-1",
+ scan=MagicMock(is_migrated=True, sink_backend="neptune"),
+ )
+
+ cypher = sink_backend_stub.execute_read_query.call_args[0][1]
+ assert cypher.startswith("USING QUERY:TIMEOUTMILLISECONDS")
+
+
+def test_execute_custom_query_raises_permission_denied_on_write(sink_backend_stub):
+ sink_backend_stub.execute_read_query.side_effect = (
+ graph_database.WriteQueryNotAllowedException(
message="Read query not allowed",
code="Neo.ClientError.Statement.AccessMode",
- ),
- ):
- with pytest.raises(PermissionDenied):
- views_helpers.execute_custom_query(
- "db-tenant-test", "CREATE (n) RETURN n", "provider-1"
- )
+ )
+ )
+ with pytest.raises(PermissionDenied):
+ views_helpers.execute_custom_query(
+ "db-tenant-test",
+ "CREATE (n) RETURN n",
+ "provider-1",
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
+ )
-def test_execute_custom_query_wraps_graph_errors():
- with (
- patch(
- "api.attack_paths.views_helpers.graph_database.execute_read_query",
- side_effect=graph_database.GraphDatabaseQueryException("boom"),
- ),
- patch("api.attack_paths.views_helpers.logger") as mock_logger,
- ):
+def test_execute_custom_query_wraps_graph_errors(sink_backend_stub):
+ sink_backend_stub.execute_read_query.side_effect = (
+ graph_database.GraphDatabaseQueryException("boom")
+ )
+ with patch("api.attack_paths.views_helpers.logger") as mock_logger:
with pytest.raises(APIException):
views_helpers.execute_custom_query(
- "db-tenant-test", "MATCH (n) RETURN n", "provider-1"
+ "db-tenant-test",
+ "MATCH (n) RETURN n",
+ "provider-1",
+ scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
)
mock_logger.error.assert_called_once()
@@ -561,13 +592,33 @@ def test_truncate_graph_empty_graph():
@pytest.fixture
def mock_neo4j_session():
- """Mock the Neo4j driver so execute_read_query uses a fake session."""
+ """Install a Neo4jSink with a mocked Bolt driver into the sink factory.
+
+ The yielded mock is the `neo4j.Session` that the Neo4jSink will obtain via
+ `driver.session(...)`. Tests configure `mock_neo4j_session.execute_read`
+ return values / side effects to exercise the read-mode error translation
+ path on the real `Neo4jSink.execute_read_query` and `get_session` code.
+ """
+ from api.attack_paths.sink import factory
+ from api.attack_paths.sink.neo4j import Neo4jSink
+
mock_session = MagicMock(spec=neo4j.Session)
mock_driver = MagicMock(spec=neo4j.Driver)
mock_driver.session.return_value = mock_session
- with patch("api.attack_paths.database.get_driver", return_value=mock_driver):
+ sink = Neo4jSink()
+ sink._driver = mock_driver
+
+ previous_backend = factory._backend
+ previous_secondary = dict(factory._secondary_backends)
+ factory._backend = sink
+ factory._secondary_backends.clear()
+ try:
yield mock_session
+ finally:
+ factory._backend = previous_backend
+ factory._secondary_backends.clear()
+ factory._secondary_backends.update(previous_secondary)
def test_execute_read_query_succeeds_with_select(mock_neo4j_session):
@@ -663,16 +714,20 @@ def test_execute_read_query_rejects_apoc_real_create(mock_neo4j_session, cypher)
@pytest.fixture
def mock_schema_session():
- """Mock get_session for cartography schema tests."""
+ """Mock the routed sink backend session for cartography schema tests."""
mock_result = MagicMock()
mock_session = MagicMock()
mock_session.run.return_value = mock_result
+ mock_backend = MagicMock()
with patch(
- "api.attack_paths.views_helpers.graph_database.get_session"
- ) as mock_get_session:
- mock_get_session.return_value.__enter__ = MagicMock(return_value=mock_session)
- mock_get_session.return_value.__exit__ = MagicMock(return_value=False)
+ "api.attack_paths.views_helpers.sink_module.get_backend_for_scan",
+ return_value=mock_backend,
+ ):
+ mock_backend.get_session.return_value.__enter__ = MagicMock(
+ return_value=mock_session
+ )
+ mock_backend.get_session.return_value.__exit__ = MagicMock(return_value=False)
yield mock_session, mock_result
@@ -683,7 +738,9 @@ def test_get_cartography_schema_returns_urls(mock_schema_session):
"module_version": "0.129.0",
}
- result = views_helpers.get_cartography_schema("db-tenant-test", "provider-123")
+ result = views_helpers.get_cartography_schema(
+ "db-tenant-test", "provider-123", MagicMock(sink_backend="neo4j")
+ )
mock_session.run.assert_called_once()
assert result["id"] == "aws-0.129.0"
@@ -699,7 +756,9 @@ def test_get_cartography_schema_returns_none_when_no_data(mock_schema_session):
_, mock_result = mock_schema_session
mock_result.single.return_value = None
- result = views_helpers.get_cartography_schema("db-tenant-test", "provider-123")
+ result = views_helpers.get_cartography_schema(
+ "db-tenant-test", "provider-123", MagicMock(sink_backend="neo4j")
+ )
assert result is None
@@ -721,21 +780,29 @@ def test_get_cartography_schema_extracts_provider(
"module_version": "1.0.0",
}
- result = views_helpers.get_cartography_schema("db-tenant-test", "provider-123")
+ result = views_helpers.get_cartography_schema(
+ "db-tenant-test", "provider-123", MagicMock(sink_backend="neo4j")
+ )
assert result["id"] == f"{expected_provider}-1.0.0"
assert result["provider"] == expected_provider
def test_get_cartography_schema_wraps_database_error():
+ mock_backend = MagicMock()
+ mock_backend.get_session.side_effect = graph_database.GraphDatabaseQueryException(
+ "boom"
+ )
with (
patch(
- "api.attack_paths.views_helpers.graph_database.get_session",
- side_effect=graph_database.GraphDatabaseQueryException("boom"),
+ "api.attack_paths.views_helpers.sink_module.get_backend_for_scan",
+ return_value=mock_backend,
),
patch("api.attack_paths.views_helpers.logger") as mock_logger,
):
with pytest.raises(APIException):
- views_helpers.get_cartography_schema("db-tenant-test", "provider-123")
+ views_helpers.get_cartography_schema(
+ "db-tenant-test", "provider-123", MagicMock(sink_backend="neo4j")
+ )
mock_logger.error.assert_called_once()
diff --git a/api/src/backend/api/tests/test_attack_paths_database.py b/api/src/backend/api/tests/test_attack_paths_database.py
index bf37daf5ee..c4aca45928 100644
--- a/api/src/backend/api/tests/test_attack_paths_database.py
+++ b/api/src/backend/api/tests/test_attack_paths_database.py
@@ -1,623 +1,240 @@
-"""
-Tests for Neo4j database lazy initialization.
+"""Tests for the attack-paths database facade.
-The Neo4j driver is created on first use for every process type; app startup
-never contacts Neo4j. These tests validate the database module behavior itself.
+After the Neptune port, `api.attack_paths.database` is a thin routing shim
+over `api.attack_paths.ingest` (cartography temp DB, always Neo4j) and
+`api.attack_paths.sink` (configurable Neo4j or Neptune). The facade's
+contract is routing by database-name prefix and the public exception
+hierarchy; sink-internal behavior is exercised in `test_sink.py`.
"""
-import threading
from unittest.mock import MagicMock, patch
import api.attack_paths.database as db_module
-import neo4j
-import neo4j.exceptions
import pytest
-class TestLazyInitialization:
- """Test that Neo4j driver is initialized lazily on first use."""
-
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- """Reset module-level singleton state before each test."""
- original_driver = db_module._driver
-
- db_module._driver = None
-
- yield
-
- db_module._driver = original_driver
-
- def test_driver_not_initialized_at_import(self):
- """Driver should be None after module import (no eager connection)."""
- assert db_module._driver is None
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_init_driver_creates_connection_on_first_call(
- self, mock_driver_factory, mock_settings
- ):
- """init_driver() should create connection only when called."""
- mock_driver = MagicMock()
- mock_driver_factory.return_value = mock_driver
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- assert db_module._driver is None
-
- result = db_module.init_driver()
-
- mock_driver_factory.assert_called_once()
- mock_driver.verify_connectivity.assert_called_once()
- assert result is mock_driver
- assert db_module._driver is mock_driver
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_init_driver_leaves_driver_none_when_verify_fails(
- self, mock_driver_factory, mock_settings
- ):
- """A failed verify_connectivity() must not publish or leak the driver."""
- mock_driver = MagicMock()
- mock_driver.verify_connectivity.side_effect = (
- neo4j.exceptions.ServiceUnavailable("down")
+class TestDatabaseNameHelper:
+ def test_tenant_name_lowercases_uuid(self):
+ assert (
+ db_module.get_database_name("ABC-123", temporary=False)
+ == "db-tenant-abc-123"
)
- mock_driver_factory.return_value = mock_driver
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
- with pytest.raises(neo4j.exceptions.ServiceUnavailable):
- db_module.init_driver()
-
- assert db_module._driver is None
- mock_driver.close.assert_called_once()
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_init_driver_returns_cached_driver_on_subsequent_calls(
- self, mock_driver_factory, mock_settings
- ):
- """Subsequent calls should return cached driver without reconnecting."""
- mock_driver = MagicMock()
- mock_driver_factory.return_value = mock_driver
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- first_result = db_module.init_driver()
- second_result = db_module.init_driver()
- third_result = db_module.init_driver()
-
- # Only one connection attempt
- assert mock_driver_factory.call_count == 1
- assert mock_driver.verify_connectivity.call_count == 1
-
- # All calls return same instance
- assert first_result is second_result is third_result
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_get_driver_delegates_to_init_driver(
- self, mock_driver_factory, mock_settings
- ):
- """get_driver() should use init_driver() for lazy initialization."""
- mock_driver = MagicMock()
- mock_driver_factory.return_value = mock_driver
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- result = db_module.get_driver()
-
- assert result is mock_driver
- mock_driver_factory.assert_called_once()
+ def test_temporary_name_uses_tmp_scan_prefix(self):
+ assert (
+ db_module.get_database_name("XYZ-789", temporary=True)
+ == "db-tmp-scan-xyz-789"
+ )
-class TestConnectionAcquisitionTimeout:
- """Test that the connection acquisition timeout is configurable."""
+class TestExceptionHierarchy:
+ """`tasks/` and `api/v1/views.py` import these from the facade."""
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- original_driver = db_module._driver
- original_acq_timeout = db_module.CONN_ACQUISITION_TIMEOUT
- original_conn_timeout = db_module.CONNECTION_TIMEOUT
+ def test_write_query_is_graph_database_exception(self):
+ assert issubclass(
+ db_module.WriteQueryNotAllowedException,
+ db_module.GraphDatabaseQueryException,
+ )
- db_module._driver = None
+ def test_client_statement_is_graph_database_exception(self):
+ assert issubclass(
+ db_module.ClientStatementException, db_module.GraphDatabaseQueryException
+ )
- yield
+ def test_exception_str_includes_code_when_set(self):
+ exc = db_module.GraphDatabaseQueryException(
+ message="boom", code="Neo.ClientError.X.Y"
+ )
+ assert str(exc) == "Neo.ClientError.X.Y: boom"
- db_module._driver = original_driver
- db_module.CONN_ACQUISITION_TIMEOUT = original_acq_timeout
- db_module.CONNECTION_TIMEOUT = original_conn_timeout
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_driver_receives_configured_timeout(
- self, mock_driver_factory, mock_settings
- ):
- """init_driver() should pass the configured timeouts to the neo4j driver."""
- mock_driver_factory.return_value = MagicMock()
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
- db_module.CONN_ACQUISITION_TIMEOUT = 42
- db_module.CONNECTION_TIMEOUT = 7
-
- db_module.init_driver()
-
- _, kwargs = mock_driver_factory.call_args
- assert kwargs["connection_acquisition_timeout"] == 42
- assert kwargs["connection_timeout"] == 7
+ def test_exception_str_falls_back_to_message_without_code(self):
+ exc = db_module.GraphDatabaseQueryException(message="boom")
+ assert str(exc) == "boom"
-class TestAtexitRegistration:
- """Test that atexit cleanup handler is registered correctly."""
+class TestExecuteReadQueryRoutes:
+ def test_execute_read_query_delegates_to_sink(self, sink_backend_stub):
+ sink_backend_stub.execute_read_query.return_value = "graph"
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- """Reset module-level singleton state before each test."""
- original_driver = db_module._driver
+ result = db_module.execute_read_query(
+ "db-tenant-abc", "MATCH (n) RETURN n", {"provider_uid": "123"}
+ )
- db_module._driver = None
+ sink_backend_stub.execute_read_query.assert_called_once_with(
+ "db-tenant-abc", "MATCH (n) RETURN n", {"provider_uid": "123"}
+ )
+ assert result == "graph"
- yield
+ def test_execute_read_query_defaults_parameters_to_none(self, sink_backend_stub):
+ db_module.execute_read_query("db-tenant-abc", "MATCH (n) RETURN n")
- db_module._driver = original_driver
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.atexit.register")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_atexit_registered_on_first_init(
- self, mock_driver_factory, mock_atexit_register, mock_settings
- ):
- """atexit.register should be called on first initialization."""
- mock_driver_factory.return_value = MagicMock()
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- db_module.init_driver()
-
- mock_atexit_register.assert_called_once_with(db_module.close_driver)
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.atexit.register")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_atexit_registered_only_once(
- self, mock_driver_factory, mock_atexit_register, mock_settings
- ):
- """atexit.register should only be called once across multiple inits.
-
- The double-checked locking on _driver ensures the atexit registration
- block only executes once (when _driver is first created).
- """
- mock_driver_factory.return_value = MagicMock()
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- db_module.init_driver()
- db_module.init_driver()
- db_module.init_driver()
-
- # Only registered once because subsequent calls hit the fast path
- assert mock_atexit_register.call_count == 1
+ sink_backend_stub.execute_read_query.assert_called_once_with(
+ "db-tenant-abc", "MATCH (n) RETURN n", None
+ )
-class TestCloseDriver:
- """Test driver cleanup functionality."""
+class TestScanDatabaseAvailability:
+ def test_verify_scan_databases_available_checks_ingest_and_sink(self):
+ with (
+ patch("api.attack_paths.database.ingest") as mock_ingest,
+ patch("api.attack_paths.database.get_driver") as mock_get_driver,
+ ):
+ db_module.verify_scan_databases_available()
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- """Reset module-level singleton state before each test."""
- original_driver = db_module._driver
+ mock_ingest.get_driver.return_value.verify_connectivity.assert_called_once_with()
+ mock_get_driver.return_value.verify_connectivity.assert_called_once_with()
- db_module._driver = None
-
- yield
-
- db_module._driver = original_driver
-
- def test_close_driver_closes_and_clears_driver(self):
- """close_driver() should close the driver and set it to None."""
- mock_driver = MagicMock()
- db_module._driver = mock_driver
-
- db_module.close_driver()
-
- mock_driver.close.assert_called_once()
- assert db_module._driver is None
-
- def test_close_driver_handles_none_driver(self):
- """close_driver() should handle case where driver is None."""
- db_module._driver = None
-
- # Should not raise
- db_module.close_driver()
-
- assert db_module._driver is None
-
- def test_close_driver_clears_driver_even_on_close_error(self):
- """Driver should be cleared even if close() raises an exception."""
- mock_driver = MagicMock()
- mock_driver.close.side_effect = Exception("Connection error")
- db_module._driver = mock_driver
-
- with pytest.raises(Exception, match="Connection error"):
- db_module.close_driver()
-
- # Driver should still be cleared
- assert db_module._driver is None
-
-
-class TestExecuteReadQuery:
- """Test read query execution helper."""
-
- def test_execute_read_query_calls_read_session_and_returns_result(self):
- tx = MagicMock()
- expected_graph = MagicMock()
- run_result = MagicMock()
- run_result.graph.return_value = expected_graph
- tx.run.return_value = run_result
-
- session = MagicMock()
-
- def execute_read_side_effect(fn):
- return fn(tx)
-
- session.execute_read.side_effect = execute_read_side_effect
-
- session_ctx = MagicMock()
- session_ctx.__enter__.return_value = session
- session_ctx.__exit__.return_value = False
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ) as mock_get_session:
- result = db_module.execute_read_query(
- "db-tenant-test-tenant-id",
- "MATCH (n) RETURN n",
- {"provider_uid": "123"},
+ def test_verify_scan_databases_available_raises_when_ingest_is_down(self):
+ with (
+ patch("api.attack_paths.database.ingest") as mock_ingest,
+ patch("api.attack_paths.database.get_driver"),
+ ):
+ mock_ingest.get_driver.return_value.verify_connectivity.side_effect = (
+ RuntimeError("ingest down")
)
- mock_get_session.assert_called_once_with(
- "db-tenant-test-tenant-id",
- default_access_mode=neo4j.READ_ACCESS,
+ with pytest.raises(RuntimeError) as exc:
+ db_module.verify_scan_databases_available()
+
+ assert "Attack Paths graph database unavailable before scan start" in str(
+ exc.value
)
- session.execute_read.assert_called_once()
- tx.run.assert_called_once_with(
- "MATCH (n) RETURN n",
- {"provider_uid": "123"},
- timeout=db_module.READ_QUERY_TIMEOUT_SECONDS,
- )
- run_result.graph.assert_called_once_with()
- assert result is expected_graph
+ assert "ingest Neo4j: ingest down" in str(exc.value)
- def test_execute_read_query_defaults_parameters_to_empty_dict(self):
- tx = MagicMock()
- run_result = MagicMock()
- run_result.graph.return_value = MagicMock()
- tx.run.return_value = run_result
+ def test_verify_scan_databases_available_raises_when_sink_is_down(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
- session = MagicMock()
- session.execute_read.side_effect = lambda fn: fn(tx)
-
- session_ctx = MagicMock()
- session_ctx.__enter__.return_value = session
- session_ctx.__exit__.return_value = False
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
+ with (
+ patch("api.attack_paths.database.ingest"),
+ patch("api.attack_paths.database.get_driver") as mock_get_driver,
):
- db_module.execute_read_query(
- "db-tenant-test-tenant-id",
- "MATCH (n) RETURN n",
+ mock_get_driver.return_value.verify_connectivity.side_effect = RuntimeError(
+ "writer down"
)
- tx.run.assert_called_once_with(
- "MATCH (n) RETURN n",
- {},
- timeout=db_module.READ_QUERY_TIMEOUT_SECONDS,
- )
- run_result.graph.assert_called_once_with()
+ with pytest.raises(RuntimeError) as exc:
+ db_module.verify_scan_databases_available()
+ assert "sink neptune: writer down" in str(exc.value)
-class TestGetSessionReadOnly:
- """Test that get_session translates Neo4j read-mode errors."""
+ def test_verify_scan_databases_available_reports_both_failures(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- original_driver = db_module._driver
- db_module._driver = None
- yield
- db_module._driver = original_driver
-
- @pytest.mark.parametrize(
- "neo4j_code",
- [
- "Neo.ClientError.Statement.AccessMode",
- "Neo.ClientError.Procedure.ProcedureNotFound",
- ],
- )
- def test_get_session_raises_write_query_not_allowed(self, neo4j_code):
- """Read-mode Neo4j errors should raise `WriteQueryNotAllowedException`."""
- mock_session = MagicMock()
- neo4j_error = neo4j.exceptions.Neo4jError._hydrate_neo4j(
- code=neo4j_code,
- message="Write operations are not allowed",
- )
- mock_session.run.side_effect = neo4j_error
-
- mock_driver = MagicMock()
- mock_driver.session.return_value = mock_session
- db_module._driver = mock_driver
-
- with pytest.raises(db_module.WriteQueryNotAllowedException):
- with db_module.get_session(
- default_access_mode=neo4j.READ_ACCESS
- ) as session:
- session.run("CREATE (n) RETURN n")
-
- def test_get_session_raises_generic_exception_for_other_errors(self):
- """Non-read-mode Neo4j errors should raise GraphDatabaseQueryException."""
- mock_session = MagicMock()
- neo4j_error = neo4j.exceptions.Neo4jError._hydrate_neo4j(
- code="Neo.ClientError.Statement.SyntaxError",
- message="Invalid syntax",
- )
- mock_session.run.side_effect = neo4j_error
-
- mock_driver = MagicMock()
- mock_driver.session.return_value = mock_session
- db_module._driver = mock_driver
-
- with pytest.raises(db_module.GraphDatabaseQueryException):
- with db_module.get_session(
- default_access_mode=neo4j.READ_ACCESS
- ) as session:
- session.run("INVALID CYPHER")
-
-
-class TestThreadSafety:
- """Test thread-safe initialization."""
-
- @pytest.fixture(autouse=True)
- def reset_module_state(self):
- """Reset module-level singleton state before each test."""
- original_driver = db_module._driver
-
- db_module._driver = None
-
- yield
-
- db_module._driver = original_driver
-
- @patch("api.attack_paths.database.settings")
- @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
- def test_concurrent_init_creates_single_driver(
- self, mock_driver_factory, mock_settings
- ):
- """Multiple threads calling init_driver() should create only one driver."""
- mock_driver = MagicMock()
- mock_driver_factory.return_value = mock_driver
- mock_settings.DATABASES = {
- "neo4j": {
- "HOST": "localhost",
- "PORT": 7687,
- "USER": "neo4j",
- "PASSWORD": "password",
- }
- }
-
- results = []
- errors = []
-
- def call_init():
- try:
- result = db_module.init_driver()
- results.append(result)
- except Exception as e:
- errors.append(e)
-
- threads = [threading.Thread(target=call_init) for _ in range(10)]
-
- for t in threads:
- t.start()
- for t in threads:
- t.join()
-
- assert not errors, f"Threads raised errors: {errors}"
-
- # Only one driver created
- assert mock_driver_factory.call_count == 1
-
- # All threads got the same driver instance
- assert all(r is mock_driver for r in results)
- assert len(results) == 10
-
-
-class TestHasProviderData:
- """Test has_provider_data helper for checking provider nodes in Neo4j."""
-
- def test_returns_true_when_nodes_exist(self):
- mock_session = MagicMock()
- mock_result = MagicMock()
- mock_result.single.return_value = MagicMock() # non-None record
- mock_session.run.return_value = mock_result
-
- session_ctx = MagicMock()
- session_ctx.__enter__.return_value = mock_session
- session_ctx.__exit__.return_value = False
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
+ with (
+ patch("api.attack_paths.database.ingest") as mock_ingest,
+ patch("api.attack_paths.database.get_driver") as mock_get_driver,
):
- assert db_module.has_provider_data("db-tenant-abc", "provider-123") is True
-
- mock_session.run.assert_called_once()
-
- def test_returns_false_when_no_nodes(self):
- mock_session = MagicMock()
- mock_result = MagicMock()
- mock_result.single.return_value = None
- mock_session.run.return_value = mock_result
-
- session_ctx = MagicMock()
- session_ctx.__enter__.return_value = mock_session
- session_ctx.__exit__.return_value = False
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ):
- assert db_module.has_provider_data("db-tenant-abc", "provider-123") is False
-
- def test_returns_false_when_database_not_found(self):
- session_ctx = MagicMock()
- session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
- message="Database does not exist",
- code="Neo.ClientError.Database.DatabaseNotFound",
- )
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ):
- assert (
- db_module.has_provider_data("db-tenant-gone", "provider-123") is False
+ mock_ingest.get_driver.return_value.verify_connectivity.side_effect = (
+ RuntimeError("ingest down")
+ )
+ mock_get_driver.return_value.verify_connectivity.side_effect = RuntimeError(
+ "sink down"
)
- def test_raises_on_other_errors(self):
- session_ctx = MagicMock()
- session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
- message="Connection refused",
- code="Neo.TransientError.General.UnknownError",
+ with pytest.raises(RuntimeError) as exc:
+ db_module.verify_scan_databases_available()
+
+ assert "ingest Neo4j: ingest down" in str(exc.value)
+ assert "sink neo4j: sink down" in str(exc.value)
+
+
+class TestSinkOperationsDelegation:
+ def test_has_provider_data_delegates_to_sink(self, sink_backend_stub):
+ sink_backend_stub.has_provider_data.return_value = True
+
+ assert db_module.has_provider_data("db-tenant-abc", "provider-123") is True
+ sink_backend_stub.has_provider_data.assert_called_once_with(
+ "db-tenant-abc", "provider-123"
)
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ):
- with pytest.raises(db_module.GraphDatabaseQueryException):
- db_module.has_provider_data("db-tenant-abc", "provider-123")
+ def test_drop_subgraph_delegates_to_sink(self, sink_backend_stub):
+ sink_backend_stub.drop_subgraph.return_value = 42
-
-class TestDropSubgraph:
- """Test drop_subgraph two-phase batched deletion of a provider's graph."""
-
- @staticmethod
- def _result(count):
- result = MagicMock()
- result.single.return_value.get.return_value = count
- return result
-
- @staticmethod
- def _session_ctx(session):
- ctx = MagicMock()
- ctx.__enter__.return_value = session
- ctx.__exit__.return_value = False
- return ctx
-
- def test_deletes_relationships_then_nodes_in_batches(self):
- session = MagicMock()
- # Phase 1 (relationships): one full batch then empty.
- # Phase 2 (nodes): one full batch then empty.
- session.run.side_effect = [
- self._result(1000),
- self._result(0),
- self._result(1000),
- self._result(0),
- ]
-
- with patch(
- "api.attack_paths.database.get_session",
- return_value=self._session_ctx(session),
- ):
- deleted = db_module.drop_subgraph("db-tenant-abc", "provider-123")
-
- # Only phase-2 node counts contribute to the return value.
- assert deleted == 1000
- assert session.run.call_count == 4
-
- queries = [call.args[0] for call in session.run.call_args_list]
-
- # Regression guard: the memory blow-up was caused by DETACH DELETE.
- assert all("DETACH DELETE" not in query for query in queries)
-
- rel_queries = [query for query in queries if "DELETE r" in query]
- node_queries = [query for query in queries if "DELETE n" in query]
- assert rel_queries and node_queries
- # DISTINCT avoids double-counting relationships matched from both ends.
- assert all("DISTINCT r" in query for query in rel_queries)
-
- # Relationships must be fully drained before nodes are deleted.
- first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
- last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
- assert last_rel < first_node
-
- def test_returns_zero_when_database_not_found(self):
- session_ctx = MagicMock()
- session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
- message="Database does not exist",
- code="Neo.ClientError.Database.DatabaseNotFound",
+ assert db_module.drop_subgraph("db-tenant-abc", "provider-123") == 42
+ sink_backend_stub.drop_subgraph.assert_called_once_with(
+ "db-tenant-abc", "provider-123"
)
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ):
- assert db_module.drop_subgraph("db-tenant-gone", "provider-123") == 0
- def test_raises_on_other_errors(self):
- session_ctx = MagicMock()
- session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
- message="Connection refused",
- code="Neo.TransientError.General.UnknownError",
- )
+class TestRoutingByDatabasePrefix:
+ """`db-tmp-scan-*` and `None` route to ingest; everything else to sink."""
- with patch(
- "api.attack_paths.database.get_session",
- return_value=session_ctx,
- ):
- with pytest.raises(db_module.GraphDatabaseQueryException):
- db_module.drop_subgraph("db-tenant-abc", "provider-123")
+ def test_create_database_routes_temp_to_ingest(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.create_database("db-tmp-scan-uuid-1")
+
+ mock_ingest.create_database.assert_called_once_with("db-tmp-scan-uuid-1")
+ sink_backend_stub.create_database.assert_not_called()
+
+ def test_create_database_routes_tenant_to_sink(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.create_database("db-tenant-abc")
+
+ sink_backend_stub.create_database.assert_called_once_with("db-tenant-abc")
+ mock_ingest.create_database.assert_not_called()
+
+ def test_drop_database_routes_temp_to_ingest(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.drop_database("db-tmp-scan-uuid-1")
+
+ mock_ingest.drop_database.assert_called_once_with("db-tmp-scan-uuid-1")
+ sink_backend_stub.drop_database.assert_not_called()
+
+ def test_drop_database_routes_tenant_to_sink(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.drop_database("db-tenant-abc")
+
+ sink_backend_stub.drop_database.assert_called_once_with("db-tenant-abc")
+ mock_ingest.drop_database.assert_not_called()
+
+ def test_clear_cache_routes_temp_to_ingest(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.clear_cache("db-tmp-scan-uuid-1")
+
+ mock_ingest.clear_cache.assert_called_once_with("db-tmp-scan-uuid-1")
+ sink_backend_stub.clear_cache.assert_not_called()
+
+ def test_clear_cache_routes_tenant_to_sink(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ db_module.clear_cache("db-tenant-abc")
+
+ sink_backend_stub.clear_cache.assert_called_once_with("db-tenant-abc")
+ mock_ingest.clear_cache.assert_not_called()
+
+ def test_get_session_routes_temp_to_ingest(self, sink_backend_stub):
+ sentinel = MagicMock()
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ mock_ingest.get_session.return_value = sentinel
+
+ result = db_module.get_session("db-tmp-scan-uuid-1")
+
+ assert result is sentinel
+ mock_ingest.get_session.assert_called_once()
+ sink_backend_stub.get_session.assert_not_called()
+
+ def test_get_session_routes_none_to_ingest(self, sink_backend_stub):
+ sentinel = MagicMock()
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ mock_ingest.get_session.return_value = sentinel
+
+ result = db_module.get_session(None)
+
+ assert result is sentinel
+ sink_backend_stub.get_session.assert_not_called()
+
+ def test_get_ingest_uri_delegates_to_ingest(self, sink_backend_stub):
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ mock_ingest.get_uri.return_value = "bolt://neo4j:7687"
+
+ assert db_module.get_ingest_uri() == "bolt://neo4j:7687"
+
+ mock_ingest.get_uri.assert_called_once_with()
+
+ def test_get_session_routes_tenant_to_sink(self, sink_backend_stub):
+ sentinel = MagicMock()
+ sink_backend_stub.get_session.return_value = sentinel
+ with patch("api.attack_paths.database.ingest") as mock_ingest:
+ result = db_module.get_session("db-tenant-abc")
+
+ assert result is sentinel
+ mock_ingest.get_session.assert_not_called()
diff --git a/api/src/backend/api/tests/test_cypher_sanitizer.py b/api/src/backend/api/tests/test_cypher_sanitizer.py
index 6caca47a56..c0d4f9b7ff 100644
--- a/api/src/backend/api/tests/test_cypher_sanitizer.py
+++ b/api/src/backend/api/tests/test_cypher_sanitizer.py
@@ -4,6 +4,7 @@ from unittest.mock import patch
import pytest
from api.attack_paths.cypher_sanitizer import (
+ inject_label,
inject_provider_label,
validate_custom_query,
)
@@ -21,6 +22,13 @@ def _inject(cypher: str) -> str:
return inject_provider_label(cypher, PROVIDER_ID)
+def test_generic_inject_label_reuses_provider_injection_pipeline():
+ result = inject_label("MATCH (n:AWSRole)--(m) RETURN n, m", "_Tenant_test")
+
+ assert "(n:AWSRole:_Tenant_test)" in result
+ assert "(m:_Tenant_test)" in result
+
+
# ---------------------------------------------------------------------------
# Pass A - Labeled node patterns (all clauses)
# ---------------------------------------------------------------------------
diff --git a/api/src/backend/api/tests/test_db_utils.py b/api/src/backend/api/tests/test_db_utils.py
index 06b528b44a..347be2b64d 100644
--- a/api/src/backend/api/tests/test_db_utils.py
+++ b/api/src/backend/api/tests/test_db_utils.py
@@ -1,11 +1,16 @@
+from contextlib import contextmanager
from datetime import UTC, datetime
from enum import Enum
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock, call, patch
import pytest
from api.db_utils import (
POSTGRES_TENANT_VAR,
+ SET_CONFIG_QUERY,
+ SET_TRANSACTION_READ_ONLY_QUERY,
PostgresEnumMigration,
+ _is_replica_connection_failure,
+ _is_safe_primary_replay,
_should_create_index_on_partition,
batch_delete,
create_objects_in_batches,
@@ -392,10 +397,23 @@ class TestRlsTransaction:
with patch("api.db_utils.get_read_db_alias", return_value=None):
with patch("api.db_utils.connections") as mock_connections:
- mock_conn = MagicMock()
- mock_cursor = MagicMock()
- mock_conn.cursor.return_value.__enter__.return_value = mock_cursor
- mock_connections.__getitem__.return_value = mock_conn
+ mock_replica_conn = MagicMock()
+ mock_replica_cursor = MagicMock()
+ mock_replica_conn.cursor.return_value.__enter__.return_value = (
+ mock_replica_cursor
+ )
+ mock_primary_conn = MagicMock()
+ mock_primary_cursor = MagicMock()
+ mock_primary_conn.cursor.return_value.__enter__.return_value = (
+ mock_primary_cursor
+ )
+
+ def connections_getitem(alias):
+ if alias == "replica":
+ return mock_replica_conn
+ return mock_primary_conn
+
+ mock_connections.__getitem__.side_effect = connections_getitem
mock_connections.__contains__.return_value = True
with patch("api.db_utils.transaction.atomic"):
@@ -525,7 +543,7 @@ class TestRlsTransaction:
def atomic_side_effect(*args, **kwargs):
nonlocal call_count
call_count += 1
- if call_count < 3:
+ if call_count < 4:
raise OperationalError("Connection error")
return MagicMock(
__enter__=MagicMock(return_value=None),
@@ -544,10 +562,11 @@ class TestRlsTransaction:
with rls_transaction(tenant_id):
pass
- assert mock_sleep.call_count == 2
+ assert mock_sleep.call_count == 3
mock_sleep.assert_any_call(0.5)
mock_sleep.assert_any_call(1.0)
- assert mock_logger.info.call_count == 2
+ mock_sleep.assert_any_call(2.0)
+ assert mock_logger.info.call_count == 3
def test_rls_transaction_operational_error_inside_context_no_retry(
self, tenants_fixture, enable_read_replica
@@ -578,11 +597,12 @@ class TestRlsTransaction:
raise OperationalError("Conflict with recovery")
mock_sleep.assert_not_called()
+ mock_conn.close.assert_not_called()
- def test_rls_transaction_max_three_attempts_for_replica(
+ def test_rls_transaction_max_attempts_for_replica(
self, tenants_fixture, enable_read_replica
):
- """Test maximum 3 attempts for replica database."""
+ """Test REPLICA_MAX_ATTEMPTS replica tries + 1 primary fallback."""
tenant = tenants_fixture[0]
tenant_id = str(tenant.id)
@@ -606,7 +626,11 @@ class TestRlsTransaction:
with rls_transaction(tenant_id):
pass
- assert mock_atomic.call_count == 3
+ assert mock_atomic.call_args_list[-1] == call(
+ using=DEFAULT_DB_ALIAS
+ )
+ # 3 replica + 1 primary = 4 total
+ assert mock_atomic.call_count == 4
def test_rls_transaction_replica_no_retry_when_disabled(
self, tenants_fixture, enable_read_replica
@@ -617,10 +641,23 @@ class TestRlsTransaction:
with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
with patch("api.db_utils.connections") as mock_connections:
- mock_conn = MagicMock()
- mock_cursor = MagicMock()
- mock_conn.cursor.return_value.__enter__.return_value = mock_cursor
- mock_connections.__getitem__.return_value = mock_conn
+ mock_replica_conn = MagicMock()
+ mock_replica_cursor = MagicMock()
+ mock_replica_conn.cursor.return_value.__enter__.return_value = (
+ mock_replica_cursor
+ )
+ mock_primary_conn = MagicMock()
+ mock_primary_cursor = MagicMock()
+ mock_primary_conn.cursor.return_value.__enter__.return_value = (
+ mock_primary_cursor
+ )
+
+ def connections_getitem(alias):
+ if alias == "replica":
+ return mock_replica_conn
+ return mock_primary_conn
+
+ mock_connections.__getitem__.side_effect = connections_getitem
mock_connections.__contains__.return_value = True
with patch("api.db_utils.transaction.atomic") as mock_atomic:
@@ -682,7 +719,7 @@ class TestRlsTransaction:
def atomic_side_effect(*args, **kwargs):
nonlocal call_count
call_count += 1
- if call_count < 3:
+ if call_count < 4:
raise OperationalError("Replica error")
return MagicMock(
__enter__=MagicMock(return_value=None),
@@ -691,7 +728,7 @@ class TestRlsTransaction:
with patch(
"api.db_utils.transaction.atomic", side_effect=atomic_side_effect
- ):
+ ) as mock_atomic:
with patch("api.db_utils.time.sleep"):
with patch(
"api.db_utils.set_read_db_alias", return_value="token"
@@ -701,6 +738,9 @@ class TestRlsTransaction:
with rls_transaction(tenant_id):
pass
+ assert mock_atomic.call_args_list[-1] == call(
+ using=DEFAULT_DB_ALIAS
+ )
mock_logger.warning.assert_called_once()
warning_msg = mock_logger.warning.call_args[0][0]
assert "falling back to primary DB" in warning_msg
@@ -725,7 +765,7 @@ class TestRlsTransaction:
def atomic_side_effect(*args, **kwargs):
nonlocal call_count
call_count += 1
- if call_count < 3:
+ if call_count < 4:
raise OperationalError("Replica error")
return MagicMock(
__enter__=MagicMock(return_value=None),
@@ -744,7 +784,7 @@ class TestRlsTransaction:
with rls_transaction(tenant_id):
pass
- assert mock_logger.info.call_count == 2
+ assert mock_logger.info.call_count == 3
assert mock_logger.warning.call_count == 1
def test_rls_transaction_operational_error_raised_immediately_on_primary(
@@ -910,6 +950,520 @@ class TestRlsTransaction:
result = cursor.fetchone()
assert result[0] == 1
+ # --- Mid-query failover tests ---
+
+ class _FakeDatabaseError(Exception):
+ def __init__(self, message, pgcode=None):
+ super().__init__(message)
+ self.pgcode = pgcode
+
+ def _install_execute_wrapper(self, connection):
+ connection.execute_wrappers = []
+
+ @contextmanager
+ def _execute_wrapper(fn):
+ connection.execute_wrappers.append(fn)
+ try:
+ yield
+ finally:
+ connection.execute_wrappers.remove(fn)
+
+ connection.execute_wrapper = _execute_wrapper
+
+ def _mock_replica_and_primary_connections(self, mock_connections):
+ mock_replica_conn = MagicMock()
+ self._install_execute_wrapper(mock_replica_conn)
+ mock_replica_cursor = MagicMock()
+ mock_replica_conn.cursor.return_value.__enter__.return_value = (
+ mock_replica_cursor
+ )
+
+ mock_primary_conn = MagicMock()
+ mock_primary_cursor = MagicMock()
+ mock_primary_raw_cursor = MagicMock()
+ mock_primary_cursor.cursor = mock_primary_raw_cursor
+ mock_primary_conn.cursor.return_value = mock_primary_cursor
+
+ def connections_getitem(alias):
+ if alias == "replica":
+ return mock_replica_conn
+ return mock_primary_conn
+
+ mock_connections.__getitem__.side_effect = connections_getitem
+ mock_connections.__contains__.return_value = True
+
+ return mock_replica_conn, mock_primary_conn, mock_primary_cursor
+
+ @pytest.mark.parametrize(
+ "error",
+ [
+ _FakeDatabaseError("connection lost", pgcode="08006"),
+ _FakeDatabaseError("terminating connection", pgcode="57P01"),
+ OperationalError("SSL SYSCALL error: EOF detected"),
+ OperationalError("server closed the connection unexpectedly"),
+ OperationalError("database system is starting up"),
+ ],
+ )
+ def test_replica_connection_failure_detection_allows_failover(self, error):
+ assert _is_replica_connection_failure(error)
+
+ @pytest.mark.parametrize(
+ "error",
+ [
+ _FakeDatabaseError("canceling statement", pgcode="57014"),
+ _FakeDatabaseError("could not serialize access", pgcode="40001"),
+ _FakeDatabaseError("deadlock detected", pgcode="40P01"),
+ OperationalError("deadlock detected"),
+ ],
+ )
+ def test_replica_connection_failure_detection_rejects_query_errors(self, error):
+ assert not _is_replica_connection_failure(error)
+
+ @pytest.mark.parametrize(
+ ("sql", "many", "expected"),
+ [
+ ("SELECT 1", False, True),
+ (" -- leading comment\nSELECT 1", False, True),
+ ("/* leading comment */ SELECT 1", False, True),
+ ("SELECT 1", True, False),
+ ("SELECTING 1", False, False),
+ ("INSERT INTO fake_table (name) VALUES (%s)", False, False),
+ ("WITH rows AS (SELECT 1) SELECT * FROM rows", False, False),
+ ("SELECT * INTO fake_table_copy FROM fake_table", False, False),
+ ("SELECT * FROM fake_table FOR UPDATE", False, False),
+ ("SELECT * FROM fake_table FOR SHARE", False, False),
+ ],
+ )
+ def test_primary_replay_safety_detection(self, sql, many, expected):
+ assert _is_safe_primary_replay(sql, many) is expected
+
+ def test_mid_query_failure_falls_directly_back_to_primary(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """Mid-query replica connection loss is replayed once on primary."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ mock_primary_conn,
+ mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+
+ outer_atomic = MagicMock()
+ outer_atomic.__enter__ = MagicMock(return_value=None)
+ outer_atomic.__exit__ = MagicMock(return_value=False)
+ fallback_atomic = MagicMock()
+ fallback_atomic.__enter__ = MagicMock(return_value=None)
+ fallback_atomic.__exit__ = MagicMock(return_value=False)
+
+ with patch(
+ "api.db_utils.transaction.atomic",
+ side_effect=[outer_atomic, fallback_atomic],
+ ) as mock_atomic:
+ with patch("api.db_utils.time.sleep") as mock_sleep:
+ with patch(
+ "api.db_utils.set_read_db_alias",
+ side_effect=["replica-token", "primary-token"],
+ ) as mock_set_alias:
+ with patch(
+ "api.db_utils.reset_read_db_alias"
+ ) as mock_reset_alias:
+ with rls_transaction(tenant_id):
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ context_cursor = MagicMock()
+ mock_execute = MagicMock(
+ side_effect=OperationalError(
+ "SSL SYSCALL error: EOF detected"
+ )
+ )
+
+ wrapper(
+ mock_execute,
+ "SELECT %s",
+ ["value"],
+ False,
+ {"cursor": context_cursor},
+ )
+
+ mock_sleep.assert_not_called()
+ (
+ mock_replica_conn.ensure_connection.assert_not_called()
+ )
+ mock_replica_conn.close.assert_called_once()
+ (
+ mock_primary_conn.ensure_connection.assert_called_once()
+ )
+ mock_primary_conn.cursor.assert_called_once_with()
+ mock_primary_cursor.execute.assert_has_calls(
+ [
+ call(SET_TRANSACTION_READ_ONLY_QUERY),
+ call(
+ SET_CONFIG_QUERY,
+ [POSTGRES_TENANT_VAR, tenant_id],
+ ),
+ call("SELECT %s", ["value"]),
+ ]
+ )
+ assert context_cursor.db == mock_primary_conn
+ assert (
+ context_cursor.cursor
+ == mock_primary_cursor.cursor
+ )
+
+ mock_set_alias.assert_has_calls(
+ [
+ call(enable_read_replica),
+ call(DEFAULT_DB_ALIAS),
+ ]
+ )
+ mock_reset_alias.assert_has_calls(
+ [call("primary-token"), call("replica-token")]
+ )
+ assert mock_atomic.call_args_list == [
+ call(using=enable_read_replica),
+ call(using=DEFAULT_DB_ALIAS),
+ ]
+ assert mock_replica_conn.execute_wrappers == []
+
+ @pytest.mark.parametrize(
+ ("sql", "params", "many"),
+ [
+ ("INSERT INTO fake_table (name) VALUES (%s)", [("one",), ("two",)], True),
+ ("INSERT INTO fake_table (name) VALUES (%s)", ["one"], False),
+ ("UPDATE fake_table SET name = %s", ["one"], False),
+ ("DELETE FROM fake_table WHERE id = %s", [1], False),
+ (
+ "WITH deleted AS (DELETE FROM fake_table RETURNING *) "
+ "SELECT * FROM deleted",
+ None,
+ False,
+ ),
+ ("SELECT * INTO fake_table_copy FROM fake_table", None, False),
+ ],
+ )
+ def test_mid_query_fallback_rejects_unsafe_replay(
+ self, tenants_fixture, enable_read_replica, sql, params, many
+ ):
+ """Only single SELECT statements are replayed on primary."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ mock_primary_conn,
+ mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+
+ with patch("api.db_utils.transaction.atomic") as mock_atomic:
+ mock_atomic.return_value.__enter__ = MagicMock(return_value=None)
+ mock_atomic.return_value.__exit__ = MagicMock(return_value=False)
+ with patch(
+ "api.db_utils.set_read_db_alias",
+ side_effect=["replica-token", "primary-token"],
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with rls_transaction(tenant_id):
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ mock_execute = MagicMock(
+ side_effect=OperationalError(
+ "server closed the connection"
+ )
+ )
+
+ with pytest.raises(OperationalError):
+ wrapper(
+ mock_execute,
+ sql,
+ params,
+ many,
+ {"cursor": MagicMock()},
+ )
+
+ mock_primary_conn.ensure_connection.assert_not_called()
+ mock_primary_conn.cursor.assert_not_called()
+ mock_primary_cursor.execute.assert_not_called()
+ mock_primary_cursor.executemany.assert_not_called()
+
+ def test_mid_query_non_connection_error_does_not_fall_back(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """Query/concurrency errors are not replayed on primary."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ mock_primary_conn,
+ _mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+
+ with patch("api.db_utils.transaction.atomic") as mock_atomic:
+ mock_atomic.return_value.__enter__ = MagicMock(return_value=None)
+ mock_atomic.return_value.__exit__ = MagicMock(return_value=False)
+ with patch(
+ "api.db_utils.set_read_db_alias", return_value="replica-token"
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with rls_transaction(tenant_id):
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ mock_execute = MagicMock(
+ side_effect=OperationalError("deadlock detected")
+ )
+
+ with pytest.raises(OperationalError):
+ wrapper(
+ mock_execute,
+ "SELECT 1",
+ None,
+ False,
+ {"cursor": MagicMock()},
+ )
+
+ mock_replica_conn.close.assert_not_called()
+ (
+ mock_primary_conn.ensure_connection.assert_not_called()
+ )
+
+ def test_mid_query_primary_replay_failure_propagates(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """Primary fallback errors propagate as Django OperationalError."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ _mock_primary_conn,
+ mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+ mock_primary_cursor.execute.side_effect = [
+ None,
+ None,
+ OperationalError("primary down"),
+ ]
+
+ with patch("api.db_utils.transaction.atomic") as mock_atomic:
+ mock_atomic.return_value.__enter__ = MagicMock(return_value=None)
+ mock_atomic.return_value.__exit__ = MagicMock(return_value=False)
+ with patch(
+ "api.db_utils.set_read_db_alias",
+ side_effect=["replica-token", "primary-token"],
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with pytest.raises(OperationalError, match="primary down"):
+ with rls_transaction(tenant_id):
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ mock_execute = MagicMock(
+ side_effect=OperationalError(
+ "server closed the connection"
+ )
+ )
+ wrapper(
+ mock_execute,
+ "SELECT 1",
+ None,
+ False,
+ {"cursor": MagicMock()},
+ )
+
+ mock_primary_cursor.close.assert_called_once()
+
+ def test_mid_query_fallback_suppresses_cleanup_error(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """After successful primary fallback, replica cleanup error is suppressed."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ _mock_primary_conn,
+ mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+
+ # Replica's atomic.__exit__ raises on dead replica cleanup;
+ # primary's atomic.__exit__ returns False (healthy commit).
+ mock_outer_atomic = MagicMock()
+ mock_outer_atomic.__enter__ = MagicMock(return_value=None)
+ mock_outer_atomic.__exit__ = MagicMock(
+ side_effect=OperationalError("cleanup failed on dead replica")
+ )
+
+ mock_fallback_atomic = MagicMock()
+ mock_fallback_atomic.__enter__ = MagicMock(return_value=None)
+ mock_fallback_atomic.__exit__ = MagicMock(return_value=False)
+
+ atomic_call_count = 0
+
+ def atomic_side_effect(*args, **kwargs):
+ nonlocal atomic_call_count
+ atomic_call_count += 1
+ if atomic_call_count == 1:
+ return mock_outer_atomic
+ return mock_fallback_atomic
+
+ with patch(
+ "api.db_utils.transaction.atomic",
+ side_effect=atomic_side_effect,
+ ):
+ with patch(
+ "api.db_utils.set_read_db_alias",
+ side_effect=["replica-token", "primary-token"],
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with rls_transaction(tenant_id):
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ mock_execute = MagicMock(
+ side_effect=OperationalError(
+ "server closed the connection"
+ )
+ )
+ mock_context = {"cursor": MagicMock()}
+ wrapper(
+ mock_execute,
+ "SELECT 1",
+ None,
+ False,
+ mock_context,
+ )
+
+ mock_primary_cursor.execute.assert_has_calls(
+ [
+ call(SET_TRANSACTION_READ_ONLY_QUERY),
+ call(
+ SET_CONFIG_QUERY,
+ [POSTGRES_TENANT_VAR, tenant_id],
+ ),
+ call("SELECT 1", None),
+ ]
+ )
+
+ def test_wrapper_not_installed_on_primary(self, tenants_fixture):
+ """execute_wrapper is not installed when targeting primary DB."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=None):
+ with patch("api.db_utils.connections") as mock_connections:
+ mock_conn = MagicMock()
+ mock_conn.execute_wrappers = []
+ mock_cursor = MagicMock()
+ mock_conn.cursor.return_value.__enter__.return_value = mock_cursor
+ mock_connections.__getitem__.return_value = mock_conn
+ mock_connections.__contains__.return_value = True
+
+ with patch("api.db_utils.transaction.atomic") as mock_atomic:
+ mock_atomic.return_value.__enter__ = MagicMock(return_value=None)
+ mock_atomic.return_value.__exit__ = MagicMock(return_value=False)
+
+ with rls_transaction(tenant_id):
+ # No wrapper installed on primary
+ assert len(mock_conn.execute_wrappers) == 0
+
+ def test_stale_connection_closed_on_pre_yield_retry(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """Stale connection is closed before each pre-yield retry."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ mock_conn = MagicMock()
+ mock_conn.execute_wrappers = []
+ mock_cursor = MagicMock()
+ mock_conn.cursor.return_value.__enter__.return_value = mock_cursor
+ mock_connections.__getitem__.return_value = mock_conn
+ mock_connections.__contains__.return_value = True
+
+ call_count = 0
+
+ def atomic_side_effect(*args, **kwargs):
+ nonlocal call_count
+ call_count += 1
+ if call_count < 3:
+ raise OperationalError("Connection error")
+ return MagicMock(
+ __enter__=MagicMock(return_value=None),
+ __exit__=MagicMock(return_value=False),
+ )
+
+ with patch(
+ "api.db_utils.transaction.atomic", side_effect=atomic_side_effect
+ ):
+ with patch("api.db_utils.time.sleep"):
+ with patch(
+ "api.db_utils.set_read_db_alias", return_value="token"
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with rls_transaction(tenant_id):
+ pass
+
+ # close() called for each failed pre-yield attempt
+ assert mock_conn.close.call_count == 2
+
+ def test_caller_error_propagates_after_successful_failover(
+ self, tenants_fixture, enable_read_replica
+ ):
+ """OperationalError raised by caller after failover is NOT suppressed."""
+ tenant = tenants_fixture[0]
+ tenant_id = str(tenant.id)
+
+ with patch("api.db_utils.get_read_db_alias", return_value=enable_read_replica):
+ with patch("api.db_utils.connections") as mock_connections:
+ (
+ mock_replica_conn,
+ _mock_primary_conn,
+ _mock_primary_cursor,
+ ) = self._mock_replica_and_primary_connections(mock_connections)
+
+ # Transaction cleanup succeeds so the caller error should surface.
+ mock_atomic_cm = MagicMock()
+ mock_atomic_cm.__enter__ = MagicMock(return_value=None)
+ mock_atomic_cm.__exit__ = MagicMock(return_value=False)
+
+ with patch(
+ "api.db_utils.transaction.atomic", return_value=mock_atomic_cm
+ ):
+ with patch("api.db_utils.time.sleep"):
+ with patch(
+ "api.db_utils.set_read_db_alias", return_value="token"
+ ):
+ with patch("api.db_utils.reset_read_db_alias"):
+ with pytest.raises(
+ OperationalError, match="caller error"
+ ):
+ with rls_transaction(tenant_id):
+ # Trigger failover (succeeds on primary)
+ wrapper = mock_replica_conn.execute_wrappers[0]
+ mock_execute = MagicMock(
+ side_effect=OperationalError(
+ "server closed the connection"
+ )
+ )
+ mock_context = {"cursor": MagicMock()}
+ wrapper(
+ mock_execute,
+ "SELECT 1",
+ None,
+ False,
+ mock_context,
+ )
+ # Caller errors after successful failover
+ # should still propagate.
+ raise OperationalError("caller error")
+
class TestPostgresEnumMigration:
"""
diff --git a/api/src/backend/api/tests/test_decorators.py b/api/src/backend/api/tests/test_decorators.py
index 25053a2258..0bf58340a1 100644
--- a/api/src/backend/api/tests/test_decorators.py
+++ b/api/src/backend/api/tests/test_decorators.py
@@ -2,11 +2,12 @@ import uuid
from unittest.mock import call, patch
import pytest
+from api.attack_paths.database import GraphDatabaseQueryException
from api.db_utils import POSTGRES_TENANT_VAR, SET_CONFIG_QUERY
from api.decorators import handle_provider_deletion, set_tenant
from api.exceptions import ProviderDeletedException
from django.core.exceptions import ObjectDoesNotExist
-from django.db import DatabaseError, IntegrityError
+from django.db import DEFAULT_DB_ALIAS, DatabaseError, IntegrityError
@pytest.mark.django_db
@@ -40,10 +41,10 @@ class TestSetTenantDecorator:
@pytest.mark.django_db
class TestHandleProviderDeletionDecorator:
- def test_success_no_exception(self, tenants_fixture, providers_fixture):
+ def test_success_no_exception(self, tenants_fixture, aws_provider):
"""Decorated function runs normally when no exception is raised."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
@handle_provider_deletion
def task_func(**kwargs):
@@ -127,11 +128,11 @@ class TestHandleProviderDeletionDecorator:
@patch("api.decorators.rls_transaction")
@patch("api.decorators.Provider.objects.filter")
def test_provider_exists_reraises_original(
- self, mock_filter, mock_rls, tenants_fixture, providers_fixture
+ self, mock_filter, mock_rls, tenants_fixture, aws_provider
):
"""Re-raises original exception when provider still exists."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
mock_rls.return_value.__enter__ = lambda s: None
mock_rls.return_value.__exit__ = lambda s, *args: None
@@ -187,11 +188,11 @@ class TestHandleProviderDeletionDecorator:
@patch("api.decorators.rls_transaction")
@patch("api.decorators.Provider.objects.filter")
def test_database_error_provider_exists_reraises(
- self, mock_filter, mock_rls, tenants_fixture, providers_fixture
+ self, mock_filter, mock_rls, tenants_fixture, aws_provider
):
"""Re-raises original DatabaseError when provider still exists."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
mock_rls.return_value.__enter__ = lambda s: None
mock_rls.return_value.__exit__ = lambda s, *args: None
@@ -204,6 +205,106 @@ class TestHandleProviderDeletionDecorator:
with pytest.raises(DatabaseError):
task_func(tenant_id=str(tenant.id), provider_id=str(provider.id))
+ @patch("api.decorators.rls_transaction")
+ @patch("api.decorators.Provider.objects.filter")
+ def test_graph_database_error_provider_missing_or_soft_deleted(
+ self, mock_provider_filter, mock_rls, tenants_fixture
+ ):
+ tenant = tenants_fixture[0]
+ provider_id = str(uuid.uuid4())
+
+ mock_rls.return_value.__enter__ = lambda s: None
+ mock_rls.return_value.__exit__ = lambda s, *args: None
+ mock_provider_filter.return_value.exists.return_value = False
+
+ @handle_provider_deletion
+ def task_func(**kwargs):
+ raise GraphDatabaseQueryException("Temporary database not found")
+
+ with pytest.raises(ProviderDeletedException):
+ task_func(tenant_id=str(tenant.id), provider_id=provider_id)
+
+ @patch("api.decorators.rls_transaction")
+ @patch("api.decorators.Tenant.objects.filter")
+ @patch("api.decorators.Provider.objects.filter")
+ def test_graph_database_error_tenant_missing(
+ self, mock_provider_filter, mock_tenant_filter, mock_rls, tenants_fixture
+ ):
+ tenant = tenants_fixture[0]
+ provider_id = str(uuid.uuid4())
+
+ mock_rls.return_value.__enter__ = lambda s: None
+ mock_rls.return_value.__exit__ = lambda s, *args: None
+ mock_provider_filter.return_value.exists.return_value = True
+ mock_tenant_filter.return_value.exists.return_value = False
+
+ @handle_provider_deletion
+ def task_func(**kwargs):
+ raise GraphDatabaseQueryException("Temporary database not found")
+
+ with pytest.raises(ProviderDeletedException):
+ task_func(tenant_id=str(tenant.id), provider_id=provider_id)
+
+ @patch("api.decorators.rls_transaction")
+ @patch("api.decorators.Membership.objects.filter")
+ @patch("api.decorators.Tenant.objects.filter")
+ @patch("api.decorators.Provider.objects.filter")
+ def test_graph_database_error_tenant_without_memberships(
+ self,
+ mock_provider_filter,
+ mock_tenant_filter,
+ mock_membership_filter,
+ mock_rls,
+ tenants_fixture,
+ ):
+ tenant = tenants_fixture[0]
+ provider_id = str(uuid.uuid4())
+
+ mock_rls.return_value.__enter__ = lambda s: None
+ mock_rls.return_value.__exit__ = lambda s, *args: None
+ mock_provider_filter.return_value.exists.return_value = True
+ mock_tenant_filter.return_value.exists.return_value = True
+ mock_membership_filter.return_value.exists.return_value = False
+
+ @handle_provider_deletion
+ def task_func(**kwargs):
+ raise GraphDatabaseQueryException("Temporary database not found")
+
+ with pytest.raises(ProviderDeletedException):
+ task_func(tenant_id=str(tenant.id), provider_id=provider_id)
+
+ @patch("api.decorators.rls_transaction")
+ @patch("api.decorators.Membership.objects.filter")
+ @patch("api.decorators.Tenant.objects.filter")
+ @patch("api.decorators.Provider.objects.filter")
+ def test_graph_database_error_active_provider_and_tenant_reraises(
+ self,
+ mock_provider_filter,
+ mock_tenant_filter,
+ mock_membership_filter,
+ mock_rls,
+ tenants_fixture,
+ ):
+ tenant = tenants_fixture[0]
+ provider_id = str(uuid.uuid4())
+ graph_error = GraphDatabaseQueryException("Temporary database not found")
+
+ mock_rls.return_value.__enter__ = lambda s: None
+ mock_rls.return_value.__exit__ = lambda s, *args: None
+ mock_provider_filter.return_value.exists.return_value = True
+ mock_tenant_filter.return_value.exists.return_value = True
+ mock_membership_filter.return_value.exists.return_value = True
+
+ @handle_provider_deletion
+ def task_func(**kwargs):
+ raise graph_error
+
+ with pytest.raises(GraphDatabaseQueryException) as exc_info:
+ task_func(tenant_id=str(tenant.id), provider_id=provider_id)
+
+ assert exc_info.value is graph_error
+ mock_rls.assert_called_once_with(str(tenant.id), using=DEFAULT_DB_ALIAS)
+
def test_missing_provider_and_scan_raises_assertion(self, tenants_fixture):
"""Raises AssertionError when neither provider_id nor scan_id in kwargs."""
diff --git a/api/src/backend/api/tests/test_health.py b/api/src/backend/api/tests/test_health.py
index f3a7bb34a4..b7cd20f697 100644
--- a/api/src/backend/api/tests/test_health.py
+++ b/api/src/backend/api/tests/test_health.py
@@ -67,7 +67,7 @@ class TestLivenessEndpoint:
with (
patch("api.health._probe_postgres") as mock_pg,
patch("api.health._probe_valkey") as mock_vk,
- patch("api.health._probe_neo4j") as mock_neo,
+ patch("api.health._probe_graph_db") as mock_neo,
):
response = api_client.get(reverse("health-live"))
@@ -83,14 +83,14 @@ class TestReadinessEndpoint:
return (
patch("api.health._probe_postgres", return_value=None),
patch("api.health._probe_valkey", return_value=None),
- patch("api.health._probe_neo4j", return_value=None),
+ patch("api.health._probe_graph_db", return_value=None),
)
def test_returns_200_and_pass_when_all_dependencies_healthy(self, api_client):
with (
patch("api.health._probe_postgres"),
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
response = api_client.get(reverse("health-ready"))
@@ -107,7 +107,7 @@ class TestReadinessEndpoint:
assert set(body["checks"].keys()) == {
"postgres:responseTime",
"valkey:responseTime",
- "neo4j:responseTime",
+ "graphdb:responseTime",
}
for key in body["checks"]:
entries = body["checks"][key]
@@ -122,6 +122,23 @@ class TestReadinessEndpoint:
# `output` must not leak when the check passed.
assert "output" not in entry
+ @pytest.mark.parametrize("sink", ["neo4j", "neptune"])
+ def test_graphdb_component_id_reflects_active_sink(self, api_client, sink):
+ from django.test import override_settings
+
+ with (
+ override_settings(ATTACK_PATHS_SINK_DATABASE=sink),
+ patch("api.health._probe_postgres"),
+ patch("api.health._probe_valkey"),
+ patch("api.health._probe_graph_db"),
+ ):
+ response = api_client.get(reverse("health-ready"))
+
+ assert response.status_code == status.HTTP_200_OK
+ entry = response.json()["checks"]["graphdb:responseTime"][0]
+ # Stable key, but the concrete store is named in componentId.
+ assert entry["componentId"] == sink
+
def test_returns_503_and_fail_when_postgres_is_down(self, api_client):
with (
patch(
@@ -129,7 +146,7 @@ class TestReadinessEndpoint:
side_effect=RuntimeError("connection refused"),
),
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
response = api_client.get(reverse("health-ready"))
@@ -141,13 +158,13 @@ class TestReadinessEndpoint:
# Exception detail is never echoed in the response, only logged.
assert "output" not in pg_entry
assert body["checks"]["valkey:responseTime"][0]["status"] == "pass"
- assert body["checks"]["neo4j:responseTime"][0]["status"] == "pass"
+ assert body["checks"]["graphdb:responseTime"][0]["status"] == "pass"
def test_returns_503_and_fail_when_valkey_is_down(self, api_client):
with (
patch("api.health._probe_postgres"),
patch("api.health._probe_valkey", side_effect=ConnectionError("timeout")),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
response = api_client.get(reverse("health-ready"))
@@ -158,12 +175,12 @@ class TestReadinessEndpoint:
assert vk_entry["status"] == "fail"
assert "output" not in vk_entry
- def test_returns_503_and_fail_when_neo4j_is_down(self, api_client):
+ def test_returns_503_and_fail_when_graph_db_is_down(self, api_client):
with (
patch("api.health._probe_postgres"),
patch("api.health._probe_valkey"),
patch(
- "api.health._probe_neo4j",
+ "api.health._probe_graph_db",
side_effect=RuntimeError("ServiceUnavailable"),
),
):
@@ -172,15 +189,15 @@ class TestReadinessEndpoint:
assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
body = response.json()
assert body["status"] == "fail"
- neo_entry = body["checks"]["neo4j:responseTime"][0]
- assert neo_entry["status"] == "fail"
- assert "output" not in neo_entry
+ graph_db_entry = body["checks"]["graphdb:responseTime"][0]
+ assert graph_db_entry["status"] == "fail"
+ assert "output" not in graph_db_entry
def test_reports_all_failures_simultaneously(self, api_client):
with (
patch("api.health._probe_postgres", side_effect=RuntimeError("pg down")),
patch("api.health._probe_valkey", side_effect=RuntimeError("vk down")),
- patch("api.health._probe_neo4j", side_effect=RuntimeError("neo down")),
+ patch("api.health._probe_graph_db", side_effect=RuntimeError("neo down")),
):
response = api_client.get(reverse("health-ready"))
@@ -190,7 +207,7 @@ class TestReadinessEndpoint:
for key in (
"postgres:responseTime",
"valkey:responseTime",
- "neo4j:responseTime",
+ "graphdb:responseTime",
):
entry = body["checks"][key][0]
assert entry["status"] == "fail"
@@ -209,7 +226,7 @@ class TestReadinessEndpoint:
with (
patch("api.health._probe_postgres", side_effect=RuntimeError(sensitive)),
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
response = api_client.get(reverse("health-ready"))
@@ -229,7 +246,7 @@ class TestReadinessEndpoint:
with (
patch("api.health._probe_postgres"),
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
api_client.credentials()
response = api_client.get(reverse("health-ready"))
@@ -244,7 +261,7 @@ class TestReadinessCache:
with (
patch("api.health._probe_postgres") as pg,
patch("api.health._probe_valkey") as vk,
- patch("api.health._probe_neo4j") as neo,
+ patch("api.health._probe_graph_db") as neo,
):
r1 = api_client.get(reverse("health-ready"))
r2 = api_client.get(reverse("health-ready"))
@@ -262,7 +279,7 @@ class TestReadinessCache:
with (
patch("api.health._probe_postgres") as pg,
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
api_client.get(reverse("health-ready"))
assert pg.call_count == 1
@@ -286,7 +303,7 @@ class TestReadinessCache:
with (
patch("api.health._probe_postgres", side_effect=RuntimeError("down")) as pg,
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
):
r1 = api_client.get(reverse("health-ready"))
r2 = api_client.get(reverse("health-ready"))
@@ -320,7 +337,7 @@ class TestRateLimiting:
with (
patch("api.health._probe_postgres"),
patch("api.health._probe_valkey"),
- patch("api.health._probe_neo4j"),
+ patch("api.health._probe_graph_db"),
patch.object(ScopedRateThrottle, "parse_rate", return_value=(2, 60)),
):
statuses = [
@@ -414,19 +431,42 @@ class TestProbeImplementations:
with pytest.raises(RuntimeError, match="bug"):
health._probe_valkey()
- def test_neo4j_probe_calls_verify_connectivity(self):
- with patch("api.attack_paths.database.get_driver") as mock_get_driver:
- mock_get_driver.return_value.verify_connectivity.return_value = None
- assert health._probe_neo4j() is None
- mock_get_driver.return_value.verify_connectivity.assert_called_once_with()
+ def test_graph_db_probe_calls_verify_connectivity(self):
+ with patch("api.attack_paths.database.verify_connectivity") as mock_verify:
+ mock_verify.return_value = None
+ assert health._probe_graph_db() is None
+ mock_verify.assert_called_once_with()
- def test_neo4j_probe_propagates_driver_errors(self):
- with patch("api.attack_paths.database.get_driver") as mock_get_driver:
- mock_get_driver.return_value.verify_connectivity.side_effect = RuntimeError(
- "unreachable"
- )
+ def test_graph_db_probe_propagates_errors(self):
+ with patch(
+ "api.attack_paths.database.verify_connectivity",
+ side_effect=RuntimeError("unreachable"),
+ ):
with pytest.raises(RuntimeError, match="unreachable"):
- health._probe_neo4j()
+ health._probe_graph_db()
+
+ def test_graph_db_probe_times_out_when_check_exceeds_budget(self):
+ # A sink whose connectivity check blocks past the probe budget must
+ # surface as a failure fast, not pin the request thread for the
+ # driver's full acquisition timeout.
+ import time as _time
+
+ def _hang() -> None:
+ _time.sleep(2)
+
+ with (
+ patch("api.health.GRAPH_DB_PROBE_TIMEOUT_SECONDS", 0.2),
+ patch(
+ "api.attack_paths.database.verify_connectivity",
+ side_effect=_hang,
+ ),
+ ):
+ started = _time.perf_counter()
+ with pytest.raises(TimeoutError):
+ health._probe_graph_db()
+ elapsed = _time.perf_counter() - started
+
+ assert elapsed < health.GRAPH_DB_PROBE_TIMEOUT_SECONDS + 1
class TestStatusAggregation:
diff --git a/api/src/backend/api/tests/test_models.py b/api/src/backend/api/tests/test_models.py
index 3ec823b89a..5095da3a0e 100644
--- a/api/src/backend/api/tests/test_models.py
+++ b/api/src/backend/api/tests/test_models.py
@@ -19,8 +19,8 @@ from django.db import IntegrityError
@pytest.mark.django_db
class TestResourceModel:
- def test_setting_tags(self, providers_fixture):
- provider, *_ = providers_fixture
+ def test_setting_tags(self, aws_provider):
+ provider = aws_provider
tenant_id = provider.tenant_id
resource = Resource.objects.create(
@@ -111,9 +111,9 @@ class TestResourceModel:
# @pytest.mark.django_db
# class TestFindingModel:
# def test_add_finding_with_long_uid(
-# self, providers_fixture, scans_fixture, resources_fixture
+# self, aws_provider, scans_fixture, resources_fixture
# ):
-# provider, *_ = providers_fixture
+# provider = aws_provider
# tenant_id = provider.tenant_id
# long_uid = "1" * 500
@@ -372,8 +372,8 @@ class TestSAMLConfigurationModel:
@pytest.mark.django_db
class TestProviderComplianceScoreModel:
- def test_create_provider_compliance_score(self, providers_fixture, scans_fixture):
- provider = providers_fixture[0]
+ def test_create_provider_compliance_score(self, aws_provider, scans_fixture):
+ provider = aws_provider
scan = scans_fixture[0]
scan.completed_at = datetime.now(UTC)
scan.save()
@@ -393,9 +393,9 @@ class TestProviderComplianceScoreModel:
assert score.requirement_status == StatusChoices.PASS
def test_unique_constraint_per_provider_compliance_requirement(
- self, providers_fixture, scans_fixture
+ self, aws_provider, scans_fixture
):
- provider = providers_fixture[0]
+ provider = aws_provider
scan = scans_fixture[0]
scan.completed_at = datetime.now(UTC)
scan.save()
@@ -422,9 +422,9 @@ class TestProviderComplianceScoreModel:
)
def test_different_providers_same_requirement_allowed(
- self, providers_fixture, scans_fixture
+ self, aws_provider_pair, scans_fixture
):
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = scans_fixture[0]
scan1.completed_at = datetime.now(UTC)
scan1.save()
diff --git a/api/src/backend/api/tests/test_rbac.py b/api/src/backend/api/tests/test_rbac.py
index 4f787b1f5a..ed177138b2 100644
--- a/api/src/backend/api/tests/test_rbac.py
+++ b/api/src/backend/api/tests/test_rbac.py
@@ -11,6 +11,7 @@ from api.models import (
User,
UserRoleRelationship,
)
+from api.rbac.permissions import HasPermissions, Permissions
from api.v1.serializers import TokenSerializer
from conftest import TEST_PASSWORD, TODAY
from django.urls import reverse
@@ -103,20 +104,84 @@ class TestUserViewSet:
assert response.json()["data"]["attributes"]["name"] == "Updated Name"
def test_partial_update_user_with_no_permissions(
- self, authenticated_client_no_permissions_rbac, create_test_user
+ self, authenticated_client_no_permissions_rbac, create_test_user_rbac_limited
):
updated_data = {
"data": {
"type": "users",
+ "id": str(create_test_user_rbac_limited.id),
"attributes": {"name": "Updated Name"},
}
}
response = authenticated_client_no_permissions_rbac.patch(
- reverse("user-detail", kwargs={"pk": create_test_user.id}),
+ reverse("user-detail", kwargs={"pk": create_test_user_rbac_limited.id}),
data=updated_data,
- format="vnd.api+json",
+ content_type="application/vnd.api+json",
)
- assert response.status_code == status.HTTP_403_FORBIDDEN
+ assert response.status_code == status.HTTP_200_OK
+ assert response.json()["data"]["attributes"]["name"] == "Updated Name"
+
+ def test_partial_update_other_user_with_no_permissions_denied(
+ self, authenticated_client_no_permissions_rbac, tenants_fixture
+ ):
+ original_email = "target-rbac-update@example.com"
+ original_password = "OriginalPassword123@"
+ target_user = User.objects.create_user(
+ name="target_rbac_update",
+ email=original_email,
+ password=original_password,
+ )
+ Membership.objects.create(user=target_user, tenant=tenants_fixture[0])
+ updated_data = {
+ "data": {
+ "type": "users",
+ "id": str(target_user.id),
+ "attributes": {
+ "email": "updated-target-rbac@example.com",
+ "password": "UpdatedPassword123@",
+ },
+ }
+ }
+
+ response = authenticated_client_no_permissions_rbac.patch(
+ reverse("user-detail", kwargs={"pk": target_user.id}),
+ data=updated_data,
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ target_user.refresh_from_db()
+ assert target_user.email == original_email
+ assert target_user.check_password(original_password)
+
+ def test_partial_update_other_user_with_manage_users_allowed(
+ self, authenticated_client_rbac_manage_users_only
+ ):
+ user = authenticated_client_rbac_manage_users_only.user
+ tenant = Membership.objects.filter(user=user).first().tenant
+ target_user = User.objects.create_user(
+ name="target_manage_users_update",
+ email="target-manage-users-update@example.com",
+ password="Password123@",
+ )
+ Membership.objects.create(user=target_user, tenant=tenant)
+ updated_data = {
+ "data": {
+ "type": "users",
+ "id": str(target_user.id),
+ "attributes": {"name": "Updated Target Name"},
+ }
+ }
+
+ response = authenticated_client_rbac_manage_users_only.patch(
+ reverse("user-detail", kwargs={"pk": target_user.id}),
+ data=updated_data,
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ target_user.refresh_from_db()
+ assert target_user.name == "Updated Target Name"
def test_delete_user_with_all_permissions(
self, authenticated_client_rbac, create_test_user_rbac
@@ -370,11 +435,11 @@ class TestUserViewSet:
@pytest.mark.django_db
class TestProviderViewSet:
def test_list_providers_with_all_permissions(
- self, authenticated_client_rbac, providers_fixture
+ self, authenticated_client_rbac, aws_provider
):
response = authenticated_client_rbac.get(reverse("provider-list"))
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == len(providers_fixture)
+ assert len(response.json()["data"]) == 1
def test_list_providers_with_no_permissions(
self, authenticated_client_no_permissions_rbac
@@ -386,9 +451,9 @@ class TestProviderViewSet:
assert len(response.json()["data"]) == 0
def test_retrieve_provider_with_all_permissions(
- self, authenticated_client_rbac, providers_fixture
+ self, authenticated_client_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client_rbac.get(
reverse("provider-detail", kwargs={"pk": provider.id})
)
@@ -396,9 +461,9 @@ class TestProviderViewSet:
assert response.json()["data"]["attributes"]["alias"] == provider.alias
def test_retrieve_provider_with_no_permissions(
- self, authenticated_client_no_permissions_rbac, providers_fixture
+ self, authenticated_client_no_permissions_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client_no_permissions_rbac.get(
reverse("provider-detail", kwargs={"pk": provider.id})
)
@@ -422,9 +487,9 @@ class TestProviderViewSet:
assert response.status_code == status.HTTP_403_FORBIDDEN
def test_partial_update_provider_with_all_permissions(
- self, authenticated_client_rbac, providers_fixture
+ self, authenticated_client_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
payload = {
"data": {
"type": "providers",
@@ -441,9 +506,9 @@ class TestProviderViewSet:
assert response.json()["data"]["attributes"]["alias"] == "updated_alias"
def test_partial_update_provider_with_no_permissions(
- self, authenticated_client_no_permissions_rbac, providers_fixture
+ self, authenticated_client_no_permissions_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
update_payload = {
"data": {
"type": "providers",
@@ -464,7 +529,7 @@ class TestProviderViewSet:
mock_delete_task,
mock_task_get,
authenticated_client_rbac,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
prowler_task = tasks_fixture[0]
@@ -473,7 +538,7 @@ class TestProviderViewSet:
mock_delete_task.return_value = task_mock
mock_task_get.return_value = prowler_task
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
response = authenticated_client_rbac.delete(
reverse("provider-detail", kwargs={"pk": provider1.id})
)
@@ -485,9 +550,9 @@ class TestProviderViewSet:
assert response.headers["Content-Location"] == f"/api/v1/tasks/{task_mock.id}"
def test_delete_provider_with_no_permissions(
- self, authenticated_client_no_permissions_rbac, providers_fixture
+ self, authenticated_client_no_permissions_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client_no_permissions_rbac.delete(
reverse("provider-detail", kwargs={"pk": provider.id})
)
@@ -500,7 +565,7 @@ class TestProviderViewSet:
mock_provider_connection,
mock_task_get,
authenticated_client_rbac,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
prowler_task = tasks_fixture[0]
@@ -510,7 +575,7 @@ class TestProviderViewSet:
mock_provider_connection.return_value = task_mock
mock_task_get.return_value = prowler_task
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
assert provider1.connected is None
assert provider1.connection_last_checked_at is None
@@ -525,9 +590,9 @@ class TestProviderViewSet:
assert response.headers["Content-Location"] == f"/api/v1/tasks/{task_mock.id}"
def test_connection_with_no_permissions(
- self, authenticated_client_no_permissions_rbac, providers_fixture
+ self, authenticated_client_no_permissions_rbac, aws_provider
):
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client_no_permissions_rbac.post(
reverse("provider-connection", kwargs={"pk": provider.id})
)
@@ -540,12 +605,10 @@ class TestLimitedVisibility:
TEST_PASSWORD = "Thisisapassword123@"
@pytest.fixture
- def limited_admin_user(
- self, django_db_setup, django_db_blocker, tenants_fixture, providers_fixture
- ):
+ def limited_admin_user(self, django_db_blocker, tenants_fixture, aws_provider):
with django_db_blocker.unblock():
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
user = User.objects.create_user(
name="testing",
email=self.TEST_EMAIL,
@@ -592,25 +655,17 @@ class TestLimitedVisibility:
@pytest.fixture
def authenticated_client_rbac_limited(
- self, limited_admin_user, tenants_fixture, client
+ self,
+ limited_admin_user,
+ tenants_fixture,
+ authenticated_client_for_tenant_factory,
):
- client.user = limited_admin_user
- tenant_id = tenants_fixture[0].id
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": self.TEST_EMAIL,
- "password": self.TEST_PASSWORD,
- "tenant_id": tenant_id,
- }
+ return authenticated_client_for_tenant_factory(
+ limited_admin_user, tenants_fixture[0]
)
- serializer.is_valid(raise_exception=True)
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
def test_integrations(
- self, authenticated_client_rbac_limited, integrations_fixture, providers_fixture
+ self, authenticated_client_rbac_limited, integrations_fixture
):
# Integration 2 is related to provider1 and provider 2
# This user cannot see provider 2
@@ -626,11 +681,11 @@ class TestLimitedVisibility:
response.json()["data"]["relationships"]["providers"]["meta"]["count"] == 1
)
+ @pytest.mark.usefixtures("scan_summaries_fixture")
def test_overviews_providers(
self,
authenticated_client_rbac_limited,
- scan_summaries_fixture,
- providers_fixture,
+ provider_factory,
):
# By default, the associated provider is the one which has the overview data
response = authenticated_client_rbac_limited.get(reverse("overview-providers"))
@@ -640,7 +695,7 @@ class TestLimitedVisibility:
# Changing the provider visibility, no data should be returned
# Only the associated provider to that group is changed
- new_provider = providers_fixture[1]
+ new_provider = provider_factory()
ProviderGroupMembership.objects.all().update(provider=new_provider)
response = authenticated_client_rbac_limited.get(reverse("overview-providers"))
@@ -648,6 +703,7 @@ class TestLimitedVisibility:
assert response.status_code == status.HTTP_200_OK
assert len(response.json()["data"]) == 0
+ @pytest.mark.usefixtures("scan_summaries_fixture")
@pytest.mark.parametrize(
"endpoint_name",
[
@@ -659,8 +715,7 @@ class TestLimitedVisibility:
self,
endpoint_name,
authenticated_client_rbac_limited,
- scan_summaries_fixture,
- providers_fixture,
+ provider_factory,
):
# By default, the associated provider is the one which has the overview data
response = authenticated_client_rbac_limited.get(
@@ -673,7 +728,7 @@ class TestLimitedVisibility:
# Changing the provider visibility, no data should be returned
# Only the associated provider to that group is changed
- new_provider = providers_fixture[1]
+ new_provider = provider_factory()
ProviderGroupMembership.objects.all().update(provider=new_provider)
response = authenticated_client_rbac_limited.get(
@@ -684,11 +739,11 @@ class TestLimitedVisibility:
data = response.json()["data"]["attributes"].values()
assert all(value == 0 for value in data)
+ @pytest.mark.usefixtures("scan_summaries_fixture")
def test_overviews_services(
self,
authenticated_client_rbac_limited,
- scan_summaries_fixture,
- providers_fixture,
+ provider_factory,
):
# By default, the associated provider is the one which has the overview data
response = authenticated_client_rbac_limited.get(
@@ -700,7 +755,7 @@ class TestLimitedVisibility:
# Changing the provider visibility, no data should be returned
# Only the associated provider to that group is changed
- new_provider = providers_fixture[1]
+ new_provider = provider_factory()
ProviderGroupMembership.objects.all().update(provider=new_provider)
response = authenticated_client_rbac_limited.get(
@@ -762,6 +817,48 @@ class TestRolePermissions:
assert response.status_code == status.HTTP_403_FORBIDDEN
+@pytest.mark.django_db
+class TestHasPermissions:
+ def test_permissions_are_combined_across_roles(
+ self, create_test_user_rbac_no_roles
+ ):
+ user = create_test_user_rbac_no_roles
+ tenant = Membership.objects.get(user=user).tenant
+ manage_users_role = Role.objects.create(
+ name="manage_users_only",
+ tenant=tenant,
+ manage_users=True,
+ )
+ UserRoleRelationship.objects.create(
+ user=user,
+ role=manage_users_role,
+ tenant=tenant,
+ )
+ request = Mock(user=user, tenant_id=tenant.id)
+ view = Mock(
+ required_permissions=[
+ Permissions.MANAGE_USERS,
+ Permissions.MANAGE_ACCOUNT,
+ ]
+ )
+ permission = HasPermissions()
+
+ assert not permission.has_permission(request, view)
+
+ manage_account_role = Role.objects.create(
+ name="manage_account_only",
+ tenant=tenant,
+ manage_account=True,
+ )
+ UserRoleRelationship.objects.create(
+ user=user,
+ role=manage_account_role,
+ tenant=tenant,
+ )
+
+ assert permission.has_permission(request, view)
+
+
@pytest.mark.django_db
class TestUserRoleLinkPermissions:
def test_link_user_roles_with_manage_account_only_allowed(
diff --git a/api/src/backend/api/tests/test_retryable_session.py b/api/src/backend/api/tests/test_retryable_session.py
new file mode 100644
index 0000000000..09b184c223
--- /dev/null
+++ b/api/src/backend/api/tests/test_retryable_session.py
@@ -0,0 +1,165 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+from api.attack_paths.retryable_session import RetryableSession, RetryExhaustedError
+from neo4j.exceptions import ServiceUnavailable
+
+
+class TestRetryableSession:
+ @patch("api.attack_paths.retryable_session.time.sleep")
+ @patch("api.attack_paths.retryable_session.random.uniform", return_value=3.0)
+ def test_custom_retry_uses_backoff_and_a_fresh_session(
+ self, mock_uniform, mock_sleep
+ ):
+ retryable_error = RuntimeError("retryable")
+ first_session = MagicMock()
+ first_session.execute_write.side_effect = retryable_error
+ second_session = MagicMock()
+ second_session.execute_write.return_value = "success"
+ session_factory = MagicMock(side_effect=[first_session, second_session])
+ work = MagicMock()
+
+ session = RetryableSession(
+ session_factory=session_factory,
+ max_retries=3,
+ retry_if=lambda exc: exc is retryable_error,
+ initial_retry_delay_seconds=2,
+ retry_context="Neptune write",
+ )
+
+ assert session.execute_write(work) == "success"
+ assert session_factory.call_count == 2
+ first_session.close.assert_called_once_with()
+ mock_uniform.assert_called_once_with(2.0, 4.0)
+ mock_sleep.assert_called_once_with(3.0)
+
+ def test_connection_errors_remain_retryable(self):
+ first_session = MagicMock()
+ first_session.run.side_effect = ServiceUnavailable("unavailable")
+ second_session = MagicMock()
+ second_session.run.return_value = "success"
+ session_factory = MagicMock(side_effect=[first_session, second_session])
+
+ session = RetryableSession(session_factory=session_factory, max_retries=1)
+
+ assert session.run("RETURN 1") == "success"
+ first_session.close.assert_called_once_with()
+
+ def test_non_retryable_error_is_raised_without_refreshing_session(self):
+ error = RuntimeError("do not retry")
+ driver_session = MagicMock()
+ driver_session.execute_write.side_effect = error
+ session_factory = MagicMock(return_value=driver_session)
+ session = RetryableSession(
+ session_factory=session_factory,
+ max_retries=3,
+ retry_if=lambda _: False,
+ initial_retry_delay_seconds=2,
+ retry_context="Neptune write",
+ )
+
+ with pytest.raises(RuntimeError) as exc_info:
+ session.execute_write(MagicMock())
+
+ assert exc_info.value is error
+ session_factory.assert_called_once_with()
+ driver_session.close.assert_not_called()
+
+ def test_retry_exhaustion_raises_the_last_error(self):
+ error = RuntimeError("still retryable")
+ driver_sessions = [MagicMock() for _ in range(3)]
+ for driver_session in driver_sessions:
+ driver_session.execute_write.side_effect = error
+ session_factory = MagicMock(side_effect=driver_sessions)
+ session = RetryableSession(
+ session_factory=session_factory,
+ max_retries=2,
+ retry_if=lambda _: True,
+ )
+
+ with pytest.raises(RuntimeError) as exc_info:
+ session.execute_write(MagicMock())
+
+ assert exc_info.value is error
+ assert session_factory.call_count == 3
+ driver_sessions[0].close.assert_called_once_with()
+ driver_sessions[1].close.assert_called_once_with()
+ driver_sessions[2].close.assert_not_called()
+
+ def test_retry_exhaustion_with_context_reports_attempts_and_elapsed_time(self):
+ error = RuntimeError("still retryable")
+ driver_sessions = [MagicMock() for _ in range(3)]
+ for driver_session in driver_sessions:
+ driver_session.execute_write.side_effect = error
+ session = RetryableSession(
+ session_factory=MagicMock(side_effect=driver_sessions),
+ max_retries=2,
+ retry_if=lambda _: True,
+ retry_context="Neptune write",
+ )
+
+ with (
+ patch(
+ "api.attack_paths.retryable_session.time.monotonic",
+ side_effect=[100.0, 127.1234],
+ ),
+ pytest.raises(RetryExhaustedError) as exc_info,
+ ):
+ session.execute_write(MagicMock())
+
+ assert exc_info.value.method_name == "execute_write"
+ assert exc_info.value.attempts == 3
+ assert exc_info.value.elapsed_seconds == pytest.approx(27.1234)
+ assert exc_info.value.last_error is error
+ assert exc_info.value.__cause__ is error
+ assert str(exc_info.value) == (
+ "Neptune write execute_write failed after 3 attempts over 27.123s. "
+ "Last error: still retryable"
+ )
+
+ def test_retry_exhaustion_with_zero_retries_reports_one_attempt(self):
+ error = ServiceUnavailable("still unavailable")
+ driver_session = MagicMock()
+ driver_session.execute_write.side_effect = error
+ session = RetryableSession(
+ session_factory=MagicMock(return_value=driver_session),
+ max_retries=0,
+ retry_context="Neptune write",
+ )
+
+ with pytest.raises(RetryExhaustedError) as exc_info:
+ session.execute_write(MagicMock())
+
+ assert exc_info.value.attempts == 1
+
+ @patch("api.attack_paths.retryable_session.time.sleep")
+ @patch("api.attack_paths.retryable_session.random.uniform", return_value=3.0)
+ def test_contextual_retry_warning_includes_original_error(
+ self, _mock_uniform, _mock_sleep
+ ):
+ error = RuntimeError("retryable detail")
+ first_session = MagicMock()
+ first_session.execute_write.side_effect = error
+ second_session = MagicMock()
+ second_session.execute_write.return_value = "success"
+ session = RetryableSession(
+ session_factory=MagicMock(side_effect=[first_session, second_session]),
+ max_retries=1,
+ retry_if=lambda _: True,
+ initial_retry_delay_seconds=2,
+ retry_context="Neptune write",
+ )
+
+ with patch("api.attack_paths.retryable_session.logger.warning") as mock_warning:
+ assert session.execute_write(MagicMock()) == "success"
+
+ mock_warning.assert_called_once_with(
+ "%s %s failed with %s: %s; retry %s/%s in %.3fs",
+ "Neptune write",
+ "execute_write",
+ "RuntimeError",
+ "retryable detail",
+ 1,
+ 1,
+ 3.0,
+ )
diff --git a/api/src/backend/api/tests/test_sentry.py b/api/src/backend/api/tests/test_sentry.py
index fb7abaffb4..67ba1ee01e 100644
--- a/api/src/backend/api/tests/test_sentry.py
+++ b/api/src/backend/api/tests/test_sentry.py
@@ -1,9 +1,34 @@
import logging
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
+import pytest
+from config.settings import sentry as sentry_settings
from config.settings.sentry import before_send
+def test_initialize_sentry_skips_without_dsn():
+ with (
+ patch.object(sentry_settings.env, "str", return_value=""),
+ patch.object(sentry_settings.sentry_sdk, "init") as mock_init,
+ ):
+ sentry_settings.initialize_sentry()
+
+ mock_init.assert_not_called()
+
+
+def test_initialize_sentry_uses_configured_dsn():
+ sentry_dsn = "https://fake-public-key@sentry.example.invalid/1"
+
+ with (
+ patch.object(sentry_settings.env, "str", return_value=sentry_dsn),
+ patch.object(sentry_settings.sentry_sdk, "init") as mock_init,
+ ):
+ sentry_settings.initialize_sentry()
+
+ assert mock_init.call_args.kwargs["dsn"] == sentry_dsn
+ assert mock_init.call_args.kwargs["before_send"] is sentry_settings.before_send
+
+
def _make_log_record(msg, level=logging.ERROR, name="test", args=None):
"""Build a real LogRecord so getMessage() works like in production."""
record = logging.LogRecord(
@@ -58,6 +83,45 @@ def test_before_send_passes_through_non_ignored_log():
assert result == event
+def test_before_send_ignores_cartography_missing_temporary_database_log():
+ log_record = _make_log_record(
+ msg="Cartography job failed with %s for database %s",
+ name="cartography.graph.job",
+ args=(
+ "Neo.ClientError.Database.DatabaseNotFound",
+ "db-tmp-scan-12345678",
+ ),
+ )
+
+ event = MagicMock()
+
+ assert before_send(event, {"log_record": log_record}) is None
+
+
+@pytest.mark.parametrize(
+ ("logger_name", "message"),
+ [
+ (
+ "cartography.graph.job.worker",
+ "Neo.ClientError.Database.DatabaseNotFound for db-tmp-scan-12345678",
+ ),
+ (
+ "cartography.graph.job",
+ "DatabaseNotFound for db-tmp-scan-12345678",
+ ),
+ (
+ "cartography.graph.job",
+ "Neo.ClientError.Database.DatabaseNotFound for db-tenant-12345678",
+ ),
+ ],
+)
+def test_before_send_passes_through_similar_cartography_logs(logger_name, message):
+ log_record = _make_log_record(msg=message, name=logger_name)
+ event = MagicMock()
+
+ assert before_send(event, {"log_record": log_record}) is event
+
+
def test_before_send_passes_through_non_ignored_exception():
"""Test that before_send passes through exceptions that don't contain ignored exceptions."""
exc_info = (Exception, Exception("Some other error message"), None)
diff --git a/api/src/backend/api/tests/test_serializers.py b/api/src/backend/api/tests/test_serializers.py
index ea01075934..8e77d63604 100644
--- a/api/src/backend/api/tests/test_serializers.py
+++ b/api/src/backend/api/tests/test_serializers.py
@@ -1,6 +1,14 @@
import pytest
-from api.v1.serializer_utils.integrations import S3ConfigSerializer
-from api.v1.serializers import ImageProviderSecret
+from api.v1.serializer_utils.integrations import (
+ JiraCredentialSerializer,
+ S3ConfigSerializer,
+)
+from api.v1.serializer_utils.providers import ProviderSecretField
+from api.v1.serializers import (
+ ImageProviderSecret,
+ KubernetesProviderSecret,
+ OracleCloudProviderSecret,
+)
from rest_framework.exceptions import ValidationError
@@ -100,6 +108,59 @@ class TestS3ConfigSerializer:
assert "output_directory" in serializer.errors
+class TestJiraCredentialSerializer:
+ @pytest.mark.parametrize(
+ "domain",
+ (
+ "a",
+ "prowler",
+ "prowler-domain",
+ "A1-b2-C3",
+ "a" * 63,
+ ),
+ )
+ def test_valid_site_name(self, domain):
+ serializer = JiraCredentialSerializer(
+ data={
+ "user_mail": "testing@prowler.com",
+ "api_token": "fake-api-token",
+ "domain": domain,
+ }
+ )
+
+ assert serializer.is_valid(), serializer.errors
+
+ @pytest.mark.parametrize(
+ "domain",
+ (
+ "169.254.169.254#",
+ "internal/service",
+ "internal?target",
+ "internal\\target",
+ "internal:8000",
+ "user@internal",
+ "example.atlassian.net",
+ "-prowler",
+ "prowler-",
+ "a" * 64,
+ " prowler",
+ "prowler ",
+ "prowler\n",
+ ),
+ )
+ def test_invalid_site_name(self, domain):
+ serializer = JiraCredentialSerializer(
+ data={
+ "user_mail": "testing@prowler.com",
+ "api_token": "fake-api-token",
+ "domain": domain,
+ }
+ )
+
+ assert not serializer.is_valid()
+ assert "domain" in serializer.errors
+
+
class TestImageProviderSecret:
"""Test cases for ImageProviderSecret validation."""
@@ -132,3 +193,132 @@ class TestImageProviderSecret:
serializer = ImageProviderSecret(data={"registry_password": "pass"})
assert not serializer.is_valid()
assert "non_field_errors" in serializer.errors
+
+
+class TestOracleCloudProviderSecret:
+ def valid_secret(self, **overrides):
+ secret = {
+ "user": "ocid1.user.oc1..aaaaaaaexample",
+ "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ "key_content": "fake-base64-key-content",
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ }
+ secret.update(overrides)
+ return secret
+
+ def test_accepts_regionless_secret(self):
+ serializer = OracleCloudProviderSecret(data=self.valid_secret())
+
+ assert serializer.is_valid(), serializer.errors
+ assert "region" not in serializer.validated_data
+
+ def test_accepts_and_ignores_region_field(self):
+ secret = self.valid_secret(region="us-phoenix-1")
+ serializer = OracleCloudProviderSecret(data=secret)
+
+ assert serializer.is_valid(), serializer.errors
+
+ assert "region" not in serializer.validated_data
+
+ @pytest.mark.parametrize(
+ "legacy_field, legacy_value",
+ [
+ ("region", None),
+ ("region", ""),
+ ("region", {"name": "us-ashburn-1"}),
+ ],
+ )
+ def test_accepts_and_ignores_any_legacy_region_value(
+ self, legacy_field, legacy_value
+ ):
+ serializer = OracleCloudProviderSecret(
+ data=self.valid_secret(**{legacy_field: legacy_value})
+ )
+
+ assert serializer.is_valid(), serializer.errors
+
+ assert legacy_field not in serializer.validated_data
+
+
+class TestProviderSecretFieldSchema:
+ def test_oraclecloud_schema_includes_legacy_region_field(self):
+ schema = ProviderSecretField._spectacular_annotation["field"]
+ oraclecloud_schema = next(
+ credential_schema
+ for credential_schema in schema["oneOf"]
+ if credential_schema["title"]
+ == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
+ )
+
+ assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
+
+
+class TestKubernetesProviderSecret:
+ def test_valid_static_kubeconfig_is_accepted(self):
+ kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+ - name: test-cluster
+ cluster:
+ server: https://kubernetes.example.test
+users:
+ - name: test-user
+ user:
+ token: test-token
+contexts:
+ - name: test-context
+ context:
+ cluster: test-cluster
+ user: test-user
+current-context: test-context
+"""
+
+ serializer = KubernetesProviderSecret(
+ data={"kubeconfig_content": kubeconfig_content}
+ )
+
+ assert serializer.is_valid()
+
+ def test_kubeconfig_with_exec_authentication_is_rejected(self):
+ kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+ - name: test-cluster
+ cluster:
+ server: https://kubernetes.example.test
+users:
+ - name: test-user
+ user:
+ exec:
+ apiVersion: client.authentication.k8s.io/v1
+ command: kubectl
+contexts:
+ - name: test-context
+ context:
+ cluster: test-cluster
+ user: test-user
+current-context: test-context
+"""
+
+ serializer = KubernetesProviderSecret(
+ data={"kubeconfig_content": kubeconfig_content}
+ )
+
+ assert not serializer.is_valid()
+ assert "kubeconfig_content" in serializer.errors
+
+ def test_malformed_kubeconfig_is_rejected(self):
+ serializer = KubernetesProviderSecret(
+ data={"kubeconfig_content": "apiVersion: ["}
+ )
+
+ assert not serializer.is_valid()
+ assert "kubeconfig_content" in serializer.errors
+
+ def test_non_mapping_kubeconfig_is_rejected(self):
+ serializer = KubernetesProviderSecret(data={"kubeconfig_content": "[]"})
+
+ assert not serializer.is_valid()
+ assert "kubeconfig_content" in serializer.errors
diff --git a/api/src/backend/api/tests/test_sink.py b/api/src/backend/api/tests/test_sink.py
new file mode 100644
index 0000000000..c778626b62
--- /dev/null
+++ b/api/src/backend/api/tests/test_sink.py
@@ -0,0 +1,716 @@
+"""Tests for the attack-paths sink factory and Neo4j sink.
+
+The sink module picks a backend per ``settings.ATTACK_PATHS_SINK_DATABASE``.
+Neo4j is the default and preserves today's behavior; Neptune is opt-in and
+builds dual writer/reader Bolt drivers.
+"""
+
+import json
+from unittest.mock import MagicMock, patch
+
+import neo4j
+import pytest
+from api.attack_paths import sink as sink_module
+from api.attack_paths.database import (
+ GraphDatabaseQueryException,
+ NeptuneWriteRetryExhaustedException,
+)
+from api.attack_paths.retryable_session import RetryExhaustedError
+from api.attack_paths.sink import factory
+from api.attack_paths.sink.neo4j import DATABASE_NOT_FOUND_CODE, Neo4jSink
+from api.attack_paths.sink.neptune import (
+ NEPTUNE_WRITE_RETRY_DELAY_SECONDS,
+ NeptuneSink,
+ _is_retryable_write_error,
+ _NeptuneAuthToken,
+)
+
+
+@pytest.fixture(autouse=True)
+def reset_sink_state():
+ """Reset the module-level backend singletons around each test.
+
+ The cache lives in `api.attack_paths.sink.factory`, not on the package.
+ """
+ original_backend = factory._backend
+ original_secondary = dict(factory._secondary_backends)
+ factory._backend = None
+ factory._secondary_backends.clear()
+ yield
+ factory._backend = original_backend
+ factory._secondary_backends.clear()
+ factory._secondary_backends.update(original_secondary)
+
+
+class TestSinkFactory:
+ def test_default_resolves_to_neo4j(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ assert factory._resolve_setting() == "neo4j"
+
+ def test_neptune_resolves_correctly(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ assert factory._resolve_setting() == "neptune"
+
+ def test_invalid_value_raises(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "foo"
+ with pytest.raises(RuntimeError, match="ATTACK_PATHS_SINK_DATABASE"):
+ factory._resolve_setting()
+
+ @patch("api.attack_paths.sink.neo4j.neo4j.GraphDatabase.driver")
+ def test_init_builds_neo4j_backend_by_default(self, mock_driver, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neo4j": {
+ "HOST": "localhost",
+ "PORT": "7687",
+ "USER": "neo4j",
+ "PASSWORD": "pw",
+ },
+ }
+ mock_driver.return_value = MagicMock()
+
+ backend = sink_module.init()
+
+ assert isinstance(backend, Neo4jSink)
+ mock_driver.assert_called_once()
+
+ @patch("api.attack_paths.sink.neptune.neptune_auth_provider")
+ @patch("api.attack_paths.sink.neptune.neo4j.GraphDatabase.driver")
+ def test_init_builds_neptune_backend(
+ self, mock_driver, mock_auth_provider, settings
+ ):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neptune": {
+ "WRITER_ENDPOINT": "writer.example",
+ "READER_ENDPOINT": "reader.example",
+ "PORT": "8182",
+ "REGION": "eu-west-1",
+ },
+ }
+ mock_driver.return_value = MagicMock()
+ mock_auth_provider.return_value = lambda: None
+
+ backend = sink_module.init()
+
+ assert isinstance(backend, NeptuneSink)
+ # Writer + reader endpoints both trigger driver construction
+ assert mock_driver.call_count == 2
+ writer_uri = mock_driver.call_args_list[0][0][0]
+ reader_uri = mock_driver.call_args_list[1][0][0]
+ assert writer_uri == "bolt+s://writer.example:8182"
+ assert reader_uri == "bolt+s://reader.example:8182"
+
+ @patch("api.attack_paths.sink.neptune.neptune_auth_provider")
+ @patch("api.attack_paths.sink.neptune.neo4j.GraphDatabase.driver")
+ def test_neptune_reader_falls_back_to_writer(
+ self, mock_driver, mock_auth_provider, settings
+ ):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neptune": {
+ "WRITER_ENDPOINT": "writer.example",
+ "READER_ENDPOINT": "",
+ "PORT": "8182",
+ "REGION": "eu-west-1",
+ },
+ }
+ mock_driver.return_value = MagicMock()
+ mock_auth_provider.return_value = lambda: None
+
+ sink_module.init()
+
+ # Only one driver call — reader aliases writer
+ assert mock_driver.call_count == 1
+
+
+def test_neo4j_sync_batch_size_defaults_to_1000():
+ assert Neo4jSink.sync_batch_size == 1000
+
+
+def test_neptune_sync_batch_size_defaults_to_500():
+ assert NeptuneSink.sync_batch_size == 500
+
+
+class TestGetBackendForScan:
+ """``get_backend_for_scan`` routes by the row's recorded sink backend."""
+
+ @patch("api.attack_paths.sink.neo4j.neo4j.GraphDatabase.driver")
+ def test_legacy_scan_in_neo4j_process_uses_active_backend(
+ self, mock_driver, settings
+ ):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neo4j": {
+ "HOST": "localhost",
+ "PORT": "7687",
+ "USER": "neo4j",
+ "PASSWORD": "pw",
+ },
+ }
+ mock_driver.return_value = MagicMock()
+
+ scan = MagicMock(sink_backend="neo4j")
+ backend = sink_module.get_backend_for_scan(scan)
+
+ assert backend is sink_module.get_backend()
+
+ def test_neptune_scan_on_neo4j_process_uses_neptune_secondary(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ active_neo4j = MagicMock(name="neo4j-active")
+ factory._backend = active_neo4j
+
+ secondary_neptune = MagicMock(name="neptune-secondary")
+ with patch.object(factory, "_build_backend", return_value=secondary_neptune):
+ scan = MagicMock(sink_backend="neptune")
+ backend = factory.get_backend_for_scan(scan)
+
+ assert backend is secondary_neptune
+ assert backend is not active_neo4j
+
+
+def _session_ctx(session: MagicMock) -> MagicMock:
+ ctx = MagicMock()
+ ctx.__enter__ = MagicMock(return_value=session)
+ ctx.__exit__ = MagicMock(return_value=False)
+ return ctx
+
+
+def _count_result(key: str, count: int) -> MagicMock:
+ return MagicMock(single=MagicMock(return_value={key: count}))
+
+
+def _run_managed_write(session: MagicMock) -> MagicMock:
+ transaction = MagicMock()
+ session.execute_write.call_args.args[0](transaction)
+ return transaction
+
+
+def _managed_write_session(
+ results: list[MagicMock],
+) -> tuple[MagicMock, list[MagicMock]]:
+ session = MagicMock()
+ transactions: list[MagicMock] = []
+ result_iter = iter(results)
+
+ def execute_write(work):
+ transaction = MagicMock()
+ transaction.run.return_value = next(result_iter)
+ transactions.append(transaction)
+ return work(transaction)
+
+ session.execute_write.side_effect = execute_write
+ return session, transactions
+
+
+def _directed_drop_results(
+ outgoing_rels: int,
+ incoming_rels: int,
+ nodes: int,
+) -> list[MagicMock]:
+ return [
+ _count_result("deleted_rels_count", outgoing_rels),
+ _count_result("deleted_rels_count", 0),
+ _count_result("deleted_rels_count", incoming_rels),
+ _count_result("deleted_rels_count", 0),
+ _count_result("deleted_nodes_count", nodes),
+ _count_result("deleted_nodes_count", 0),
+ ]
+
+
+class TestNeo4jSinkSyncWrites:
+ def test_ensure_sync_indexes_runs_create_index_idempotent(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ sink.ensure_sync_indexes("db-tenant-x")
+
+ transaction = _run_managed_write(session)
+ query = transaction.run.call_args.args[0]
+ assert "CREATE INDEX" in query
+ assert "IF NOT EXISTS" in query
+ assert "`_ProviderResource`" in query
+ assert "`_provider_element_id`" in query
+ transaction.run.return_value.consume.assert_called_once_with()
+
+ def test_write_nodes_skips_empty_batch(self):
+ sink = Neo4jSink()
+ with patch.object(sink, "get_session") as get_session:
+ sink.write_nodes("db-tenant-x", "`AWSUser`", [])
+ get_session.assert_not_called()
+
+ def test_write_nodes_merges_on_provider_resource_label(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ sink.write_nodes(
+ "db-tenant-x",
+ "`AWSUser`:`_ProviderResource`",
+ [{"provider_element_id": "p:e", "props": {"k": "v"}}],
+ )
+
+ transaction = _run_managed_write(session)
+ query, params = transaction.run.call_args.args
+ assert "MERGE (n:`_ProviderResource`" in query
+ assert "`_provider_element_id`: row.provider_element_id" in query
+ assert "SET n:`AWSUser`:`_ProviderResource`" in query
+ assert params == {"rows": [{"provider_element_id": "p:e", "props": {"k": "v"}}]}
+ transaction.run.return_value.consume.assert_called_once_with()
+
+ def test_write_relationships_scopes_endpoints_by_provider_label(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ provider_id = "00000000-0000-0000-0000-000000000abc"
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ sink.write_relationships(
+ "db-tenant-x",
+ "RESOURCE",
+ provider_id,
+ [
+ {
+ "start_element_id": "s",
+ "end_element_id": "e",
+ "provider_element_id": "pe",
+ "props": {},
+ }
+ ],
+ )
+
+ transaction = _run_managed_write(session)
+ query = transaction.run.call_args.args[0]
+ assert ":`_Provider_00000000000000000000000000000abc`" in query
+ assert ":RESOURCE" in query.replace("`", "")
+ assert "MERGE (s)-[r:`RESOURCE`" in query
+ transaction.run.return_value.consume.assert_called_once_with()
+
+
+class TestNeptuneSinkSyncWrites:
+ def test_ensure_sync_indexes_is_noop(self):
+ sink = NeptuneSink()
+ with patch.object(sink, "get_session") as get_session:
+ sink.ensure_sync_indexes("ignored")
+ get_session.assert_not_called()
+
+ def test_write_nodes_merges_on_neptune_id_with_provider_resource_label(self):
+ sink = NeptuneSink()
+ session = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ sink.write_nodes(
+ "ignored",
+ "`AWSUser`",
+ [{"provider_element_id": "p:e", "props": {"k": "v"}}],
+ )
+
+ transaction = _run_managed_write(session)
+ query = transaction.run.call_args.args[0]
+ # Neptune assigns a default `vertex` label to any unlabeled node,
+ # so the MERGE must pin a real label at creation time.
+ assert "MERGE (n:`_ProviderResource` {`~id`: row.provider_element_id})" in query
+ assert "SET n:`AWSUser`" in query
+ assert "SET n.`_provider_element_id` = row.provider_element_id" in query
+ transaction.run.return_value.consume.assert_called_once_with()
+
+ def test_write_relationships_matches_endpoints_by_id(self):
+ sink = NeptuneSink()
+ session = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ sink.write_relationships(
+ "ignored",
+ "RESOURCE",
+ "provider-1",
+ [
+ {
+ "start_element_id": "s",
+ "end_element_id": "e",
+ "provider_element_id": "pe",
+ "props": {},
+ }
+ ],
+ )
+
+ transaction = _run_managed_write(session)
+ query = transaction.run.call_args.args[0]
+ assert "MATCH (s) WHERE id(s) = row.start_element_id" in query
+ assert "MATCH (e) WHERE id(e) = row.end_element_id" in query
+ assert "MERGE (s)-[r:`RESOURCE`" in query
+ transaction.run.return_value.consume.assert_called_once_with()
+
+
+class TestNeptuneRetryPolicy:
+ @pytest.mark.parametrize(
+ "message",
+ [
+ "Unexpected server exception 'Operation failed due to conflicting "
+ "concurrent operations (please retry), 0 transactions are currently "
+ "rolling back.'",
+ "Unexpected server exception 'Operation terminated (deadline exceeded)'",
+ ],
+ )
+ def test_observed_transient_write_errors_are_retryable(self, message):
+ error = MagicMock(spec=neo4j.exceptions.Neo4jError)
+ error.message = message
+
+ assert _is_retryable_write_error(error) is True
+
+ def test_unrelated_database_error_is_not_retryable(self):
+ error = MagicMock(spec=neo4j.exceptions.Neo4jError)
+ error.message = (
+ "Unexpected server exception 'Operation terminated (out of memory)'"
+ )
+
+ assert _is_retryable_write_error(error) is False
+
+ def test_non_neo4j_error_is_not_retryable(self):
+ error = RuntimeError(
+ "Operation failed due to conflicting concurrent operations"
+ )
+
+ assert _is_retryable_write_error(error) is False
+
+ @patch("api.attack_paths.sink.neptune.RetryableSession")
+ def test_writer_session_enables_neptune_retry_policy(self, retryable_session):
+ sink = NeptuneSink()
+ driver = MagicMock()
+ with patch.object(sink, "_get_writer", return_value=driver):
+ with sink.get_session():
+ pass
+
+ kwargs = retryable_session.call_args.kwargs
+ assert kwargs["retry_if"] is _is_retryable_write_error
+ assert (
+ kwargs["initial_retry_delay_seconds"] == NEPTUNE_WRITE_RETRY_DELAY_SECONDS
+ )
+ assert kwargs["retry_context"] == "Neptune write"
+
+ @patch("api.attack_paths.sink.neptune.RetryableSession")
+ def test_reader_session_does_not_enable_write_retry_policy(self, retryable_session):
+ sink = NeptuneSink()
+ driver = MagicMock()
+ with patch.object(sink, "_get_reader", return_value=driver):
+ with sink.get_session(default_access_mode=neo4j.READ_ACCESS):
+ pass
+
+ kwargs = retryable_session.call_args.kwargs
+ assert kwargs["retry_if"] is None
+ assert kwargs["initial_retry_delay_seconds"] == 0
+ assert kwargs["retry_context"] is None
+
+ def test_writer_retry_exhaustion_preserves_neptune_error_details(self):
+ message = (
+ "Unexpected server exception 'Operation failed due to conflicting "
+ "concurrent operations (please retry), 0 transactions are currently "
+ "rolling back.'"
+ )
+ error = neo4j.exceptions.Neo4jError._hydrate_neo4j(
+ code="BoltProtocol.unexpectedException",
+ message=message,
+ )
+ retry_error = RetryExhaustedError(
+ retry_context="Neptune write",
+ method_name="execute_write",
+ attempts=4,
+ elapsed_seconds=27.1234,
+ last_error=error,
+ )
+ sink = NeptuneSink()
+ driver = MagicMock()
+ retryable_session = MagicMock()
+ retryable_session.execute_write.side_effect = retry_error
+
+ with (
+ patch.object(sink, "_get_writer", return_value=driver),
+ patch(
+ "api.attack_paths.sink.neptune.RetryableSession",
+ return_value=retryable_session,
+ ),
+ pytest.raises(NeptuneWriteRetryExhaustedException) as exc_info,
+ ):
+ with sink.get_session() as session:
+ session.execute_write(MagicMock())
+
+ assert exc_info.value.code == "BoltProtocol.unexpectedException"
+ assert str(exc_info.value) == (
+ "BoltProtocol.unexpectedException: Neptune write execute_write failed "
+ "after 4 attempts over 27.123s. Last error: "
+ f"{message}"
+ )
+ assert exc_info.value.__cause__ is error
+
+
+class TestNeptuneSinkDropSubgraph:
+ def test_drop_subgraph_deletes_directed_rels_before_nodes_in_bounded_batches(self):
+ sink = NeptuneSink()
+ session, transactions = _managed_write_session(
+ _directed_drop_results(
+ outgoing_rels=50,
+ incoming_rels=30,
+ nodes=10,
+ )
+ )
+
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ deleted = sink.drop_subgraph("ignored", "provider-1")
+
+ assert deleted == 10
+ assert session.execute_write.call_count == 6
+ queries = [transaction.run.call_args.args[0] for transaction in transactions]
+
+ assert ")-[r]->()" in queries[0]
+ assert ")<-[r]-()" in queries[2]
+ assert "DELETE n" in queries[4]
+ assert all("DETACH DELETE" not in query for query in queries)
+ assert all("DISTINCT r" not in query for query in queries)
+
+ first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
+ last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
+ assert last_rel < first_node
+
+
+class TestNeo4jSinkDropSubgraph:
+ """Neo4j drop deletes relationships then nodes in batches (no ``DETACH DELETE``)."""
+
+ def test_drop_subgraph_deletes_directed_rels_before_nodes_in_bounded_batches(self):
+ sink = Neo4jSink()
+ session, transactions = _managed_write_session(
+ _directed_drop_results(
+ outgoing_rels=50,
+ incoming_rels=30,
+ nodes=10,
+ )
+ )
+
+ provider_id = "00000000-0000-0000-0000-000000000abc"
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ deleted = sink.drop_subgraph("db-tenant-x", provider_id)
+
+ # Only phase-2 node counts contribute to the return value.
+ assert deleted == 10
+ assert session.execute_write.call_count == 6
+
+ queries = [transaction.run.call_args.args[0] for transaction in transactions]
+ # Regression guard: the memory blow-up was caused by DETACH DELETE.
+ assert all("DETACH DELETE" not in query for query in queries)
+ assert all("DISTINCT r" not in query for query in queries)
+
+ first_query = queries[0]
+ assert "DELETE r" in first_query
+ assert ")-[r]->()" in first_query
+ assert ":`_Provider_00000000000000000000000000000abc`" in first_query
+
+ assert ")<-[r]-()" in queries[2]
+ assert "DELETE n" in queries[4]
+
+ # Relationships must be fully drained before nodes are deleted.
+ first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
+ last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
+ assert last_rel < first_node
+
+ def test_drop_subgraph_returns_zero_when_database_does_not_exist(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ session.execute_write.side_effect = GraphDatabaseQueryException(
+ message="db missing", code=DATABASE_NOT_FOUND_CODE
+ )
+
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ deleted = sink.drop_subgraph("db-tenant-missing", "provider-1")
+
+ assert deleted == 0
+
+
+class TestSinkHasProviderData:
+ """``has_provider_data`` is the read-path probe used by API views."""
+
+ def test_neo4j_returns_true_when_provider_node_exists(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ session.run.return_value.single.return_value = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ present = sink.has_provider_data(
+ "db-tenant-x", "00000000-0000-0000-0000-000000000abc"
+ )
+
+ assert present is True
+ query = session.run.call_args.args[0]
+ assert ":`_Provider_00000000000000000000000000000abc`" in query
+
+ def test_neo4j_returns_false_when_database_does_not_exist(self):
+ sink = Neo4jSink()
+ session = MagicMock()
+ session.run.side_effect = GraphDatabaseQueryException(
+ message="db missing", code=DATABASE_NOT_FOUND_CODE
+ )
+
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ present = sink.has_provider_data("db-tenant-missing", "provider-1")
+
+ assert present is False
+
+ def test_neptune_returns_true_when_provider_node_exists(self):
+ sink = NeptuneSink()
+ session = MagicMock()
+ session.run.return_value.single.return_value = MagicMock()
+ with patch.object(sink, "get_session", return_value=_session_ctx(session)):
+ present = sink.has_provider_data("ignored", "provider-1")
+
+ assert present is True
+
+
+class TestGetBackendForScanCutover:
+ """``get_backend_for_scan`` keeps old-sink scans queryable after cutover."""
+
+ def test_legacy_scan_on_neptune_process_uses_neo4j_secondary(self, settings):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ active_neptune = MagicMock(name="neptune-active")
+ factory._backend = active_neptune
+
+ secondary_neo4j = MagicMock(name="neo4j-secondary")
+ with patch.object(factory, "_build_backend", return_value=secondary_neo4j):
+ scan = MagicMock(sink_backend="neo4j")
+ backend = factory.get_backend_for_scan(scan)
+
+ assert backend is secondary_neo4j
+ assert backend is not active_neptune
+
+
+class TestSinkVerifyConnectivity:
+ """The readiness probe calls ``verify_connectivity`` through the shim.
+
+ Neo4j checks its single driver; Neptune checks the reader (the API read
+ path), which on single-endpoint clusters aliases the writer.
+ """
+
+ @patch("api.attack_paths.sink.neo4j.neo4j.GraphDatabase.driver")
+ def test_neo4j_verifies_its_driver(self, mock_driver, settings):
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neo4j": {
+ "HOST": "localhost",
+ "PORT": "7687",
+ "USER": "neo4j",
+ "PASSWORD": "pw",
+ },
+ }
+ driver = MagicMock()
+ mock_driver.return_value = driver
+
+ sink = Neo4jSink()
+ sink.init()
+ driver.verify_connectivity.reset_mock() # ignore the eager init check
+ sink.verify_connectivity()
+
+ driver.verify_connectivity.assert_called_once_with()
+
+ @patch("api.attack_paths.sink.neptune.neptune_auth_provider")
+ @patch("api.attack_paths.sink.neptune.neo4j.GraphDatabase.driver")
+ def test_neptune_verifies_reader_not_writer(
+ self, mock_driver, mock_auth_provider, settings
+ ):
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neptune": {
+ "WRITER_ENDPOINT": "writer.example",
+ "READER_ENDPOINT": "reader.example",
+ "PORT": "8182",
+ "REGION": "eu-west-1",
+ },
+ }
+ writer, reader = MagicMock(name="writer"), MagicMock(name="reader")
+ mock_driver.side_effect = [writer, reader]
+ mock_auth_provider.return_value = lambda: None
+
+ sink = NeptuneSink()
+ sink.init()
+ writer.verify_connectivity.reset_mock()
+ reader.verify_connectivity.reset_mock()
+
+ sink.verify_connectivity()
+
+ reader.verify_connectivity.assert_called_once_with()
+ writer.verify_connectivity.assert_not_called()
+
+
+class TestSinkInitToleratesUnreachableSink:
+ """Init must not crash the process when the sink is down at boot.
+
+ Same degradation model as Postgres: the driver is retained and
+ reconnects lazily; /health/ready surfaces the outage until it recovers.
+ """
+
+ @patch("api.attack_paths.sink.neo4j.neo4j.GraphDatabase.driver")
+ def test_neo4j_init_continues_when_verify_fails(self, mock_driver, settings):
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neo4j": {
+ "HOST": "localhost",
+ "PORT": "7687",
+ "USER": "neo4j",
+ "PASSWORD": "pw",
+ },
+ }
+ driver = MagicMock()
+ driver.verify_connectivity.side_effect = RuntimeError("unreachable")
+ mock_driver.return_value = driver
+
+ sink = Neo4jSink()
+ # Must not raise.
+ assert sink.init() is driver
+ assert sink._driver is driver
+
+ @patch("api.attack_paths.sink.neptune.neptune_auth_provider")
+ @patch("api.attack_paths.sink.neptune.neo4j.GraphDatabase.driver")
+ def test_neptune_init_continues_when_verify_fails(
+ self, mock_driver, mock_auth_provider, settings
+ ):
+ settings.DATABASES = {
+ **settings.DATABASES,
+ "neptune": {
+ "WRITER_ENDPOINT": "writer.example",
+ "READER_ENDPOINT": "reader.example",
+ "PORT": "8182",
+ "REGION": "eu-west-1",
+ },
+ }
+ driver = MagicMock()
+ driver.verify_connectivity.side_effect = RuntimeError("unreachable")
+ mock_driver.return_value = driver
+ mock_auth_provider.return_value = lambda: None
+
+ sink = NeptuneSink()
+ # Must not raise; both drivers retained.
+ sink.init()
+ assert sink._writer is not None
+ assert sink._reader is not None
+
+
+class TestNeptuneAdminNoOps:
+ """Neptune is single-database; admin DDL has no work to do."""
+
+ @pytest.mark.parametrize("method", ["create_database", "drop_database"])
+ def test_admin_ops_return_none_without_touching_a_session(self, method):
+ sink = NeptuneSink()
+ with patch.object(sink, "get_session") as get_session:
+ assert getattr(sink, method)("ignored") is None
+ get_session.assert_not_called()
+
+
+class TestNeptuneAuthToken:
+ """SigV4 signing for the Neptune Bolt endpoint."""
+
+ @patch("api.attack_paths.sink.neptune.SigV4Auth")
+ @patch("api.attack_paths.sink.neptune.BotoSession")
+ def test_host_header_includes_non_default_port(self, mock_boto, mock_sigv4):
+ # Neptune runs on 8182; the SigV4 canonical Host must keep the port or
+ # the signature is rejected.
+ credentials = MagicMock()
+ credentials.get_frozen_credentials.return_value = MagicMock()
+ mock_boto.return_value.get_credentials.return_value = credentials
+
+ token = _NeptuneAuthToken("eu-west-1", "https://writer.example:8182")
+
+ auth_obj = json.loads(token.credentials)
+ assert auth_obj["Host"] == "writer.example:8182"
diff --git a/api/src/backend/api/tests/test_utils.py b/api/src/backend/api/tests/test_utils.py
index 935a15c4f3..4b5e8e1694 100644
--- a/api/src/backend/api/tests/test_utils.py
+++ b/api/src/backend/api/tests/test_utils.py
@@ -171,6 +171,53 @@ class TestInitializeProwlerProvider:
key="value", mutelist_content={"key": "value"}
)
+ @patch("api.utils.return_prowler_provider")
+ def test_initialize_oraclecloud_provider_removes_region_string(
+ self, mock_return_prowler_provider
+ ):
+ provider = MagicMock()
+ provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+ provider.secret.secret = {
+ "user": "ocid1.user.oc1..fake",
+ "fingerprint": "00:11:22:33:44:55:66:77",
+ "key_content": "fake-base64-key-content",
+ "tenancy": "ocid1.tenancy.oc1..fake",
+ "region": "us-ashburn-1",
+ }
+ mock_return_prowler_provider.return_value = MagicMock()
+
+ initialize_prowler_provider(provider)
+
+ mock_return_prowler_provider.return_value.assert_called_once_with(
+ user="ocid1.user.oc1..fake",
+ fingerprint="00:11:22:33:44:55:66:77",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..fake",
+ )
+
+ @patch("api.utils.return_prowler_provider")
+ def test_initialize_oraclecloud_provider_without_region_omits_scan_filter(
+ self, mock_return_prowler_provider
+ ):
+ provider = MagicMock()
+ provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+ provider.secret.secret = {
+ "user": "ocid1.user.oc1..fake",
+ "fingerprint": "00:11:22:33:44:55:66:77",
+ "key_content": "fake-base64-key-content",
+ "tenancy": "ocid1.tenancy.oc1..fake",
+ }
+ mock_return_prowler_provider.return_value = MagicMock()
+
+ initialize_prowler_provider(provider)
+
+ mock_return_prowler_provider.return_value.assert_called_once_with(
+ user="ocid1.user.oc1..fake",
+ fingerprint="00:11:22:33:44:55:66:77",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..fake",
+ )
+
class TestProwlerProviderConnectionTest:
@patch("api.utils.return_prowler_provider")
@@ -185,13 +232,44 @@ class TestProwlerProviderConnectionTest:
key="value", provider_id="1234567890", raise_on_exception=False
)
+ @patch("api.utils.return_prowler_provider")
+ def test_oraclecloud_connection_test_uses_direct_credentials_without_region(
+ self, mock_return_prowler_provider
+ ):
+ provider = MagicMock()
+ provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
+ provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+ provider.secret.secret = {
+ "user": "ocid1.user.oc1..aaaaaaaexample",
+ "fingerprint": "00:11:22:33:44:55:66:77",
+ "key_content": "fake-base64-key-content",
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ }
+ mock_return_prowler_provider.return_value = MagicMock()
+
+ prowler_provider_connection_test(provider)
+
+ mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+ user="ocid1.user.oc1..aaaaaaaexample",
+ fingerprint="00:11:22:33:44:55:66:77",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+ region=getattr(
+ OraclecloudProvider,
+ "_bootstrap_region",
+ OraclecloudProvider._home_region,
+ ),
+ provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ raise_on_exception=False,
+ )
+
@pytest.mark.django_db
@patch("api.utils.return_prowler_provider")
def test_prowler_provider_connection_test_without_secret(
- self, mock_return_prowler_provider, providers_fixture
+ self, mock_return_prowler_provider, aws_provider
):
mock_return_prowler_provider.return_value = MagicMock()
- connection = prowler_provider_connection_test(providers_fixture[0])
+ connection = prowler_provider_connection_test(aws_provider)
assert connection.is_connected is False
assert isinstance(connection.error, Provider.secret.RelatedObjectDoesNotExist)
@@ -356,7 +434,7 @@ class TestGetProwlerProviderKwargs:
expected_result = {**secret_dict, **expected_extra_kwargs}
assert result == expected_result
- def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
+ def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
self,
):
secret_dict = {
@@ -377,8 +455,13 @@ class TestGetProwlerProviderKwargs:
result = get_prowler_provider_kwargs(provider)
- expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
- assert result == expected_result
+ assert result == {
+ "user": "ocid1.user.oc1..fake",
+ "fingerprint": "00:11:22:33:44:55:66:77",
+ "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
+ "tenancy": "ocid1.tenancy.oc1..fake",
+ "pass_phrase": "fake-passphrase",
+ }
def test_get_prowler_provider_kwargs_with_mutelist(self):
provider_uid = "provider_uid"
@@ -856,7 +939,7 @@ class TestProwlerIntegrationConnectionTest:
integration.credentials = {
"user_mail": "test@example.com",
"api_token": "test_api_token",
- "domain": "example.atlassian.net",
+ "domain": "example",
}
integration.configuration = {}
@@ -884,7 +967,7 @@ class TestProwlerIntegrationConnectionTest:
mock_jira_class.test_connection.assert_called_once_with(
user_mail="test@example.com",
api_token="test_api_token",
- domain="example.atlassian.net",
+ domain="example",
raise_on_exception=False,
)
@@ -917,7 +1000,7 @@ class TestProwlerIntegrationConnectionTest:
integration.credentials = {
"user_mail": "invalid@example.com",
"api_token": "invalid_token",
- "domain": "invalid.atlassian.net",
+ "domain": "invalid",
}
integration.configuration = {}
@@ -942,7 +1025,7 @@ class TestProwlerIntegrationConnectionTest:
mock_jira_class.test_connection.assert_called_once_with(
user_mail="invalid@example.com",
api_token="invalid_token",
- domain="invalid.atlassian.net",
+ domain="invalid",
raise_on_exception=False,
)
@@ -970,7 +1053,7 @@ class TestProwlerIntegrationConnectionTest:
integration.credentials = {
"user_mail": "test@example.com",
"api_token": "test_api_token",
- "domain": "example.atlassian.net",
+ "domain": "example",
}
integration.configuration = {
"issue_types": {"OLD_PROJ": ["Task"]}, # Existing configuration
diff --git a/api/src/backend/api/tests/test_validators.py b/api/src/backend/api/tests/test_validators.py
new file mode 100644
index 0000000000..a431a659c7
--- /dev/null
+++ b/api/src/backend/api/tests/test_validators.py
@@ -0,0 +1,246 @@
+import socket
+
+import pytest
+from api.validators import (
+ resolve_lighthouse_openai_compatible_host,
+ validate_lighthouse_openai_compatible_base_url,
+)
+from django.core.exceptions import ValidationError
+from django.test import override_settings
+
+
+def test_lighthouse_base_url_rejects_http_scheme():
+ with pytest.raises(ValidationError, match="HTTPS"):
+ validate_lighthouse_openai_compatible_base_url(
+ "http://openrouter.ai/api/v1",
+ resolve_dns=False,
+ )
+
+
+@pytest.mark.parametrize(
+ "base_url",
+ [
+ "https://openrouter.ai:0/api/v1",
+ "https://openrouter.ai:-1/api/v1",
+ "https://openrouter.ai:65536/api/v1",
+ "https://openrouter.ai:invalid/api/v1",
+ ],
+)
+def test_lighthouse_base_url_rejects_invalid_port(base_url):
+ with pytest.raises(ValidationError, match="port is invalid"):
+ validate_lighthouse_openai_compatible_base_url(
+ base_url,
+ resolve_dns=False,
+ )
+
+
+@pytest.mark.parametrize("port", [1, 65535])
+def test_lighthouse_base_url_accepts_valid_port_boundaries(port):
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ f"https://openrouter.ai:{port}/api/v1",
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+def test_lighthouse_base_url_rejects_localhost():
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ "https://localhost/v1",
+ resolve_dns=False,
+ )
+
+
+@pytest.mark.parametrize("ip_address", ["10.0.0.1", "172.16.0.1", "192.168.1.1"])
+def test_lighthouse_base_url_rejects_private_ip_literal(ip_address):
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ f"https://{ip_address}/v1",
+ resolve_dns=False,
+ )
+
+
+def test_lighthouse_base_url_rejects_metadata_ip_literal():
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ "https://169.254.169.254/latest/meta-data",
+ resolve_dns=False,
+ )
+
+
+@pytest.mark.parametrize(
+ "base_url",
+ [
+ "https://[::ffff:169.254.169.254]/v1",
+ "https://[64:ff9b::a9fe:a9fe]/v1",
+ "https://[2002:a9fe:a9fe::]/v1",
+ ],
+)
+def test_lighthouse_base_url_rejects_embedded_non_global_ip(base_url):
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ base_url,
+ resolve_dns=False,
+ )
+
+
+@pytest.mark.parametrize(
+ "base_url",
+ [
+ "https://[::ffff:93.184.216.34]/v1",
+ "https://[64:ff9b::5db8:d822]/v1",
+ "https://[2002:5db8:d822::]/v1",
+ ],
+)
+def test_lighthouse_base_url_accepts_embedded_public_ip(base_url):
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ base_url,
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+def test_lighthouse_base_url_accepts_hostname_without_dns_resolution():
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ "https://openrouter.ai/api/v1",
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+def test_lighthouse_base_url_rejects_post_dns_internal_address(monkeypatch):
+ def resolve_to_metadata(*_args, **_kwargs):
+ return [
+ (
+ socket.AF_INET,
+ socket.SOCK_STREAM,
+ 6,
+ "",
+ ("169.254.169.254", 443),
+ )
+ ]
+
+ monkeypatch.setattr("api.validators.socket.getaddrinfo", resolve_to_metadata)
+
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ "https://metadata.example.test/v1"
+ )
+
+
+def test_lighthouse_base_url_accepts_public_resolved_address(monkeypatch):
+ def resolve_to_public(*_args, **_kwargs):
+ return [
+ (
+ socket.AF_INET,
+ socket.SOCK_STREAM,
+ 6,
+ "",
+ ("93.184.216.34", 443),
+ )
+ ]
+
+ monkeypatch.setattr("api.validators.socket.getaddrinfo", resolve_to_public)
+
+ assert (
+ validate_lighthouse_openai_compatible_base_url("https://openrouter.ai/api/v1")
+ is None
+ )
+
+
+@override_settings(
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_accepts_allowlisted_host_without_resolution(monkeypatch):
+ def fail_resolution(*_args, **_kwargs):
+ raise AssertionError("allowlisted hosts must not be resolved")
+
+ monkeypatch.setattr("api.validators.socket.getaddrinfo", fail_resolution)
+
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ "https://custom-openai.internal/v1"
+ )
+ is None
+ )
+
+
+@override_settings(
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_resolve_returns_allowlisted_hostname_unpinned():
+ assert resolve_lighthouse_openai_compatible_host(
+ "Custom-OpenAI.internal.", 443
+ ) == ("custom-openai.internal",)
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["localhost"])
+def test_lighthouse_base_url_accepts_allowlisted_blocked_host():
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ "https://localhost/v1",
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["10.0.0.1"])
+def test_lighthouse_base_url_accepts_allowlisted_private_ip_literal():
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ "https://10.0.0.1/v1",
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+@override_settings(
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=[" Custom-OpenAI.Internal. "]
+)
+def test_lighthouse_allowlist_entries_are_normalized():
+ assert (
+ validate_lighthouse_openai_compatible_base_url(
+ "https://custom-openai.internal/v1",
+ resolve_dns=False,
+ )
+ is None
+ )
+
+
+@override_settings(
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_rejects_host_not_in_allowlist():
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ "https://localhost/v1",
+ resolve_dns=False,
+ )
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=[""])
+def test_lighthouse_allowlist_ignores_empty_entries():
+ with pytest.raises(ValidationError, match="external public endpoint"):
+ validate_lighthouse_openai_compatible_base_url(
+ "https://localhost/v1",
+ resolve_dns=False,
+ )
+
+
+@override_settings(
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_allowlisted_host_still_requires_https():
+ with pytest.raises(ValidationError, match="HTTPS"):
+ validate_lighthouse_openai_compatible_base_url(
+ "http://custom-openai.internal/v1",
+ resolve_dns=False,
+ )
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 4e8c9336b6..96d366e847 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -57,9 +57,14 @@ from api.models import (
UserRoleRelationship,
)
from api.rls import Tenant
-from api.v1.serializers import TokenSerializer
-from api.v1.views import ComplianceOverviewViewSet, TenantFinishACSView
+from api.uuid_utils import datetime_to_uuid7
+from api.v1.views import (
+ ComplianceOverviewViewSet,
+ CustomSAMLLoginView,
+ TenantFinishACSView,
+)
from botocore.exceptions import ClientError, NoCredentialsError
+from celery import states
from conftest import (
API_JSON_CONTENT_TYPE,
TEST_PASSWORD,
@@ -243,6 +248,63 @@ class TestUserViewSet:
create_test_user.refresh_from_db()
assert create_test_user.company_name == new_company_name
+ def test_users_partial_update_same_tenant_other_user_password_denied(
+ self, authenticated_client_no_permissions_rbac, tenants_fixture
+ ):
+ original_password = "OriginalPassword123@"
+ new_password = "UpdatedPassword123@"
+ target_user = User.objects.create_user(
+ password=original_password,
+ email="target-password-update@example.com",
+ )
+ Membership.objects.create(user=target_user, tenant=tenants_fixture[0])
+ payload = {
+ "data": {
+ "type": "users",
+ "id": str(target_user.id),
+ "attributes": {"password": new_password},
+ },
+ }
+
+ response = authenticated_client_no_permissions_rbac.patch(
+ reverse("user-detail", kwargs={"pk": target_user.id}),
+ data=payload,
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ target_user.refresh_from_db()
+ assert target_user.check_password(original_password)
+ assert not target_user.check_password(new_password)
+
+ def test_users_partial_update_same_tenant_other_user_email_denied(
+ self, authenticated_client_no_permissions_rbac, tenants_fixture
+ ):
+ original_email = "target-email-update@example.com"
+ new_email = "updated-target-email@example.com"
+ target_user = User.objects.create_user(
+ password="OriginalPassword123@",
+ email=original_email,
+ )
+ Membership.objects.create(user=target_user, tenant=tenants_fixture[0])
+ payload = {
+ "data": {
+ "type": "users",
+ "id": str(target_user.id),
+ "attributes": {"email": new_email},
+ },
+ }
+
+ response = authenticated_client_no_permissions_rbac.patch(
+ reverse("user-detail", kwargs={"pk": target_user.id}),
+ data=payload,
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ target_user.refresh_from_db()
+ assert target_user.email == original_email
+
def test_users_partial_update_invalid_content_type(
self, authenticated_client, create_test_user
):
@@ -788,21 +850,15 @@ class TestTenantViewSet:
assert response.json()["data"] == []
def test_tenants_list_memberships_as_member(
- self, authenticated_client, tenants_fixture, extra_users
+ self, authenticated_client_for_tenant_factory, tenants_fixture, extra_users
):
_, tenant2, _ = tenants_fixture
_, user3_membership = extra_users
user3, membership3 = user3_membership
- token_response = authenticated_client.post(
- reverse("token-obtain"),
- data={"email": user3.email, "password": TEST_PASSWORD},
- format="json",
- )
- access_token = token_response.json()["data"]["attributes"]["access"]
+ client = authenticated_client_for_tenant_factory(user3, tenant2)
- response = authenticated_client.get(
+ response = client.get(
reverse("tenant-membership-list", kwargs={"tenant_pk": tenant2.id}),
- headers={"Authorization": f"Bearer {access_token}"},
)
assert response.status_code == status.HTTP_200_OK
# User is a member and can only see its own membership
@@ -1365,23 +1421,29 @@ class TestMembershipViewSet:
class TestProviderViewSet:
@pytest.fixture(scope="function")
def create_provider_group_relationship(
- self, tenants_fixture, providers_fixture, provider_groups_fixture
+ self, tenants_fixture, aws_provider, provider_groups_fixture
):
tenant, *_ = tenants_fixture
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
provider_group1, *_ = provider_groups_fixture
provider_group_membership = ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=provider_group1
)
return provider_group_membership
- def test_providers_list(self, authenticated_client, providers_fixture):
- response = authenticated_client.get(reverse("provider-list"))
+ def test_providers_list(self, authenticated_client, all_provider_types_fixture):
+ response = authenticated_client.get(
+ reverse("provider-list"), {"page[disable]": "true"}
+ )
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == len(providers_fixture)
+ data = response.json()["data"]
+ assert len(data) == len(all_provider_types_fixture)
+ assert {item["attributes"]["provider"] for item in data} == {
+ provider.provider for provider in all_provider_types_fixture
+ }
def test_providers_filter_provider_type(
- self, authenticated_client, providers_fixture
+ self, authenticated_client, aws_provider_pair
):
response = authenticated_client.get(
reverse("provider-list"), {"filter[provider_type]": "aws"}
@@ -1392,7 +1454,7 @@ class TestProviderViewSet:
assert all(item["attributes"]["provider"] == "aws" for item in data)
def test_providers_filter_provider_type_in(
- self, authenticated_client, providers_fixture
+ self, authenticated_client, aws_provider_pair, gcp_provider
):
response = authenticated_client.get(
reverse("provider-list"), {"filter[provider_type__in]": "aws,gcp"}
@@ -1403,7 +1465,7 @@ class TestProviderViewSet:
assert {"aws", "gcp"} >= {item["attributes"]["provider"] for item in data}
def test_providers_filter_provider_type_invalid(
- self, authenticated_client, providers_fixture
+ self, authenticated_client, aws_provider
):
response = authenticated_client.get(
reverse("provider-list"), {"filter[provider_type]": "invalid"}
@@ -1414,11 +1476,11 @@ class TestProviderViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider_pair,
provider_groups_fixture,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -1447,7 +1509,7 @@ class TestProviderViewSet:
assert len(response.json()["data"]) == 2
def test_providers_disable_pagination(
- self, authenticated_client, providers_fixture, tenants_fixture
+ self, authenticated_client, aws_provider, tenants_fixture
):
tenant, *_ = tenants_fixture
existing_count = Provider.objects.filter(tenant_id=tenant.id).count()
@@ -1490,19 +1552,19 @@ class TestProviderViewSet:
("provider_groups", ["provider-groups"]),
],
)
+ @pytest.mark.usefixtures("create_provider_group_relationship")
def test_providers_list_include(
self,
include_values,
expected_resources,
authenticated_client,
- providers_fixture,
- create_provider_group_relationship,
+ aws_provider,
):
response = authenticated_client.get(
reverse("provider-list"), {"include": include_values}
)
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == len(providers_fixture)
+ assert len(response.json()["data"]) == 1
assert "included" in response.json()
included_data = response.json()["included"]
@@ -1511,8 +1573,8 @@ class TestProviderViewSet:
f"Expected type '{expected_type}' not found in included data"
)
- def test_providers_retrieve(self, authenticated_client, providers_fixture):
- provider1, *_ = providers_fixture
+ def test_providers_retrieve(self, authenticated_client, aws_provider):
+ provider1 = aws_provider
response = authenticated_client.get(
reverse("provider-detail", kwargs={"pk": provider1.id}),
)
@@ -1663,6 +1725,11 @@ class TestProviderViewSet:
"uid": "C12",
"alias": "Google Workspace Minimum Length",
},
+ {
+ "provider": "image",
+ "uid": "registry.example.com/prowler/test:latest",
+ "alias": "Container Image",
+ },
{
"provider": "okta",
"uid": "acme.okta.com",
@@ -2253,8 +2320,8 @@ class TestProviderViewSet:
assert response.status_code == status.HTTP_201_CREATED
assert Provider.objects.get().uid == stored_uid
- def test_providers_partial_update(self, authenticated_client, providers_fixture):
- provider1, *_ = providers_fixture
+ def test_providers_partial_update(self, authenticated_client, aws_provider):
+ provider1 = aws_provider
new_alias = "This is the new name"
payload = {
"data": {
@@ -2273,9 +2340,11 @@ class TestProviderViewSet:
assert provider1.alias == new_alias
def test_providers_partial_update_invalid_content_type(
- self, authenticated_client, providers_fixture
+ self,
+ authenticated_client,
+ aws_provider,
):
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
response = authenticated_client.patch(
reverse("provider-detail", kwargs={"pk": provider1.id}),
data={},
@@ -2283,9 +2352,11 @@ class TestProviderViewSet:
assert response.status_code == status.HTTP_415_UNSUPPORTED_MEDIA_TYPE
def test_providers_partial_update_invalid_content(
- self, authenticated_client, providers_fixture
+ self,
+ authenticated_client,
+ aws_provider,
):
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
new_name = "This is the new name"
payload = {"alias": new_name}
response = authenticated_client.patch(
@@ -2305,11 +2376,11 @@ class TestProviderViewSet:
def test_providers_partial_update_invalid_fields(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
attribute_key,
attribute_value,
):
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
payload = {
"data": {
"type": "providers",
@@ -2331,7 +2402,7 @@ class TestProviderViewSet:
mock_delete_task,
mock_task_get,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
prowler_task = tasks_fixture[0]
@@ -2340,7 +2411,7 @@ class TestProviderViewSet:
mock_delete_task.return_value = task_mock
mock_task_get.return_value = prowler_task
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
response = authenticated_client.delete(
reverse("provider-detail", kwargs={"pk": provider1.id})
)
@@ -2364,7 +2435,7 @@ class TestProviderViewSet:
mock_provider_connection,
mock_task_get,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
prowler_task = tasks_fixture[0]
@@ -2374,7 +2445,7 @@ class TestProviderViewSet:
mock_provider_connection.return_value = task_mock
mock_task_get.return_value = prowler_task
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
assert provider1.connected is None
assert provider1.connection_last_checked_at is None
@@ -2389,7 +2460,8 @@ class TestProviderViewSet:
assert response.headers["Content-Location"] == f"/api/v1/tasks/{task_mock.id}"
def test_providers_connection_invalid_provider(
- self, authenticated_client, providers_fixture
+ self,
+ authenticated_client,
):
response = authenticated_client.post(
reverse("provider-connection", kwargs={"pk": "random_id"})
@@ -2397,42 +2469,24 @@ class TestProviderViewSet:
assert response.status_code == status.HTTP_404_NOT_FOUND
@pytest.mark.parametrize(
- "filter_name, filter_value, expected_count",
+ "filter_name, filter_value",
(
[
- ("provider", "aws", 2),
- ("provider.in", "azure,gcp", 2),
- ("uid", "123456789012", 1),
- (
- "uid.icontains",
- "1",
- 12,
- ),
- ("alias", "aws_testing_1", 1),
- ("alias.icontains", "aws", 2),
- ("inserted_at", TODAY, 14),
- (
- "inserted_at.gte",
- "2024-01-01",
- 14,
- ),
- ("inserted_at.lte", "2024-01-01", 0),
- (
- "updated_at.gte",
- "2024-01-01",
- 14,
- ),
- ("updated_at.lte", "2024-01-01", 0),
+ ("uid", "123456789012"),
+ ("uid.icontains", "1"),
+ ("alias", "aws_testing_1"),
+ ("inserted_at", TODAY),
+ ("inserted_at.gte", "2024-01-01"),
+ ("updated_at.gte", "2024-01-01"),
]
),
)
- def test_providers_filters(
+ def test_providers_filters_single_aws_provider(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
filter_name,
filter_value,
- expected_count,
):
response = authenticated_client.get(
reverse("provider-list"),
@@ -2440,7 +2494,69 @@ class TestProviderViewSet:
)
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == expected_count
+ assert len(response.json()["data"]) == 1
+
+ @pytest.mark.parametrize(
+ "filter_name, filter_value",
+ (
+ [
+ ("inserted_at.lte", "2024-01-01"),
+ ("updated_at.lte", "2024-01-01"),
+ ]
+ ),
+ )
+ def test_providers_filters_single_aws_provider_no_results(
+ self,
+ authenticated_client,
+ aws_provider,
+ filter_name,
+ filter_value,
+ ):
+ response = authenticated_client.get(
+ reverse("provider-list"),
+ {f"filter[{filter_name}]": filter_value},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ assert len(response.json()["data"]) == 0
+
+ @pytest.mark.parametrize(
+ "filter_name, filter_value",
+ (
+ [
+ ("provider", "aws"),
+ ("alias.icontains", "aws"),
+ ]
+ ),
+ )
+ def test_providers_filters_two_aws_providers(
+ self,
+ authenticated_client,
+ aws_provider_pair,
+ filter_name,
+ filter_value,
+ ):
+ response = authenticated_client.get(
+ reverse("provider-list"),
+ {f"filter[{filter_name}]": filter_value},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ assert len(response.json()["data"]) == 2
+
+ def test_providers_filters_provider_in(
+ self,
+ authenticated_client,
+ azure_provider,
+ gcp_provider,
+ ):
+ response = authenticated_client.get(
+ reverse("provider-list"),
+ {"filter[provider.in]": "azure,gcp"},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ assert len(response.json()["data"]) == 2
@pytest.mark.parametrize(
"filter_name",
@@ -2634,9 +2750,9 @@ class TestProviderGroupViewSet:
assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
def test_provider_group_create_with_relationships(
- self, authenticated_client, providers_fixture, roles_fixture
+ self, authenticated_client, aws_provider_pair, roles_fixture
):
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
role1, role2, *_ = roles_fixture
data = {
@@ -2677,12 +2793,13 @@ class TestProviderGroupViewSet:
self,
authenticated_client,
provider_groups_fixture,
- providers_fixture,
+ gcp_provider,
+ kubernetes_provider,
roles_fixture,
):
group = provider_groups_fixture[0]
- provider3 = providers_fixture[2]
- provider4 = providers_fixture[3]
+ provider3 = gcp_provider
+ provider4 = kubernetes_provider
role3 = roles_fixture[2]
role4 = roles_fixture[3]
@@ -2719,11 +2836,15 @@ class TestProviderGroupViewSet:
assert set(group.roles.all()) == {role3, role4}
def test_provider_group_clear_relationships(
- self, authenticated_client, providers_fixture, provider_groups_fixture
+ self,
+ authenticated_client,
+ gcp_provider,
+ kubernetes_provider,
+ provider_groups_fixture,
):
group = provider_groups_fixture[0]
- provider3 = providers_fixture[2]
- provider4 = providers_fixture[3]
+ provider3 = gcp_provider
+ provider4 = kubernetes_provider
data = {
"data": {
@@ -2796,10 +2917,57 @@ class TestProviderGroupViewSet:
@pytest.mark.django_db
class TestProviderSecretViewSet:
+ @staticmethod
+ def _oraclecloud_secret(**overrides):
+ secret = {
+ "user": "ocid1.user.oc1..aaaaaaaakldibrbov4ubh25aqdeiroklxjngwka7u6w7no3glmdq3n5sxtkq",
+ "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ "key_content": "test-key-content",
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
+ }
+ secret.update(overrides)
+ return secret
+
+ def _create_oraclecloud_secret(
+ self,
+ authenticated_client,
+ oraclecloud_provider,
+ secret,
+ name="OCI Secret",
+ ):
+ data = {
+ "data": {
+ "type": "provider-secrets",
+ "attributes": {
+ "name": name,
+ "secret_type": ProviderSecret.TypeChoices.STATIC,
+ "secret": secret,
+ },
+ "relationships": {
+ "provider": {
+ "data": {
+ "type": "providers",
+ "id": str(oraclecloud_provider.id),
+ }
+ }
+ },
+ }
+ }
+ return authenticated_client.post(
+ reverse("providersecret-list"),
+ data=json.dumps(data),
+ content_type="application/vnd.api+json",
+ )
+
def test_provider_secrets_list(self, authenticated_client, provider_secret_fixture):
response = authenticated_client.get(reverse("providersecret-list"))
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == len(provider_secret_fixture)
+ assert len(response.json()["data"]) == min(
+ settings.REST_FRAMEWORK["PAGE_SIZE"], len(provider_secret_fixture)
+ )
+ assert response.json()["meta"]["pagination"]["count"] == len(
+ provider_secret_fixture
+ )
def test_provider_secrets_retrieve(
self, authenticated_client, provider_secret_fixture
@@ -2897,7 +3065,24 @@ class TestProviderSecretViewSet:
Provider.ProviderChoices.KUBERNETES.value,
ProviderSecret.TypeChoices.STATIC,
{
- "kubeconfig_content": "kubeconfig-content",
+ "kubeconfig_content": """
+apiVersion: v1
+kind: Config
+clusters:
+ - name: test-cluster
+ cluster:
+ server: https://kubernetes.example.test
+users:
+ - name: test-user
+ user:
+ token: test-token
+contexts:
+ - name: test-context
+ context:
+ cluster: test-cluster
+ user: test-user
+current-context: test-context
+""",
},
),
# M365 client secret credentials
@@ -2933,7 +3118,6 @@ class TestProviderSecretViewSet:
"fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
"key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-key-content\n-----END RSA PRIVATE KEY-----",
"tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
- "region": "us-ashburn-1",
},
),
# OCI with API key credentials (with key_file)
@@ -2945,7 +3129,6 @@ class TestProviderSecretViewSet:
"fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
"key_file": "/path/to/oci_api_key.pem",
"tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
- "region": "us-ashburn-1",
},
),
# OCI with API key credentials (with passphrase)
@@ -2957,7 +3140,6 @@ class TestProviderSecretViewSet:
"fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
"key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-encrypted-key\n-----END RSA PRIVATE KEY-----",
"tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
- "region": "us-ashburn-1",
"pass_phrase": "my-secure-passphrase",
},
),
@@ -3053,6 +3235,15 @@ class TestProviderSecretViewSet:
"api_token": "fake-vercel-api-token-for-testing",
},
),
+ # Image registry credentials
+ (
+ Provider.ProviderChoices.IMAGE.value,
+ ProviderSecret.TypeChoices.STATIC,
+ {
+ "registry_username": "user",
+ "registry_password": "pass",
+ },
+ ),
# Okta with inline private key credentials
(
Provider.ProviderChoices.OKTA.value,
@@ -3071,16 +3262,12 @@ class TestProviderSecretViewSet:
def test_provider_secrets_create_valid(
self,
authenticated_client,
- providers_fixture,
+ provider_factory,
provider_type,
secret_type,
secret_data,
):
- # Get the provider from the fixture and set its type
- try:
- provider = Provider.objects.filter(provider=provider_type)[0]
- except IndexError:
- print(f"Provider {provider_type} not found")
+ provider = provider_factory(provider_type)
data = {
"data": {
@@ -3110,6 +3297,103 @@ class TestProviderSecretViewSet:
== data["data"]["relationships"]["provider"]["data"]["id"]
)
+ def test_provider_secrets_create_oraclecloud_without_region_stores_no_region(
+ self,
+ authenticated_client,
+ oraclecloud_provider,
+ ):
+ response = self._create_oraclecloud_secret(
+ authenticated_client,
+ oraclecloud_provider,
+ self._oraclecloud_secret(),
+ )
+
+ assert response.status_code == status.HTTP_201_CREATED
+ provider_secret = ProviderSecret.objects.get()
+ assert "region" not in provider_secret.secret
+
+ def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
+ self,
+ authenticated_client,
+ oraclecloud_provider,
+ ):
+ response = self._create_oraclecloud_secret(
+ authenticated_client,
+ oraclecloud_provider,
+ self._oraclecloud_secret(
+ key_content=" test-key-content ", region=" us-ashburn-1 "
+ ),
+ )
+
+ assert response.status_code == status.HTTP_201_CREATED
+ provider_secret = ProviderSecret.objects.get()
+ assert provider_secret.secret["key_content"] == "test-key-content"
+ assert "region" not in provider_secret.secret
+
+ def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
+ self,
+ authenticated_client,
+ oraclecloud_provider,
+ ):
+ create_response = self._create_oraclecloud_secret(
+ authenticated_client,
+ oraclecloud_provider,
+ self._oraclecloud_secret(),
+ )
+ provider_secret = ProviderSecret.objects.get(
+ id=create_response.json()["data"]["id"]
+ )
+ data = {
+ "data": {
+ "type": "provider-secrets",
+ "id": str(provider_secret.id),
+ "attributes": {"secret": self._oraclecloud_secret()},
+ }
+ }
+
+ response = authenticated_client.patch(
+ reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+ data=json.dumps(data),
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ provider_secret.refresh_from_db()
+ assert "region" not in provider_secret.secret
+
+ def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
+ self,
+ authenticated_client,
+ oraclecloud_provider,
+ ):
+ create_response = self._create_oraclecloud_secret(
+ authenticated_client,
+ oraclecloud_provider,
+ self._oraclecloud_secret(),
+ )
+ provider_secret = ProviderSecret.objects.get(
+ id=create_response.json()["data"]["id"]
+ )
+ data = {
+ "data": {
+ "type": "provider-secrets",
+ "id": str(provider_secret.id),
+ "attributes": {
+ "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
+ },
+ }
+ }
+
+ response = authenticated_client.patch(
+ reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+ data=json.dumps(data),
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ provider_secret.refresh_from_db()
+ assert "region" not in provider_secret.secret
+
@pytest.mark.parametrize(
"attributes, error_code, error_pointer",
(
@@ -3150,13 +3434,13 @@ class TestProviderSecretViewSet:
)
def test_provider_secrets_invalid_create(
self,
- providers_fixture,
+ aws_provider,
authenticated_client,
attributes,
error_code,
error_pointer,
):
- provider, *_ = providers_fixture
+ provider = aws_provider
data = {
"data": {
"type": "provider-secrets",
@@ -3180,14 +3464,9 @@ class TestProviderSecretViewSet:
def test_provider_secrets_invalid_create_okta_missing_private_key(
self,
- providers_fixture,
+ okta_provider,
authenticated_client,
):
- okta_provider = next(
- provider
- for provider in providers_fixture
- if provider.provider == Provider.ProviderChoices.OKTA.value
- )
data = {
"data": {
"type": "provider-secrets",
@@ -3311,30 +3590,43 @@ class TestProviderSecretViewSet:
)
assert response.status_code == status.HTTP_404_NOT_FOUND
- @pytest.mark.parametrize(
- "filter_name, filter_value, expected_count",
- (
- [
- ("name", "aws_testing_1", 1),
- ("name.icontains", "aws", 2),
- ]
- ),
- )
- def test_provider_secrets_filters(
+ def test_provider_secrets_filter_name(
self,
authenticated_client,
provider_secret_fixture,
- filter_name,
- filter_value,
- expected_count,
):
response = authenticated_client.get(
reverse("providersecret-list"),
- {f"filter[{filter_name}]": filter_value},
+ {"filter[name]": "aws_testing_1"},
)
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == expected_count
+ assert len(response.json()["data"]) == 1
+
+ def test_provider_secrets_filter_name_icontains(
+ self,
+ authenticated_client,
+ provider_secret_fixture,
+ provider_factory,
+ ):
+ provider = provider_factory(
+ Provider.ProviderChoices.AWS.value, alias="aws_testing_extra"
+ )
+ ProviderSecret.objects.create(
+ tenant_id=provider.tenant_id,
+ provider=provider,
+ secret_type=ProviderSecret.TypeChoices.STATIC,
+ secret={"key": "value"},
+ name=provider.alias,
+ )
+
+ response = authenticated_client.get(
+ reverse("providersecret-list"),
+ {"filter[name.icontains]": "aws"},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ assert len(response.json()["data"]) == 2
@pytest.mark.parametrize(
"filter_name",
@@ -3472,18 +3764,9 @@ class TestProviderSecretViewSet:
assert response.status_code == status.HTTP_400_BAD_REQUEST
def test_m365_provider_secrets_invalid_certificate_base64(
- self, authenticated_client, providers_fixture
+ self, authenticated_client, m365_provider
):
"""Test M365 provider secret creation with invalid base64 certificate content"""
- # Find M365 provider from fixture
- m365_provider = None
- for provider in providers_fixture:
- if provider.provider == Provider.ProviderChoices.M365.value:
- m365_provider = provider
- break
-
- assert m365_provider is not None, "M365 provider not found in fixture"
-
data = {
"data": {
"type": "provider-secrets",
@@ -3541,7 +3824,7 @@ class TestScanViewSet:
assert response.status_code == status.HTTP_404_NOT_FOUND
@pytest.mark.parametrize(
- "scan_json_payload, expected_scanner_args",
+ "scan_json_payload, _expected_scanner_args",
[
# Case 1: No scanner_args in payload (should use provider's scanner_args)
(
@@ -3582,22 +3865,16 @@ class TestScanViewSet:
),
],
)
- @patch("api.v1.views.Task.objects.get")
- @patch("api.v1.views.perform_scan_task.apply_async")
+ @patch("api.v1.views.enqueue_scan_execution_on_commit")
def test_scans_create_valid(
self,
- mock_perform_scan_task,
- mock_task_get,
+ mock_enqueue_scan_execution,
authenticated_client,
scan_json_payload,
- expected_scanner_args,
- providers_fixture,
- tasks_fixture,
+ _expected_scanner_args,
+ okta_provider,
):
- prowler_task = tasks_fixture[0]
- mock_perform_scan_task.return_value.id = prowler_task.id
- mock_task_get.return_value = prowler_task
- *_, provider5 = providers_fixture
+ provider5 = okta_provider
# Provider5 has these scanner_args
# scanner_args={"key1": "value1", "key2": {"key21": "value21"}}
@@ -3621,8 +3898,121 @@ class TestScanViewSet:
assert scan.name == scan_json_payload["data"]["attributes"]["name"]
assert scan.provider == provider5
assert scan.trigger == Scan.TriggerChoices.MANUAL
+ mock_enqueue_scan_execution.assert_called_once()
# assert scan.scanner_args == expected_scanner_args
+ @patch("tasks.tasks.perform_scan_task.apply_async")
+ def test_scans_create_queues_scan_when_provider_has_active_scan(
+ self,
+ mock_perform_scan_task,
+ authenticated_client,
+ aws_provider,
+ tenants_fixture,
+ django_capture_on_commit_callbacks,
+ ):
+ tenant, *_ = tenants_fixture
+ provider = aws_provider
+ task_result = TaskResult.objects.create(
+ task_id=str(uuid4()),
+ task_name="scan-perform",
+ status=states.PENDING,
+ )
+ prowler_task = Task.objects.create(
+ id=task_result.task_id,
+ tenant_id=tenant.id,
+ task_runner_task=task_result,
+ )
+ Scan.objects.create(
+ name="Active scan",
+ provider=provider,
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ tenant_id=tenant.id,
+ task=prowler_task,
+ )
+
+ with django_capture_on_commit_callbacks(execute=True):
+ response = authenticated_client.post(
+ reverse("scan-list"),
+ data={
+ "data": {
+ "type": "scans",
+ "attributes": {"name": "Duplicate Scan"},
+ "relationships": {
+ "provider": {
+ "data": {"type": "providers", "id": str(provider.id)}
+ }
+ },
+ }
+ },
+ content_type=API_JSON_CONTENT_TYPE,
+ )
+
+ assert response.status_code == status.HTTP_202_ACCEPTED
+ assert response.json()["data"]["id"] != str(prowler_task.id)
+ assert Scan.objects.count() == 2
+ queued_scan = Scan.objects.exclude(task=prowler_task).get()
+ assert queued_scan.trigger == Scan.TriggerChoices.MANUAL
+ assert queued_scan.state == StateChoices.AVAILABLE
+ assert queued_scan.task.task_runner_task.status == "QUEUED"
+ mock_perform_scan_task.assert_not_called()
+
+ @patch("tasks.tasks.perform_scan_task.apply_async")
+ def test_scans_create_queues_scan_when_scheduled_scan_is_claimed(
+ self,
+ mock_perform_scan_task,
+ authenticated_client,
+ aws_provider,
+ tenants_fixture,
+ django_capture_on_commit_callbacks,
+ ):
+ tenant, *_ = tenants_fixture
+ provider = aws_provider
+ task_result = TaskResult.objects.create(
+ task_id=str(uuid4()),
+ task_name="scan-perform-scheduled",
+ status=states.STARTED,
+ )
+ prowler_task = Task.objects.create(
+ id=task_result.task_id,
+ tenant_id=tenant.id,
+ task_runner_task=task_result,
+ )
+ Scan.objects.create(
+ name="Claimed scheduled scan",
+ provider=provider,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.SCHEDULED,
+ tenant_id=tenant.id,
+ task=prowler_task,
+ )
+
+ with django_capture_on_commit_callbacks(execute=True):
+ response = authenticated_client.post(
+ reverse("scan-list"),
+ data={
+ "data": {
+ "type": "scans",
+ "attributes": {"name": "Manual Scan"},
+ "relationships": {
+ "provider": {
+ "data": {"type": "providers", "id": str(provider.id)}
+ }
+ },
+ }
+ },
+ content_type=API_JSON_CONTENT_TYPE,
+ )
+
+ assert response.status_code == status.HTTP_202_ACCEPTED
+ assert response.json()["data"]["id"] != str(prowler_task.id)
+ assert Scan.objects.count() == 2
+ queued_scan = Scan.objects.exclude(task=prowler_task).get()
+ assert queued_scan.trigger == Scan.TriggerChoices.MANUAL
+ assert queued_scan.state == StateChoices.AVAILABLE
+ assert queued_scan.task.task_runner_task.status == "QUEUED"
+ mock_perform_scan_task.assert_not_called()
+
@pytest.mark.parametrize(
"scan_json_payload, error_code",
[
@@ -3649,10 +4039,10 @@ class TestScanViewSet:
self,
authenticated_client,
scan_json_payload,
- providers_fixture,
+ aws_provider,
error_code,
):
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
scan_json_payload["data"]["relationships"]["provider"]["data"]["id"] = str(
provider1.id
)
@@ -4069,7 +4459,7 @@ class TestScanViewSet:
monkeypatch.setattr(
"api.v1.views.env",
- type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
+ type("env", (), {"str": lambda self, *_args, **_kwargs: "test-bucket"})(),
)
presigned_url = (
@@ -4175,7 +4565,7 @@ class TestScanViewSet:
monkeypatch.setattr(
"api.v1.views.TaskSerializer",
- lambda *args, **kwargs: type("S", (), {"data": dummy}),
+ lambda *_args, **_kwargs: type("S", (), {"data": dummy}),
)
framework = get_compliance_frameworks(scan.provider.provider)[0]
@@ -4233,7 +4623,7 @@ class TestScanViewSet:
monkeypatch.setattr(
"api.v1.views.env",
- type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
+ type("env", (), {"str": lambda self, *_args, **_kwargs: "test-bucket"})(),
)
match_key = "path/compliance/mitre_attack_aws.csv"
@@ -4244,6 +4634,7 @@ class TestScanViewSet:
class FakeS3Client:
def list_objects_v2(self, Bucket, Prefix):
+ del Prefix
return {"Contents": [{"Key": match_key}]}
def generate_presigned_url(self, ClientMethod, Params, ExpiresIn):
@@ -4275,7 +4666,7 @@ class TestScanViewSet:
monkeypatch.setattr(
"api.v1.views.env",
- type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
+ type("env", (), {"str": lambda self, *_args, **_kwargs: "test-bucket"})(),
)
old_key = "path/compliance/prowler-output-aws-20240101000000_cis_1.4_aws.csv"
@@ -4283,6 +4674,7 @@ class TestScanViewSet:
class FakeS3Client:
def list_objects_v2(self, Bucket, Prefix):
+ del Prefix
return {
"Contents": [
{
@@ -4356,11 +4748,12 @@ class TestScanViewSet:
monkeypatch.setattr(
"api.v1.views.env",
- type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
+ type("env", (), {"str": lambda self, *_args, **_kwargs: "test-bucket"})(),
)
class FakeS3Client:
def list_objects_v2(self, Bucket, Prefix):
+ del Prefix
return {"Contents": []}
def get_object(self, Bucket, Key):
@@ -4546,7 +4939,7 @@ class TestScanViewSet:
inserted_at=base + timedelta(hours=1)
)
- mock_task_serializer.side_effect = lambda instance, *a, **k: SimpleNamespace(
+ mock_task_serializer.side_effect = lambda instance, *_a, **_k: SimpleNamespace(
data={"id": str(instance.id), "state": StateChoices.EXECUTING}
)
@@ -4709,12 +5102,13 @@ class TestAttackPathsScanViewSet:
def test_attack_paths_scans_list_returns_latest_entry_per_provider(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
+ aws_provider_pair,
):
- provider = providers_fixture[0]
- other_provider = providers_fixture[1]
+ provider = aws_provider
+ other_provider = aws_provider_pair[1]
older_scan = create_attack_paths_scan(
provider,
@@ -4754,19 +5148,78 @@ class TestAttackPathsScanViewSet:
assert first_attributes["provider_type"] == provider.provider
assert first_attributes["provider_uid"] == provider.uid
+ def test_attack_paths_scans_list_prefers_active_sink_scan_on_rollback(
+ self,
+ authenticated_client,
+ aws_provider,
+ scans_fixture,
+ create_attack_paths_scan,
+ settings,
+ ):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ provider = aws_provider
+
+ neo4j_scan = create_attack_paths_scan(
+ provider,
+ scan=scans_fixture[0],
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ sink_backend="neo4j",
+ )
+ neptune_scan = create_attack_paths_scan(
+ provider,
+ scan=scans_fixture[0],
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ sink_backend="neptune",
+ )
+
+ response = authenticated_client.get(reverse("attack-paths-scans-list"))
+
+ assert response.status_code == status.HTTP_200_OK
+ ids = {item["id"] for item in response.json()["data"]}
+ assert str(neo4j_scan.id) in ids
+ assert str(neptune_scan.id) not in ids
+
+ def test_attack_paths_scans_list_falls_back_when_active_sink_has_no_scan(
+ self,
+ authenticated_client,
+ aws_provider,
+ scans_fixture,
+ create_attack_paths_scan,
+ settings,
+ ):
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ provider = aws_provider
+
+ legacy_scan = create_attack_paths_scan(
+ provider,
+ scan=scans_fixture[0],
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ sink_backend="neo4j",
+ )
+
+ response = authenticated_client.get(reverse("attack-paths-scans-list"))
+
+ assert response.status_code == status.HTTP_200_OK
+ ids = {item["id"] for item in response.json()["data"]}
+ assert str(legacy_scan.id) in ids
+
def test_attack_paths_scans_list_respects_provider_group_visibility(
self,
authenticated_client_no_permissions_rbac,
- providers_fixture,
+ aws_provider,
create_attack_paths_scan,
+ aws_provider_pair,
):
client = authenticated_client_no_permissions_rbac
limited_user = client.user
membership = Membership.objects.filter(user=limited_user).first()
tenant = membership.tenant
- allowed_provider = providers_fixture[0]
- denied_provider = providers_fixture[1]
+ allowed_provider = aws_provider
+ denied_provider = aws_provider_pair[1]
allowed_scan = create_attack_paths_scan(allowed_provider)
create_attack_paths_scan(denied_provider)
@@ -4797,11 +5250,11 @@ class TestAttackPathsScanViewSet:
def test_attack_paths_scan_retrieve(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -4840,11 +5293,11 @@ class TestAttackPathsScanViewSet:
def test_attack_paths_queries_returns_catalog(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -4874,7 +5327,8 @@ class TestAttackPathsScanViewSet:
)
assert response.status_code == status.HTTP_200_OK
- mock_get_queries.assert_called_once_with(provider.provider)
+ # TODO: drop the is_migrated argument after Neptune cutover
+ mock_get_queries.assert_called_once_with(provider.provider, is_migrated=False)
payload = response.json()["data"]
assert len(payload) == 1
assert payload[0]["id"] == "aws-rds"
@@ -4884,11 +5338,11 @@ class TestAttackPathsScanViewSet:
def test_attack_paths_queries_returns_404_when_catalog_missing(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(provider, scan=scans_fixture[0])
with patch("api.v1.views.get_queries_for_provider", return_value=[]):
@@ -4904,11 +5358,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_returns_graph(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -4974,7 +5428,8 @@ class TestAttackPathsScanViewSet:
)
assert response.status_code == status.HTTP_200_OK
- mock_get_query.assert_called_once_with("aws-rds")
+ # TODO: drop the is_migrated argument after Neptune cutover
+ mock_get_query.assert_called_once_with("aws-rds", is_migrated=False)
mock_get_db_name.assert_called_once_with(attack_paths_scan.provider.tenant_id)
provider_id = str(attack_paths_scan.provider_id)
mock_prepare.assert_called_once_with(
@@ -4988,6 +5443,7 @@ class TestAttackPathsScanViewSet:
query_definition,
prepared_parameters,
provider_id,
+ scan=attack_paths_scan,
)
result = response.json()["data"]
attributes = result["attributes"]
@@ -4997,11 +5453,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_returns_text_when_accept_text_plain(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5064,11 +5520,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_blocks_when_graph_data_not_ready(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5090,11 +5546,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_allows_executing_scan_when_graph_data_ready(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5144,11 +5600,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_allows_failed_scan_when_graph_data_ready(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5198,11 +5654,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_unknown_query(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5225,11 +5681,11 @@ class TestAttackPathsScanViewSet:
def test_run_attack_paths_query_returns_404_when_no_nodes_found(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5292,11 +5748,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_graph(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5339,6 +5795,7 @@ class TestAttackPathsScanViewSet:
"db-test",
"MATCH (n) RETURN n",
str(attack_paths_scan.provider_id),
+ scan=attack_paths_scan,
)
attributes = response.json()["data"]["attributes"]
assert len(attributes["nodes"]) == 1
@@ -5348,11 +5805,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_text_when_accept_text_plain(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5401,11 +5858,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_404_when_no_nodes(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5441,11 +5898,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_400_when_graph_not_ready(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5467,11 +5924,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_403_for_write_query(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5525,12 +5982,12 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_rejects_ssrf_patterns(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
cypher,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5619,13 +6076,13 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_401_unauthenticated(
self,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
from rest_framework.test import APIClient
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5646,13 +6103,13 @@ class TestAttackPathsScanViewSet:
def test_cartography_schema_returns_401_unauthenticated(
self,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
from rest_framework.test import APIClient
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5672,11 +6129,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_403_no_manage_scans(
self,
authenticated_client_no_permissions_rbac,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5699,13 +6156,13 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_does_not_leak_internals_on_error(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
from rest_framework.exceptions import APIException
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5743,11 +6200,11 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_throttled_after_limit(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5797,13 +6254,13 @@ class TestAttackPathsScanViewSet:
def test_run_custom_query_returns_500_on_database_timeout(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
from rest_framework.exceptions import APIException
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5838,11 +6295,11 @@ class TestAttackPathsScanViewSet:
def test_cartography_schema_returns_urls(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5875,9 +6332,10 @@ class TestAttackPathsScanViewSet:
)
assert response.status_code == status.HTTP_200_OK
- mock_get_schema.assert_called_once_with(
- "db-test", str(attack_paths_scan.provider_id)
- )
+ mock_get_schema.assert_called_once()
+ schema_args = mock_get_schema.call_args[0]
+ assert schema_args[:2] == ("db-test", str(attack_paths_scan.provider_id))
+ assert schema_args[2].id == attack_paths_scan.id
attributes = response.json()["data"]["attributes"]
assert attributes["provider"] == "aws"
assert attributes["cartography_version"] == "0.129.0"
@@ -5887,11 +6345,11 @@ class TestAttackPathsScanViewSet:
def test_cartography_schema_returns_404_when_no_metadata(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -5921,11 +6379,11 @@ class TestAttackPathsScanViewSet:
def test_cartography_schema_returns_400_when_graph_not_ready(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
scans_fixture,
create_attack_paths_scan,
):
- provider = providers_fixture[0]
+ provider = aws_provider
attack_paths_scan = create_attack_paths_scan(
provider,
scan=scans_fixture[0],
@@ -6215,9 +6673,8 @@ class TestResourceViewSet:
)
assert response.status_code == status.HTTP_404_NOT_FOUND
- def test_resources_metadata_retrieve(
- self, authenticated_client, resources_fixture, backfill_scan_metadata_fixture
- ):
+ @pytest.mark.usefixtures("backfill_scan_metadata_fixture")
+ def test_resources_metadata_retrieve(self, authenticated_client, resources_fixture):
resource_1, *_ = resources_fixture
response = authenticated_client.get(
reverse("resource-metadata"),
@@ -6237,8 +6694,9 @@ class TestResourceViewSet:
assert set(data["data"]["attributes"]["types"]) == expected_resource_types
assert set(data["data"]["attributes"]["groups"]) == expected_groups
+ @pytest.mark.usefixtures("backfill_scan_metadata_fixture")
def test_resources_metadata_resource_filter_retrieve(
- self, authenticated_client, resources_fixture, backfill_scan_metadata_fixture
+ self, authenticated_client, resources_fixture
):
resource_1, *_ = resources_fixture
response = authenticated_client.get(
@@ -6344,10 +6802,13 @@ class TestResourceViewSet:
)
def test_resources_latest_filter_by_provider_id_in_multiple(
- self, authenticated_client, providers_fixture
+ self,
+ authenticated_client,
+ aws_provider,
+ aws_provider_pair,
):
"""Test that provider_id__in filter works with multiple provider IDs."""
- provider1, provider2 = providers_fixture[0], providers_fixture[1]
+ provider1, provider2 = aws_provider, aws_provider_pair[1]
tenant_id = str(provider1.tenant_id)
# Create completed scans for both providers
@@ -6416,12 +6877,14 @@ class TestResourceViewSet:
assert len(response.json()["data"]) == 0
# Events endpoint tests
- def test_events_non_aws_provider(self, authenticated_client, providers_fixture):
+ def test_events_non_aws_provider(
+ self,
+ authenticated_client,
+ azure_provider,
+ ):
"""Test events endpoint rejects non-AWS providers."""
from api.models import Resource
- azure_provider = providers_fixture[4] # Azure provider from fixture
-
resource = Resource.objects.create(
uid="test-resource-id",
name="Test Resource",
@@ -6457,7 +6920,7 @@ class TestResourceViewSet:
def test_events_invalid_lookback_days(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
lookback_days,
expected_status,
expected_code,
@@ -6466,8 +6929,6 @@ class TestResourceViewSet:
"""Test events endpoint validates lookback_days with JSON:API compliant errors."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-test",
name="Test Instance",
@@ -6504,7 +6965,7 @@ class TestResourceViewSet:
def test_events_invalid_page_size(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
page_size,
expected_status,
expected_code,
@@ -6513,8 +6974,6 @@ class TestResourceViewSet:
"""Test events endpoint validates page[size] with JSON:API compliant errors."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-pagesize-test",
name="Test Instance",
@@ -6552,15 +7011,13 @@ class TestResourceViewSet:
def test_events_invalid_query_parameter(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
invalid_params,
expected_invalid_param,
):
"""Test events endpoint rejects unknown query parameters with JSON:API compliant errors."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-test",
name="Test Instance",
@@ -6597,13 +7054,11 @@ class TestResourceViewSet:
def test_events_multiple_invalid_query_parameters(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test events endpoint returns error for first unknown parameter."""
from api.models import Resource
- aws_provider = providers_fixture[0]
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-test",
name="Test Instance",
@@ -6640,13 +7095,11 @@ class TestResourceViewSet:
mock_cloudtrail_timeline,
mock_initialize_provider,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test successful events retrieval."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
# Create test resource
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-test123",
@@ -6732,13 +7185,11 @@ class TestResourceViewSet:
mock_cloudtrail_timeline,
mock_initialize_provider,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test events uses default lookback_days (90) when not provided."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:s3:::test-bucket",
name="Test Bucket",
@@ -6776,13 +7227,14 @@ class TestResourceViewSet:
@patch("api.v1.views.initialize_prowler_provider")
def test_events_no_credentials_error(
- self, mock_initialize_provider, authenticated_client, providers_fixture
+ self,
+ mock_initialize_provider,
+ authenticated_client,
+ aws_provider,
):
"""Test events handles missing credentials errors."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:rds:us-west-2:123456789012:db:test-db",
name="Test Database",
@@ -6815,13 +7267,11 @@ class TestResourceViewSet:
mock_cloudtrail_timeline,
mock_initialize_provider,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test events handles AccessDenied errors from AWS."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:lambda:eu-west-1:123456789012:function:test-func",
name="Test Function",
@@ -6866,13 +7316,11 @@ class TestResourceViewSet:
mock_cloudtrail_timeline,
mock_initialize_provider,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test events handles generic AWS API errors as 503."""
from api.models import Resource
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:lambda:eu-west-1:123456789012:function:test-func2",
name="Test Function 2",
@@ -6915,7 +7363,7 @@ class TestResourceViewSet:
self,
mock_initialize_provider,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
"""Test events handles AWSAssumeRoleError during provider init.
@@ -6927,8 +7375,6 @@ class TestResourceViewSet:
from api.models import Resource
from prowler.providers.aws.exceptions.exceptions import AWSAssumeRoleError
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:lambda:eu-west-1:123456789012:function:assume-role-test",
name="AssumeRole Test Function",
@@ -6972,7 +7418,7 @@ class TestResourceViewSet:
assert error["status"] == "502"
assert "detail" in error
- def test_events_unauthenticated_returns_401(self, providers_fixture):
+ def test_events_unauthenticated_returns_401(self, aws_provider):
"""Test events endpoint returns 401 when no credentials are provided.
This ensures the endpoint follows API conventions where missing authentication
@@ -6981,8 +7427,6 @@ class TestResourceViewSet:
from api.models import Resource
from rest_framework.test import APIClient
- aws_provider = providers_fixture[0] # AWS provider from fixture
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-unauth-test",
name="Test Instance",
@@ -7045,7 +7489,7 @@ class TestResourceViewSet:
# RLS hides resources from other tenants - should appear as not found
assert response.status_code == status.HTTP_404_NOT_FOUND
- def test_events_expired_token_returns_401(self, providers_fixture, tenants_fixture):
+ def test_events_expired_token_returns_401(self, aws_provider, tenants_fixture):
"""Test events endpoint returns 401 when JWT token is expired.
Expired tokens should return 401 Unauthorized, not 404 Not Found.
@@ -7055,8 +7499,6 @@ class TestResourceViewSet:
from api.models import Resource
from rest_framework.test import APIClient
- aws_provider = providers_fixture[0]
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-expired-test",
name="Test Instance",
@@ -7092,7 +7534,7 @@ class TestResourceViewSet:
"Expired tokens should return 401, not 404."
)
- def test_events_invalid_token_returns_401(self, providers_fixture):
+ def test_events_invalid_token_returns_401(self, aws_provider):
"""Test events endpoint returns 401 when JWT token is completely invalid.
Malformed or invalid tokens should return 401 Unauthorized, not 404 Not Found.
@@ -7100,8 +7542,6 @@ class TestResourceViewSet:
from api.models import Resource
from rest_framework.test import APIClient
- aws_provider = providers_fixture[0]
-
resource = Resource.objects.create(
uid="arn:aws:ec2:us-east-1:123456789012:instance/i-invalid-test",
name="Test Instance",
@@ -7155,6 +7595,26 @@ class TestFindingViewSet:
assert response.status_code == status.HTTP_400_BAD_REQUEST
assert response.json()["errors"][0]["code"] == "invalid"
+ def test_findings_updated_at_range_too_large_with_inserted_at_filter(
+ self, authenticated_client
+ ):
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {
+ "filter[inserted_at]": TODAY,
+ "filter[updated_at.gte]": today_after_n_days(
+ -(settings.FINDINGS_MAX_DAYS_IN_RANGE + 1)
+ ),
+ "filter[updated_at.lte]": TODAY,
+ },
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ assert response.json()["errors"][0]["code"] == "invalid"
+ assert response.json()["errors"][0]["source"]["pointer"] == (
+ "/data/attributes/updated_at"
+ )
+
def test_findings_list(self, authenticated_client, findings_fixture):
response = authenticated_client.get(
reverse("finding-list"), {"filter[inserted_at]": TODAY}
@@ -7166,6 +7626,170 @@ class TestFindingViewSet:
== findings_fixture[0].status
)
+ def test_findings_list_inserted_at_accepts_timestamp_precision_filters(
+ self, authenticated_client, scans_fixture
+ ):
+ scan, *_ = scans_fixture
+
+ def create_finding(uid, inserted_at):
+ finding = Finding.objects.create(
+ id=datetime_to_uuid7(inserted_at),
+ tenant_id=scan.tenant_id,
+ uid=uid,
+ scan=scan,
+ status=Status.FAIL,
+ status_extended="timestamp precision status",
+ impact=Severity.medium,
+ severity=Severity.medium,
+ check_id="timestamp_precision_check",
+ check_metadata={
+ "CheckId": "timestamp_precision_check",
+ "Description": "timestamp precision check",
+ "servicename": "ec2",
+ },
+ first_seen_at=inserted_at,
+ )
+ Finding.all_objects.filter(pk=finding.pk).update(
+ inserted_at=inserted_at,
+ updated_at=inserted_at,
+ )
+ finding.refresh_from_db()
+ return finding
+
+ create_finding(
+ "timestamp_precision_early",
+ datetime(2026, 1, 15, 10, 30, 0, 100000, tzinfo=UTC),
+ )
+ late_finding = create_finding(
+ "timestamp_precision_late",
+ datetime(2026, 1, 15, 10, 30, 0, 200000, tzinfo=UTC),
+ )
+
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {
+ "filter[inserted_at.gte]": "2026-01-15T10:30:00.150Z",
+ "filter[inserted_at.lte]": "2026-01-15T10:30:00.250Z",
+ },
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ returned_uids = {
+ finding["attributes"]["uid"] for finding in response.json()["data"]
+ }
+ assert returned_uids == {late_finding.uid}
+
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {"filter[inserted_at]": "2026-01-15T10:30:00.200Z"},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ returned_uids = {
+ finding["attributes"]["uid"] for finding in response.json()["data"]
+ }
+ assert returned_uids == {late_finding.uid}
+
+ def test_findings_list_updated_at_accepts_timestamp_precision_filters(
+ self, authenticated_client, findings_fixture
+ ):
+ early_finding, late_finding, *_ = findings_fixture
+ early_updated_at = datetime(2026, 1, 15, 10, 30, 0, 100000, tzinfo=UTC)
+ late_updated_at = datetime(2026, 1, 15, 10, 30, 0, 200000, tzinfo=UTC)
+ Finding.all_objects.filter(pk=early_finding.pk).update(
+ updated_at=early_updated_at
+ )
+ Finding.all_objects.filter(pk=late_finding.pk).update(
+ updated_at=late_updated_at
+ )
+
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {
+ "filter[updated_at.gte]": "2026-01-15T10:30:00.150Z",
+ "filter[updated_at.lte]": "2026-01-15T10:30:00.250Z",
+ },
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ returned_uids = {
+ finding["attributes"]["uid"] for finding in response.json()["data"]
+ }
+ assert returned_uids == {late_finding.uid}
+
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {"filter[updated_at]": "2026-01-15T10:30:00.200Z"},
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ returned_uids = {
+ finding["attributes"]["uid"] for finding in response.json()["data"]
+ }
+ assert returned_uids == {late_finding.uid}
+
+ def test_findings_list_inserted_at_and_updated_at_filters_are_combined(
+ self, authenticated_client, scans_fixture
+ ):
+ scan, *_ = scans_fixture
+
+ def create_finding(uid, inserted_at, updated_at):
+ finding = Finding.objects.create(
+ id=datetime_to_uuid7(inserted_at),
+ tenant_id=scan.tenant_id,
+ uid=uid,
+ scan=scan,
+ status=Status.FAIL,
+ status_extended="timestamp precision status",
+ impact=Severity.medium,
+ severity=Severity.medium,
+ check_id="timestamp_precision_check",
+ check_metadata={
+ "CheckId": "timestamp_precision_check",
+ "Description": "timestamp precision check",
+ "servicename": "ec2",
+ },
+ first_seen_at=inserted_at,
+ )
+ Finding.all_objects.filter(pk=finding.pk).update(
+ inserted_at=inserted_at,
+ updated_at=updated_at,
+ )
+ finding.refresh_from_db()
+ return finding
+
+ matching_finding = create_finding(
+ "timestamp_precision_combined_match",
+ datetime(2026, 1, 15, 10, 30, 0, 200000, tzinfo=UTC),
+ datetime(2026, 1, 15, 11, 30, 0, 200000, tzinfo=UTC),
+ )
+ create_finding(
+ "timestamp_precision_combined_inserted_only",
+ datetime(2026, 1, 15, 10, 30, 0, 200000, tzinfo=UTC),
+ datetime(2026, 1, 15, 12, 30, 0, 200000, tzinfo=UTC),
+ )
+ create_finding(
+ "timestamp_precision_combined_updated_only",
+ datetime(2026, 1, 15, 9, 30, 0, 200000, tzinfo=UTC),
+ datetime(2026, 1, 15, 11, 30, 0, 200000, tzinfo=UTC),
+ )
+
+ response = authenticated_client.get(
+ reverse("finding-list"),
+ {
+ "filter[inserted_at.gte]": "2026-01-15T10:30:00.150Z",
+ "filter[inserted_at.lte]": "2026-01-15T10:30:00.250Z",
+ "filter[updated_at.gte]": "2026-01-15T11:30:00.150Z",
+ "filter[updated_at.lte]": "2026-01-15T11:30:00.250Z",
+ },
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ returned_uids = {
+ finding["attributes"]["uid"] for finding in response.json()["data"]
+ }
+ assert returned_uids == {matching_finding.uid}
+
def test_findings_list_resource_tags_no_n_plus_one(
self, authenticated_client, findings_fixture
):
@@ -7548,9 +8172,8 @@ class TestFindingViewSet:
)
assert response.status_code == status.HTTP_404_NOT_FOUND
- def test_findings_metadata_retrieve(
- self, authenticated_client, findings_fixture, backfill_scan_metadata_fixture
- ):
+ @pytest.mark.usefixtures("backfill_scan_metadata_fixture")
+ def test_findings_metadata_retrieve(self, authenticated_client, findings_fixture):
finding_1, *_ = findings_fixture
response = authenticated_client.get(
reverse("finding-metadata"),
@@ -7573,8 +8196,9 @@ class TestFindingViewSet:
)
# assert data["data"]["attributes"]["tags"] == expected_tags
+ @pytest.mark.usefixtures("backfill_scan_metadata_fixture")
def test_findings_metadata_resource_filter_retrieve(
- self, authenticated_client, findings_fixture, backfill_scan_metadata_fixture
+ self, authenticated_client, findings_fixture
):
finding_1, *_ = findings_fixture
response = authenticated_client.get(
@@ -7631,6 +8255,23 @@ class TestFindingViewSet:
]
}
+ @pytest.mark.parametrize(
+ "filter_name",
+ ["inserted_at", "inserted_at.gte", "inserted_at.lte"],
+ )
+ def test_findings_metadata_rejects_timestamp_precision_filters(
+ self, authenticated_client, filter_name
+ ):
+ response = authenticated_client.get(
+ reverse("finding-metadata"),
+ {f"filter[{filter_name}]": "2048-01-01T10:30:00Z"},
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ error = response.json()["errors"][0]
+ assert error["detail"] == "Enter a valid date."
+ assert error["code"] == "invalid"
+
def test_findings_metadata_backfill(
self, authenticated_client, scans_fixture, findings_fixture
):
@@ -7743,9 +8384,8 @@ class TestFindingViewSet:
attributes = response.json()["data"]["attributes"]
assert set(attributes["categories"]) == {"gen-ai", "security"}
- def test_findings_metadata_latest_categories(
- self, authenticated_client, latest_scan_finding_with_categories
- ):
+ @pytest.mark.usefixtures("latest_scan_finding_with_categories")
+ def test_findings_metadata_latest_categories(self, authenticated_client):
response = authenticated_client.get(
reverse("finding-metadata_latest"),
)
@@ -7753,9 +8393,8 @@ class TestFindingViewSet:
attributes = response.json()["data"]["attributes"]
assert set(attributes["categories"]) == {"gen-ai", "iam"}
- def test_findings_metadata_latest_groups(
- self, authenticated_client, latest_scan_finding_with_categories
- ):
+ @pytest.mark.usefixtures("latest_scan_finding_with_categories")
+ def test_findings_metadata_latest_groups(self, authenticated_client):
response = authenticated_client.get(
reverse("finding-metadata_latest"),
)
@@ -7856,11 +8495,17 @@ class TestFindingViewSet:
@pytest.mark.django_db
class TestJWTFields:
- def test_jwt_fields(self, authenticated_client, create_test_user):
- data = {"type": "tokens", "email": TEST_USER, "password": TEST_PASSWORD}
- response = authenticated_client.post(
- reverse("token-obtain"), data, format="json"
- )
+ def test_jwt_fields(self, create_test_user, tenants_fixture):
+ from rest_framework.test import APIClient
+
+ client = APIClient()
+ data = {
+ "data": {
+ "type": "tokens",
+ "attributes": {"email": TEST_USER, "password": TEST_PASSWORD},
+ }
+ }
+ response = client.post(reverse("token-obtain"), data, format="vnd.api+json")
assert response.status_code == status.HTTP_200_OK, (
f"Unexpected status code: {response.status_code}"
@@ -8275,16 +8920,14 @@ class TestInvitationViewSet:
expires_at=self.TOMORROW,
)
- data = {
- "invitation_token": invitation.token,
- }
+ data = {"invitation_token": invitation.token}
assert not Membership.objects.filter(
user__email__iexact=user.email, tenant=tenant
).exists()
response = authenticated_client.post(
- reverse("invitation-accept"), data=data, format="json"
+ reverse("invitation-accept"), data=data, format="vnd.api+json"
)
assert response.status_code == status.HTTP_201_CREATED
invitation.refresh_from_db()
@@ -8293,13 +8936,46 @@ class TestInvitationViewSet:
).exists()
assert invitation.state == Invitation.State.ACCEPTED.value
- def test_invitations_accept_invitation_invalid_token(self, authenticated_client):
- data = {
- "invitation_token": "invalid_token",
- }
+ def test_invitations_accept_invitation_existing_membership(
+ self,
+ authenticated_client,
+ create_test_user,
+ tenants_fixture,
+ ):
+ *_, tenant = tenants_fixture
+ user = create_test_user
+
+ invitation = Invitation.objects.create(
+ tenant=tenant,
+ email=TEST_USER,
+ inviter=user,
+ expires_at=self.TOMORROW,
+ )
+ Membership.objects.create(user=user, tenant=tenant)
+
+ data = {"invitation_token": invitation.token}
response = authenticated_client.post(
- reverse("invitation-accept"), data=data, format="json"
+ reverse("invitation-accept"),
+ data=data,
+ format="vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_201_CREATED
+ invitation.refresh_from_db()
+ assert invitation.state == Invitation.State.ACCEPTED.value
+ assert (
+ Membership.objects.filter(
+ user__email__iexact=user.email, tenant=tenant
+ ).count()
+ == 1
+ )
+
+ def test_invitations_accept_invitation_invalid_token(self, authenticated_client):
+ data = {"invitation_token": "invalid_token"}
+
+ response = authenticated_client.post(
+ reverse("invitation-accept"), data=data, format="vnd.api+json"
)
assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -8313,12 +8989,10 @@ class TestInvitationViewSet:
invitation.email = TEST_USER
invitation.save()
- data = {
- "invitation_token": invitation.token,
- }
+ data = {"invitation_token": invitation.token}
response = authenticated_client.post(
- reverse("invitation-accept"), data=data, format="json"
+ reverse("invitation-accept"), data=data, format="vnd.api+json"
)
assert response.status_code == status.HTTP_410_GONE
@@ -8354,12 +9028,10 @@ class TestInvitationViewSet:
invitation.email = TEST_USER
invitation.save()
- data = {
- "invitation_token": invitation.token,
- }
+ data = {"invitation_token": invitation.token}
response = authenticated_client.post(
- reverse("invitation-accept"), data=data, format="json"
+ reverse("invitation-accept"), data=data, format="vnd.api+json"
)
assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -8377,12 +9049,10 @@ class TestInvitationViewSet:
invitation.email = TEST_USER
invitation.save()
- data = {
- "invitation_token": invitation.token,
- }
+ data = {"invitation_token": invitation.token}
response = authenticated_client.post(
- reverse("invitation-accept"), data=data, format="json"
+ reverse("invitation-accept"), data=data, format="vnd.api+json"
)
assert response.status_code == status.HTTP_400_BAD_REQUEST
@@ -8901,20 +9571,22 @@ class TestUserRoleRelationshipViewSet:
assert added_role_ids.issubset(relationship_role_ids)
def test_create_relationship_already_exists(
- self, authenticated_client, roles_fixture, create_test_user
+ self, authenticated_client, roles_fixture, create_test_user_rbac_no_roles
):
- # Only add Role One (which has manage_account=True) to ensure
- # the second request has permission to add roles
data = {
"data": [
- {"type": "roles", "id": str(roles_fixture[0].id)},
+ {"type": "roles", "id": str(role.id)} for role in roles_fixture[:2]
]
}
- authenticated_client.post(
- reverse("user-roles-relationship", kwargs={"pk": create_test_user.id}),
+ setup_response = authenticated_client.post(
+ reverse(
+ "user-roles-relationship",
+ kwargs={"pk": create_test_user_rbac_no_roles.id},
+ ),
data=data,
content_type="application/vnd.api+json",
)
+ assert setup_response.status_code == status.HTTP_204_NO_CONTENT
data = {
"data": [
@@ -8922,7 +9594,10 @@ class TestUserRoleRelationshipViewSet:
]
}
response = authenticated_client.post(
- reverse("user-roles-relationship", kwargs={"pk": create_test_user.id}),
+ reverse(
+ "user-roles-relationship",
+ kwargs={"pk": create_test_user_rbac_no_roles.id},
+ ),
data=data,
content_type="application/vnd.api+json",
)
@@ -8944,9 +9619,15 @@ class TestUserRoleRelationshipViewSet:
content_type="application/vnd.api+json",
)
assert response.status_code == status.HTTP_204_NO_CONTENT
- relationships = UserRoleRelationship.objects.filter(user=create_test_user.id)
+ tenant = roles_fixture[2].tenant
+ relationships = UserRoleRelationship.objects.filter(
+ user=create_test_user.id, tenant=tenant
+ )
assert relationships.count() == 1
assert {rel.role.id for rel in relationships} == {roles_fixture[2].id}
+ assert (
+ UserRoleRelationship.objects.filter(user=create_test_user.id).count() == 2
+ )
data = {
"data": [
@@ -8960,12 +9641,66 @@ class TestUserRoleRelationshipViewSet:
content_type="application/vnd.api+json",
)
assert response.status_code == status.HTTP_204_NO_CONTENT
- relationships = UserRoleRelationship.objects.filter(user=create_test_user.id)
+ relationships = UserRoleRelationship.objects.filter(
+ user=create_test_user.id, tenant=tenant
+ )
assert relationships.count() == 2
assert {rel.role.id for rel in relationships} == {
roles_fixture[1].id,
roles_fixture[2].id,
}
+ assert (
+ UserRoleRelationship.objects.filter(user=create_test_user.id).count() == 3
+ )
+
+ def test_partial_update_relationship_preserves_foreign_tenant_roles(
+ self, authenticated_client, roles_fixture, tenants_fixture
+ ):
+ tenant_a, tenant_b, _ = tenants_fixture
+ tenant_a_role = roles_fixture[1]
+ replacement_role = roles_fixture[2]
+ foreign_role = Role.objects.create(
+ name=f"foreign-role-{uuid4()}",
+ tenant=tenant_b,
+ manage_users=False,
+ manage_account=False,
+ manage_billing=False,
+ manage_providers=False,
+ manage_integrations=False,
+ manage_scans=False,
+ unlimited_visibility=False,
+ )
+ shared_user = User.objects.create_user(
+ name="shared_user",
+ email=f"shared-user-{uuid4()}@prowler.com",
+ password="TmpPass123@",
+ )
+ Membership.objects.create(user=shared_user, tenant=tenant_a)
+ Membership.objects.create(user=shared_user, tenant=tenant_b)
+ UserRoleRelationship.objects.create(
+ user=shared_user, role=tenant_a_role, tenant=tenant_a
+ )
+ UserRoleRelationship.objects.create(
+ user=shared_user, role=foreign_role, tenant=tenant_b
+ )
+
+ data = {"data": [{"type": "roles", "id": str(replacement_role.id)}]}
+ response = authenticated_client.patch(
+ reverse("user-roles-relationship", kwargs={"pk": shared_user.id}),
+ data=data,
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_204_NO_CONTENT
+ tenant_a_relationships = UserRoleRelationship.objects.filter(
+ user=shared_user, tenant=tenant_a
+ )
+ assert tenant_a_relationships.count() == 1
+ assert {rel.role_id for rel in tenant_a_relationships} == {replacement_role.id}
+ assert UserRoleRelationship.objects.filter(
+ user=shared_user, tenant=tenant_b, role=foreign_role
+ ).exists()
+ assert UserRoleRelationship.objects.filter(user=shared_user).count() == 2
def test_destroy_relationship_other_user(
self, authenticated_client, roles_fixture, create_test_user, tenants_fixture
@@ -9055,7 +9790,7 @@ class TestUserRoleRelationshipViewSet:
assert response.status_code == status.HTTP_204_NO_CONTENT
def test_role_destroy_only_manage_account_blocked(
- self, authenticated_client, tenants_fixture
+ self, authenticated_client_for_tenant_factory, tenants_fixture
):
# Use a tenant without default admin role (tenant3)
tenant = tenants_fixture[2]
@@ -9077,24 +9812,10 @@ class TestUserRoleRelationshipViewSet:
)
# Assign the role to the user
UserRoleRelationship.objects.create(user=user, role=only_role, tenant=tenant)
-
- # Switch token to this tenant
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": TEST_USER,
- "password": TEST_PASSWORD,
- "tenant_id": str(tenant.id),
- }
- )
- serializer.is_valid(raise_exception=True)
- access_token = serializer.validated_data["access"]
- authenticated_client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
+ client = authenticated_client_for_tenant_factory(user, tenant)
# Attempt to delete the only MANAGE_ACCOUNT role
- response = authenticated_client.delete(
- reverse("role-detail", kwargs={"pk": only_role.id})
- )
+ response = client.delete(reverse("role-detail", kwargs={"pk": only_role.id}))
assert response.status_code == status.HTTP_400_BAD_REQUEST
assert Role.objects.filter(id=only_role.id).exists()
@@ -9251,13 +9972,16 @@ class TestRoleProviderGroupRelationshipViewSet:
@pytest.mark.django_db
class TestProviderGroupMembershipViewSet:
def test_create_relationship(
- self, authenticated_client, providers_fixture, provider_groups_fixture
+ self,
+ authenticated_client,
+ provider_groups_fixture,
+ aws_provider_pair,
):
provider_group, *_ = provider_groups_fixture
data = {
"data": [
{"type": "provider", "id": str(provider.id)}
- for provider in providers_fixture[:2]
+ for provider in aws_provider_pair
]
}
response = authenticated_client.post(
@@ -9274,16 +9998,20 @@ class TestProviderGroupMembershipViewSet:
)
assert relationships.count() == 2
for relationship in relationships:
- assert relationship.provider.id in [p.id for p in providers_fixture[:2]]
+ assert relationship.provider.id in [p.id for p in aws_provider_pair]
def test_create_relationship_already_exists(
- self, authenticated_client, providers_fixture, provider_groups_fixture
+ self,
+ authenticated_client,
+ aws_provider,
+ provider_groups_fixture,
+ aws_provider_pair,
):
provider_group, *_ = provider_groups_fixture
data = {
"data": [
{"type": "provider", "id": str(provider.id)}
- for provider in providers_fixture[:2]
+ for provider in aws_provider_pair
]
}
authenticated_client.post(
@@ -9297,7 +10025,7 @@ class TestProviderGroupMembershipViewSet:
data = {
"data": [
- {"type": "provider", "id": str(providers_fixture[0].id)},
+ {"type": "provider", "id": str(aws_provider.id)},
]
}
response = authenticated_client.post(
@@ -9313,12 +10041,16 @@ class TestProviderGroupMembershipViewSet:
assert "already associated" in errors
def test_partial_update_relationship(
- self, authenticated_client, providers_fixture, provider_groups_fixture
+ self,
+ authenticated_client,
+ provider_groups_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
provider_group, *_ = provider_groups_fixture
data = {
"data": [
- {"type": "provider", "id": str(providers_fixture[1].id)},
+ {"type": "provider", "id": str(aws_provider_pair[1].id)},
]
}
response = authenticated_client.patch(
@@ -9334,12 +10066,12 @@ class TestProviderGroupMembershipViewSet:
provider_group=provider_group.id
)
assert relationships.count() == 1
- assert {rel.provider.id for rel in relationships} == {providers_fixture[1].id}
+ assert {rel.provider.id for rel in relationships} == {aws_provider_pair[1].id}
data = {
"data": [
- {"type": "provider", "id": str(providers_fixture[1].id)},
- {"type": "provider", "id": str(providers_fixture[2].id)},
+ {"type": "provider", "id": str(aws_provider_pair[1].id)},
+ {"type": "provider", "id": str(gcp_provider.id)},
]
}
response = authenticated_client.patch(
@@ -9356,18 +10088,21 @@ class TestProviderGroupMembershipViewSet:
)
assert relationships.count() == 2
assert {rel.provider.id for rel in relationships} == {
- providers_fixture[1].id,
- providers_fixture[2].id,
+ aws_provider_pair[1].id,
+ gcp_provider.id,
}
def test_destroy_relationship(
- self, authenticated_client, providers_fixture, provider_groups_fixture
+ self,
+ authenticated_client,
+ provider_groups_fixture,
+ aws_provider_pair,
):
provider_group, *_ = provider_groups_fixture
data = {
"data": [
{"type": "provider", "id": str(provider.id)}
- for provider in providers_fixture[:2]
+ for provider in aws_provider_pair
]
}
response = authenticated_client.post(
@@ -9387,7 +10122,7 @@ class TestProviderGroupMembershipViewSet:
)
assert response.status_code == status.HTTP_204_NO_CONTENT
relationships = ProviderGroupMembership.objects.filter(
- provider_group=providers_fixture[0].id
+ provider_group=provider_group.id
)
assert relationships.count() == 0
@@ -9480,8 +10215,13 @@ class TestComplianceOverviewViewSet:
assert response.status_code == status.HTTP_200_OK
return {item["id"]: item["attributes"] for item in response.json()["data"]}
- def _prepare_latest_compliance_data(self, providers_fixture):
- provider1, provider2, provider3, *_ = providers_fixture
+ def _prepare_latest_compliance_data(
+ self,
+ aws_provider_pair,
+ gcp_provider,
+ ):
+ provider1, provider2 = aws_provider_pair
+ provider3 = gcp_provider
old_scan = self._create_completed_scan(provider1, "old aws compliance scan")
latest_scan1 = self._create_completed_scan(
provider1, "latest aws compliance scan 1"
@@ -9533,11 +10273,11 @@ class TestComplianceOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
mock_backfill_task,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="empty-compliance-scan",
provider=provider,
@@ -9599,11 +10339,11 @@ class TestComplianceOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
mock_backfill_task,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="preaggregated-scan",
provider=provider,
@@ -9679,10 +10419,13 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_id_filter_uses_latest_scan(
self,
authenticated_client,
- providers_fixture,
mock_backfill_task,
+ aws_provider_pair,
+ gcp_provider,
):
- _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+ _, latest_scan, *_ = self._prepare_latest_compliance_data(
+ aws_provider_pair, gcp_provider
+ )
response = authenticated_client.get(
reverse("complianceoverview-list"),
@@ -9698,10 +10441,11 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_id_in_filter_aggregates_latest_scans(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
_, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
- providers_fixture
+ aws_provider_pair, gcp_provider
)
response = authenticated_client.get(
@@ -9722,9 +10466,10 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_type_filter_uses_latest_scans(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
- self._prepare_latest_compliance_data(providers_fixture)
+ self._prepare_latest_compliance_data(aws_provider_pair, gcp_provider)
response = authenticated_client.get(
reverse("complianceoverview-list"),
@@ -9740,15 +10485,16 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_groups_filters_use_latest_scans(
self,
authenticated_client,
- providers_fixture,
provider_groups_fixture,
tenants_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
_, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
- providers_fixture
+ aws_provider_pair, gcp_provider
)
ProviderGroupMembership.objects.create(
tenant_id=tenant.id,
@@ -9814,10 +10560,10 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_filter_returns_running_task_without_data(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
scan = self._create_completed_scan(
- providers_fixture[0], "latest scan without compliance data"
+ aws_provider, "latest scan without compliance data"
)
self._assert_latest_provider_scan_task_response(
@@ -9829,9 +10575,9 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_filter_returns_running_task_for_partial_data(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
):
- provider_with_data, provider_without_data, *_ = providers_fixture
+ provider_with_data, provider_without_data = aws_provider_pair
scan_with_data = self._create_completed_scan(
provider_with_data, "latest scan with compliance data"
)
@@ -9854,10 +10600,10 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_provider_filter_empty_response_uses_scan_data_presence(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
scan = self._create_completed_scan(
- providers_fixture[0], "latest scan with filtered compliance data"
+ aws_provider, "latest scan with filtered compliance data"
)
self._create_requirement(scan, "1.1", StatusChoices.PASS, region="eu-west-1")
@@ -9883,10 +10629,10 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_metadata_provider_filter_returns_running_task_without_data(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
scan = self._create_completed_scan(
- providers_fixture[0], "latest scan without compliance metadata"
+ aws_provider, "latest scan without compliance metadata"
)
self._assert_latest_provider_scan_task_response(
@@ -9898,10 +10644,10 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_requirements_provider_filter_returns_running_task_without_data(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
):
scan = self._create_completed_scan(
- providers_fixture[0], "latest scan without compliance requirements"
+ aws_provider, "latest scan without compliance requirements"
)
self._assert_latest_provider_scan_task_response(
@@ -9914,9 +10660,12 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_metadata_accepts_provider_filters(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
- _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+ _, latest_scan, *_ = self._prepare_latest_compliance_data(
+ aws_provider_pair, gcp_provider
+ )
response = authenticated_client.get(
reverse("complianceoverview-metadata"),
@@ -9930,10 +10679,11 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_requirements_accepts_provider_filters(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
+ gcp_provider,
):
_, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
- providers_fixture
+ aws_provider_pair, gcp_provider
)
response = authenticated_client.get(
@@ -10099,7 +10849,11 @@ class TestComplianceOverviewViewSet:
assert "AWSService" in first_attr
def test_compliance_overview_attributes_resolves_provider_from_scan(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ gcp_provider,
+ azure_provider,
):
# csa_ccm_4.0 is a multi-provider universal framework: a single
# compliance_id whose requirements expose different checks per provider.
@@ -10108,8 +10862,6 @@ class TestComplianceOverviewViewSet:
# framework and azure/gcp requirements end up with check IDs that match
# no findings.
tenant = tenants_fixture[0]
- gcp_provider = providers_fixture[2]
- azure_provider = providers_fixture[4]
assert gcp_provider.provider == Provider.ProviderChoices.GCP.value
assert azure_provider.provider == Provider.ProviderChoices.AZURE.value
@@ -10210,7 +10962,8 @@ class TestComplianceOverviewViewSet:
def test_compliance_overview_attributes_scan_scoped_by_provider_group(
self,
authenticated_client_no_permissions_rbac,
- providers_fixture,
+ gcp_provider,
+ azure_provider,
):
# A user with limited visibility (no UNLIMITED_VISIBILITY) must only be
# able to resolve scans for providers in its provider groups. Tenant RLS
@@ -10222,8 +10975,8 @@ class TestComplianceOverviewViewSet:
membership = Membership.objects.filter(user=limited_user).first()
tenant = membership.tenant
- allowed_provider = providers_fixture[2]
- denied_provider = providers_fixture[4]
+ allowed_provider = gcp_provider
+ denied_provider = azure_provider
assert allowed_provider.provider == Provider.ProviderChoices.GCP.value
assert denied_provider.provider == Provider.ProviderChoices.AZURE.value
@@ -10458,9 +11211,8 @@ class TestOverviewViewSet:
response = authenticated_client.put(reverse("overview-list"))
assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
- def test_overview_providers_list(
- self, authenticated_client, scan_summaries_fixture, resources_fixture
- ):
+ @pytest.mark.usefixtures("scan_summaries_fixture")
+ def test_overview_providers_list(self, authenticated_client, resources_fixture):
response = authenticated_client.get(reverse("overview-providers"))
assert response.status_code == status.HTTP_200_OK
assert len(response.json()["data"]) == 1
@@ -10471,16 +11223,16 @@ class TestOverviewViewSet:
# Aggregated resources include all AWS providers present in the tenant
assert response.json()["data"][0]["attributes"]["resources"]["total"] == 3
+ @pytest.mark.usefixtures("scan_summaries_fixture")
def test_overview_providers_aggregates_same_provider_type(
self,
authenticated_client,
- scan_summaries_fixture,
resources_fixture,
- providers_fixture,
tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- _provider1, provider2, *_ = providers_fixture
+ _provider1, provider2 = aws_provider_pair
scan = Scan.objects.create(
name="overview scan aws account 2",
@@ -10525,12 +11277,12 @@ class TestOverviewViewSet:
assert attributes["findings"]["muted"] == 7
assert attributes["resources"]["total"] == 4
+ @pytest.mark.usefixtures("scan_summaries_fixture")
def test_overview_providers_count(
self,
authenticated_client,
- scan_summaries_fixture,
resources_fixture,
- providers_fixture,
+ aws_provider,
tenants_fixture,
):
tenant = tenants_fixture[0]
@@ -10562,14 +11314,15 @@ class TestOverviewViewSet:
def test_overview_providers_count_applies_limited_visibility(
self,
authenticated_client_no_permissions_rbac,
- providers_fixture,
provider_groups_fixture,
tenants_fixture,
+ gcp_provider,
+ azure_provider,
):
tenant = tenants_fixture[0]
client = authenticated_client_no_permissions_rbac
- allowed_provider = providers_fixture[2]
- denied_provider = providers_fixture[4]
+ allowed_provider = gcp_provider
+ denied_provider = azure_provider
provider_group = provider_groups_fixture[0]
ProviderGroupMembership.objects.create(
@@ -10643,10 +11396,13 @@ class TestOverviewViewSet:
)
def test_overview_threatscore_returns_weighted_aggregate_snapshot(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = self._create_scan(tenant, provider1, "agg-scan-one")
scan2 = self._create_scan(tenant, provider2, "agg-scan-two")
@@ -10816,10 +11572,13 @@ class TestOverviewViewSet:
assert attrs["critical_requirements"] == expected_critical
def test_overview_threatscore_weight_fallback_to_requirements(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = self._create_scan(tenant, provider1, "fallback-scan-1")
scan2 = self._create_scan(tenant, provider2, "fallback-scan-2")
@@ -10871,10 +11630,13 @@ class TestOverviewViewSet:
assert aggregate["section_scores"] == {"1. IAM": "62.22"}
def test_overview_threatscore_filter_by_scan_id_returns_snapshot(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider,
):
tenant = tenants_fixture[0]
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
scan = self._create_scan(tenant, provider1, "filter-scan")
snapshot = self._create_threatscore_snapshot(
@@ -10906,10 +11668,13 @@ class TestOverviewViewSet:
assert body["data"][0]["attributes"]["overall_score"] == "75.00"
def test_overview_threatscore_snapshot_id_returns_specific_snapshot(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider,
):
tenant = tenants_fixture[0]
- provider1, *_ = providers_fixture
+ provider1 = aws_provider
scan = self._create_scan(tenant, provider1, "snapshot-id-scan")
snapshot = self._create_threatscore_snapshot(
@@ -10940,10 +11705,13 @@ class TestOverviewViewSet:
assert data["data"]["attributes"]["score_delta"] is None
def test_overview_threatscore_provider_filter_returns_unaggregated_snapshot(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = self._create_scan(tenant, provider1, "provider-filter-scan-1")
scan2 = self._create_scan(tenant, provider2, "provider-filter-scan-2")
@@ -10994,15 +11762,15 @@ class TestOverviewViewSet:
assert data[0]["id"] == str(snapshot1.id)
assert data[0]["attributes"]["overall_score"] == "55.55"
- def test_overview_services_list_no_required_filters(
- self, authenticated_client, scan_summaries_fixture
- ):
+ @pytest.mark.usefixtures("scan_summaries_fixture")
+ def test_overview_services_list_no_required_filters(self, authenticated_client):
response = authenticated_client.get(reverse("overview-services"))
assert response.status_code == status.HTTP_200_OK
# Should return services from latest scans
assert len(response.json()["data"]) == 2
- def test_overview_regions_list(self, authenticated_client, scan_summaries_fixture):
+ @pytest.mark.usefixtures("scan_summaries_fixture")
+ def test_overview_regions_list(self, authenticated_client):
response = authenticated_client.get(
reverse("overview-regions"), {"filter[inserted_at]": TODAY}
)
@@ -11028,7 +11796,8 @@ class TestOverviewViewSet:
assert regions["aws:region2"]["fail"] == 1
assert regions["aws:region2"]["muted"] == 3
- def test_overview_services_list(self, authenticated_client, scan_summaries_fixture):
+ @pytest.mark.usefixtures("scan_summaries_fixture")
+ def test_overview_services_list(self, authenticated_client):
response = authenticated_client.get(
reverse("overview-services"), {"filter[inserted_at]": TODAY}
)
@@ -11054,10 +11823,13 @@ class TestOverviewViewSet:
assert service2_data["attributes"]["muted"] == 1
def test_overview_findings_provider_id_in_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="scan-one",
@@ -11144,11 +11916,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
provider_groups_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -11222,10 +11994,13 @@ class TestOverviewViewSet:
assert attributes["total"] == 14
def test_overview_findings_severity_provider_id_in_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="severity-scan-one",
@@ -11345,10 +12120,13 @@ class TestOverviewViewSet:
assert item["attributes"]["scan_ids"] == []
def test_overview_findings_severity_timeseries_with_data(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
# Create scan for day 1
scan1 = Scan.objects.create(
@@ -11428,10 +12206,13 @@ class TestOverviewViewSet:
assert data[2]["attributes"]["scan_ids"] == [str(scan3.id)]
def test_overview_findings_severity_timeseries_aggregates_providers(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
# Same day, different providers
scan1 = Scan.objects.create(
@@ -11501,10 +12282,13 @@ class TestOverviewViewSet:
assert set(data[0]["attributes"]["scan_ids"]) == {str(scan1.id), str(scan2.id)}
def test_overview_findings_severity_timeseries_provider_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="severity-over-time-filter-scan-p1",
@@ -11580,11 +12364,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
create_attack_surface_overview,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="attack-surface-scan",
@@ -11628,11 +12412,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
create_attack_surface_overview,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="attack-surface-scan-1",
@@ -11676,9 +12460,8 @@ class TestOverviewViewSet:
assert results_by_type["internet-exposed"]["total_findings"] == 10
assert results_by_type["internet-exposed"]["failed_findings"] == 5
- def test_overview_services_region_filter(
- self, authenticated_client, scan_summaries_fixture
- ):
+ @pytest.mark.usefixtures("scan_summaries_fixture")
+ def test_overview_services_region_filter(self, authenticated_client):
response = authenticated_client.get(
reverse("overview-services"),
{"filter[region]": "region1"},
@@ -11690,10 +12473,13 @@ class TestOverviewViewSet:
assert service_ids == {"service1", "service2"}
def test_overview_services_provider_type_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider,
+ gcp_provider,
):
tenant = tenants_fixture[0]
- aws_provider, _, gcp_provider, *_ = providers_fixture
aws_scan = Scan.objects.create(
name="aws-scan",
@@ -11746,7 +12532,7 @@ class TestOverviewViewSet:
assert "gcp-service" not in service_ids
@pytest.mark.parametrize(
- "status_filter,field_to_check",
+ "status_filter,_field_to_check",
[
("FAIL", "fail"),
("PASS", "_pass"),
@@ -11756,12 +12542,12 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
status_filter,
- field_to_check,
+ _field_to_check,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="status-filter-scan",
@@ -11813,10 +12599,13 @@ class TestOverviewViewSet:
assert attrs["medium"] == 8
def test_overview_threatscore_compliance_id_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = self._create_scan(tenant, provider, "compliance-filter-scan")
self._create_threatscore_snapshot(
@@ -11865,10 +12654,13 @@ class TestOverviewViewSet:
assert data[0]["attributes"]["compliance_id"] == "prowler_threatscore_aws"
def test_overview_threatscore_provider_type_filter(
- self, authenticated_client, tenants_fixture, providers_fixture
+ self,
+ authenticated_client,
+ tenants_fixture,
+ aws_provider,
+ gcp_provider,
):
tenant = tenants_fixture[0]
- aws_provider, _, gcp_provider, *_ = providers_fixture
aws_scan = self._create_scan(tenant, aws_provider, "aws-threatscore-scan")
gcp_scan = self._create_scan(tenant, gcp_provider, "gcp-threatscore-scan")
@@ -11926,11 +12718,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
create_scan_category_summary,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="categories-scan",
@@ -12010,16 +12802,17 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
provider_groups_fixture,
create_scan_category_summary,
filter_key,
filter_value_fn,
expected_total,
expected_failed,
+ gcp_provider,
):
tenant = tenants_fixture[0]
- provider1, _, gcp_provider, *_ = providers_fixture
+ provider1 = aws_provider
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -12067,11 +12860,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
create_scan_category_summary,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="category-filter-scan",
@@ -12104,11 +12897,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
create_scan_category_summary,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="multi-provider-scan-1",
@@ -12162,11 +12955,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
create_scan_resource_group_summary,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="resource-groups-scan",
@@ -12251,17 +13044,17 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
provider_groups_fixture,
create_scan_resource_group_summary,
filter_key,
filter_value_fn,
expected_total,
expected_failed,
+ gcp_provider,
):
tenant = tenants_fixture[0]
- provider1 = providers_fixture[0] # AWS
- gcp_provider = providers_fixture[2] # GCP
+ provider1 = aws_provider # AWS
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -12309,11 +13102,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
create_scan_resource_group_summary,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="rg-filter-scan",
@@ -12346,11 +13139,11 @@ class TestOverviewViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
create_scan_resource_group_summary,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1 = Scan.objects.create(
name="multi-provider-rg-scan-1",
@@ -12398,8 +13191,9 @@ class TestOverviewViewSet:
assert data[0]["attributes"]["new_failed_findings"] == 5
assert data[0]["attributes"]["resources_count"] == 10
+ @pytest.mark.usefixtures("tenant_compliance_summary_fixture")
def test_compliance_watchlist_no_filters_uses_tenant_summary(
- self, authenticated_client, tenant_compliance_summary_fixture
+ self, authenticated_client
):
response = authenticated_client.get(reverse("overview-compliance-watchlist"))
assert response.status_code == status.HTTP_200_OK
@@ -12419,13 +13213,13 @@ class TestOverviewViewSet:
assert by_id["gdpr_aws"]["requirements_failed"] == 0
assert by_id["gdpr_aws"]["total_requirements"] == 7
+ @pytest.mark.usefixtures("provider_compliance_scores_fixture")
def test_compliance_watchlist_with_provider_filter_uses_provider_scores(
self,
authenticated_client,
- provider_compliance_scores_fixture,
- providers_fixture,
+ aws_provider,
):
- provider1 = providers_fixture[0]
+ provider1 = aws_provider
url = f"{reverse('overview-compliance-watchlist')}?filter[provider_id]={provider1.id}"
response = authenticated_client.get(url)
assert response.status_code == status.HTTP_200_OK
@@ -12439,9 +13233,8 @@ class TestOverviewViewSet:
assert by_id["aws_cis_2.0"]["requirements_manual"] == 1
assert by_id["aws_cis_2.0"]["total_requirements"] == 3
- def test_compliance_watchlist_fail_dominant_logic(
- self, authenticated_client, provider_compliance_scores_fixture
- ):
+ @pytest.mark.usefixtures("provider_compliance_scores_fixture")
+ def test_compliance_watchlist_fail_dominant_logic(self, authenticated_client):
response = authenticated_client.get(
f"{reverse('overview-compliance-watchlist')}?filter[provider_type]=aws"
)
@@ -12456,13 +13249,13 @@ class TestOverviewViewSet:
assert aws_cis["requirements_manual"] == 1
assert aws_cis["total_requirements"] == 3
+ @pytest.mark.usefixtures("provider_compliance_scores_fixture")
def test_compliance_watchlist_provider_id_in_filter(
self,
authenticated_client,
- provider_compliance_scores_fixture,
- providers_fixture,
+ aws_provider_pair,
):
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
url = (
f"{reverse('overview-compliance-watchlist')}"
f"?filter[provider_id__in]={provider1.id},{provider2.id}"
@@ -12472,16 +13265,16 @@ class TestOverviewViewSet:
data = response.json()["data"]
assert len(data) >= 1
+ @pytest.mark.usefixtures("provider_compliance_scores_fixture")
def test_compliance_watchlist_provider_groups_filter(
self,
authenticated_client,
- provider_compliance_scores_fixture,
- providers_fixture,
provider_groups_fixture,
tenants_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -12547,10 +13340,10 @@ class TestScheduleViewSet:
mock_schedule_scan,
mock_task_get,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
- provider, *_ = providers_fixture
+ provider = aws_provider
prowler_task = tasks_fixture[0]
mock_schedule_scan.return_value.id = prowler_task.id
mock_task_get.return_value = prowler_task
@@ -12578,10 +13371,10 @@ class TestScheduleViewSet:
mock_task_get,
mock_apply_async,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
- provider, *_ = providers_fixture
+ provider = aws_provider
prowler_task = tasks_fixture[0]
mock_task_get.return_value = prowler_task
mock_apply_async.return_value.id = prowler_task.id
@@ -12682,7 +13475,7 @@ class TestIntegrationViewSet:
def test_integrations_create_valid(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
integration_type,
configuration,
credentials,
@@ -12766,12 +13559,51 @@ class TestIntegrationViewSet:
)
assert "credentials" not in response.json()["data"]["attributes"]
+ @pytest.mark.parametrize(
+ "domain",
+ (
+ "169.254.169.254#",
+ "internal/service",
+ "internal?target",
+ "internal\\target",
+ "internal:8000",
+ "user@internal",
+ ),
+ )
+ def test_integrations_create_jira_rejects_invalid_domain(
+ self, authenticated_client, domain
+ ):
+ data = {
+ "data": {
+ "type": "integrations",
+ "attributes": {
+ "integration_type": Integration.IntegrationChoices.JIRA,
+ "configuration": {},
+ "credentials": {
+ "domain": domain,
+ "api_token": "fake-api-token",
+ "user_mail": "testing@prowler.com",
+ },
+ "enabled": True,
+ },
+ }
+ }
+
+ response = authenticated_client.post(
+ reverse("integration-list"),
+ data=json.dumps(data),
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ assert Integration.objects.count() == 0
+
def test_integrations_create_valid_relationships(
self,
authenticated_client,
- providers_fixture,
+ aws_provider_pair,
):
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
data = {
"data": {
@@ -13094,9 +13926,11 @@ class TestIntegrationViewSet:
assert response.status_code == status.HTTP_400_BAD_REQUEST
def test_integrations_create_duplicate_amazon_s3(
- self, authenticated_client, providers_fixture
+ self,
+ authenticated_client,
+ aws_provider,
):
- provider = providers_fixture[0]
+ provider = aws_provider
# Create first S3 integration
data = {
@@ -13304,6 +14138,55 @@ class TestIntegrationViewSet:
assert "projects" in configuration
assert "issue_types" in configuration
+ def test_integrations_update_jira_rejects_invalid_domain(
+ self, authenticated_client
+ ):
+ create_data = {
+ "data": {
+ "type": "integrations",
+ "attributes": {
+ "integration_type": Integration.IntegrationChoices.JIRA,
+ "configuration": {},
+ "credentials": {
+ "user_mail": "test@example.com",
+ "api_token": "fake-api-token",
+ "domain": "original-domain",
+ },
+ "enabled": True,
+ },
+ }
+ }
+ create_response = authenticated_client.post(
+ reverse("integration-list"),
+ data=json.dumps(create_data),
+ content_type="application/vnd.api+json",
+ )
+ assert create_response.status_code == status.HTTP_201_CREATED
+ integration_id = create_response.json()["data"]["id"]
+
+ update_data = {
+ "data": {
+ "type": "integrations",
+ "id": integration_id,
+ "attributes": {
+ "credentials": {
+ "user_mail": "test@example.com",
+ "api_token": "fake-api-token",
+ "domain": "169.254.169.254#",
+ }
+ },
+ }
+ }
+ response = authenticated_client.patch(
+ reverse("integration-detail", kwargs={"pk": integration_id}),
+ data=json.dumps(update_data),
+ content_type="application/vnd.api+json",
+ )
+
+ assert response.status_code == status.HTTP_400_BAD_REQUEST
+ integration = Integration.objects.get(id=integration_id)
+ assert integration.credentials["domain"] == "original-domain"
+
@pytest.mark.django_db
class TestSAMLTokenValidation:
@@ -13375,6 +14258,26 @@ class TestSAMLTokenValidation:
assert response2.status_code == status.HTTP_404_NOT_FOUND
+@pytest.mark.django_db
+class TestCustomSAMLLoginView:
+ def test_dispatch_clears_stale_callback_url_when_request_has_none(self):
+ request = RequestFactory().get("/api/v1/saml/login/testtenant/")
+ request.session = {
+ "saml_callback_url": "/invitation/accept?invitation_token=old-token"
+ }
+
+ with patch(
+ "allauth.socialaccount.providers.saml.views.LoginView.dispatch",
+ return_value=JsonResponse({}),
+ ):
+ response = CustomSAMLLoginView.as_view()(
+ request, organization_slug="testtenant"
+ )
+
+ assert response.status_code == status.HTTP_200_OK
+ assert "saml_callback_url" not in request.session
+
+
@pytest.mark.django_db
class TestSAMLInitiateAPIView:
def test_valid_email_domain_and_certificates(
@@ -13386,7 +14289,7 @@ class TestSAMLInitiateAPIView:
url = reverse("api_saml_initiate")
payload = {"email_domain": saml_setup["email"]}
- response = authenticated_client.post(url, data=payload, format="json")
+ response = authenticated_client.post(url, data=payload, format="vnd.api+json")
assert response.status_code == status.HTTP_302_FOUND
assert (
@@ -13395,11 +14298,42 @@ class TestSAMLInitiateAPIView:
)
assert "SAMLRequest" not in response.url
+ def test_valid_email_domain_preserves_safe_callback_url(
+ self, authenticated_client, saml_setup
+ ):
+ url = reverse("api_saml_initiate")
+ callback_url = "/invitation/accept?invitation_token=test-token"
+ payload = {
+ "email_domain": saml_setup["email"],
+ "callback_url": callback_url,
+ }
+
+ response = authenticated_client.post(url, data=payload, format="vnd.api+json")
+
+ assert response.status_code == status.HTTP_302_FOUND
+ query_params = parse_qs(urlparse(response.url).query)
+ assert query_params["callback_url"] == [callback_url]
+
+ def test_valid_email_domain_rejects_external_callback_url(
+ self, authenticated_client, saml_setup
+ ):
+ url = reverse("api_saml_initiate")
+ payload = {
+ "email_domain": saml_setup["email"],
+ "callback_url": "https://attacker.example/invitation",
+ }
+
+ response = authenticated_client.post(url, data=payload, format="vnd.api+json")
+
+ assert response.status_code == status.HTTP_302_FOUND
+ query_params = parse_qs(urlparse(response.url).query)
+ assert "callback_url" not in query_params
+
def test_invalid_email_domain(self, authenticated_client):
url = reverse("api_saml_initiate")
payload = {"email_domain": "user@unauthorized.com"}
- response = authenticated_client.post(url, data=payload, format="json")
+ response = authenticated_client.post(url, data=payload, format="vnd.api+json")
assert response.status_code == status.HTTP_403_FORBIDDEN
assert response.json()["errors"]["detail"] == "Unauthorized domain."
@@ -13582,7 +14516,8 @@ class TestTenantFinishACSView:
)
)
request.user = user
- request.session = {}
+ callback_url = "/invitation/accept?invitation_token=test-token"
+ request.session = {"saml_callback_url": callback_url}
with (
patch(
@@ -13624,6 +14559,7 @@ class TestTenantFinishACSView:
assert parsed_url.netloc == expected_callback_host
query_params = parse_qs(parsed_url.query)
assert "id" in query_params
+ assert query_params["callbackUrl"] == [callback_url]
token_id = query_params["id"][0]
token_obj = SAMLToken.objects.get(id=token_id)
@@ -16601,6 +17537,76 @@ class TestLighthouseProviderConfigViewSet:
error_detail = str(resp.json()).lower()
assert "base_url" in error_detail
+ @pytest.mark.parametrize(
+ "base_url",
+ [
+ "https://127.0.0.1/v1",
+ "https://169.254.169.254/latest/meta-data",
+ ],
+ )
+ def test_openai_compatible_rejects_internal_base_url_on_create(
+ self, authenticated_client, base_url
+ ):
+ payload = {
+ "data": {
+ "type": "lighthouse-providers",
+ "attributes": {
+ "provider_type": "openai_compatible",
+ "base_url": base_url,
+ "credentials": {"api_key": "compat-key"},
+ },
+ }
+ }
+
+ resp = authenticated_client.post(
+ reverse("lighthouse-providers-list"),
+ data=payload,
+ content_type=API_JSON_CONTENT_TYPE,
+ )
+
+ assert resp.status_code == status.HTTP_400_BAD_REQUEST
+ assert "base_url" in str(resp.json()).lower()
+
+ def test_openai_compatible_rejects_internal_base_url_on_update(
+ self, authenticated_client
+ ):
+ create_payload = {
+ "data": {
+ "type": "lighthouse-providers",
+ "attributes": {
+ "provider_type": "openai_compatible",
+ "base_url": "https://openrouter.ai/api/v1",
+ "credentials": {"api_key": "compat-key-123"},
+ },
+ }
+ }
+ create_resp = authenticated_client.post(
+ reverse("lighthouse-providers-list"),
+ data=create_payload,
+ content_type=API_JSON_CONTENT_TYPE,
+ )
+ assert create_resp.status_code == status.HTTP_201_CREATED
+ provider_id = create_resp.json()["data"]["id"]
+
+ patch_payload = {
+ "data": {
+ "type": "lighthouse-providers",
+ "id": provider_id,
+ "attributes": {
+ "base_url": "https://169.254.169.254/latest/meta-data",
+ },
+ }
+ }
+
+ patch_resp = authenticated_client.patch(
+ reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}),
+ data=patch_payload,
+ content_type=API_JSON_CONTENT_TYPE,
+ )
+
+ assert patch_resp.status_code == status.HTTP_400_BAD_REQUEST
+ assert "base_url" in str(patch_resp.json()).lower()
+
def test_openai_compatible_invalid_credentials(self, authenticated_client):
payload = {
"data": {
@@ -16913,7 +17919,7 @@ class TestMuteRuleViewSet:
mock_task,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
"""Test that multiple findings with same UID result in only one UID in the rule."""
@@ -17912,10 +18918,13 @@ class TestFindingGroupViewSet:
assert response.json()["errors"][0]["code"] == "invalid"
def test_finding_groups_provider_filter(
- self, authenticated_client, finding_groups_fixture, providers_fixture
+ self,
+ authenticated_client,
+ finding_groups_fixture,
+ aws_provider,
):
"""Test filtering by provider UUID."""
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client.get(
reverse("finding-group-list"),
{"filter[inserted_at]": TODAY, "filter[provider_id]": str(provider.id)},
@@ -17943,11 +18952,11 @@ class TestFindingGroupViewSet:
authenticated_client,
tenants_fixture,
finding_groups_fixture,
- providers_fixture,
provider_groups_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -18027,10 +19036,10 @@ class TestFindingGroupViewSet:
],
ids=["summary_path", "finding_level_path"],
)
+ @pytest.mark.usefixtures("finding_groups_title_variants_fixture")
def test_check_title_icontains_includes_all_title_variants(
self,
authenticated_client,
- finding_groups_title_variants_fixture,
extra_filters,
):
"""
@@ -18438,7 +19447,11 @@ class TestFindingGroupViewSet:
# Test provider_id filter actually filters data
def test_finding_groups_provider_id_filter_actually_filters(
- self, authenticated_client, finding_groups_fixture, providers_fixture
+ self,
+ authenticated_client,
+ finding_groups_fixture,
+ aws_provider,
+ aws_provider_pair,
):
"""
Test that provider_id filter returns ONLY data from that provider.
@@ -18446,8 +19459,8 @@ class TestFindingGroupViewSet:
This is a critical test - it verifies the filter doesn't just return 200 OK,
but actually restricts the data to the specified provider.
"""
- provider1 = providers_fixture[0] # Has scan1 with 4 checks
- provider2 = providers_fixture[1] # Has scan2 with 1 check (cloudtrail_enabled)
+ provider1 = aws_provider # Has scan1 with 4 checks
+ provider2 = aws_provider_pair[1] # Has scan2 with 1 check (cloudtrail_enabled)
# Get ALL finding groups (without provider filter)
response_all = authenticated_client.get(
@@ -18588,11 +19601,15 @@ class TestFindingGroupViewSet:
assert len(data) == 0
def test_finding_groups_latest_provider_id_filter(
- self, authenticated_client, finding_groups_fixture, providers_fixture
+ self,
+ authenticated_client,
+ finding_groups_fixture,
+ aws_provider,
+ aws_provider_pair,
):
"""Test /latest with provider_id filter returns only that provider's data."""
- provider1 = providers_fixture[0] # Has 4 checks
- provider2 = providers_fixture[1] # Has 1 check
+ provider1 = aws_provider # Has 4 checks
+ provider2 = aws_provider_pair[1] # Has 1 check
# Filter by provider1
response = authenticated_client.get(
@@ -18756,8 +19773,9 @@ class TestFindingGroupViewSet:
def test_finding_groups_latest_aggregates_latest_per_provider(
self,
authenticated_client,
- providers_fixture,
+ aws_provider,
resources_fixture,
+ aws_provider_pair,
):
"""Test /latest keeps all findings from the latest scan per provider.
@@ -18765,8 +19783,8 @@ class TestFindingGroupViewSet:
same check_id (e.g. one per resource), all of them are included in the
aggregation — not just one.
"""
- provider1 = providers_fixture[0]
- provider2 = providers_fixture[1]
+ provider1 = aws_provider
+ provider2 = aws_provider_pair[1]
resource1 = resources_fixture[0]
resource2 = resources_fixture[1]
resource3 = resources_fixture[2]
@@ -18891,11 +19909,11 @@ class TestFindingGroupViewSet:
authenticated_client,
tenants_fixture,
finding_groups_fixture,
- providers_fixture,
provider_groups_fixture,
+ aws_provider_pair,
):
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
group1, group2, *_ = provider_groups_fixture
ProviderGroupMembership.objects.create(
tenant=tenant, provider=provider1, provider_group=group1
@@ -19373,7 +20391,7 @@ class TestFindingGroupViewSet:
self,
authenticated_client,
tenants_fixture,
- providers_fixture,
+ aws_provider,
resources_fixture,
):
"""Overlapping scans on the same provider must resolve to the scan
@@ -19383,7 +20401,7 @@ class TestFindingGroupViewSet:
different scans and reporting diverging delta/new counts.
"""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
resource = resources_fixture[0]
check_id = "overlap_regression_check"
diff --git a/api/src/backend/api/utils.py b/api/src/backend/api/utils.py
index ce1dc0f10d..8e73b96a39 100644
--- a/api/src/backend/api/utils.py
+++ b/api/src/backend/api/utils.py
@@ -7,9 +7,19 @@ from allauth.socialaccount.providers.oauth2.client import OAuth2Client
from api.db_router import MainRouter
from api.db_utils import rls_transaction
from api.exceptions import InvitationTokenExpiredException
-from api.models import Integration, Invitation, Processor, Provider, Resource
+from api.models import (
+ Integration,
+ Invitation,
+ Membership,
+ Processor,
+ Provider,
+ Resource,
+ Role,
+ UserRoleRelationship,
+)
from api.v1.serializers import FindingMetadataSerializer
from django.contrib.postgres.aggregates import ArrayAgg
+from django.db import transaction
from django.db.models import Subquery
from prowler.lib.outputs.jira.jira import Jira, JiraBasicAuthError
from prowler.providers.aws.lib.s3.s3 import S3
@@ -242,12 +252,6 @@ def get_prowler_provider_kwargs(
**prowler_provider_kwargs,
"filter_accounts": [provider.uid],
}
- elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
- if isinstance(prowler_provider_kwargs.get("region"), str):
- prowler_provider_kwargs = {
- **prowler_provider_kwargs,
- "region": {prowler_provider_kwargs["region"]},
- }
elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
# clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
# in the provider itself, so it's not needed here.
@@ -278,6 +282,11 @@ def get_prowler_provider_kwargs(
**{k: v for k, v in prowler_provider_kwargs.items() if v},
}
+ elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+ prowler_provider_kwargs = _normalize_oraclecloud_provider_kwargs(
+ prowler_provider_kwargs
+ )
+
if mutelist_processor:
mutelist_content = mutelist_processor.configuration.get("Mutelist", {})
# IaC and Image providers don't support mutelist (both use Trivy's built-in logic)
@@ -290,6 +299,40 @@ def get_prowler_provider_kwargs(
return prowler_provider_kwargs
+def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
+ """Normalize external OCI secret fields into SDK provider kwargs."""
+ prowler_provider_kwargs = secret.copy()
+ prowler_provider_kwargs.pop("region", None)
+
+ return prowler_provider_kwargs
+
+
+def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
+ """Normalize external OCI secret fields into test_connection kwargs."""
+ from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
+
+ prowler_provider_kwargs = secret.copy()
+ prowler_provider_kwargs.pop("region", None)
+
+ if (
+ prowler_provider_kwargs.get("user")
+ and prowler_provider_kwargs.get("fingerprint")
+ and prowler_provider_kwargs.get("tenancy")
+ and (
+ prowler_provider_kwargs.get("key_content")
+ or prowler_provider_kwargs.get("key_file")
+ )
+ ):
+ # Connection validation needs one OCI endpoint, but scans remain unfiltered.
+ prowler_provider_kwargs["region"] = getattr(
+ OraclecloudProvider,
+ "_bootstrap_region",
+ OraclecloudProvider._home_region,
+ )
+
+ return prowler_provider_kwargs
+
+
def initialize_prowler_provider(
provider: Provider,
mutelist_processor: Processor | None = None,
@@ -392,6 +435,15 @@ def prowler_provider_connection_test(provider: Provider) -> Connection:
if prowler_provider_kwargs.get("registry_token"):
image_kwargs["registry_token"] = prowler_provider_kwargs["registry_token"]
return prowler_provider.test_connection(**image_kwargs)
+ elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+ oraclecloud_kwargs = _normalize_oraclecloud_connection_test_kwargs(
+ prowler_provider_kwargs
+ )
+ return prowler_provider.test_connection(
+ **oraclecloud_kwargs,
+ provider_id=provider.uid,
+ raise_on_exception=False,
+ )
else:
return prowler_provider.test_connection(
**prowler_provider_kwargs,
@@ -538,6 +590,35 @@ def validate_invitation(
return invitation
+def accept_invitation_for_user(
+ *, user, invitation_token: str, raise_not_found: bool = False
+):
+ with transaction.atomic(using=MainRouter.admin_db):
+ invitation = validate_invitation(
+ invitation_token, user.email, raise_not_found=raise_not_found
+ )
+ with rls_transaction(str(invitation.tenant_id), using=MainRouter.admin_db):
+ membership, _ = Membership.objects.using(MainRouter.admin_db).get_or_create(
+ user=user,
+ tenant=invitation.tenant,
+ defaults={"role": Membership.RoleChoices.MEMBER},
+ )
+ invitation_roles = Role.objects.using(MainRouter.admin_db).filter(
+ invitations=invitation
+ )
+ for role in invitation_roles:
+ UserRoleRelationship.objects.using(MainRouter.admin_db).get_or_create(
+ user=user,
+ role=role,
+ defaults={"tenant": invitation.tenant},
+ )
+
+ invitation.state = Invitation.State.ACCEPTED
+ invitation.save(using=MainRouter.admin_db)
+
+ return invitation, membership
+
+
# ToRemove after removing the fallback mechanism in /findings/metadata
def get_findings_metadata_no_aggregations(tenant_id: str, filtered_queryset):
filtered_ids = filtered_queryset.order_by().values("id")
diff --git a/api/src/backend/api/v1/serializer_utils/authentication.py b/api/src/backend/api/v1/serializer_utils/authentication.py
new file mode 100644
index 0000000000..840cb44a0a
--- /dev/null
+++ b/api/src/backend/api/v1/serializer_utils/authentication.py
@@ -0,0 +1,18 @@
+from api.db_router import MainRouter
+from rest_framework_simplejwt.token_blacklist.models import (
+ BlacklistedToken,
+ OutstandingToken,
+)
+
+
+def blacklist_user_refresh_tokens(user_id):
+ outstanding_token_ids = list(
+ OutstandingToken.objects.using(MainRouter.admin_db)
+ .filter(user_id=user_id)
+ .values_list("id", flat=True)
+ )
+ if outstanding_token_ids:
+ BlacklistedToken.objects.using(MainRouter.admin_db).bulk_create(
+ [BlacklistedToken(token_id=token_id) for token_id in outstanding_token_ids],
+ ignore_conflicts=True,
+ )
diff --git a/api/src/backend/api/v1/serializer_utils/integrations.py b/api/src/backend/api/v1/serializer_utils/integrations.py
index a77de9c237..ac876d1d5b 100644
--- a/api/src/backend/api/v1/serializer_utils/integrations.py
+++ b/api/src/backend/api/v1/serializer_utils/integrations.py
@@ -5,6 +5,10 @@ from api.v1.serializer_utils.base import BaseValidateSerializer
from drf_spectacular.utils import extend_schema_field
from rest_framework_json_api import serializers
+ATLASSIAN_SITE_NAME_REGEX = re.compile(
+ r"\A[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\Z"
+)
+
class S3ConfigSerializer(BaseValidateSerializer):
bucket_name = serializers.CharField()
@@ -97,7 +101,17 @@ class AWSCredentialSerializer(BaseValidateSerializer):
class JiraCredentialSerializer(BaseValidateSerializer):
user_mail = serializers.EmailField(required=True)
api_token = serializers.CharField(required=True)
- domain = serializers.CharField(required=True)
+ domain = serializers.RegexField(
+ regex=ATLASSIAN_SITE_NAME_REGEX,
+ required=True,
+ trim_whitespace=False,
+ error_messages={
+ "invalid": (
+ "Domain must be a valid Atlassian site name containing only "
+ "letters, numbers, and hyphens."
+ )
+ },
+ )
class Meta:
resource_name = "integrations"
@@ -170,7 +184,10 @@ class JiraCredentialSerializer(BaseValidateSerializer):
},
"domain": {
"type": "string",
- "description": "The JIRA domain/instance URL (e.g., 'your-domain.atlassian.net').",
+ "description": "The Jira site name without the '.atlassian.net' suffix (e.g., 'your-domain').",
+ "minLength": 1,
+ "maxLength": 63,
+ "pattern": "^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$",
},
},
"required": ["user_mail", "api_token", "domain"],
diff --git a/api/src/backend/api/v1/serializer_utils/providers.py b/api/src/backend/api/v1/serializer_utils/providers.py
index 0b8b4eacf4..49b593049f 100644
--- a/api/src/backend/api/v1/serializer_utils/providers.py
+++ b/api/src/backend/api/v1/serializer_utils/providers.py
@@ -213,7 +213,8 @@ from rest_framework_json_api import serializers
"properties": {
"kubeconfig_content": {
"type": "string",
- "description": "The content of the Kubernetes kubeconfig file, encoded as a string.",
+ "description": "The content of the Kubernetes kubeconfig file, encoded as a string. "
+ "Kubeconfig exec authentication is not supported in Prowler Cloud for security reasons.",
}
},
"required": ["kubeconfig_content"],
@@ -294,16 +295,21 @@ from rest_framework_json_api import serializers
"type": "string",
"description": "The OCID of the tenancy.",
},
- "region": {
- "type": "string",
- "description": "The OCI region identifier (e.g., us-ashburn-1, us-phoenix-1).",
- },
"pass_phrase": {
"type": "string",
"description": "The passphrase for the private key, if encrypted.",
},
+ "region": {
+ "type": "string",
+ "deprecated": True,
+ "description": "Legacy OCI region field accepted for backwards compatibility but ignored; OCI scans all regions.",
+ },
},
- "required": ["user", "fingerprint", "tenancy", "region"],
+ "required": ["user", "fingerprint", "tenancy"],
+ "anyOf": [
+ {"required": ["key_file"]},
+ {"required": ["key_content"]},
+ ],
},
{
"type": "object",
diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py
index 1d160b4048..750174e7a8 100644
--- a/api/src/backend/api/v1/serializers.py
+++ b/api/src/backend/api/v1/serializers.py
@@ -2,6 +2,7 @@ import base64
import json
from datetime import UTC, datetime, timedelta
+import yaml
from api.db_router import MainRouter
from api.exceptions import ConflictException
from api.models import (
@@ -37,6 +38,7 @@ from api.models import (
UserRoleRelationship,
)
from api.rls import Tenant
+from api.v1.serializer_utils.authentication import blacklist_user_refresh_tokens
from api.v1.serializer_utils.integrations import (
AWSCredentialSerializer,
IntegrationConfigField,
@@ -55,12 +57,13 @@ from api.v1.serializer_utils.lighthouse import (
)
from api.v1.serializer_utils.processors import ProcessorConfigField
from api.v1.serializer_utils.providers import ProviderSecretField
+from api.validators import validate_lighthouse_openai_compatible_base_url
from django.conf import settings
from django.contrib.auth import authenticate
from django.contrib.auth.models import update_last_login
from django.contrib.auth.password_validation import validate_password
from django.core.exceptions import ValidationError as DjangoValidationError
-from django.db import IntegrityError
+from django.db import IntegrityError, transaction
from drf_spectacular.utils import extend_schema_field
from jwt.exceptions import InvalidKeyError
from prowler.lib.mutelist.mutelist import Mutelist
@@ -71,11 +74,28 @@ from rest_framework_json_api.relations import SerializerMethodResourceRelatedFie
from rest_framework_json_api.serializers import ValidationError
from rest_framework_simplejwt.exceptions import TokenError
from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
+from rest_framework_simplejwt.settings import api_settings
from rest_framework_simplejwt.tokens import RefreshToken
+from rest_framework_simplejwt.utils import get_md5_hash_password
# Base
+def _validate_lighthouse_base_url_without_dns(base_url: str) -> None:
+ try:
+ validate_lighthouse_openai_compatible_base_url(base_url, resolve_dns=False)
+ except DjangoValidationError as error:
+ raise ValidationError({"base_url": error.messages[0]}) from error
+
+
+def _reraise_lighthouse_credentials_errors(error: ValidationError) -> None:
+ details = error.detail.copy()
+ for key, value in details.items():
+ error.detail[f"credentials/{key}"] = value
+ del error.detail[key]
+ raise error
+
+
class BaseModelSerializerV1(serializers.ModelSerializer):
def get_root_meta(self, _resource, _many):
return {"version": "v1"}
@@ -231,6 +251,18 @@ class TokenRefreshSerializer(BaseSerializerV1):
try:
# Validate the refresh token
refresh = RefreshToken(refresh_token)
+ if api_settings.CHECK_REVOKE_TOKEN:
+ user_id = refresh.payload.get(api_settings.USER_ID_CLAIM)
+ try:
+ user = User.objects.using(MainRouter.admin_db).get(
+ **{api_settings.USER_ID_FIELD: user_id}
+ )
+ except User.DoesNotExist:
+ raise TokenError("User not found.") from None
+ if refresh.get(api_settings.REVOKE_TOKEN_CLAIM) != (
+ get_md5_hash_password(user.password)
+ ):
+ raise TokenError("The user's password has been changed.")
# Generate new access token
access_token = refresh.access_token
@@ -404,7 +436,13 @@ class UserUpdateSerializer(BaseWriteSerializer):
password = validated_data.pop("password", None)
if password:
validate_password(password, user=instance)
- instance.set_password(password)
+ with transaction.atomic(using=MainRouter.admin_db):
+ instance.set_password(password)
+ for attr, value in validated_data.items():
+ setattr(instance, attr, value)
+ blacklist_user_refresh_tokens(instance.id)
+ instance.save(using=MainRouter.admin_db)
+ return instance
return super().update(instance, validated_data)
@@ -443,8 +481,8 @@ class UserRoleRelationshipSerializer(RLSSerializer, BaseWriteSerializer):
def create(self, validated_data):
role_ids = [item["id"] for item in validated_data["roles"]]
- roles = Role.objects.filter(id__in=role_ids)
tenant_id = self.context.get("tenant_id")
+ roles = Role.objects.filter(id__in=role_ids, tenant_id=tenant_id)
new_relationships = [
UserRoleRelationship(
@@ -458,8 +496,8 @@ class UserRoleRelationshipSerializer(RLSSerializer, BaseWriteSerializer):
def update(self, instance, validated_data):
role_ids = [item["id"] for item in validated_data["roles"]]
- roles = Role.objects.filter(id__in=role_ids)
tenant_id = self.context.get("tenant_id")
+ roles = Role.objects.filter(id__in=role_ids, tenant_id=tenant_id)
# Safeguard: A tenant must always have at least one user with MANAGE_ACCOUNT.
# If the target roles do NOT include MANAGE_ACCOUNT, and the current user is
@@ -489,7 +527,7 @@ class UserRoleRelationshipSerializer(RLSSerializer, BaseWriteSerializer):
}
)
- instance.roles.clear()
+ UserRoleRelationship.objects.filter(user=instance, tenant_id=tenant_id).delete()
new_relationships = [
UserRoleRelationship(user=instance, role=r, tenant_id=tenant_id)
for r in roles
@@ -1530,6 +1568,32 @@ class FindingMetadataSerializer(BaseSerializerV1):
# Provider secrets
+KUBERNETES_KUBECONFIG_EXEC_ERROR = (
+ "Kubernetes kubeconfig exec authentication is not supported in Prowler Cloud "
+ "for security reasons."
+)
+KUBERNETES_KUBECONFIG_INVALID_ERROR = "Invalid Kubernetes kubeconfig content."
+
+
+def kubeconfig_contains_exec_auth(kubeconfig: dict) -> bool:
+ users = kubeconfig.get("users", [])
+ if not isinstance(users, list):
+ raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
+
+ for user_entry in users:
+ if not isinstance(user_entry, dict):
+ raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
+
+ user = user_entry.get("user", {})
+ if not isinstance(user, dict):
+ raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
+
+ if "exec" in user:
+ return True
+
+ return False
+
+
class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
@staticmethod
def validate_secret_based_on_provider(
@@ -1608,6 +1672,7 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
validation_error.detail[f"secret/{key}"] = value
del validation_error.detail[key]
raise validation_error
+ return serializer.validated_data
class AwsProviderSecret(serializers.Serializer):
@@ -1711,6 +1776,22 @@ class MongoDBAtlasProviderSecret(serializers.Serializer):
class KubernetesProviderSecret(serializers.Serializer):
kubeconfig_content = serializers.CharField()
+ def validate_kubeconfig_content(self, kubeconfig_content):
+ try:
+ kubeconfig = yaml.safe_load(kubeconfig_content)
+ except yaml.YAMLError as exc:
+ raise serializers.ValidationError(
+ KUBERNETES_KUBECONFIG_INVALID_ERROR
+ ) from exc
+
+ if not isinstance(kubeconfig, dict):
+ raise serializers.ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
+
+ if kubeconfig_contains_exec_auth(kubeconfig):
+ raise serializers.ValidationError(KUBERNETES_KUBECONFIG_EXEC_ERROR)
+
+ return kubeconfig_content
+
class Meta:
resource_name = "provider-secrets"
@@ -1733,14 +1814,32 @@ class IacProviderSecret(serializers.Serializer):
resource_name = "provider-secrets"
+class LegacyOCIRegionField(serializers.Field):
+ def to_internal_value(self, data):
+ return data
+
+ def to_representation(self, value):
+ return value
+
+
class OracleCloudProviderSecret(serializers.Serializer):
user = serializers.CharField()
fingerprint = serializers.CharField()
key_file = serializers.CharField(required=False)
key_content = serializers.CharField(required=False)
tenancy = serializers.CharField()
- region = serializers.CharField()
pass_phrase = serializers.CharField(required=False)
+ region = LegacyOCIRegionField(required=False, allow_null=True)
+
+ def validate(self, attrs):
+ attrs.pop("region", None)
+
+ if "key_file" not in attrs and "key_content" not in attrs:
+ raise serializers.ValidationError(
+ {"key_file": "Either key_file or key_content must be provided."}
+ )
+
+ return attrs
class Meta:
resource_name = "provider-secrets"
@@ -1885,7 +1984,11 @@ class ProviderSecretCreateSerializer(RLSSerializer, BaseWriteProviderSecretSeria
secret = attrs.get("secret")
validated_attrs = super().validate(attrs)
- self.validate_secret_based_on_provider(provider.provider, secret_type, secret)
+ validated_secret = self.validate_secret_based_on_provider(
+ provider.provider, secret_type, secret
+ )
+ if provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+ validated_attrs["secret"] = validated_secret
return validated_attrs
@@ -1917,7 +2020,11 @@ class ProviderSecretUpdateSerializer(BaseWriteProviderSecretSerializer):
secret = attrs.get("secret")
validated_attrs = super().validate(attrs)
- self.validate_secret_based_on_provider(provider.provider, secret_type, secret)
+ validated_secret = self.validate_secret_based_on_provider(
+ provider.provider, secret_type, secret
+ )
+ if provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+ validated_attrs["secret"] = validated_secret
return validated_attrs
@@ -3147,6 +3254,9 @@ class ProcessorUpdateSerializer(BaseWriteSerializer):
class SamlInitiateSerializer(BaseSerializerV1):
email_domain = serializers.CharField()
+ callback_url = serializers.CharField(
+ required=False, allow_blank=True, max_length=2048
+ )
class JSONAPIMeta:
resource_name = "saml-initiate"
@@ -3578,11 +3688,7 @@ class LighthouseProviderConfigCreateSerializer(RLSSerializer, BaseWriteSerialize
raise_exception=True
)
except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ _reraise_lighthouse_credentials_errors(e)
elif (
provider_type == LighthouseProviderConfiguration.LLMProviderChoices.BEDROCK
):
@@ -3591,27 +3697,20 @@ class LighthouseProviderConfigCreateSerializer(RLSSerializer, BaseWriteSerialize
raise_exception=True
)
except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ _reraise_lighthouse_credentials_errors(e)
elif (
provider_type
== LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE
):
if not base_url:
raise ValidationError({"base_url": "Base URL is required."})
+ _validate_lighthouse_base_url_without_dns(base_url)
try:
OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
raise_exception=True
)
except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ _reraise_lighthouse_credentials_errors(e)
return super().validate(attrs)
@@ -3674,11 +3773,7 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
raise_exception=True
)
except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ _reraise_lighthouse_credentials_errors(e)
elif (
credentials is not None
and provider_type
@@ -3702,11 +3797,7 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
raise_exception=True
)
except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ _reraise_lighthouse_credentials_errors(e)
# Then enforce invariants about not changing the auth method
# If the existing config uses an API key, forbid introducing access keys.
@@ -3733,24 +3824,23 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
}
)
elif (
- credentials is not None
- and provider_type
+ provider_type
== LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE
):
- if base_url is None:
- pass
- elif not base_url:
+ effective_base_url = (
+ base_url if "base_url" in attrs else getattr(self.instance, "base_url")
+ )
+ if not effective_base_url:
raise ValidationError({"base_url": "Base URL cannot be empty."})
- try:
- OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
- raise_exception=True
- )
- except ValidationError as e:
- details = e.detail.copy()
- for key, value in details.items():
- e.detail[f"credentials/{key}"] = value
- del e.detail[key]
- raise e
+ if "base_url" in attrs:
+ _validate_lighthouse_base_url_without_dns(effective_base_url)
+ if credentials is not None:
+ try:
+ OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
+ raise_exception=True
+ )
+ except ValidationError as e:
+ _reraise_lighthouse_credentials_errors(e)
return super().validate(attrs)
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 89c2f344a2..e392505818 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -9,7 +9,7 @@ from collections import defaultdict
from copy import deepcopy
from datetime import UTC, datetime, timedelta
from decimal import ROUND_HALF_UP, Decimal, InvalidOperation
-from urllib.parse import urljoin
+from urllib.parse import urlencode, urljoin
import sentry_sdk
from allauth.socialaccount.models import SocialAccount, SocialApp
@@ -50,6 +50,7 @@ from api.filters import (
FindingGroupAggregatedComputedFilter,
FindingGroupFilter,
FindingGroupSummaryFilter,
+ FindingMetadataFilter,
IntegrationFilter,
IntegrationJiraFindingsFilter,
InvitationFilter,
@@ -128,6 +129,7 @@ from api.renderers import APIJSONRenderer, PlainTextRenderer
from api.rls import Tenant
from api.utils import (
CustomOAuth2Client,
+ accept_invitation_for_user,
get_findings_metadata_no_aggregations,
initialize_prowler_integration,
initialize_prowler_provider,
@@ -235,7 +237,7 @@ from api.v1.serializers import (
UserUpdateSerializer,
)
from botocore.exceptions import ClientError, NoCredentialsError, ParamValidationError
-from celery import chain, states
+from celery import chain
from celery.result import AsyncResult
from config.custom_logging import BackendLogger
from config.env import env
@@ -281,7 +283,6 @@ from django.utils.dateparse import parse_date
from django.utils.decorators import method_decorator
from django.views.decorators.cache import cache_control
from django_celery_beat.models import PeriodicTask
-from django_celery_results.models import TaskResult
from drf_spectacular.settings import spectacular_settings
from drf_spectacular.types import OpenApiTypes
from drf_spectacular.utils import (
@@ -320,17 +321,20 @@ from tasks.beat import schedule_provider_scan
from tasks.jobs.attack_paths import db_utils as attack_paths_db_utils
from tasks.jobs.export import get_s3_client
from tasks.tasks import (
+ QUEUED_SCAN_TASK_STATE,
backfill_compliance_summaries_task,
backfill_scan_resource_summaries_task,
check_integration_connection_task,
check_lighthouse_connection_task,
check_lighthouse_provider_connection_task,
check_provider_connection_task,
+ create_scan_task_record,
delete_provider_task,
delete_tenant_task,
+ enqueue_scan_execution_on_commit,
+ get_active_provider_scan,
jira_integration_task,
mute_historical_findings_task,
- perform_scan_task,
reaggregate_all_finding_group_summaries_task,
refresh_lighthouse_provider_models_task,
)
@@ -541,6 +545,46 @@ class SchemaView(SpectacularAPIView):
return super().get(request, *args, **kwargs)
+SAML_CALLBACK_SESSION_KEY = "saml_callback_url"
+
+
+def _safe_callback_path(value):
+ if not value or not isinstance(value, str):
+ return None
+ if not value.startswith("/") or value.startswith("//"):
+ return None
+ return value
+
+
+def _get_request_invitation_token(request):
+ for source_name in ("data", "POST"):
+ data = getattr(request, source_name, None) or {}
+ if not hasattr(data, "get"):
+ continue
+ invitation_token = data.get("invitation_token")
+ if invitation_token:
+ return invitation_token
+
+ wrapped_request = getattr(request, "_request", None)
+ if wrapped_request and wrapped_request is not request:
+ return _get_request_invitation_token(wrapped_request)
+
+ return None
+
+
+def _accept_social_invitation(request, user):
+ invitation_token = _get_request_invitation_token(request)
+ tenant_id = getattr(request, "prowler_invitation_tenant_id", None)
+ if invitation_token and not tenant_id:
+ invitation, _ = accept_invitation_for_user(
+ user=user,
+ invitation_token=invitation_token,
+ raise_not_found=True,
+ )
+ tenant_id = str(invitation.tenant_id)
+ return tenant_id
+
+
@extend_schema(exclude=True)
class GoogleSocialLoginView(SocialLoginView):
adapter_class = GoogleOAuth2Adapter
@@ -551,7 +595,11 @@ class GoogleSocialLoginView(SocialLoginView):
original_response = super().get_response()
if self.user and self.user.is_authenticated:
- serializer = TokenSocialLoginSerializer(data={"email": self.user.email})
+ tenant_id = _accept_social_invitation(self.request, self.user)
+ serializer_data = {"email": self.user.email}
+ if tenant_id:
+ serializer_data["tenant_id"] = tenant_id
+ serializer = TokenSocialLoginSerializer(data=serializer_data)
try:
serializer.is_valid(raise_exception=True)
except TokenError as e:
@@ -576,7 +624,11 @@ class GithubSocialLoginView(SocialLoginView):
original_response = super().get_response()
if self.user and self.user.is_authenticated:
- serializer = TokenSocialLoginSerializer(data={"email": self.user.email})
+ tenant_id = _accept_social_invitation(self.request, self.user)
+ serializer_data = {"email": self.user.email}
+ if tenant_id:
+ serializer_data["tenant_id"] = tenant_id
+ serializer = TokenSocialLoginSerializer(data=serializer_data)
try:
serializer.is_valid(raise_exception=True)
@@ -636,6 +688,10 @@ class CustomSAMLLoginView(LoginView):
This approach maintains security while providing better UX.
"""
+ callback_url = _safe_callback_path(request.GET.get("callback_url"))
+ request.session.pop(SAML_CALLBACK_SESSION_KEY, None)
+ if callback_url:
+ request.session[SAML_CALLBACK_SESSION_KEY] = callback_url
if request.method == "GET":
# Convert GET to POST while preserving parameters
request.method = "POST"
@@ -680,6 +736,11 @@ class SAMLInitiateAPIView(GenericAPIView):
"saml_login", kwargs={"organization_slug": config.email_domain}
)
login_url = urljoin(api_host, login_path)
+ callback_url = _safe_callback_path(
+ serializer.validated_data.get("callback_url")
+ )
+ if callback_url:
+ login_url = f"{login_url}?{urlencode({'callback_url': callback_url})}"
return redirect(login_url)
@@ -895,7 +956,13 @@ class TenantFinishACSView(FinishACSView):
token=token_data, user=user
)
callback_url = env.str("SAML_SSO_CALLBACK_URL")
- redirect_url = f"{callback_url}?id={saml_token.id}"
+ redirect_params = {"id": str(saml_token.id)}
+ saml_callback_url = _safe_callback_path(
+ request.session.pop(SAML_CALLBACK_SESSION_KEY, None)
+ )
+ if saml_callback_url:
+ redirect_params["callbackUrl"] = saml_callback_url
+ redirect_url = f"{callback_url}?{urlencode(redirect_params)}"
request.session.pop("saml_user_created", None)
return redirect(redirect_url)
@@ -947,8 +1014,8 @@ class UserViewSet(BaseUserViewset):
"""
Returns the required permissions based on the request method.
"""
- if self.action == "me":
- # No permissions required for me request
+ if self.action in ["me", "partial_update"]:
+ # No permissions required for me and partial_update requests
self.required_permissions = []
else:
# Require permission for the rest of the requests
@@ -1002,6 +1069,24 @@ class UserViewSet(BaseUserViewset):
status=status.HTTP_200_OK,
)
+ def partial_update(self, request, *args, **kwargs):
+ user = self.get_object()
+ if user.id != self.request.user.id:
+ role = get_role(self.request.user, self.request.tenant_id)
+ if not getattr(role, Permissions.MANAGE_USERS.value, False):
+ raise ValidationError(
+ "Only users with manage users permission can update other users."
+ )
+
+ serializer = self.get_serializer(user, data=request.data, partial=True)
+ serializer.is_valid(raise_exception=True)
+ self.perform_update(serializer)
+
+ if getattr(user, "_prefetched_objects_cache", None):
+ user._prefetched_objects_cache = {}
+
+ return Response(serializer.data)
+
def destroy(self, request, *args, **kwargs):
if kwargs["pk"] != str(self.request.user.id):
raise ValidationError("Only the current user can be deleted.")
@@ -1888,8 +1973,8 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
description=(
"Download a specific compliance report as an OCSF JSON file. "
"Only universal frameworks that declare an output configuration "
- "produce this artifact (currently 'dora_2022_2554' and 'csa_ccm_4.0'); any "
- "other framework returns 404."
+ "produce this artifact (currently 'dora_2022_2554', 'csa_ccm_4.0' "
+ "and 'cis_controls_8.1'); any other framework returns 404."
),
parameters=[
OpenApiParameter(
@@ -2634,12 +2719,23 @@ class ScanViewSet(BaseRLSViewSet):
def create(self, request, *args, **kwargs):
input_serializer = self.get_serializer(data=request.data)
input_serializer.is_valid(raise_exception=True)
+ provider = input_serializer.validated_data.get("provider")
+ active_scan = None
# Broker publish is deferred to on_commit so the worker cannot read
# Scan before BaseRLSViewSet's dispatch-wide atomic commits.
pre_task_id = str(uuid.uuid4())
with transaction.atomic():
+ if provider:
+ provider = Provider.objects.select_for_update().get(
+ id=provider.id,
+ tenant_id=self.request.tenant_id,
+ )
+ active_scan = get_active_provider_scan(
+ self.request.tenant_id, provider.id
+ )
+
scan = input_serializer.save()
scan.task_id = pre_task_id
scan.save(update_fields=["task_id"])
@@ -2650,29 +2746,18 @@ class ScanViewSet(BaseRLSViewSet):
provider_id=str(scan.provider_id),
)
- task_result, _ = TaskResult.objects.get_or_create(
- task_id=pre_task_id,
- defaults={"status": states.PENDING, "task_name": "scan-perform"},
- )
- prowler_task, _ = Task.objects.update_or_create(
- id=pre_task_id,
+ prowler_task = create_scan_task_record(
tenant_id=self.request.tenant_id,
- defaults={"task_runner_task": task_result},
+ task_id=pre_task_id,
+ task_status=(QUEUED_SCAN_TASK_STATE if active_scan else None),
)
- scan_kwargs = {
- "tenant_id": self.request.tenant_id,
- "scan_id": str(scan.id),
- "provider_id": str(scan.provider_id),
- # Disabled for now
- # checks_to_execute=scan.scanner_args.get("checks_to_execute")
- }
-
- transaction.on_commit(
- lambda: perform_scan_task.apply_async(
- kwargs=scan_kwargs, task_id=pre_task_id
+ if not active_scan:
+ enqueue_scan_execution_on_commit(
+ tenant_id=self.request.tenant_id,
+ scan=scan,
+ task_id=pre_task_id,
)
- )
self.response_serializer_class = TaskSerializer
output_serializer = self.get_serializer(prowler_task)
@@ -2876,13 +2961,22 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
def list(self, request, *args, **kwargs):
queryset = self.filter_queryset(self.get_queryset())
+ active_sink_backend = django_settings.ATTACK_PATHS_SINK_DATABASE
latest_per_provider = queryset.annotate(
+ active_sink_rank=Case(
+ When(sink_backend=active_sink_backend, then=Value(0)),
+ default=Value(1),
+ output_field=IntegerField(),
+ ),
latest_scan_rank=Window(
expression=RowNumber(),
partition_by=[F("provider_id")],
- order_by=[F("inserted_at").desc()],
- )
+ order_by=[
+ F("active_sink_rank").asc(),
+ F("inserted_at").desc(),
+ ],
+ ),
).filter(latest_scan_rank=1)
page = self.paginate_queryset(latest_per_provider)
@@ -2909,7 +3003,11 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
)
def attack_paths_queries(self, request, pk=None):
attack_paths_scan = self.get_object()
- queries = get_queries_for_provider(attack_paths_scan.provider.provider)
+ # TODO: drop the is_migrated argument after Neptune cutover
+ queries = get_queries_for_provider(
+ attack_paths_scan.provider.provider,
+ is_migrated=attack_paths_scan.is_migrated,
+ )
if not queries:
return Response(
@@ -2942,7 +3040,11 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
serializer = AttackPathsQueryRunRequestSerializer(data=payload)
serializer.is_valid(raise_exception=True)
- query_definition = get_query_by_id(serializer.validated_data["id"])
+ # TODO: drop the is_migrated argument after Neptune cutover
+ query_definition = get_query_by_id(
+ serializer.validated_data["id"],
+ is_migrated=attack_paths_scan.is_migrated,
+ )
if (
query_definition is None
or query_definition.provider != attack_paths_scan.provider.provider
@@ -2968,6 +3070,7 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
query_definition,
parameters,
provider_id,
+ scan=attack_paths_scan,
)
query_duration = time.monotonic() - start
@@ -3035,6 +3138,7 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
database_name,
serializer.validated_data["query"],
provider_id,
+ scan=attack_paths_scan,
)
query_duration = time.monotonic() - start
@@ -3091,7 +3195,7 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
provider_id = str(attack_paths_scan.provider_id)
schema = attack_paths_views_helpers.get_cartography_schema(
- database_name, provider_id
+ database_name, provider_id, attack_paths_scan
)
if not schema:
return Response(
@@ -3814,6 +3918,8 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
def get_filterset_class(self):
if self.action in ["latest", "metadata_latest"]:
return LatestFindingFilter
+ if self.action == "metadata":
+ return FindingMetadataFilter
return FindingFilter
def get_queryset(self):
@@ -4349,25 +4455,12 @@ class InvitationAcceptViewSet(BaseRLSViewSet):
invitation_token = serializer.validated_data["invitation_token"]
user_email = request.user.email
- invitation = validate_invitation(
- invitation_token, user_email, raise_not_found=True
- )
-
- # Proceed with accepting the invitation
user = User.objects.using(MainRouter.admin_db).get(email=user_email)
- membership = Membership.objects.using(MainRouter.admin_db).create(
+ invitation, membership = accept_invitation_for_user(
user=user,
- tenant=invitation.tenant,
+ invitation_token=invitation_token,
+ raise_not_found=True,
)
- user_role = []
- for role in invitation.roles.all():
- user_role.append(
- UserRoleRelationship.objects.using(MainRouter.admin_db).create(
- user=user, role=role, tenant=invitation.tenant
- )
- )
- invitation.state = Invitation.State.ACCEPTED
- invitation.save(using=MainRouter.admin_db)
self.response_serializer_class = MembershipSerializer
membership_serializer = self.get_serializer(membership)
diff --git a/api/src/backend/api/validators.py b/api/src/backend/api/validators.py
index 543406f202..6ad7ccfe0f 100644
--- a/api/src/backend/api/validators.py
+++ b/api/src/backend/api/validators.py
@@ -1,14 +1,155 @@
+import ipaddress
+import socket
import string
+from urllib.parse import urlparse
+from django.conf import settings
from django.core.exceptions import ValidationError
from django.utils.translation import gettext as _
+LIGHTHOUSE_OPENAI_COMPATIBLE_ALLOWED_SCHEMES = frozenset({"https"})
+LIGHTHOUSE_NAT64_WELL_KNOWN_PREFIX = ipaddress.IPv6Network("64:ff9b::/96")
+LIGHTHOUSE_BLOCKED_METADATA_HOSTS = frozenset(
+ {
+ "169.254.169.254",
+ "169.254.170.2",
+ "fd00:ec2::254",
+ "localhost",
+ "metadata.google.internal",
+ }
+)
+
+
+def _normalize_hostname(hostname: str) -> str:
+ return hostname.rstrip(".").lower()
+
+
+def _lighthouse_openai_compatible_allowed_hosts() -> frozenset[str]:
+ return frozenset(
+ _normalize_hostname(allowed_host.strip())
+ for allowed_host in settings.LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS
+ if allowed_host and allowed_host.strip()
+ )
+
+
+def _validate_lighthouse_public_ip(address: str) -> None:
+ ip_address = ipaddress.ip_address(address)
+ if isinstance(ip_address, ipaddress.IPv6Address):
+ # Classify transition addresses by their effective IPv4 destination.
+ embedded_ip_address = ip_address.ipv4_mapped or ip_address.sixtofour
+ if (
+ embedded_ip_address is None
+ and ip_address in LIGHTHOUSE_NAT64_WELL_KNOWN_PREFIX
+ ):
+ embedded_ip_address = ipaddress.IPv4Address(int(ip_address) & 0xFFFFFFFF)
+ if embedded_ip_address is not None:
+ ip_address = embedded_ip_address
+ if not ip_address.is_global:
+ raise ValidationError(
+ _("Base URL must use an external public endpoint."),
+ code="lighthouse_base_url_not_public",
+ )
+
+
+def resolve_lighthouse_openai_compatible_host(
+ hostname: str,
+ port: int,
+ *,
+ resolve_dns: bool = True,
+) -> tuple[str, ...]:
+ """Return public IP addresses that are safe for Lighthouse outbound use."""
+ hostname = _normalize_hostname(hostname)
+ if hostname in _lighthouse_openai_compatible_allowed_hosts():
+ # Operator-allowlisted hosts skip the public-endpoint checks; returning
+ # the hostname makes the network backend connect through regular DNS
+ # resolution instead of pinned addresses.
+ return (hostname,)
+
+ if hostname in LIGHTHOUSE_BLOCKED_METADATA_HOSTS or hostname.endswith(".localhost"):
+ raise ValidationError(
+ _("Base URL must use an external public endpoint."),
+ code="lighthouse_base_url_blocked_host",
+ )
+
+ try:
+ _validate_lighthouse_public_ip(hostname)
+ except ValueError:
+ if not resolve_dns:
+ return ()
+ else:
+ return (hostname,)
+
+ try:
+ resolved_addresses = socket.getaddrinfo(hostname, port, type=socket.SOCK_STREAM)
+ except socket.gaierror as error:
+ raise ValidationError(
+ _("Base URL host could not be resolved."),
+ code="lighthouse_base_url_resolution_failed",
+ ) from error
+
+ if not resolved_addresses:
+ raise ValidationError(
+ _("Base URL host could not be resolved."),
+ code="lighthouse_base_url_resolution_failed",
+ )
+
+ public_addresses: list[str] = []
+ for resolved_address in resolved_addresses:
+ socket_address = resolved_address[4]
+ resolved_ip_address = socket_address[0]
+ _validate_lighthouse_public_ip(resolved_ip_address)
+ if resolved_ip_address not in public_addresses:
+ public_addresses.append(resolved_ip_address)
+
+ return tuple(public_addresses)
+
+
+def validate_lighthouse_openai_compatible_base_url(
+ base_url: str,
+ *,
+ resolve_dns: bool = True,
+) -> None:
+ """Validate an OpenAI-compatible Lighthouse base URL before outbound use."""
+ parsed = urlparse(str(base_url))
+ if parsed.scheme.lower() not in LIGHTHOUSE_OPENAI_COMPATIBLE_ALLOWED_SCHEMES:
+ raise ValidationError(
+ _("Base URL must use HTTPS."),
+ code="lighthouse_base_url_invalid_scheme",
+ )
+
+ if not parsed.hostname:
+ raise ValidationError(
+ _("Base URL must include a host."),
+ code="lighthouse_base_url_missing_host",
+ )
+
+ try:
+ port = parsed.port
+ except ValueError as error:
+ raise ValidationError(
+ _("Base URL port is invalid."),
+ code="lighthouse_base_url_invalid_port",
+ ) from error
+
+ if port is not None and not 1 <= port <= 65535:
+ raise ValidationError(
+ _("Base URL port is invalid."),
+ code="lighthouse_base_url_invalid_port",
+ )
+
+ resolve_lighthouse_openai_compatible_host(
+ parsed.hostname,
+ port or 443,
+ resolve_dns=resolve_dns,
+ )
+
class MaximumLengthValidator:
def __init__(self, max_length=72):
self.max_length = max_length
def validate(self, password, user=None):
+ del user
if len(password) > self.max_length:
raise ValidationError(
_(
@@ -31,6 +172,7 @@ class SpecialCharactersValidator:
self.min_special_characters = min_special_characters
def validate(self, password, user=None):
+ del user
if (
sum(1 for char in password if char in self.special_characters)
< self.min_special_characters
@@ -55,6 +197,7 @@ class UppercaseValidator:
self.min_uppercase = min_uppercase
def validate(self, password, user=None):
+ del user
if sum(1 for char in password if char.isupper()) < self.min_uppercase:
raise ValidationError(
_(
@@ -75,6 +218,7 @@ class LowercaseValidator:
self.min_lowercase = min_lowercase
def validate(self, password, user=None):
+ del user
if sum(1 for char in password if char.islower()) < self.min_lowercase:
raise ValidationError(
_(
@@ -95,6 +239,7 @@ class NumericValidator:
self.min_numeric = min_numeric
def validate(self, password, user=None):
+ del user
if sum(1 for char in password if char.isdigit()) < self.min_numeric:
raise ValidationError(
_(
diff --git a/api/src/backend/config/celery.py b/api/src/backend/config/celery.py
index 1a35a1a753..9ac4f1e4ef 100644
--- a/api/src/backend/config/celery.py
+++ b/api/src/backend/config/celery.py
@@ -74,6 +74,7 @@ celery_app.conf.task_annotations = {
for name in (
"scan-perform",
"scan-perform-scheduled",
+ "attack-paths-scan-perform",
"provider-deletion",
"tenant-deletion",
)
diff --git a/api/src/backend/config/django/base.py b/api/src/backend/config/django/base.py
index 31a9537b5f..a079942600 100644
--- a/api/src/backend/config/django/base.py
+++ b/api/src/backend/config/django/base.py
@@ -230,6 +230,7 @@ SIMPLE_JWT = {
"JTI_CLAIM": "jti",
"USER_ID_FIELD": "id",
"USER_ID_CLAIM": "sub",
+ "CHECK_REVOKE_TOKEN": True,
# Issuer and Audience claims, for the moment we will keep these values as default values, they may change in the
# future.
"AUDIENCE": env.str("DJANGO_JWT_AUDIENCE", "https://api.prowler.com"),
@@ -307,9 +308,26 @@ CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
# Attack Paths
+ATTACK_PATHS_SCAN_INACTIVITY_THRESHOLD_MINUTES = env.int(
+ "ATTACK_PATHS_SCAN_INACTIVITY_THRESHOLD_MINUTES", 30
+)
ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES = env.int(
- "ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES", 2880
-) # 48h
+ "ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES", 960
+) # 16h
+
+# Selects where the persistent attack-paths graph is stored. The scan
+# temporary database is always Neo4j; only the sink is configurable.
+# Valid values: "neo4j" (default, OSS and local dev), "neptune" (hosted).
+ATTACK_PATHS_SINK_DATABASE = env.str("ATTACK_PATHS_SINK_DATABASE", default="neo4j")
+
+# Lighthouse AI
+# Comma-separated hostnames (or IP literals) that bypass the SSRF validation
+# applied to OpenAI-compatible provider base URLs, so self-hosted deployments
+# can point Lighthouse AI at internal endpoints. Empty by default: every base
+# URL must resolve to a public endpoint.
+LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS = env.list(
+ "LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS", default=[]
+)
# Orphan task recovery feature flags. The master switch is OFF by default, so task
# recovery is opt-in; enable it with DJANGO_TASK_RECOVERY_ENABLED=true. The per-group
diff --git a/api/src/backend/config/django/devel.py b/api/src/backend/config/django/devel.py
index 6921790ca3..5b3871aa8b 100644
--- a/api/src/backend/config/django/devel.py
+++ b/api/src/backend/config/django/devel.py
@@ -50,6 +50,12 @@ DATABASES = {
"USER": env.str("NEO4J_USER", "neo4j"),
"PASSWORD": env.str("NEO4J_PASSWORD", "neo4j_password"),
},
+ "neptune": {
+ "WRITER_ENDPOINT": env.str("NEPTUNE_WRITER_ENDPOINT", ""),
+ "READER_ENDPOINT": env.str("NEPTUNE_READER_ENDPOINT", ""),
+ "PORT": env.str("NEPTUNE_PORT", "8182"),
+ "REGION": env.str("AWS_REGION", ""),
+ },
}
DATABASES["default"] = DATABASES["prowler_user"]
diff --git a/api/src/backend/config/django/production.py b/api/src/backend/config/django/production.py
index cb651f6e76..79d8993b10 100644
--- a/api/src/backend/config/django/production.py
+++ b/api/src/backend/config/django/production.py
@@ -49,12 +49,19 @@ DATABASES = {
"HOST": env("POSTGRES_REPLICA_HOST", default=default_db_host),
"PORT": env("POSTGRES_REPLICA_PORT", default=default_db_port),
},
+ # TODO: drop after Neptune cutover just loosen defaults to `""`
"neo4j": {
"HOST": env.str("NEO4J_HOST"),
"PORT": env.str("NEO4J_PORT"),
"USER": env.str("NEO4J_USER"),
"PASSWORD": env.str("NEO4J_PASSWORD"),
},
+ "neptune": {
+ "WRITER_ENDPOINT": env.str("NEPTUNE_WRITER_ENDPOINT", default=""),
+ "READER_ENDPOINT": env.str("NEPTUNE_READER_ENDPOINT", default=""),
+ "PORT": env.str("NEPTUNE_PORT", default="8182"),
+ "REGION": env.str("AWS_REGION", default=""),
+ },
}
DATABASES["default"] = DATABASES["prowler_user"]
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 9ede1d3164..8b17ad669d 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -83,12 +83,32 @@ def _warm_compliance_caches_in_background():
def post_fork(_server, worker):
- """Warm compliance caches after each worker fork.
+ """Re-initialize attack-paths drivers and warm compliance caches per worker.
- Warm compliance caches in a background thread so the worker becomes ready
- immediately. A request for a not-yet-warmed provider lazily loads just that
- provider, which stays well under the worker timeout.
+ Neo4j / Neptune drivers spawn background IO threads that do not survive
+ ``fork()``. When the gunicorn master runs with ``preload_app=True``, the
+ child inherits driver objects whose pool references dead threads and
+ hangs on the first ``pool.acquire`` call until the watchdog kills the
+ worker. Re-initializing per worker guarantees each child owns its own
+ live threads. See GUNICORN_WORKER_TIMEOUTS_ANALYSIS.md for detail.
+
+ Compliance caches are then warmed in a background thread so the worker
+ becomes ready immediately. A request for a not-yet-warmed provider lazily
+ loads just that provider, which stays well under the worker timeout.
"""
+ from api.attack_paths import database as graph_database
+
+ try:
+ graph_database.close_driver()
+ except Exception: # pragma: no cover - best-effort cleanup
+ gunicorn_logger.debug(
+ "Failed to close inherited Neo4j driver in post_fork for worker pid=%s",
+ worker.pid,
+ exc_info=True,
+ )
+ graph_database.init_driver()
+ gunicorn_logger.info(f"Attack-paths drivers initialized for worker {worker.pid}")
+
threading.Thread(
target=_warm_compliance_caches_in_background,
name="warm-compliance-caches",
diff --git a/api/src/backend/config/settings/sentry.py b/api/src/backend/config/settings/sentry.py
index 5fd6e39cc9..a3acbe37bb 100644
--- a/api/src/backend/config/settings/sentry.py
+++ b/api/src/backend/config/settings/sentry.py
@@ -91,6 +91,13 @@ def before_send(event, hint):
log_msg = log_record.getMessage()
log_lvl = log_record.levelno
+ if (
+ getattr(log_record, "name", "") == "cartography.graph.job"
+ and "Neo.ClientError.Database.DatabaseNotFound" in log_msg
+ and "db-tmp-scan-" in log_msg
+ ):
+ return None
+
# The Neo4j driver logs transient connection errors (defunct
# connections, resets) at ERROR level via the `neo4j.io` logger.
# `RetryableSession` handles these with retries. If all retries
@@ -115,19 +122,27 @@ def before_send(event, hint):
return event
-sentry_sdk.init(
- dsn=env.str("DJANGO_SENTRY_DSN", ""),
- # Add data like request headers and IP for users,
- # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
- before_send=before_send,
- send_default_pii=True,
- traces_sample_rate=env.float("DJANGO_SENTRY_TRACES_SAMPLE_RATE", default=0.02),
- _experiments={
- # Set continuous_profiling_auto_start to True
- # to automatically start the profiler on when
- # possible.
- "continuous_profiling_auto_start": True,
- },
- attach_stacktrace=True,
- ignore_errors=IGNORED_EXCEPTIONS,
-)
+def initialize_sentry():
+ sentry_dsn = env.str("DJANGO_SENTRY_DSN", "")
+ if not sentry_dsn:
+ return
+
+ sentry_sdk.init(
+ dsn=sentry_dsn,
+ # Add data like request headers and IP for users,
+ # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
+ before_send=before_send,
+ send_default_pii=True,
+ traces_sample_rate=env.float("DJANGO_SENTRY_TRACES_SAMPLE_RATE", default=0.02),
+ _experiments={
+ # Set continuous_profiling_auto_start to True
+ # to automatically start the profiler on when
+ # possible.
+ "continuous_profiling_auto_start": True,
+ },
+ attach_stacktrace=True,
+ ignore_errors=IGNORED_EXCEPTIONS,
+ )
+
+
+initialize_sentry()
diff --git a/api/src/backend/config/settings/social_login.py b/api/src/backend/config/settings/social_login.py
index d6b5b53df2..ffc6a4724e 100644
--- a/api/src/backend/config/settings/social_login.py
+++ b/api/src/backend/config/settings/social_login.py
@@ -13,16 +13,17 @@ GITHUB_OAUTH_CALLBACK_URL = env("SOCIAL_GITHUB_OAUTH_CALLBACK_URL", default="")
ACCOUNT_LOGIN_METHODS = {"email"} # Use Email / Password authentication
ACCOUNT_SIGNUP_FIELDS = ["email*", "password1*", "password2*"]
ACCOUNT_EMAIL_VERIFICATION = "none" # Do not require email confirmation
+ACCOUNT_EMAIL_NOTIFICATIONS = False
ACCOUNT_USER_MODEL_USERNAME_FIELD = None
REST_AUTH = {
"TOKEN_MODEL": None,
"REST_USE_JWT": True,
}
# django-allauth (social)
-# Authenticate if local account with this email address already exists
-SOCIALACCOUNT_EMAIL_AUTHENTICATION = True
-# Connect local account and social account if local account with that email address already exists
-SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = True
+# Email-based account matching is handled by ProwlerSocialAccountAdapter, which
+# verifies both the provider email and the existing account email before linking.
+SOCIALACCOUNT_EMAIL_AUTHENTICATION = False
+SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = False
SOCIALACCOUNT_ADAPTER = "api.adapters.ProwlerSocialAccountAdapter"
diff --git a/api/src/backend/conftest.py b/api/src/backend/conftest.py
index af58730e7d..daa0616971 100644
--- a/api/src/backend/conftest.py
+++ b/api/src/backend/conftest.py
@@ -2,6 +2,7 @@ import logging
from datetime import UTC, datetime, timedelta
from types import SimpleNamespace
from unittest.mock import MagicMock, patch
+from uuid import uuid4
import pytest
from allauth.socialaccount.models import SocialLogin
@@ -50,12 +51,14 @@ from api.v1.serializers import TokenSerializer
from django.conf import settings
from django.db import connection as django_connection
from django.db import connections as django_connections
+from django.test import Client
from django.urls import reverse
from django_celery_results.models import TaskResult
from prowler.lib.check.models import Severity
from prowler.lib.outputs.finding import Status
from rest_framework import status
from rest_framework.test import APIClient
+from rest_framework_simplejwt.tokens import AccessToken
from tasks.jobs.backfill import (
aggregate_scan_category_summaries,
aggregate_scan_resource_group_summaries,
@@ -67,6 +70,7 @@ API_JSON_CONTENT_TYPE = "application/vnd.api+json"
NO_TENANT_HTTP_STATUS = status.HTTP_401_UNAUTHORIZED
TEST_USER = "dev@prowler.com"
TEST_PASSWORD = "testing_psswd"
+TEST_REPLICA_ALIAS = "test_replica"
def _install_compliance_catalog_test_cache() -> None:
@@ -228,14 +232,15 @@ def create_test_user(_session_test_user, django_db_blocker):
"""Re-create the session-scoped test user when a TransactionTestCase
has truncated the users table."""
with django_db_blocker.unblock():
- if not User.objects.filter(pk=_session_test_user.pk).exists():
- User.objects.create_user(
+ user = User.objects.filter(pk=_session_test_user.pk).first()
+ if user is None:
+ user = User.objects.create_user(
id=_session_test_user.pk,
name="testing",
email=TEST_USER,
password=TEST_PASSWORD,
)
- return _session_test_user
+ return user
@pytest.fixture(scope="function")
@@ -358,22 +363,42 @@ def create_test_user_rbac_manage_account(django_db_setup, django_db_blocker):
return user
+def first_membership_tenant(user):
+ return user.memberships.order_by("date_joined").first().tenant
+
+
+def access_token_for_tenant(user, tenant):
+ access_token = AccessToken.for_user(user)
+ access_token["tenant_id"] = str(tenant.id)
+ access_token.payload["nbf"] = access_token["iat"]
+ return str(access_token)
+
+
+def authenticate_client_for_tenant(client, user, tenant):
+ client.user = user
+ client.defaults["HTTP_AUTHORIZATION"] = (
+ f"Bearer {access_token_for_tenant(user, tenant)}"
+ )
+ return client
+
+
+@pytest.fixture
+def authenticated_client_for_tenant_factory():
+ def create_authenticated_client(user, tenant):
+ return authenticate_client_for_tenant(Client(), user, tenant)
+
+ return create_authenticated_client
+
+
@pytest.fixture
def authenticated_client_rbac_manage_account(
- create_test_user_rbac_manage_account, tenants_fixture, client
+ create_test_user_rbac_manage_account, client
):
- client.user = create_test_user_rbac_manage_account
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": "rbac_manage_account@rbac.com",
- "password": TEST_PASSWORD,
- }
+ return authenticate_client_for_tenant(
+ client,
+ create_test_user_rbac_manage_account,
+ first_membership_tenant(create_test_user_rbac_manage_account),
)
- serializer.is_valid()
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
@pytest.fixture(scope="function")
@@ -410,86 +435,43 @@ def create_test_user_rbac_manage_users_only(django_db_setup, django_db_blocker):
def authenticated_client_rbac_manage_users_only(
create_test_user_rbac_manage_users_only, client
):
- client.user = create_test_user_rbac_manage_users_only
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": "rbac_manage_users_only@rbac.com",
- "password": TEST_PASSWORD,
- }
+ return authenticate_client_for_tenant(
+ client,
+ create_test_user_rbac_manage_users_only,
+ first_membership_tenant(create_test_user_rbac_manage_users_only),
)
- serializer.is_valid()
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
@pytest.fixture
def authenticated_client_rbac(create_test_user_rbac, tenants_fixture, client):
- client.user = create_test_user_rbac
- tenant_id = tenants_fixture[0].id
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": "rbac@rbac.com",
- "password": TEST_PASSWORD,
- "tenant_id": tenant_id,
- }
+ return authenticate_client_for_tenant(
+ client, create_test_user_rbac, tenants_fixture[0]
)
- serializer.is_valid(raise_exception=True)
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
@pytest.fixture
def authenticated_client_rbac_noroles(
create_test_user_rbac_no_roles, tenants_fixture, client
):
- client.user = create_test_user_rbac_no_roles
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": "rbac_noroles@rbac.com",
- "password": TEST_PASSWORD,
- }
+ return authenticate_client_for_tenant(
+ client, create_test_user_rbac_no_roles, tenants_fixture[0]
)
- serializer.is_valid()
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
@pytest.fixture
def authenticated_client_no_permissions_rbac(
create_test_user_rbac_limited, tenants_fixture, client
):
- client.user = create_test_user_rbac_limited
- serializer = TokenSerializer(
- data={
- "type": "tokens",
- "email": "rbac_limited@rbac.com",
- "password": TEST_PASSWORD,
- }
+ return authenticate_client_for_tenant(
+ client, create_test_user_rbac_limited, tenants_fixture[0]
)
- serializer.is_valid()
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
@pytest.fixture
def authenticated_client(
create_test_user, tenants_fixture, set_user_admin_roles_fixture, client
):
- client.user = create_test_user
- serializer = TokenSerializer(
- data={"type": "tokens", "email": TEST_USER, "password": TEST_PASSWORD}
- )
- serializer.is_valid()
- access_token = serializer.validated_data["access"]
- client.defaults["HTTP_AUTHORIZATION"] = f"Bearer {access_token}"
- return client
+ return authenticate_client_for_tenant(client, create_test_user, tenants_fixture[0])
@pytest.fixture
@@ -590,109 +572,191 @@ def users_fixture(django_user_model):
@pytest.fixture
-def providers_fixture(tenants_fixture):
- tenant, *_ = tenants_fixture
- provider1 = Provider.objects.create(
- provider="aws",
- uid="123456789012",
- alias="aws_testing_1",
- tenant_id=tenant.id,
- )
- provider2 = Provider.objects.create(
- provider="aws",
- uid="123456789013",
- alias="aws_testing_2",
- tenant_id=tenant.id,
- )
- provider3 = Provider.objects.create(
- provider="gcp",
- uid="a12322-test321",
- alias="gcp_testing",
- tenant_id=tenant.id,
- )
- provider4 = Provider.objects.create(
- provider="kubernetes",
- uid="kubernetes-test-12345",
- alias="k8s_testing",
- tenant_id=tenant.id,
- )
- provider5 = Provider.objects.create(
- provider="azure",
- uid="37b065f8-26b0-4218-a665-0b23d07b27d9",
- alias="azure_testing",
- tenant_id=tenant.id,
- scanner_args={"key1": "value1", "key2": {"key21": "value21"}},
- )
- provider6 = Provider.objects.create(
- provider="m365",
- uid="m365.test.com",
- alias="m365_testing",
- tenant_id=tenant.id,
- )
- provider7 = Provider.objects.create(
- provider="oraclecloud",
- uid="ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
- alias="oci_testing",
- tenant_id=tenant.id,
- )
- provider8 = Provider.objects.create(
- provider="mongodbatlas",
- uid="64b1d3c0e4b03b1234567890",
- alias="mongodbatlas_testing",
- tenant_id=tenant.id,
- )
- provider9 = Provider.objects.create(
- provider="alibabacloud",
- uid="1234567890123456",
- alias="alibabacloud_testing",
- tenant_id=tenant.id,
- )
- provider10 = Provider.objects.create(
- provider="cloudflare",
- uid="a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
- alias="cloudflare_testing",
- tenant_id=tenant.id,
- )
- provider11 = Provider.objects.create(
- provider="openstack",
- uid="a1b2c3d4-e5f6-7890-abcd-ef1234567890",
- alias="openstack_testing",
- tenant_id=tenant.id,
- )
- provider12 = Provider.objects.create(
- provider="googleworkspace",
- uid="C12345678",
- alias="googleworkspace_testing",
- tenant_id=tenant.id,
- )
- provider13 = Provider.objects.create(
- provider="vercel",
- uid="team_abcdef1234567890ab",
- alias="vercel_testing",
- tenant_id=tenant.id,
- )
- provider14 = Provider.objects.create(
- provider="okta",
- uid="acme.okta.com",
- alias="okta_testing",
- tenant_id=tenant.id,
+def provider_factory(tenants_fixture):
+ tenant = tenants_fixture[0]
+ counters = {}
+
+ def next_counter(provider):
+ counters[provider] = counters.get(provider, 0) + 1
+ return counters[provider]
+
+ def defaults_for(provider, sequence):
+ return {
+ Provider.ProviderChoices.AWS.value: {
+ "uid": f"{123456789011 + sequence:012d}",
+ "alias": f"aws_testing_{sequence}",
+ },
+ Provider.ProviderChoices.AZURE.value: {
+ "uid": str(uuid4()),
+ "alias": f"azure_testing_{sequence}",
+ "scanner_args": {"key1": "value1", "key2": {"key21": "value21"}},
+ },
+ Provider.ProviderChoices.GCP.value: {
+ "uid": f"a12322-test{sequence:05d}",
+ "alias": f"gcp_testing_{sequence}",
+ },
+ Provider.ProviderChoices.KUBERNETES.value: {
+ "uid": f"kubernetes-test-{sequence}",
+ "alias": f"k8s_testing_{sequence}",
+ },
+ Provider.ProviderChoices.M365.value: {
+ "uid": f"m365-{sequence}.test.com",
+ "alias": f"m365_testing_{sequence}",
+ },
+ Provider.ProviderChoices.GITHUB.value: {
+ "uid": f"github-test-{sequence}",
+ "alias": f"github_testing_{sequence}",
+ },
+ Provider.ProviderChoices.MONGODBATLAS.value: {
+ "uid": f"64b1d3c0e4b03b{sequence:010x}",
+ "alias": f"mongodbatlas_testing_{sequence}",
+ },
+ Provider.ProviderChoices.IAC.value: {
+ "uid": f"https://github.com/prowler-cloud/test-{sequence}.git",
+ "alias": f"iac_testing_{sequence}",
+ },
+ Provider.ProviderChoices.ORACLECLOUD.value: {
+ "uid": f"ocid1.tenancy.oc1..aaaaaaaa{sequence:024d}",
+ "alias": f"oci_testing_{sequence}",
+ },
+ Provider.ProviderChoices.ALIBABACLOUD.value: {
+ "uid": f"{1234567890123455 + sequence:016d}",
+ "alias": f"alibabacloud_testing_{sequence}",
+ },
+ Provider.ProviderChoices.CLOUDFLARE.value: {
+ "uid": f"{0x1000000000000000000000000000000 + sequence:032x}",
+ "alias": f"cloudflare_testing_{sequence}",
+ },
+ Provider.ProviderChoices.OPENSTACK.value: {
+ "uid": f"openstack-project-{sequence}",
+ "alias": f"openstack_testing_{sequence}",
+ },
+ Provider.ProviderChoices.IMAGE.value: {
+ "uid": f"registry.example.com/prowler/test:{sequence}",
+ "alias": f"image_testing_{sequence}",
+ },
+ Provider.ProviderChoices.GOOGLEWORKSPACE.value: {
+ "uid": f"C{12345677 + sequence}",
+ "alias": f"googleworkspace_testing_{sequence}",
+ },
+ Provider.ProviderChoices.VERCEL.value: {
+ "uid": f"team_{sequence:016x}",
+ "alias": f"vercel_testing_{sequence}",
+ },
+ Provider.ProviderChoices.OKTA.value: {
+ "uid": f"acme-{sequence}.okta.com",
+ "alias": f"okta_testing_{sequence}",
+ },
+ }[provider]
+
+ def create_provider(provider=Provider.ProviderChoices.AWS.value, **overrides):
+ provider_value = getattr(provider, "value", provider)
+ selected_tenant = overrides.pop("tenant", tenant)
+ sequence = next_counter(provider_value)
+ attributes = {
+ "provider": provider_value,
+ "tenant_id": selected_tenant.id,
+ **defaults_for(provider_value, sequence),
+ }
+ attributes.update(overrides)
+ return Provider.objects.create(**attributes)
+
+ return create_provider
+
+
+@pytest.fixture
+def aws_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.AWS.value)
+
+
+@pytest.fixture
+def aws_provider_pair(aws_provider, provider_factory):
+ return (
+ aws_provider,
+ provider_factory(Provider.ProviderChoices.AWS.value),
)
- return (
- provider1,
- provider2,
- provider3,
- provider4,
- provider5,
- provider6,
- provider7,
- provider8,
- provider9,
- provider10,
- provider11,
- provider12,
- provider13,
- provider14,
+
+@pytest.fixture
+def azure_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.AZURE.value)
+
+
+@pytest.fixture
+def gcp_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.GCP.value)
+
+
+@pytest.fixture
+def kubernetes_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.KUBERNETES.value)
+
+
+@pytest.fixture
+def m365_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.M365.value)
+
+
+@pytest.fixture
+def github_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.GITHUB.value)
+
+
+@pytest.fixture
+def mongodbatlas_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.MONGODBATLAS.value)
+
+
+@pytest.fixture
+def iac_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.IAC.value)
+
+
+@pytest.fixture
+def oraclecloud_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.ORACLECLOUD.value)
+
+
+@pytest.fixture
+def alibabacloud_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.ALIBABACLOUD.value)
+
+
+@pytest.fixture
+def cloudflare_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.CLOUDFLARE.value)
+
+
+@pytest.fixture
+def openstack_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.OPENSTACK.value)
+
+
+@pytest.fixture
+def image_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.IMAGE.value)
+
+
+@pytest.fixture
+def googleworkspace_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.GOOGLEWORKSPACE.value)
+
+
+@pytest.fixture
+def vercel_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.VERCEL.value)
+
+
+@pytest.fixture
+def okta_provider(provider_factory):
+ return provider_factory(Provider.ProviderChoices.OKTA.value)
+
+
+@pytest.fixture
+def all_provider_types_fixture(provider_factory):
+ return tuple(
+ provider_factory(provider_choice.value)
+ for provider_choice in Provider.ProviderChoices
)
@@ -797,7 +861,7 @@ def roles_fixture(tenants_fixture):
@pytest.fixture
-def provider_secret_fixture(providers_fixture):
+def provider_secret_fixture(all_provider_types_fixture):
return tuple(
ProviderSecret.objects.create(
tenant_id=provider.tenant_id,
@@ -806,14 +870,14 @@ def provider_secret_fixture(providers_fixture):
secret={"key": "value"},
name=provider.alias,
)
- for provider in providers_fixture
+ for provider in all_provider_types_fixture
)
@pytest.fixture
-def scans_fixture(tenants_fixture, providers_fixture):
+def scans_fixture(tenants_fixture, aws_provider_pair):
tenant, *_ = tenants_fixture
- provider, provider2, *_ = providers_fixture
+ provider, provider2 = aws_provider_pair
now = datetime.now(UTC)
@@ -876,8 +940,8 @@ def tasks_fixture(tenants_fixture):
@pytest.fixture
-def resources_fixture(providers_fixture):
- provider, *_ = providers_fixture
+def resources_fixture(aws_provider_pair):
+ provider, provider2 = aws_provider_pair
tags = [
ResourceTag.objects.create(
@@ -918,8 +982,8 @@ def resources_fixture(providers_fixture):
resource2.upsert_or_delete_tags(tags)
resource3 = Resource.objects.create(
- tenant_id=providers_fixture[1].tenant_id,
- provider=providers_fixture[1],
+ tenant_id=provider2.tenant_id,
+ provider=provider2,
uid="arn:aws:ec2:us-east-1:123456789012:bucket/i-1234567890abcdef2",
name="My Bucket 3",
region="us-east-1",
@@ -1267,9 +1331,9 @@ def get_api_tokens(
@pytest.fixture
-def scan_summaries_fixture(tenants_fixture, providers_fixture):
+def scan_summaries_fixture(tenants_fixture, aws_provider):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
scan = Scan.objects.create(
name="overview scan",
provider=provider,
@@ -1346,8 +1410,8 @@ def scan_summaries_fixture(tenants_fixture, providers_fixture):
@pytest.fixture
-def integrations_fixture(providers_fixture):
- provider1, provider2, *_ = providers_fixture
+def integrations_fixture(aws_provider_pair):
+ provider1, provider2 = aws_provider_pair
tenant_id = provider1.tenant_id
integration1 = Integration.objects.create(
tenant_id=tenant_id,
@@ -1408,9 +1472,9 @@ def lighthouse_config_fixture(authenticated_client, tenants_fixture):
@pytest.fixture(scope="function")
-def latest_scan_finding(authenticated_client, providers_fixture, resources_fixture):
- provider = providers_fixture[0]
- tenant_id = str(providers_fixture[0].tenant_id)
+def latest_scan_finding(authenticated_client, aws_provider, resources_fixture):
+ provider = aws_provider
+ tenant_id = str(aws_provider.tenant_id)
resource = resources_fixture[0]
scan = Scan.objects.create(
name="latest completed scan",
@@ -1521,10 +1585,10 @@ def findings_with_multiple_categories(scans_fixture, resources_fixture):
@pytest.fixture(scope="function")
def latest_scan_finding_with_categories(
- authenticated_client, providers_fixture, resources_fixture
+ authenticated_client, aws_provider, resources_fixture
):
- provider = providers_fixture[0]
- tenant_id = str(providers_fixture[0].tenant_id)
+ provider = aws_provider
+ tenant_id = str(aws_provider.tenant_id)
resource = resources_fixture[0]
scan = Scan.objects.create(
name="latest completed scan with categories",
@@ -1558,9 +1622,9 @@ def latest_scan_finding_with_categories(
@pytest.fixture(scope="function")
-def latest_scan_resource(authenticated_client, providers_fixture):
- provider = providers_fixture[0]
- tenant_id = str(providers_fixture[0].tenant_id)
+def latest_scan_resource(authenticated_client, aws_provider):
+ provider = aws_provider
+ tenant_id = str(aws_provider.tenant_id)
scan = Scan.objects.create(
name="latest completed scan for resource",
provider=provider,
@@ -1821,6 +1885,36 @@ def attack_paths_query_definition_factory():
return _create
+@pytest.fixture
+def sink_backend_stub():
+ """Install a stub `SinkDatabase` into the sink factory for the test's duration.
+
+ The sink factory caches a process-wide backend and lazily initializes it
+ against `settings.DATABASES["neo4j"]` / `["neptune"]`. Tests that don't
+ want to stand up a real Bolt driver can yield this fixture's mock and
+ configure its return values directly:
+
+ sink_backend_stub.execute_read_query.return_value = some_graph
+
+ Both the active backend and the secondary-backend cache are restored on
+ teardown so tests stay isolated.
+ """
+ from api.attack_paths.sink import factory
+ from api.attack_paths.sink.base import SinkDatabase
+
+ stub = MagicMock(spec=SinkDatabase)
+ previous_backend = factory._backend
+ previous_secondary = dict(factory._secondary_backends)
+ factory._backend = stub
+ factory._secondary_backends.clear()
+ try:
+ yield stub
+ finally:
+ factory._backend = previous_backend
+ factory._secondary_backends.clear()
+ factory._secondary_backends.update(previous_secondary)
+
+
@pytest.fixture
def attack_paths_graph_stub_classes():
"""Provide lightweight graph element stubs for Attack Paths serialization tests."""
@@ -1995,11 +2089,11 @@ def get_authorization_header(access_token: str) -> dict:
@pytest.fixture
def provider_compliance_scores_fixture(
- tenants_fixture, providers_fixture, scans_fixture
+ tenants_fixture, aws_provider_pair, scans_fixture
):
"""Create ProviderComplianceScore entries for compliance watchlist tests."""
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
+ provider1, provider2 = aws_provider_pair
scan1, _, scan3 = scans_fixture
scan1.completed_at = datetime.now(UTC) - timedelta(hours=1)
@@ -2096,9 +2190,7 @@ def tenant_compliance_summary_fixture(tenants_fixture):
@pytest.fixture
-def finding_groups_fixture(
- tenants_fixture, providers_fixture, scans_fixture, resources_fixture
-):
+def finding_groups_fixture(tenants_fixture, scans_fixture, resources_fixture):
"""
Create a comprehensive set of findings for testing Finding Groups aggregation.
@@ -2117,7 +2209,6 @@ def finding_groups_fixture(
- Finding counts (pass, fail, muted, new, changed)
"""
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
scan1, scan2, *_ = scans_fixture
resource1, resource2, *_ = resources_fixture
@@ -2368,7 +2459,7 @@ def finding_groups_fixture(
@pytest.fixture
def finding_groups_title_variants_fixture(
- tenants_fixture, providers_fixture, scans_fixture, resources_fixture
+ tenants_fixture, scans_fixture, resources_fixture
):
"""
Two providers report the same check_id with different checktitle values.
@@ -2379,7 +2470,6 @@ def finding_groups_title_variants_fixture(
of which title variant matches the search term.
"""
tenant = tenants_fixture[0]
- provider1, provider2, *_ = providers_fixture
scan1, scan2, *_ = scans_fixture
resource1, resource2, *_ = resources_fixture
@@ -2453,8 +2543,27 @@ def pytest_collection_modifyitems(items):
"""Ensure test_rbac.py is executed first."""
items.sort(key=lambda item: 0 if "test_rbac.py" in item.nodeid else 1)
+ if any(item.get_closest_marker("requires_test_replica_alias") for item in items):
+ default_database = settings.DATABASES["default"]
+ if TEST_REPLICA_ALIAS not in settings.DATABASES:
+ settings.DATABASES[TEST_REPLICA_ALIAS] = {
+ **default_database,
+ "TEST": {
+ **default_database.get("TEST", {}),
+ "MIRROR": "default",
+ },
+ }
+ django_connections.databases[TEST_REPLICA_ALIAS] = settings.DATABASES[
+ TEST_REPLICA_ALIAS
+ ]
+
def pytest_configure(config):
+ config.addinivalue_line(
+ "markers",
+ "requires_test_replica_alias: creates a test-only replica alias mirrored "
+ "to default",
+ )
# Apply the mock before the test session starts. This is necessary to avoid admin error when running the
# 0004_rbac_missing_admin_roles migration
patch("api.db_router.MainRouter.admin_db", new="default").start()
diff --git a/api/src/backend/tasks/jobs/attack_paths/aws.py b/api/src/backend/tasks/jobs/attack_paths/aws.py
index 398c261ca4..4b2b96dd1b 100644
--- a/api/src/backend/tasks/jobs/attack_paths/aws.py
+++ b/api/src/backend/tasks/jobs/attack_paths/aws.py
@@ -6,7 +6,10 @@ from typing import Any
import aioboto3
import boto3
+import botocore
import neo4j
+import neo4j.exceptions
+from api.attack_paths.database import DATABASE_NOT_FOUND_CODE
from api.models import (
AttackPathsScan as ProwlerAPIAttackPathsScan,
)
@@ -73,13 +76,28 @@ def start_aws_ingestion(
# Adding an extra field
common_job_parameters["AWS_ID"] = prowler_api_provider.uid
- cartography_aws._autodiscover_accounts(
- neo4j_session,
- boto3_session,
- prowler_api_provider.uid,
- cartography_config.update_tag,
- common_job_parameters,
- )
+ # AWS Organizations account autodiscovery. Inlined from Cartography's removed
+ # `_autodiscover_accounts` (deleted in `0.137.0`), as `load_aws_accounts` is still public.
+ try:
+ org_client = boto3_session.client("organizations")
+ paginator = org_client.get_paginator("list_accounts")
+ discovered = []
+ for page in paginator.paginate():
+ discovered.extend(page["Accounts"])
+ active_accounts = {
+ a["Name"]: a["Id"] for a in discovered if a["Status"] == "ACTIVE"
+ }
+ cartography_aws.organizations.load_aws_accounts(
+ neo4j_session,
+ active_accounts,
+ cartography_config.update_tag,
+ common_job_parameters,
+ )
+ except botocore.exceptions.ClientError:
+ logger.warning(
+ f"Account {prowler_api_provider.uid} lacks permissions for AWS "
+ "Organizations autodiscovery."
+ )
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 4)
failed_syncs = sync_aws_account(
@@ -277,7 +295,7 @@ def sync_aws_account(
sync_args: dict[str, Any],
attack_paths_scan: ProwlerAPIAttackPathsScan,
) -> dict[str, str]:
- current_progress = 4 # `cartography_aws._autodiscover_accounts`
+ current_progress = 4 # AWS Organizations account autodiscovery
max_progress = (
87 # `cartography_aws.RESOURCE_FUNCTIONS["permission_relationships"]` - 1
)
@@ -331,6 +349,12 @@ def sync_aws_account(
)
except Exception as e:
+ if (
+ isinstance(e, neo4j.exceptions.Neo4jError)
+ and e.code == DATABASE_NOT_FOUND_CODE
+ ):
+ raise
+
logger.info(
f"Synced function {func_name} for AWS account {prowler_api_provider.uid} in {time.perf_counter() - func_t0:.3f}s (FAILED)"
)
diff --git a/api/src/backend/tasks/jobs/attack_paths/cleanup.py b/api/src/backend/tasks/jobs/attack_paths/cleanup.py
index 9ac2733faf..11868b3fe0 100644
--- a/api/src/backend/tasks/jobs/attack_paths/cleanup.py
+++ b/api/src/backend/tasks/jobs/attack_paths/cleanup.py
@@ -1,40 +1,50 @@
from datetime import UTC, datetime, timedelta
+from functools import partial
from api.attack_paths import database as graph_database
from api.db_router import MainRouter
from api.db_utils import rls_transaction
from api.models import AttackPathsScan, StateChoices
-from celery import states
+from celery import current_app, states
from celery.utils.log import get_task_logger
-from config.django.base import ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES
+from config.django.base import (
+ ATTACK_PATHS_SCAN_INACTIVITY_THRESHOLD_MINUTES,
+ ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES,
+)
+from django.db import DatabaseError
+from django.db.transaction import on_commit
from tasks.jobs.attack_paths.db_utils import (
- _mark_scan_finished,
+ mark_scan_finished,
recover_graph_data_ready,
)
-from tasks.jobs.orphan_recovery import is_worker_alive as _is_worker_alive
from tasks.jobs.orphan_recovery import revoke_task as _revoke_task
logger = get_task_logger(__name__)
+WORKER_PING_BASE_TIMEOUT_SECONDS = 5
+WORKER_PING_MAX_ATTEMPTS = 3
+
def cleanup_stale_attack_paths_scans() -> dict:
"""
Mark stale `AttackPathsScan` rows as `FAILED`.
Covers two stuck-state scenarios:
- 1. `EXECUTING` scans whose workers are dead, or that have exceeded the
- stale threshold while alive.
- 2. `SCHEDULED` scans that never made it to a worker — parent scan
+ 1. `EXECUTING` scans whose workers are unresponsive and whose rows have
+ stopped receiving progress updates, or that exceeded the stale threshold.
+ 2. `SCHEDULED` scans that never made it to a worker - parent scan
crashed before dispatch, broker lost the message, etc. Detected by
age plus the parent `Scan` no longer being in flight.
"""
- threshold = timedelta(minutes=ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES)
now = datetime.now(tz=UTC)
- cutoff = now - threshold
+ stale_cutoff = now - timedelta(minutes=ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES)
+ inactivity_cutoff = now - timedelta(
+ minutes=ATTACK_PATHS_SCAN_INACTIVITY_THRESHOLD_MINUTES
+ )
cleaned_up: list[str] = []
- cleaned_up.extend(_cleanup_stale_executing_scans(cutoff))
- cleaned_up.extend(_cleanup_stale_scheduled_scans(cutoff))
+ cleaned_up.extend(_cleanup_stale_executing_scans(stale_cutoff, inactivity_cutoff))
+ cleaned_up.extend(_cleanup_stale_scheduled_scans(stale_cutoff))
logger.info(
f"Stale `AttackPathsScan` cleanup: {len(cleaned_up)} scan(s) cleaned up"
@@ -42,13 +52,57 @@ def cleanup_stale_attack_paths_scans() -> dict:
return {"cleaned_up_count": len(cleaned_up), "scan_ids": cleaned_up}
-def _cleanup_stale_executing_scans(cutoff: datetime) -> list[str]:
+def _ping_workers(workers: set[str]) -> tuple[set[str], set[str] | None]:
+ """Ping worker destinations in parallel and retry only missing workers.
+
+ The second tuple item is `None` when the final ping attempt raises. In that
+ case the pending workers have unknown liveness and their scans must be kept.
+ """
+ pending = set(workers)
+ responsive: set[str] = set()
+
+ for attempt in range(WORKER_PING_MAX_ATTEMPTS):
+ if not pending:
+ return responsive, set()
+
+ timeout = WORKER_PING_BASE_TIMEOUT_SECONDS * 2**attempt
+ try:
+ response = current_app.control.inspect(
+ destination=sorted(pending), timeout=timeout
+ ).ping()
+ except Exception:
+ attempts_remaining = WORKER_PING_MAX_ATTEMPTS - attempt - 1
+ if attempts_remaining:
+ logger.warning(
+ f"Attack Paths worker ping attempt {attempt + 1} failed; "
+ f"retrying pending workers with {attempts_remaining} "
+ "attempt(s) remaining",
+ exc_info=True,
+ )
+ continue
+
+ logger.exception(
+ "Attack Paths worker ping attempts exhausted; preserving scans "
+ "for workers with unknown liveness"
+ )
+ return responsive, None
+
+ responded = pending.intersection((response or {}).keys())
+ responsive.update(responded)
+ pending.difference_update(responded)
+
+ return responsive, pending
+
+
+def _cleanup_stale_executing_scans(
+ stale_cutoff: datetime, inactivity_cutoff: datetime
+) -> list[str]:
"""
Two-pass detection for `EXECUTING` scans:
- 1. If `TaskResult.worker` exists, ping the worker.
- - Dead worker: cleanup immediately (any age).
- - Alive + past threshold: revoke the task, then cleanup.
- - Alive + within threshold: skip.
+ 1. Ping all recorded workers in parallel with bounded retries.
+ - Responsive + past stale threshold: cleanup.
+ - Unresponsive + past inactivity threshold: cleanup.
+ - Unknown after a final ping exception: preserve.
2. If no worker field: fall back to time-based heuristic only.
"""
executing_scans = list(
@@ -57,14 +111,13 @@ def _cleanup_stale_executing_scans(cutoff: datetime) -> list[str]:
.select_related("task__task_runner_task")
)
- # Cache worker liveness so each worker is pinged at most once
workers = {
tr.worker
for scan in executing_scans
if (tr := getattr(scan.task, "task_runner_task", None) if scan.task else None)
and tr.worker
}
- worker_alive = {w: _is_worker_alive(w) for w in workers}
+ responsive_workers, unresponsive_workers = _ping_workers(workers)
cleaned_up: list[str] = []
@@ -75,27 +128,50 @@ def _cleanup_stale_executing_scans(cutoff: datetime) -> list[str]:
worker = task_result.worker if task_result else None
if worker:
- alive = worker_alive.get(worker, True)
-
- if alive:
- if scan.started_at and scan.started_at >= cutoff:
+ if worker in responsive_workers:
+ if scan.started_at is None or scan.started_at >= stale_cutoff:
continue
- # Alive but stale — revoke before cleanup
- _revoke_task(task_result)
- reason = "Scan exceeded stale threshold — cleaned up by periodic task"
+ reason = "Scan exceeded stale threshold - cleaned up by periodic task"
+ recheck_activity_cutoff = None
+ elif unresponsive_workers is None or worker not in unresponsive_workers:
+ logger.info(
+ f"Preserving scan {scan.id}: worker {worker} liveness is "
+ f"unknown (progress={scan.progress}, updated_at={scan.updated_at})"
+ )
+ continue
else:
- reason = "Worker dead — cleaned up by periodic task"
+ if scan.updated_at >= inactivity_cutoff:
+ logger.info(
+ f"Preserving scan {scan.id}: worker {worker} is unresponsive "
+ f"but activity is recent (progress={scan.progress}, "
+ f"updated_at={scan.updated_at})"
+ )
+ continue
+
+ reason = (
+ "Worker unresponsive and scan inactive for "
+ f"{ATTACK_PATHS_SCAN_INACTIVITY_THRESHOLD_MINUTES} minutes - "
+ "cleaned up by periodic task"
+ )
+ recheck_activity_cutoff = inactivity_cutoff
else:
- # No worker recorded — time-based heuristic only
- if scan.started_at and scan.started_at >= cutoff:
+ # No worker recorded, time-based heuristic only
+ if scan.started_at is None or scan.started_at >= stale_cutoff:
continue
reason = (
- "No worker recorded, scan exceeded stale threshold — "
+ "No worker recorded, scan exceeded stale threshold - "
"cleaned up by periodic task"
)
+ recheck_activity_cutoff = None
- if _cleanup_scan(scan, task_result, reason):
+ if _cleanup_scan(
+ scan,
+ task_result,
+ reason,
+ revoke=worker is not None,
+ inactivity_cutoff=recheck_activity_cutoff,
+ ):
cleaned_up.append(str(scan.id))
return cleaned_up
@@ -112,10 +188,9 @@ def _cleanup_stale_scheduled_scans(cutoff: datetime) -> list[str]:
avoids cleaning up rows whose parent Prowler scan is legitimately still
running.
- For each match: revoke the queued task (best-effort; harmless if already
- consumed), atomically flip to `FAILED`, and mark the `TaskResult`. The
- temp Neo4j database is never created while `SCHEDULED`, so no drop is
- needed.
+ For each match: lock and recheck the row, mark the scan and `TaskResult` as
+ failed, then revoke the queued task after the transaction commits. The temp
+ Neo4j database is never created while `SCHEDULED`, so no drop is needed.
"""
scheduled_scans = list(
AttackPathsScan.all_objects.using(MainRouter.admin_db)
@@ -141,42 +216,54 @@ def _cleanup_stale_scheduled_scans(cutoff: datetime) -> list[str]:
task_result = (
getattr(scan.task, "task_runner_task", None) if scan.task else None
)
- if task_result:
- _revoke_task(task_result, terminate=False)
-
- reason = "Scan never started — cleaned up by periodic task"
+ reason = "Scan never started - cleaned up by periodic task"
if _cleanup_scheduled_scan(scan, task_result, reason):
cleaned_up.append(str(scan.id))
return cleaned_up
-def _cleanup_scan(scan, task_result, reason: str) -> bool:
+def _cleanup_scan(
+ scan,
+ task_result,
+ reason: str,
+ *,
+ revoke: bool = False,
+ inactivity_cutoff: datetime | None = None,
+) -> bool:
"""
Clean up a single stale `AttackPathsScan`:
- drop temp DB, mark `FAILED`, update `TaskResult`, recover `graph_data_ready`.
+ lock and recheck, mark `FAILED`, revoke after commit, drop the temp DB, and
+ recover graph readiness.
Returns `True` if the scan was actually cleaned up, `False` if skipped.
"""
scan_id_str = str(scan.id)
- # 1. Drop temp Neo4j database
+ try:
+ fresh_scan = _finalize_failed_scan(
+ scan,
+ StateChoices.EXECUTING,
+ reason,
+ task_result=task_result,
+ revoke=revoke,
+ inactivity_cutoff=inactivity_cutoff,
+ )
+ except DatabaseError:
+ logger.exception(
+ f"Failed to mark stale Attack Paths scan {scan_id_str} as failed"
+ )
+ return False
+
+ if fresh_scan is None:
+ return False
+
tmp_db_name = graph_database.get_database_name(scan.id, temporary=True)
try:
graph_database.drop_database(tmp_db_name)
except Exception:
logger.exception(f"Failed to drop temp database {tmp_db_name}")
- fresh_scan = _finalize_failed_scan(scan, StateChoices.EXECUTING, reason)
- if fresh_scan is None:
- return False
-
- # Mark `TaskResult` as `FAILURE` (not RLS-protected, outside lock)
- if task_result:
- task_result.status = states.FAILURE
- task_result.date_done = datetime.now(tz=UTC)
- task_result.save(update_fields=["status", "date_done"])
-
recover_graph_data_ready(fresh_scan)
logger.info(f"Cleaned up stale scan {scan_id_str}: {reason}")
@@ -187,31 +274,49 @@ def _cleanup_scheduled_scan(scan, task_result, reason: str) -> bool:
"""
Clean up a `SCHEDULED` scan that never reached a worker.
- Skips the temp Neo4j drop — the database is only created once the worker
+ Skips the temp Neo4j drop - the database is only created once the worker
enters `EXECUTING`, so dropping it here just produces noisy log output.
Returns `True` if the scan was actually cleaned up, `False` if skipped.
"""
scan_id_str = str(scan.id)
- fresh_scan = _finalize_failed_scan(scan, StateChoices.SCHEDULED, reason)
- if fresh_scan is None:
+ try:
+ fresh_scan = _finalize_failed_scan(
+ scan,
+ StateChoices.SCHEDULED,
+ reason,
+ task_result=task_result,
+ revoke=task_result is not None,
+ terminate=False,
+ )
+ except DatabaseError:
+ logger.exception(
+ f"Failed to mark scheduled Attack Paths scan {scan_id_str} as failed"
+ )
return False
- if task_result:
- task_result.status = states.FAILURE
- task_result.date_done = datetime.now(tz=UTC)
- task_result.save(update_fields=["status", "date_done"])
+ if fresh_scan is None:
+ return False
logger.info(f"Cleaned up scheduled scan {scan_id_str}: {reason}")
return True
-def _finalize_failed_scan(scan, expected_state: str, reason: str):
+def _finalize_failed_scan(
+ scan,
+ expected_state: str,
+ reason: str,
+ *,
+ task_result=None,
+ revoke: bool = False,
+ terminate: bool = True,
+ inactivity_cutoff: datetime | None = None,
+):
"""
- Atomically lock the row, verify it's still in `expected_state`, and
- mark it `FAILED`. Returns the locked row on success, `None` if the
- row is gone or has already moved on.
+ Atomically lock the row, verify it's still eligible, and mark it `FAILED`.
+ If requested, register revocation after commit. Returns the locked row on
+ success, `None` if the row is gone or has already moved on.
"""
scan_id_str = str(scan.id)
with rls_transaction(str(scan.tenant_id)):
@@ -225,6 +330,23 @@ def _finalize_failed_scan(scan, expected_state: str, reason: str):
logger.info(f"Scan {scan_id_str} is now {fresh_scan.state}, skipping")
return None
- _mark_scan_finished(fresh_scan, StateChoices.FAILED, {"global_error": reason})
+ if inactivity_cutoff is not None and fresh_scan.updated_at >= inactivity_cutoff:
+ logger.info(
+ f"Scan {scan_id_str} received activity during worker checks, skipping"
+ )
+ return None
+
+ mark_scan_finished(fresh_scan, StateChoices.FAILED, {"global_error": reason})
+
+ if task_result:
+ task_result.status = states.FAILURE
+ task_result.date_done = datetime.now(tz=UTC)
+ task_result.save(update_fields=["status", "date_done"])
+
+ if revoke and task_result:
+ on_commit(
+ partial(_revoke_task, task_result, terminate=terminate),
+ using=fresh_scan._state.db,
+ )
return fresh_scan
diff --git a/api/src/backend/tasks/jobs/attack_paths/config.py b/api/src/backend/tasks/jobs/attack_paths/config.py
index 78ca7eb038..122fc8a9e0 100644
--- a/api/src/backend/tasks/jobs/attack_paths/config.py
+++ b/api/src/backend/tasks/jobs/attack_paths/config.py
@@ -1,17 +1,19 @@
from collections.abc import Callable
-from dataclasses import dataclass
from uuid import UUID
from config.env import env
-from tasks.jobs.attack_paths import aws
+from tasks.jobs.attack_paths import provider_config as _provider_config
-# Batch size for Neo4j write operations (resource labeling, cleanup)
-BATCH_SIZE = env.int("ATTACK_PATHS_BATCH_SIZE", 1000)
+# Re-export provider config objects so existing imports keep working.
+AWS_CONFIG = _provider_config.AWS_CONFIG
+NormalizedList = _provider_config.NormalizedList
+PROVIDER_CONFIGS = _provider_config.PROVIDER_CONFIGS
+ProviderConfig = _provider_config.ProviderConfig
+
+# Batch size for graph mutation operations (resource labeling and subgraph deletion)
+GRAPH_MUTATION_BATCH_SIZE = env.int("ATTACK_PATHS_GRAPH_MUTATION_BATCH_SIZE", 1000)
# Batch size for Postgres findings fetch (keyset pagination page size)
FINDINGS_BATCH_SIZE = env.int("ATTACK_PATHS_FINDINGS_BATCH_SIZE", 1000)
-# Batch size for temp-to-tenant graph sync (nodes and relationships per cursor page)
-SYNC_BATCH_SIZE = env.int("ATTACK_PATHS_SYNC_BATCH_SIZE", 1000)
-
# Neo4j internal labels (Prowler-specific, not provider-specific)
# - `Internet`: Singleton node representing external internet access for exposed-resource queries
# - `ProwlerFinding`: Label for finding nodes created by Prowler and linked to cloud resources
@@ -21,42 +23,12 @@ PROWLER_FINDING_LABEL = "ProwlerFinding"
PROVIDER_RESOURCE_LABEL = "_ProviderResource"
# Dynamic isolation labels that contain entity UUIDs and are added to every synced node during sync
-# Format: _Tenant_{uuid_no_hyphens}, _Provider_{uuid_no_hyphens}
+# Format: `_Tenant_{uuid_no_hyphens}`, `_Provider_{uuid_no_hyphens}`
TENANT_LABEL_PREFIX = "_Tenant_"
PROVIDER_LABEL_PREFIX = "_Provider_"
DYNAMIC_ISOLATION_PREFIXES = [TENANT_LABEL_PREFIX, PROVIDER_LABEL_PREFIX]
-@dataclass(frozen=True)
-class ProviderConfig:
- """Configuration for a cloud provider's Attack Paths integration."""
-
- name: str
- root_node_label: str # e.g., "AWSAccount"
- uid_field: str # e.g., "arn"
- # Label for resources connected to the account node, enabling indexed finding lookups.
- resource_label: str # e.g., "_AWSResource"
- ingestion_function: Callable
- # Maps a Postgres resource UID (e.g. full ARN) to the short-id form Cartography stores on some node types (e.g. `i-xxx` for EC2Instance).
- short_uid_extractor: Callable[[str], str]
-
-
-# Provider Configurations
-# -----------------------
-
-AWS_CONFIG = ProviderConfig(
- name="aws",
- root_node_label="AWSAccount",
- uid_field="arn",
- resource_label="_AWSResource",
- ingestion_function=aws.start_aws_ingestion,
- short_uid_extractor=aws.extract_short_uid,
-)
-
-PROVIDER_CONFIGS: dict[str, ProviderConfig] = {
- "aws": AWS_CONFIG,
-}
-
# Labels added by Prowler that should be filtered from API responses
# Derived from provider configs + common internal labels
INTERNAL_LABELS: list[str] = [
@@ -87,7 +59,6 @@ INTERNAL_PROPERTIES: list[str] = [
# Provider Config Accessors
-# -------------------------
def is_provider_available(provider_type: str) -> bool:
@@ -135,7 +106,6 @@ def get_short_uid_extractor(provider_type: str) -> Callable[[str], str]:
# Dynamic Isolation Label Helpers
-# --------------------------------
def _normalize_uuid(value: str | UUID) -> str:
diff --git a/api/src/backend/tasks/jobs/attack_paths/db_utils.py b/api/src/backend/tasks/jobs/attack_paths/db_utils.py
index f1bb4edef4..327d4463e2 100644
--- a/api/src/backend/tasks/jobs/attack_paths/db_utils.py
+++ b/api/src/backend/tasks/jobs/attack_paths/db_utils.py
@@ -8,6 +8,8 @@ from api.models import Provider as ProwlerAPIProvider
from api.models import StateChoices
from cartography.config import Config as CartographyConfig
from celery.utils.log import get_task_logger
+from django.conf import settings
+from django.db.models import Case, IntegerField, Value, When
from tasks.jobs.attack_paths.config import is_provider_available
logger = get_task_logger(__name__)
@@ -29,13 +31,33 @@ def create_attack_paths_scan(
return None
with rls_transaction(tenant_id):
- # Inherit graph_data_ready from the previous scan for this provider,
- # so queries remain available while the new scan runs.
- previous_data_ready = ProwlerAPIAttackPathsScan.objects.filter(
- tenant_id=tenant_id,
- provider_id=provider_id,
- graph_data_ready=True,
- ).exists()
+ # Inherit metadata from the previous ready scan for this provider so
+ # queries remain available while the new scan runs. The new row only
+ # flips to the target sink after its own graph sync succeeds.
+ active_sink_backend = settings.ATTACK_PATHS_SINK_DATABASE
+ previous_ready = (
+ ProwlerAPIAttackPathsScan.objects.filter(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ graph_data_ready=True,
+ )
+ .annotate(
+ active_sink_rank=Case(
+ When(sink_backend=active_sink_backend, then=Value(0)),
+ default=Value(1),
+ output_field=IntegerField(),
+ )
+ )
+ .order_by("active_sink_rank", "-inserted_at")
+ .first()
+ )
+ previous_data_ready = previous_ready is not None
+ inherited_is_migrated = previous_ready.is_migrated if previous_ready else False
+ inherited_sink_backend = (
+ previous_ready.sink_backend
+ if previous_ready
+ else ProwlerAPIAttackPathsScan.SinkBackendChoices.NEO4J
+ )
attack_paths_scan = ProwlerAPIAttackPathsScan.objects.create(
tenant_id=tenant_id,
@@ -44,6 +66,8 @@ def create_attack_paths_scan(
state=StateChoices.SCHEDULED,
started_at=datetime.now(tz=UTC),
graph_data_ready=previous_data_ready,
+ is_migrated=inherited_is_migrated,
+ sink_backend=inherited_sink_backend,
)
attack_paths_scan.save()
@@ -102,19 +126,22 @@ def starting_attack_paths_scan(
if locked.state != StateChoices.SCHEDULED:
return False
+ now = datetime.now(tz=UTC)
locked.state = StateChoices.EXECUTING
- locked.started_at = datetime.now(tz=UTC)
+ locked.started_at = now
+ locked.updated_at = now
locked.update_tag = cartography_config.update_tag
- locked.save(update_fields=["state", "started_at", "update_tag"])
+ locked.save(update_fields=["state", "started_at", "updated_at", "update_tag"])
# Keep the in-memory object the caller is holding in sync.
attack_paths_scan.state = locked.state
attack_paths_scan.started_at = locked.started_at
+ attack_paths_scan.updated_at = locked.updated_at
attack_paths_scan.update_tag = locked.update_tag
return True
-def _mark_scan_finished(
+def mark_scan_finished(
attack_paths_scan: ProwlerAPIAttackPathsScan,
state: StateChoices,
ingestion_exceptions: dict[str, Any],
@@ -148,7 +175,7 @@ def finish_attack_paths_scan(
ingestion_exceptions: dict[str, Any],
) -> None:
with rls_transaction(attack_paths_scan.tenant_id):
- _mark_scan_finished(attack_paths_scan, state, ingestion_exceptions)
+ mark_scan_finished(attack_paths_scan, state, ingestion_exceptions)
def update_attack_paths_scan_progress(
@@ -157,7 +184,8 @@ def update_attack_paths_scan_progress(
) -> None:
with rls_transaction(attack_paths_scan.tenant_id):
attack_paths_scan.progress = progress
- attack_paths_scan.save(update_fields=["progress"])
+ attack_paths_scan.updated_at = datetime.now(tz=UTC)
+ attack_paths_scan.save(update_fields=["progress", "updated_at"])
def set_graph_data_ready(
@@ -169,19 +197,45 @@ def set_graph_data_ready(
attack_paths_scan.save(update_fields=["graph_data_ready"])
+def set_scan_migrated(
+ attack_paths_scan: ProwlerAPIAttackPathsScan,
+ migrated: bool,
+ sink_backend: str | None = None,
+) -> None:
+ """Mark the scan as written with the current (migrated) schema.
+
+ Called after a successful sync so the read catalog and sink backend only
+ switch once the new graph is actually live.
+
+ # TODO: drop after Neptune cutover
+ """
+ with rls_transaction(attack_paths_scan.tenant_id):
+ attack_paths_scan.is_migrated = migrated
+ update_fields = ["is_migrated"]
+ if sink_backend is not None:
+ attack_paths_scan.sink_backend = sink_backend
+ update_fields.append("sink_backend")
+ attack_paths_scan.save(update_fields=update_fields)
+
+
def set_provider_graph_data_ready(
attack_paths_scan: ProwlerAPIAttackPathsScan,
ready: bool,
+ sink_backend: str | None = None,
) -> None:
"""
- Set `graph_data_ready` for ALL scans of the same provider.
+ Set `graph_data_ready` for scans of the same provider in one sink.
- Used before drop/sync so that older scan IDs cannot bypass the query gate while the graph is being replaced.
+ Used before drop/sync so that older scan IDs in the target sink cannot
+ bypass the query gate while that sink's graph is being replaced. Scans
+ preserved in another sink stay queryable for rollback.
"""
+ target_sink_backend = sink_backend or attack_paths_scan.sink_backend
with rls_transaction(attack_paths_scan.tenant_id):
ProwlerAPIAttackPathsScan.objects.filter(
tenant_id=attack_paths_scan.tenant_id,
provider_id=attack_paths_scan.provider_id,
+ sink_backend=target_sink_backend,
).update(graph_data_ready=ready)
attack_paths_scan.refresh_from_db(fields=["graph_data_ready"])
@@ -202,10 +256,15 @@ def recover_graph_data_ready(
next successful scan) is a worse outcome for the user.
"""
try:
+ from api.attack_paths import sink as sink_module
+
tenant_db = graph_database.get_database_name(attack_paths_scan.tenant_id)
- if graph_database.has_provider_data(
- tenant_db, str(attack_paths_scan.provider_id)
- ):
+ # TODO: drop after Neptune cutover
+ # Check the backend that actually holds this scan's data, not the
+ # currently configured sink, a stale `EXECUTING` scan from before a
+ # backend switch must still be recoverable
+ backend = sink_module.get_backend_for_scan(attack_paths_scan)
+ if backend.has_provider_data(tenant_db, str(attack_paths_scan.provider_id)):
set_provider_graph_data_ready(attack_paths_scan, True)
logger.info(
f"Recovered `graph_data_ready` for provider {attack_paths_scan.provider_id}"
@@ -247,6 +306,6 @@ def fail_attack_paths_scan(
return
if fresh.state in (StateChoices.COMPLETED, StateChoices.FAILED):
return
- _mark_scan_finished(fresh, StateChoices.FAILED, {"global_error": error})
+ mark_scan_finished(fresh, StateChoices.FAILED, {"global_error": error})
recover_graph_data_ready(fresh)
diff --git a/api/src/backend/tasks/jobs/attack_paths/findings.py b/api/src/backend/tasks/jobs/attack_paths/findings.py
index a5bc4c1ad5..c47c9f1149 100644
--- a/api/src/backend/tasks/jobs/attack_paths/findings.py
+++ b/api/src/backend/tasks/jobs/attack_paths/findings.py
@@ -21,8 +21,8 @@ from cartography.config import Config as CartographyConfig
from celery.utils.log import get_task_logger
from prowler.config import config as ProwlerConfig
from tasks.jobs.attack_paths.config import (
- BATCH_SIZE,
FINDINGS_BATCH_SIZE,
+ GRAPH_MUTATION_BATCH_SIZE,
get_node_uid_field,
get_provider_resource_label,
get_root_node_label,
@@ -82,7 +82,6 @@ def _to_neo4j_dict(
# Public API
-# ----------
def analysis(
@@ -136,7 +135,7 @@ def add_resource_label(
while labeled_count > 0:
result = neo4j_session.run(
query,
- {"provider_uid": provider_uid, "batch_size": BATCH_SIZE},
+ {"provider_uid": provider_uid, "batch_size": GRAPH_MUTATION_BATCH_SIZE},
)
labeled_count = result.single().get("labeled_count", 0)
total_labeled += labeled_count
@@ -196,7 +195,6 @@ def load_findings(
# Findings Streaming (Generator-based)
-# -------------------------------------
def stream_findings_with_resources(
@@ -275,7 +273,6 @@ def _fetch_findings_batch(
# Batch Enrichment
-# -----------------
def _enrich_batch_with_resources(
diff --git a/api/src/backend/tasks/jobs/attack_paths/indexes.py b/api/src/backend/tasks/jobs/attack_paths/indexes.py
index c2b56197d4..50e8a12bcd 100644
--- a/api/src/backend/tasks/jobs/attack_paths/indexes.py
+++ b/api/src/backend/tasks/jobs/attack_paths/indexes.py
@@ -1,5 +1,6 @@
import neo4j
from cartography.client.core.tx import run_write_query
+from cartography.intel import create_indexes as cartography_create_indexes
from celery.utils.log import get_task_logger
from tasks.jobs.attack_paths.config import (
INTERNET_NODE_LABEL,
@@ -30,14 +31,34 @@ SYNC_INDEX_STATEMENTS = [
def create_findings_indexes(neo4j_session: neo4j.Session) -> None:
- """Create indexes for Prowler findings and resource lookups."""
+ """Create indexes for Prowler findings and resource lookups.
+
+ Runs `CREATE INDEX`, so the caller must only invoke this against a Neo4j
+ session (the temp ingest DB or a Neo4j sink). Neptune auto-manages indexes
+ and rejects `CREATE INDEX`, so callers skip it for the Neptune sink.
+ """
logger.info("Creating indexes for Prowler Findings node types")
for statement in FINDINGS_INDEX_STATEMENTS:
run_write_query(neo4j_session, statement)
+def create_cartography_indexes(neo4j_session: neo4j.Session, config) -> None:
+ """Create Cartography's standard indexes for the session's database.
+
+ Runs `CREATE INDEX`, so the caller must only invoke this against a Neo4j
+ session (the temp ingest DB or a Neo4j sink). Neptune auto-manages indexes
+ and rejects `CREATE INDEX`, so callers skip it for the Neptune sink.
+ """
+ cartography_create_indexes.run(neo4j_session, config)
+
+
def create_sync_indexes(neo4j_session: neo4j.Session) -> None:
- """Create indexes for provider resource sync operations."""
+ """Create indexes for provider resource sync operations.
+
+ Runs `CREATE INDEX`, so the caller must only invoke this against a Neo4j
+ session (the temp ingest DB or a Neo4j sink). Neptune auto-manages indexes
+ and rejects `CREATE INDEX`, so callers skip it for the Neptune sink.
+ """
logger.info("Ensuring ProviderResource indexes exist")
for statement in SYNC_INDEX_STATEMENTS:
neo4j_session.run(statement)
diff --git a/api/src/backend/tasks/jobs/attack_paths/provider_config.py b/api/src/backend/tasks/jobs/attack_paths/provider_config.py
new file mode 100644
index 0000000000..7d834e6aff
--- /dev/null
+++ b/api/src/backend/tasks/jobs/attack_paths/provider_config.py
@@ -0,0 +1,431 @@
+"""
+Provider-level Attack Paths configuration.
+
+Each `ProviderConfig` carries the cloud provider's ingestion entry point and
+the catalog of list-typed node properties (`normalized_lists`). The sync
+layer reads this catalog and materialises each list element as a child node
+connected to the parent by a typed edge, so queries traverse the graph
+instead of working on serialised list values. Both Neo4j and Neptune sinks
+write the same shape and queries are portable across them.
+"""
+
+from collections.abc import Callable
+from dataclasses import dataclass, field
+
+from tasks.jobs.attack_paths import aws
+
+
+@dataclass(frozen=True)
+class NormalizedList:
+ """Catalog entry for a list-typed node property.
+
+ Describes how the sync layer materialises a parent node's list-typed
+ property as a set of child item nodes connected by a typed edge.
+
+ Conventions (mechanical, do not invent):
+ - `child_label`: `Item`
+ e.g. AWSPolicyStatement.resource -> AWSPolicyStatementResourceItem
+ - `rel_type`: `HAS_`
+ e.g. resource -> HAS_RESOURCE
+ - child node property:
+ * `field_map = []` (scalar list, ~95% case) -> child stores `value: str`
+ * `field_map = [(src_key, child_field), ...]` (list of dicts, rare)
+ -> child stores those fields
+ """
+
+ source_label: str
+ source_property: str
+ child_label: str
+ rel_type: str
+ field_map: list[tuple[str, str]] = field(default_factory=list)
+
+ def __post_init__(self) -> None:
+ if self.field_map:
+ child_fields = [dst for _, dst in self.field_map]
+ if "value" in child_fields:
+ raise ValueError(
+ f"NormalizedList {self.source_label}.{self.source_property}: "
+ "`value` is reserved for scalar mode; do not map a source key to it"
+ )
+ src_keys = [src for src, _ in self.field_map]
+ if len(set(src_keys)) != len(src_keys):
+ raise ValueError(
+ f"NormalizedList {self.source_label}.{self.source_property}: "
+ "duplicate source key in field_map"
+ )
+ if len(set(child_fields)) != len(child_fields):
+ raise ValueError(
+ f"NormalizedList {self.source_label}.{self.source_property}: "
+ "duplicate child field in field_map"
+ )
+
+
+@dataclass(frozen=True)
+class ProviderConfig:
+ """Configuration for a cloud provider's Attack Paths integration."""
+
+ name: str
+ root_node_label: str # e.g., "AWSAccount"
+ uid_field: str # e.g., "arn"
+ # Label for resources connected to the account node, enabling indexed finding lookups
+ resource_label: str # e.g., "_AWSResource"
+ ingestion_function: Callable
+ # Maps a Postgres resource UID (e.g. full ARN) to the short-id form Cartography stores on some node types (e.g. `i-xxx` for EC2Instance)
+ short_uid_extractor: Callable[[str], str]
+ # List-typed properties to materialise as child nodes + edges at sync time.
+ # Mandatory (may be []). Without an entry here, a list-typed property falls
+ # back to comma-string flatten and emits a one-time warning.
+ normalized_lists: list[NormalizedList]
+
+
+# AWS list-typed property catalog.
+# One entry per Cartography node property whose runtime value is a list. The
+# sync layer materialises each element as a `` node and links it
+# to the parent with a `` edge; see the `NormalizedList` docstring
+# above for the naming conventions.
+AWS_NORMALIZED_LISTS: list[NormalizedList] = [
+ # AWSPolicyStatement - the hot path driving the 53-query perf fix.
+ NormalizedList(
+ "AWSPolicyStatement", "action", "AWSPolicyStatementActionItem", "HAS_ACTION"
+ ),
+ NormalizedList(
+ "AWSPolicyStatement",
+ "notaction",
+ "AWSPolicyStatementNotactionItem",
+ "HAS_NOTACTION",
+ ),
+ NormalizedList(
+ "AWSPolicyStatement",
+ "resource",
+ "AWSPolicyStatementResourceItem",
+ "HAS_RESOURCE",
+ ),
+ NormalizedList(
+ "AWSPolicyStatement",
+ "notresource",
+ "AWSPolicyStatementNotresourceItem",
+ "HAS_NOTRESOURCE",
+ ),
+ # S3PolicyStatement - same shape as IAM policies; AWS allows list or string.
+ NormalizedList(
+ "S3PolicyStatement", "action", "S3PolicyStatementActionItem", "HAS_ACTION"
+ ),
+ NormalizedList(
+ "S3PolicyStatement", "resource", "S3PolicyStatementResourceItem", "HAS_RESOURCE"
+ ),
+ # IAM / Cognito / KMS / Secrets
+ NormalizedList(
+ "CognitoIdentityPool", "roles", "CognitoIdentityPoolRolesItem", "HAS_ROLES"
+ ),
+ NormalizedList(
+ "KMSKey",
+ "encryption_algorithms",
+ "KMSKeyEncryptionAlgorithmsItem",
+ "HAS_ENCRYPTION_ALGORITHMS",
+ ),
+ NormalizedList(
+ "KMSKey",
+ "signing_algorithms",
+ "KMSKeySigningAlgorithmsItem",
+ "HAS_SIGNING_ALGORITHMS",
+ ),
+ NormalizedList(
+ "KMSKey",
+ "anonymous_actions",
+ "KMSKeyAnonymousActionsItem",
+ "HAS_ANONYMOUS_ACTIONS",
+ ),
+ NormalizedList(
+ "KMSGrant", "operations", "KMSGrantOperationsItem", "HAS_OPERATIONS"
+ ),
+ NormalizedList(
+ "SecretsManagerSecretVersion",
+ "version_stages",
+ "SecretsManagerSecretVersionVersionStagesItem",
+ "HAS_VERSION_STAGES",
+ ),
+ NormalizedList(
+ "SecretsManagerSecretVersion",
+ "kms_key_ids",
+ "SecretsManagerSecretVersionKmsKeyIdsItem",
+ "HAS_KMS_KEY_IDS",
+ ),
+ NormalizedList(
+ "SecretsManagerSecretVersion",
+ "tags",
+ "SecretsManagerSecretVersionTagsItem",
+ "HAS_TAGS",
+ field_map=[("Key", "key"), ("Value", "value_")],
+ # `value` is reserved for scalar mode; map `Value` to `value_` to keep dict shape.
+ ),
+ # Lambda / Compute
+ NormalizedList(
+ "AWSLambda", "architectures", "AWSLambdaArchitecturesItem", "HAS_ARCHITECTURES"
+ ),
+ NormalizedList(
+ "AWSLambda",
+ "anonymous_actions",
+ "AWSLambdaAnonymousActionsItem",
+ "HAS_ANONYMOUS_ACTIONS",
+ ),
+ NormalizedList(
+ "CodeBuildProject",
+ "environment_variables",
+ "CodeBuildProjectEnvironmentVariablesItem",
+ "HAS_ENVIRONMENT_VARIABLES",
+ ),
+ # ECS family
+ NormalizedList(
+ "ECSCluster",
+ "capacity_providers",
+ "ECSClusterCapacityProvidersItem",
+ "HAS_CAPACITY_PROVIDERS",
+ ),
+ NormalizedList(
+ "ECSTaskDefinition",
+ "compatibilities",
+ "ECSTaskDefinitionCompatibilitiesItem",
+ "HAS_COMPATIBILITIES",
+ ),
+ NormalizedList(
+ "ECSTaskDefinition",
+ "requires_compatibilities",
+ "ECSTaskDefinitionRequiresCompatibilitiesItem",
+ "HAS_REQUIRES_COMPATIBILITIES",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "links",
+ "ECSContainerDefinitionLinksItem",
+ "HAS_LINKS",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "entry_point",
+ "ECSContainerDefinitionEntryPointItem",
+ "HAS_ENTRY_POINT",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "command",
+ "ECSContainerDefinitionCommandItem",
+ "HAS_COMMAND",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "dns_servers",
+ "ECSContainerDefinitionDnsServersItem",
+ "HAS_DNS_SERVERS",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "dns_search_domains",
+ "ECSContainerDefinitionDnsSearchDomainsItem",
+ "HAS_DNS_SEARCH_DOMAINS",
+ ),
+ NormalizedList(
+ "ECSContainerDefinition",
+ "docker_security_options",
+ "ECSContainerDefinitionDockerSecurityOptionsItem",
+ "HAS_DOCKER_SECURITY_OPTIONS",
+ ),
+ NormalizedList("ECSContainer", "gpu_ids", "ECSContainerGpuIdsItem", "HAS_GPU_IDS"),
+ # ECR
+ NormalizedList(
+ "ECRImage", "layer_diff_ids", "ECRImageLayerDiffIdsItem", "HAS_LAYER_DIFF_IDS"
+ ),
+ NormalizedList(
+ "ECRImage",
+ "child_image_digests",
+ "ECRImageChildImageDigestsItem",
+ "HAS_CHILD_IMAGE_DIGESTS",
+ ),
+ # EC2 / Networking
+ NormalizedList(
+ "EC2Instance",
+ "exposed_internet_type",
+ "EC2InstanceExposedInternetTypeItem",
+ "HAS_EXPOSED_INTERNET_TYPE",
+ ),
+ NormalizedList(
+ "AutoScalingGroup",
+ "exposed_internet_type",
+ "AutoScalingGroupExposedInternetTypeItem",
+ "HAS_EXPOSED_INTERNET_TYPE",
+ ),
+ NormalizedList(
+ "LaunchConfiguration",
+ "security_groups",
+ "LaunchConfigurationSecurityGroupsItem",
+ "HAS_SECURITY_GROUPS",
+ ),
+ NormalizedList(
+ "LaunchTemplateVersion",
+ "security_group_ids",
+ "LaunchTemplateVersionSecurityGroupIdsItem",
+ "HAS_SECURITY_GROUP_IDS",
+ ),
+ NormalizedList(
+ "LaunchTemplateVersion",
+ "security_groups",
+ "LaunchTemplateVersionSecurityGroupsItem",
+ "HAS_SECURITY_GROUPS",
+ ),
+ NormalizedList(
+ "AWSVpcEndpoint",
+ "route_table_ids",
+ "AWSVpcEndpointRouteTableIdsItem",
+ "HAS_ROUTE_TABLE_IDS",
+ ),
+ NormalizedList(
+ "AWSVpcEndpoint",
+ "network_interface_ids",
+ "AWSVpcEndpointNetworkInterfaceIdsItem",
+ "HAS_NETWORK_INTERFACE_IDS",
+ ),
+ NormalizedList(
+ "AWSVpcEndpoint",
+ "subnet_ids",
+ "AWSVpcEndpointSubnetIdsItem",
+ "HAS_SUBNET_IDS",
+ ),
+ NormalizedList(
+ "ELBListener", "policy_names", "ELBListenerPolicyNamesItem", "HAS_POLICY_NAMES"
+ ),
+ # CloudFront / Route53 / CloudWatch / CloudTrail
+ NormalizedList(
+ "CloudFrontDistribution",
+ "aliases",
+ "CloudFrontDistributionAliasesItem",
+ "HAS_ALIASES",
+ ),
+ NormalizedList(
+ "CloudFrontDistribution",
+ "geo_restriction_locations",
+ "CloudFrontDistributionGeoRestrictionLocationsItem",
+ "HAS_GEO_RESTRICTION_LOCATIONS",
+ ),
+ NormalizedList(
+ "CloudWatchLogGroup",
+ "inherited_properties",
+ "CloudWatchLogGroupInheritedPropertiesItem",
+ "HAS_INHERITED_PROPERTIES",
+ ),
+ # RDS / Storage
+ NormalizedList(
+ "RDSCluster",
+ "availability_zones",
+ "RDSClusterAvailabilityZonesItem",
+ "HAS_AVAILABILITY_ZONES",
+ ),
+ NormalizedList(
+ "RDSEventSubscription",
+ "event_categories",
+ "RDSEventSubscriptionEventCategoriesItem",
+ "HAS_EVENT_CATEGORIES",
+ ),
+ NormalizedList(
+ "RDSEventSubscription",
+ "source_ids",
+ "RDSEventSubscriptionSourceIdsItem",
+ "HAS_SOURCE_IDS",
+ ),
+ NormalizedList(
+ "S3Bucket",
+ "anonymous_actions",
+ "S3BucketAnonymousActionsItem",
+ "HAS_ANONYMOUS_ACTIONS",
+ ),
+ # Inspector / Config / SSM / ACM / APIGateway / Glue / SageMaker / Bedrock
+ NormalizedList(
+ "AWSInspectorFinding",
+ "referenceurls",
+ "AWSInspectorFindingReferenceurlsItem",
+ "HAS_REFERENCEURLS",
+ ),
+ NormalizedList(
+ "AWSInspectorFinding",
+ "relatedvulnerabilities",
+ "AWSInspectorFindingRelatedvulnerabilitiesItem",
+ "HAS_RELATEDVULNERABILITIES",
+ ),
+ NormalizedList(
+ "AWSInspectorFinding",
+ "vulnerablepackageids",
+ "AWSInspectorFindingVulnerablepackageidsItem",
+ "HAS_VULNERABLEPACKAGEIDS",
+ ),
+ NormalizedList(
+ "AWSConfigurationRecorder",
+ "recording_group_resource_types",
+ "AWSConfigurationRecorderRecordingGroupResourceTypesItem",
+ "HAS_RECORDING_GROUP_RESOURCE_TYPES",
+ ),
+ NormalizedList(
+ "AWSConfigRule",
+ "scope_compliance_resource_types",
+ "AWSConfigRuleScopeComplianceResourceTypesItem",
+ "HAS_SCOPE_COMPLIANCE_RESOURCE_TYPES",
+ ),
+ NormalizedList(
+ "AWSConfigRule",
+ "source_details",
+ "AWSConfigRuleSourceDetailsItem",
+ "HAS_SOURCE_DETAILS",
+ ),
+ NormalizedList(
+ "SSMInstancePatch", "cve_ids", "SSMInstancePatchCveIdsItem", "HAS_CVE_IDS"
+ ),
+ NormalizedList(
+ "ACMCertificate", "in_use_by", "ACMCertificateInUseByItem", "HAS_IN_USE_BY"
+ ),
+ NormalizedList(
+ "APIGatewayRestAPI",
+ "anonymous_actions",
+ "APIGatewayRestAPIAnonymousActionsItem",
+ "HAS_ANONYMOUS_ACTIONS",
+ ),
+ NormalizedList(
+ "GlueJob", "connections", "GlueJobConnectionsItem", "HAS_CONNECTIONS"
+ ),
+ NormalizedList(
+ "AWSBedrockFoundationModel",
+ "input_modalities",
+ "AWSBedrockFoundationModelInputModalitiesItem",
+ "HAS_INPUT_MODALITIES",
+ ),
+ NormalizedList(
+ "AWSBedrockFoundationModel",
+ "output_modalities",
+ "AWSBedrockFoundationModelOutputModalitiesItem",
+ "HAS_OUTPUT_MODALITIES",
+ ),
+ NormalizedList(
+ "AWSBedrockFoundationModel",
+ "customizations_supported",
+ "AWSBedrockFoundationModelCustomizationsSupportedItem",
+ "HAS_CUSTOMIZATIONS_SUPPORTED",
+ ),
+ NormalizedList(
+ "AWSBedrockFoundationModel",
+ "inference_types_supported",
+ "AWSBedrockFoundationModelInferenceTypesSupportedItem",
+ "HAS_INFERENCE_TYPES_SUPPORTED",
+ ),
+]
+
+
+AWS_CONFIG = ProviderConfig(
+ name="aws",
+ root_node_label="AWSAccount",
+ uid_field="arn",
+ resource_label="_AWSResource",
+ ingestion_function=aws.start_aws_ingestion,
+ short_uid_extractor=aws.extract_short_uid,
+ normalized_lists=AWS_NORMALIZED_LISTS,
+)
+
+
+PROVIDER_CONFIGS: dict[str, ProviderConfig] = {
+ "aws": AWS_CONFIG,
+}
diff --git a/api/src/backend/tasks/jobs/attack_paths/queries.py b/api/src/backend/tasks/jobs/attack_paths/queries.py
index 277305f0e0..1166de17ed 100644
--- a/api/src/backend/tasks/jobs/attack_paths/queries.py
+++ b/api/src/backend/tasks/jobs/attack_paths/queries.py
@@ -1,8 +1,6 @@
# Cypher query templates for Attack Paths operations
from tasks.jobs.attack_paths.config import (
INTERNET_NODE_LABEL,
- PROVIDER_ELEMENT_ID_PROPERTY,
- PROVIDER_RESOURCE_LABEL,
PROWLER_FINDING_LABEL,
)
@@ -21,7 +19,6 @@ def render_cypher_template(template: str, replacements: dict[str, str]) -> str:
# Findings queries (used by findings.py)
-# ---------------------------------------
ADD_RESOURCE_LABEL_TEMPLATE = """
MATCH (account:__ROOT_LABEL__ {id: $provider_uid})-->(r)
@@ -88,7 +85,6 @@ INSERT_FINDING_TEMPLATE = f"""
"""
# Internet queries (used by internet.py)
-# ---------------------------------------
CREATE_INTERNET_NODE = f"""
MERGE (internet:{INTERNET_NODE_LABEL} {{id: 'Internet'}})
@@ -118,8 +114,8 @@ CREATE_CAN_ACCESS_RELATIONSHIPS_TEMPLATE = f"""
RETURN COUNT(r) AS relationships_merged
"""
-# Sync queries (used by sync.py)
-# -------------------------------
+# Sync queries (used by sync.py to fetch from the cartography temp Neo4j DB)
+# The write side of sync lives in each sink (`api/attack_paths/sink/`).
NODE_FETCH_QUERY = """
MATCH (n)
@@ -143,17 +139,3 @@ RELATIONSHIPS_FETCH_QUERY = """
ORDER BY internal_id
LIMIT $batch_size
"""
-
-NODE_SYNC_TEMPLATE = f"""
- UNWIND $rows AS row
- MERGE (n:__NODE_LABELS__ {{{PROVIDER_ELEMENT_ID_PROPERTY}: row.provider_element_id}})
- SET n += row.props
-"""
-
-RELATIONSHIP_SYNC_TEMPLATE = f"""
- UNWIND $rows AS row
- MATCH (s:{PROVIDER_RESOURCE_LABEL} {{{PROVIDER_ELEMENT_ID_PROPERTY}: row.start_element_id}})
- MATCH (t:{PROVIDER_RESOURCE_LABEL} {{{PROVIDER_ELEMENT_ID_PROPERTY}: row.end_element_id}})
- MERGE (s)-[r:__REL_TYPE__ {{{PROVIDER_ELEMENT_ID_PROPERTY}: row.provider_element_id}}]->(t)
- SET r += row.props
-"""
diff --git a/api/src/backend/tasks/jobs/attack_paths/scan.py b/api/src/backend/tasks/jobs/attack_paths/scan.py
index 0fb8d2b885..e161c9eb8d 100644
--- a/api/src/backend/tasks/jobs/attack_paths/scan.py
+++ b/api/src/backend/tasks/jobs/attack_paths/scan.py
@@ -39,8 +39,8 @@ Pipeline steps:
7. Sync the temp database into the tenant database:
- Drop the old provider subgraph (matched by dynamic _Provider_{uuid} label).
- graph_data_ready is set to False for all scans of this provider while
- the swap happens so the API doesn't serve partial data.
+ graph_data_ready is set to False for scans of this provider in the
+ target sink while the swap happens so the API doesn't serve partial data.
- Copy nodes and relationships in batches. Every synced node gets a
_ProviderResource label and dynamic _Tenant_{uuid} / _Provider_{uuid}
isolation labels, plus a _provider_element_id property for MERGE keys.
@@ -64,10 +64,17 @@ from api.models import StateChoices
from api.utils import initialize_prowler_provider
from cartography.config import Config as CartographyConfig
from cartography.intel import analysis as cartography_analysis
-from cartography.intel import create_indexes as cartography_create_indexes
from cartography.intel import ontology as cartography_ontology
from celery.utils.log import get_task_logger
-from tasks.jobs.attack_paths import db_utils, findings, indexes, internet, sync, utils
+from django.conf import settings
+from tasks.jobs.attack_paths import (
+ db_utils,
+ findings,
+ indexes,
+ internet,
+ sync,
+ utils,
+)
from tasks.jobs.attack_paths.config import get_cartography_ingestion_function
# Without this Celery goes crazy with Cartography logging
@@ -96,7 +103,7 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
attack_paths_scan = db_utils.retrieve_attack_paths_scan(tenant_id, scan_id)
# Idempotency guard: cleanup may have flipped this row to a terminal state
- # while the message was still in flight. Bail out before touching state.
+ # while the message was still in flight. Bail out before touching state
if attack_paths_scan and attack_paths_scan.state in (
StateChoices.FAILED,
StateChoices.COMPLETED,
@@ -125,7 +132,7 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
else:
if not attack_paths_scan:
- # Safety net for in-flight messages or direct task invocations; dispatcher normally pre-creates the row.
+ # Safety net for in-flight messages or direct task invocations; dispatcher normally pre-creates the row
logger.warning(
f"No Attack Paths Scan found for scan {scan_id} and tenant {tenant_id}, let's create it then"
)
@@ -143,10 +150,18 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
tenant_database_name = graph_database.get_database_name(
prowler_api_provider.tenant_id
)
+ target_sink_backend = settings.ATTACK_PATHS_SINK_DATABASE
+ target_description = (
+ f"tenant Neo4j database {tenant_database_name}"
+ if target_sink_backend == "neo4j"
+ else f"{target_sink_backend} sink"
+ )
# While creating the Cartography configuration, attributes `neo4j_user` and `neo4j_password` are not really needed in this config object
tmp_cartography_config = CartographyConfig(
- neo4j_uri=graph_database.get_uri(),
+ # The temp ingest database is always Neo4j, so use the ingest URI here
+ # rather than the sink URI (which points at Neptune when configured).
+ neo4j_uri=graph_database.get_ingest_uri(),
neo4j_database=tmp_database_name,
update_tag=int(time.time()),
)
@@ -156,6 +171,8 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
update_tag=tmp_cartography_config.update_tag,
)
+ graph_database.verify_scan_databases_available()
+
# Starting the Attack Paths scan
if not db_utils.starting_attack_paths_scan(
attack_paths_scan, tenant_cartography_config
@@ -168,7 +185,8 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
scan_t0 = time.perf_counter()
logger.info(
f"Starting Attack Paths scan ({attack_paths_scan.id}) for "
- f"{prowler_api_provider.provider.upper()} provider {prowler_api_provider.id}"
+ f"{prowler_api_provider.provider.upper()} provider {prowler_api_provider.id} "
+ f"(staging=Neo4j database {tmp_database_name}, target={target_description})"
)
subgraph_dropped = False
@@ -177,7 +195,8 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
try:
logger.info(
- f"Creating Neo4j database {tmp_cartography_config.neo4j_database} for tenant {prowler_api_provider.tenant_id}"
+ f"Creating staging Neo4j database {tmp_cartography_config.neo4j_database} "
+ f"for tenant {prowler_api_provider.tenant_id}"
)
graph_database.create_database(tmp_cartography_config.neo4j_database)
@@ -191,7 +210,9 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
tmp_cartography_config.neo4j_database
) as tmp_neo4j_session:
# Indexes creation
- cartography_create_indexes.run(tmp_neo4j_session, tmp_cartography_config)
+ indexes.create_cartography_indexes(
+ tmp_neo4j_session, tmp_cartography_config
+ )
indexes.create_findings_indexes(tmp_neo4j_session)
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 2)
@@ -223,7 +244,7 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
cartography_analysis.run(tmp_neo4j_session, tmp_cartography_config)
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 95)
- # Creating Internet node and CAN_ACCESS relationships
+ # Creating Internet node and `CAN_ACCESS` relationships
logger.info(
f"Creating Internet graph for AWS account {prowler_api_provider.uid}"
)
@@ -247,23 +268,41 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 97)
logger.info(
- f"Clearing Neo4j cache for database {tmp_cartography_config.neo4j_database}"
+ f"Clearing Neo4j cache for staging database {tmp_cartography_config.neo4j_database}"
)
graph_database.clear_cache(tmp_cartography_config.neo4j_database)
+ t0 = time.perf_counter()
logger.info(
- f"Ensuring tenant database {tenant_database_name}, and its indexes, exists for tenant {prowler_api_provider.tenant_id}"
+ f"Preparing target {target_description} for tenant {prowler_api_provider.tenant_id}"
)
graph_database.create_database(tenant_database_name)
- with graph_database.get_session(tenant_database_name) as tenant_neo4j_session:
- cartography_create_indexes.run(
- tenant_neo4j_session, tenant_cartography_config
- )
- indexes.create_findings_indexes(tenant_neo4j_session)
- indexes.create_sync_indexes(tenant_neo4j_session)
+ # Sink-side index creation: Neptune auto-manages indexes and rejects
+ # `CREATE INDEX`, so only run it when the sink is Neo4j
+ # The temp ingest DB is always Neo4j and is always indexed above
+ if target_sink_backend != "neptune":
+ logger.info(f"Ensuring indexes exist for {target_description}")
+ with graph_database.get_session(
+ tenant_database_name
+ ) as tenant_neo4j_session:
+ indexes.create_cartography_indexes(
+ tenant_neo4j_session, tenant_cartography_config
+ )
+ indexes.create_findings_indexes(tenant_neo4j_session)
+ indexes.create_sync_indexes(tenant_neo4j_session)
+ else:
+ logger.info("Skipping tenant database indexes for neptune sink")
+ logger.info(
+ f"Prepared target {target_description} in {time.perf_counter() - t0:.3f}s"
+ )
- logger.info(f"Deleting existing provider graph in {tenant_database_name}")
- db_utils.set_provider_graph_data_ready(attack_paths_scan, False)
+ logger.info(
+ f"Deleting existing provider graph from {target_description} "
+ f"(tenant={prowler_api_provider.tenant_id}, provider={prowler_api_provider.id})"
+ )
+ db_utils.set_provider_graph_data_ready(
+ attack_paths_scan, False, target_sink_backend
+ )
provider_gated = True
t0 = time.perf_counter()
@@ -272,14 +311,17 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
provider_id=str(prowler_api_provider.id),
)
logger.info(
- f"Deleted existing provider graph in {time.perf_counter() - t0:.3f}s "
- f"(deleted_nodes={deleted_nodes})"
+ f"Deleted existing provider graph from {target_description} "
+ f"in {time.perf_counter() - t0:.3f}s (deleted_nodes={deleted_nodes})"
)
subgraph_dropped = True
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 98)
logger.info(
- f"Syncing graph from {tmp_database_name} into {tenant_database_name}"
+ f"Syncing staging graph {tmp_database_name} into {target_description} "
+ f"for provider {prowler_api_provider.id} "
+ f"(tenant {prowler_api_provider.tenant_id}, "
+ f"type {prowler_api_provider.provider})"
)
t0 = time.perf_counter()
sync_result = sync.sync_graph(
@@ -287,17 +329,34 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
target_database=tenant_database_name,
tenant_id=str(prowler_api_provider.tenant_id),
provider_id=str(prowler_api_provider.id),
+ provider_type=prowler_api_provider.provider,
)
+ elapsed = time.perf_counter() - t0
+ total_nodes = sync_result["nodes"] + sync_result["child_nodes"]
+ elements = total_nodes + sync_result["relationships"]
+ rate = elements / elapsed if elapsed else 0
logger.info(
- f"Synced graph in {time.perf_counter() - t0:.3f}s "
- f"(nodes={sync_result['nodes']}, relationships={sync_result['relationships']})"
+ f"Synced staging graph into {target_description} in {elapsed:.3f}s - "
+ f"nodes={total_nodes} (source={sync_result['nodes']}, "
+ f"items={sync_result['child_nodes']}), "
+ f"relationships={sync_result['relationships']} "
+ f"(structural={sync_result['structural_relationships']}, "
+ f"items={sync_result['item_relationships']}), "
+ f"~{rate:.0f} elem/s"
)
sync_completed = True
+ # Flip metadata only now: the new schema is live in the target sink, so
+ # reads can switch to the current catalog/backend. The target-sink gate
+ # is already closed, so the switch is atomic from the API's view.
+ db_utils.set_scan_migrated(attack_paths_scan, True, target_sink_backend)
db_utils.set_graph_data_ready(attack_paths_scan, True)
db_utils.update_attack_paths_scan_progress(attack_paths_scan, 99)
- logger.info(f"Clearing Neo4j cache for database {tenant_database_name}")
- graph_database.clear_cache(tenant_database_name)
+ if target_sink_backend == "neptune":
+ logger.info("Skipping cache clear for neptune sink")
+ else:
+ logger.info(f"Clearing Neo4j cache for target {target_description}")
+ graph_database.clear_cache(tenant_database_name)
logger.info(f"Dropping temporary Neo4j database {tmp_database_name}")
graph_database.drop_database(tmp_database_name)
@@ -313,32 +372,51 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
except Exception as e:
exception_message = utils.stringify_exception(e, "Attack Paths scan failed")
- logger.exception(exception_message)
+ temporary_database_missing = (
+ isinstance(e, graph_database.GraphDatabaseQueryException)
+ and e.code == graph_database.DATABASE_NOT_FOUND_CODE
+ and tmp_database_name in str(e)
+ )
+ if temporary_database_missing:
+ logger.warning(exception_message)
+ else:
+ logger.exception(exception_message)
+ cleanup_log_level = (
+ logging.WARNING if temporary_database_missing else logging.ERROR
+ )
+ cleanup_exc_info = not temporary_database_missing
ingestion_exceptions["global_error"] = exception_message
- # Recover graph_data_ready based on how far the swap got.
- # Partial drop (mid-batch failure) may leave `subgraph_dropped=False`
- # with data partially deleted, so we prefer that over permanently blocked queries.
+ # Recover `graph_data_ready` based on how far the swap got
+ # Partial drop (mid-batch failure) may leave `subgraph_dropped=False` with data partially deleted,
+ # so we prefer that over permanently blocked queries
try:
if sync_completed:
db_utils.set_graph_data_ready(attack_paths_scan, True)
elif provider_gated and not subgraph_dropped:
- db_utils.set_provider_graph_data_ready(attack_paths_scan, True)
+ db_utils.set_provider_graph_data_ready(
+ attack_paths_scan, True, target_sink_backend
+ )
except Exception:
- logger.error(
- f"Failed to recover `graph_data_ready` for provider {attack_paths_scan.provider_id}",
- exc_info=True,
+ logger.log(
+ cleanup_log_level,
+ "Failed to recover `graph_data_ready` for provider "
+ f"{attack_paths_scan.provider_id}",
+ exc_info=cleanup_exc_info,
)
# Dropping the temporary database if it still exists
try:
graph_database.drop_database(tmp_cartography_config.neo4j_database)
- except Exception as e:
- logger.error(
- f"Failed to drop temporary Neo4j database `{tmp_cartography_config.neo4j_database}` during cleanup: {e}",
- exc_info=True,
+ except Exception as cleanup_error:
+ logger.log(
+ cleanup_log_level,
+ "Failed to drop temporary Neo4j database "
+ f"`{tmp_cartography_config.neo4j_database}` during cleanup: "
+ f"{cleanup_error}",
+ exc_info=cleanup_exc_info,
)
# Set Attack Paths scan state to FAILED
@@ -346,10 +424,12 @@ def run(tenant_id: str, scan_id: str, task_id: str) -> dict[str, Any]:
db_utils.finish_attack_paths_scan(
attack_paths_scan, StateChoices.FAILED, ingestion_exceptions
)
- except Exception as e:
- logger.error(
- f"Could not mark Attack Paths scan {attack_paths_scan.id} as `FAILED` (row may have been deleted): {e}",
- exc_info=True,
+ except Exception as cleanup_error:
+ logger.log(
+ cleanup_log_level,
+ f"Could not mark Attack Paths scan {attack_paths_scan.id} as `FAILED` "
+ f"(row may have been deleted): {cleanup_error}",
+ exc_info=cleanup_exc_info,
)
raise
diff --git a/api/src/backend/tasks/jobs/attack_paths/sync.py b/api/src/backend/tasks/jobs/attack_paths/sync.py
index 50f770deb5..98a52bd48b 100644
--- a/api/src/backend/tasks/jobs/attack_paths/sync.py
+++ b/api/src/backend/tasks/jobs/attack_paths/sync.py
@@ -1,40 +1,58 @@
"""
Graph sync operations for Attack Paths.
-This module handles syncing graph data from temporary scan databases
-to the tenant database, adding provider isolation labels and properties.
+Reads nodes and relationships out of the cartography temp database (always
+Neo4j) and hands them to the configured sink (Neo4j or Neptune) in batches.
+Backend-specific Cypher (MERGE shape, ID strategy, indexes) lives in each
+sink; this module owns the source read loop, per-batch grouping, and the
+list-property materialisation policy (see `NormalizedList`).
+
+Each list-typed node property that appears in the provider's
+`normalized_lists` catalog becomes a set of child item nodes connected to
+the parent by a typed edge. A list-typed property that is not in the
+catalog is serialised to a comma-delimited string and emits a one-time
+warning per (label, property), surfacing Cartography fields that should be
+added to the catalog.
"""
+import json
import time
from collections import defaultdict
+from collections.abc import Iterator
+from hashlib import sha256
from typing import Any
import neo4j
from api.attack_paths import database as graph_database
+from api.attack_paths import sink as sink_module
from celery.utils.log import get_task_logger
from tasks.jobs.attack_paths.config import (
+ PROVIDER_CONFIGS,
PROVIDER_ISOLATION_PROPERTIES,
PROVIDER_RESOURCE_LABEL,
- SYNC_BATCH_SIZE,
+ NormalizedList,
get_provider_label,
get_tenant_label,
)
from tasks.jobs.attack_paths.queries import (
NODE_FETCH_QUERY,
- NODE_SYNC_TEMPLATE,
- RELATIONSHIP_SYNC_TEMPLATE,
RELATIONSHIPS_FETCH_QUERY,
- render_cypher_template,
)
logger = get_task_logger(__name__)
+# (label, property) tuples for which we've already emitted the
+# "unnormalised list" warning. Module-level so the warning fires once per
+# process, not once per node.
+_WARNED_UNNORMALIZED: set[tuple[str, str]] = set()
+
def sync_graph(
source_database: str,
target_database: str,
tenant_id: str,
provider_id: str,
+ provider_type: str,
) -> dict[str, int]:
"""
Sync all nodes and relationships from source to target database.
@@ -44,25 +62,38 @@ def sync_graph(
`target_database`: The tenant database
`tenant_id`: The tenant ID for isolation
`provider_id`: The provider ID for isolation
+ `provider_type`: Provider type key (e.g. "aws"), used to resolve the
+ `NormalizedList` catalog from `PROVIDER_CONFIGS`.
Returns:
- Dict with counts of synced nodes and relationships
+ Dict with counts of synced nodes, child item nodes, and relationships.
"""
- nodes_synced = sync_nodes(
+ sink = sink_module.get_backend()
+ sink.ensure_sync_indexes(target_database)
+
+ normalized_lists = _resolve_normalized_lists(provider_type)
+
+ node_result = sync_nodes(
source_database,
target_database,
tenant_id,
provider_id,
+ sink,
+ normalized_lists,
)
relationships_synced = sync_relationships(
source_database,
target_database,
provider_id,
+ sink,
)
return {
- "nodes": nodes_synced,
- "relationships": relationships_synced,
+ "nodes": node_result["parents"],
+ "child_nodes": node_result["children"],
+ "relationships": relationships_synced + node_result["parent_child_rels"],
+ "structural_relationships": relationships_synced,
+ "item_relationships": node_result["parent_child_rels"],
}
@@ -71,84 +102,123 @@ def sync_nodes(
target_database: str,
tenant_id: str,
provider_id: str,
-) -> int:
+ sink: Any,
+ normalized_lists: list[NormalizedList],
+) -> dict[str, int]:
"""
- Sync nodes from source to target database.
+ Sync nodes from source to target database, exploding catalogued list
+ properties into child nodes + parent->child edges.
Adds `_ProviderResource` label and dynamic `_Tenant_{id}` and `_Provider_{id}`
- isolation labels to all nodes.
+ isolation labels to all nodes (parents and children alike).
Source and target sessions are opened sequentially per batch to avoid
holding two Bolt connections simultaneously for the entire sync duration.
"""
+ batch_size = sink.sync_batch_size
t0 = time.perf_counter()
last_id = -1
- total_synced = 0
+ parents_synced = 0
+ children_synced = 0
+ parent_child_rels = 0
+
+ catalog = _build_catalog_index(normalized_lists)
+ extra_labels = _build_extra_labels(tenant_id, provider_id)
while True:
- grouped: dict[tuple[str, ...], list[dict[str, Any]]] = defaultdict(list)
+ tb = time.perf_counter()
+ prev_children = children_synced
+ prev_rels = parent_child_rels
+ parent_groups: dict[tuple[str, ...], list[dict[str, Any]]] = defaultdict(list)
+ child_groups: dict[str, list[dict[str, Any]]] = defaultdict(list)
+ rel_groups: dict[str, list[dict[str, Any]]] = defaultdict(list)
batch_count = 0
with graph_database.get_session(source_database) as source_session:
result = source_session.run(
NODE_FETCH_QUERY,
- {"last_id": last_id, "batch_size": SYNC_BATCH_SIZE},
+ {"last_id": last_id, "batch_size": batch_size},
)
for record in result:
batch_count += 1
last_id = record["internal_id"]
- key, value = _node_to_sync_dict(record, provider_id)
- grouped[key].append(value)
+ key, parent_dict, children, rels = _node_to_sync_dict(
+ record, provider_id, catalog
+ )
+ parent_groups[key].append(parent_dict)
+ for child in children:
+ child_groups[child["_child_label"]].append(child["row"])
+ for rel in rels:
+ rel_groups[rel["rel_type"]].append(rel["row"])
if batch_count == 0:
break
- with graph_database.get_session(target_database) as target_session:
- for labels, batch in grouped.items():
- label_set = set(labels)
- label_set.add(PROVIDER_RESOURCE_LABEL)
- label_set.add(get_tenant_label(tenant_id))
- label_set.add(get_provider_label(provider_id))
- node_labels = ":".join(f"`{label}`" for label in sorted(label_set))
+ for labels, batch in parent_groups.items():
+ rendered_labels = _render_labels(labels, extra_labels)
+ for sink_batch in _iter_sink_batches(batch, batch_size):
+ sink.write_nodes(target_database, rendered_labels, sink_batch)
- query = render_cypher_template(
- NODE_SYNC_TEMPLATE, {"__NODE_LABELS__": node_labels}
+ for child_label, batch in child_groups.items():
+ rendered_labels = _render_labels((child_label,), extra_labels)
+ for sink_batch in _iter_sink_batches(batch, batch_size):
+ sink.write_nodes(target_database, rendered_labels, sink_batch)
+ children_synced += len(batch)
+
+ for rel_type, batch in rel_groups.items():
+ for sink_batch in _iter_sink_batches(batch, batch_size):
+ sink.write_relationships(
+ target_database, rel_type, provider_id, sink_batch
)
- target_session.run(query, {"rows": batch})
+ parent_child_rels += len(batch)
- total_synced += batch_count
+ parents_synced += batch_count
+ batch_dt = time.perf_counter() - tb
+ batch_elements = (
+ batch_count
+ + (children_synced - prev_children)
+ + (parent_child_rels - prev_rels)
+ )
+ rate = batch_elements / batch_dt if batch_dt else 0
logger.info(
- f"Synced {total_synced} nodes from {source_database} to {target_database} in {time.perf_counter() - t0:.3f}s"
+ f"[sync nodes] {parents_synced} source (+{children_synced} items, "
+ f"+{parent_child_rels} item rels) · batch {batch_dt:.1f}s · "
+ f"elapsed {time.perf_counter() - t0:.1f}s · ~{rate:.0f} elem/s"
)
- return total_synced
+ return {
+ "parents": parents_synced,
+ "children": children_synced,
+ "parent_child_rels": parent_child_rels,
+ }
def sync_relationships(
source_database: str,
target_database: str,
provider_id: str,
+ sink: Any,
) -> int:
"""
Sync relationships from source to target database.
- Matches source and target nodes by `_provider_element_id` in the tenant database.
-
Source and target sessions are opened sequentially per batch to avoid
holding two Bolt connections simultaneously for the entire sync duration.
"""
+ batch_size = sink.sync_batch_size
t0 = time.perf_counter()
last_id = -1
total_synced = 0
while True:
+ tb = time.perf_counter()
grouped: dict[str, list[dict[str, Any]]] = defaultdict(list)
batch_count = 0
with graph_database.get_session(source_database) as source_session:
result = source_session.run(
RELATIONSHIPS_FETCH_QUERY,
- {"last_id": last_id, "batch_size": SYNC_BATCH_SIZE},
+ {"last_id": last_id, "batch_size": batch_size},
)
for record in result:
batch_count += 1
@@ -159,32 +229,212 @@ def sync_relationships(
if batch_count == 0:
break
- with graph_database.get_session(target_database) as target_session:
- for rel_type, batch in grouped.items():
- query = render_cypher_template(
- RELATIONSHIP_SYNC_TEMPLATE, {"__REL_TYPE__": rel_type}
+ for rel_type, batch in grouped.items():
+ for sink_batch in _iter_sink_batches(batch, batch_size):
+ sink.write_relationships(
+ target_database, rel_type, provider_id, sink_batch
)
- target_session.run(query, {"rows": batch})
total_synced += batch_count
+ batch_dt = time.perf_counter() - tb
+ rate = batch_count / batch_dt if batch_dt else 0
logger.info(
- f"Synced {total_synced} relationships from {source_database} to {target_database} in {time.perf_counter() - t0:.3f}s"
+ f"[sync rels] {total_synced} structural · batch {batch_dt:.1f}s · "
+ f"elapsed {time.perf_counter() - t0:.1f}s · ~{rate:.0f}/s"
)
return total_synced
+def _iter_sink_batches(
+ rows: list[dict[str, Any]],
+ batch_size: int,
+) -> Iterator[list[dict[str, Any]]]:
+ """Yield final sink write batches after source rows have been transformed."""
+ if batch_size <= 0:
+ raise ValueError("Sink batch size must be greater than zero")
+
+ for index in range(0, len(rows), batch_size):
+ yield rows[index : index + batch_size]
+
+
def _node_to_sync_dict(
- record: neo4j.Record, provider_id: str
-) -> tuple[tuple[str, ...], dict[str, Any]]:
- """Transform a source node record into a (grouping_key, sync_dict) pair."""
+ record: neo4j.Record,
+ provider_id: str,
+ catalog: dict[tuple[str, str], NormalizedList],
+) -> tuple[
+ tuple[str, ...],
+ dict[str, Any],
+ list[dict[str, Any]],
+ list[dict[str, Any]],
+]:
+ """Transform a source node record into a (grouping_key, sync_dict, children, rels) tuple.
+
+ Catalogued list properties are popped from `props` and emitted as child
+ nodes + parent->child relationships.
+ """
props = dict(record["props"] or {})
_strip_internal_properties(props)
labels = tuple(sorted(set(record["labels"] or [])))
- return labels, {
- "provider_element_id": f"{provider_id}:{record['element_id']}",
+ parent_element_id = f"{provider_id}:{record['element_id']}"
+
+ children, rels = _explode_catalogued_lists(
+ labels, props, catalog, provider_id, parent_element_id
+ )
+
+ _normalize_sink_properties(props, labels)
+
+ parent = {
+ "provider_element_id": parent_element_id,
"props": props,
}
+ return labels, parent, children, rels
+
+
+def _explode_catalogued_lists(
+ labels: tuple[str, ...],
+ props: dict[str, Any],
+ catalog: dict[tuple[str, str], NormalizedList],
+ provider_id: str,
+ parent_element_id: str,
+) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
+ """Pop catalogued list properties from `props` and produce child + rel emits.
+
+ A node may carry multiple labels (e.g. `AWSPolicyStatement` plus
+ `_AWSResource`); we check each label for catalog matches independently.
+ Returns:
+ - children: list of {"_child_label": str, "row": } dicts.
+ - rels: list of {"rel_type": str, "row": } dicts.
+ """
+ children: list[dict[str, Any]] = []
+ rels: list[dict[str, Any]] = []
+
+ for label in labels:
+ for key in list(props.keys()):
+ spec = catalog.get((label, key))
+ if spec is None:
+ continue
+ value = props.pop(key)
+ if value is None:
+ continue
+ if not isinstance(value, list):
+ # Catalogued but not actually a list this scan - fall back to
+ # the generic normaliser so we don't lose the value.
+ props[key] = value
+ continue
+ for item in value:
+ child_value_key, child_props = _build_child_props(spec, item)
+ if child_value_key is None:
+ continue
+ child_element_id = _build_child_id(
+ provider_id, spec.child_label, child_value_key
+ )
+ children.append(
+ {
+ "_child_label": spec.child_label,
+ "row": {
+ "provider_element_id": child_element_id,
+ "props": child_props,
+ },
+ }
+ )
+ rels.append(
+ {
+ "rel_type": spec.rel_type,
+ "row": {
+ "start_element_id": parent_element_id,
+ "end_element_id": child_element_id,
+ "provider_element_id": (
+ f"{parent_element_id}::{spec.rel_type}::"
+ f"{child_element_id}"
+ ),
+ "props": {},
+ },
+ }
+ )
+
+ return children, rels
+
+
+def _build_child_props(
+ spec: NormalizedList, item: Any
+) -> tuple[str | None, dict[str, Any]]:
+ """Translate one list element into a child node's prop dict.
+
+ Returns (dedup_key, props). The dedup_key is what makes two child nodes
+ equal within (tenant, provider) - used to build `_provider_element_id`.
+ For scalar mode, the dedup key is the value itself. For dict mode it is
+ a stable concatenation of the mapped fields in `field_map` order.
+ """
+ if not spec.field_map:
+ if isinstance(item, (dict, list)):
+ # Defensive: caller marked this list as scalar but elements are
+ # structured. Convert to a stable string so the value survives.
+ value_str = json.dumps(item, sort_keys=True, default=str)
+ else:
+ value_str = str(item)
+ return value_str, {"value": value_str}
+
+ if not isinstance(item, dict):
+ # Catalogued as dict-shape but got a scalar. Skip - caller will see
+ # the value go missing and can fix the field_map.
+ return None, {}
+
+ props: dict[str, Any] = {}
+ dedup_parts: list[str] = []
+ for src_key, child_field in spec.field_map:
+ raw = item.get(src_key)
+ value_str = _to_sink_property_value(raw) if raw is not None else ""
+ props[child_field] = value_str
+ dedup_parts.append(f"{child_field}={value_str}")
+ return "::".join(dedup_parts), props
+
+
+def _build_child_id(provider_id: str, child_label: str, value_key: str) -> str:
+ """Deterministic `_provider_element_id` for a list-item child node.
+
+ Hashing the value keeps the ID bounded while preserving deduplication within
+ each provider and child label.
+ """
+ value_digest = sha256(value_key.encode("utf-8")).hexdigest()
+ return f"{provider_id}::{child_label}::{value_digest}"
+
+
+def _build_catalog_index(
+ normalized_lists: list[NormalizedList],
+) -> dict[tuple[str, str], NormalizedList]:
+ """Index the catalog by (source_label, source_property) for O(1) lookup."""
+ return {
+ (spec.source_label, spec.source_property): spec for spec in normalized_lists
+ }
+
+
+def _build_extra_labels(tenant_id: str, provider_id: str) -> tuple[str, ...]:
+ return (
+ PROVIDER_RESOURCE_LABEL,
+ get_tenant_label(tenant_id),
+ get_provider_label(provider_id),
+ )
+
+
+def _render_labels(base_labels: tuple[str, ...], extra_labels: tuple[str, ...]) -> str:
+ """Render the Cypher label string for a node-write batch."""
+ label_set = set(base_labels) | set(extra_labels)
+ return ":".join(f"`{label}`" for label in sorted(label_set))
+
+
+def _resolve_normalized_lists(provider_type: str) -> list[NormalizedList]:
+ config = PROVIDER_CONFIGS.get(provider_type)
+ if config is None:
+ # Unknown provider: empty catalog. Any list-typed property will be
+ # serialised to a comma-delimited string with one warning per
+ # (label, property).
+ logger.warning(
+ "Provider type %s not in PROVIDER_CONFIGS; no normalized_lists active",
+ provider_type,
+ )
+ return []
+ return config.normalized_lists
def _rel_to_sync_dict(
@@ -193,7 +443,11 @@ def _rel_to_sync_dict(
"""Transform a source relationship record into a (grouping_key, sync_dict) pair."""
props = dict(record["props"] or {})
_strip_internal_properties(props)
+ # Relationship properties go through the same primitive coercion as
+ # nodes; catalog-driven materialisation applies to node properties only.
+ _normalize_sink_properties(props, labels=None)
rel_type = record["rel_type"]
+
return rel_type, {
"start_element_id": f"{provider_id}:{record['start_element_id']}",
"end_element_id": f"{provider_id}:{record['end_element_id']}",
@@ -206,3 +460,80 @@ def _strip_internal_properties(props: dict[str, Any]) -> None:
"""Remove provider isolation properties before the += spread in sync templates."""
for key in PROVIDER_ISOLATION_PROPERTIES:
props.pop(key, None)
+
+
+def _normalize_sink_properties(
+ props: dict[str, Any], labels: tuple[str, ...] | None
+) -> None:
+ """Normalize property values to primitive Cypher literals for either sink.
+
+ Attack-paths node and relationship properties are written as primitive
+ scalars regardless of the active sink (Neo4j or Neptune). The convention
+ is driven by Neptune's openCypher type restrictions, which reject list,
+ map, temporal and spatial property values, but it is applied uniformly
+ so that custom and predefined queries are portable across sinks without
+ runtime rewriting.
+
+ Concretely:
+ - Temporal values (neo4j.time.{DateTime,Date,Time,Duration}) become
+ their ISO-8601 string representation.
+ - Spatial values (neo4j.spatial.Point and subclasses) become their
+ WKT-style string representation.
+ - Maps / dicts become a JSON-encoded string, read back with `CONTAINS`
+ substring checks inside queries.
+ - Lists become a comma-delimited string. Catalogued list properties
+ are materialised as child item nodes upstream in
+ `_explode_catalogued_lists` and never reach this point; any list
+ seen here is uncatalogued, so we log a one-time warning per
+ (label, property) to surface Cartography fields that should be
+ added to the catalog.
+
+ `labels` is only used for the warning message; pass `None` for
+ relationship props (no label context).
+ """
+ for key, value in list(props.items()):
+ if isinstance(value, list) and labels is not None:
+ _warn_unnormalized_list(labels, key)
+ props[key] = _to_sink_property_value(value)
+
+
+def _warn_unnormalized_list(labels: tuple[str, ...], key: str) -> None:
+ """Warn once per (label, property), on the real label(s) only.
+
+ Every synced node also carries internal isolation labels (`_AWSResource`,
+ `_ProviderResource`, `_Tenant_*`, `_Provider_*`); warning on those just
+ doubles the noise, so skip them and point at the actionable Cartography
+ label. Falls back to all labels if only internal ones are present.
+ """
+ real_labels = [label for label in labels if not label.startswith("_")]
+ for label in real_labels or labels:
+ token = (label, key)
+ if token in _WARNED_UNNORMALIZED:
+ continue
+ _WARNED_UNNORMALIZED.add(token)
+ logger.warning(
+ "Unnormalized list property %s.%s reached sink as comma-string; "
+ "add a NormalizedList entry to the provider catalog to explode it",
+ label,
+ key,
+ )
+
+
+def _to_sink_property_value(value: Any) -> Any:
+ if hasattr(value, "iso_format") and callable(value.iso_format):
+ return value.iso_format()
+
+ if type(value).__module__.startswith("neo4j.spatial"):
+ return str(value)
+
+ if isinstance(value, dict):
+ # openCypher `SET` rejects map property values: encode as JSON so the structured payload
+ # survives the round-trip and is queryable with `CONTAINS` substring checks
+ return json.dumps(value, sort_keys=True, default=str)
+
+ if isinstance(value, list):
+ # openCypher `SET` rejects list/array property values: encode as a
+ # delimited string read back with split() inside queries
+ return ",".join(str(_to_sink_property_value(v)) for v in value)
+
+ return value
diff --git a/api/src/backend/tasks/jobs/deletion.py b/api/src/backend/tasks/jobs/deletion.py
index fadf98d464..91e64610f7 100644
--- a/api/src/backend/tasks/jobs/deletion.py
+++ b/api/src/backend/tasks/jobs/deletion.py
@@ -1,4 +1,5 @@
from api.attack_paths import database as graph_database
+from api.attack_paths import sink as sink_module
from api.db_router import MainRouter
from api.db_utils import batch_delete, rls_transaction
from api.models import (
@@ -76,6 +77,12 @@ def delete_provider(tenant_id: str, pk: str):
"id", flat=True
)
)
+ attack_paths_sink_backends = list(
+ AttackPathsScan.all_objects.filter(provider=instance)
+ .values_list("sink_backend", flat=True)
+ .distinct()
+ .order_by("sink_backend")
+ )
deletion_steps = [
("Scan Summaries", ScanSummary.all_objects.filter(scan__provider=instance)),
@@ -97,7 +104,13 @@ def delete_provider(tenant_id: str, pk: str):
# Delete the Attack Paths' graph data related to the provider from the tenant database
tenant_database_name = graph_database.get_database_name(tenant_id)
try:
- graph_database.drop_subgraph(tenant_database_name, str(pk))
+ if attack_paths_sink_backends:
+ for sink_backend in attack_paths_sink_backends:
+ sink_module.get_backend_for_name(sink_backend).drop_subgraph(
+ tenant_database_name, str(pk)
+ )
+ else:
+ graph_database.drop_subgraph(tenant_database_name, str(pk))
except graph_database.GraphDatabaseQueryException as gdb_error:
logger.error(f"Error deleting Provider graph data: {gdb_error}")
diff --git a/api/src/backend/tasks/jobs/integrations.py b/api/src/backend/tasks/jobs/integrations.py
index 25722686cc..c77ba22b7f 100644
--- a/api/src/backend/tasks/jobs/integrations.py
+++ b/api/src/backend/tasks/jobs/integrations.py
@@ -14,6 +14,7 @@ from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
from prowler.lib.outputs.csv.csv import CSV
from prowler.lib.outputs.finding import Finding as FindingOutput
from prowler.lib.outputs.html.html import HTML
+from prowler.lib.outputs.jira.exceptions.exceptions import JiraBaseException
from prowler.lib.outputs.ocsf.ocsf import OCSF
from prowler.providers.aws.aws_provider import AwsProvider
from prowler.providers.aws.lib.s3.s3 import S3
@@ -26,6 +27,8 @@ from tasks.utils import batched
logger = get_task_logger(__name__)
+JIRA_GENERIC_SEND_ERROR = "Failed to create Jira issue."
+
def get_s3_client_from_integration(
integration: Integration,
@@ -483,6 +486,7 @@ def send_findings_to_jira(
jira_integration = initialize_prowler_integration(integration)
num_tickets_created = 0
+ error_messages = []
for finding_id in finding_ids:
with rls_transaction(tenant_id):
finding_instance = (
@@ -512,35 +516,54 @@ def send_findings_to_jira(
recommendation = remediation.get("recommendation", {})
remediation_code = remediation.get("code", {})
- # Send the individual finding to Jira
- result = jira_integration.send_finding(
- check_id=finding_instance.check_id,
- check_title=check_metadata.get("checktitle", ""),
- severity=finding_instance.severity,
- status=finding_instance.status,
- status_extended=finding_instance.status_extended or "",
- provider=finding_instance.scan.provider.provider,
- region=region,
- resource_uid=resource_uid,
- resource_name=resource_name,
- risk=check_metadata.get("risk", ""),
- recommendation_text=recommendation.get("text", ""),
- recommendation_url=recommendation.get("url", ""),
- remediation_code_native_iac=remediation_code.get("nativeiac", ""),
- remediation_code_terraform=remediation_code.get("terraform", ""),
- remediation_code_cli=remediation_code.get("cli", ""),
- remediation_code_other=remediation_code.get("other", ""),
- resource_tags=resource_tags,
- compliance=finding_instance.compliance or {},
- project_key=project_key,
- issue_type=issue_type,
- )
+ try:
+ # Send the individual finding to Jira
+ result = jira_integration.send_finding(
+ check_id=finding_instance.check_id,
+ check_title=check_metadata.get("checktitle", ""),
+ severity=finding_instance.severity,
+ status=finding_instance.status,
+ status_extended=finding_instance.status_extended or "",
+ provider=finding_instance.scan.provider.provider,
+ region=region,
+ resource_uid=resource_uid,
+ resource_name=resource_name,
+ risk=check_metadata.get("risk", ""),
+ recommendation_text=recommendation.get("text", ""),
+ recommendation_url=recommendation.get("url", ""),
+ remediation_code_native_iac=remediation_code.get("nativeiac", ""),
+ remediation_code_terraform=remediation_code.get("terraform", ""),
+ remediation_code_cli=remediation_code.get("cli", ""),
+ remediation_code_other=remediation_code.get("other", ""),
+ resource_tags=resource_tags,
+ compliance=finding_instance.compliance or {},
+ project_key=project_key,
+ issue_type=issue_type,
+ )
+ except JiraBaseException as error:
+ error_message = error.message or JIRA_GENERIC_SEND_ERROR
+ logger.exception(
+ "Failed to send finding %s to Jira: %s", finding_id, error_message
+ )
+ error_messages.append(error_message)
+ continue
+ except Exception:
+ logger.exception("Failed to send finding %s to Jira", finding_id)
+ error_messages.append(JIRA_GENERIC_SEND_ERROR)
+ continue
+
if result:
num_tickets_created += 1
else:
- logger.error(f"Failed to send finding {finding_id} to Jira")
+ error_message = JIRA_GENERIC_SEND_ERROR
+ logger.error(error_message)
+ error_messages.append(error_message)
- return {
+ result = {
"created_count": num_tickets_created,
"failed_count": len(finding_ids) - num_tickets_created,
}
+ if error_messages:
+ result["error"] = "; ".join(dict.fromkeys(error_messages))
+
+ return result
diff --git a/api/src/backend/tasks/jobs/lighthouse_providers.py b/api/src/backend/tasks/jobs/lighthouse_providers.py
index 0f28725e01..1eec1d3c6a 100644
--- a/api/src/backend/tasks/jobs/lighthouse_providers.py
+++ b/api/src/backend/tasks/jobs/lighthouse_providers.py
@@ -1,6 +1,15 @@
+import ssl
+from collections.abc import Iterable
+
import boto3
+import httpcore
+import httpx
import openai
from api.models import LighthouseProviderConfiguration, LighthouseProviderModels
+from api.validators import (
+ resolve_lighthouse_openai_compatible_host,
+ validate_lighthouse_openai_compatible_base_url,
+)
from botocore import UNSIGNED
from botocore.config import Config
from botocore.exceptions import BotoCoreError, ClientError
@@ -43,6 +52,90 @@ EXCLUDED_OPENAI_MODEL_SUBSTRINGS = (
"-instruct", # Legacy instruct models (gpt-3.5-turbo-instruct, etc.)
)
+OPENAI_COMPATIBLE_AUTHENTICATION_ERROR = "API key is invalid or missing"
+OPENAI_COMPATIBLE_CONNECTION_ERROR = "Provider connection failed"
+
+
+class _OpenAICompatibleProviderError(Exception):
+ """Sanitized OpenAI-compatible provider error safe for task results."""
+
+
+def _sanitize_openai_compatible_error(error: Exception) -> str:
+ status_code = getattr(error, "status_code", None)
+ if status_code is None:
+ response = getattr(error, "response", None)
+ status_code = getattr(response, "status_code", None)
+
+ if status_code == 401:
+ return OPENAI_COMPATIBLE_AUTHENTICATION_ERROR
+ return OPENAI_COMPATIBLE_CONNECTION_ERROR
+
+
+class _LighthouseOpenAICompatibleNetworkBackend(httpcore.SyncBackend):
+ """Validate and pin DNS results immediately before TCP connections."""
+
+ def connect_tcp(
+ self,
+ host: str,
+ port: int,
+ timeout: float | None = None,
+ local_address: str | None = None,
+ socket_options: Iterable[httpcore.SOCKET_OPTION] | None = None,
+ ) -> httpcore.NetworkStream:
+ resolved_addresses = resolve_lighthouse_openai_compatible_host(host, port)
+ last_error: httpcore.ConnectError | httpcore.ConnectTimeout | None = None
+
+ for address in resolved_addresses:
+ try:
+ return super().connect_tcp(
+ address,
+ port,
+ timeout=timeout,
+ local_address=local_address,
+ socket_options=socket_options,
+ )
+ except (httpcore.ConnectError, httpcore.ConnectTimeout) as error:
+ last_error = error
+
+ if last_error:
+ raise last_error
+ raise httpcore.ConnectError("No resolved addresses are available")
+
+
+class _LighthouseOpenAICompatibleHTTPTransport(httpx.HTTPTransport):
+ """HTTP transport that connects only to validated public IP addresses."""
+
+ def __init__(self) -> None:
+ self._pool = httpcore.ConnectionPool(
+ ssl_context=ssl.create_default_context(),
+ network_backend=_LighthouseOpenAICompatibleNetworkBackend(),
+ )
+
+
+def _create_openai_compatible_http_client() -> httpx.Client:
+ """Create the restricted HTTP client used for OpenAI-compatible providers."""
+ return httpx.Client(
+ follow_redirects=False,
+ trust_env=False,
+ transport=_LighthouseOpenAICompatibleHTTPTransport(),
+ )
+
+
+def _list_openai_compatible_models(base_url: str, api_key: str):
+ validate_lighthouse_openai_compatible_base_url(base_url)
+ try:
+ with _create_openai_compatible_http_client() as http_client:
+ client = openai.OpenAI(
+ api_key=api_key,
+ base_url=base_url,
+ http_client=http_client,
+ )
+ return client.models.list()
+ except Exception as error:
+ raise _OpenAICompatibleProviderError(
+ _sanitize_openai_compatible_error(error)
+ ) from error
+
def _extract_error_message(e: Exception) -> str:
"""
@@ -114,6 +207,7 @@ def _extract_openai_compatible_params(
return None
if not isinstance(base_url, str) or not base_url:
return None
+ validate_lighthouse_openai_compatible_base_url(base_url, resolve_dns=False)
return {"base_url": base_url, "api_key": api_key}
@@ -285,13 +379,7 @@ def check_lighthouse_provider_connection(provider_config_id: str) -> dict:
"error": "Base URL or API key is invalid or missing",
}
- # Test connection using OpenAI SDK with custom base_url
- # Note: base_url should include version (e.g., https://openrouter.ai/api/v1)
- client = openai.OpenAI(
- api_key=params["api_key"],
- base_url=params["base_url"],
- )
- _ = client.models.list()
+ _ = _list_openai_compatible_models(params["base_url"], params["api_key"])
else:
return {"connected": False, "error": "Unsupported provider type"}
@@ -361,8 +449,7 @@ def _fetch_openai_compatible_models(base_url: str, api_key: str) -> dict[str, st
Note: base_url should include version (e.g., https://openrouter.ai/api/v1)
"""
- client = openai.OpenAI(api_key=api_key, base_url=base_url)
- models = client.models.list()
+ models = _list_openai_compatible_models(base_url, api_key)
available_models: dict[str, str] = {}
for model in models.data:
diff --git a/api/src/backend/tasks/jobs/orphan_recovery.py b/api/src/backend/tasks/jobs/orphan_recovery.py
index 7211f1a1d5..05a2083dbe 100644
--- a/api/src/backend/tasks/jobs/orphan_recovery.py
+++ b/api/src/backend/tasks/jobs/orphan_recovery.py
@@ -172,11 +172,9 @@ def reconcile_orphans(
window_hours: int = 6,
dry_run: bool = False,
) -> dict:
- """Run the full orphan sweep under a single-flight advisory lock.
+ """Run the orphan task sweep under a single-flight advisory lock.
- Recovers any orphaned in-flight task and delegates attack-paths scans that
- never reached a worker to their existing stale-cleanup. Returns a summary;
- a no-op (lock not won) is reported too.
+ Returns a recovery summary. A no-op is reported when the lock is not acquired.
"""
with advisory_lock() as acquired:
if not acquired:
@@ -200,11 +198,6 @@ def reconcile_orphans(
logger.info("Orphan task recovery disabled by feature flag")
result = {"recovered": [], "failed": [], "skipped": [], "enabled": False}
- if not dry_run:
- from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
-
- result["attack_paths"] = cleanup_stale_attack_paths_scans()
-
return {"acquired": True, **result}
diff --git a/api/src/backend/tasks/jobs/report.py b/api/src/backend/tasks/jobs/report.py
index b40516dadf..c9d63a63ac 100644
--- a/api/src/backend/tasks/jobs/report.py
+++ b/api/src/backend/tasks/jobs/report.py
@@ -11,7 +11,6 @@ from uuid import UUID
from api.db_router import READ_REPLICA_ALIAS, MainRouter
from api.db_utils import rls_transaction
from api.models import Provider, Scan, ScanSummary, StateChoices, ThreatScoreSnapshot
-from api.utils import initialize_prowler_provider
from celery.utils.log import get_task_logger
from config.django.base import DJANGO_TMP_OUTPUT_DIRECTORY
from prowler.lib.check.compliance_models import (
@@ -27,6 +26,7 @@ from tasks.jobs.reports import (
ENSReportGenerator,
NIS2ReportGenerator,
ThreatScoreReportGenerator,
+ build_provider_metadata,
)
from tasks.jobs.threatscore import compute_threatscore_metrics
from tasks.jobs.threatscore_utils import (
@@ -841,24 +841,12 @@ def generate_compliance_reports(
tenant_id, scan_id
)
- # Initialize the Prowler provider once for the whole report batch. Each
- # generator used to re-init this in _load_compliance_data, paying the
- # boto3/Azure-SDK construction cost 5 times per scan. The instance is
- # only used by FindingOutput.transform_api_finding to enrich findings,
- # so a single shared instance is correct.
- logger.info("Initializing prowler_provider once for all reports (scan %s)", scan_id)
- try:
- with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
- prowler_provider = initialize_prowler_provider(provider_obj)
- except Exception as init_error:
- # If init fails the generators will fall back to lazy init in
- # _load_compliance_data; we just log and continue.
- logger.warning(
- "Could not pre-initialize prowler_provider for scan %s: %s",
- scan_id,
- init_error,
- )
- prowler_provider = None
+ # Build a credential-free provider metadata stub once for the whole
+ # report batch. FindingOutput.transform_api_finding only reads static
+ # attributes (type plus a few identity fields), so reports never decrypt
+ # the ProviderSecret nor construct a cloud SDK session — generation keeps
+ # working after credentials are deleted or invalidated (PROWLER-2145).
+ prowler_provider = build_provider_metadata(provider_obj)
# Create shared findings cache up front so the eviction closure below
# can reference it. Defined BEFORE the closure to avoid the UnboundLocalError
diff --git a/api/src/backend/tasks/jobs/reports/__init__.py b/api/src/backend/tasks/jobs/reports/__init__.py
index a538416f59..94da8d6524 100644
--- a/api/src/backend/tasks/jobs/reports/__init__.py
+++ b/api/src/backend/tasks/jobs/reports/__init__.py
@@ -98,6 +98,7 @@ from .config import (
from .csa import CSAReportGenerator
from .ens import ENSReportGenerator
from .nis2 import NIS2ReportGenerator
+from .provider_metadata import build_provider_metadata
from .threatscore import ThreatScoreReportGenerator
__all__ = [
@@ -105,6 +106,7 @@ __all__ = [
"BaseComplianceReportGenerator",
"ComplianceData",
"RequirementData",
+ "build_provider_metadata",
"create_pdf_styles",
"get_requirement_metadata",
# Framework-specific generators
diff --git a/api/src/backend/tasks/jobs/reports/base.py b/api/src/backend/tasks/jobs/reports/base.py
index f51319a846..574609280a 100644
--- a/api/src/backend/tasks/jobs/reports/base.py
+++ b/api/src/backend/tasks/jobs/reports/base.py
@@ -11,7 +11,6 @@ from typing import Any
from api.db_router import READ_REPLICA_ALIAS
from api.db_utils import rls_transaction
from api.models import Provider, StatusChoices
-from api.utils import initialize_prowler_provider
from celery.utils.log import get_task_logger
from prowler.lib.check.compliance_models import (
Compliance,
@@ -52,6 +51,7 @@ from .config import (
PADDING_SMALL,
FrameworkConfig,
)
+from .provider_metadata import build_provider_metadata
logger = get_task_logger(__name__)
@@ -178,7 +178,8 @@ class ComplianceData:
attributes_by_requirement_id: Mapping of requirement IDs to their attributes
findings_by_check_id: Mapping of check IDs to their findings
provider_obj: Provider model object
- prowler_provider: Initialized Prowler provider
+ prowler_provider: Credential-free provider metadata stub (see
+ ``build_provider_metadata``)
"""
tenant_id: str
@@ -439,10 +440,10 @@ class BaseComplianceReportGenerator(ABC):
provider_obj: Optional pre-fetched Provider object
requirement_statistics: Optional pre-aggregated statistics
findings_cache: Optional pre-loaded findings cache
- prowler_provider: Optional pre-initialized Prowler provider. When
- generating multiple reports for the same scan the master
- function initializes this once and passes it in to avoid
- re-running boto3/Azure-SDK setup per framework.
+ prowler_provider: Optional provider metadata stub (see
+ ``build_provider_metadata``). When generating multiple
+ reports for the same scan the master function builds it
+ once and passes it in.
**kwargs: Additional framework-specific arguments
"""
framework = self.config.display_name
@@ -896,9 +897,9 @@ class BaseComplianceReportGenerator(ABC):
provider_obj: Optional pre-fetched Provider
requirement_statistics: Optional pre-aggregated statistics
findings_cache: Optional pre-loaded findings
- prowler_provider: Optional pre-initialized Prowler provider. When
- the master function initializes it once and passes it in,
- we skip the per-report ``initialize_prowler_provider`` call.
+ prowler_provider: Optional provider metadata stub. When the
+ master function builds it once and passes it in, we skip
+ the per-report ``build_provider_metadata`` call.
Returns:
Aggregated ComplianceData object
@@ -909,7 +910,7 @@ class BaseComplianceReportGenerator(ABC):
provider_obj = Provider.objects.get(id=provider_id)
if prowler_provider is None:
- prowler_provider = initialize_prowler_provider(provider_obj)
+ prowler_provider = build_provider_metadata(provider_obj)
provider_type = provider_obj.provider
# Load compliance framework — fall back to the universal loader
diff --git a/api/src/backend/tasks/jobs/reports/provider_metadata.py b/api/src/backend/tasks/jobs/reports/provider_metadata.py
new file mode 100644
index 0000000000..632f15c424
--- /dev/null
+++ b/api/src/backend/tasks/jobs/reports/provider_metadata.py
@@ -0,0 +1,124 @@
+from types import SimpleNamespace
+
+from prowler.providers.github.models import GithubIdentityInfo
+
+
+def build_provider_metadata(provider) -> SimpleNamespace:
+ """Build a credential-free stand-in for the Prowler SDK provider.
+
+ ``FindingOutput.transform_api_finding`` only reads static attributes
+ from the provider (``type`` plus a few identity/metadata fields used to
+ label accounts), so compliance reports never need the decrypted
+ ``ProviderSecret`` nor a live cloud SDK session. This builds an object
+ exposing exactly those attributes from the ``Provider`` DB row, which
+ keeps report generation working when the provider secret has been
+ deleted or its credentials are no longer valid (PROWLER-2145).
+
+ Args:
+ provider: The API ``Provider`` model instance (only ``provider``,
+ ``uid`` and ``alias`` are read).
+
+ Returns:
+ A ``SimpleNamespace`` mimicking the SDK provider attributes consumed
+ by ``FindingOutput.transform_api_finding`` / ``generate_output``.
+ """
+ provider_type = provider.provider
+ uid = provider.uid
+ display_name = provider.alias or uid
+
+ # Defaults cover every attribute read unconditionally in
+ # FindingOutput.generate_output (``provider.auth_method`` is accessed
+ # directly for several provider types); identity lookups go through
+ # get_nested_attribute/getattr, which tolerate missing attributes.
+ stub = SimpleNamespace(
+ type=provider_type,
+ auth_method="",
+ identity=SimpleNamespace(),
+ )
+
+ if provider_type == "aws":
+ stub.identity = SimpleNamespace(account=uid)
+ elif provider_type == "azure":
+ stub.identity = SimpleNamespace(
+ identity_type="",
+ identity_id="",
+ tenant_ids=[""],
+ tenant_domain="",
+ subscriptions={uid: display_name},
+ )
+ elif provider_type == "gcp":
+ stub.identity = SimpleNamespace(profile="")
+ stub.projects = {
+ uid: SimpleNamespace(
+ id=uid,
+ name=display_name,
+ labels={},
+ organization=None,
+ )
+ }
+ elif provider_type == "kubernetes":
+ stub.identity = SimpleNamespace(context=uid, cluster=uid)
+ elif provider_type == "m365":
+ stub.identity = SimpleNamespace(
+ identity_type="",
+ identity_id="",
+ tenant_domain=uid,
+ tenant_id="",
+ )
+ elif provider_type == "github":
+ # generate_output assigns account fields only inside
+ # isinstance(identity, Github*IdentityInfo) branches, so the stub
+ # must carry a real GithubIdentityInfo instance.
+ stub.identity = GithubIdentityInfo(
+ account_id=uid,
+ account_name=display_name,
+ account_url="",
+ )
+ elif provider_type == "mongodbatlas":
+ stub.identity = SimpleNamespace(
+ organization_id=uid,
+ organization_name=display_name,
+ )
+ elif provider_type == "iac":
+ stub.provider_uid = uid
+ elif provider_type == "oraclecloud":
+ stub.identity = SimpleNamespace(
+ tenancy_id=uid,
+ tenancy_name=display_name,
+ )
+ elif provider_type == "alibabacloud":
+ stub.identity = SimpleNamespace(
+ identity_arn="",
+ account_id=uid,
+ account_name=display_name,
+ )
+ elif provider_type == "cloudflare":
+ stub.identity = SimpleNamespace(
+ audited_accounts=[uid],
+ accounts=[],
+ )
+ elif provider_type == "openstack":
+ stub.identity = SimpleNamespace(
+ username="",
+ project_id=uid,
+ project_name=display_name,
+ )
+ elif provider_type == "googleworkspace":
+ stub.identity = SimpleNamespace(
+ delegated_user="",
+ customer_id=uid,
+ domain=display_name,
+ )
+ elif provider_type == "vercel":
+ stub.identity = SimpleNamespace(
+ team=None,
+ user_id=uid,
+ username=display_name,
+ )
+ elif provider_type == "okta":
+ stub.identity = SimpleNamespace(
+ org_domain=uid,
+ client_id="",
+ )
+
+ return stub
diff --git a/api/src/backend/tasks/jobs/scan.py b/api/src/backend/tasks/jobs/scan.py
index dcaacf6642..39db32abe4 100644
--- a/api/src/backend/tasks/jobs/scan.py
+++ b/api/src/backend/tasks/jobs/scan.py
@@ -1,6 +1,7 @@
import csv
import io
import json
+import random
import re
import time
import uuid
@@ -19,7 +20,7 @@ from api.db_utils import (
psycopg_connection,
rls_transaction,
)
-from api.exceptions import ProviderConnectionError
+from api.exceptions import ProviderConnectionError, ProviderDeletedException
from api.models import (
AttackSurfaceOverview,
ComplianceOverviewSummary,
@@ -48,7 +49,7 @@ from celery.utils.log import get_task_logger
from config.django.base import DJANGO_FINDINGS_BATCH_SIZE
from config.env import env
from config.settings.celery import CELERY_DEADLOCK_ATTEMPTS
-from django.db import IntegrityError, OperationalError
+from django.db import DatabaseError, IntegrityError, OperationalError, transaction
from django.db.models import (
Case,
Count,
@@ -117,6 +118,20 @@ ATTACK_SURFACE_PROVIDER_COMPATIBILITY = {
_ATTACK_SURFACE_MAPPING_CACHE: dict[str, dict] = {}
+def _save_scan_instance(
+ scan_instance: Scan, provider_id: str, update_fields: list[str]
+) -> None:
+ try:
+ with transaction.atomic(): # Savepoint for not killing the `rls_transaction`
+ scan_instance.save(update_fields=update_fields)
+ except DatabaseError:
+ if Scan.objects.filter(pk=scan_instance.id).exists():
+ raise
+ raise ProviderDeletedException(
+ f"Provider '{provider_id}' for scan '{scan_instance.id}' was deleted during the scan"
+ ) from None
+
+
def aggregate_category_counts(
categories: list[str],
severity: str,
@@ -292,6 +307,55 @@ def _store_resources(
return resource_instance, (resource_instance.uid, resource_instance.region)
+def _bulk_update_resource_failed_findings_counts(
+ tenant_id: str,
+ scan_id: str,
+ resources_to_update: list[Resource],
+) -> None:
+ """Persist failed finding counters with stable row locking and retry."""
+ if not resources_to_update:
+ return
+
+ sorted_resources = sorted(
+ resources_to_update, key=lambda resource: str(resource.id)
+ )
+ for start in range(0, len(sorted_resources), SCAN_DB_BATCH_SIZE):
+ chunk = sorted_resources[start : start + SCAN_DB_BATCH_SIZE]
+ chunk_ids = [resource.id for resource in chunk]
+
+ for attempt in range(CELERY_DEADLOCK_ATTEMPTS):
+ try:
+ with rls_transaction(tenant_id):
+ list(
+ Resource.objects.select_for_update()
+ .filter(id__in=chunk_ids)
+ .order_by("id")
+ .values_list("id", flat=True)
+ )
+ Resource.objects.bulk_update(
+ chunk,
+ ["failed_findings_count"],
+ batch_size=SCAN_DB_BATCH_SIZE,
+ )
+ break
+ except OperationalError:
+ if attempt < CELERY_DEADLOCK_ATTEMPTS - 1:
+ logger.warning(
+ "Resource failed findings count update hit a database "
+ "conflict on scan %s. Retrying chunk %s/%s "
+ "(attempt %s/%s).",
+ scan_id,
+ start // SCAN_DB_BATCH_SIZE + 1,
+ (len(sorted_resources) + SCAN_DB_BATCH_SIZE - 1)
+ // SCAN_DB_BATCH_SIZE,
+ attempt + 1,
+ CELERY_DEADLOCK_ATTEMPTS,
+ )
+ time.sleep((0.1 * (2**attempt)) + random.uniform(0, 0.1))
+ continue
+ raise
+
+
def _copy_compliance_requirement_rows(
tenant_id: str, rows: list[dict[str, Any]]
) -> None:
@@ -1029,13 +1093,18 @@ def perform_prowler_scan(
group_resources_cache: dict[str, set] = {}
start_time = time.time()
exc = None
+ skip_final_scan_update = False
with rls_transaction(tenant_id):
provider_instance = Provider.objects.get(pk=provider_id)
scan_instance = Scan.objects.get(pk=scan_id)
scan_instance.state = StateChoices.EXECUTING
scan_instance.started_at = datetime.now(tz=UTC)
- scan_instance.save(update_fields=["state", "started_at", "updated_at"])
+ _save_scan_instance(
+ scan_instance,
+ provider_id,
+ ["state", "started_at", "updated_at"],
+ )
# Find the mutelist processor if it exists
with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
@@ -1101,7 +1170,7 @@ def perform_prowler_scan(
# Throttle scan_instance progress writes to avoid hammering the writer:
# only persist when progress moves by at least `PROGRESS_THROTTLE_DELTA`
- # OR `PROGRESS_THROTTLE_SECONDS` have elapsed. The final progress (1.0)
+ # OR `PROGRESS_THROTTLE_SECONDS` have elapsed. The final progress (100)
# always persists in the `finally` block below.
last_persisted_progress = -1.0
last_persisted_progress_at = 0.0
@@ -1143,7 +1212,11 @@ def perform_prowler_scan(
):
with rls_transaction(tenant_id):
scan_instance.progress = progress
- scan_instance.save(update_fields=["progress", "updated_at"])
+ _save_scan_instance(
+ scan_instance,
+ provider_id,
+ ["progress", "updated_at"],
+ )
last_persisted_progress = progress
last_persisted_progress_at = now
@@ -1159,37 +1232,45 @@ def perform_prowler_scan(
resources_to_update.append(resource_instance)
if resources_to_update:
- # Single rls_transaction wrapping the bulk_update (previously
- # `update_objects_in_batches` opened one rls_transaction per
- # chunk; for tenants with many resources this collapsed N
- # BEGINs/COMMITs into 1).
- with rls_transaction(tenant_id):
- Resource.objects.bulk_update(
- resources_to_update,
- ["failed_findings_count"],
- batch_size=SCAN_DB_BATCH_SIZE,
- )
+ _bulk_update_resource_failed_findings_counts(
+ tenant_id=tenant_id,
+ scan_id=scan_id,
+ resources_to_update=resources_to_update,
+ )
+ except ProviderDeletedException as e:
+ logger.warning(str(e))
+ exception = e
+ skip_final_scan_update = True
except Exception as e:
logger.error(f"Error performing scan {scan_id}: {e}")
exception = e
scan_instance.state = StateChoices.FAILED
finally:
- with rls_transaction(tenant_id):
- scan_instance.duration = time.time() - start_time
- scan_instance.completed_at = datetime.now(tz=UTC)
- scan_instance.unique_resource_count = len(unique_resources)
- scan_instance.save(
- update_fields=[
- "state",
- "duration",
- "completed_at",
- "unique_resource_count",
- "progress",
- "updated_at",
- ]
- )
+ if not skip_final_scan_update:
+ try:
+ with rls_transaction(tenant_id):
+ scan_instance.duration = time.time() - start_time
+ scan_instance.completed_at = datetime.now(tz=UTC)
+ scan_instance.unique_resource_count = len(unique_resources)
+ if exception is None:
+ scan_instance.progress = 100
+ _save_scan_instance(
+ scan_instance,
+ provider_id,
+ [
+ "state",
+ "duration",
+ "completed_at",
+ "unique_resource_count",
+ "progress",
+ "updated_at",
+ ],
+ )
+ except ProviderDeletedException as e:
+ logger.warning(str(e))
+ exception = e
if exception is not None:
raise exception
@@ -1383,7 +1464,7 @@ def aggregate_findings(tenant_id: str, scan_id: str):
)
with rls_transaction(tenant_id):
- scan_aggregations = {
+ scan_aggregations = [
ScanSummary(
tenant_id=tenant_id,
scan_id=scan_id,
@@ -1408,9 +1489,18 @@ def aggregate_findings(tenant_id: str, scan_id: str):
for agg in aggregation
if agg["resources__service"] is not None
and agg["resources__region"] is not None
- }
- # Upsert so re-runs (post-mute reaggregation) don't trip
- # `unique_scan_summary`; race-safe under concurrent writers.
+ ]
+ # Needed sort so concurrent upserts acquire locks consistently
+ scan_aggregations.sort(
+ key=lambda summary: (
+ summary.tenant_id,
+ summary.scan_id,
+ summary.check_id,
+ summary.service,
+ summary.severity,
+ summary.region,
+ )
+ )
ScanSummary.objects.bulk_create(
scan_aggregations,
batch_size=3000,
diff --git a/api/src/backend/tasks/jobs/threatscore_utils.py b/api/src/backend/tasks/jobs/threatscore_utils.py
index 2e2fb87ba5..2f968749dd 100644
--- a/api/src/backend/tasks/jobs/threatscore_utils.py
+++ b/api/src/backend/tasks/jobs/threatscore_utils.py
@@ -178,7 +178,9 @@ def _load_findings_for_requirement_checks(
tenant_id (str): The tenant ID for Row-Level Security context.
scan_id (str): The ID of the scan to retrieve findings for.
check_ids (list[str]): List of check IDs to load findings for.
- prowler_provider: The initialized Prowler provider instance.
+ prowler_provider: Credential-free provider metadata stub (see
+ ``tasks.jobs.reports.build_provider_metadata``) consumed by
+ ``FindingOutput.transform_api_finding``.
findings_cache (dict, optional): Cache of already loaded findings.
If provided, checks are first looked up in cache before querying database.
total_counts_out (dict, optional): If provided, populated with
diff --git a/api/src/backend/tasks/tasks.py b/api/src/backend/tasks/tasks.py
index e7bb0982cd..a91ff85c01 100644
--- a/api/src/backend/tasks/tasks.py
+++ b/api/src/backend/tasks/tasks.py
@@ -2,6 +2,7 @@ import os
from datetime import UTC, datetime, timedelta
from pathlib import Path
from shutil import rmtree
+from uuid import uuid4
from api.compliance import (
get_compliance_frameworks,
@@ -10,14 +11,25 @@ from api.compliance import (
from api.db_router import READ_REPLICA_ALIAS
from api.db_utils import delete_related_daily_task, rls_transaction
from api.decorators import handle_provider_deletion, set_tenant
-from api.models import Finding, Integration, Provider, Scan, ScanSummary, StateChoices
+from api.exceptions import ProviderDeletedException
+from api.models import (
+ Finding,
+ Integration,
+ Provider,
+ Scan,
+ ScanSummary,
+ StateChoices,
+ Task,
+)
from api.utils import initialize_prowler_provider
from api.v1.serializers import ScanTaskSerializer
-from celery import chain, group, shared_task
+from celery import chain, group, shared_task, states
from celery.utils.log import get_task_logger
from config.celery import RLSTask
from config.django.base import DJANGO_FINDINGS_BATCH_SIZE, DJANGO_TMP_OUTPUT_DIRECTORY
+from django.db import transaction
from django_celery_beat.models import PeriodicTask
+from django_celery_results.models import TaskResult
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance import (
process_universal_compliance_frameworks,
@@ -85,6 +97,220 @@ from tasks.utils import (
)
logger = get_task_logger(__name__)
+QUEUED_SCAN_TASK_STATE = "QUEUED"
+DISPATCHED_SCAN_TASK_STATES = (states.PENDING, states.STARTED, "PROGRESS")
+
+
+def _get_dispatched_provider_scan(tenant_id: str, provider_id: str):
+ """Return a scan that has already been dispatched for a provider."""
+ executing_scan = (
+ Scan.objects.select_for_update()
+ .filter(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ state=StateChoices.EXECUTING,
+ )
+ .order_by("-inserted_at")
+ .first()
+ )
+ if executing_scan:
+ return executing_scan
+
+ return (
+ Scan.objects.select_for_update(of=("self",))
+ .select_related("task__task_runner_task")
+ .filter(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ state__in=(StateChoices.AVAILABLE, StateChoices.SCHEDULED),
+ task__isnull=False,
+ task__task_runner_task__status__in=DISPATCHED_SCAN_TASK_STATES,
+ )
+ .order_by("-inserted_at")
+ .first()
+ )
+
+
+def _get_queued_provider_scan(tenant_id: str, provider_id: str):
+ """Return the next DB-queued scan for a provider."""
+ return (
+ Scan.objects.select_for_update(of=("self",))
+ .select_related("task__task_runner_task")
+ .filter(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ state=StateChoices.AVAILABLE,
+ task__isnull=False,
+ task__task_runner_task__status=QUEUED_SCAN_TASK_STATE,
+ )
+ .order_by("inserted_at", "id")
+ .first()
+ )
+
+
+def get_active_provider_scan(tenant_id: str, provider_id: str):
+ """Return a dispatched or DB-queued scan for a provider."""
+ return _get_dispatched_provider_scan(
+ tenant_id, provider_id
+ ) or _get_queued_provider_scan(tenant_id, provider_id)
+
+
+def create_scan_task_record(
+ tenant_id: str,
+ task_id: str,
+ task_name: str = "scan-perform",
+ task_status: str | None = states.PENDING,
+) -> Task:
+ if task_status is None:
+ task_status = states.PENDING
+
+ task_result, _ = TaskResult.objects.update_or_create(
+ task_id=str(task_id),
+ defaults={"status": task_status, "task_name": task_name},
+ )
+ prowler_task, _ = Task.objects.update_or_create(
+ id=str(task_id),
+ tenant_id=tenant_id,
+ defaults={"task_runner_task": task_result},
+ )
+ return prowler_task
+
+
+def enqueue_scan_execution_on_commit(
+ tenant_id: str,
+ scan: Scan,
+ task_id: str,
+) -> None:
+ transaction.on_commit(
+ lambda: perform_scan_task.apply_async(
+ kwargs={
+ "tenant_id": str(tenant_id),
+ "scan_id": str(scan.id),
+ "provider_id": str(scan.provider_id),
+ },
+ task_id=str(task_id),
+ )
+ )
+
+
+def _get_queued_scheduled_scan(tenant_id: str, provider_id: str):
+ return (
+ Scan.objects.select_for_update(of=("self",))
+ .select_related("task__task_runner_task")
+ .filter(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ task__isnull=False,
+ task__task_runner_task__status=QUEUED_SCAN_TASK_STATE,
+ )
+ .order_by("inserted_at", "id")
+ .first()
+ )
+
+
+def _get_or_create_queued_scheduled_scan(
+ tenant_id: str,
+ provider_id: str,
+ periodic_task_instance: PeriodicTask,
+ scheduled_at: datetime,
+) -> Scan:
+ queued_scan = _get_queued_scheduled_scan(tenant_id, provider_id)
+ if queued_scan:
+ return queued_scan
+
+ task_id = str(uuid4())
+ queued_task = create_scan_task_record(
+ tenant_id=tenant_id,
+ task_id=task_id,
+ task_status=QUEUED_SCAN_TASK_STATE,
+ )
+ return Scan.objects.create(
+ tenant_id=tenant_id,
+ name="Daily scheduled scan",
+ provider_id=provider_id,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ scheduled_at=scheduled_at,
+ scheduler_task_id=periodic_task_instance.id,
+ task=queued_task,
+ )
+
+
+def _dispatch_next_queued_provider_scan(tenant_id: str, provider_id: str):
+ with rls_transaction(tenant_id):
+ if not Provider.objects.select_for_update().filter(pk=provider_id).exists():
+ return None
+
+ if _get_dispatched_provider_scan(tenant_id, provider_id):
+ return None
+
+ queued_scan = _get_queued_provider_scan(tenant_id, provider_id)
+ if not queued_scan or not queued_scan.task:
+ return None
+
+ task_result = queued_scan.task.task_runner_task
+ task_result.status = states.PENDING
+ task_result.task_name = "scan-perform"
+ task_result.save(update_fields=["status", "task_name"])
+ enqueue_scan_execution_on_commit(
+ tenant_id=tenant_id,
+ scan=queued_scan,
+ task_id=str(queued_scan.task_id),
+ )
+ return queued_scan
+
+
+def _dispatch_next_queued_provider_scan_best_effort(
+ tenant_id: str, provider_id: str
+) -> None:
+ try:
+ _dispatch_next_queued_provider_scan(tenant_id, provider_id)
+ except Exception:
+ logger.exception(
+ "Failed to dispatch next queued scan for provider %s", provider_id
+ )
+
+
+def _get_or_create_next_scheduled_scan(
+ tenant_id: str,
+ provider_id: str,
+ periodic_task_instance: PeriodicTask,
+ next_scan_datetime: datetime,
+) -> Scan:
+ interval = periodic_task_instance.interval
+ now = datetime.now(UTC)
+ while next_scan_datetime <= now:
+ next_scan_datetime += timedelta(**{interval.period: interval.every})
+
+ return _get_or_create_scheduled_scan(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ scheduler_task_id=periodic_task_instance.id,
+ scheduled_at=next_scan_datetime,
+ update_state=True,
+ )
+
+
+def _ensure_next_scheduled_scan_best_effort(
+ tenant_id: str,
+ provider_id: str,
+ periodic_task_instance: PeriodicTask,
+ next_scan_datetime: datetime,
+) -> None:
+ try:
+ with rls_transaction(tenant_id):
+ _get_or_create_next_scheduled_scan(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ periodic_task_instance=periodic_task_instance,
+ next_scan_datetime=next_scan_datetime,
+ )
+ except Exception:
+ logger.exception(
+ "Failed to ensure next scheduled scan for provider %s", provider_id
+ )
def _cleanup_orphan_scheduled_scans(
@@ -117,6 +343,7 @@ def _cleanup_orphan_scheduled_scans(
trigger=Scan.TriggerChoices.SCHEDULED,
state=StateChoices.AVAILABLE,
scheduler_task_id=scheduler_task_id,
+ task__isnull=True,
)
scheduled_scan_exists = Scan.objects.filter(
@@ -292,16 +519,17 @@ def perform_scan_task(
)
return None
- result = perform_prowler_scan(
- tenant_id=tenant_id,
- scan_id=scan_id,
- provider_id=provider_id,
- checks_to_execute=checks_to_execute,
- )
-
- _perform_scan_complete_tasks(tenant_id, scan_id, provider_id)
-
- return result
+ try:
+ result = perform_prowler_scan(
+ tenant_id=tenant_id,
+ scan_id=scan_id,
+ provider_id=provider_id,
+ checks_to_execute=checks_to_execute,
+ )
+ _perform_scan_complete_tasks(tenant_id, scan_id, provider_id)
+ return result
+ finally:
+ _dispatch_next_queued_provider_scan_best_effort(tenant_id, provider_id)
# acks_late=False: like scan-perform; a dropped run is re-fired by Beat on the next tick.
@@ -335,7 +563,7 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
task_id = self.request.id
with rls_transaction(tenant_id):
- if not Provider.objects.filter(pk=provider_id).exists():
+ if not Provider.objects.select_for_update().filter(pk=provider_id).exists():
logger.warning(
"scheduled scan-perform skipped: provider %s no longer exists "
"(tenant=%s)",
@@ -348,22 +576,6 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
periodic_task_instance = PeriodicTask.objects.get(
name=f"scan-perform-scheduled-{provider_id}"
)
- executing_scan = (
- Scan.objects.filter(
- tenant_id=tenant_id,
- provider_id=provider_id,
- trigger=Scan.TriggerChoices.SCHEDULED,
- state=StateChoices.EXECUTING,
- )
- .order_by("-started_at")
- .first()
- )
- if executing_scan:
- logger.warning(
- f"Scheduled scan already executing for provider {provider_id}. Skipping."
- )
- return ScanTaskSerializer(instance=executing_scan).data
-
executed_scan = Scan.objects.filter(
tenant_id=tenant_id,
provider_id=provider_id,
@@ -388,6 +600,26 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
scheduler_task_id=periodic_task_instance.id,
)
+ active_scan = get_active_provider_scan(tenant_id, provider_id)
+ if active_scan:
+ logger.warning(
+ "Scan already queued or executing for provider %s. Queueing scheduled run.",
+ provider_id,
+ )
+ queued_scheduled_scan = _get_or_create_queued_scheduled_scan(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ periodic_task_instance=periodic_task_instance,
+ scheduled_at=current_scan_datetime,
+ )
+ _get_or_create_next_scheduled_scan(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ periodic_task_instance=periodic_task_instance,
+ next_scan_datetime=next_scan_datetime,
+ )
+ return ScanTaskSerializer(instance=queued_scheduled_scan).data
+
scan_instance = _get_or_create_scheduled_scan(
tenant_id=tenant_id,
provider_id=provider_id,
@@ -403,24 +635,16 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
scan_id=str(scan_instance.id),
provider_id=provider_id,
)
+ _perform_scan_complete_tasks(tenant_id, str(scan_instance.id), provider_id)
+ return result
finally:
- with rls_transaction(tenant_id):
- now = datetime.now(UTC)
- if next_scan_datetime <= now:
- interval_delta = timedelta(**{interval.period: interval.every})
- while next_scan_datetime <= now:
- next_scan_datetime += interval_delta
- _get_or_create_scheduled_scan(
- tenant_id=tenant_id,
- provider_id=provider_id,
- scheduler_task_id=periodic_task_instance.id,
- scheduled_at=next_scan_datetime,
- update_state=True,
- )
-
- _perform_scan_complete_tasks(tenant_id, str(scan_instance.id), provider_id)
-
- return result
+ _ensure_next_scheduled_scan_best_effort(
+ tenant_id=tenant_id,
+ provider_id=provider_id,
+ periodic_task_instance=periodic_task_instance,
+ next_scan_datetime=next_scan_datetime,
+ )
+ _dispatch_next_queued_provider_scan_best_effort(tenant_id, provider_id)
@shared_task(name="scan-summary", queue="overview")
@@ -443,7 +667,13 @@ class AttackPathsScanRLSTask(RLSTask):
scan_id = kwargs.get("scan_id")
if tenant_id and scan_id:
- logger.error(f"Attack paths scan task {task_id} failed: {exc}")
+ if isinstance(exc, ProviderDeletedException):
+ logger.warning(
+ f"Attack paths scan task {task_id} stopped because its provider "
+ f"or tenant was deleted: {exc}"
+ )
+ else:
+ logger.error(f"Attack paths scan task {task_id} failed: {exc}")
attack_paths_db_utils.fail_attack_paths_scan(tenant_id, scan_id, str(exc))
diff --git a/api/src/backend/tasks/tests/report_test_helpers.py b/api/src/backend/tasks/tests/report_test_helpers.py
new file mode 100644
index 0000000000..18d7b0e2b6
--- /dev/null
+++ b/api/src/backend/tasks/tests/report_test_helpers.py
@@ -0,0 +1,62 @@
+import io
+import struct
+import zlib
+from types import ModuleType, SimpleNamespace
+from typing import Any
+
+PNG_SIGNATURE = b"\x89PNG\r\n\x1a\n"
+
+
+def _png_chunk(chunk_type: bytes, data: bytes) -> bytes:
+ checksum = zlib.crc32(chunk_type + data) & 0xFFFFFFFF
+ return (
+ struct.pack(">I", len(data)) + chunk_type + data + struct.pack(">I", checksum)
+ )
+
+
+def _build_tiny_png() -> bytes:
+ ihdr = struct.pack(">IIBBBBB", 1, 1, 8, 2, 0, 0, 0)
+ # Filter byte 0 plus one white RGB pixel.
+ idat = zlib.compress(b"\x00\xff\xff\xff")
+ return (
+ PNG_SIGNATURE
+ + _png_chunk(b"IHDR", ihdr)
+ + _png_chunk(b"IDAT", idat)
+ + _png_chunk(b"IEND", b"")
+ )
+
+
+_TINY_PNG_BYTES = _build_tiny_png()
+
+
+def fake_png_buffer() -> io.BytesIO:
+ return io.BytesIO(_TINY_PNG_BYTES)
+
+
+def patch_chart_helpers(
+ monkeypatch: Any, module: ModuleType, names: tuple[str, ...]
+) -> dict[str, list[dict[str, Any]]]:
+ calls: dict[str, list[dict[str, Any]]] = {name: [] for name in names}
+
+ def _build_fake_chart(name: str):
+ def _fake_chart(*args: Any, **kwargs: Any) -> io.BytesIO:
+ calls[name].append({"args": args, "kwargs": kwargs})
+ return fake_png_buffer()
+
+ return _fake_chart
+
+ for name in names:
+ monkeypatch.setattr(module, name, _build_fake_chart(name))
+
+ return calls
+
+
+def patch_report_gc(monkeypatch: Any) -> None:
+ from tasks.jobs import report as report_module
+ from tasks.jobs.reports import base as base_report_module
+ from tasks.jobs.reports import threatscore as threatscore_report_module
+
+ gc_stub = SimpleNamespace(collect=lambda: 0)
+ monkeypatch.setattr(report_module, "gc", gc_stub)
+ monkeypatch.setattr(base_report_module, "gc", gc_stub)
+ monkeypatch.setattr(threatscore_report_module, "gc", gc_stub)
diff --git a/api/src/backend/tasks/tests/test_attack_paths_aws.py b/api/src/backend/tasks/tests/test_attack_paths_aws.py
new file mode 100644
index 0000000000..dc2c59d614
--- /dev/null
+++ b/api/src/backend/tasks/tests/test_attack_paths_aws.py
@@ -0,0 +1,102 @@
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import neo4j.exceptions
+import pytest
+from tasks.jobs.attack_paths import aws
+
+DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
+
+
+def _make_neo4j_error(code: str) -> neo4j.exceptions.Neo4jError:
+ return neo4j.exceptions.Neo4jError._hydrate_neo4j(
+ code=code,
+ message="graph query failed",
+ )
+
+
+def _resource_functions(failing_sync, following_sync):
+ return {
+ "failing_sync": failing_sync,
+ "following_sync": following_sync,
+ "permission_relationships": MagicMock(),
+ "resourcegroupstaggingapi": MagicMock(),
+ }
+
+
+def test_sync_aws_account_reraises_database_not_found_immediately():
+ error = _make_neo4j_error(DATABASE_NOT_FOUND_CODE)
+ failing_sync = MagicMock(side_effect=error)
+ following_sync = MagicMock()
+
+ with (
+ patch.object(
+ aws.cartography_aws,
+ "RESOURCE_FUNCTIONS",
+ _resource_functions(failing_sync, following_sync),
+ ),
+ patch.object(aws.db_utils, "update_attack_paths_scan_progress"),
+ patch.object(aws.utils, "stringify_exception") as stringify_exception,
+ patch.object(aws.logger, "warning") as warning,
+ pytest.raises(neo4j.exceptions.Neo4jError) as exc_info,
+ ):
+ aws.sync_aws_account(
+ SimpleNamespace(uid="123456789012"),
+ [
+ "failing_sync",
+ "following_sync",
+ "permission_relationships",
+ "resourcegroupstaggingapi",
+ ],
+ {},
+ MagicMock(),
+ )
+
+ assert exc_info.value is error
+ following_sync.assert_not_called()
+ stringify_exception.assert_not_called()
+ warning.assert_not_called()
+
+
+@pytest.mark.parametrize(
+ "error",
+ [
+ _make_neo4j_error("Neo.ClientError.Statement.SyntaxError"),
+ RuntimeError("resource sync failed"),
+ ],
+ ids=["different-neo4j-error", "non-neo4j-error"],
+)
+def test_sync_aws_account_warns_and_continues_for_other_exceptions(error):
+ failing_sync = MagicMock(side_effect=error)
+ following_sync = MagicMock()
+
+ with (
+ patch.object(
+ aws.cartography_aws,
+ "RESOURCE_FUNCTIONS",
+ _resource_functions(failing_sync, following_sync),
+ ),
+ patch.object(aws.db_utils, "update_attack_paths_scan_progress"),
+ patch.object(
+ aws.utils,
+ "stringify_exception",
+ return_value="formatted failure",
+ ),
+ patch.object(aws.logger, "warning") as warning,
+ ):
+ failed_syncs = aws.sync_aws_account(
+ SimpleNamespace(uid="123456789012"),
+ [
+ "failing_sync",
+ "following_sync",
+ "permission_relationships",
+ "resourcegroupstaggingapi",
+ ],
+ {},
+ MagicMock(),
+ )
+
+ assert failed_syncs == {"failing_sync": "formatted failure"}
+ following_sync.assert_called_once_with()
+ warning.assert_called_once()
+ assert "Continuing to the next AWS sync function" in warning.call_args.args[0]
diff --git a/api/src/backend/tasks/tests/test_attack_paths_provider_config.py b/api/src/backend/tasks/tests/test_attack_paths_provider_config.py
new file mode 100644
index 0000000000..41ec2847d4
--- /dev/null
+++ b/api/src/backend/tasks/tests/test_attack_paths_provider_config.py
@@ -0,0 +1,30 @@
+from tasks.jobs.attack_paths.provider_config import AWS_NORMALIZED_LISTS
+from tasks.jobs.attack_paths.sync import _build_catalog_index, _node_to_sync_dict
+
+
+def test_aws_vpc_endpoint_id_lists_are_normalized():
+ catalog = _build_catalog_index(AWS_NORMALIZED_LISTS)
+ record = {
+ "element_id": "node-1",
+ "labels": ["AWSVpcEndpoint"],
+ "props": {
+ "id": "vpce-123",
+ "route_table_ids": ["rtb-1"],
+ "network_interface_ids": ["eni-1"],
+ "subnet_ids": ["subnet-1"],
+ },
+ }
+
+ _, parent, children, rels = _node_to_sync_dict(record, "provider-id", catalog)
+
+ assert parent["props"] == {"id": "vpce-123"}
+ assert {child["_child_label"] for child in children} == {
+ "AWSVpcEndpointRouteTableIdsItem",
+ "AWSVpcEndpointNetworkInterfaceIdsItem",
+ "AWSVpcEndpointSubnetIdsItem",
+ }
+ assert {rel["rel_type"] for rel in rels} == {
+ "HAS_ROUTE_TABLE_IDS",
+ "HAS_NETWORK_INTERFACE_IDS",
+ "HAS_SUBNET_IDS",
+ }
diff --git a/api/src/backend/tasks/tests/test_attack_paths_scan.py b/api/src/backend/tasks/tests/test_attack_paths_scan.py
index fef4894646..4409e5f19d 100644
--- a/api/src/backend/tasks/tests/test_attack_paths_scan.py
+++ b/api/src/backend/tasks/tests/test_attack_paths_scan.py
@@ -1,9 +1,14 @@
+import logging
from contextlib import nullcontext
from datetime import UTC, datetime, timedelta
from types import SimpleNamespace
from unittest.mock import MagicMock, call, patch
+from uuid import uuid4
import pytest
+from api.attack_paths.database import GraphDatabaseQueryException
+from api.db_utils import rls_transaction
+from api.exceptions import ProviderDeletedException
from api.models import (
AttackPathsScan,
Finding,
@@ -15,6 +20,7 @@ from api.models import (
StatusChoices,
Task,
)
+from django.db import DEFAULT_DB_ALIAS, DatabaseError
from django_celery_results.models import TaskResult
from prowler.lib.check.models import Severity
from tasks.jobs.attack_paths import findings as findings_module
@@ -23,15 +29,31 @@ from tasks.jobs.attack_paths import internet as internet_module
from tasks.jobs.attack_paths import sync as sync_module
from tasks.jobs.attack_paths.scan import run as attack_paths_run
+SYNC_RESULT_EMPTY = {
+ "nodes": 0,
+ "child_nodes": 0,
+ "relationships": 0,
+ "structural_relationships": 0,
+ "item_relationships": 0,
+}
+
@pytest.mark.django_db
class TestAttackPathsRun:
+ @pytest.fixture(autouse=True)
+ def mock_graph_database_preflight(self):
+ with patch(
+ "tasks.jobs.attack_paths.scan.graph_database.verify_scan_databases_available"
+ ) as mock_preflight:
+ yield mock_preflight
+
# Patching with decorators as we got a `SyntaxError: too many statically nested blocks` error if we use context managers
@patch("tasks.jobs.attack_paths.scan.graph_database.drop_database")
@patch(
"tasks.jobs.attack_paths.scan.utils.call_within_event_loop",
side_effect=lambda fn, *a, **kw: fn(*a, **kw),
)
+ @patch("tasks.jobs.attack_paths.scan.db_utils.set_scan_migrated")
@patch("tasks.jobs.attack_paths.scan.db_utils.set_graph_data_ready")
@patch("tasks.jobs.attack_paths.scan.db_utils.set_provider_graph_data_ready")
@patch("tasks.jobs.attack_paths.scan.db_utils.finish_attack_paths_scan")
@@ -39,7 +61,7 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.db_utils.starting_attack_paths_scan")
@patch(
"tasks.jobs.attack_paths.scan.sync.sync_graph",
- return_value={"nodes": 0, "relationships": 0},
+ return_value=SYNC_RESULT_EMPTY,
)
@patch("tasks.jobs.attack_paths.scan.graph_database.drop_subgraph", return_value=0)
@patch("tasks.jobs.attack_paths.scan.indexes.create_sync_indexes")
@@ -48,11 +70,11 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_ontology.run")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.clear_cache")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
- "tasks.jobs.attack_paths.scan.graph_database.get_uri",
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
return_value="bolt://neo4j",
)
@patch(
@@ -66,7 +88,7 @@ class TestAttackPathsRun:
def test_run_success_flow(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_create_db,
mock_clear_cache,
mock_cartography_indexes,
@@ -83,19 +105,16 @@ class TestAttackPathsRun:
mock_finish,
mock_set_provider_graph_data_ready,
mock_set_graph_data_ready,
+ mock_set_scan_migrated,
mock_event_loop,
mock_drop_db,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -159,6 +178,7 @@ class TestAttackPathsRun:
target_database="tenant-db",
tenant_id=str(provider.tenant_id),
provider_id=str(provider.id),
+ provider_type="aws",
)
mock_get_ingestion.assert_called_once_with(provider.provider)
mock_event_loop.assert_called_once()
@@ -172,10 +192,93 @@ class TestAttackPathsRun:
attack_paths_scan, StateChoices.COMPLETED, ingestion_result
)
mock_set_provider_graph_data_ready.assert_called_once_with(
- attack_paths_scan, False
+ attack_paths_scan, False, "neo4j"
)
mock_set_graph_data_ready.assert_called_once_with(attack_paths_scan, True)
+ # is_migrated is flipped to True only after the sync succeeds, so reads
+ # don't switch to the new catalog/sink before the graph is live.
+ mock_set_scan_migrated.assert_called_once_with(attack_paths_scan, True, "neo4j")
+ def test_run_preflight_failure_does_not_start_scan(
+ self,
+ mock_graph_database_preflight,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ scan = scans_fixture[0]
+
+ attack_paths_scan = AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.SCHEDULED,
+ )
+ mock_graph_database_preflight.side_effect = RuntimeError("graph unavailable")
+
+ with (
+ patch(
+ "tasks.jobs.attack_paths.scan.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ ),
+ patch(
+ "tasks.jobs.attack_paths.scan.initialize_prowler_provider",
+ return_value=MagicMock(_enabled_regions=["us-east-1"]),
+ ),
+ patch(
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
+ return_value="bolt://neo4j",
+ ),
+ patch(
+ "tasks.jobs.attack_paths.scan.db_utils.retrieve_attack_paths_scan",
+ return_value=attack_paths_scan,
+ ),
+ patch(
+ "tasks.jobs.attack_paths.scan.get_cartography_ingestion_function",
+ return_value=MagicMock(return_value={}),
+ ),
+ patch(
+ "tasks.jobs.attack_paths.scan.db_utils.starting_attack_paths_scan"
+ ) as mock_starting,
+ patch(
+ "tasks.jobs.attack_paths.scan.graph_database.create_database"
+ ) as mock_create_db,
+ ):
+ with pytest.raises(RuntimeError, match="graph unavailable"):
+ attack_paths_run(str(tenant.id), str(scan.id), "task-123")
+
+ mock_graph_database_preflight.assert_called_once_with()
+ mock_starting.assert_not_called()
+ mock_create_db.assert_not_called()
+
+ @pytest.mark.parametrize(
+ ("ingestion_error", "temporary_database_missing"),
+ [
+ (RuntimeError("ingestion boom"), False),
+ (
+ GraphDatabaseQueryException(
+ message="Graph not found: db-scan-id",
+ code="Neo.ClientError.Database.DatabaseNotFound",
+ ),
+ True,
+ ),
+ (
+ GraphDatabaseQueryException(
+ message="Graph not found: db-tenant-id",
+ code="Neo.ClientError.Database.DatabaseNotFound",
+ ),
+ False,
+ ),
+ ],
+ ids=[
+ "regular-error",
+ "temporary-database-missing",
+ "sink-database-missing",
+ ],
+ )
+ @patch("tasks.jobs.attack_paths.scan.logger")
@patch(
"tasks.jobs.attack_paths.scan.utils.stringify_exception",
return_value="Cartography failed: ingestion boom",
@@ -194,13 +297,13 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.internet.analysis")
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
"tasks.jobs.attack_paths.scan.graph_database.get_database_name",
return_value="db-scan-id",
)
- @patch("tasks.jobs.attack_paths.scan.graph_database.get_uri")
+ @patch("tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri")
@patch(
"tasks.jobs.attack_paths.scan.initialize_prowler_provider",
return_value=MagicMock(_enabled_regions=["us-east-1"]),
@@ -212,7 +315,7 @@ class TestAttackPathsRun:
def test_run_failure_marks_scan_failed(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_get_db_name,
mock_create_db,
mock_cartography_indexes,
@@ -228,17 +331,16 @@ class TestAttackPathsRun:
mock_drop_db,
mock_event_loop,
mock_stringify,
+ mock_logger,
+ ingestion_error,
+ temporary_database_missing,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -251,7 +353,11 @@ class TestAttackPathsRun:
session_ctx = MagicMock()
session_ctx.__enter__.return_value = mock_session
session_ctx.__exit__.return_value = False
- ingestion_fn = MagicMock(side_effect=RuntimeError("ingestion boom"))
+ ingestion_fn = MagicMock(side_effect=ingestion_error)
+ if temporary_database_missing:
+ mock_finish.side_effect = DatabaseError(
+ "Save with update_fields did not affect any rows"
+ )
with (
patch(
@@ -267,13 +373,28 @@ class TestAttackPathsRun:
return_value=ingestion_fn,
),
):
- with pytest.raises(RuntimeError, match="ingestion boom"):
+ with pytest.raises(type(ingestion_error)):
attack_paths_run(str(tenant.id), str(scan.id), "task-456")
failure_args = mock_finish.call_args[0]
assert failure_args[0] is attack_paths_scan
assert failure_args[1] == StateChoices.FAILED
assert failure_args[2] == {"global_error": "Cartography failed: ingestion boom"}
+ mock_drop_db.assert_called_once_with("db-scan-id")
+ if temporary_database_missing:
+ mock_logger.warning.assert_any_call("Cartography failed: ingestion boom")
+ mock_logger.exception.assert_not_called()
+ mock_logger.log.assert_called_once_with(
+ logging.WARNING,
+ f"Could not mark Attack Paths scan {attack_paths_scan.id} as `FAILED` "
+ "(row may have been deleted): Save with update_fields did not affect "
+ "any rows",
+ exc_info=False,
+ )
+ else:
+ mock_logger.exception.assert_called_once_with(
+ "Cartography failed: ingestion boom"
+ )
@patch(
"tasks.jobs.attack_paths.scan.utils.stringify_exception",
@@ -293,13 +414,13 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.internet.analysis")
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
"tasks.jobs.attack_paths.scan.graph_database.get_database_name",
return_value="db-scan-id",
)
- @patch("tasks.jobs.attack_paths.scan.graph_database.get_uri")
+ @patch("tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri")
@patch(
"tasks.jobs.attack_paths.scan.initialize_prowler_provider",
return_value=MagicMock(_enabled_regions=["us-east-1"]),
@@ -311,7 +432,7 @@ class TestAttackPathsRun:
def test_failure_before_gate_does_not_flip_graph_data_ready_true(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_get_db_name,
mock_create_db,
mock_cartography_indexes,
@@ -328,18 +449,14 @@ class TestAttackPathsRun:
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
"""Failure during ingestion (before set_provider_graph_data_ready(False))
must NOT flip graph_data_ready to True for providers that never had data."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -396,13 +513,13 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.internet.analysis")
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
"tasks.jobs.attack_paths.scan.graph_database.get_database_name",
return_value="db-scan-id",
)
- @patch("tasks.jobs.attack_paths.scan.graph_database.get_uri")
+ @patch("tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri")
@patch(
"tasks.jobs.attack_paths.scan.initialize_prowler_provider",
return_value=MagicMock(_enabled_regions=["us-east-1"]),
@@ -414,7 +531,7 @@ class TestAttackPathsRun:
def test_run_failure_marks_scan_failed_even_when_drop_database_fails(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_get_db_name,
mock_create_db,
mock_cartography_indexes,
@@ -431,16 +548,12 @@ class TestAttackPathsRun:
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -493,7 +606,7 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.db_utils.starting_attack_paths_scan")
@patch(
"tasks.jobs.attack_paths.scan.sync.sync_graph",
- return_value={"nodes": 0, "relationships": 0},
+ return_value=SYNC_RESULT_EMPTY,
)
@patch(
"tasks.jobs.attack_paths.scan.graph_database.drop_subgraph",
@@ -505,11 +618,11 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_ontology.run")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.clear_cache")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
- "tasks.jobs.attack_paths.scan.graph_database.get_uri",
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
return_value="bolt://neo4j",
)
@patch(
@@ -523,7 +636,7 @@ class TestAttackPathsRun:
def test_failure_after_gate_before_drop_restores_graph_data_ready(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_create_db,
mock_clear_cache,
mock_cartography_indexes,
@@ -544,16 +657,12 @@ class TestAttackPathsRun:
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -589,8 +698,8 @@ class TestAttackPathsRun:
attack_paths_run(str(tenant.id), str(scan.id), "task-456")
assert mock_set_provider_graph_data_ready.call_args_list == [
- call(attack_paths_scan, False),
- call(attack_paths_scan, True),
+ call(attack_paths_scan, False, "neo4j"),
+ call(attack_paths_scan, True, "neo4j"),
]
@patch(
@@ -618,11 +727,11 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_ontology.run")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.clear_cache")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
- "tasks.jobs.attack_paths.scan.graph_database.get_uri",
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
return_value="bolt://neo4j",
)
@patch(
@@ -636,7 +745,7 @@ class TestAttackPathsRun:
def test_failure_after_drop_before_sync_leaves_graph_data_ready_false(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_create_db,
mock_clear_cache,
mock_cartography_indexes,
@@ -657,16 +766,12 @@ class TestAttackPathsRun:
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -703,7 +808,7 @@ class TestAttackPathsRun:
# Only called with False (gate), never with True (no recovery for partial data)
mock_set_provider_graph_data_ready.assert_called_once_with(
- attack_paths_scan, False
+ attack_paths_scan, False, "neo4j"
)
@patch(
@@ -716,6 +821,7 @@ class TestAttackPathsRun:
)
@patch("tasks.jobs.attack_paths.scan.graph_database.drop_database")
@patch("tasks.jobs.attack_paths.scan.db_utils.finish_attack_paths_scan")
+ @patch("tasks.jobs.attack_paths.scan.db_utils.set_scan_migrated")
@patch(
"tasks.jobs.attack_paths.scan.db_utils.set_graph_data_ready",
side_effect=[RuntimeError("flag failed"), None],
@@ -725,7 +831,7 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.db_utils.starting_attack_paths_scan")
@patch(
"tasks.jobs.attack_paths.scan.sync.sync_graph",
- return_value={"nodes": 0, "relationships": 0},
+ return_value=SYNC_RESULT_EMPTY,
)
@patch("tasks.jobs.attack_paths.scan.graph_database.drop_subgraph")
@patch("tasks.jobs.attack_paths.scan.indexes.create_sync_indexes")
@@ -734,11 +840,11 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_ontology.run")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.clear_cache")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
- "tasks.jobs.attack_paths.scan.graph_database.get_uri",
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
return_value="bolt://neo4j",
)
@patch(
@@ -752,7 +858,7 @@ class TestAttackPathsRun:
def test_failure_after_sync_restores_graph_data_ready(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_create_db,
mock_clear_cache,
mock_cartography_indexes,
@@ -768,21 +874,18 @@ class TestAttackPathsRun:
mock_update_progress,
mock_set_provider_graph_data_ready,
mock_set_graph_data_ready,
+ mock_set_scan_migrated,
mock_finish,
mock_drop_db,
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -824,8 +927,11 @@ class TestAttackPathsRun:
]
# set_provider_graph_data_ready only called once with False (the gate)
mock_set_provider_graph_data_ready.assert_called_once_with(
- attack_paths_scan, False
+ attack_paths_scan, False, "neo4j"
)
+ # is_migrated is flipped once after the sync and is not touched again by
+ # the failure-recovery branch
+ mock_set_scan_migrated.assert_called_once_with(attack_paths_scan, True, "neo4j")
@patch(
"tasks.jobs.attack_paths.scan.utils.stringify_exception",
@@ -843,7 +949,7 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.db_utils.starting_attack_paths_scan")
@patch(
"tasks.jobs.attack_paths.scan.sync.sync_graph",
- return_value={"nodes": 0, "relationships": 0},
+ return_value=SYNC_RESULT_EMPTY,
)
@patch(
"tasks.jobs.attack_paths.scan.graph_database.drop_subgraph",
@@ -855,11 +961,11 @@ class TestAttackPathsRun:
@patch("tasks.jobs.attack_paths.scan.indexes.create_findings_indexes")
@patch("tasks.jobs.attack_paths.scan.cartography_ontology.run")
@patch("tasks.jobs.attack_paths.scan.cartography_analysis.run")
- @patch("tasks.jobs.attack_paths.scan.cartography_create_indexes.run")
+ @patch("tasks.jobs.attack_paths.indexes.cartography_create_indexes.run")
@patch("tasks.jobs.attack_paths.scan.graph_database.clear_cache")
@patch("tasks.jobs.attack_paths.scan.graph_database.create_database")
@patch(
- "tasks.jobs.attack_paths.scan.graph_database.get_uri",
+ "tasks.jobs.attack_paths.scan.graph_database.get_ingest_uri",
return_value="bolt://neo4j",
)
@patch(
@@ -873,7 +979,7 @@ class TestAttackPathsRun:
def test_recovery_failure_does_not_suppress_original_exception(
self,
mock_init_provider,
- mock_get_uri,
+ mock_get_ingest_uri,
mock_create_db,
mock_clear_cache,
mock_cartography_indexes,
@@ -894,16 +1000,12 @@ class TestAttackPathsRun:
mock_event_loop,
mock_stringify,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -991,17 +1093,13 @@ class TestAttackPathsRun:
@pytest.mark.django_db
class TestFailAttackPathsScan:
def test_marks_executing_scan_as_failed(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import fail_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1033,17 +1131,13 @@ class TestFailAttackPathsScan:
}
def test_drops_temp_database_even_when_drop_fails(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import fail_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1069,17 +1163,13 @@ class TestFailAttackPathsScan:
assert attack_paths_scan.state == StateChoices.FAILED
def test_skips_already_failed_scan(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import fail_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1116,17 +1206,13 @@ class TestFailAttackPathsScan:
fail_attack_paths_scan(str(tenant.id), "nonexistent", "setup exploded")
def test_fail_recovers_graph_data_ready_when_data_exists(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture, sink_backend_stub
):
from tasks.jobs.attack_paths.db_utils import fail_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1135,16 +1221,18 @@ class TestFailAttackPathsScan:
state=StateChoices.EXECUTING,
)
+ # `recover_graph_data_ready` routes `has_provider_data` through
+ # `sink_module.get_backend_for_scan(scan)`. With `is_migrated=False`
+ # and the default `ATTACK_PATHS_SINK_DATABASE=neo4j`, the factory
+ # returns the active backend, which `sink_backend_stub` replaces.
+ sink_backend_stub.has_provider_data.return_value = True
+
with (
patch(
"tasks.jobs.attack_paths.db_utils.retrieve_attack_paths_scan",
return_value=attack_paths_scan,
),
patch("tasks.jobs.attack_paths.db_utils.graph_database.drop_database"),
- patch(
- "tasks.jobs.attack_paths.db_utils.graph_database.has_provider_data",
- return_value=True,
- ),
patch(
"tasks.jobs.attack_paths.db_utils.set_provider_graph_data_ready"
) as mock_set_ready,
@@ -1154,17 +1242,13 @@ class TestFailAttackPathsScan:
mock_set_ready.assert_called_once_with(attack_paths_scan, True)
def test_fail_leaves_graph_data_ready_false_when_no_data(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture, sink_backend_stub
):
from tasks.jobs.attack_paths.db_utils import fail_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1173,16 +1257,14 @@ class TestFailAttackPathsScan:
state=StateChoices.EXECUTING,
)
+ sink_backend_stub.has_provider_data.return_value = False
+
with (
patch(
"tasks.jobs.attack_paths.db_utils.retrieve_attack_paths_scan",
return_value=attack_paths_scan,
),
patch("tasks.jobs.attack_paths.db_utils.graph_database.drop_database"),
- patch(
- "tasks.jobs.attack_paths.db_utils.graph_database.has_provider_data",
- return_value=False,
- ),
patch(
"tasks.jobs.attack_paths.db_utils.set_provider_graph_data_ready"
) as mock_set_ready,
@@ -1192,17 +1274,13 @@ class TestFailAttackPathsScan:
mock_set_ready.assert_not_called()
def test_recover_graph_data_ready_never_raises(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import recover_graph_data_ready
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -1238,6 +1316,33 @@ class TestAttackPathsScanRLSTaskOnFailure:
mock_fail.assert_called_once_with("t-1", "s-1", "boom")
+ def test_on_failure_logs_provider_deletion_as_warning(self):
+ from tasks.tasks import AttackPathsScanRLSTask
+
+ task = AttackPathsScanRLSTask()
+ error = ProviderDeletedException("provider deleted")
+
+ with (
+ patch("tasks.tasks.logger") as mock_logger,
+ patch(
+ "tasks.tasks.attack_paths_db_utils.fail_attack_paths_scan"
+ ) as mock_fail,
+ ):
+ task.on_failure(
+ exc=error,
+ task_id="task-abc",
+ args=(),
+ kwargs={"tenant_id": "t-1", "scan_id": "s-1"},
+ _einfo=None,
+ )
+
+ mock_logger.warning.assert_called_once_with(
+ "Attack paths scan task task-abc stopped because its provider or tenant "
+ "was deleted: provider deleted"
+ )
+ mock_logger.error.assert_not_called()
+ mock_fail.assert_called_once_with("t-1", "s-1", "provider deleted")
+
def test_on_failure_skips_when_missing_kwargs(self):
from tasks.tasks import AttackPathsScanRLSTask
@@ -1271,10 +1376,22 @@ class TestAttackPathsFindingsHelpers:
[call(mock_session, stmt) for stmt in FINDINGS_INDEX_STATEMENTS]
)
- def test_load_findings_batches_requests(self, providers_fixture):
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ def test_create_findings_indexes_runs_even_when_sink_is_neptune(self, settings):
+ # The index helpers run against the temp ingest DB, which is always
+ # Neo4j regardless of the configured sink. A Neptune sink must not
+ # suppress index creation on that DB (regression for the dropped
+ # in-helper sink gate).
+ settings.ATTACK_PATHS_SINK_DATABASE = "neptune"
+ mock_session = MagicMock()
+ with patch("tasks.jobs.attack_paths.indexes.run_write_query") as mock_run_write:
+ indexes_module.create_findings_indexes(mock_session)
+
+ from tasks.jobs.attack_paths.indexes import FINDINGS_INDEX_STATEMENTS
+
+ assert mock_run_write.call_count == len(FINDINGS_INDEX_STATEMENTS)
+
+ def test_load_findings_batches_requests(self, aws_provider):
+ provider = aws_provider
# Create a generator that yields two batches of dicts (pre-converted)
def findings_generator():
@@ -1322,12 +1439,10 @@ class TestAttackPathsFindingsHelpers:
def test_stream_findings_with_resources_returns_latest_scan_data(
self,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
resource = Resource.objects.create(
tenant_id=tenant.id,
@@ -1426,13 +1541,11 @@ class TestAttackPathsFindingsHelpers:
def test_enrich_batch_with_resources_single_resource(
self,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
"""One finding + one resource = one output dict"""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
resource = Resource.objects.create(
tenant_id=tenant.id,
@@ -1510,13 +1623,11 @@ class TestAttackPathsFindingsHelpers:
def test_enrich_batch_with_resources_multiple_resources(
self,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
"""One finding + three resources = three output dicts"""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
resources = []
for i in range(3):
@@ -1602,13 +1713,11 @@ class TestAttackPathsFindingsHelpers:
def test_enrich_batch_with_resources_no_resources_skips(
self,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
"""Finding without resources should be skipped"""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = Scan.objects.create(
name="Test Scan",
@@ -1667,11 +1776,9 @@ class TestAttackPathsFindingsHelpers:
assert len(result) == 0
mock_logger.warning.assert_not_called()
- def test_generator_is_lazy(self, providers_fixture):
+ def test_generator_is_lazy(self, aws_provider):
"""Generator should not execute queries until iterated"""
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan_id = "some-scan-id"
with patch("tasks.jobs.attack_paths.findings.rls_transaction") as mock_rls:
@@ -1681,11 +1788,9 @@ class TestAttackPathsFindingsHelpers:
# Nothing should be called yet
mock_rls.assert_not_called()
- def test_load_findings_empty_generator(self, providers_fixture):
+ def test_load_findings_empty_generator(self, aws_provider):
"""Empty generator should not call neo4j"""
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
mock_session = MagicMock()
config = SimpleNamespace(update_tag=12345)
@@ -1801,8 +1906,63 @@ def _make_session_ctx(session, call_order=None, name=None):
return ctx
+class TestBuildChildId:
+ def test_large_value_is_hashed_and_preserved_as_child_data(self):
+ value = "x" * 22_796
+ spec = sync_module.NormalizedList(
+ "SomeLabel",
+ "values",
+ "SomeLabelValuesItem",
+ "HAS_VALUES",
+ )
+ record = {
+ "element_id": "elem-1",
+ "labels": ["SomeLabel"],
+ "props": {"values": [value]},
+ }
+
+ _, parent, children, relationships = sync_module._node_to_sync_dict(
+ record,
+ "prov-1",
+ sync_module._build_catalog_index([spec]),
+ )
+
+ child = children[0]["row"]
+ child_id = child["provider_element_id"]
+ prefix = "prov-1::SomeLabelValuesItem::"
+ assert parent["provider_element_id"] == "prov-1:elem-1"
+ assert child["props"]["value"] == value
+ assert len(child_id) == len(prefix) + 64
+ assert value not in child_id
+ assert relationships[0]["row"]["end_element_id"] == child_id
+
+ @pytest.mark.parametrize(
+ ("provider_id", "child_label", "value_key"),
+ [
+ ("prov-2", "ChildLabel", "value"),
+ ("prov-1", "OtherChildLabel", "value"),
+ ("prov-1", "ChildLabel", "other-value"),
+ ],
+ )
+ def test_each_identity_component_changes_id(
+ self, provider_id, child_label, value_key
+ ):
+ child_id = sync_module._build_child_id("prov-1", "ChildLabel", "value")
+
+ assert sync_module._build_child_id("prov-1", "ChildLabel", "value") == child_id
+ assert (
+ sync_module._build_child_id(provider_id, child_label, value_key) != child_id
+ )
+
+
class TestSyncNodes:
- def test_sync_nodes_adds_private_label(self):
+ def test_iter_sink_batches_rejects_zero_batch_size(self):
+ with pytest.raises(
+ ValueError, match="Sink batch size must be greater than zero"
+ ):
+ list(sync_module._iter_sink_batches([], batch_size=0))
+
+ def test_sync_nodes_passes_isolation_labels_to_sink(self):
row = {
"internal_id": 1,
"element_id": "elem-1",
@@ -1812,29 +1972,32 @@ class TestSyncNodes:
mock_source_1 = MagicMock()
mock_source_1.run.return_value = [row]
- mock_target = MagicMock()
mock_source_2 = MagicMock()
mock_source_2.run.return_value = []
+ sink = MagicMock(sync_batch_size=1000)
with patch(
"tasks.jobs.attack_paths.sync.graph_database.get_session",
side_effect=[
_make_session_ctx(mock_source_1),
- _make_session_ctx(mock_target),
_make_session_ctx(mock_source_2),
],
):
- total = sync_module.sync_nodes(
- "source-db", "target-db", "tenant-1", "prov-1"
+ result = sync_module.sync_nodes(
+ "source-db", "target-db", "tenant-1", "prov-1", sink, []
)
- assert total == 1
- query = mock_target.run.call_args.args[0]
- assert "_ProviderResource" in query
- assert "_Tenant_tenant1" in query
- assert "_Provider_prov1" in query
+ assert result["parents"] == 1
+ sink.write_nodes.assert_called_once()
+ target_db, labels, batch = sink.write_nodes.call_args.args
+ assert target_db == "target-db"
+ assert "_ProviderResource" in labels
+ assert "_Tenant_tenant1" in labels
+ assert "_Provider_prov1" in labels
+ assert batch[0]["provider_element_id"] == "prov-1:elem-1"
+ assert batch[0]["props"] == {"key": "value"}
- def test_sync_nodes_source_closes_before_target_opens(self):
+ def test_sync_nodes_writes_after_source_session_closes(self):
row = {
"internal_id": 1,
"element_id": "elem-1",
@@ -1846,21 +2009,23 @@ class TestSyncNodes:
src_1 = MagicMock()
src_1.run.return_value = [row]
- tgt = MagicMock()
src_2 = MagicMock()
src_2.run.return_value = []
+ sink = MagicMock(sync_batch_size=1000)
+ sink.write_nodes.side_effect = lambda *_a, **_kw: call_order.append(
+ "sink:write"
+ )
with patch(
"tasks.jobs.attack_paths.sync.graph_database.get_session",
side_effect=[
_make_session_ctx(src_1, call_order, "source1"),
- _make_session_ctx(tgt, call_order, "target"),
_make_session_ctx(src_2, call_order, "source2"),
],
):
- sync_module.sync_nodes("src-db", "tgt-db", "t-1", "p-1")
+ sync_module.sync_nodes("src-db", "tgt-db", "t-1", "p-1", sink, [])
- assert call_order.index("source1:exit") < call_order.index("target:enter")
+ assert call_order.index("source1:exit") < call_order.index("sink:write")
def test_sync_nodes_pagination_with_batch_size_1(self):
row_a = {
@@ -1882,44 +2047,83 @@ class TestSyncNodes:
src_2.run.return_value = [row_b]
src_3 = MagicMock()
src_3.run.return_value = []
- tgt_1 = MagicMock()
- tgt_2 = MagicMock()
+ sink = MagicMock(sync_batch_size=1)
- with (
- patch(
- "tasks.jobs.attack_paths.sync.graph_database.get_session",
- side_effect=[
- _make_session_ctx(src_1),
- _make_session_ctx(tgt_1),
- _make_session_ctx(src_2),
- _make_session_ctx(tgt_2),
- _make_session_ctx(src_3),
- ],
- ),
- patch("tasks.jobs.attack_paths.sync.SYNC_BATCH_SIZE", 1),
+ with patch(
+ "tasks.jobs.attack_paths.sync.graph_database.get_session",
+ side_effect=[
+ _make_session_ctx(src_1),
+ _make_session_ctx(src_2),
+ _make_session_ctx(src_3),
+ ],
):
- total = sync_module.sync_nodes("src", "tgt", "t-1", "p-1")
+ result = sync_module.sync_nodes("src", "tgt", "t-1", "p-1", sink, [])
- assert total == 2
+ assert result["parents"] == 2
+ assert sink.write_nodes.call_count == 2
assert src_1.run.call_args.args[1]["last_id"] == -1
assert src_2.run.call_args.args[1]["last_id"] == 1
+ def test_sync_nodes_chunks_expanded_list_rows_before_sink_write(self):
+ row = {
+ "internal_id": 1,
+ "element_id": "elem-1",
+ "labels": ["SomeLabel"],
+ "props": {"values": ["a", "b", "c", "d", "e"]},
+ }
+ normalized_lists = [
+ sync_module.NormalizedList(
+ "SomeLabel",
+ "values",
+ "SomeLabelValuesItem",
+ "HAS_VALUES",
+ )
+ ]
+
+ src_1 = MagicMock()
+ src_1.run.return_value = [row]
+ src_2 = MagicMock()
+ src_2.run.return_value = []
+ sink = MagicMock(sync_batch_size=2)
+
+ with patch(
+ "tasks.jobs.attack_paths.sync.graph_database.get_session",
+ side_effect=[
+ _make_session_ctx(src_1),
+ _make_session_ctx(src_2),
+ ],
+ ):
+ result = sync_module.sync_nodes(
+ "src", "tgt", "t-1", "p-1", sink, normalized_lists
+ )
+
+ assert result == {"parents": 1, "children": 5, "parent_child_rels": 5}
+ assert [
+ len(call_args.args[2]) for call_args in sink.write_nodes.call_args_list[1:]
+ ] == [2, 2, 1]
+ assert [
+ len(call_args.args[3])
+ for call_args in sink.write_relationships.call_args_list
+ ] == [2, 2, 1]
+
def test_sync_nodes_empty_source_returns_zero(self):
src = MagicMock()
src.run.return_value = []
+ sink = MagicMock(sync_batch_size=1000)
with patch(
"tasks.jobs.attack_paths.sync.graph_database.get_session",
side_effect=[_make_session_ctx(src)],
) as mock_get_session:
- total = sync_module.sync_nodes("src", "tgt", "t-1", "p-1")
+ result = sync_module.sync_nodes("src", "tgt", "t-1", "p-1", sink, [])
- assert total == 0
+ assert result["parents"] == 0
assert mock_get_session.call_count == 1
+ sink.write_nodes.assert_not_called()
class TestSyncRelationships:
- def test_sync_relationships_source_closes_before_target_opens(self):
+ def test_sync_relationships_writes_after_source_session_closes(self):
row = {
"internal_id": 1,
"rel_type": "HAS",
@@ -1932,21 +2136,23 @@ class TestSyncRelationships:
src_1 = MagicMock()
src_1.run.return_value = [row]
- tgt = MagicMock()
src_2 = MagicMock()
src_2.run.return_value = []
+ sink = MagicMock(sync_batch_size=1000)
+ sink.write_relationships.side_effect = lambda *_a, **_kw: call_order.append(
+ "sink:write"
+ )
with patch(
"tasks.jobs.attack_paths.sync.graph_database.get_session",
side_effect=[
_make_session_ctx(src_1, call_order, "source1"),
- _make_session_ctx(tgt, call_order, "target"),
_make_session_ctx(src_2, call_order, "source2"),
],
):
- sync_module.sync_relationships("src", "tgt", "p-1")
+ sync_module.sync_relationships("src", "tgt", "p-1", sink)
- assert call_order.index("source1:exit") < call_order.index("target:enter")
+ assert call_order.index("source1:exit") < call_order.index("sink:write")
def test_sync_relationships_pagination_with_batch_size_1(self):
row_a = {
@@ -1970,40 +2176,70 @@ class TestSyncRelationships:
src_2.run.return_value = [row_b]
src_3 = MagicMock()
src_3.run.return_value = []
- tgt_1 = MagicMock()
- tgt_2 = MagicMock()
+ sink = MagicMock(sync_batch_size=1)
- with (
- patch(
- "tasks.jobs.attack_paths.sync.graph_database.get_session",
- side_effect=[
- _make_session_ctx(src_1),
- _make_session_ctx(tgt_1),
- _make_session_ctx(src_2),
- _make_session_ctx(tgt_2),
- _make_session_ctx(src_3),
- ],
- ),
- patch("tasks.jobs.attack_paths.sync.SYNC_BATCH_SIZE", 1),
+ with patch(
+ "tasks.jobs.attack_paths.sync.graph_database.get_session",
+ side_effect=[
+ _make_session_ctx(src_1),
+ _make_session_ctx(src_2),
+ _make_session_ctx(src_3),
+ ],
):
- total = sync_module.sync_relationships("src", "tgt", "p-1")
+ total = sync_module.sync_relationships("src", "tgt", "p-1", sink)
assert total == 2
+ assert sink.write_relationships.call_count == 2
assert src_1.run.call_args.args[1]["last_id"] == -1
assert src_2.run.call_args.args[1]["last_id"] == 1
+ def test_sync_relationships_chunks_grouped_rows_before_sink_write(self):
+ rows = [
+ {
+ "internal_id": idx,
+ "rel_type": "HAS",
+ "start_element_id": f"s-{idx}",
+ "end_element_id": f"e-{idx}",
+ "props": {},
+ }
+ for idx in range(1, 6)
+ ]
+
+ src_1 = MagicMock()
+ src_1.run.return_value = rows
+ src_2 = MagicMock()
+ src_2.run.return_value = []
+ sink = MagicMock(sync_batch_size=2)
+
+ with patch(
+ "tasks.jobs.attack_paths.sync.graph_database.get_session",
+ side_effect=[
+ _make_session_ctx(src_1),
+ _make_session_ctx(src_2),
+ ],
+ ):
+ total = sync_module.sync_relationships("src", "tgt", "p-1", sink)
+
+ assert total == 5
+ assert [
+ len(call_args.args[3])
+ for call_args in sink.write_relationships.call_args_list
+ ] == [2, 2, 1]
+
def test_sync_relationships_empty_source_returns_zero(self):
src = MagicMock()
src.run.return_value = []
+ sink = MagicMock(sync_batch_size=1000)
with patch(
"tasks.jobs.attack_paths.sync.graph_database.get_session",
side_effect=[_make_session_ctx(src)],
) as mock_get_session:
- total = sync_module.sync_relationships("src", "tgt", "p-1")
+ total = sync_module.sync_relationships("src", "tgt", "p-1", sink)
assert total == 0
assert mock_get_session.call_count == 1
+ sink.write_relationships.assert_not_called()
class TestInternetAnalysis:
@@ -2052,18 +2288,62 @@ class TestInternetAnalysis:
class TestAttackPathsDbUtilsGraphDataReady:
"""Tests for db_utils functions related to graph_data_ready lifecycle."""
+ def test_database_defaults_allow_legacy_insert_without_cutover_columns(
+ self, tenants_fixture, aws_provider, scans_fixture
+ ):
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ scan = scans_fixture[0]
+
+ attack_paths_scan_id = uuid4()
+ now = datetime.now(tz=UTC)
+
+ with rls_transaction(str(tenant.id), using=DEFAULT_DB_ALIAS) as cursor:
+ cursor.execute(
+ """
+ INSERT INTO attack_paths_scans (
+ id,
+ inserted_at,
+ updated_at,
+ state,
+ progress,
+ graph_data_ready,
+ started_at,
+ tenant_id,
+ provider_id,
+ scan_id
+ )
+ VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+ """,
+ [
+ attack_paths_scan_id,
+ now,
+ now,
+ StateChoices.SCHEDULED,
+ 0,
+ False,
+ now,
+ tenant.id,
+ provider.id,
+ scan.id,
+ ],
+ )
+
+ attack_paths_scan = AttackPathsScan.objects.get(id=attack_paths_scan_id)
+
+ assert attack_paths_scan.is_migrated is False
+ assert (
+ attack_paths_scan.sink_backend == AttackPathsScan.SinkBackendChoices.NEO4J
+ )
+
def test_create_attack_paths_scan_first_scan_defaults_to_false(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import create_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
with patch(
"tasks.jobs.attack_paths.db_utils.rls_transaction",
@@ -2075,19 +2355,17 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan is not None
assert attack_paths_scan.graph_data_ready is False
+ assert attack_paths_scan.is_migrated is False
+ assert attack_paths_scan.sink_backend == "neo4j"
def test_create_attack_paths_scan_inherits_true_from_previous(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import create_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2095,6 +2373,8 @@ class TestAttackPathsDbUtilsGraphDataReady:
scan=scan,
state=StateChoices.COMPLETED,
graph_data_ready=True,
+ is_migrated=True,
+ sink_backend="neptune",
)
new_scan = Scan.objects.create(
@@ -2115,19 +2395,110 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan is not None
assert attack_paths_scan.graph_data_ready is True
+ # is_migrated tracks the data being served: inherited from the ready scan
+ assert attack_paths_scan.is_migrated is True
+ assert attack_paths_scan.sink_backend == "neptune"
- def test_create_attack_paths_scan_inherits_false_when_no_previous_ready(
- self, tenants_fixture, providers_fixture, scans_fixture
+ def test_create_attack_paths_scan_prefers_active_sink_ready_scan(
+ self, tenants_fixture, aws_provider, scans_fixture, settings
+ ):
+ from tasks.jobs.attack_paths.db_utils import create_attack_paths_scan
+
+ settings.ATTACK_PATHS_SINK_DATABASE = "neo4j"
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ scan = scans_fixture[0]
+
+ AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ is_migrated=False,
+ sink_backend="neo4j",
+ )
+ AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ is_migrated=True,
+ sink_backend="neptune",
+ )
+
+ new_scan = Scan.objects.create(
+ name="New Scan",
+ provider=provider,
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ tenant_id=tenant.id,
+ )
+
+ with patch(
+ "tasks.jobs.attack_paths.db_utils.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ ):
+ attack_paths_scan = create_attack_paths_scan(
+ str(tenant.id), str(new_scan.id), provider.id
+ )
+
+ assert attack_paths_scan is not None
+ assert attack_paths_scan.graph_data_ready is True
+ assert attack_paths_scan.is_migrated is False
+ assert attack_paths_scan.sink_backend == "neo4j"
+
+ def test_create_attack_paths_scan_inherits_is_migrated_false_from_legacy_ready(
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import create_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
+ scan = scans_fixture[0]
+
+ # Previous scan is ready but pre-cutover (legacy Neo4j graph shape)
+ AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ is_migrated=False,
+ sink_backend="neo4j",
+ )
+
+ new_scan = Scan.objects.create(
+ name="New Scan",
+ provider=provider,
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ tenant_id=tenant.id,
+ )
+
+ with patch(
+ "tasks.jobs.attack_paths.db_utils.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ ):
+ attack_paths_scan = create_attack_paths_scan(
+ str(tenant.id), str(new_scan.id), provider.id
+ )
+
+ assert attack_paths_scan is not None
+ assert attack_paths_scan.graph_data_ready is True
+ # Reads stay on the legacy catalog/backend until this scan's own sync
+ assert attack_paths_scan.is_migrated is False
+ assert attack_paths_scan.sink_backend == "neo4j"
+
+ def test_create_attack_paths_scan_inherits_false_when_no_previous_ready(
+ self, tenants_fixture, aws_provider, scans_fixture
+ ):
+ from tasks.jobs.attack_paths.db_utils import create_attack_paths_scan
+
+ tenant = tenants_fixture[0]
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2135,6 +2506,7 @@ class TestAttackPathsDbUtilsGraphDataReady:
scan=scan,
state=StateChoices.FAILED,
graph_data_ready=False,
+ sink_backend="neptune",
)
new_scan = Scan.objects.create(
@@ -2155,19 +2527,17 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan is not None
assert attack_paths_scan.graph_data_ready is False
+ assert attack_paths_scan.is_migrated is False
+ assert attack_paths_scan.sink_backend == "neo4j"
def test_set_graph_data_ready_updates_field(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import set_graph_data_ready
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2196,17 +2566,13 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan.graph_data_ready is True
def test_finish_attack_paths_scan_does_not_modify_graph_data_ready(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import finish_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2227,17 +2593,13 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan.graph_data_ready is True
def test_finish_attack_paths_scan_preserves_graph_data_ready_on_failure(
- self, tenants_fixture, providers_fixture, scans_fixture
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import finish_attack_paths_scan
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan = scans_fixture[0]
- scan.provider = provider
- scan.save()
attack_paths_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2261,19 +2623,15 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert attack_paths_scan.state == StateChoices.FAILED
assert attack_paths_scan.graph_data_ready is True
- def test_set_provider_graph_data_ready_updates_all_scans_for_provider(
- self, tenants_fixture, providers_fixture, scans_fixture
+ def test_set_provider_graph_data_ready_updates_all_scans_for_provider_sink(
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import set_provider_graph_data_ready
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
scan_a = scans_fixture[0]
- scan_a.provider = provider
- scan_a.save()
scan_b = Scan.objects.create(
name="Second Scan",
@@ -2289,6 +2647,7 @@ class TestAttackPathsDbUtilsGraphDataReady:
scan=scan_a,
state=StateChoices.COMPLETED,
graph_data_ready=True,
+ sink_backend="neptune",
)
new_ap_scan = AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2296,6 +2655,7 @@ class TestAttackPathsDbUtilsGraphDataReady:
scan=scan_b,
state=StateChoices.EXECUTING,
graph_data_ready=True,
+ sink_backend="neptune",
)
with patch(
@@ -2309,23 +2669,53 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert old_ap_scan.graph_data_ready is False
assert new_ap_scan.graph_data_ready is False
- def test_set_provider_graph_data_ready_does_not_affect_other_providers(
- self, tenants_fixture, providers_fixture, scans_fixture
+ def test_set_provider_graph_data_ready_preserves_other_sink_scans(
+ self, tenants_fixture, aws_provider, scans_fixture
):
from tasks.jobs.attack_paths.db_utils import set_provider_graph_data_ready
tenant = tenants_fixture[0]
- provider_a = providers_fixture[0]
- provider_a.provider = Provider.ProviderChoices.AWS
- provider_a.save()
+ provider = aws_provider
- provider_b = providers_fixture[1]
- provider_b.provider = Provider.ProviderChoices.AWS
- provider_b.save()
+ scan = scans_fixture[0]
+
+ legacy_scan = AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.COMPLETED,
+ graph_data_ready=True,
+ sink_backend="neo4j",
+ )
+ neptune_scan = AttackPathsScan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ scan=scan,
+ state=StateChoices.EXECUTING,
+ graph_data_ready=True,
+ sink_backend="neptune",
+ )
+
+ with patch(
+ "tasks.jobs.attack_paths.db_utils.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ ):
+ set_provider_graph_data_ready(neptune_scan, False)
+
+ legacy_scan.refresh_from_db()
+ neptune_scan.refresh_from_db()
+ assert legacy_scan.graph_data_ready is True
+ assert neptune_scan.graph_data_ready is False
+
+ def test_set_provider_graph_data_ready_does_not_affect_other_providers(
+ self, tenants_fixture, aws_provider_pair, scans_fixture
+ ):
+ from tasks.jobs.attack_paths.db_utils import set_provider_graph_data_ready
+
+ tenant = tenants_fixture[0]
+ provider_a, provider_b = aws_provider_pair
scan_a = scans_fixture[0]
- scan_a.provider = provider_a
- scan_a.save()
scan_b = Scan.objects.create(
name="Scan for provider B",
@@ -2362,10 +2752,194 @@ class TestAttackPathsDbUtilsGraphDataReady:
assert ap_scan_b.graph_data_ready is True
+class TestAttackPathsWorkerPing:
+ @patch("tasks.jobs.attack_paths.cleanup.current_app")
+ def test_pings_workers_in_parallel_and_retries_only_missing(self, mock_app):
+ from tasks.jobs.attack_paths.cleanup import _ping_workers
+
+ first_ping = MagicMock(return_value={"worker-a@host": {"ok": "pong"}})
+ second_ping = MagicMock(return_value={"worker-b@host": {"ok": "pong"}})
+ third_ping = MagicMock(return_value={"worker-c@host": {"ok": "pong"}})
+ mock_app.control.inspect.side_effect = [
+ MagicMock(ping=first_ping),
+ MagicMock(ping=second_ping),
+ MagicMock(ping=third_ping),
+ ]
+
+ responsive, unresponsive = _ping_workers(
+ {"worker-c@host", "worker-a@host", "worker-b@host"}
+ )
+
+ assert responsive == {
+ "worker-a@host",
+ "worker-b@host",
+ "worker-c@host",
+ }
+ assert unresponsive == set()
+ assert mock_app.control.inspect.call_args_list == [
+ call(
+ destination=["worker-a@host", "worker-b@host", "worker-c@host"],
+ timeout=5,
+ ),
+ call(destination=["worker-b@host", "worker-c@host"], timeout=10),
+ call(destination=["worker-c@host"], timeout=20),
+ ]
+
+ @patch("tasks.jobs.attack_paths.cleanup.logger")
+ @patch("tasks.jobs.attack_paths.cleanup.current_app")
+ def test_retries_intermediate_ping_exceptions(self, mock_app, mock_logger):
+ from tasks.jobs.attack_paths.cleanup import _ping_workers
+
+ mock_app.control.inspect.side_effect = [
+ MagicMock(ping=MagicMock(side_effect=ConnectionError("first"))),
+ MagicMock(ping=MagicMock(side_effect=ConnectionError("second"))),
+ MagicMock(ping=MagicMock(return_value={})),
+ ]
+
+ responsive, unresponsive = _ping_workers({"worker@host"})
+
+ assert responsive == set()
+ assert unresponsive == {"worker@host"}
+ assert mock_logger.warning.call_count == 2
+ assert all(
+ warning.kwargs["exc_info"] is True
+ for warning in mock_logger.warning.call_args_list
+ )
+ mock_logger.exception.assert_not_called()
+
+ @patch("tasks.jobs.attack_paths.cleanup.logger")
+ @patch("tasks.jobs.attack_paths.cleanup.current_app")
+ def test_final_ping_exception_leaves_pending_workers_unknown(
+ self, mock_app, mock_logger
+ ):
+ from tasks.jobs.attack_paths.cleanup import _ping_workers
+
+ mock_app.control.inspect.side_effect = [
+ MagicMock(ping=MagicMock(return_value={"worker-a@host": {"ok": "pong"}})),
+ MagicMock(ping=MagicMock(return_value={})),
+ MagicMock(ping=MagicMock(side_effect=ConnectionError("final"))),
+ ]
+
+ responsive, unresponsive = _ping_workers({"worker-a@host", "worker-b@host"})
+
+ assert responsive == {"worker-a@host"}
+ assert unresponsive is None
+ mock_logger.exception.assert_called_once()
+
+ @patch("tasks.jobs.attack_paths.cleanup.logger")
+ @patch("tasks.jobs.attack_paths.cleanup.current_app")
+ def test_worker_can_respond_after_an_intermediate_exception(
+ self, mock_app, mock_logger
+ ):
+ from tasks.jobs.attack_paths.cleanup import _ping_workers
+
+ mock_app.control.inspect.side_effect = [
+ MagicMock(ping=MagicMock(side_effect=ConnectionError("first"))),
+ MagicMock(ping=MagicMock(side_effect=ConnectionError("second"))),
+ MagicMock(ping=MagicMock(return_value={"worker@host": {"ok": "pong"}})),
+ ]
+
+ responsive, unresponsive = _ping_workers({"worker@host"})
+
+ assert responsive == {"worker@host"}
+ assert unresponsive == set()
+ assert mock_logger.warning.call_count == 2
+ mock_logger.exception.assert_not_called()
+
+
+class TestAttackPathsCleanupTask:
+ @patch(
+ "tasks.tasks.cleanup_stale_attack_paths_scans",
+ return_value={"cleaned_up_count": 1, "scan_ids": ["scan-id"]},
+ )
+ def test_hourly_task_invokes_attack_paths_cleanup(self, mock_cleanup):
+ from tasks.tasks import cleanup_stale_attack_paths_scans_task
+
+ result = cleanup_stale_attack_paths_scans_task.run()
+
+ assert result == {"cleaned_up_count": 1, "scan_ids": ["scan-id"]}
+ mock_cleanup.assert_called_once_with()
+
+
+@pytest.mark.django_db
+class TestAttackPathsDbUtilsActivity:
+ @patch(
+ "tasks.jobs.attack_paths.db_utils.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ def test_starting_scan_refreshes_updated_at(
+ self, tenants_fixture, aws_provider, scans_fixture
+ ):
+ from tasks.jobs.attack_paths.db_utils import starting_attack_paths_scan
+
+ old_updated_at = datetime.now(tz=UTC) - timedelta(hours=1)
+ attack_paths_scan = AttackPathsScan.objects.create(
+ tenant_id=tenants_fixture[0].id,
+ provider=aws_provider,
+ scan=scans_fixture[0],
+ state=StateChoices.SCHEDULED,
+ )
+ AttackPathsScan.objects.filter(id=attack_paths_scan.id).update(
+ updated_at=old_updated_at
+ )
+ attack_paths_scan.refresh_from_db()
+
+ started = starting_attack_paths_scan(
+ attack_paths_scan, SimpleNamespace(update_tag=123)
+ )
+
+ assert attack_paths_scan.updated_at > old_updated_at
+ attack_paths_scan.refresh_from_db()
+ assert started is True
+ assert attack_paths_scan.updated_at > old_updated_at
+
+ @patch(
+ "tasks.jobs.attack_paths.db_utils.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ def test_progress_update_refreshes_updated_at(
+ self, tenants_fixture, aws_provider, scans_fixture
+ ):
+ from tasks.jobs.attack_paths.db_utils import update_attack_paths_scan_progress
+
+ old_updated_at = datetime.now(tz=UTC) - timedelta(hours=1)
+ attack_paths_scan = AttackPathsScan.objects.create(
+ tenant_id=tenants_fixture[0].id,
+ provider=aws_provider,
+ scan=scans_fixture[0],
+ state=StateChoices.EXECUTING,
+ )
+ AttackPathsScan.objects.filter(id=attack_paths_scan.id).update(
+ updated_at=old_updated_at
+ )
+ attack_paths_scan.refresh_from_db()
+
+ update_attack_paths_scan_progress(attack_paths_scan, 42)
+
+ assert attack_paths_scan.updated_at > old_updated_at
+ attack_paths_scan.refresh_from_db()
+ assert attack_paths_scan.progress == 42
+ assert attack_paths_scan.updated_at > old_updated_at
+
+
@pytest.mark.django_db
class TestCleanupStaleAttackPathsScans:
+ @pytest.fixture(autouse=True)
+ def execute_on_commit_callbacks(self):
+ with patch(
+ "tasks.jobs.attack_paths.cleanup.on_commit",
+ side_effect=lambda callback, **kwargs: callback(),
+ ):
+ yield
+
def _create_executing_scan(
- self, tenant, provider, scan=None, started_at=None, worker=None
+ self,
+ tenant,
+ provider,
+ scan=None,
+ started_at=None,
+ updated_at=None,
+ worker=None,
):
"""Helper to create an EXECUTING AttackPathsScan with optional Task+TaskResult."""
ap_scan = AttackPathsScan.objects.create(
@@ -2392,40 +2966,106 @@ class TestCleanupStaleAttackPathsScans:
ap_scan.task = task
ap_scan.save(update_fields=["task_id"])
+ if updated_at is not None:
+ AttackPathsScan.objects.filter(id=ap_scan.id).update(updated_at=updated_at)
+ ap_scan.updated_at = updated_at
+
return ap_scan, task_result
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ def test_defers_revoke_until_scan_failure_is_persisted(
+ self,
+ mock_revoke,
+ tenants_fixture,
+ aws_provider,
+ ):
+ from tasks.jobs.attack_paths.cleanup import _finalize_failed_scan
+
+ ap_scan, task_result = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ worker="unresponsive-worker@host",
+ )
+
+ with patch("tasks.jobs.attack_paths.cleanup.on_commit") as mock_on_commit:
+ finalized_scan = _finalize_failed_scan(
+ ap_scan,
+ StateChoices.EXECUTING,
+ "Cleanup reason",
+ task_result=task_result,
+ revoke=True,
+ )
+
+ assert finalized_scan is not None
+ ap_scan.refresh_from_db()
+ task_result.refresh_from_db()
+ assert ap_scan.state == StateChoices.FAILED
+ assert task_result.status == "FAILURE"
+ mock_revoke.assert_not_called()
+ mock_on_commit.assert_called_once()
+ assert mock_on_commit.call_args.kwargs == {"using": DEFAULT_DB_ALIAS}
+
+ callback = mock_on_commit.call_args.args[0]
+ callback()
+
+ mock_revoke.assert_called_once_with(task_result, terminate=True)
+
@patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
@patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
@patch(
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=False)
- def test_cleans_up_scan_with_dead_worker(
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_cleans_up_inactive_scan_with_unresponsive_worker(
self,
- mock_alive,
+ mock_ping,
+ mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+ from tasks.jobs.attack_paths.db_utils import mark_scan_finished
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
- # Recent scan — should still be cleaned up because worker is dead
+ updated_at = datetime.now(tz=UTC) - timedelta(minutes=31)
ap_scan, task_result = self._create_executing_scan(
- tenant, provider, worker="dead-worker@host"
+ tenant,
+ provider,
+ updated_at=updated_at,
+ worker="unresponsive-worker@host",
)
+ mock_ping.return_value = (set(), {"unresponsive-worker@host"})
- result = cleanup_stale_attack_paths_scans()
+ with patch(
+ "tasks.jobs.attack_paths.cleanup.mark_scan_finished",
+ wraps=mark_scan_finished,
+ ) as mock_mark_failed:
+ call_order = MagicMock()
+ call_order.attach_mock(mock_revoke, "revoke")
+ call_order.attach_mock(mock_mark_failed, "mark_failed")
+ call_order.attach_mock(mock_drop_db, "drop_database")
+
+ result = cleanup_stale_attack_paths_scans()
assert result["cleaned_up_count"] == 1
assert str(ap_scan.id) in result["scan_ids"]
+ assert [entry[0] for entry in call_order.mock_calls] == [
+ "mark_failed",
+ "revoke",
+ "drop_database",
+ ]
+ mock_revoke.assert_called_once_with(task_result, terminate=True)
mock_drop_db.assert_called_once()
mock_recover.assert_called_once()
@@ -2434,7 +3074,10 @@ class TestCleanupStaleAttackPathsScans:
assert ap_scan.progress == 100
assert ap_scan.completed_at is not None
assert ap_scan.ingestion_exceptions == {
- "global_error": "Worker dead — cleaned up by periodic task"
+ "global_error": (
+ "Worker unresponsive and scan inactive for 30 minutes - "
+ "cleaned up by periodic task"
+ )
}
task_result.refresh_from_db()
@@ -2448,63 +3091,115 @@ class TestCleanupStaleAttackPathsScans:
new=lambda *args, **kwargs: nullcontext(),
)
@patch("tasks.jobs.attack_paths.cleanup._revoke_task")
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=True)
- def test_revokes_and_cleans_scan_exceeding_threshold_on_live_worker(
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_revokes_and_cleans_scan_exceeding_threshold_on_responsive_worker(
self,
- mock_alive,
+ mock_ping,
mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
old_start = datetime.now(tz=UTC) - timedelta(hours=49)
ap_scan, task_result = self._create_executing_scan(
tenant, provider, started_at=old_start, worker="live-worker@host"
)
+ mock_ping.return_value = ({"live-worker@host"}, set())
result = cleanup_stale_attack_paths_scans()
assert result["cleaned_up_count"] == 1
- mock_revoke.assert_called_once_with(task_result)
+ mock_revoke.assert_called_once_with(task_result, terminate=True)
mock_recover.assert_called_once()
ap_scan.refresh_from_db()
assert ap_scan.state == StateChoices.FAILED
+ @pytest.mark.parametrize(
+ ("age_seconds", "should_clean"),
+ [
+ (960 * 60 - 1, False),
+ (960 * 60, False),
+ (960 * 60 + 1, True),
+ ],
+ )
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_stale_threshold_boundary_is_strict(
+ self,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ age_seconds,
+ should_clean,
+ tenants_fixture,
+ aws_provider,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ now = datetime.now(tz=UTC)
+ ap_scan, task_result = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ started_at=now - timedelta(seconds=age_seconds),
+ worker="live-worker@host",
+ )
+ mock_ping.return_value = ({"live-worker@host"}, set())
+
+ with patch("tasks.jobs.attack_paths.cleanup.datetime") as mock_datetime:
+ mock_datetime.now.return_value = now
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == int(should_clean)
+ ap_scan.refresh_from_db()
+ expected_state = StateChoices.FAILED if should_clean else StateChoices.EXECUTING
+ assert ap_scan.state == expected_state
+ if should_clean:
+ mock_revoke.assert_called_once_with(task_result, terminate=True)
+ mock_drop_db.assert_called_once()
+ mock_recover.assert_called_once()
+ else:
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
@patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
@patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
@patch(
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=True)
- def test_ignores_recent_executing_scans_on_live_worker(
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_ignores_recent_executing_scans_on_responsive_worker(
self,
- mock_alive,
+ mock_ping,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
- # Recent scan on live worker — should be skipped
self._create_executing_scan(tenant, provider, worker="live-worker@host")
+ mock_ping.return_value = ({"live-worker@host"}, set())
result = cleanup_stale_attack_paths_scans()
@@ -2512,6 +3207,130 @@ class TestCleanupStaleAttackPathsScans:
mock_drop_db.assert_not_called()
mock_recover.assert_not_called()
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_preserves_recent_scan_on_unresponsive_worker(
+ self,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(minutes=29),
+ worker="unresponsive-worker@host",
+ )
+ mock_ping.return_value = (set(), {"unresponsive-worker@host"})
+
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers", return_value=(set(), None))
+ def test_final_ping_exception_preserves_pending_worker_scan(
+ self,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ ap_scan, _ = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(hours=1),
+ worker="unknown-worker@host",
+ )
+
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ mock_ping.assert_called_once_with({"unknown-worker@host"})
+ ap_scan.refresh_from_db()
+ assert ap_scan.state == StateChoices.EXECUTING
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
+ @pytest.mark.parametrize(
+ ("inactive_seconds", "should_clean"),
+ [(29 * 60 + 59, False), (30 * 60, False), (30 * 60 + 1, True)],
+ )
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_inactivity_boundary_is_strict(
+ self,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ inactive_seconds,
+ should_clean,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ now = datetime.now(tz=UTC)
+ ap_scan, task_result = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=now - timedelta(seconds=inactive_seconds),
+ worker="unresponsive-worker@host",
+ )
+ mock_ping.return_value = (set(), {"unresponsive-worker@host"})
+
+ with patch("tasks.jobs.attack_paths.cleanup.datetime") as mock_datetime:
+ mock_datetime.now.return_value = now
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == int(should_clean)
+ ap_scan.refresh_from_db()
+ expected_state = StateChoices.FAILED if should_clean else StateChoices.EXECUTING
+ assert ap_scan.state == expected_state
+ if should_clean:
+ mock_revoke.assert_called_once_with(task_result, terminate=True)
+ mock_drop_db.assert_called_once()
+ mock_recover.assert_called_once()
+ else:
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
@patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
@patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
@patch(
@@ -2523,15 +3342,13 @@ class TestCleanupStaleAttackPathsScans:
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
AttackPathsScan.objects.create(
tenant_id=tenant.id,
@@ -2552,35 +3369,100 @@ class TestCleanupStaleAttackPathsScans:
@patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
@patch(
"tasks.jobs.attack_paths.cleanup.graph_database.drop_database",
- side_effect=Exception("Neo4j unreachable"),
+ side_effect=[Exception("Neo4j unreachable"), None],
)
@patch(
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=False)
- def test_handles_drop_database_failure_gracefully(
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ @patch("tasks.jobs.attack_paths.cleanup.logger")
+ def test_neo4j_failure_leaves_scan_failed_and_continues(
self,
- mock_alive,
+ mock_logger,
+ mock_ping,
+ mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
- self._create_executing_scan(tenant, provider, worker="dead-worker@host")
+ updated_at = datetime.now(tz=UTC) - timedelta(minutes=31)
+ ap_scan_1, _ = self._create_executing_scan(
+ tenant,
+ provider,
+ updated_at=updated_at,
+ worker="unresponsive-worker-1@host",
+ )
+ ap_scan_2, _ = self._create_executing_scan(
+ tenant,
+ provider,
+ updated_at=updated_at,
+ worker="unresponsive-worker-2@host",
+ )
+ mock_ping.return_value = (
+ set(),
+ {"unresponsive-worker-1@host", "unresponsive-worker-2@host"},
+ )
result = cleanup_stale_attack_paths_scans()
- assert result["cleaned_up_count"] == 1
- mock_drop_db.assert_called_once()
+ assert result["cleaned_up_count"] == 2
+ assert mock_revoke.call_count == 2
+ assert mock_drop_db.call_count == 2
+ mock_logger.exception.assert_called_once()
+ ap_scan_1.refresh_from_db()
+ ap_scan_2.refresh_from_db()
+ assert ap_scan_1.state == StateChoices.FAILED
+ assert ap_scan_2.state == StateChoices.FAILED
+
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.mark_scan_finished",
+ side_effect=DatabaseError("PostgreSQL unavailable"),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup.logger")
+ def test_postgresql_failure_prevents_revoke_and_neo4j_deletion(
+ self,
+ mock_logger,
+ mock_mark_failed,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(minutes=31),
+ worker="unresponsive-worker@host",
+ )
+ mock_ping.return_value = (set(), {"unresponsive-worker@host"})
+
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ mock_mark_failed.assert_called_once()
+ mock_logger.exception.assert_called_once()
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
@patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
@patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
@@ -2588,22 +3470,22 @@ class TestCleanupStaleAttackPathsScans:
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=False)
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
def test_cross_tenant_cleanup(
self,
- mock_alive,
+ mock_ping,
+ mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant1 = tenants_fixture[0]
tenant2 = tenants_fixture[1]
- provider1 = providers_fixture[0]
- provider1.provider = Provider.ProviderChoices.AWS
- provider1.save()
+ provider1 = aws_provider
provider2 = Provider.objects.create(
provider="aws",
@@ -2612,16 +3494,28 @@ class TestCleanupStaleAttackPathsScans:
tenant_id=tenant2.id,
)
+ updated_at = datetime.now(tz=UTC) - timedelta(minutes=31)
ap_scan1, _ = self._create_executing_scan(
- tenant1, provider1, worker="dead-worker-1@host"
+ tenant1,
+ provider1,
+ updated_at=updated_at,
+ worker="unresponsive-worker-1@host",
)
ap_scan2, _ = self._create_executing_scan(
- tenant2, provider2, worker="dead-worker-2@host"
+ tenant2,
+ provider2,
+ updated_at=updated_at,
+ worker="unresponsive-worker-2@host",
+ )
+ mock_ping.return_value = (
+ set(),
+ {"unresponsive-worker-1@host", "unresponsive-worker-2@host"},
)
result = cleanup_stale_attack_paths_scans()
assert result["cleaned_up_count"] == 2
+ assert mock_revoke.call_count == 2
assert mock_recover.call_count == 2
ap_scan1.refresh_from_db()
@@ -2635,29 +3529,34 @@ class TestCleanupStaleAttackPathsScans:
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=False)
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
def test_recovers_graph_data_ready_for_stale_scan(
self,
- mock_alive,
+ mock_ping,
+ mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
ap_scan, _ = self._create_executing_scan(
- tenant, provider, worker="dead-worker@host"
+ tenant,
+ provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(minutes=31),
+ worker="unresponsive-worker@host",
)
+ mock_ping.return_value = (set(), {"unresponsive-worker@host"})
cleanup_stale_attack_paths_scans()
+ mock_revoke.assert_called_once()
mock_recover.assert_called_once()
recovered_scan = mock_recover.call_args[0][0]
assert recovered_scan.id == ap_scan.id
@@ -2673,15 +3572,13 @@ class TestCleanupStaleAttackPathsScans:
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
# Old scan with no Task/TaskResult
old_start = datetime.now(tz=UTC) - timedelta(hours=49)
@@ -2705,32 +3602,176 @@ class TestCleanupStaleAttackPathsScans:
"tasks.jobs.attack_paths.cleanup.rls_transaction",
new=lambda *args, **kwargs: nullcontext(),
)
- @patch("tasks.jobs.attack_paths.cleanup._is_worker_alive", return_value=False)
- def test_shared_worker_is_pinged_only_once(
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_preserves_scans_without_a_started_at_timestamp(
self,
- mock_alive,
+ mock_ping,
+ mock_revoke,
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ responsive_scan, _ = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ worker="responsive-worker@host",
+ )
+ AttackPathsScan.objects.filter(id=responsive_scan.id).update(started_at=None)
+ no_worker_scan = AttackPathsScan.objects.create(
+ tenant_id=tenants_fixture[0].id,
+ provider=aws_provider,
+ state=StateChoices.EXECUTING,
+ started_at=None,
+ )
+ mock_ping.return_value = ({"responsive-worker@host"}, set())
+
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ responsive_scan.refresh_from_db()
+ no_worker_scan.refresh_from_db()
+ assert responsive_scan.state == StateChoices.EXECUTING
+ assert no_worker_scan.state == StateChoices.EXECUTING
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ @patch("tasks.jobs.attack_paths.cleanup._ping_workers")
+ def test_shared_worker_is_collected_only_once(
+ self,
+ mock_ping,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ tenants_fixture,
+ aws_provider,
scans_fixture,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
- # Two scans on the same dead worker
- self._create_executing_scan(tenant, provider, worker="shared-worker@host")
- self._create_executing_scan(tenant, provider, worker="shared-worker@host")
+ updated_at = datetime.now(tz=UTC) - timedelta(minutes=31)
+ self._create_executing_scan(
+ tenant,
+ provider,
+ updated_at=updated_at,
+ worker="shared-worker@host",
+ )
+ self._create_executing_scan(
+ tenant,
+ provider,
+ updated_at=updated_at,
+ worker="shared-worker@host",
+ )
+ mock_ping.return_value = (set(), {"shared-worker@host"})
result = cleanup_stale_attack_paths_scans()
assert result["cleaned_up_count"] == 2
- # Worker should be pinged exactly once — cache prevents second ping
- mock_alive.assert_called_once_with("shared-worker@host")
+ assert mock_revoke.call_count == 2
+ mock_ping.assert_called_once_with({"shared-worker@host"})
+
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ def test_locked_recheck_preserves_scan_with_new_activity(
+ self,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ ap_scan, _ = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(minutes=31),
+ worker="unresponsive-worker@host",
+ )
+
+ def record_activity(_workers):
+ AttackPathsScan.objects.filter(id=ap_scan.id).update(
+ updated_at=datetime.now(tz=UTC)
+ )
+ return set(), {"unresponsive-worker@host"}
+
+ with patch(
+ "tasks.jobs.attack_paths.cleanup._ping_workers",
+ side_effect=record_activity,
+ ):
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ ap_scan.refresh_from_db()
+ assert ap_scan.state == StateChoices.EXECUTING
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
+
+ @patch("tasks.jobs.attack_paths.cleanup.recover_graph_data_ready")
+ @patch("tasks.jobs.attack_paths.cleanup.graph_database.drop_database")
+ @patch(
+ "tasks.jobs.attack_paths.cleanup.rls_transaction",
+ new=lambda *args, **kwargs: nullcontext(),
+ )
+ @patch("tasks.jobs.attack_paths.cleanup._revoke_task")
+ def test_locked_recheck_preserves_scan_that_changed_state(
+ self,
+ mock_revoke,
+ mock_drop_db,
+ mock_recover,
+ tenants_fixture,
+ aws_provider,
+ scans_fixture,
+ ):
+ from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+ ap_scan, _ = self._create_executing_scan(
+ tenants_fixture[0],
+ aws_provider,
+ updated_at=datetime.now(tz=UTC) - timedelta(minutes=31),
+ worker="unresponsive-worker@host",
+ )
+
+ def complete_scan(_workers):
+ AttackPathsScan.objects.filter(id=ap_scan.id).update(
+ state=StateChoices.COMPLETED
+ )
+ return set(), {"unresponsive-worker@host"}
+
+ with patch(
+ "tasks.jobs.attack_paths.cleanup._ping_workers",
+ side_effect=complete_scan,
+ ):
+ result = cleanup_stale_attack_paths_scans()
+
+ assert result["cleaned_up_count"] == 0
+ ap_scan.refresh_from_db()
+ assert ap_scan.state == StateChoices.COMPLETED
+ mock_revoke.assert_not_called()
+ mock_drop_db.assert_not_called()
+ mock_recover.assert_not_called()
# `SCHEDULED` state cleanup
def _create_scheduled_scan(
@@ -2793,14 +3834,12 @@ class TestCleanupStaleAttackPathsScans:
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
ap_scan, task_result = self._create_scheduled_scan(
tenant,
@@ -2819,7 +3858,7 @@ class TestCleanupStaleAttackPathsScans:
assert ap_scan.progress == 100
assert ap_scan.completed_at is not None
assert ap_scan.ingestion_exceptions == {
- "global_error": "Scan never started — cleaned up by periodic task"
+ "global_error": "Scan never started - cleaned up by periodic task"
}
# SCHEDULED revoke must NOT terminate a running worker
@@ -2848,14 +3887,12 @@ class TestCleanupStaleAttackPathsScans:
mock_drop_db,
mock_recover,
tenants_fixture,
- providers_fixture,
+ aws_provider,
):
from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
- provider.provider = Provider.ProviderChoices.AWS
- provider.save()
+ provider = aws_provider
ap_scan, _ = self._create_scheduled_scan(
tenant,
@@ -2871,3 +3908,57 @@ class TestCleanupStaleAttackPathsScans:
ap_scan.refresh_from_db()
assert ap_scan.state == StateChoices.SCHEDULED
mock_revoke.assert_not_called()
+
+
+class TestNormalizeSinkProperties:
+ """Coerce Cartography-emitted property values into sink-portable primitives.
+
+ Lists become comma-strings, dicts become JSON strings, temporals become
+ ISO strings, spatials become their stringified form. The same coercion
+ runs regardless of the active sink so queries are portable.
+ """
+
+ @pytest.mark.parametrize(
+ "raw, expected",
+ [
+ (
+ {"a": "x", "b": 1, "c": 1.5, "d": True, "e": None},
+ {"a": "x", "b": 1, "c": 1.5, "d": True, "e": None},
+ ),
+ (
+ {"actions": ["s3:GetObject", "s3:PutObject"], "tags": []},
+ {"actions": "s3:GetObject,s3:PutObject", "tags": ""},
+ ),
+ (
+ {"condition": {"StringEquals": {"aws:SourceAccount": "123456789012"}}},
+ {
+ "condition": '{"StringEquals": {"aws:SourceAccount": "123456789012"}}'
+ },
+ ),
+ ],
+ )
+ def test_primitive_list_and_dict_branches(self, raw, expected):
+ sync_module._normalize_sink_properties(raw, labels=None)
+ assert raw == expected
+
+ def test_temporal_and_spatial_become_strings(self):
+ class FakeDateTime:
+ def iso_format(self) -> str:
+ return "2026-05-13T10:00:00+00:00"
+
+ class FakeSpatialPoint:
+ def __str__(self) -> str:
+ return "POINT(1.0 2.0)"
+
+ # The spatial branch is detected by module prefix, not by base class.
+ FakeSpatialPoint.__module__ = "neo4j.spatial.fake"
+
+ props = {
+ "created_at": FakeDateTime(),
+ "location": FakeSpatialPoint(),
+ }
+ sync_module._normalize_sink_properties(props, labels=None)
+ assert props == {
+ "created_at": "2026-05-13T10:00:00+00:00",
+ "location": "POINT(1.0 2.0)",
+ }
diff --git a/api/src/backend/tasks/tests/test_backfill.py b/api/src/backend/tasks/tests/test_backfill.py
index 8ae39905fc..7b01c46480 100644
--- a/api/src/backend/tasks/tests/test_backfill.py
+++ b/api/src/backend/tasks/tests/test_backfill.py
@@ -39,9 +39,9 @@ def resource_scan_summary_data(scans_fixture):
@pytest.fixture(scope="function")
-def get_not_completed_scans(providers_fixture):
- provider_id = providers_fixture[0].id
- tenant_id = providers_fixture[0].tenant_id
+def get_not_completed_scans(aws_provider):
+ provider_id = aws_provider.id
+ tenant_id = aws_provider.tenant_id
scan_1 = Scan.objects.create(
tenant_id=tenant_id,
trigger=Scan.TriggerChoices.MANUAL,
diff --git a/api/src/backend/tasks/tests/test_beat.py b/api/src/backend/tasks/tests/test_beat.py
index 8679872164..e3ce97a04a 100644
--- a/api/src/backend/tasks/tests/test_beat.py
+++ b/api/src/backend/tasks/tests/test_beat.py
@@ -10,8 +10,8 @@ from tasks.beat import schedule_provider_scan
@pytest.mark.django_db
class TestScheduleProviderScan:
- def test_schedule_provider_scan_success(self, providers_fixture):
- provider_instance, *_ = providers_fixture
+ def test_schedule_provider_scan_success(self, aws_provider):
+ provider_instance = aws_provider
with patch(
"tasks.tasks.perform_scheduled_scan_task.apply_async"
@@ -41,8 +41,8 @@ class TestScheduleProviderScan:
"provider_id": str(provider_instance.id),
}
- def test_schedule_provider_scan_already_exists(self, providers_fixture):
- provider_instance, *_ = providers_fixture
+ def test_schedule_provider_scan_already_exists(self, aws_provider):
+ provider_instance = aws_provider
# First, schedule the scan
with patch("tasks.tasks.perform_scheduled_scan_task.apply_async"):
@@ -56,8 +56,8 @@ class TestScheduleProviderScan:
exc_info.value
)
- def test_remove_periodic_task(self, providers_fixture):
- provider_instance = providers_fixture[0]
+ def test_remove_periodic_task(self, aws_provider):
+ provider_instance = aws_provider
assert Scan.objects.count() == 0
with patch("tasks.tasks.perform_scheduled_scan_task.apply_async"):
diff --git a/api/src/backend/tasks/tests/test_deletion.py b/api/src/backend/tasks/tests/test_deletion.py
index 1124334861..9a6c4acc7c 100644
--- a/api/src/backend/tasks/tests/test_deletion.py
+++ b/api/src/backend/tasks/tests/test_deletion.py
@@ -1,4 +1,4 @@
-from unittest.mock import call, patch
+from unittest.mock import MagicMock, call, patch
import pytest
from api.attack_paths import database as graph_database
@@ -9,7 +9,7 @@ from tasks.jobs.deletion import delete_provider, delete_tenant
@pytest.mark.django_db
class TestDeleteProvider:
- def test_delete_provider_success(self, providers_fixture):
+ def test_delete_provider_success(self, aws_provider):
with (
patch(
"tasks.jobs.deletion.graph_database.get_database_name",
@@ -19,7 +19,7 @@ class TestDeleteProvider:
"tasks.jobs.deletion.graph_database.drop_subgraph"
) as mock_drop_subgraph,
):
- instance = providers_fixture[0]
+ instance = aws_provider
tenant_id = str(instance.tenant_id)
result = delete_provider(tenant_id, instance.id)
@@ -53,17 +53,19 @@ class TestDeleteProvider:
mock_drop_subgraph.assert_not_called()
def test_delete_provider_drops_temp_attack_paths_databases(
- self, providers_fixture, create_attack_paths_scan
+ self, aws_provider, create_attack_paths_scan
):
- instance = providers_fixture[0]
+ instance = aws_provider
tenant_id = str(instance.tenant_id)
aps1 = create_attack_paths_scan(instance)
aps2 = create_attack_paths_scan(instance)
+ backend = MagicMock()
with (
patch(
- "tasks.jobs.deletion.graph_database.drop_subgraph",
+ "tasks.jobs.deletion.sink_module.get_backend_for_name",
+ return_value=backend,
),
patch(
"tasks.jobs.deletion.graph_database.drop_database",
@@ -72,23 +74,68 @@ class TestDeleteProvider:
result = delete_provider(tenant_id, instance.id)
assert result
+ backend.drop_subgraph.assert_called_once_with(
+ graph_database.get_database_name(tenant_id), str(instance.id)
+ )
expected_tmp_calls = [
call(f"db-tmp-scan-{str(aps1.id).lower()}"),
call(f"db-tmp-scan-{str(aps2.id).lower()}"),
]
mock_drop_database.assert_has_calls(expected_tmp_calls, any_order=True)
- def test_delete_provider_continues_when_temp_db_drop_fails(
- self, providers_fixture, create_attack_paths_scan
+ def test_delete_provider_drops_graph_data_from_all_recorded_sinks(
+ self, aws_provider, create_attack_paths_scan
):
- instance = providers_fixture[0]
+ instance = aws_provider
tenant_id = str(instance.tenant_id)
+ create_attack_paths_scan(instance, sink_backend="neo4j")
+ create_attack_paths_scan(instance, sink_backend="neptune")
+ neo4j_backend = MagicMock()
+ neptune_backend = MagicMock()
- create_attack_paths_scan(instance)
+ def get_backend_for_name(name):
+ return {
+ "neo4j": neo4j_backend,
+ "neptune": neptune_backend,
+ }[name]
with (
patch(
- "tasks.jobs.deletion.graph_database.drop_subgraph",
+ "tasks.jobs.deletion.graph_database.get_database_name",
+ return_value="tenant-db",
+ ),
+ patch(
+ "tasks.jobs.deletion.sink_module.get_backend_for_name",
+ side_effect=get_backend_for_name,
+ ) as mock_get_backend_for_name,
+ patch("tasks.jobs.deletion.graph_database.drop_database"),
+ ):
+ result = delete_provider(tenant_id, instance.id)
+
+ assert result
+ mock_get_backend_for_name.assert_has_calls(
+ [call("neo4j"), call("neptune")], any_order=True
+ )
+ neo4j_backend.drop_subgraph.assert_called_once_with(
+ "tenant-db", str(instance.id)
+ )
+ neptune_backend.drop_subgraph.assert_called_once_with(
+ "tenant-db", str(instance.id)
+ )
+
+ def test_delete_provider_continues_when_temp_db_drop_fails(
+ self, aws_provider, create_attack_paths_scan
+ ):
+ instance = aws_provider
+ tenant_id = str(instance.tenant_id)
+
+ create_attack_paths_scan(instance)
+ backend = MagicMock()
+
+ with (
+ patch(
+ "tasks.jobs.deletion.sink_module.get_backend_for_name",
+ return_value=backend,
),
patch(
"tasks.jobs.deletion.graph_database.drop_database",
@@ -104,10 +151,10 @@ class TestDeleteProvider:
def test_delete_provider_recalculates_tenant_compliance_summary(
self,
- providers_fixture,
+ aws_provider_pair,
provider_compliance_scores_fixture,
):
- instance = providers_fixture[0]
+ instance = aws_provider_pair[0]
tenant_id = instance.tenant_id
TenantComplianceSummary.objects.create(
@@ -152,7 +199,7 @@ class TestDeleteProvider:
@pytest.mark.django_db
class TestDeleteTenant:
- def test_delete_tenant_success(self, tenants_fixture, providers_fixture):
+ def test_delete_tenant_success(self, tenants_fixture, aws_provider):
"""
Test successful deletion of a tenant and its related data.
"""
diff --git a/api/src/backend/tasks/tests/test_integrations.py b/api/src/backend/tasks/tests/test_integrations.py
index 9cb727e8d0..bebb813feb 100644
--- a/api/src/backend/tasks/tests/test_integrations.py
+++ b/api/src/backend/tasks/tests/test_integrations.py
@@ -5,6 +5,10 @@ from api.db_router import READ_REPLICA_ALIAS, MainRouter
from api.models import Integration
from api.utils import prowler_integration_connection_test
from django.db import OperationalError
+from prowler.lib.outputs.jira.exceptions.exceptions import (
+ JiraRefreshTokenError,
+ JiraRequiredCustomFieldsError,
+)
from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
from prowler.providers.common.models import Connection
from tasks.jobs.integrations import (
@@ -1830,10 +1834,213 @@ class TestJiraIntegration:
)
# Assertions
- assert result == {"created_count": 2, "failed_count": 1}
+ assert result == {
+ "created_count": 2,
+ "failed_count": 1,
+ "error": "Failed to create Jira issue.",
+ }
# Verify error was logged for the failed finding
- mock_logger.error.assert_called_with("Failed to send finding finding-2 to Jira")
+ mock_logger.error.assert_called_with("Failed to create Jira issue.")
+
+ @patch("tasks.jobs.integrations.rls_transaction")
+ @patch("tasks.jobs.integrations.Finding")
+ @patch("tasks.jobs.integrations.Integration")
+ @patch("tasks.jobs.integrations.initialize_prowler_integration")
+ @patch("tasks.jobs.integrations.logger")
+ def test_send_findings_to_jira_preserves_exception_message(
+ self,
+ mock_logger,
+ mock_initialize_integration,
+ mock_integration_model,
+ mock_finding_model,
+ mock_rls_transaction,
+ ):
+ """Test Jira send exceptions are returned for UI polling."""
+ tenant_id = "tenant-123"
+ integration_id = "integration-456"
+ project_key = "PROJ"
+ issue_type = "Task"
+ finding_ids = ["finding-1"]
+ error_message = "Jira project requires custom fields: Team is required"
+
+ mock_rls_transaction.return_value.__enter__ = MagicMock()
+ mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+ integration = MagicMock()
+ mock_integration_model.objects.get.return_value = integration
+
+ mock_jira_integration = MagicMock()
+
+ mock_jira_integration.send_finding.side_effect = JiraRequiredCustomFieldsError(
+ message=error_message
+ )
+ mock_initialize_integration.return_value = mock_jira_integration
+
+ finding = MagicMock()
+ finding.id = "finding-1"
+ finding.check_id = "check_001"
+ finding.severity = "high"
+ finding.status = "FAIL"
+ finding.status_extended = "Resource is not compliant"
+ finding.compliance = {}
+ finding.resources.exists.return_value = False
+ finding.resources.first.return_value = None
+ finding.scan.provider.provider = "aws"
+ finding.check_metadata = {
+ "checktitle": "Check Title",
+ "risk": "High risk",
+ "remediation": {"recommendation": {}, "code": {}},
+ }
+ mock_select_related = mock_finding_model.all_objects.select_related.return_value
+ mock_finding_query = mock_select_related.prefetch_related.return_value
+ mock_finding_query.get.return_value = finding
+
+ result = send_findings_to_jira(
+ tenant_id, integration_id, project_key, issue_type, finding_ids
+ )
+
+ assert result == {
+ "created_count": 0,
+ "failed_count": 1,
+ "error": error_message,
+ }
+ mock_logger.exception.assert_called_with(
+ "Failed to send finding %s to Jira: %s",
+ "finding-1",
+ error_message,
+ )
+
+ @patch("tasks.jobs.integrations.rls_transaction")
+ @patch("tasks.jobs.integrations.Finding")
+ @patch("tasks.jobs.integrations.Integration")
+ @patch("tasks.jobs.integrations.initialize_prowler_integration")
+ @patch("tasks.jobs.integrations.logger")
+ def test_send_findings_to_jira_preserves_refresh_token_error_message(
+ self,
+ mock_logger,
+ mock_initialize_integration,
+ mock_integration_model,
+ mock_finding_model,
+ mock_rls_transaction,
+ ):
+ """Test Jira refresh token exceptions return their UI-friendly message."""
+ tenant_id = "tenant-123"
+ integration_id = "integration-456"
+ project_key = "PROJ"
+ issue_type = "Task"
+ finding_ids = ["finding-1"]
+ error_message = "Failed to refresh the access token"
+
+ mock_rls_transaction.return_value.__enter__ = MagicMock()
+ mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+ integration = MagicMock()
+ mock_integration_model.objects.get.return_value = integration
+
+ mock_jira_integration = MagicMock()
+
+ mock_jira_integration.send_finding.side_effect = JiraRefreshTokenError(
+ message=error_message
+ )
+ mock_initialize_integration.return_value = mock_jira_integration
+
+ finding = MagicMock()
+ finding.id = "finding-1"
+ finding.check_id = "check_001"
+ finding.severity = "high"
+ finding.status = "FAIL"
+ finding.status_extended = "Resource is not compliant"
+ finding.compliance = {}
+ finding.resources.exists.return_value = False
+ finding.resources.first.return_value = None
+ finding.scan.provider.provider = "aws"
+ finding.check_metadata = {
+ "checktitle": "Check Title",
+ "risk": "High risk",
+ "remediation": {"recommendation": {}, "code": {}},
+ }
+ mock_select_related = mock_finding_model.all_objects.select_related.return_value
+ mock_finding_query = mock_select_related.prefetch_related.return_value
+ mock_finding_query.get.return_value = finding
+
+ result = send_findings_to_jira(
+ tenant_id, integration_id, project_key, issue_type, finding_ids
+ )
+
+ assert result == {
+ "created_count": 0,
+ "failed_count": 1,
+ "error": error_message,
+ }
+ mock_logger.exception.assert_called_with(
+ "Failed to send finding %s to Jira: %s",
+ "finding-1",
+ error_message,
+ )
+
+ @patch("tasks.jobs.integrations.rls_transaction")
+ @patch("tasks.jobs.integrations.Finding")
+ @patch("tasks.jobs.integrations.Integration")
+ @patch("tasks.jobs.integrations.initialize_prowler_integration")
+ @patch("tasks.jobs.integrations.logger")
+ def test_send_findings_to_jira_sanitizes_unexpected_exception_message(
+ self,
+ mock_logger,
+ mock_initialize_integration,
+ mock_integration_model,
+ mock_finding_model,
+ mock_rls_transaction,
+ ):
+ """Test unexpected Jira send exceptions do not leak raw details to UI."""
+ tenant_id = "tenant-123"
+ integration_id = "integration-456"
+ project_key = "PROJ"
+ issue_type = "Task"
+ finding_ids = ["finding-1"]
+
+ mock_rls_transaction.return_value.__enter__ = MagicMock()
+ mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+ integration = MagicMock()
+ mock_integration_model.objects.get.return_value = integration
+
+ mock_jira_integration = MagicMock()
+ mock_jira_integration.send_finding.side_effect = Exception("token=secret-value")
+ mock_initialize_integration.return_value = mock_jira_integration
+
+ finding = MagicMock()
+ finding.id = "finding-1"
+ finding.check_id = "check_001"
+ finding.severity = "high"
+ finding.status = "FAIL"
+ finding.status_extended = "Resource is not compliant"
+ finding.compliance = {}
+ finding.resources.exists.return_value = False
+ finding.resources.first.return_value = None
+ finding.scan.provider.provider = "aws"
+ finding.check_metadata = {
+ "checktitle": "Check Title",
+ "risk": "High risk",
+ "remediation": {"recommendation": {}, "code": {}},
+ }
+ mock_select_related = mock_finding_model.all_objects.select_related.return_value
+ mock_finding_query = mock_select_related.prefetch_related.return_value
+ mock_finding_query.get.return_value = finding
+
+ result = send_findings_to_jira(
+ tenant_id, integration_id, project_key, issue_type, finding_ids
+ )
+
+ assert result == {
+ "created_count": 0,
+ "failed_count": 1,
+ "error": "Failed to create Jira issue.",
+ }
+ assert "secret-value" not in result["error"]
+ mock_logger.exception.assert_called_with(
+ "Failed to send finding %s to Jira", "finding-1"
+ )
@patch("tasks.jobs.integrations.rls_transaction")
@patch("tasks.jobs.integrations.Finding")
diff --git a/api/src/backend/tasks/tests/test_orphan_recovery.py b/api/src/backend/tasks/tests/test_orphan_recovery.py
index b78aca4e63..074e311b70 100644
--- a/api/src/backend/tasks/tests/test_orphan_recovery.py
+++ b/api/src/backend/tasks/tests/test_orphan_recovery.py
@@ -7,6 +7,7 @@ from celery import states
from django.test import override_settings
from django_celery_results.models import TaskResult
from tasks.jobs.orphan_recovery import (
+ _SKIP_RECOVERY,
_decode_celery_field,
_reconcile_task_results,
_recovery_attempt_count,
@@ -14,6 +15,7 @@ from tasks.jobs.orphan_recovery import (
is_worker_alive,
reconcile_orphans,
reenqueueable_tasks,
+ revoke_task,
)
@@ -180,10 +182,18 @@ class TestReconcileTaskResults:
assert tr.task_id in result["failed"]
mock_count.assert_not_called()
- def test_scan_task_is_skipped_entirely(self, tenants_fixture):
+ @pytest.mark.parametrize(
+ "task_name",
+ [
+ "scan-perform",
+ "attack-paths-scan-perform",
+ "attack-paths-cleanup-stale-scans",
+ ],
+ )
+ def test_scan_task_is_skipped_entirely(self, tenants_fixture, task_name):
"""Scan tasks are excluded from recovery: the watchdog never touches them."""
tr = _orphan_result(
- name="scan-perform",
+ name=task_name,
kwargs={
"tenant_id": str(tenants_fixture[0].id),
"scan_id": str(uuid4()),
@@ -339,6 +349,15 @@ class TestOrphanRecoveryHelpers:
):
assert is_worker_alive("w@h") is False
+ def test_revoke_task_terminates_with_sigterm_by_default(self):
+ task_result = MagicMock(task_id="task-id")
+ with patch(
+ "tasks.jobs.orphan_recovery.current_app.control.revoke"
+ ) as mock_revoke:
+ revoke_task(task_result)
+
+ mock_revoke.assert_called_once_with("task-id", terminate=True, signal="SIGTERM")
+
def test_recovery_attempt_count_increments(self):
# Unique signature so the Valkey counter starts fresh for this test.
kwargs_repr = repr({"probe": str(uuid4())})
@@ -350,6 +369,12 @@ class TestOrphanRecoveryHelpers:
class TestRecoveryFeatureFlags:
+ def test_attack_paths_tasks_are_excluded_from_generic_recovery(self):
+ assert {
+ "attack-paths-scan-perform",
+ "attack-paths-cleanup-stale-scans",
+ } <= _SKIP_RECOVERY
+
def test_all_groups_enabled_by_default(self):
tasks = reenqueueable_tasks()
assert "scan-summary" in tasks
@@ -374,33 +399,23 @@ class TestRecoveryFeatureFlags:
class TestRecoveryMasterFlag:
@override_settings(TASK_RECOVERY_ENABLED=False)
def test_master_flag_disables_task_recovery(self):
- with (
- patch(
- "tasks.jobs.orphan_recovery._reconcile_task_results"
- ) as mock_reconcile,
- patch(
- "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
- return_value={},
- ),
- ):
+ with patch(
+ "tasks.jobs.orphan_recovery._reconcile_task_results"
+ ) as mock_reconcile:
result = reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
mock_reconcile.assert_not_called()
assert result["acquired"] is True
assert result["enabled"] is False
+ assert "attack_paths" not in result
@override_settings(TASK_RECOVERY_ENABLED=True)
def test_master_flag_enabled_runs_task_recovery(self):
- with (
- patch(
- "tasks.jobs.orphan_recovery._reconcile_task_results",
- return_value={"recovered": [], "failed": [], "skipped": []},
- ) as mock_reconcile,
- patch(
- "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
- return_value={},
- ),
- ):
- reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
+ with patch(
+ "tasks.jobs.orphan_recovery._reconcile_task_results",
+ return_value={"recovered": [], "failed": [], "skipped": []},
+ ) as mock_reconcile:
+ result = reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
mock_reconcile.assert_called_once()
+ assert "attack_paths" not in result
diff --git a/api/src/backend/tasks/tests/test_reports.py b/api/src/backend/tasks/tests/test_reports.py
index c290e6fe1d..626237922f 100644
--- a/api/src/backend/tasks/tests/test_reports.py
+++ b/api/src/backend/tasks/tests/test_reports.py
@@ -45,14 +45,48 @@ from tasks.jobs.reports import (
get_color_for_risk_level,
get_color_for_weight,
)
+from tasks.jobs.reports import cis as cis_report_module
+from tasks.jobs.reports import csa as csa_report_module
+from tasks.jobs.reports import ens as ens_report_module
+from tasks.jobs.reports import nis2 as nis2_report_module
+from tasks.jobs.reports import threatscore as threatscore_report_module
from tasks.jobs.threatscore_utils import (
_aggregate_requirement_statistics_from_database,
_load_findings_for_requirement_checks,
)
+from tasks.tests.report_test_helpers import patch_chart_helpers, patch_report_gc
matplotlib.use("Agg") # Use non-interactive backend for tests
+@pytest.fixture
+def patch_report_rendering(monkeypatch):
+ patch_report_gc(monkeypatch)
+ patch_chart_helpers(
+ monkeypatch,
+ cis_report_module,
+ (
+ "create_pie_chart",
+ "create_horizontal_bar_chart",
+ "create_stacked_bar_chart",
+ ),
+ )
+ patch_chart_helpers(
+ monkeypatch, csa_report_module, ("create_horizontal_bar_chart",)
+ )
+ patch_chart_helpers(
+ monkeypatch,
+ ens_report_module,
+ ("create_horizontal_bar_chart", "create_radar_chart"),
+ )
+ patch_chart_helpers(
+ monkeypatch, nis2_report_module, ("create_horizontal_bar_chart",)
+ )
+ patch_chart_helpers(
+ monkeypatch, threatscore_report_module, ("create_vertical_bar_chart",)
+ )
+
+
@pytest.mark.django_db
class TestAggregateRequirementStatistics:
"""Test suite for _aggregate_requirement_statistics_from_database function."""
@@ -355,7 +389,7 @@ class TestPDFStylesCreation:
class TestLoadFindingsForChecks:
"""Test suite for _load_findings_for_requirement_checks function."""
- def test_empty_check_ids_returns_empty(self, tenants_fixture, providers_fixture):
+ def test_empty_check_ids_returns_empty(self, tenants_fixture):
"""Test that empty check_ids list returns empty dict."""
tenant = tenants_fixture[0]
@@ -1041,23 +1075,24 @@ class TestStaleCleanupProtectionHelpers:
@pytest.mark.django_db
+@pytest.mark.usefixtures("patch_report_rendering")
class TestGenerateThreatscoreReportFunction:
"""Test suite for generate_threatscore_report function."""
- @patch("tasks.jobs.reports.base.initialize_prowler_provider")
+ @patch("tasks.jobs.reports.base.build_provider_metadata")
def test_generate_threatscore_report_exception_handling(
self,
- mock_initialize_provider,
+ mock_build_provider_metadata,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test that exceptions during report generation are properly handled."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
- mock_initialize_provider.side_effect = Exception("Test exception")
+ mock_build_provider_metadata.side_effect = Exception("Test exception")
with pytest.raises(Exception) as exc_info:
generate_threatscore_report(
@@ -1072,6 +1107,7 @@ class TestGenerateThreatscoreReportFunction:
@pytest.mark.django_db
+@pytest.mark.usefixtures("patch_report_rendering")
class TestGenerateComplianceReportsOptimized:
"""Test suite for generate_compliance_reports function."""
@@ -1087,12 +1123,12 @@ class TestGenerateComplianceReportsOptimized:
mock_upload,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test that function returns early when scan has no findings."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
result = generate_compliance_reports(
tenant_id=str(tenant.id),
@@ -1144,14 +1180,14 @@ class TestGenerateComplianceReportsOptimized:
mock_upload,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Scan with no findings and ``generate_cis=True`` must yield a flat
``{"upload": False, "path": ""}`` entry, consistent with the other
frameworks (no nested dict, no sentinel keys)."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
result = generate_compliance_reports(
tenant_id=str(tenant.id),
@@ -1167,7 +1203,6 @@ class TestGenerateComplianceReportsOptimized:
assert result["cis"] == {"upload": False, "path": ""}
mock_cis.assert_not_called()
- @patch("api.utils.initialize_prowler_provider")
@patch("tasks.jobs.report.rmtree")
@patch("tasks.jobs.report._upload_to_s3")
@patch("tasks.jobs.report.generate_cis_report")
@@ -1194,7 +1229,6 @@ class TestGenerateComplianceReportsOptimized:
mock_cis,
mock_upload_to_s3,
mock_rmtree,
- mock_init_provider,
):
"""After each framework finishes, exclusive entries are evicted.
@@ -1223,7 +1257,6 @@ class TestGenerateComplianceReportsOptimized:
mock_aggregate_stats.return_value = {}
mock_generate_output_dir.return_value = "/tmp/tenant/scan/x/prowler-out"
mock_upload_to_s3.return_value = "s3://bucket/tenant/scan/x/report.pdf"
- mock_init_provider.return_value = Mock(name="prowler_provider")
# Seed the cache as if both frameworks had already loaded their
# findings. We mutate it indirectly: each generator wrapper is a
@@ -1266,7 +1299,7 @@ class TestGenerateComplianceReportsOptimized:
"shared must remain in cache because ENS still needs it"
)
- @patch("tasks.jobs.report.initialize_prowler_provider")
+ @patch("tasks.jobs.report.build_provider_metadata")
@patch("tasks.jobs.report.rmtree")
@patch("tasks.jobs.report._upload_to_s3")
@patch("tasks.jobs.report.generate_cis_report")
@@ -1279,7 +1312,7 @@ class TestGenerateComplianceReportsOptimized:
@patch("tasks.jobs.report.Compliance.get_bulk")
@patch("tasks.jobs.report.Provider.objects.get")
@patch("tasks.jobs.report.ScanSummary.objects.filter")
- def test_prowler_provider_initialized_once(
+ def test_provider_metadata_built_once(
self,
mock_scan_summary_filter,
mock_provider_get,
@@ -1293,11 +1326,11 @@ class TestGenerateComplianceReportsOptimized:
mock_cis,
mock_upload_to_s3,
mock_rmtree,
- mock_init_provider,
+ mock_build_metadata,
):
- """``initialize_prowler_provider`` must be called exactly once for
- the whole batch (PROWLER-1733). Previously each generator re-init'd
- the SDK provider in ``_load_compliance_data`` → 5 inits per scan.
+ """``build_provider_metadata`` must be called exactly once for the
+ whole batch and its result shared across all 5 reports
+ (PROWLER-1733 / PROWLER-2145).
"""
mock_scan_summary_filter.return_value.exists.return_value = True
mock_provider_get.return_value = Mock(uid="provider-uid", provider="aws")
@@ -1306,7 +1339,7 @@ class TestGenerateComplianceReportsOptimized:
mock_aggregate_stats.return_value = {}
mock_generate_output_dir.return_value = "/tmp/tenant/scan/x/prowler-out"
mock_upload_to_s3.return_value = "s3://bucket/tenant/scan/x/report.pdf"
- mock_init_provider.return_value = Mock(name="prowler_provider")
+ mock_build_metadata.return_value = Mock(name="prowler_provider")
generate_compliance_reports(
tenant_id=str(uuid.uuid4()),
@@ -1325,14 +1358,14 @@ class TestGenerateComplianceReportsOptimized:
mock_nis2.assert_called_once()
mock_csa.assert_called_once()
mock_cis.assert_called_once()
- # …but the SDK provider was initialized only once.
- assert mock_init_provider.call_count == 1, (
- f"expected 1 init, got {mock_init_provider.call_count} "
+ # …but the provider metadata stub was built only once.
+ assert mock_build_metadata.call_count == 1, (
+ f"expected 1 build, got {mock_build_metadata.call_count} "
f"(prowler_provider must be shared across reports)"
)
# The shared instance must reach every wrapper as kwargs.
- shared = mock_init_provider.return_value
+ shared = mock_build_metadata.return_value
for mock_wrapper in (
mock_threatscore,
mock_ens,
@@ -1442,6 +1475,7 @@ class TestGenerateComplianceReportsOptimized:
@pytest.mark.django_db
+@pytest.mark.usefixtures("patch_report_rendering")
class TestGenerateComplianceReportsCIS:
"""Test suite covering the CIS branch of generate_compliance_reports."""
@@ -1471,7 +1505,7 @@ class TestGenerateComplianceReportsCIS:
monkeypatch,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""CIS branch should generate a single PDF for the highest version.
@@ -1481,7 +1515,7 @@ class TestGenerateComplianceReportsCIS:
"""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
self._force_scan_has_findings(monkeypatch)
@@ -1530,12 +1564,12 @@ class TestGenerateComplianceReportsCIS:
monkeypatch,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""A failure in the latest CIS variant must be surfaced in the flat results entry."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
self._force_scan_has_findings(monkeypatch)
@@ -1577,14 +1611,14 @@ class TestGenerateComplianceReportsCIS:
monkeypatch,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""When ``Compliance.get_bulk`` returns no CIS entry the CIS branch
must skip cleanly and record a flat ``{"upload": False, "path": ""}``
entry — no hard-coded provider whitelist is consulted."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
self._force_scan_has_findings(monkeypatch)
mock_stats.return_value = {}
@@ -1616,12 +1650,12 @@ class TestGenerateComplianceReportsCIS:
monkeypatch,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""CIS output dir errors must be captured in results (not raised)."""
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
self._force_scan_has_findings(monkeypatch)
mock_stats.return_value = {}
diff --git a/api/src/backend/tasks/tests/test_reports_base.py b/api/src/backend/tasks/tests/test_reports_base.py
index 6246654436..7577903bae 100644
--- a/api/src/backend/tasks/tests/test_reports_base.py
+++ b/api/src/backend/tasks/tests/test_reports_base.py
@@ -43,6 +43,7 @@ from tasks.jobs.reports import ( # Configuration; Colors; Components; Charts; B
get_framework_config,
get_status_color,
)
+from tasks.tests.report_test_helpers import PNG_SIGNATURE, fake_png_buffer
# =============================================================================
# Configuration Tests
@@ -452,174 +453,47 @@ class TestSectionHeader:
# =============================================================================
-class TestChartCreation:
- """Tests for chart creation functions."""
+class TestChartRenderingSmoke:
+ """Small real-render coverage for the chart helpers."""
- def test_create_vertical_bar_chart(self):
- """Test vertical bar chart creation."""
- buffer = create_vertical_bar_chart(
- labels=["A", "B", "C"],
- values=[80, 60, 40],
- )
- assert isinstance(buffer, io.BytesIO)
- assert buffer.getvalue() # Not empty
+ @pytest.mark.parametrize(
+ ("chart_helper", "kwargs"),
+ [
+ (
+ create_vertical_bar_chart,
+ {"labels": ["Section 1", "Section 2"], "values": [90, 70]},
+ ),
+ (
+ create_horizontal_bar_chart,
+ {"labels": ["Category 1", "Category 2"], "values": [85, 65]},
+ ),
+ (
+ create_radar_chart,
+ {"labels": ["A", "B", "C"], "values": [50, 60, 70]},
+ ),
+ (
+ create_pie_chart,
+ {"labels": ["Pass", "Fail"], "values": [80, 20]},
+ ),
+ (
+ create_stacked_bar_chart,
+ {
+ "labels": ["Section 1", "Section 2"],
+ "data_series": {"Pass": [8, 6], "Fail": [2, 4]},
+ },
+ ),
+ ],
+ )
+ def test_chart_helper_renders_valid_png(self, chart_helper, kwargs):
+ buffer = chart_helper(**kwargs)
+ image_bytes = buffer.getvalue()
- def test_create_vertical_bar_chart_with_options(self):
- """Test vertical bar chart with custom options."""
- buffer = create_vertical_bar_chart(
- labels=["Section 1", "Section 2"],
- values=[90, 70],
- ylabel="Compliance",
- title="Test Chart",
- figsize=(8, 6),
- )
assert isinstance(buffer, io.BytesIO)
+ assert image_bytes
+ assert image_bytes.startswith(PNG_SIGNATURE)
- def test_create_horizontal_bar_chart(self):
- """Test horizontal bar chart creation."""
- buffer = create_horizontal_bar_chart(
- labels=["Category 1", "Category 2", "Category 3"],
- values=[85, 65, 45],
- )
- assert isinstance(buffer, io.BytesIO)
- assert buffer.getvalue()
-
- def test_create_horizontal_bar_chart_with_options(self):
- """Test horizontal bar chart with custom options."""
- buffer = create_horizontal_bar_chart(
- labels=["A", "B"],
- values=[100, 50],
- xlabel="Percentage",
- title="Custom Chart",
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_radar_chart(self):
- """Test radar chart creation."""
- buffer = create_radar_chart(
- labels=["Dim 1", "Dim 2", "Dim 3", "Dim 4", "Dim 5"],
- values=[80, 70, 60, 90, 75],
- )
- assert isinstance(buffer, io.BytesIO)
- assert buffer.getvalue()
-
- def test_create_radar_chart_with_options(self):
- """Test radar chart with custom options."""
- buffer = create_radar_chart(
- labels=["A", "B", "C"],
- values=[50, 60, 70],
- color="#FF0000",
- fill_alpha=0.5,
- title="Custom Radar",
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_pie_chart(self):
- """Test pie chart creation."""
- buffer = create_pie_chart(
- labels=["Pass", "Fail"],
- values=[80, 20],
- )
- assert isinstance(buffer, io.BytesIO)
- assert buffer.getvalue()
-
- def test_create_pie_chart_with_options(self):
- """Test pie chart with custom options."""
- buffer = create_pie_chart(
- labels=["Pass", "Fail", "Manual"],
- values=[60, 30, 10],
- colors=["#4CAF50", "#F44336", "#9E9E9E"],
- title="Status Distribution",
- autopct="%1.0f%%",
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_stacked_bar_chart(self):
- """Test stacked bar chart creation."""
- buffer = create_stacked_bar_chart(
- labels=["Section 1", "Section 2", "Section 3"],
- data_series={
- "Pass": [8, 6, 4],
- "Fail": [2, 4, 6],
- },
- )
- assert isinstance(buffer, io.BytesIO)
- assert buffer.getvalue()
-
- def test_create_stacked_bar_chart_with_options(self):
- """Test stacked bar chart with custom options."""
- buffer = create_stacked_bar_chart(
- labels=["A", "B"],
- data_series={
- "Pass": [10, 5],
- "Fail": [2, 3],
- "Manual": [1, 2],
- },
- colors={
- "Pass": "#4CAF50",
- "Fail": "#F44336",
- "Manual": "#9E9E9E",
- },
- xlabel="Categories",
- ylabel="Requirements",
- title="Requirements by Status",
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_stacked_bar_chart_without_legend(self):
- """Test stacked bar chart without legend."""
- buffer = create_stacked_bar_chart(
- labels=["X", "Y"],
- data_series={"A": [1, 2]},
- show_legend=False,
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_vertical_bar_chart_without_labels(self):
- """Test vertical bar chart without value labels."""
- buffer = create_vertical_bar_chart(
- labels=["A", "B"],
- values=[50, 75],
- show_labels=False,
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_vertical_bar_chart_with_explicit_colors(self):
- """Test vertical bar chart with explicit color list."""
- buffer = create_vertical_bar_chart(
- labels=["Pass", "Fail"],
- values=[80, 20],
- colors=["#4CAF50", "#F44336"],
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_horizontal_bar_chart_auto_figsize(self):
- """Test horizontal bar chart auto-calculates figure size for many items."""
- labels = [f"Item {i}" for i in range(20)]
- values = [50 + i * 2 for i in range(20)]
- buffer = create_horizontal_bar_chart(
- labels=labels,
- values=values,
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_horizontal_bar_chart_with_explicit_colors(self):
- """Test horizontal bar chart with explicit colors."""
- buffer = create_horizontal_bar_chart(
- labels=["A", "B", "C"],
- values=[80, 60, 40],
- colors=["#4CAF50", "#FFEB3B", "#F44336"],
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_create_radar_chart_with_custom_ticks(self):
- """Test radar chart with custom y-axis ticks."""
- buffer = create_radar_chart(
- labels=["A", "B", "C", "D"],
- values=[25, 50, 75, 100],
- y_ticks=[0, 25, 50, 75, 100],
- )
- assert isinstance(buffer, io.BytesIO)
+ buffer.seek(0)
+ assert Image(buffer, width=1 * inch, height=1 * inch)
# =============================================================================
@@ -1056,10 +930,7 @@ class TestExampleReportGenerator:
]
def create_charts_section(self, data):
- chart_buffer = create_vertical_bar_chart(
- labels=["Pass", "Fail"],
- values=[80, 20],
- )
+ chart_buffer = fake_png_buffer()
return [Image(chart_buffer, width=6 * inch, height=4 * inch)]
def create_requirements_index(self, data):
@@ -1150,63 +1021,6 @@ class TestExampleReportGenerator:
# =============================================================================
-class TestChartEdgeCases:
- """Tests for chart edge cases."""
-
- def test_vertical_bar_chart_empty_data(self):
- """Test vertical bar chart with empty data."""
- buffer = create_vertical_bar_chart(labels=[], values=[])
- assert isinstance(buffer, io.BytesIO)
-
- def test_vertical_bar_chart_single_item(self):
- """Test vertical bar chart with single item."""
- buffer = create_vertical_bar_chart(labels=["Single"], values=[75.0])
- assert isinstance(buffer, io.BytesIO)
-
- def test_horizontal_bar_chart_empty_data(self):
- """Test horizontal bar chart with empty data."""
- buffer = create_horizontal_bar_chart(labels=[], values=[])
- assert isinstance(buffer, io.BytesIO)
-
- def test_horizontal_bar_chart_single_item(self):
- """Test horizontal bar chart with single item."""
- buffer = create_horizontal_bar_chart(labels=["Single"], values=[50.0])
- assert isinstance(buffer, io.BytesIO)
-
- def test_radar_chart_minimum_points(self):
- """Test radar chart with minimum number of points (3)."""
- buffer = create_radar_chart(
- labels=["A", "B", "C"],
- values=[30.0, 60.0, 90.0],
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_pie_chart_single_slice(self):
- """Test pie chart with single slice."""
- buffer = create_pie_chart(labels=["Only"], values=[100.0])
- assert isinstance(buffer, io.BytesIO)
-
- def test_pie_chart_many_slices(self):
- """Test pie chart with many slices."""
- labels = [f"Item {i}" for i in range(10)]
- values = [10.0] * 10
- buffer = create_pie_chart(labels=labels, values=values)
- assert isinstance(buffer, io.BytesIO)
-
- def test_stacked_bar_chart_single_series(self):
- """Test stacked bar chart with single series."""
- buffer = create_stacked_bar_chart(
- labels=["A", "B"],
- data_series={"Only": [10.0, 20.0]},
- )
- assert isinstance(buffer, io.BytesIO)
-
- def test_stacked_bar_chart_empty_data(self):
- """Test stacked bar chart with empty data."""
- buffer = create_stacked_bar_chart(labels=[], data_series={})
- assert isinstance(buffer, io.BytesIO)
-
-
class TestComponentEdgeCases:
"""Tests for component edge cases."""
diff --git a/api/src/backend/tasks/tests/test_reports_cis.py b/api/src/backend/tasks/tests/test_reports_cis.py
index 31e5a5495f..b57780b8a4 100644
--- a/api/src/backend/tasks/tests/test_reports_cis.py
+++ b/api/src/backend/tasks/tests/test_reports_cis.py
@@ -4,11 +4,13 @@ import pytest
from api.models import StatusChoices
from reportlab.platypus import Image, LongTable, Paragraph, Table
from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
+from tasks.jobs.reports import cis as cis_report_module
from tasks.jobs.reports.cis import (
CISReportGenerator,
_normalize_profile,
_profile_badge_text,
)
+from tasks.tests.report_test_helpers import patch_chart_helpers
# =============================================================================
# Fixtures
@@ -399,18 +401,69 @@ class TestCISExecutiveSummary:
class TestCISChartsSection:
- def test_charts_rendered(self, cis_generator, populated_cis_compliance_data):
- elements = cis_generator.create_charts_section(populated_cis_compliance_data)
- # At least 1 image for the pie + 1 for section bar + 1 for stacked
- images = [e for e in elements if isinstance(e, Image)]
- assert len(images) >= 1
+ def test_charts_rendered(
+ self, monkeypatch, cis_generator, populated_cis_compliance_data
+ ):
+ chart_calls = patch_chart_helpers(
+ monkeypatch,
+ cis_report_module,
+ (
+ "create_pie_chart",
+ "create_horizontal_bar_chart",
+ "create_stacked_bar_chart",
+ ),
+ )
- def test_charts_no_data_no_crash(self, cis_generator, basic_cis_compliance_data):
+ elements = cis_generator.create_charts_section(populated_cis_compliance_data)
+
+ images = [e for e in elements if isinstance(e, Image)]
+ assert len(images) == 3
+
+ pie_kwargs = chart_calls["create_pie_chart"][0]["kwargs"]
+ assert pie_kwargs["labels"] == ["Pass (2)", "Fail (2)", "Manual (1)"]
+ assert pie_kwargs["values"] == [2, 2, 1]
+ assert pie_kwargs["colors"]
+
+ bar_kwargs = chart_calls["create_horizontal_bar_chart"][0]["kwargs"]
+ assert set(bar_kwargs["labels"]) == {
+ "1 Identity and Access Management",
+ "2 Storage",
+ }
+ assert bar_kwargs["values"] == [50.0, 50.0]
+ assert bar_kwargs["xlabel"] == "Compliance (%)"
+ assert bar_kwargs["color_func"]
+ assert bar_kwargs["label_fontsize"] == 9
+
+ stacked_kwargs = chart_calls["create_stacked_bar_chart"][0]["kwargs"]
+ assert stacked_kwargs["labels"] == ["Level 1", "Level 2"]
+ assert stacked_kwargs["data_series"] == {
+ "Pass": [1, 1],
+ "Fail": [2, 0],
+ "Manual": [0, 1],
+ }
+ assert stacked_kwargs["xlabel"] == "Profile"
+ assert stacked_kwargs["ylabel"] == "Requirements"
+
+ def test_charts_no_data_no_crash(
+ self, monkeypatch, cis_generator, basic_cis_compliance_data
+ ):
+ chart_calls = patch_chart_helpers(
+ monkeypatch,
+ cis_report_module,
+ (
+ "create_pie_chart",
+ "create_horizontal_bar_chart",
+ "create_stacked_bar_chart",
+ ),
+ )
basic_cis_compliance_data.requirements = []
basic_cis_compliance_data.attributes_by_requirement_id = {}
elements = cis_generator.create_charts_section(basic_cis_compliance_data)
- # Must not raise; may or may not have any Image
+
assert isinstance(elements, list)
+ assert chart_calls["create_pie_chart"] == []
+ assert chart_calls["create_horizontal_bar_chart"] == []
+ assert chart_calls["create_stacked_bar_chart"] == []
# =============================================================================
diff --git a/api/src/backend/tasks/tests/test_reports_csa.py b/api/src/backend/tasks/tests/test_reports_csa.py
index 2e61e9ef84..7a97018f6c 100644
--- a/api/src/backend/tasks/tests/test_reports_csa.py
+++ b/api/src/backend/tasks/tests/test_reports_csa.py
@@ -2,9 +2,11 @@ import io
from unittest.mock import Mock
import pytest
-from reportlab.platypus import PageBreak, Paragraph, Table
+from reportlab.platypus import Image, PageBreak, Paragraph, Table
from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
+from tasks.jobs.reports import csa as csa_report_module
from tasks.jobs.reports.csa import CSAReportGenerator
+from tasks.tests.report_test_helpers import patch_chart_helpers
# Use string status values directly to avoid Django DB initialization
@@ -29,6 +31,13 @@ def csa_generator():
return CSAReportGenerator(config)
+@pytest.fixture
+def patched_csa_charts(monkeypatch):
+ return patch_chart_helpers(
+ monkeypatch, csa_report_module, ("create_horizontal_bar_chart",)
+ )
+
+
@pytest.fixture
def mock_csa_requirement_attribute_iam():
"""Create a mock CSA CCM requirement attribute for Identity & Access Management."""
@@ -320,7 +329,7 @@ class TestCSAChartsSection:
"""Test suite for CSA charts section generation."""
def test_charts_section_has_section_chart_title(
- self, csa_generator, basic_csa_compliance_data
+ self, csa_generator, basic_csa_compliance_data, patched_csa_charts
):
"""Test that charts section has section compliance title."""
basic_csa_compliance_data.requirements = []
@@ -331,9 +340,14 @@ class TestCSAChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Section" in content or "Compliance" in content
+ assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_csa_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == []
+ assert chart_kwargs["values"] == []
+ assert chart_kwargs["xlabel"] == "Compliance (%)"
def test_charts_section_has_page_break(
- self, csa_generator, basic_csa_compliance_data
+ self, csa_generator, basic_csa_compliance_data, patched_csa_charts
):
"""Test that charts section has page breaks."""
basic_csa_compliance_data.requirements = []
@@ -343,12 +357,14 @@ class TestCSAChartsSection:
page_breaks = [e for e in elements if isinstance(e, PageBreak)]
assert len(page_breaks) >= 1
+ assert len(patched_csa_charts["create_horizontal_bar_chart"]) == 1
def test_charts_section_has_section_breakdown(
self,
csa_generator,
basic_csa_compliance_data,
mock_csa_requirement_attribute_iam,
+ patched_csa_charts,
):
"""Test that charts section includes section breakdown table."""
basic_csa_compliance_data.requirements = [
@@ -372,6 +388,11 @@ class TestCSAChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Section" in content or "Breakdown" in content
+ assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_csa_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Identity & Access Management"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["color_func"]
# =============================================================================
@@ -387,6 +408,7 @@ class TestCSASectionChart:
csa_generator,
basic_csa_compliance_data,
mock_csa_requirement_attribute_iam,
+ patched_csa_charts,
):
"""Test that section chart is created successfully."""
basic_csa_compliance_data.requirements = [
@@ -409,12 +431,17 @@ class TestCSASectionChart:
assert isinstance(chart_buffer, io.BytesIO)
assert chart_buffer.getvalue() # Not empty
+ chart_kwargs = patched_csa_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Identity & Access Management"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["xlabel"] == "Compliance (%)"
def test_section_chart_excludes_manual(
self,
csa_generator,
basic_csa_compliance_data,
mock_csa_requirement_attribute_iam,
+ patched_csa_charts,
):
"""Test that manual requirements are excluded from section chart."""
basic_csa_compliance_data.requirements = [
@@ -447,6 +474,9 @@ class TestCSASectionChart:
# Should not raise any errors
chart_buffer = csa_generator._create_section_chart(basic_csa_compliance_data)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_csa_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Identity & Access Management"]
+ assert chart_kwargs["values"] == [100.0]
def test_section_chart_multiple_sections(
self,
@@ -455,6 +485,7 @@ class TestCSASectionChart:
mock_csa_requirement_attribute_iam,
mock_csa_requirement_attribute_logging,
mock_csa_requirement_attribute_crypto,
+ patched_csa_charts,
):
"""Test section chart with multiple sections."""
basic_csa_compliance_data.requirements = [
@@ -501,6 +532,13 @@ class TestCSASectionChart:
chart_buffer = csa_generator._create_section_chart(basic_csa_compliance_data)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_csa_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == [
+ "Cryptography & Encryption",
+ "Identity & Access Management",
+ "Logging and Monitoring",
+ ]
+ assert chart_kwargs["values"] == [100.0, 100.0, 0.0]
# =============================================================================
diff --git a/api/src/backend/tasks/tests/test_reports_ens.py b/api/src/backend/tasks/tests/test_reports_ens.py
index 91eb6d6f3a..220c3e1427 100644
--- a/api/src/backend/tasks/tests/test_reports_ens.py
+++ b/api/src/backend/tasks/tests/test_reports_ens.py
@@ -2,9 +2,11 @@ import io
from unittest.mock import Mock, patch
import pytest
-from reportlab.platypus import PageBreak, Paragraph, Table
+from reportlab.platypus import Image, PageBreak, Paragraph, Table
from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
+from tasks.jobs.reports import ens as ens_report_module
from tasks.jobs.reports.ens import ENSReportGenerator
+from tasks.tests.report_test_helpers import patch_chart_helpers
# Use string status values directly to avoid Django DB initialization
@@ -29,6 +31,15 @@ def ens_generator():
return ENSReportGenerator(config)
+@pytest.fixture
+def patched_ens_charts(monkeypatch):
+ return patch_chart_helpers(
+ monkeypatch,
+ ens_report_module,
+ ("create_horizontal_bar_chart", "create_radar_chart"),
+ )
+
+
@pytest.fixture
def mock_ens_requirement_attribute():
"""Create a mock ENS requirement attribute with all fields."""
@@ -355,7 +366,7 @@ class TestENSChartsSection:
"""Test suite for ENS charts section generation."""
def test_charts_section_has_page_breaks(
- self, ens_generator, basic_ens_compliance_data
+ self, ens_generator, basic_ens_compliance_data, patched_ens_charts
):
"""Test that charts section has page breaks between charts."""
basic_ens_compliance_data.requirements = []
@@ -365,9 +376,25 @@ class TestENSChartsSection:
page_breaks = [e for e in elements if isinstance(e, PageBreak)]
assert len(page_breaks) >= 2 # At least 2 page breaks for different charts
+ assert any(isinstance(e, Image) for e in elements)
+ assert len(patched_ens_charts["create_horizontal_bar_chart"]) == 1
+ assert len(patched_ens_charts["create_radar_chart"]) == 1
+
+ marco_kwargs = patched_ens_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert marco_kwargs["labels"] == []
+ assert marco_kwargs["values"] == []
+
+ radar_kwargs = patched_ens_charts["create_radar_chart"][0]["kwargs"]
+ assert radar_kwargs["labels"] == ens_report_module.DIMENSION_NAMES
+ assert radar_kwargs["values"] == [100, 100, 100, 100, 100]
+ assert radar_kwargs["color"] == "#2196F3"
def test_charts_section_has_marco_category_chart(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test that charts section contains Marco/Categoría chart."""
basic_ens_compliance_data.requirements = [
@@ -391,9 +418,18 @@ class TestENSChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Marco" in content or "Categoría" in content
+ assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_ens_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Operacional - Gestión de incidentes"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["xlabel"] == "Porcentaje de Cumplimiento (%)"
def test_charts_section_has_dimensions_radar(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test that charts section contains dimensions radar chart."""
basic_ens_compliance_data.requirements = [
@@ -417,9 +453,17 @@ class TestENSChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Dimensiones" in content or "dimensiones" in content.lower()
+ radar_kwargs = patched_ens_charts["create_radar_chart"][0]["kwargs"]
+ assert radar_kwargs["labels"] == ens_report_module.DIMENSION_NAMES
+ assert radar_kwargs["values"] == [100, 100, 100.0, 100.0, 100]
+ assert radar_kwargs["color"] == "#2196F3"
def test_charts_section_has_tipo_distribution(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test that charts section contains tipo distribution."""
basic_ens_compliance_data.requirements = [
@@ -443,6 +487,8 @@ class TestENSChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Tipo" in content or "tipo" in content.lower()
+ assert len(patched_ens_charts["create_horizontal_bar_chart"]) == 1
+ assert len(patched_ens_charts["create_radar_chart"]) == 1
# =============================================================================
@@ -829,7 +875,11 @@ class TestENSDimensionHandling:
"""Test suite for ENS security dimension handling."""
def test_dimensions_as_list(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test handling dimensions as a list."""
# mock_ens_requirement_attribute has Dimensiones as list
@@ -837,9 +887,9 @@ class TestENSDimensionHandling:
RequirementData(
id="REQ-001",
description="Test requirement",
- status=StatusChoices.PASS,
- passed_findings=10,
- failed_findings=0,
+ status=StatusChoices.FAIL,
+ passed_findings=0,
+ failed_findings=10,
total_findings=10,
),
]
@@ -854,12 +904,16 @@ class TestENSDimensionHandling:
basic_ens_compliance_data
)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_ens_charts["create_radar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ens_report_module.DIMENSION_NAMES
+ assert chart_kwargs["values"] == [100, 100, 0.0, 0.0, 100]
def test_dimensions_as_string(
self,
ens_generator,
basic_ens_compliance_data,
mock_ens_requirement_attribute_medio,
+ patched_ens_charts,
):
"""Test handling dimensions as comma-separated string."""
# mock_ens_requirement_attribute_medio has Dimensiones as string
@@ -867,9 +921,9 @@ class TestENSDimensionHandling:
RequirementData(
id="REQ-001",
description="Test requirement",
- status=StatusChoices.PASS,
- passed_findings=10,
- failed_findings=0,
+ status=StatusChoices.FAIL,
+ passed_findings=0,
+ failed_findings=10,
total_findings=10,
),
]
@@ -884,12 +938,16 @@ class TestENSDimensionHandling:
basic_ens_compliance_data
)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_ens_charts["create_radar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ens_report_module.DIMENSION_NAMES
+ assert chart_kwargs["values"] == [0.0, 0.0, 100, 100, 100]
def test_dimensions_empty(
self,
ens_generator,
basic_ens_compliance_data,
mock_ens_requirement_attribute_opcional,
+ patched_ens_charts,
):
"""Test handling empty dimensions."""
# mock_ens_requirement_attribute_opcional has empty Dimensiones
@@ -916,6 +974,9 @@ class TestENSDimensionHandling:
basic_ens_compliance_data
)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_ens_charts["create_radar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ens_report_module.DIMENSION_NAMES
+ assert chart_kwargs["values"] == [100, 100, 100, 100, 100]
# =============================================================================
@@ -1061,7 +1122,11 @@ class TestENSMarcoCategoryChart:
"""Test suite for ENS Marco/Categoría chart."""
def test_marco_category_chart_creation(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test that Marco/Categoría chart is created successfully."""
basic_ens_compliance_data.requirements = [
@@ -1086,9 +1151,17 @@ class TestENSMarcoCategoryChart:
assert isinstance(chart_buffer, io.BytesIO)
assert chart_buffer.getvalue() # Not empty
+ chart_kwargs = patched_ens_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Operacional - Gestión de incidentes"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["xlabel"] == "Porcentaje de Cumplimiento (%)"
def test_marco_category_chart_excludes_manual(
- self, ens_generator, basic_ens_compliance_data, mock_ens_requirement_attribute
+ self,
+ ens_generator,
+ basic_ens_compliance_data,
+ mock_ens_requirement_attribute,
+ patched_ens_charts,
):
"""Test that manual requirements are excluded from chart."""
basic_ens_compliance_data.requirements = [
@@ -1123,6 +1196,9 @@ class TestENSMarcoCategoryChart:
basic_ens_compliance_data
)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_ens_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["Operacional - Gestión de incidentes"]
+ assert chart_kwargs["values"] == [100.0]
# =============================================================================
diff --git a/api/src/backend/tasks/tests/test_reports_nis2.py b/api/src/backend/tasks/tests/test_reports_nis2.py
index 07e88ec7ca..ea6e06477d 100644
--- a/api/src/backend/tasks/tests/test_reports_nis2.py
+++ b/api/src/backend/tasks/tests/test_reports_nis2.py
@@ -2,9 +2,11 @@ import io
from unittest.mock import Mock, patch
import pytest
-from reportlab.platypus import PageBreak, Paragraph, Table
+from reportlab.platypus import Image, PageBreak, Paragraph, Table
from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
+from tasks.jobs.reports import nis2 as nis2_report_module
from tasks.jobs.reports.nis2 import NIS2ReportGenerator, _extract_section_number
+from tasks.tests.report_test_helpers import patch_chart_helpers
# Use string status values directly to avoid Django DB initialization
@@ -29,6 +31,13 @@ def nis2_generator():
return NIS2ReportGenerator(config)
+@pytest.fixture
+def patched_nis2_charts(monkeypatch):
+ return patch_chart_helpers(
+ monkeypatch, nis2_report_module, ("create_horizontal_bar_chart",)
+ )
+
+
@pytest.fixture
def mock_nis2_requirement_attribute_section1():
"""Create a mock NIS2 requirement attribute for Section 1."""
@@ -380,7 +389,7 @@ class TestNIS2ChartsSection:
"""Test suite for NIS2 charts section generation."""
def test_charts_section_has_section_chart_title(
- self, nis2_generator, basic_nis2_compliance_data
+ self, nis2_generator, basic_nis2_compliance_data, patched_nis2_charts
):
"""Test that charts section has section compliance title."""
basic_nis2_compliance_data.requirements = []
@@ -391,9 +400,14 @@ class TestNIS2ChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "Section" in content or "Compliance" in content
+ assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_nis2_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == []
+ assert chart_kwargs["values"] == []
+ assert chart_kwargs["xlabel"] == "Compliance (%)"
def test_charts_section_has_page_break(
- self, nis2_generator, basic_nis2_compliance_data
+ self, nis2_generator, basic_nis2_compliance_data, patched_nis2_charts
):
"""Test that charts section has page breaks."""
basic_nis2_compliance_data.requirements = []
@@ -403,12 +417,14 @@ class TestNIS2ChartsSection:
page_breaks = [e for e in elements if isinstance(e, PageBreak)]
assert len(page_breaks) >= 1
+ assert len(patched_nis2_charts["create_horizontal_bar_chart"]) == 1
def test_charts_section_has_subsection_breakdown(
self,
nis2_generator,
basic_nis2_compliance_data,
mock_nis2_requirement_attribute_section1,
+ patched_nis2_charts,
):
"""Test that charts section includes subsection breakdown table."""
basic_nis2_compliance_data.requirements = [
@@ -434,6 +450,11 @@ class TestNIS2ChartsSection:
paragraphs = [e for e in elements if isinstance(e, Paragraph)]
content = " ".join(str(p.text) for p in paragraphs)
assert "SubSection" in content or "Breakdown" in content
+ assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_nis2_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["1. Policy on Security"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["color_func"]
# =============================================================================
@@ -449,6 +470,7 @@ class TestNIS2SectionChart:
nis2_generator,
basic_nis2_compliance_data,
mock_nis2_requirement_attribute_section1,
+ patched_nis2_charts,
):
"""Test that section chart is created successfully."""
basic_nis2_compliance_data.requirements = [
@@ -473,12 +495,17 @@ class TestNIS2SectionChart:
assert isinstance(chart_buffer, io.BytesIO)
assert chart_buffer.getvalue() # Not empty
+ chart_kwargs = patched_nis2_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["1. Policy on Security"]
+ assert chart_kwargs["values"] == [100.0]
+ assert chart_kwargs["xlabel"] == "Compliance (%)"
def test_section_chart_excludes_manual(
self,
nis2_generator,
basic_nis2_compliance_data,
mock_nis2_requirement_attribute_section1,
+ patched_nis2_charts,
):
"""Test that manual requirements are excluded from section chart."""
basic_nis2_compliance_data.requirements = [
@@ -515,6 +542,9 @@ class TestNIS2SectionChart:
# Should not raise any errors
chart_buffer = nis2_generator._create_section_chart(basic_nis2_compliance_data)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_nis2_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == ["1. Policy on Security"]
+ assert chart_kwargs["values"] == [100.0]
def test_section_chart_multiple_sections(
self,
@@ -523,6 +553,7 @@ class TestNIS2SectionChart:
mock_nis2_requirement_attribute_section1,
mock_nis2_requirement_attribute_section2,
mock_nis2_requirement_attribute_section11,
+ patched_nis2_charts,
):
"""Test section chart with multiple sections."""
basic_nis2_compliance_data.requirements = [
@@ -571,6 +602,13 @@ class TestNIS2SectionChart:
chart_buffer = nis2_generator._create_section_chart(basic_nis2_compliance_data)
assert isinstance(chart_buffer, io.BytesIO)
+ chart_kwargs = patched_nis2_charts["create_horizontal_bar_chart"][0]["kwargs"]
+ assert chart_kwargs["labels"] == [
+ "1. Policy on Security",
+ "2. Risk Management",
+ "11. Access Control",
+ ]
+ assert chart_kwargs["values"] == [100.0, 0.0, 100.0]
# =============================================================================
diff --git a/api/src/backend/tasks/tests/test_reports_provider_metadata.py b/api/src/backend/tasks/tests/test_reports_provider_metadata.py
new file mode 100644
index 0000000000..6fe1c32255
--- /dev/null
+++ b/api/src/backend/tasks/tests/test_reports_provider_metadata.py
@@ -0,0 +1,193 @@
+"""Tests for the credential-free provider metadata stub (PROWLER-2145).
+
+Every provider object used here is a plain ``SimpleNamespace`` WITHOUT a
+``secret`` attribute: any code path trying to read ``provider.secret`` (the
+coupling these tests guard against) would raise ``AttributeError`` and fail
+the test. No database is required.
+"""
+
+from types import SimpleNamespace
+
+import pytest
+from api.models import Provider
+from prowler.lib.outputs.finding import Finding as FindingOutput
+from prowler.providers.github.models import GithubIdentityInfo
+from tasks.jobs.reports import build_provider_metadata
+
+PROVIDER_UID = "provider-uid-123"
+PROVIDER_ALIAS = "my-provider-alias"
+
+
+def _provider_row(provider_type: str, alias: str | None = PROVIDER_ALIAS):
+ """Mimic the Provider DB row attributes read by build_provider_metadata."""
+ return SimpleNamespace(provider=provider_type, uid=PROVIDER_UID, alias=alias)
+
+
+class TestBuildProviderMetadata:
+ @pytest.mark.parametrize("provider_type", Provider.ProviderChoices.values)
+ def test_every_provider_type_gets_safe_defaults(self, provider_type):
+ stub = build_provider_metadata(_provider_row(provider_type))
+
+ assert stub.type == provider_type
+ assert isinstance(stub.auth_method, str)
+ assert hasattr(stub, "identity")
+
+ def test_aws_identity_account_is_uid(self):
+ stub = build_provider_metadata(_provider_row("aws"))
+ assert stub.identity.account == PROVIDER_UID
+
+ def test_azure_identity_covers_generate_output_accesses(self):
+ stub = build_provider_metadata(_provider_row("azure"))
+
+ # generate_output indexes tenant_ids[0] and reads these directly.
+ assert stub.identity.tenant_ids
+ assert stub.identity.identity_type == ""
+ assert stub.identity.identity_id == ""
+ assert stub.identity.subscriptions == {PROVIDER_UID: PROVIDER_ALIAS}
+
+ def test_gcp_projects_keyed_by_uid(self):
+ stub = build_provider_metadata(_provider_row("gcp"))
+
+ project = stub.projects[PROVIDER_UID]
+ assert project.id == PROVIDER_UID
+ assert project.name == PROVIDER_ALIAS
+ assert project.labels == {}
+ # generate_output calls getattr(project, "organization") without a
+ # default, so the attribute must exist (None skips the org branch).
+ assert project.organization is None
+
+ def test_kubernetes_identity_context_and_cluster(self):
+ stub = build_provider_metadata(_provider_row("kubernetes"))
+ assert stub.identity.context == PROVIDER_UID
+ assert stub.identity.cluster == PROVIDER_UID
+
+ def test_github_identity_is_real_identity_info(self):
+ # generate_output only assigns account fields inside
+ # isinstance(identity, Github*IdentityInfo) branches.
+ stub = build_provider_metadata(_provider_row("github"))
+ assert isinstance(stub.identity, GithubIdentityInfo)
+ assert stub.identity.account_id == PROVIDER_UID
+ assert stub.identity.account_name == PROVIDER_ALIAS
+
+ def test_iac_provider_uid(self):
+ stub = build_provider_metadata(_provider_row("iac"))
+ assert stub.provider_uid == PROVIDER_UID
+
+ def test_alias_falls_back_to_uid(self):
+ stub = build_provider_metadata(_provider_row("azure", alias=None))
+ assert stub.identity.subscriptions == {PROVIDER_UID: PROVIDER_UID}
+
+
+def _check_metadata_dict(provider_type: str, check_id: str) -> dict:
+ return {
+ "provider": provider_type,
+ "checkid": check_id,
+ "checktitle": "Test check title",
+ "checktype": [],
+ # CheckMetadata validates ServiceName == check_id.split("_")[0]
+ "servicename": check_id.split("_")[0],
+ "subservicename": "",
+ "severity": "high",
+ "resourcetype": "resource-type",
+ "description": "",
+ "risk": "",
+ "relatedurl": "",
+ "remediation": {
+ "recommendation": {"text": "", "url": ""},
+ "code": {"nativeiac": "", "terraform": "", "cli": "", "other": ""},
+ },
+ "resourceidtemplate": "",
+ "categories": [],
+ "dependson": [],
+ "relatedto": [],
+ "notes": "",
+ }
+
+
+class _FakeFinding:
+ """Attribute-faithful Finding stand-in.
+
+ A plain object instead of ``Mock``: only the attributes the Django model
+ exposes exist, so any new provider-attribute read in generate_output
+ (e.g. cloudflare's ``getattr(finding, "account_id", ...)``) hits the
+ same missing-attribute path it would hit in production instead of being
+ masked by Mock auto-created attributes.
+ """
+
+
+def _finding_model(provider_type: str, check_id: str, region: str):
+ """Mimic the Django Finding row attributes read by transform_api_finding."""
+ resource = SimpleNamespace(
+ uid="resource-uid",
+ name="resource-name",
+ metadata="{}",
+ details="",
+ region=region,
+ tags=SimpleNamespace(all=lambda: []),
+ )
+ finding = _FakeFinding()
+ finding.resources = SimpleNamespace(first=lambda: resource)
+ finding.check_metadata = _check_metadata_dict(provider_type, check_id)
+ finding.status = "FAIL"
+ finding.status_extended = "failed for testing"
+ finding.muted = False
+ return finding
+
+
+_FINDING_REGION = "region-x"
+
+# Expected (account_uid, region) of the transformed finding per provider
+# type, with resource.region = _FINDING_REGION. Keyed by every
+# Provider.ProviderChoices value so that adding a new provider type without
+# extending build_provider_metadata (and this table) fails the test below
+# instead of breaking PDF generation at runtime.
+_EXPECTED_TRANSFORM = {
+ "aws": (PROVIDER_UID, _FINDING_REGION),
+ "azure": (PROVIDER_UID, _FINDING_REGION),
+ "gcp": (PROVIDER_UID, _FINDING_REGION),
+ # transform_api_finding strips the "namespace: " prefix and
+ # generate_output re-adds it.
+ "kubernetes": (PROVIDER_UID, f"namespace: {_FINDING_REGION}"),
+ "m365": (PROVIDER_UID, _FINDING_REGION),
+ # For GitHub the owner comes from resource.region.
+ "github": (_FINDING_REGION, _FINDING_REGION),
+ "mongodbatlas": (PROVIDER_UID, _FINDING_REGION),
+ "iac": (PROVIDER_UID, _FINDING_REGION),
+ "oraclecloud": (PROVIDER_UID, _FINDING_REGION),
+ "alibabacloud": (PROVIDER_UID, _FINDING_REGION),
+ # Cloudflare uses the zone name (falls back to resource.name) as region.
+ "cloudflare": (PROVIDER_UID, "resource-name"),
+ "openstack": (PROVIDER_UID, _FINDING_REGION),
+ "image": ("image", _FINDING_REGION),
+ "googleworkspace": (PROVIDER_UID, _FINDING_REGION),
+ "vercel": (PROVIDER_UID, "global"),
+ "okta": (PROVIDER_UID, "global"),
+}
+
+
+class TestTransformApiFindingWithMetadataStub:
+ """transform_api_finding must work end-to-end with the stub — i.e.
+ without a credentialed SDK provider — for EVERY API provider type."""
+
+ @pytest.mark.parametrize("provider_type", Provider.ProviderChoices.values)
+ def test_transform_with_stub(self, provider_type):
+ assert provider_type in _EXPECTED_TRANSFORM, (
+ f"New provider type {provider_type!r}: add a branch to "
+ f"build_provider_metadata covering the attributes read by "
+ f"FindingOutput.generate_output, then add its expected "
+ f"(account_uid, region) here."
+ )
+ expected_account_uid, expected_region = _EXPECTED_TRANSFORM[provider_type]
+
+ stub = build_provider_metadata(_provider_row(provider_type))
+ check_id = f"{provider_type}_test_check"
+ finding_model = _finding_model(provider_type, check_id, _FINDING_REGION)
+
+ output = FindingOutput.transform_api_finding(finding_model, stub)
+
+ assert output.check_id == check_id
+ assert output.status == "FAIL"
+ assert output.account_uid == expected_account_uid
+ assert output.region == expected_region
+ assert output.resource_name
+ assert output.resource_uid
diff --git a/api/src/backend/tasks/tests/test_reports_threatscore.py b/api/src/backend/tasks/tests/test_reports_threatscore.py
index 07dd654a05..570a437eb3 100644
--- a/api/src/backend/tasks/tests/test_reports_threatscore.py
+++ b/api/src/backend/tasks/tests/test_reports_threatscore.py
@@ -10,6 +10,8 @@ from tasks.jobs.reports import (
RequirementData,
ThreatScoreReportGenerator,
)
+from tasks.jobs.reports import threatscore as threatscore_report_module
+from tasks.tests.report_test_helpers import patch_chart_helpers
# =============================================================================
# Fixtures
@@ -23,6 +25,13 @@ def threatscore_generator():
return ThreatScoreReportGenerator(config)
+@pytest.fixture
+def patched_threatscore_charts(monkeypatch):
+ return patch_chart_helpers(
+ monkeypatch, threatscore_report_module, ("create_vertical_bar_chart",)
+ )
+
+
@pytest.fixture
def mock_requirement_attribute():
"""Create a mock requirement attribute with numeric values."""
@@ -677,7 +686,7 @@ class TestSectionScoreChart:
"""Test suite for section score chart generation."""
def test_create_section_chart_empty_data(
- self, threatscore_generator, basic_compliance_data
+ self, threatscore_generator, basic_compliance_data, patched_threatscore_charts
):
"""Test chart creation with no requirements."""
basic_compliance_data.requirements = []
@@ -689,9 +698,22 @@ class TestSectionScoreChart:
assert isinstance(result, io.BytesIO)
assert result.getvalue() # Should have content
+ chart_kwargs = patched_threatscore_charts["create_vertical_bar_chart"][0][
+ "kwargs"
+ ]
+ assert chart_kwargs["labels"] == []
+ assert chart_kwargs["values"] == []
+ assert chart_kwargs["ylabel"] == "Compliance Score (%)"
+ assert chart_kwargs["xlabel"] == ""
+ assert chart_kwargs["color_func"]
+ assert chart_kwargs["rotation"] == 0
def test_create_section_chart_single_section(
- self, threatscore_generator, basic_compliance_data, mock_requirement_attribute
+ self,
+ threatscore_generator,
+ basic_compliance_data,
+ mock_requirement_attribute,
+ patched_threatscore_charts,
):
"""Test chart creation with a single section."""
basic_compliance_data.requirements = [
@@ -713,9 +735,14 @@ class TestSectionScoreChart:
)
assert isinstance(result, io.BytesIO)
+ chart_kwargs = patched_threatscore_charts["create_vertical_bar_chart"][0][
+ "kwargs"
+ ]
+ assert chart_kwargs["labels"] == ["1. IAM"]
+ assert chart_kwargs["values"] == [100.0]
def test_create_section_chart_multiple_sections(
- self, threatscore_generator, basic_compliance_data
+ self, threatscore_generator, basic_compliance_data, patched_threatscore_charts
):
"""Test chart creation with multiple sections."""
mock_attr_1 = Mock()
@@ -756,9 +783,14 @@ class TestSectionScoreChart:
)
assert isinstance(result, io.BytesIO)
+ chart_kwargs = patched_threatscore_charts["create_vertical_bar_chart"][0][
+ "kwargs"
+ ]
+ assert chart_kwargs["labels"] == ["1. IAM", "2. Attack Surface"]
+ assert chart_kwargs["values"] == [100.0, 50.0]
def test_create_section_chart_no_findings_section_gets_100(
- self, threatscore_generator, basic_compliance_data
+ self, threatscore_generator, basic_compliance_data, patched_threatscore_charts
):
"""Test that sections without findings get 100% score."""
mock_attr = Mock()
@@ -786,6 +818,11 @@ class TestSectionScoreChart:
)
assert isinstance(result, io.BytesIO)
+ chart_kwargs = patched_threatscore_charts["create_vertical_bar_chart"][0][
+ "kwargs"
+ ]
+ assert chart_kwargs["labels"] == ["1. IAM"]
+ assert chart_kwargs["values"] == [100.0]
# =============================================================================
@@ -797,7 +834,11 @@ class TestExecutiveSummary:
"""Test suite for executive summary generation."""
def test_executive_summary_contains_chart(
- self, threatscore_generator, basic_compliance_data, mock_requirement_attribute
+ self,
+ threatscore_generator,
+ basic_compliance_data,
+ mock_requirement_attribute,
+ patched_threatscore_charts,
):
"""Test that executive summary contains a chart."""
basic_compliance_data.requirements = [
@@ -818,9 +859,18 @@ class TestExecutiveSummary:
assert len(elements) > 0
assert any(isinstance(e, Image) for e in elements)
+ chart_kwargs = patched_threatscore_charts["create_vertical_bar_chart"][0][
+ "kwargs"
+ ]
+ assert chart_kwargs["labels"] == ["1. IAM"]
+ assert chart_kwargs["values"] == [100.0]
def test_executive_summary_contains_score_table(
- self, threatscore_generator, basic_compliance_data, mock_requirement_attribute
+ self,
+ threatscore_generator,
+ basic_compliance_data,
+ mock_requirement_attribute,
+ patched_threatscore_charts,
):
"""Test that executive summary contains a score table."""
basic_compliance_data.requirements = [
diff --git a/api/src/backend/tasks/tests/test_scan.py b/api/src/backend/tasks/tests/test_scan.py
index 17b3b65fc4..2a66985276 100644
--- a/api/src/backend/tasks/tests/test_scan.py
+++ b/api/src/backend/tasks/tests/test_scan.py
@@ -9,7 +9,7 @@ from unittest.mock import MagicMock, patch
import pytest
from api.db_router import MainRouter
-from api.exceptions import ProviderConnectionError
+from api.exceptions import ProviderConnectionError, ProviderDeletedException
from api.models import (
Finding,
MuteRule,
@@ -21,11 +21,13 @@ from api.models import (
StateChoices,
StatusChoices,
)
+from django.db import IntegrityError, OperationalError
from prowler.lib.check.models import Severity
from prowler.lib.outputs.finding import Status
from tasks.jobs.scan import (
_ATTACK_SURFACE_MAPPING_CACHE,
_aggregate_findings_by_region,
+ _bulk_update_resource_failed_findings_counts,
_copy_compliance_requirement_rows,
_create_compliance_summaries,
_create_finding_delta,
@@ -74,7 +76,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
with (
patch("api.db_utils.rls_transaction"),
@@ -132,7 +134,7 @@ class TestPerformScan:
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
# Ensure the provider type is 'aws' to match our mocks
provider.provider = Provider.ProviderChoices.AWS
@@ -241,11 +243,11 @@ class TestPerformScan:
mock_prowler_scan_class,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
tenant_id = str(tenant.id)
scan_id = str(scan.id)
@@ -262,6 +264,75 @@ class TestPerformScan:
assert provider.connected is False
assert isinstance(provider.connection_last_checked_at, datetime)
+ def test_perform_prowler_scan_provider_deleted_during_progress_update(
+ self,
+ tenants_fixture,
+ scans_fixture,
+ aws_provider,
+ ):
+ tenant = tenants_fixture[0]
+ scan = scans_fixture[0]
+ provider = aws_provider
+
+ tenant_id = str(tenant.id)
+ scan_id = str(scan.id)
+ provider_id = str(provider.id)
+
+ def scan_results():
+ Provider.objects.filter(pk=provider_id).delete()
+ yield 50, []
+
+ with (
+ patch(
+ "tasks.jobs.scan.initialize_prowler_provider",
+ return_value=MagicMock(),
+ ),
+ patch("tasks.jobs.scan.ProwlerScan") as mock_prowler_scan_class,
+ patch("tasks.jobs.scan.logger.error") as mock_logger_error,
+ ):
+ mock_prowler_scan_instance = MagicMock()
+ mock_prowler_scan_instance.scan.return_value = scan_results()
+ mock_prowler_scan_class.return_value = mock_prowler_scan_instance
+
+ with pytest.raises(ProviderDeletedException):
+ perform_prowler_scan(tenant_id, scan_id, provider_id, [])
+
+ mock_logger_error.assert_not_called()
+ assert not Scan.objects.filter(pk=scan_id).exists()
+
+ def test_perform_prowler_scan_sets_final_progress_when_progress_updates_are_throttled(
+ self,
+ tenants_fixture,
+ scans_fixture,
+ aws_provider,
+ ):
+ tenant = tenants_fixture[0]
+ scan = scans_fixture[0]
+ provider = aws_provider
+
+ tenant_id = str(tenant.id)
+ scan_id = str(scan.id)
+ provider_id = str(provider.id)
+
+ with (
+ patch(
+ "tasks.jobs.scan.initialize_prowler_provider",
+ return_value=MagicMock(),
+ ),
+ patch("tasks.jobs.scan.ProwlerScan") as mock_prowler_scan_class,
+ patch("tasks.jobs.scan.PROGRESS_THROTTLE_DELTA", 200),
+ patch("tasks.jobs.scan.PROGRESS_THROTTLE_SECONDS", 3600),
+ ):
+ mock_prowler_scan_instance = MagicMock()
+ mock_prowler_scan_instance.scan.return_value = [(99, []), (100, [])]
+ mock_prowler_scan_class.return_value = mock_prowler_scan_instance
+
+ perform_prowler_scan(tenant_id, scan_id, provider_id, [])
+
+ scan.refresh_from_db()
+ assert scan.state == StateChoices.COMPLETED
+ assert scan.progress == 100
+
@pytest.mark.parametrize(
"last_status, new_status, expected_delta",
[
@@ -440,7 +511,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test that failed findings increment the failed_findings_count"""
with (
@@ -461,7 +532,7 @@ class TestPerformScan:
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
# Ensure the provider type is 'aws'
provider.provider = Provider.ProviderChoices.AWS
@@ -518,7 +589,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test that multiple FAIL findings on the same resource increment the counter correctly"""
with (
@@ -535,7 +606,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -635,7 +706,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test that muted FAIL findings do not increment the failed_findings_count"""
with (
@@ -652,7 +723,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -706,13 +777,13 @@ class TestPerformScan:
def test_perform_prowler_scan_reset_failed_findings_count(
self,
tenants_fixture,
- providers_fixture,
+ aws_provider,
resources_fixture,
):
"""Test that failed_findings_count is reset to 0 at the beginning of each scan"""
# Use existing resource from fixture and set initial failed_findings_count
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
resource = resources_fixture[0]
# Set a non-zero failed_findings_count initially
@@ -789,11 +860,103 @@ class TestPerformScan:
# Assert that failed_findings_count was reset to 0 during the scan
assert resource.failed_findings_count == 0
+ def test_failed_findings_count_update_retries_deadlock_in_stable_order(
+ self, resources_fixture, monkeypatch
+ ):
+ resource1, resource2, _ = resources_fixture
+ tenant_id = str(resource1.tenant_id)
+ resource1.failed_findings_count = 2
+ resource2.failed_findings_count = 3
+ resources_to_update = [resource2, resource1]
+ expected_order = [
+ str(resource.id)
+ for resource in sorted(resources_to_update, key=lambda item: str(item.id))
+ ]
+ original_bulk_update = Resource.objects.bulk_update
+ bulk_update_calls = []
+
+ def flaky_bulk_update(objects, fields, batch_size=None):
+ bulk_update_calls.append([str(obj.id) for obj in objects])
+ if len(bulk_update_calls) == 1:
+ raise OperationalError("deadlock detected")
+ return original_bulk_update(objects, fields, batch_size=batch_size)
+
+ monkeypatch.setattr("tasks.jobs.scan.SCAN_DB_BATCH_SIZE", 10)
+ monkeypatch.setattr(Resource.objects, "bulk_update", flaky_bulk_update)
+
+ _bulk_update_resource_failed_findings_counts(
+ tenant_id=tenant_id,
+ scan_id="scan-id",
+ resources_to_update=resources_to_update,
+ )
+
+ resource1.refresh_from_db()
+ resource2.refresh_from_db()
+ assert resource1.failed_findings_count == 2
+ assert resource2.failed_findings_count == 3
+ assert bulk_update_calls == [expected_order, expected_order]
+
+ def test_failed_findings_count_update_does_not_retry_integrity_error(
+ self, resources_fixture, monkeypatch
+ ):
+ resource, *_ = resources_fixture
+ resource.failed_findings_count = 2
+ bulk_update_calls = []
+ sleep_calls = []
+
+ def failing_bulk_update(objects, fields, batch_size=None):
+ bulk_update_calls.append([str(obj.id) for obj in objects])
+ raise IntegrityError("constraint violation")
+
+ monkeypatch.setattr(Resource.objects, "bulk_update", failing_bulk_update)
+ monkeypatch.setattr("tasks.jobs.scan.time.sleep", sleep_calls.append)
+
+ with pytest.raises(IntegrityError, match="constraint violation"):
+ _bulk_update_resource_failed_findings_counts(
+ tenant_id=str(resource.tenant_id),
+ scan_id="scan-id",
+ resources_to_update=[resource],
+ )
+
+ assert len(bulk_update_calls) == 1
+ assert sleep_calls == []
+
+ def test_failed_findings_count_update_adds_jitter_to_retry_backoff(
+ self, resources_fixture, monkeypatch
+ ):
+ from tasks.jobs import scan as scan_jobs
+
+ resource, *_ = resources_fixture
+ resource.failed_findings_count = 2
+ bulk_update_calls = []
+ sleep_calls = []
+ original_bulk_update = Resource.objects.bulk_update
+
+ def flaky_bulk_update(objects, fields, batch_size=None):
+ bulk_update_calls.append([str(obj.id) for obj in objects])
+ if len(bulk_update_calls) == 1:
+ raise OperationalError("deadlock detected")
+ return original_bulk_update(objects, fields, batch_size=batch_size)
+
+ monkeypatch.setattr(Resource.objects, "bulk_update", flaky_bulk_update)
+ monkeypatch.setattr(scan_jobs, "random", MagicMock())
+ scan_jobs.random.uniform.return_value = 0.037
+ monkeypatch.setattr("tasks.jobs.scan.time.sleep", sleep_calls.append)
+
+ _bulk_update_resource_failed_findings_counts(
+ tenant_id=str(resource.tenant_id),
+ scan_id="scan-id",
+ resources_to_update=[resource],
+ )
+
+ scan_jobs.random.uniform.assert_called_once_with(0, 0.1)
+ assert sleep_calls == [0.137]
+
def test_perform_prowler_scan_with_active_mute_rules(
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test active MuteRule mutes findings with correct reason"""
with (
@@ -810,7 +973,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -910,7 +1073,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test inactive MuteRule does not mute findings"""
with (
@@ -927,7 +1090,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -996,7 +1159,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test mutelist processor takes precedence over MuteRule"""
with (
@@ -1013,7 +1176,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -1082,7 +1245,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test MuteRule with multiple finding UIDs mutes all findings"""
with (
@@ -1099,7 +1262,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -1181,7 +1344,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test scan continues when MuteRule loading fails"""
with (
@@ -1199,7 +1362,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -1264,7 +1427,7 @@ class TestPerformScan:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
):
"""Test muted_at timestamp is set correctly for muted findings"""
with (
@@ -1281,7 +1444,7 @@ class TestPerformScan:
):
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.AWS
provider.save()
@@ -1868,7 +2031,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
resources_fixture,
):
@@ -1919,7 +2082,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch(
@@ -1957,7 +2120,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
"""Re-running compliance materialization must not raise nor duplicate rows.
@@ -2012,7 +2175,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch(
@@ -2020,7 +2183,7 @@ class TestCreateComplianceRequirements:
) as mock_compliance_template:
tenant = tenants_fixture[0]
scan = scans_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
provider.provider = Provider.ProviderChoices.KUBERNETES
provider.save()
@@ -2058,7 +2221,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch(
@@ -2077,7 +2240,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider:
@@ -2161,7 +2324,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch(
@@ -2199,7 +2362,7 @@ class TestCreateComplianceRequirements:
self,
tenants_fixture,
scans_fixture,
- providers_fixture,
+ aws_provider,
findings_fixture,
):
with patch(
@@ -3489,6 +3652,95 @@ class TestAggregateFindings:
regions = {s.region for s in summaries}
assert regions == {"us-east-1", "us-west-2"}
+ @patch("tasks.jobs.scan.Finding.objects.filter")
+ @patch("tasks.jobs.scan.ScanSummary.objects.bulk_create")
+ @patch("tasks.jobs.scan.rls_transaction")
+ def test_aggregate_findings_orders_upserts_by_conflict_key(
+ self, mock_rls_transaction, mock_bulk_create, mock_findings_filter
+ ):
+ """Scan summaries must use a stable lock order for concurrent upserts."""
+ tenant_id = str(uuid.uuid4())
+ scan_id = str(uuid.uuid4())
+ counts = {
+ "fail": 1,
+ "_pass": 0,
+ "muted_count": 0,
+ "total": 1,
+ "new": 1,
+ "changed": 0,
+ "unchanged": 0,
+ "fail_new": 1,
+ "fail_changed": 0,
+ "pass_new": 0,
+ "pass_changed": 0,
+ "muted_new": 0,
+ "muted_changed": 0,
+ }
+
+ mock_queryset = MagicMock()
+ mock_queryset.values.return_value = mock_queryset
+ mock_queryset.annotate.return_value = [
+ {
+ "check_id": "check-b",
+ "resources__service": "s3",
+ "severity": "high",
+ "resources__region": "us-east-1",
+ **counts,
+ },
+ {
+ "check_id": "check-a",
+ "resources__service": "sqs",
+ "severity": "high",
+ "resources__region": "us-east-1",
+ **counts,
+ },
+ {
+ "check_id": "check-a",
+ "resources__service": "s3",
+ "severity": "medium",
+ "resources__region": "us-east-1",
+ **counts,
+ },
+ {
+ "check_id": "check-a",
+ "resources__service": "s3",
+ "severity": "high",
+ "resources__region": "us-west-2",
+ **counts,
+ },
+ {
+ "check_id": "check-a",
+ "resources__service": "s3",
+ "severity": "high",
+ "resources__region": "us-east-1",
+ **counts,
+ },
+ ]
+
+ ctx = MagicMock()
+ ctx.__enter__.return_value = None
+ ctx.__exit__.return_value = False
+ mock_rls_transaction.return_value = ctx
+ mock_findings_filter.return_value = mock_queryset
+
+ aggregate_findings(tenant_id, scan_id)
+
+ summaries = mock_bulk_create.call_args.args[0]
+ assert isinstance(summaries, list)
+ conflict_keys = [
+ (
+ str(summary.tenant_id),
+ str(summary.scan_id),
+ summary.check_id,
+ summary.service,
+ summary.severity,
+ summary.region,
+ )
+ for summary in summaries
+ ]
+ assert len(conflict_keys) == 5
+ assert conflict_keys == sorted(conflict_keys)
+
@patch("tasks.jobs.scan.Finding.objects.filter")
@patch("tasks.jobs.scan.ScanSummary.objects.bulk_create")
@patch("tasks.jobs.scan.rls_transaction")
@@ -4526,7 +4778,7 @@ class TestUpdateProviderComplianceScores:
self,
mock_psycopg_connection,
tenants_fixture,
- providers_fixture,
+ aws_provider,
scans_fixture,
settings,
):
@@ -4634,7 +4886,7 @@ class TestResetEphemeralResourceFindingsCount:
)
def test_resets_only_resources_missing_from_full_scope_scan(
- self, tenants_fixture, scans_fixture, providers_fixture, resources_fixture
+ self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
):
tenant, *_ = tenants_fixture
scan1, scan2, *_ = scans_fixture
@@ -4714,7 +4966,7 @@ class TestResetEphemeralResourceFindingsCount:
assert result["reason"] == "scan not found"
def test_skips_when_newer_scan_completed_for_same_provider(
- self, tenants_fixture, scans_fixture, providers_fixture, resources_fixture
+ self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
):
# If a newer completed scan exists for the same provider, our
# ResourceScanSummary set is stale relative to the resources' current
@@ -4723,7 +4975,7 @@ class TestResetEphemeralResourceFindingsCount:
tenant, *_ = tenants_fixture
scan1, *_ = scans_fixture
- provider, *_ = providers_fixture
+ provider = aws_provider
_, resource2, _ = resources_fixture
Resource.objects.filter(id=resource2.id).update(failed_findings_count=5)
@@ -4753,7 +5005,7 @@ class TestResetEphemeralResourceFindingsCount:
assert resource2.failed_findings_count == 5
def test_does_not_touch_other_providers_resources(
- self, tenants_fixture, scans_fixture, providers_fixture, resources_fixture
+ self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
):
tenant, *_ = tenants_fixture
scan1, *_ = scans_fixture
@@ -4819,14 +5071,14 @@ class TestResetEphemeralResourceFindingsCount:
assert resource2.failed_findings_count == 5
def test_ignores_sibling_scan_with_null_completed_at(
- self, tenants_fixture, scans_fixture, providers_fixture, resources_fixture
+ self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
):
# Postgres orders NULL first in DESC; a sibling COMPLETED scan with a
# missing completed_at must not be treated as the latest scan and
# cause us to incorrectly skip the reset.
tenant, *_ = tenants_fixture
scan1, *_ = scans_fixture
- provider, *_ = providers_fixture
+ provider = aws_provider
resource1, resource2, _ = resources_fixture
Resource.objects.filter(id=resource2.id).update(failed_findings_count=5)
diff --git a/api/src/backend/tasks/tests/test_tasks.py b/api/src/backend/tasks/tests/test_tasks.py
index 95634e8a95..476444cb00 100644
--- a/api/src/backend/tasks/tests/test_tasks.py
+++ b/api/src/backend/tasks/tests/test_tasks.py
@@ -3,6 +3,7 @@ from contextlib import contextmanager
from datetime import UTC, datetime, timedelta
from unittest.mock import MagicMock, patch
+import httpx
import openai
import pytest
from api.models import (
@@ -14,11 +15,13 @@ from api.models import (
Task,
)
from botocore.exceptions import ClientError
+from celery import states
from django_celery_beat.models import IntervalSchedule, PeriodicTask
from django_celery_results.models import TaskResult
from tasks.jobs.lighthouse_providers import (
_create_bedrock_client,
_extract_bedrock_credentials,
+ _LighthouseOpenAICompatibleNetworkBackend,
)
from tasks.tasks import (
DJANGO_TMP_OUTPUT_DIRECTORY,
@@ -1565,7 +1568,7 @@ class TestCheckLighthouseProviderConnectionTask:
(
LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
{"api_key": "sk-test123"},
- "https://openrouter.ai/api/v1",
+ "https://93.184.216.34/api/v1",
{"connected": True, "error": None},
),
(
@@ -1640,7 +1643,7 @@ class TestCheckLighthouseProviderConnectionTask:
(
LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
{"api_key": "sk-invalid"},
- "https://openrouter.ai/api/v1",
+ "https://93.184.216.34/api/v1",
openai.APIConnectionError(request=MagicMock()),
),
(
@@ -1754,6 +1757,166 @@ class TestCheckLighthouseProviderConnectionTask:
provider_cfg.refresh_from_db()
assert provider_cfg.is_active is False
+ def test_openai_compatible_connection_rejects_metadata_base_url_without_request(
+ self, tenants_fixture
+ ):
+ provider_cfg = LighthouseProviderConfiguration(
+ tenant_id=tenants_fixture[0].id,
+ provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+ base_url="https://169.254.169.254/latest/meta-data",
+ is_active=True,
+ )
+ provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+ provider_cfg.save()
+
+ with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+ eager_result = check_lighthouse_provider_connection_task.apply(
+ kwargs={
+ "provider_config_id": str(provider_cfg.id),
+ "tenant_id": str(tenants_fixture[0].id),
+ }
+ )
+
+ assert eager_result.successful()
+ result = eager_result.result
+ assert result["connected"] is False
+ assert "base url" in result["error"].lower()
+ mock_openai.assert_not_called()
+ provider_cfg.refresh_from_db()
+ assert provider_cfg.is_active is False
+
+ def test_openai_compatible_connection_disables_redirects(self, tenants_fixture):
+ provider_cfg = LighthouseProviderConfiguration(
+ tenant_id=tenants_fixture[0].id,
+ provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+ base_url="https://93.184.216.34/api/v1",
+ is_active=False,
+ )
+ provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+ provider_cfg.save()
+
+ with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+ mock_client = MagicMock()
+ mock_client.models.list.return_value = MagicMock()
+ mock_openai.return_value = mock_client
+
+ eager_result = check_lighthouse_provider_connection_task.apply(
+ kwargs={
+ "provider_config_id": str(provider_cfg.id),
+ "tenant_id": str(tenants_fixture[0].id),
+ }
+ )
+
+ assert eager_result.successful()
+ result = eager_result.result
+ assert result == {"connected": True, "error": None}
+ http_client = mock_openai.call_args.kwargs["http_client"]
+ assert http_client.follow_redirects is False
+ assert http_client.trust_env is False
+
+ def test_openai_compatible_connection_masks_remote_http_error(
+ self, tenants_fixture
+ ):
+ provider_cfg = LighthouseProviderConfiguration(
+ tenant_id=tenants_fixture[0].id,
+ provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+ base_url="https://93.184.216.34/api/v1",
+ is_active=True,
+ )
+ provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+ provider_cfg.save()
+ remote_body = "
"
+ response = httpx.Response(
+ 404,
+ request=httpx.Request("GET", "https://provider.example/v1/models"),
+ )
+
+ with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+ mock_client = MagicMock()
+ mock_client.models.list.side_effect = openai.NotFoundError(
+ remote_body,
+ response=response,
+ body=remote_body,
+ )
+ mock_openai.return_value = mock_client
+
+ eager_result = refresh_lighthouse_provider_models_task.apply(
+ kwargs={
+ "provider_config_id": str(provider_cfg.id),
+ "tenant_id": str(tenants_fixture[0].id),
+ }
+ )
+
+ assert eager_result.successful()
+ result = eager_result.result
+ assert result["created"] == 0
+ assert result["updated"] == 0
+ assert result["deleted"] == 0
+ assert result["error"] == "Provider connection failed"
+ assert remote_body not in result["error"]
+
def test_refresh_models_mixed_operations(self, tenants_fixture):
"""Test mixed create, update, and delete operations."""
# Create provider configuration
@@ -1963,11 +2226,11 @@ class TestCleanupOrphanScheduledScans:
)
def test_cleanup_deletes_orphan_when_both_available_and_scheduled_exist(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that AVAILABLE scan is deleted when SCHEDULED also exists."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Create orphan AVAILABLE scan
@@ -2003,11 +2266,11 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=scheduled_scan.id).exists()
def test_cleanup_does_not_delete_when_only_available_exists(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that AVAILABLE scan is NOT deleted when no SCHEDULED exists."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Create only AVAILABLE scan (normal first scan scenario)
@@ -2032,11 +2295,11 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=available_scan.id).exists()
def test_cleanup_does_not_delete_when_only_scheduled_exists(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that nothing is deleted when only SCHEDULED exists."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Create only SCHEDULED scan (normal subsequent scan scenario)
@@ -2061,11 +2324,11 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=scheduled_scan.id).exists()
def test_cleanup_returns_zero_when_no_scans_exist(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that cleanup returns 0 when no scans exist."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Execute cleanup with no scans
@@ -2078,11 +2341,11 @@ class TestCleanupOrphanScheduledScans:
assert deleted_count == 0
def test_cleanup_deletes_multiple_orphan_available_scans(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that multiple AVAILABLE orphan scans are all deleted."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Create multiple orphan AVAILABLE scans
@@ -2127,12 +2390,11 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=scheduled_scan.id).exists()
def test_cleanup_does_not_affect_different_provider(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider_pair
):
"""Test that cleanup only affects scans for the specified provider."""
tenant = tenants_fixture[0]
- provider1 = providers_fixture[0]
- provider2 = providers_fixture[1]
+ provider1, provider2 = aws_provider_pair
periodic_task1 = self._create_periodic_task(provider1.id, tenant.id)
periodic_task2 = self._create_periodic_task(provider2.id, tenant.id)
@@ -2177,12 +2439,10 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=scheduled_scan_p1.id).exists()
assert Scan.objects.filter(id=available_scan_p2.id).exists()
- def test_cleanup_does_not_affect_manual_scans(
- self, tenants_fixture, providers_fixture
- ):
+ def test_cleanup_does_not_affect_manual_scans(self, tenants_fixture, aws_provider):
"""Test that cleanup only affects SCHEDULED trigger scans, not MANUAL."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
# Create orphan AVAILABLE scheduled scan
@@ -2228,11 +2488,11 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=manual_scan.id).exists()
def test_cleanup_does_not_affect_different_scheduler_task(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Test that cleanup only affects scans with the specified scheduler_task_id."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task1 = self._create_periodic_task(provider.id, tenant.id)
# Create another periodic task
@@ -2286,6 +2546,51 @@ class TestCleanupOrphanScheduledScans:
assert Scan.objects.filter(id=scheduled_scan.id).exists()
assert Scan.objects.filter(id=available_scan_other_task.id).exists()
+ def test_cleanup_keeps_db_queued_scheduled_scans(
+ self, tenants_fixture, aws_provider
+ ):
+ """DB-queued scheduled scans have a task and must not be deleted as orphans."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ periodic_task = self._create_periodic_task(provider.id, tenant.id)
+ task_result = TaskResult.objects.create(
+ task_id=str(uuid.uuid4()),
+ task_name="scan-perform",
+ status="QUEUED",
+ )
+ queued_task = Task.objects.create(
+ id=task_result.task_id,
+ task_runner_task=task_result,
+ tenant_id=tenant.id,
+ )
+ queued_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Queued scheduled scan",
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ scheduler_task_id=periodic_task.id,
+ task=queued_task,
+ )
+ scheduled_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Daily scheduled scan",
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.SCHEDULED,
+ scheduler_task_id=periodic_task.id,
+ )
+
+ deleted_count = _cleanup_orphan_scheduled_scans(
+ tenant_id=str(tenant.id),
+ provider_id=str(provider.id),
+ scheduler_task_id=periodic_task.id,
+ )
+
+ assert deleted_count == 0
+ assert Scan.objects.filter(id=queued_scan.id).exists()
+ assert Scan.objects.filter(id=scheduled_scan.id).exists()
+
@pytest.mark.django_db
class TestPerformScheduledScanTask:
@@ -2334,12 +2639,12 @@ class TestPerformScheduledScanTask:
)
return task_result
- def test_skip_when_scheduled_scan_executing(
- self, tenants_fixture, providers_fixture
+ def test_queues_scheduled_scan_when_scheduled_scan_is_executing(
+ self, tenants_fixture, aws_provider
):
- """Skip a scheduled run when another scheduled scan is already executing."""
+ """Queue a scheduled run when another scheduled scan is executing."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
task_id = str(uuid.uuid4())
self._create_task_result(tenant.id, task_id)
@@ -2364,8 +2669,16 @@ class TestPerformScheduledScanTask:
mock_scan.assert_not_called()
mock_complete_tasks.assert_not_called()
- assert result["id"] == str(executing_scan.id)
- assert result["state"] == StateChoices.EXECUTING
+ assert result["id"] != str(executing_scan.id)
+ assert result["state"] == StateChoices.AVAILABLE
+ queued_scheduled_scan = Scan.objects.get(
+ tenant_id=tenant.id,
+ provider=provider,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ )
+ assert result["id"] == str(queued_scheduled_scan.id)
+ assert queued_scheduled_scan.task.task_runner_task.status == "QUEUED"
assert (
Scan.objects.filter(
tenant_id=tenant.id,
@@ -2373,15 +2686,141 @@ class TestPerformScheduledScanTask:
trigger=Scan.TriggerChoices.SCHEDULED,
state=StateChoices.SCHEDULED,
).count()
- == 0
+ == 1
+ )
+
+ def test_queues_scheduled_scan_when_manual_scan_is_pending(
+ self, tenants_fixture, aws_provider
+ ):
+ """Queue one scheduled run when a manual scan is already dispatched."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ self._create_periodic_task(provider.id, tenant.id)
+ task_id = str(uuid.uuid4())
+ self._create_task_result(tenant.id, task_id)
+ manual_task_result = TaskResult.objects.create(
+ task_id=str(uuid.uuid4()),
+ task_name="scan-perform",
+ status=states.PENDING,
+ )
+ manual_task = Task.objects.create(
+ id=manual_task_result.task_id,
+ task_runner_task=manual_task_result,
+ tenant_id=tenant.id,
+ )
+ manual_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Manual scan",
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ task=manual_task,
+ )
+
+ with (
+ patch("tasks.tasks.perform_prowler_scan") as mock_scan,
+ patch("tasks.tasks._perform_scan_complete_tasks") as mock_complete_tasks,
+ self._override_task_request(perform_scheduled_scan_task, id=task_id),
+ ):
+ result = perform_scheduled_scan_task.run(
+ tenant_id=str(tenant.id), provider_id=str(provider.id)
+ )
+
+ mock_scan.assert_not_called()
+ mock_complete_tasks.assert_not_called()
+ assert result["id"] != str(manual_scan.id)
+ assert result["state"] == StateChoices.AVAILABLE
+ queued_scheduled_scan = Scan.objects.get(
+ tenant_id=tenant.id,
+ provider=provider,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ )
+ assert result["id"] == str(queued_scheduled_scan.id)
+ assert queued_scheduled_scan.task.task_runner_task.status == "QUEUED"
+ scheduled_scan = Scan.objects.get(
+ tenant_id=tenant.id,
+ provider=provider,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.SCHEDULED,
+ )
+ assert scheduled_scan.scheduled_at > datetime.now(UTC)
+
+ def test_coalesces_scheduled_scan_when_one_is_already_queued(
+ self, tenants_fixture, aws_provider
+ ):
+ """Reuse the existing queued scheduled scan instead of adding another."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ periodic_task = self._create_periodic_task(provider.id, tenant.id)
+ task_id = str(uuid.uuid4())
+ self._create_task_result(tenant.id, task_id)
+ manual_task_result = TaskResult.objects.create(
+ task_id=str(uuid.uuid4()),
+ task_name="scan-perform",
+ status=states.PENDING,
+ )
+ manual_task = Task.objects.create(
+ id=manual_task_result.task_id,
+ task_runner_task=manual_task_result,
+ tenant_id=tenant.id,
+ )
+ Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Manual scan",
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ task=manual_task,
+ )
+ queued_task_result = TaskResult.objects.create(
+ task_id=str(uuid.uuid4()),
+ task_name="scan-perform",
+ status="QUEUED",
+ )
+ queued_task = Task.objects.create(
+ id=queued_task_result.task_id,
+ task_runner_task=queued_task_result,
+ tenant_id=tenant.id,
+ )
+ queued_scheduled_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Daily scheduled scan",
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ scheduler_task_id=periodic_task.id,
+ task=queued_task,
+ )
+
+ with (
+ patch("tasks.tasks.perform_prowler_scan") as mock_scan,
+ patch("tasks.tasks._perform_scan_complete_tasks") as mock_complete_tasks,
+ self._override_task_request(perform_scheduled_scan_task, id=task_id),
+ ):
+ result = perform_scheduled_scan_task.run(
+ tenant_id=str(tenant.id), provider_id=str(provider.id)
+ )
+
+ mock_scan.assert_not_called()
+ mock_complete_tasks.assert_not_called()
+ assert result["id"] == str(queued_scheduled_scan.id)
+ assert (
+ Scan.objects.filter(
+ tenant_id=tenant.id,
+ provider=provider,
+ trigger=Scan.TriggerChoices.SCHEDULED,
+ state=StateChoices.AVAILABLE,
+ ).count()
+ == 1
)
def test_creates_next_scheduled_scan_after_completion(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Create a next scheduled scan after a successful run completes."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
self._create_periodic_task(provider.id, tenant.id)
task_id = str(uuid.uuid4())
self._create_task_result(tenant.id, task_id)
@@ -2435,12 +2874,47 @@ class TestPerformScheduledScanTask:
== 1
)
+ def test_next_scheduled_scan_failure_does_not_mask_completed_scan(
+ self, tenants_fixture, aws_provider, caplog
+ ):
+ """Keep scheduled scan success when next-run creation fails."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ self._create_periodic_task(provider.id, tenant.id)
+ task_id = str(uuid.uuid4())
+ self._create_task_result(tenant.id, task_id)
+
+ def _complete_scan(tenant_id, scan_id, provider_id):
+ scan_instance = Scan.objects.get(id=scan_id)
+ scan_instance.state = StateChoices.COMPLETED
+ scan_instance.save()
+ return {"status": "ok"}
+
+ with (
+ patch("tasks.tasks.perform_prowler_scan", side_effect=_complete_scan),
+ patch("tasks.tasks._perform_scan_complete_tasks"),
+ patch(
+ "tasks.tasks._get_or_create_next_scheduled_scan",
+ side_effect=RuntimeError("scheduler unavailable"),
+ ),
+ patch("tasks.tasks._dispatch_next_queued_provider_scan") as mock_dispatch,
+ self._override_task_request(perform_scheduled_scan_task, id=task_id),
+ caplog.at_level("ERROR"),
+ ):
+ result = perform_scheduled_scan_task.run(
+ tenant_id=str(tenant.id), provider_id=str(provider.id)
+ )
+
+ assert result == {"status": "ok"}
+ mock_dispatch.assert_called_once_with(str(tenant.id), str(provider.id))
+ assert "Failed to ensure next scheduled scan" in caplog.text
+
def test_dedupes_multiple_scheduled_scans_before_run(
- self, tenants_fixture, providers_fixture
+ self, tenants_fixture, aws_provider
):
"""Ensure duplicated scheduled scans are removed before executing."""
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
periodic_task = self._create_periodic_task(provider.id, tenant.id)
task_id = str(uuid.uuid4())
self._create_task_result(tenant.id, task_id)
@@ -2549,6 +3023,104 @@ class TestPerformScanTask:
mock_scan.assert_not_called()
mock_complete_tasks.assert_not_called()
+ def test_dispatches_next_queued_scan_after_completion(
+ self,
+ tenants_fixture,
+ aws_provider,
+ django_capture_on_commit_callbacks,
+ ):
+ """Dispatch the next queued scan for the provider after completion."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ current_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Running scan",
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ )
+ queued_task_result = TaskResult.objects.create(
+ task_id=str(uuid.uuid4()),
+ task_name="scan-perform",
+ status="QUEUED",
+ )
+ queued_task = Task.objects.create(
+ id=queued_task_result.task_id,
+ task_runner_task=queued_task_result,
+ tenant_id=tenant.id,
+ )
+ queued_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Queued scan",
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ task=queued_task,
+ )
+
+ def _complete_scan(tenant_id, scan_id, provider_id, checks_to_execute=None):
+ scan_instance = Scan.objects.get(id=scan_id)
+ scan_instance.state = StateChoices.COMPLETED
+ scan_instance.save()
+ return {"status": "ok"}
+
+ with (
+ patch("tasks.tasks.perform_prowler_scan", side_effect=_complete_scan),
+ patch("tasks.tasks._perform_scan_complete_tasks"),
+ patch("tasks.tasks.perform_scan_task.apply_async") as mock_apply_async,
+ ):
+ with django_capture_on_commit_callbacks(execute=True):
+ result = perform_scan_task.run(
+ tenant_id=str(tenant.id),
+ scan_id=str(current_scan.id),
+ provider_id=str(provider.id),
+ )
+
+ queued_task_result.refresh_from_db()
+ assert result == {"status": "ok"}
+ assert queued_task_result.status == states.PENDING
+ mock_apply_async.assert_called_once_with(
+ kwargs={
+ "tenant_id": str(tenant.id),
+ "scan_id": str(queued_scan.id),
+ "provider_id": str(provider.id),
+ },
+ task_id=str(queued_task.id),
+ )
+
+ def test_dispatch_failure_does_not_mask_completed_scan(
+ self, tenants_fixture, aws_provider, caplog
+ ):
+ """Keep scan success when queued dispatch fails after completion."""
+ tenant = tenants_fixture[0]
+ provider = aws_provider
+ current_scan = Scan.objects.create(
+ tenant_id=tenant.id,
+ provider=provider,
+ name="Running scan",
+ trigger=Scan.TriggerChoices.MANUAL,
+ state=StateChoices.AVAILABLE,
+ )
+
+ with (
+ patch("tasks.tasks.perform_prowler_scan", return_value={"status": "ok"}),
+ patch("tasks.tasks._perform_scan_complete_tasks"),
+ patch(
+ "tasks.tasks._dispatch_next_queued_provider_scan",
+ side_effect=RuntimeError("dispatch unavailable"),
+ ) as mock_dispatch,
+ caplog.at_level("ERROR"),
+ ):
+ result = perform_scan_task.run(
+ tenant_id=str(tenant.id),
+ scan_id=str(current_scan.id),
+ provider_id=str(provider.id),
+ )
+
+ assert result == {"status": "ok"}
+ mock_dispatch.assert_called_once_with(str(tenant.id), str(provider.id))
+ assert "Failed to dispatch next queued scan" in caplog.text
+
@pytest.mark.django_db
class TestReaggregateAllFindingGroupSummaries:
@@ -2732,6 +3304,7 @@ class TestTaskTimeLimits:
for name in (
"scan-perform",
"scan-perform-scheduled",
+ "attack-paths-scan-perform",
"provider-deletion",
"tenant-deletion",
):
diff --git a/api/src/backend/tasks/utils.py b/api/src/backend/tasks/utils.py
index 26bc031d7b..cac9a10f0d 100644
--- a/api/src/backend/tasks/utils.py
+++ b/api/src/backend/tasks/utils.py
@@ -103,6 +103,7 @@ def _get_or_create_scheduled_scan(
trigger=Scan.TriggerChoices.SCHEDULED,
state__in=(StateChoices.SCHEDULED, StateChoices.AVAILABLE),
scheduler_task_id=scheduler_task_id,
+ task__isnull=True,
).order_by("scheduled_at", "inserted_at")
)
diff --git a/api/towncrier.toml b/api/towncrier.toml
new file mode 100644
index 0000000000..528e6129ec
--- /dev/null
+++ b/api/towncrier.toml
@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true
diff --git a/api/uv.lock b/api/uv.lock
index 06b1968c9a..de878d9dc9 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -110,7 +110,7 @@ constraints = [
{ name = "blinker", specifier = "==1.9.0" },
{ name = "boto3", specifier = "==1.40.61" },
{ name = "botocore", specifier = "==1.40.61" },
- { name = "cartography", specifier = "==0.135.0" },
+ { name = "cartography", specifier = "==0.138.1" },
{ name = "celery", specifier = "==5.6.2" },
{ name = "certifi", specifier = "==2026.1.4" },
{ name = "cffi", specifier = "==2.0.0" },
@@ -135,7 +135,6 @@ constraints = [
{ name = "debugpy", specifier = "==1.8.20" },
{ name = "decorator", specifier = "==5.2.1" },
{ name = "defusedxml", specifier = "==0.7.1" },
- { name = "detect-secrets", specifier = "==1.5.0" },
{ name = "dill", specifier = "==0.4.1" },
{ name = "distro", specifier = "==1.9.0" },
{ name = "dj-rest-auth", specifier = "==7.0.1" },
@@ -218,6 +217,7 @@ constraints = [
{ name = "jsonschema", specifier = "==4.23.0" },
{ name = "jsonschema-specifications", specifier = "==2025.9.1" },
{ name = "keystoneauth1", specifier = "==5.13.0" },
+ { name = "kingfisher-bin", specifier = "==1.104.0" },
{ name = "kiwisolver", specifier = "==1.4.9" },
{ name = "knack", specifier = "==0.11.0" },
{ name = "kombu", specifier = "==5.6.2" },
@@ -364,7 +364,7 @@ constraints = [
{ name = "wcwidth", specifier = "==0.5.3" },
{ name = "websocket-client", specifier = "==1.9.0" },
{ name = "werkzeug", specifier = "==3.1.7" },
- { name = "workos", specifier = "==6.0.4" },
+ { name = "workos", specifier = "==6.0.8" },
{ name = "wrapt", specifier = "==1.17.3" },
{ name = "xlsxwriter", specifier = "==3.2.9" },
{ name = "xmlsec", specifier = "==1.3.17" },
@@ -376,6 +376,7 @@ constraints = [
{ name = "zstd", specifier = "==1.5.7.3" },
]
overrides = [
+ { name = "azure-mgmt-containerservice", specifier = "==34.1.0" },
{ name = "dulwich", specifier = "==1.2.5" },
{ name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
{ name = "okta", specifier = "==3.4.2" },
@@ -1407,6 +1408,20 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/3d/66/0d8ae9ca4d75e57746026a1f9a10a7e25029511c128cf20166fce516bda9/azure_mgmt_logic-10.0.0-py3-none-any.whl", hash = "sha256:525c78afedf3edb35eb0a16152c8beba89769ee1bc6af01bcdc42842a551e443", size = 235433, upload-time = "2022-06-13T01:38:27.333Z" },
]
+[[package]]
+name = "azure-mgmt-managementgroups"
+version = "1.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "azure-mgmt-core" },
+ { name = "isodate" },
+ { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/fd/73/ac5e064ed7343e1b3172f32f09be3efca906087218d3046b5038f2f394ed/azure_mgmt_managementgroups-1.1.0.tar.gz", hash = "sha256:e6199baf118890ba2bda35dda83a88861c0b1bbef126311b20ec12eed9681951", size = 60101, upload-time = "2026-02-13T03:45:45.439Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/92/bc/993158de03cc0a49f2cf8192615ffedbc508c417cb3522e88f6652b714cc/azure_mgmt_managementgroups-1.1.0-py3-none-any.whl", hash = "sha256:140934589559ef6afcac6f1d24f995588a1965aaa89d47851c1cc639fafb1942", size = 83586, upload-time = "2026-02-13T03:45:46.836Z" },
+]
+
[[package]]
name = "azure-mgmt-monitor"
version = "6.0.2"
@@ -1726,7 +1741,7 @@ wheels = [
[[package]]
name = "cartography"
-version = "0.135.0"
+version = "0.138.1"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "adal" },
@@ -1746,6 +1761,7 @@ dependencies = [
{ name = "azure-mgmt-eventhub" },
{ name = "azure-mgmt-keyvault" },
{ name = "azure-mgmt-logic" },
+ { name = "azure-mgmt-managementgroups" },
{ name = "azure-mgmt-monitor" },
{ name = "azure-mgmt-network" },
{ name = "azure-mgmt-resource" },
@@ -1754,6 +1770,7 @@ dependencies = [
{ name = "azure-mgmt-storage" },
{ name = "azure-mgmt-synapse" },
{ name = "azure-mgmt-web" },
+ { name = "azure-storage-blob" },
{ name = "azure-synapse-artifacts" },
{ name = "backoff" },
{ name = "boto3" },
@@ -1765,8 +1782,12 @@ dependencies = [
{ name = "duo-client" },
{ name = "google-api-python-client" },
{ name = "google-auth" },
+ { name = "google-cloud-aiplatform" },
+ { name = "google-cloud-artifact-registry" },
{ name = "google-cloud-asset" },
{ name = "google-cloud-resource-manager" },
+ { name = "google-cloud-run" },
+ { name = "google-cloud-storage" },
{ name = "httpx" },
{ name = "kubernetes" },
{ name = "marshmallow" },
@@ -1792,9 +1813,9 @@ dependencies = [
{ name = "workos" },
{ name = "xmltodict" },
]
-sdist = { url = "https://files.pythonhosted.org/packages/39/47/606851d2403a983b63813b9e95427a5dd896e49bc5a501868c041262e9a5/cartography-0.135.0.tar.gz", hash = "sha256:3f500cd22c3b392d00e8b49f62acc95fd4dcd559ce514aafe2eb8101133c7a49", size = 9106458, upload-time = "2026-04-10T16:25:34.898Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/51/cd/0eb6a5a3c89cc179801d902ade9719af1a583c516c00f50d72b8207db1eb/cartography-0.138.1.tar.gz", hash = "sha256:356e946a0bcac899cba293d57803c71bd35fdeabe623f5f67d9405d7a643af9f", size = 9756966, upload-time = "2026-06-19T22:11:32.411Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/b1/e1/99a26b3e662202be77961aba73338e1448623490710b81783e53a4bbef15/cartography-0.135.0-py3-none-any.whl", hash = "sha256:c62c32a6917b8f23a8b98fe2b6c7c4a918b50f55918482966c4dae1cf5f538e1", size = 1590545, upload-time = "2026-04-10T16:25:37.669Z" },
+ { url = "https://files.pythonhosted.org/packages/a8/15/4447ec968825b2a19cba26ecb74964208aa3f941d9181a7782572e30b43d/cartography-0.138.1-py3-none-any.whl", hash = "sha256:88ec0898ea1a1b3f4653be9a3e7e61144f5cee20384b9040e92039617d39f029", size = 2014725, upload-time = "2026-06-19T22:11:29.886Z" },
]
[[package]]
@@ -2224,16 +2245,15 @@ wheels = [
]
[[package]]
-name = "detect-secrets"
-version = "1.5.0"
+name = "deprecated"
+version = "1.3.1"
source = { registry = "https://pypi.org/simple" }
dependencies = [
- { name = "pyyaml" },
- { name = "requests" },
+ { name = "wrapt" },
]
-sdist = { url = "https://files.pythonhosted.org/packages/69/67/382a863fff94eae5a0cf05542179169a1c49a4c8784a9480621e2066ca7d/detect_secrets-1.5.0.tar.gz", hash = "sha256:6bb46dcc553c10df51475641bb30fd69d25645cc12339e46c824c1e0c388898a", size = 97351, upload-time = "2024-05-06T17:46:19.721Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/49/85/12f0a49a7c4ffb70572b6c2ef13c90c88fd190debda93b23f026b25f9634/deprecated-1.3.1.tar.gz", hash = "sha256:b1b50e0ff0c1fddaa5708a2c6b0a6588bb09b892825ab2b214ac9ea9d92a5223", size = 2932523, upload-time = "2025-10-30T08:19:02.757Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/4e/5e/4f5fe4b89fde1dc3ed0eb51bd4ce4c0bca406246673d370ea2ad0c58d747/detect_secrets-1.5.0-py3-none-any.whl", hash = "sha256:e24e7b9b5a35048c313e983f76c4bd09dad89f045ff059e354f9943bf45aa060", size = 120341, upload-time = "2024-05-06T17:46:16.628Z" },
+ { url = "https://files.pythonhosted.org/packages/84/d0/205d54408c08b13550c733c4b85429e7ead111c7f0014309637425520a9a/deprecated-1.3.1-py2.py3-none-any.whl", hash = "sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f", size = 11298, upload-time = "2025-10-30T08:19:00.758Z" },
]
[[package]]
@@ -2511,6 +2531,15 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/e3/26/57c6fb270950d476074c087527a558ccb6f4436657314bfb6cdf484114c4/docker-7.1.0-py3-none-any.whl", hash = "sha256:c96b93b7f0a746f9e77d325bcfb87422a3d8bd4f03136ae8a85b37f1898d5fc0", size = 147774, upload-time = "2024-05-23T11:13:55.01Z" },
]
+[[package]]
+name = "docstring-parser"
+version = "0.18.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e0/4d/f332313098c1de1b2d2ff91cf2674415cc7cddab2ca1b01ae29774bd5fdf/docstring_parser-0.18.0.tar.gz", hash = "sha256:292510982205c12b1248696f44959db3cdd1740237a968ea1e2e7a900eeb2015", size = 29341, upload-time = "2026-04-14T04:09:19.867Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/a7/5f/ed01f9a3cdffbd5a008556fc7b2a08ddb1cc6ace7effa7340604b1d16699/docstring_parser-0.18.0-py3-none-any.whl", hash = "sha256:b3fcbed555c47d8479be0796ef7e19c2670d428d72e96da63f3a40122860374b", size = 22484, upload-time = "2026-04-14T04:09:18.638Z" },
+]
+
[[package]]
name = "dogpile-cache"
version = "1.5.0"
@@ -2851,6 +2880,11 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/83/1d/d6466de3a5249d35e832a52834115ca9d1d0de6abc22065f049707516d47/google_auth-2.48.0-py3-none-any.whl", hash = "sha256:2e2a537873d449434252a9632c28bfc268b0adb1e53f9fb62afc5333a975903f", size = 236499, upload-time = "2026-01-26T19:22:45.099Z" },
]
+[package.optional-dependencies]
+requests = [
+ { name = "requests" },
+]
+
[[package]]
name = "google-auth-httplib2"
version = "0.2.0"
@@ -2877,6 +2911,46 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/ca/94/24b010493660dd55e2d9769ae7ef44164aebd7e1f4a9266cf9459affd687/google_cloud_access_context_manager-0.3.0-py3-none-any.whl", hash = "sha256:5d15ad51547f06c281e35f16b4ffcb3e98bb2d898b01470f88b94edfb2eeb0a3", size = 58852, upload-time = "2025-10-17T02:30:33.768Z" },
]
+[[package]]
+name = "google-cloud-aiplatform"
+version = "1.153.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "docstring-parser" },
+ { name = "google-api-core", extra = ["grpc"] },
+ { name = "google-auth" },
+ { name = "google-cloud-bigquery" },
+ { name = "google-cloud-resource-manager" },
+ { name = "google-cloud-storage" },
+ { name = "google-genai" },
+ { name = "packaging" },
+ { name = "proto-plus" },
+ { name = "protobuf" },
+ { name = "pydantic" },
+ { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d5/97/1779e66ab845550bc602364311ea093ba156cb805a1c31b7c4d6f25b5863/google_cloud_aiplatform-1.153.1.tar.gz", hash = "sha256:445b6c683d5c630f174d81ae1f69f7da9e27e4d4ec5b70c5fe96de5c1247cfbc", size = 11011349, upload-time = "2026-05-15T06:34:14.851Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/16/01/8a1900e7a742ed480e6037ac4f6541466cb981d81bd4cbd34a9d46204ea1/google_cloud_aiplatform-1.153.1-py2.py3-none-any.whl", hash = "sha256:033fa1595a7e8ed1d97066e261e630f38fbc60e10c98c6487cf228fe9c7ec151", size = 9170782, upload-time = "2026-05-15T06:34:10.887Z" },
+]
+
+[[package]]
+name = "google-cloud-artifact-registry"
+version = "1.21.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-api-core", extra = ["grpc"] },
+ { name = "google-auth" },
+ { name = "grpc-google-iam-v1" },
+ { name = "grpcio" },
+ { name = "proto-plus" },
+ { name = "protobuf" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/13/2b/24e6956789bc1244efb18143aa4f124e03d870228e5bfd065c04d38a4d6b/google_cloud_artifact_registry-1.21.0.tar.gz", hash = "sha256:546e51eb5d463a6e5c668be6727d14f8ec82bc798031398006b2213d703e184c", size = 315219, upload-time = "2026-03-30T22:50:38.875Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/e1/8c/a5c68031728f38d3306bad5ac10c0ca670cbdf414db308ddefa2c47f2b34/google_cloud_artifact_registry-1.21.0-py3-none-any.whl", hash = "sha256:a07079035438fd0f2e7264d4318b388650495f011db575405c18c9881449025c", size = 250544, upload-time = "2026-03-30T22:48:49.345Z" },
+]
+
[[package]]
name = "google-cloud-asset"
version = "4.2.0"
@@ -2897,6 +2971,37 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/05/88/9a43fae1d2fed94d7f5f46b6f4c44bd15e5ea0e8657632108b5ec5f53d9d/google_cloud_asset-4.2.0-py3-none-any.whl", hash = "sha256:fd7ea04c64948a4779790343204cd5b41d4772d6ab1d05a9125e28a637ac0862", size = 282707, upload-time = "2026-01-09T14:53:03.081Z" },
]
+[[package]]
+name = "google-cloud-bigquery"
+version = "3.41.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-api-core", extra = ["grpc"] },
+ { name = "google-auth" },
+ { name = "google-cloud-core" },
+ { name = "google-resumable-media" },
+ { name = "packaging" },
+ { name = "python-dateutil" },
+ { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ce/13/6515c7aab55a4a0cf708ffd309fb9af5bab54c13e32dc22c5acd6497193c/google_cloud_bigquery-3.41.0.tar.gz", hash = "sha256:2217e488b47ed576360c9b2cc07d59d883a54b83167c0ef37f915c26b01a06fe", size = 513434, upload-time = "2026-03-30T22:50:55.347Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/40/33/1d3902efadef9194566d499d61507e1f038454e0b55499d2d7f8ab2a4fee/google_cloud_bigquery-3.41.0-py3-none-any.whl", hash = "sha256:2a5b5a737b401cbd824a6e5eac7554100b878668d908e6548836b5d8aaa4dcaa", size = 262343, upload-time = "2026-03-30T22:48:45.444Z" },
+]
+
+[[package]]
+name = "google-cloud-core"
+version = "2.6.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-api-core" },
+ { name = "google-auth" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a8/dd/1eef226e470369b26824a505c34482c0b493bc35fe8e0c6b003b5feca21a/google_cloud_core-2.6.0.tar.gz", hash = "sha256:e76149739f90fac1fc6757c09f47eaccb3145b54adbd7759b0f7c4b235f46c83", size = 36001, upload-time = "2026-05-07T08:04:04.124Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/84/4a/98da8930ab109c73d9a5d13782a9ebb81ea8c111f6d534a567b71d23e52b/google_cloud_core-2.6.0-py3-none-any.whl", hash = "sha256:6d63ac8e5eca6d9e4319d0a1e2265fadcd7f1049904378caecfa01cf52dd869e", size = 29390, upload-time = "2026-05-07T08:02:34.672Z" },
+]
+
[[package]]
name = "google-cloud-org-policy"
version = "1.16.0"
@@ -2946,6 +3051,93 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/94/ff/4b28bcc791d9d7e4ac8fea00fbd90ccb236afda56746a3b4564d2ae45df3/google_cloud_resource_manager-1.16.0-py3-none-any.whl", hash = "sha256:fb9a2ad2b5053c508e1c407ac31abfd1a22e91c32876c1892830724195819a28", size = 400218, upload-time = "2026-01-15T13:02:47.378Z" },
]
+[[package]]
+name = "google-cloud-run"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-api-core", extra = ["grpc"] },
+ { name = "google-auth" },
+ { name = "grpc-google-iam-v1" },
+ { name = "grpcio" },
+ { name = "proto-plus" },
+ { name = "protobuf" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b7/89/dcaf0dc97e39b41e446456ceb60657ab025de79cfccd39cbd739d1a9849e/google_cloud_run-0.16.0.tar.gz", hash = "sha256:d52cf4e6ad3702ae48caccf6abcab543afee6f61c2a6ec753cc62a31e5b629f1", size = 514452, upload-time = "2026-03-26T22:17:05.589Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/fa/c7/46153dc13713b5e4276d86f28ff4563332f9e4bae5ebc83abc5bfd994801/google_cloud_run-0.16.0-py3-none-any.whl", hash = "sha256:d7d2dd7307130fde2a0ce27e96d580dd23b7b2d973b6484b94d902e6b2618860", size = 459112, upload-time = "2026-03-26T22:16:00.018Z" },
+]
+
+[[package]]
+name = "google-cloud-storage"
+version = "3.10.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-api-core" },
+ { name = "google-auth" },
+ { name = "google-cloud-core" },
+ { name = "google-crc32c" },
+ { name = "google-resumable-media" },
+ { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4c/47/205eb8e9a1739b5345843e5a425775cbdc472cc38e7eda082ba5b8d02450/google_cloud_storage-3.10.1.tar.gz", hash = "sha256:97db9aa4460727982040edd2bd13ff3d5e2260b5331ad22895802da1fc2a5286", size = 17309950, upload-time = "2026-03-23T09:35:23.409Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/ad/ff/ca9ab2417fa913d75aae38bf40bf856bb2749a604b2e0f701b37cfcd23cc/google_cloud_storage-3.10.1-py3-none-any.whl", hash = "sha256:a72f656759b7b99bda700f901adcb3425a828d4a29f911bc26b3ea79c5b1217f", size = 324453, upload-time = "2026-03-23T09:35:21.368Z" },
+]
+
+[[package]]
+name = "google-crc32c"
+version = "1.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/03/41/4b9c02f99e4c5fb477122cd5437403b552873f014616ac1d19ac8221a58d/google_crc32c-1.8.0.tar.gz", hash = "sha256:a428e25fb7691024de47fecfbff7ff957214da51eddded0da0ae0e0f03a2cf79", size = 14192, upload-time = "2025-12-16T00:35:25.142Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/5d/ef/21ccfaab3d5078d41efe8612e0ed0bfc9ce22475de074162a91a25f7980d/google_crc32c-1.8.0-cp311-cp311-macosx_12_0_arm64.whl", hash = "sha256:014a7e68d623e9a4222d663931febc3033c5c7c9730785727de2a81f87d5bab8", size = 31298, upload-time = "2025-12-16T00:20:32.241Z" },
+ { url = "https://files.pythonhosted.org/packages/c5/b8/f8413d3f4b676136e965e764ceedec904fe38ae8de0cdc52a12d8eb1096e/google_crc32c-1.8.0-cp311-cp311-macosx_12_0_x86_64.whl", hash = "sha256:86cfc00fe45a0ac7359e5214a1704e51a99e757d0272554874f419f79838c5f7", size = 30872, upload-time = "2025-12-16T00:33:58.785Z" },
+ { url = "https://files.pythonhosted.org/packages/f6/fd/33aa4ec62b290477181c55bb1c9302c9698c58c0ce9a6ab4874abc8b0d60/google_crc32c-1.8.0-cp311-cp311-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:19b40d637a54cb71e0829179f6cb41835f0fbd9e8eb60552152a8b52c36cbe15", size = 33243, upload-time = "2025-12-16T00:40:21.46Z" },
+ { url = "https://files.pythonhosted.org/packages/71/03/4820b3bd99c9653d1a5210cb32f9ba4da9681619b4d35b6a052432df4773/google_crc32c-1.8.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:17446feb05abddc187e5441a45971b8394ea4c1b6efd88ab0af393fd9e0a156a", size = 33608, upload-time = "2025-12-16T00:40:22.204Z" },
+ { url = "https://files.pythonhosted.org/packages/7c/43/acf61476a11437bf9733fb2f70599b1ced11ec7ed9ea760fdd9a77d0c619/google_crc32c-1.8.0-cp311-cp311-win_amd64.whl", hash = "sha256:71734788a88f551fbd6a97be9668a0020698e07b2bf5b3aa26a36c10cdfb27b2", size = 34439, upload-time = "2025-12-16T00:35:20.458Z" },
+ { url = "https://files.pythonhosted.org/packages/e9/5f/7307325b1198b59324c0fa9807cafb551afb65e831699f2ce211ad5c8240/google_crc32c-1.8.0-cp312-cp312-macosx_12_0_arm64.whl", hash = "sha256:4b8286b659c1335172e39563ab0a768b8015e88e08329fa5321f774275fc3113", size = 31300, upload-time = "2025-12-16T00:21:56.723Z" },
+ { url = "https://files.pythonhosted.org/packages/21/8e/58c0d5d86e2220e6a37befe7e6a94dd2f6006044b1a33edf1ff6d9f7e319/google_crc32c-1.8.0-cp312-cp312-macosx_12_0_x86_64.whl", hash = "sha256:2a3dc3318507de089c5384cc74d54318401410f82aa65b2d9cdde9d297aca7cb", size = 30867, upload-time = "2025-12-16T00:38:31.302Z" },
+ { url = "https://files.pythonhosted.org/packages/ce/a9/a780cc66f86335a6019f557a8aaca8fbb970728f0efd2430d15ff1beae0e/google_crc32c-1.8.0-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:14f87e04d613dfa218d6135e81b78272c3b904e2a7053b841481b38a7d901411", size = 33364, upload-time = "2025-12-16T00:40:22.96Z" },
+ { url = "https://files.pythonhosted.org/packages/21/3f/3457ea803db0198c9aaca2dd373750972ce28a26f00544b6b85088811939/google_crc32c-1.8.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:cb5c869c2923d56cb0c8e6bcdd73c009c36ae39b652dbe46a05eb4ef0ad01454", size = 33740, upload-time = "2025-12-16T00:40:23.96Z" },
+ { url = "https://files.pythonhosted.org/packages/df/c0/87c2073e0c72515bb8733d4eef7b21548e8d189f094b5dad20b0ecaf64f6/google_crc32c-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:3cc0c8912038065eafa603b238abf252e204accab2a704c63b9e14837a854962", size = 34437, upload-time = "2025-12-16T00:35:21.395Z" },
+ { url = "https://files.pythonhosted.org/packages/52/c5/c171e4d8c44fec1422d801a6d2e5d7ddabd733eeda505c79730ee9607f07/google_crc32c-1.8.0-pp311-pypy311_pp73-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:87fa445064e7db928226b2e6f0d5304ab4cd0339e664a4e9a25029f384d9bb93", size = 28615, upload-time = "2025-12-16T00:40:29.298Z" },
+ { url = "https://files.pythonhosted.org/packages/9c/97/7d75fe37a7a6ed171a2cf17117177e7aab7e6e0d115858741b41e9dd4254/google_crc32c-1.8.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f639065ea2042d5c034bf258a9f085eaa7af0cd250667c0635a3118e8f92c69c", size = 28800, upload-time = "2025-12-16T00:40:30.322Z" },
+]
+
+[[package]]
+name = "google-genai"
+version = "1.68.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "anyio" },
+ { name = "distro" },
+ { name = "google-auth", extra = ["requests"] },
+ { name = "httpx" },
+ { name = "pydantic" },
+ { name = "requests" },
+ { name = "sniffio" },
+ { name = "tenacity" },
+ { name = "typing-extensions" },
+ { name = "websockets" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9c/2c/f059982dbcb658cc535c81bbcbe7e2c040d675f4b563b03cdb01018a4bc3/google_genai-1.68.0.tar.gz", hash = "sha256:ac30c0b8bc630f9372993a97e4a11dae0e36f2e10d7c55eacdca95a9fa14ca96", size = 511285, upload-time = "2026-03-18T01:03:18.243Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/84/de/7d3ee9c94b74c3578ea4f88d45e8de9405902f857932334d81e89bce3dfa/google_genai-1.68.0-py3-none-any.whl", hash = "sha256:a1bc9919c0e2ea2907d1e319b65471d3d6d58c54822039a249fe1323e4178d15", size = 750912, upload-time = "2026-03-18T01:03:15.983Z" },
+]
+
+[[package]]
+name = "google-resumable-media"
+version = "2.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "google-crc32c" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/00/4b/0b235beccc310d0a48adbc7246b719d173cca6c88c572dfa4b090e39143c/google_resumable_media-2.9.0.tar.gz", hash = "sha256:f7cfb224846a9dd444d125115dfbe8ef02a2b893e78f087762fe716a255a734b", size = 2164534, upload-time = "2026-05-07T08:04:44.236Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/07/73/3518e63deb1667c5409a4579e28daf5e84479a87a72c547e0487f7883dcd/google_resumable_media-2.9.0-py3-none-any.whl", hash = "sha256:c8901e88e389af8bed64d9696c74d8bad961865eb2236e13e0bfca9bb0a65ca3", size = 81507, upload-time = "2026-05-07T08:03:23.809Z" },
+]
+
[[package]]
name = "googleapis-common-protos"
version = "1.72.0"
@@ -3420,6 +3612,19 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/dd/99/76476a1057b349c860bae72e45d6ef438feb877c84ee7d565faf464e54c3/keystoneauth1-5.13.0-py3-none-any.whl", hash = "sha256:5ab81412eb0923ceb9c602cc3decce514b399523cb83d16b409ed3b0f9b03d41", size = 343585, upload-time = "2026-01-19T10:47:00.762Z" },
]
+[[package]]
+name = "kingfisher-bin"
+version = "1.104.0"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/1e/2b/324212f1baf482a7d4b66a2edf33073336735b67bb6b04a38d18fd9e67fb/kingfisher_bin-1.104.0-py3-none-macosx_10_9_x86_64.whl", hash = "sha256:8e3840e67004a971fef80aba240ee5c3c5f7a3a343a6d1083a2751aaf866d5d3", size = 14057606, upload-time = "2026-06-22T03:03:01.419Z" },
+ { url = "https://files.pythonhosted.org/packages/21/0a/cbf964da5102657cb9be4a59db7c9f7807ef88f9419673b7486daba785d3/kingfisher_bin-1.104.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b838313411fa2166a318a45aec2cfcc238e2f30f5292e309ca1129a73180c851", size = 12468386, upload-time = "2026-06-22T03:03:03.951Z" },
+ { url = "https://files.pythonhosted.org/packages/0b/a0/cc7ef0ac28f147cdfc9d80e4239fff11c1329831c6f57510c929e848753c/kingfisher_bin-1.104.0-py3-none-manylinux_2_17_aarch64.musllinux_1_2_aarch64.whl", hash = "sha256:0a94abbf2154ef8a3b4845cc0240e2321cdc19e0f5c7f585ea5252e76b242f68", size = 13943188, upload-time = "2026-06-22T03:03:06.378Z" },
+ { url = "https://files.pythonhosted.org/packages/17/79/827cfd7787885798a00b5ab905bdc866ef6f8deeff0f708679b06bc9baaa/kingfisher_bin-1.104.0-py3-none-manylinux_2_17_x86_64.musllinux_1_2_x86_64.whl", hash = "sha256:f381274b946f7f68ed72911770fff72024f2192c6e2e2158f2a7fbfda8c482fb", size = 14757594, upload-time = "2026-06-22T03:03:08.66Z" },
+ { url = "https://files.pythonhosted.org/packages/da/93/b0061fc69cd10382f647f9266823f213fd0b3f168f8b5bd9151a2370abb1/kingfisher_bin-1.104.0-py3-none-win_amd64.whl", hash = "sha256:f228d0dd61a738673b1c536e965a5661a83b1ee6ca64186a46ba6ea81ab4fd0b", size = 27697957, upload-time = "2026-06-22T03:03:11.268Z" },
+ { url = "https://files.pythonhosted.org/packages/a5/fb/f062665b4eb3f77e799cb6335e56bc2945aea83787888a6c1ab329858d0a/kingfisher_bin-1.104.0-py3-none-win_arm64.whl", hash = "sha256:a7774d9d11815ca946bd80b8c9df0f1d39c36cb5a21def3323b99d148dc63065", size = 26063704, upload-time = "2026-06-22T03:03:14.08Z" },
+]
+
[[package]]
name = "kiwisolver"
version = "1.4.9"
@@ -3513,6 +3718,20 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/08/10/9f8af3e6f569685ce3af7faab51c8dd9d93b9c38eba339ca31c746119447/kubernetes-32.0.1-py2.py3-none-any.whl", hash = "sha256:35282ab8493b938b08ab5526c7ce66588232df00ef5e1dbe88a419107dc10998", size = 1988070, upload-time = "2025-02-18T21:06:31.391Z" },
]
+[[package]]
+name = "linode-api4"
+version = "5.45.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "deprecated" },
+ { name = "polling" },
+ { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b2/b5/fce03d9b81008dcc0fe4961ce10e140ac3ae5ab17f2cdd659763e4964c0d/linode_api4-5.45.0.tar.gz", hash = "sha256:af8a0a5638345ad467447112dcf5d58ec47e7dd192b89ce0c8537a1e5c435d04", size = 283375, upload-time = "2026-06-11T18:05:13.671Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/18/38/19e3c8f7b7a9dbeea2aa5af61f70162bff5131b3d39acbe73e8d0dd12972/linode_api4-5.45.0-py3-none-any.whl", hash = "sha256:3cc2650b13d8d3bc7735fa8e92a639669618f320471dc8e519db778c6020eacd", size = 158336, upload-time = "2026-06-11T18:05:11.799Z" },
+]
+
[[package]]
name = "lxml"
version = "6.1.0"
@@ -4332,6 +4551,12 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/41/f5/65b66420c275e9b26513fdd6d84687403d11ac8be4650b67d1e5572b8f48/policyuniverse-1.5.1.20231109-py2.py3-none-any.whl", hash = "sha256:0b0ece0ee8285af31fc39ce09c82a551ca62e62bc2842e23952503bccb973321", size = 484251, upload-time = "2023-11-30T19:12:43.463Z" },
]
+[[package]]
+name = "polling"
+version = "0.3.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/c5/4249317962180d97ec7a60fe38aa91f86216533bd478a427a5468945c5c9/polling-0.3.2.tar.gz", hash = "sha256:3afd62320c99b725c70f379964bf548b302fc7f04d4604e6c315d9012309cc9a", size = 5189, upload-time = "2021-05-22T19:48:41.466Z" }
+
[[package]]
name = "portalocker"
version = "2.10.1"
@@ -4448,8 +4673,8 @@ wheels = [
[[package]]
name = "prowler"
-version = "5.31.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b5bb85c9564f6ca6a7f66c851bb56bde719205ee" }
+version = "5.35.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f5ea116763aeffede9f399c8934fc280eaccd315" }
dependencies = [
{ name = "alibabacloud-actiontrail20200706" },
{ name = "alibabacloud-credentials" },
@@ -4500,13 +4725,14 @@ dependencies = [
{ name = "dash" },
{ name = "dash-bootstrap-components" },
{ name = "defusedxml" },
- { name = "detect-secrets" },
{ name = "dulwich" },
{ name = "google-api-python-client" },
{ name = "google-auth-httplib2" },
{ name = "h2" },
{ name = "jsonschema" },
+ { name = "kingfisher-bin" },
{ name = "kubernetes" },
+ { name = "linode-api4" },
{ name = "markdown" },
{ name = "microsoft-kiota-abstractions" },
{ name = "msgraph-sdk" },
@@ -4536,7 +4762,7 @@ dependencies = [
[[package]]
name = "prowler-api"
-version = "1.33.0"
+version = "1.37.0"
source = { virtual = "." }
dependencies = [
{ name = "cartography" },
@@ -4606,7 +4832,7 @@ dev = [
[package.metadata]
requires-dist = [
- { name = "cartography", specifier = "==0.135.0" },
+ { name = "cartography", specifier = "==0.138.1" },
{ name = "celery", specifier = "==5.6.2" },
{ name = "defusedxml", specifier = "==0.7.1" },
{ name = "dj-rest-auth", extras = ["with-social", "jwt"], specifier = "==7.0.1" },
@@ -5931,6 +6157,38 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/34/db/b10e48aa8fff7407e67470363eac595018441cf32d5e1001567a7aeba5d2/websocket_client-1.9.0-py3-none-any.whl", hash = "sha256:af248a825037ef591efbf6ed20cc5faa03d3b47b9e5a2230a529eeee1c1fc3ef", size = 82616, upload-time = "2025-10-07T21:16:34.951Z" },
]
+[[package]]
+name = "websockets"
+version = "16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/04/24/4b2031d72e840ce4c1ccb255f693b15c334757fc50023e4db9537080b8c4/websockets-16.0.tar.gz", hash = "sha256:5f6261a5e56e8d5c42a4497b364ea24d94d9563e8fbd44e78ac40879c60179b5", size = 179346, upload-time = "2026-01-10T09:23:47.181Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/f2/db/de907251b4ff46ae804ad0409809504153b3f30984daf82a1d84a9875830/websockets-16.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:31a52addea25187bde0797a97d6fc3d2f92b6f72a9370792d65a6e84615ac8a8", size = 177340, upload-time = "2026-01-10T09:22:34.539Z" },
+ { url = "https://files.pythonhosted.org/packages/f3/fa/abe89019d8d8815c8781e90d697dec52523fb8ebe308bf11664e8de1877e/websockets-16.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:417b28978cdccab24f46400586d128366313e8a96312e4b9362a4af504f3bbad", size = 175022, upload-time = "2026-01-10T09:22:36.332Z" },
+ { url = "https://files.pythonhosted.org/packages/58/5d/88ea17ed1ded2079358b40d31d48abe90a73c9e5819dbcde1606e991e2ad/websockets-16.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:af80d74d4edfa3cb9ed973a0a5ba2b2a549371f8a741e0800cb07becdd20f23d", size = 175319, upload-time = "2026-01-10T09:22:37.602Z" },
+ { url = "https://files.pythonhosted.org/packages/d2/ae/0ee92b33087a33632f37a635e11e1d99d429d3d323329675a6022312aac2/websockets-16.0-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:08d7af67b64d29823fed316505a89b86705f2b7981c07848fb5e3ea3020c1abe", size = 184631, upload-time = "2026-01-10T09:22:38.789Z" },
+ { url = "https://files.pythonhosted.org/packages/c8/c5/27178df583b6c5b31b29f526ba2da5e2f864ecc79c99dae630a85d68c304/websockets-16.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7be95cfb0a4dae143eaed2bcba8ac23f4892d8971311f1b06f3c6b78952ee70b", size = 185870, upload-time = "2026-01-10T09:22:39.893Z" },
+ { url = "https://files.pythonhosted.org/packages/87/05/536652aa84ddc1c018dbb7e2c4cbcd0db884580bf8e95aece7593fde526f/websockets-16.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d6297ce39ce5c2e6feb13c1a996a2ded3b6832155fcfc920265c76f24c7cceb5", size = 185361, upload-time = "2026-01-10T09:22:41.016Z" },
+ { url = "https://files.pythonhosted.org/packages/6d/e2/d5332c90da12b1e01f06fb1b85c50cfc489783076547415bf9f0a659ec19/websockets-16.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1c1b30e4f497b0b354057f3467f56244c603a79c0d1dafce1d16c283c25f6e64", size = 184615, upload-time = "2026-01-10T09:22:42.442Z" },
+ { url = "https://files.pythonhosted.org/packages/77/fb/d3f9576691cae9253b51555f841bc6600bf0a983a461c79500ace5a5b364/websockets-16.0-cp311-cp311-win32.whl", hash = "sha256:5f451484aeb5cafee1ccf789b1b66f535409d038c56966d6101740c1614b86c6", size = 178246, upload-time = "2026-01-10T09:22:43.654Z" },
+ { url = "https://files.pythonhosted.org/packages/54/67/eaff76b3dbaf18dcddabc3b8c1dba50b483761cccff67793897945b37408/websockets-16.0-cp311-cp311-win_amd64.whl", hash = "sha256:8d7f0659570eefb578dacde98e24fb60af35350193e4f56e11190787bee77dac", size = 178684, upload-time = "2026-01-10T09:22:44.941Z" },
+ { url = "https://files.pythonhosted.org/packages/84/7b/bac442e6b96c9d25092695578dda82403c77936104b5682307bd4deb1ad4/websockets-16.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:71c989cbf3254fbd5e84d3bff31e4da39c43f884e64f2551d14bb3c186230f00", size = 177365, upload-time = "2026-01-10T09:22:46.787Z" },
+ { url = "https://files.pythonhosted.org/packages/b0/fe/136ccece61bd690d9c1f715baaeefd953bb2360134de73519d5df19d29ca/websockets-16.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:8b6e209ffee39ff1b6d0fa7bfef6de950c60dfb91b8fcead17da4ee539121a79", size = 175038, upload-time = "2026-01-10T09:22:47.999Z" },
+ { url = "https://files.pythonhosted.org/packages/40/1e/9771421ac2286eaab95b8575b0cb701ae3663abf8b5e1f64f1fd90d0a673/websockets-16.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:86890e837d61574c92a97496d590968b23c2ef0aeb8a9bc9421d174cd378ae39", size = 175328, upload-time = "2026-01-10T09:22:49.809Z" },
+ { url = "https://files.pythonhosted.org/packages/18/29/71729b4671f21e1eaa5d6573031ab810ad2936c8175f03f97f3ff164c802/websockets-16.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9b5aca38b67492ef518a8ab76851862488a478602229112c4b0d58d63a7a4d5c", size = 184915, upload-time = "2026-01-10T09:22:51.071Z" },
+ { url = "https://files.pythonhosted.org/packages/97/bb/21c36b7dbbafc85d2d480cd65df02a1dc93bf76d97147605a8e27ff9409d/websockets-16.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e0334872c0a37b606418ac52f6ab9cfd17317ac26365f7f65e203e2d0d0d359f", size = 186152, upload-time = "2026-01-10T09:22:52.224Z" },
+ { url = "https://files.pythonhosted.org/packages/4a/34/9bf8df0c0cf88fa7bfe36678dc7b02970c9a7d5e065a3099292db87b1be2/websockets-16.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a0b31e0b424cc6b5a04b8838bbaec1688834b2383256688cf47eb97412531da1", size = 185583, upload-time = "2026-01-10T09:22:53.443Z" },
+ { url = "https://files.pythonhosted.org/packages/47/88/4dd516068e1a3d6ab3c7c183288404cd424a9a02d585efbac226cb61ff2d/websockets-16.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:485c49116d0af10ac698623c513c1cc01c9446c058a4e61e3bf6c19dff7335a2", size = 184880, upload-time = "2026-01-10T09:22:55.033Z" },
+ { url = "https://files.pythonhosted.org/packages/91/d6/7d4553ad4bf1c0421e1ebd4b18de5d9098383b5caa1d937b63df8d04b565/websockets-16.0-cp312-cp312-win32.whl", hash = "sha256:eaded469f5e5b7294e2bdca0ab06becb6756ea86894a47806456089298813c89", size = 178261, upload-time = "2026-01-10T09:22:56.251Z" },
+ { url = "https://files.pythonhosted.org/packages/c3/f0/f3a17365441ed1c27f850a80b2bc680a0fa9505d733fe152fdf5e98c1c0b/websockets-16.0-cp312-cp312-win_amd64.whl", hash = "sha256:5569417dc80977fc8c2d43a86f78e0a5a22fee17565d78621b6bb264a115d4ea", size = 178693, upload-time = "2026-01-10T09:22:57.478Z" },
+ { url = "https://files.pythonhosted.org/packages/72/07/c98a68571dcf256e74f1f816b8cc5eae6eb2d3d5cfa44d37f801619d9166/websockets-16.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:349f83cd6c9a415428ee1005cadb5c2c56f4389bc06a9af16103c3bc3dcc8b7d", size = 174947, upload-time = "2026-01-10T09:23:36.166Z" },
+ { url = "https://files.pythonhosted.org/packages/7e/52/93e166a81e0305b33fe416338be92ae863563fe7bce446b0f687b9df5aea/websockets-16.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:4a1aba3340a8dca8db6eb5a7986157f52eb9e436b74813764241981ca4888f03", size = 175260, upload-time = "2026-01-10T09:23:37.409Z" },
+ { url = "https://files.pythonhosted.org/packages/56/0c/2dbf513bafd24889d33de2ff0368190a0e69f37bcfa19009ef819fe4d507/websockets-16.0-pp311-pypy311_pp73-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f4a32d1bd841d4bcbffdcb3d2ce50c09c3909fbead375ab28d0181af89fd04da", size = 176071, upload-time = "2026-01-10T09:23:39.158Z" },
+ { url = "https://files.pythonhosted.org/packages/a5/8f/aea9c71cc92bf9b6cc0f7f70df8f0b420636b6c96ef4feee1e16f80f75dd/websockets-16.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0298d07ee155e2e9fda5be8a9042200dd2e3bb0b8a38482156576f863a9d457c", size = 176968, upload-time = "2026-01-10T09:23:41.031Z" },
+ { url = "https://files.pythonhosted.org/packages/9a/3f/f70e03f40ffc9a30d817eef7da1be72ee4956ba8d7255c399a01b135902a/websockets-16.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:a653aea902e0324b52f1613332ddf50b00c06fdaf7e92624fbf8c77c78fa5767", size = 178735, upload-time = "2026-01-10T09:23:42.259Z" },
+ { url = "https://files.pythonhosted.org/packages/6f/28/258ebab549c2bf3e64d2b0217b973467394a9cea8c42f70418ca2c5d0d2e/websockets-16.0-py3-none-any.whl", hash = "sha256:1637db62fad1dc833276dded54215f2c7fa46912301a24bd94d45d46a011ceec", size = 171598, upload-time = "2026-01-10T09:23:45.395Z" },
+]
+
[[package]]
name = "werkzeug"
version = "3.1.7"
@@ -5945,16 +6203,16 @@ wheels = [
[[package]]
name = "workos"
-version = "6.0.4"
+version = "6.0.8"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "cryptography" },
{ name = "httpx" },
{ name = "pyjwt", extra = ["crypto"] },
]
-sdist = { url = "https://files.pythonhosted.org/packages/3c/2f/99fb8718274116c5c146c745755620fd5c5943f78ca52ca9b17e94348286/workos-6.0.4.tar.gz", hash = "sha256:b0bfe8fd212b8567422c4ea3732eb33608794033eb3a69900c6b04db183c32d6", size = 172217, upload-time = "2026-04-16T03:09:28.583Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/0d/0a7f78912657f99412c788932ea1f3f4089916e77bdef7d2463842febe08/workos-6.0.8.tar.gz", hash = "sha256:43aa3f1992a0a4ca8933d9b6e5ada846dd3b1fe0ee10e64c876ee2000fc6090d", size = 178137, upload-time = "2026-04-24T18:48:03.203Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/fa/f1/d2ab661e6dc2828a4c73e38f12630c3b109cfe2bc664ab70631c04f0db4b/workos-6.0.4-py3-none-any.whl", hash = "sha256:548668b3702673536f853ba72a7b5bbbc269e467aaf9ac4f477b6e0177df5e21", size = 511418, upload-time = "2026-04-16T03:09:27.098Z" },
+ { url = "https://files.pythonhosted.org/packages/b2/3f/3d96da80d650b2f97d58af626053354584f619dbb769051e118bd9cd1ca5/workos-6.0.8-py3-none-any.whl", hash = "sha256:a00dd4930333aded2babbba824f8032eea05c5ca8c44d04a3fa068cf6be6e21a", size = 524505, upload-time = "2026-04-24T18:48:01.389Z" },
]
[[package]]
diff --git a/claude_plugins/prowler/.claude-plugin/plugin.json b/claude_plugins/prowler/.claude-plugin/plugin.json
index 7bf822e2e7..c77187c3b0 100644
--- a/claude_plugins/prowler/.claude-plugin/plugin.json
+++ b/claude_plugins/prowler/.claude-plugin/plugin.json
@@ -22,7 +22,7 @@
"api_key": {
"type": "string",
"title": "Prowler API key",
- "description": "API key token used to authenticate with Prowler Cloud / Prowler App via the Prowler MCP server. Create one at https://cloud.prowler.com.",
+ "description": "API key token used to authenticate with Prowler (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server) via the Prowler MCP server. Create one at https://cloud.prowler.com.",
"sensitive": true,
"required": true
}
diff --git a/claude_plugins/prowler/skills/framework-compliance-triage/SKILL.md b/claude_plugins/prowler/skills/framework-compliance-triage/SKILL.md
index 1af29f82b9..f8a9ded0c6 100644
--- a/claude_plugins/prowler/skills/framework-compliance-triage/SKILL.md
+++ b/claude_plugins/prowler/skills/framework-compliance-triage/SKILL.md
@@ -38,12 +38,12 @@ If the framework is not supported, tell the user, suggest they request it or con
### 1.1 Connect to Prowler Cloud
-Verify the Prowler MCP connection by calling `prowler_app_search_providers` — a successful response returns the list of providers. If the call fails, walk the user through troubleshooting: internet connectivity, Prowler Cloud credentials, and permissions on the Prowler Cloud account.
+Verify the Prowler MCP connection by calling `prowler_search_providers` — a successful response returns the list of providers. If the call fails, walk the user through troubleshooting: internet connectivity, Prowler Cloud credentials, and permissions on the Prowler Cloud account.
For getting accurate information about configurations use `prowler_docs_search` to pull relevant instructions from the Prowler documentation.
### 1.2 Verify the provider is configured (or configure it)
-Call `prowler_app_search_providers` to check whether the target provider (AWS account, Azure Subscription, GitHub Account...) exists in the user's Prowler Cloud account. Handle the result based on what's found:
+Call `prowler_search_providers` to check whether the target provider (AWS account, Azure Subscription, GitHub Account...) exists in the user's Prowler Cloud account. Handle the result based on what's found:
- **Provider not present.** Guide the user through adding and configuring it. Retrieve the relevant connection, credential, and permission instructions with `prowler_docs_search`.
- **Provider present but misconfigured** (missing credentials, insufficient permissions, etc.). Walk the user through fixing the configuration, pulling the relevant guidance with `prowler_docs_search`.
@@ -57,15 +57,15 @@ Call `prowler_app_search_providers` to check whether the target provider (AWS ac
The flow needs at least one completed scan with a compliance report available.
-Look for a completed scan first: call `prowler_app_list_scans` with the selected `provider_id` and `state: ["completed"]`, then call `prowler_app_get_compliance_overview` with each `scan_id` to find one whose compliance report is available. If one is found, continue to the next section.
+Look for a completed scan first: call `prowler_list_scans` with the selected `provider_id` and `state: ["completed"]`, then call `prowler_get_compliance_overview` with each `scan_id` to find one whose compliance report is available. If one is found, continue to the next section.
-If no completed scan has a report, call `prowler_app_list_scans` again with `state: ["available", "executing"]` to detect a scan in progress.
+If no completed scan has a report, call `prowler_list_scans` again with `state: ["available", "executing"]` to detect a scan in progress.
> **Checkpoint — Scan-in-progress decision** *(conditional: an in-progress scan was detected)*
>
> Tell the user a scan is already running and ask whether to wait for it to complete or start a fresh one. Wait for the answer.
-If no scan is running (or the user chose to start a fresh one), trigger a new scan with `prowler_app_trigger_scan` and the `provider_id`. The link `https://cloud.prowler.com/scans?filter%5Bprovider_uid__in%5D={provider_id}` lets the user monitor progress.
+If no scan is running (or the user chose to start a fresh one), trigger a new scan with `prowler_trigger_scan` and the `provider_id`. The link `https://cloud.prowler.com/scans?filter%5Bprovider_uid__in%5D={provider_id}` lets the user monitor progress.
When a scan is in progress (either pre-existing and elected to wait, or just triggered), stop the flow and ask the user to return when it's completed — restart this section to re-check the results.
@@ -85,7 +85,7 @@ Status taxonomy for failed requirements and their findings:
### Report template
-A fresh report is rendered like this (substituting values from the `prowler_app_get_compliance_framework_state_details` Prowler MCP tool response):
+A fresh report is rendered like this (substituting values from the `prowler_get_compliance_framework_state_details` Prowler MCP tool response):
````markdown
# Compliance report:
@@ -120,7 +120,7 @@ A fresh report is rendered like this (substituting values from the `prowler_app_
Resolve the report path for the current `compliance_id` and provider account.
-If the file does not exist, call `prowler_app_get_compliance_framework_state_details` for the target scan, render the template above, and write the file with one initialization entry in the activity log.
+If the file does not exist, call `prowler_get_compliance_framework_state_details` for the target scan, render the template above, and write the file with one initialization entry in the activity log.
If the file exists, read it and compare its `Scan ID` to the target scan from section 1.3. When the scan matches, reuse the file and summarize remaining `[FAIL]` and `[IN PROGRESS]` items in chat.
@@ -128,7 +128,7 @@ If the file exists, read it and compare its `Scan ID` to the target scan from se
>
> Tell the user the report on disk was generated from a different scan and ask whether to refresh it from the new scan. Wait for the answer.
-On confirmation, regenerate the failed-requirements section from the new `prowler_app_get_compliance_framework_state_details` response, carry forward the **Global remediation approach** block and the full activity log, and append an activity-log entry noting the scan change.
+On confirmation, regenerate the failed-requirements section from the new `prowler_get_compliance_framework_state_details` response, carry forward the **Global remediation approach** block and the full activity log, and append an activity-log entry noting the scan change.
Once the file is current, surface the top failing requirements in chat: sort by finding count descending, show the top 5 with their codes and counts, and point to the file path for the full list.
@@ -174,7 +174,7 @@ Once approved, the loop proceeds through the batch without further prompts unles
Pick the first `[FAIL]` requirement at the top of the failed-requirements section. Move its status and every finding under it to `[IN PROGRESS]`, and add a `**Fix plan**:` sub-bullet describing what will be done.
-Call `prowler_app_get_finding_details` for each `finding_id` to retrieve the failing resource and the Prowler Hub's remediation guidance for that check using the tool `prowler_hub_get_check_details` with the `check_id` from the finding details. Summarize the guidance in chat, and append it to the `**Fix plan**` note for each finding.
+Call `prowler_get_finding_details` for each `finding_id` to retrieve the failing resource and the Prowler Hub's remediation guidance for that check using the tool `prowler_hub_get_check_details` with the `check_id` from the finding details. Summarize the guidance in chat, and append it to the `**Fix plan**` note for each finding.
If a finding does not apply to the target resource (Organization-only check on a User account, paid-tier feature, missing resource type, etc.), set the requirement status to `[SKIPPED]` with the reason, log it in the activity log, and move on without attempting the fix — even if it was missed during §3.2.
@@ -194,6 +194,6 @@ Move to the next `[FAIL]` requirement and repeat from section 3.3.
> **Checkpoint — Rescan trigger** *(conditional: no `[FAIL]` requirements remain; all are `[FIXED-UNVERIFIED]` or `[SKIPPED]`)*
>
-> Summarize what was applied, list any `[SKIPPED]` items with reasons, and ask whether to trigger a fresh scan with `prowler_app_trigger_scan` to verify the fixes end-to-end. Wait for the answer.
+> Summarize what was applied, list any `[SKIPPED]` items with reasons, and ask whether to trigger a fresh scan with `prowler_trigger_scan` to verify the fixes end-to-end. Wait for the answer.
On confirmation, trigger the rescan. When it completes, restart section 2.1 with the carry-forward path — requirements no longer in the new FAIL list move to `[PASS]`, anything still failing reverts to `[FAIL]` with the previous fix attempt visible in the activity log.
diff --git a/contrib/aws/multi-account-securityhub/Dockerfile b/contrib/aws/multi-account-securityhub/Dockerfile
index de5c57ba7b..7e5e7f5182 100644
--- a/contrib/aws/multi-account-securityhub/Dockerfile
+++ b/contrib/aws/multi-account-securityhub/Dockerfile
@@ -1,7 +1,7 @@
# Build command
# docker build --platform=linux/amd64 --no-cache -t prowler:latest .
-ARG PROWLER_VERSION=latest@sha256:4b796c6df40a3350c7947747b59bdda230d0da6222287500e13b0a8e1574aad4
+ARG PROWLER_VERSION=latest@sha256:ebb4ab999f10cb7e7c256226c2873de9b3bf2f3d855f385e0164bcf34104bfba
FROM toniblyx/prowler:${PROWLER_VERSION}
diff --git a/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml b/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml
index 8e219a9271..a76982d403 100644
--- a/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml
+++ b/contrib/k8s/helm/prowler-app/templates/api/configmap.yaml
@@ -7,4 +7,4 @@ metadata:
data:
{{- range $key, $value := .Values.api.djangoConfig }}
{{ $key }}: {{ $value | quote }}
- {{- end }}
\ No newline at end of file
+ {{- end }}
diff --git a/contrib/k8s/helm/prowler-app/templates/api/role.yaml b/contrib/k8s/helm/prowler-app/templates/api/role.yaml
index 172b035076..f55d3c7dc9 100644
--- a/contrib/k8s/helm/prowler-app/templates/api/role.yaml
+++ b/contrib/k8s/helm/prowler-app/templates/api/role.yaml
@@ -26,4 +26,4 @@ roleRef:
subjects:
- kind: ServiceAccount
name: {{ include "prowler.api.serviceAccountName" . }}
- namespace: {{ .Release.Namespace }}
\ No newline at end of file
+ namespace: {{ .Release.Namespace }}
diff --git a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
index b8f8edec30..cb6bd9c3a2 100644
--- a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
+++ b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
@@ -16,7 +16,7 @@
services:
nginx:
- image: nginx:alpine@sha256:8b1e78743a03dbb2c95171cc58639fef29abc8816598e27fb910ed2e621e589a
+ image: nginx:alpine@sha256:54f2a904c251d5a34adf545a72d32515a15e08418dae0266e23be2e18c66fefa
container_name: prowler-nginx
restart: unless-stopped
ports:
diff --git a/dashboard/__main__.py b/dashboard/__main__.py
index 664ce3bfa5..6a36bda7ed 100644
--- a/dashboard/__main__.py
+++ b/dashboard/__main__.py
@@ -20,7 +20,7 @@ print_banner()
print(
f"{Fore.GREEN}Loading all CSV files from the folder {folder_path_overview} ...\n{Style.RESET_ALL}"
)
-cli.show_server_banner = lambda *x: click.echo(
+cli.show_server_banner = lambda *_: click.echo(
f"{Fore.YELLOW}NOTE:{Style.RESET_ALL} If you are using {Fore.GREEN}{Style.BRIGHT}Prowler Cloud{Style.RESET_ALL} with the S3 integration or that integration \nfrom {Fore.CYAN}{Style.BRIGHT}Prowler CLI{Style.RESET_ALL} and you want to use your data from your S3 bucket,\nrun: `{orange_color}aws s3 cp s3:///output/csv ./output --recursive{Style.RESET_ALL}`\nand then run `prowler dashboard` again to load the new files."
)
@@ -33,148 +33,187 @@ dashboard = dash.Dash(
title="Prowler Dashboard",
)
-# Logo
-prowler_logo = html.Img(
- src="https://cdn.prod.website-files.com/68c4ec3f9fb7b154fbcb6e36/68ffb46d40ed7faa37a592a5_prowler-logo.png",
- alt="Prowler Logo",
+# ``use_pages`` above already imported dashboard/pages/cloud.py and registered
+# every /cloud/* route. Import its metadata now (after app instantiation) so
+# the sidebar and the gated pages share a single source of truth.
+from dashboard.pages.cloud import CLOUD_FEATURES_BY_SLUG # noqa: E402
+
+ICON_DIR = "/assets/images/icons/cloud"
+
+# Official marketing "PROWLER / LOCAL DASHBOARD" lockup (white wordmark + teal
+# gradient sublabel) shown in the expanded sidebar. Vector SVG so it stays crisp
+# at any DPI. The sublabel is right-anchored (text-anchor="end"), so a font
+# fallback widens it leftward rather than clipping at the edge.
+prowler_lockup = html.Img(
+ src=f"{ICON_DIR}/prowler-lockup.svg",
+ alt="Prowler Local Dashboard",
+ className="pc-brand-lockup",
)
-menu_icons = {
- "overview": "/assets/images/icons/overview.svg",
- "compliance": "/assets/images/icons/compliance.svg",
-}
+# Compact brand mark shown only when the sidebar collapses to its icon rail.
+prowler_mark = html.Img(
+ src=f"{ICON_DIR}/prowler-mark.svg",
+ alt="Prowler",
+ className="pc-brand-mark",
+)
+
+# Locally functional destinations (Overview + Compliance).
+DASHBOARD_ITEMS = [
+ {"label": "Overview", "route": "/", "icon": f"{ICON_DIR}/overview.svg"},
+ {
+ "label": "Compliance",
+ "route": "/compliance",
+ "icon": f"{ICON_DIR}/compliance.svg",
+ },
+]
+
+# Gated navigation groups reference the shared feature metadata by slug so the
+# sidebar and the informational pages never drift apart.
+GATED_GROUPS = [
+ ("Upgrade to Prowler Cloud", ["lighthouse-ai", "attack-paths", "findings"]),
+ ("Configuration", ["alerts", "mutelist", "integrations"]),
+ ("Workspace", ["organization"]),
+]
+
+HELP_LINKS = [
+ {
+ "title": "Help",
+ "url": "https://github.com/prowler-cloud/prowler/issues",
+ "icon": f"{ICON_DIR}/help.svg",
+ },
+ {
+ "title": "Docs",
+ "url": "https://docs.prowler.com",
+ "icon": f"{ICON_DIR}/docs.svg",
+ },
+]
-# Function to generate navigation links
-def generate_nav_links(current_path):
- nav_links = []
- for page in dash.page_registry.values():
- # Gets the icon URL based on the page name
- icon_url = menu_icons.get(page["name"].lower())
- is_active = (
- " bg-prowler-stone-950 border-r-4 border-solid border-prowler-lime"
- if current_path == page["relative_path"]
- else ""
- )
- link_class = f"block hover:bg-prowler-stone-950 hover:border-r-4 hover:border-solid hover:border-prowler-lime{is_active}"
+def _mask_style(icon_url):
+ """Inline style rendering a recolorable mask icon from a local asset."""
+ return {
+ "WebkitMaskImage": f"url({icon_url})",
+ "maskImage": f"url({icon_url})",
+ }
- link_content = html.Span(
+
+def _nav_icon(icon_url):
+ return html.Span(className="pc-ico", style=_mask_style(icon_url))
+
+
+def _nav_item(label, route, icon_url, current_path, gated=False):
+ is_active = current_path == route
+ class_name = "pc-nav-item pc-active" if is_active else "pc-nav-item"
+
+ content = [
+ _nav_icon(icon_url),
+ html.Span(label, className="pc-nav-label"),
+ ]
+ if gated:
+ content.append(html.Span("Prowler Cloud", className="pc-pill"))
+
+ return dcc.Link(content, href=route, className=class_name)
+
+
+def _section_label(title):
+ return html.Div(title, className="pc-section")
+
+
+def generate_sidebar(current_path):
+ children = [
+ # Brand lockup: full wordmark when expanded, compact mark when collapsed.
+ html.Div(
+ [prowler_lockup, prowler_mark],
+ className="pc-brand",
+ ),
+ # Dashboards section — the only locally functional destinations.
+ _section_label("Dashboards"),
+ html.Nav(
[
- html.Img(src=icon_url, className="w-5"),
- html.Span(
- page["name"], className="font-medium text-base leading-6 text-white"
- ),
+ _nav_item(item["label"], item["route"], item["icon"], current_path)
+ for item in DASHBOARD_ITEMS
],
- className="flex justify-center lg:justify-normal items-center gap-x-3 py-2 px-3",
- )
-
- nav_link = html.Li(
- dcc.Link(link_content, href=page["relative_path"], className=link_class)
- )
- nav_links.append(nav_link)
- return nav_links
-
-
-def generate_help_menu():
- help_links = [
- {
- "title": "Help",
- "url": "https://github.com/prowler-cloud/prowler/issues",
- "icon": "/assets/images/icons/help.png",
- },
- {
- "title": "Docs",
- "url": "https://docs.prowler.com",
- "icon": "/assets/images/icons/docs.png",
- },
+ className="pc-nav",
+ ),
]
- link_class = "block hover:bg-prowler-stone-950 hover:border-r-4 hover:border-solid hover:border-prowler-lime"
-
- menu_items = []
- for link in help_links:
- menu_item = html.Li(
- html.A(
- html.Span(
- [
- html.Img(src=link["icon"], className="w-5"),
- html.Span(
- link["title"],
- className="font-medium text-base leading-6 text-white",
- ),
- ],
- className="flex items-center gap-x-3 py-2 px-3",
- ),
- href=link["url"],
- target="_blank",
- className=link_class,
+ # Gated groups (Prowler Cloud only).
+ for section_title, slugs in GATED_GROUPS:
+ children.append(_section_label(section_title))
+ children.append(
+ html.Nav(
+ [
+ _nav_item(
+ CLOUD_FEATURES_BY_SLUG[slug]["nav_label"],
+ CLOUD_FEATURES_BY_SLUG[slug]["route"],
+ CLOUD_FEATURES_BY_SLUG[slug]["icon"],
+ current_path,
+ gated=True,
+ )
+ for slug in slugs
+ ],
+ className="pc-nav",
)
)
- menu_items.append(menu_item)
- return menu_items
+ # Help and Docs pinned to the bottom, separated by a neutral top border.
+ children.append(
+ html.Nav(
+ [
+ html.A(
+ [
+ _nav_icon(link["icon"]),
+ html.Span(link["title"], className="pc-nav-label"),
+ ],
+ href=link["url"],
+ target="_blank",
+ rel="noopener noreferrer",
+ className="pc-nav-item",
+ )
+ for link in HELP_LINKS
+ ],
+ className="pc-nav pc-footer",
+ )
+ )
+
+ return html.Div(children, className="pc-sidebar pc-font")
# Layout
dashboard.layout = html.Div(
[
- dcc.Location(id="url", refresh=False),
html.Link(rel="icon", href="assets/favicon.ico"),
- # Placeholder for dynamic navigation bar
html.Div(
[
+ # Dynamic sidebar (rebuilt on navigation for active state).
+ html.Div(id="navigation-bar"),
+ # Main pane hosting the routed page content.
html.Div(
- id="navigation-bar", className="bg-prowler-stone-900 min-w-36 z-10"
- ),
- html.Div(
- [
+ html.Div(
dash.page_container,
- ],
+ className="pc-main-inner",
+ ),
id="content_select",
- className="bg-prowler-white w-full col-span-11 h-screen mx-auto overflow-y-scroll no-scrollbar px-10 py-7",
+ className="pc-main pc-font no-scrollbar",
),
],
- className="grid custom-grid 2xl:custom-grid-large h-screen",
+ className="pc-shell",
),
],
className="h-screen mx-auto",
)
-# Callback to update navigation bar
-@dashboard.callback(Output("navigation-bar", "children"), [Input("url", "pathname")])
+# Callback to update navigation bar.
+#
+# Triggered off Dash Pages' own location (``_pages_location``) rather than a
+# separate ``dcc.Location``. A standalone ``dcc.Location(id="url")`` stops
+# emitting ``pathname`` when navigating between two pages that render an
+# identical component tree — every ``/cloud/*`` gated page shares the same
+# ``build_cloud_layout`` structure — which left the active highlight stuck on
+# the first gated page visited. ``_pages_location`` fires on every route change.
+@dashboard.callback(
+ Output("navigation-bar", "children"), [Input("_pages_location", "pathname")]
+)
def update_nav_bar(pathname):
- return html.Div(
- [
- html.Div([prowler_logo], className="mb-8 px-3"),
- html.H6(
- "Dashboards",
- className="px-3 text-prowler-stone-500 text-sm opacity-90 font-regular mb-2",
- ),
- html.Nav(
- [html.Ul(generate_nav_links(pathname), className="")],
- className="flex flex-col gap-y-6",
- ),
- html.Nav(
- [
- html.A(
- [
- html.Span(
- [
- html.Img(src="assets/favicon.ico", className="w-5"),
- "Subscribe to Prowler Cloud",
- ],
- className="flex items-center gap-x-3 text-white",
- ),
- ],
- href="https://prowler.com/",
- target="_blank",
- className="block p-3 uppercase text-xs hover:bg-prowler-stone-950 hover:border-r-4 hover:border-solid hover:border-prowler-lime",
- ),
- html.Ul(generate_help_menu(), className=""),
- ],
- className="flex flex-col gap-y-6 mt-auto",
- ),
- ],
- className="flex flex-col bg-prowler-stone-900 py-7 h-full",
- )
+ return generate_sidebar(pathname)
diff --git a/dashboard/assets/cloud-pages.css b/dashboard/assets/cloud-pages.css
new file mode 100644
index 0000000000..53052eabda
--- /dev/null
+++ b/dashboard/assets/cloud-pages.css
@@ -0,0 +1,389 @@
+/*
+ * Prowler Local Dashboard — Cloud upsell chrome & gated pages.
+ * These styles are self-contained (not dependent on the precompiled Tailwind
+ * bundle) so pixel specs from the PRD render reliably without a rebuild.
+ */
+
+@import url("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap");
+
+:root {
+ --pc-btn: #6ee7b7;
+ --pc-btn-hover: #99f6e4;
+ --pc-btn-press: #34d399;
+ --pc-grad-start: #2ee59b;
+ --pc-grad-end: #62dff0;
+ --pc-text: #020617;
+ --pc-text-2: #27272a;
+ --pc-sidebar-bg: #27272a;
+ --pc-pane-bg: #fdfdfd;
+ --pc-border: #e5e5e5;
+ --pc-teal-accent: #2ee59b;
+ --pc-sidebar-w: 264px;
+ --pc-sidebar-w-collapsed: 82px;
+}
+
+.pc-font {
+ font-family: "Inter", system-ui, -apple-system, "Segoe UI", Roboto,
+ Helvetica, Arial, sans-serif;
+}
+
+/* ----------------------------------------------------------------- Shell */
+
+.pc-shell {
+ display: flex;
+ height: 100vh;
+ width: 100%;
+ overflow: hidden;
+}
+
+.pc-main {
+ flex: 1 1 auto;
+ height: 100vh;
+ overflow-y: auto;
+ background: var(--pc-pane-bg);
+}
+
+.pc-main-inner {
+ padding: 28px 40px 64px;
+}
+
+/* --------------------------------------------------------------- Sidebar */
+
+.pc-sidebar {
+ flex: 0 0 var(--pc-sidebar-w);
+ width: var(--pc-sidebar-w);
+ background: var(--pc-sidebar-bg);
+ height: 100vh;
+ display: flex;
+ flex-direction: column;
+ padding: 22px 0 16px;
+ overflow-y: auto;
+ overflow-x: hidden;
+}
+
+.pc-sidebar::-webkit-scrollbar {
+ display: none;
+}
+
+.pc-brand {
+ display: flex;
+ align-items: center;
+ gap: 10px;
+ padding: 0 18px;
+ margin-bottom: 22px;
+}
+
+.pc-brand-lockup {
+ width: 190px;
+ height: auto;
+ display: block;
+}
+
+/* Compact mark is only revealed on the collapsed icon rail (see media query). */
+.pc-brand-mark {
+ width: 30px;
+ height: 30px;
+ flex: 0 0 auto;
+ display: none;
+}
+
+.pc-section {
+ color: #8a8a90;
+ font-size: 11px;
+ font-weight: 600;
+ letter-spacing: 0.07em;
+ text-transform: uppercase;
+ padding: 0 18px;
+ margin: 18px 0 8px;
+}
+
+.pc-nav {
+ display: flex;
+ flex-direction: column;
+ gap: 2px;
+}
+
+.pc-nav-item {
+ display: flex;
+ align-items: center;
+ gap: 10px;
+ padding: 9px 12px;
+ margin: 0 8px;
+ color: #ffffff;
+ font-size: 14px;
+ font-weight: 500;
+ text-decoration: none;
+ border-radius: 8px;
+ border-left: 3px solid transparent;
+ overflow: hidden;
+ transition: background 0.15s ease;
+}
+
+.pc-nav-item:hover {
+ background: rgba(255, 255, 255, 0.07);
+}
+
+.pc-nav-item.pc-active {
+ background: rgba(255, 255, 255, 0.09);
+ border-left-color: var(--pc-teal-accent);
+}
+
+.pc-nav-label {
+ flex: 0 1 auto;
+ min-width: 0;
+ white-space: nowrap;
+ overflow: hidden;
+ text-overflow: ellipsis;
+}
+
+/* Icon rendered as a recolorable mask so one asset serves any color. */
+.pc-ico {
+ width: 20px;
+ height: 20px;
+ flex: 0 0 auto;
+ display: inline-block;
+ background-color: currentColor;
+ -webkit-mask-repeat: no-repeat;
+ mask-repeat: no-repeat;
+ -webkit-mask-position: center;
+ mask-position: center;
+ -webkit-mask-size: contain;
+ mask-size: contain;
+}
+
+.pc-pill {
+ flex: 0 0 auto;
+ margin-left: auto;
+ display: inline-flex;
+ align-items: center;
+ background: linear-gradient(
+ 112deg,
+ var(--pc-grad-start) 3.5%,
+ var(--pc-grad-end) 98.8%
+ );
+ color: var(--pc-text);
+ font-size: 10px;
+ font-weight: 700;
+ letter-spacing: 0.02em;
+ line-height: 1;
+ padding: 3px 8px;
+ border-radius: 9999px;
+ white-space: nowrap;
+}
+
+.pc-footer {
+ margin-top: auto;
+ padding-top: 12px;
+ border-top: 1px solid rgba(255, 255, 255, 0.1);
+}
+
+/* -------------------------------------------------------- Gated page body */
+
+.pc-page {
+ max-width: 1120px;
+ margin: 0 auto;
+}
+
+.pc-page-header {
+ border-bottom: 1px solid var(--pc-border);
+ padding-bottom: 18px;
+ margin-bottom: 28px;
+}
+
+.pc-page-title-row {
+ display: flex;
+ align-items: center;
+ gap: 12px;
+}
+
+/* In the page header the badge sits right next to the title (not pushed to the
+ far right like the sidebar pills) and is uppercased for emphasis. */
+.pc-page-title-row .pc-pill {
+ margin-left: 0;
+ text-transform: uppercase;
+ letter-spacing: 0.04em;
+}
+
+.pc-page-title {
+ font-size: 24px;
+ font-weight: 700;
+ color: var(--pc-text);
+ margin: 0;
+}
+
+.pc-page-subtitle {
+ font-size: 15px;
+ line-height: 24px;
+ color: #52525b;
+ margin: 8px 0 0;
+}
+
+/* ----------------------------------------------------------- Upgrade card */
+
+.pc-card {
+ position: relative;
+ background: #ffffff;
+ border: 1px solid var(--pc-border);
+ border-radius: 18px;
+ padding: 56px 40px;
+ overflow: hidden;
+}
+
+.pc-card-glow {
+ position: absolute;
+ top: 0;
+ left: 50%;
+ transform: translateX(-50%);
+ width: 560px;
+ height: 240px;
+ background: radial-gradient(
+ ellipse at top,
+ rgba(46, 229, 155, 0.2),
+ rgba(98, 223, 240, 0.06) 45%,
+ transparent 72%
+ );
+ pointer-events: none;
+}
+
+.pc-card-body {
+ position: relative;
+ z-index: 1;
+ display: flex;
+ flex-direction: column;
+ align-items: center;
+ text-align: center;
+}
+
+.pc-feature-icon {
+ width: 64px;
+ height: 64px;
+ border-radius: 16px;
+ background: linear-gradient(
+ 135deg,
+ rgba(46, 229, 155, 0.16),
+ rgba(98, 223, 240, 0.14)
+ );
+ border: 1px solid rgba(46, 229, 155, 0.3);
+ display: flex;
+ align-items: center;
+ justify-content: center;
+ color: var(--pc-text);
+ margin-bottom: 22px;
+}
+
+.pc-feature-icon .pc-ico {
+ width: 30px;
+ height: 30px;
+}
+
+.pc-avail {
+ color: #0e9f6e;
+ font-size: 12px;
+ font-weight: 700;
+ letter-spacing: 0.09em;
+ text-transform: uppercase;
+ margin-bottom: 8px;
+}
+
+.pc-card-title {
+ font-size: 24px;
+ font-weight: 700;
+ color: var(--pc-text);
+ margin: 0 0 14px;
+}
+
+.pc-card-desc {
+ font-size: 15px;
+ line-height: 24px;
+ color: var(--pc-text-2);
+ max-width: 560px;
+ margin: 0 0 26px;
+}
+
+.pc-benefits {
+ list-style: none;
+ padding: 0;
+ margin: 0 0 30px;
+ text-align: left;
+}
+
+.pc-benefit {
+ display: flex;
+ align-items: flex-start;
+ gap: 10px;
+ padding: 7px 0;
+ font-size: 15px;
+ line-height: 22px;
+ color: var(--pc-text-2);
+}
+
+.pc-benefit-check {
+ flex: 0 0 auto;
+ width: 18px;
+ height: 18px;
+ margin-top: 2px;
+ color: var(--pc-btn-press);
+}
+
+.pc-cta {
+ display: inline-flex;
+ align-items: center;
+ justify-content: center;
+ background: var(--pc-btn);
+ color: var(--pc-text);
+ font-size: 15px;
+ font-weight: 700;
+ padding: 12px 24px;
+ border-radius: 12px;
+ border: 1px solid var(--pc-btn-press);
+ text-decoration: none;
+ cursor: pointer;
+ transition: background 0.15s ease;
+}
+
+.pc-cta:hover {
+ background: var(--pc-btn-hover);
+ color: var(--pc-text);
+}
+
+.pc-cta:active {
+ background: var(--pc-btn-press);
+}
+
+/* --------------------------------------------------- Responsive collapse */
+
+@media (max-width: 900px) {
+ .pc-sidebar {
+ flex-basis: var(--pc-sidebar-w-collapsed);
+ width: var(--pc-sidebar-w-collapsed);
+ }
+
+ .pc-brand {
+ justify-content: center;
+ padding: 0 8px;
+ }
+
+ .pc-brand-lockup {
+ display: none;
+ }
+
+ .pc-brand-mark {
+ display: block;
+ }
+
+ .pc-section,
+ .pc-nav-label,
+ .pc-pill {
+ display: none;
+ }
+
+ .pc-nav-item {
+ justify-content: center;
+ margin: 0 6px;
+ padding: 10px 0;
+ }
+
+ .pc-main-inner {
+ padding: 20px 18px 48px;
+ }
+}
diff --git a/dashboard/assets/images/icons/cloud/alerts.svg b/dashboard/assets/images/icons/cloud/alerts.svg
new file mode 100644
index 0000000000..6109e378ab
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/alerts.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/attack-paths.svg b/dashboard/assets/images/icons/cloud/attack-paths.svg
new file mode 100644
index 0000000000..b856c6ea2f
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/attack-paths.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/check.svg b/dashboard/assets/images/icons/cloud/check.svg
new file mode 100644
index 0000000000..a5f8ed0c8a
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/check.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/compliance.svg b/dashboard/assets/images/icons/cloud/compliance.svg
new file mode 100644
index 0000000000..e70ebda28c
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/compliance.svg
@@ -0,0 +1,4 @@
+
diff --git a/dashboard/assets/images/icons/cloud/docs.svg b/dashboard/assets/images/icons/cloud/docs.svg
new file mode 100644
index 0000000000..efc3dfc61b
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/docs.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/findings.svg b/dashboard/assets/images/icons/cloud/findings.svg
new file mode 100644
index 0000000000..93fc42a516
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/findings.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/help.svg b/dashboard/assets/images/icons/cloud/help.svg
new file mode 100644
index 0000000000..2b3f1024e8
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/help.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/integrations.svg b/dashboard/assets/images/icons/cloud/integrations.svg
new file mode 100644
index 0000000000..e7a2d07603
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/integrations.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/lighthouse-ai.svg b/dashboard/assets/images/icons/cloud/lighthouse-ai.svg
new file mode 100644
index 0000000000..1c510ac1fc
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/lighthouse-ai.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/mutelist.svg b/dashboard/assets/images/icons/cloud/mutelist.svg
new file mode 100644
index 0000000000..1d498fa9e3
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/mutelist.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/organization.svg b/dashboard/assets/images/icons/cloud/organization.svg
new file mode 100644
index 0000000000..1f3d1da9f5
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/organization.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/overview.svg b/dashboard/assets/images/icons/cloud/overview.svg
new file mode 100644
index 0000000000..809e63d945
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/overview.svg
@@ -0,0 +1,4 @@
+
diff --git a/dashboard/assets/images/icons/cloud/prowler-lockup.svg b/dashboard/assets/images/icons/cloud/prowler-lockup.svg
new file mode 100644
index 0000000000..9daee36463
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/prowler-lockup.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/assets/images/icons/cloud/prowler-mark.svg b/dashboard/assets/images/icons/cloud/prowler-mark.svg
new file mode 100644
index 0000000000..eb30d44be8
--- /dev/null
+++ b/dashboard/assets/images/icons/cloud/prowler-mark.svg
@@ -0,0 +1 @@
+
diff --git a/dashboard/compliance/cis_2_0_1_kubernetes.py b/dashboard/compliance/cis_2_0_1_kubernetes.py
new file mode 100644
index 0000000000..94558f33ad
--- /dev/null
+++ b/dashboard/compliance/cis_2_0_1_kubernetes.py
@@ -0,0 +1,24 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_cis
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+ aux = data[
+ [
+ "REQUIREMENTS_ID",
+ "REQUIREMENTS_DESCRIPTION",
+ "REQUIREMENTS_ATTRIBUTES_SECTION",
+ "CHECKID",
+ "STATUS",
+ "REGION",
+ "ACCOUNTID",
+ "RESOURCEID",
+ ]
+ ].copy()
+
+ return get_section_containers_cis(
+ aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
+ )
diff --git a/dashboard/compliance/cis_5_0_gcp.py b/dashboard/compliance/cis_5_0_gcp.py
new file mode 100644
index 0000000000..94558f33ad
--- /dev/null
+++ b/dashboard/compliance/cis_5_0_gcp.py
@@ -0,0 +1,24 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_cis
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+ aux = data[
+ [
+ "REQUIREMENTS_ID",
+ "REQUIREMENTS_DESCRIPTION",
+ "REQUIREMENTS_ATTRIBUTES_SECTION",
+ "CHECKID",
+ "STATUS",
+ "REGION",
+ "ACCOUNTID",
+ "RESOURCEID",
+ ]
+ ].copy()
+
+ return get_section_containers_cis(
+ aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
+ )
diff --git a/dashboard/compliance/cis_6_0_azure.py b/dashboard/compliance/cis_6_0_azure.py
new file mode 100644
index 0000000000..9d33cc67a8
--- /dev/null
+++ b/dashboard/compliance/cis_6_0_azure.py
@@ -0,0 +1,25 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_cis
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+
+ aux = data[
+ [
+ "REQUIREMENTS_ID",
+ "REQUIREMENTS_DESCRIPTION",
+ "REQUIREMENTS_ATTRIBUTES_SECTION",
+ "CHECKID",
+ "STATUS",
+ "REGION",
+ "ACCOUNTID",
+ "RESOURCEID",
+ ]
+ ].copy()
+
+ return get_section_containers_cis(
+ aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
+ )
diff --git a/dashboard/compliance/cis_7_0_aws.py b/dashboard/compliance/cis_7_0_aws.py
new file mode 100644
index 0000000000..94558f33ad
--- /dev/null
+++ b/dashboard/compliance/cis_7_0_aws.py
@@ -0,0 +1,24 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_cis
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+ aux = data[
+ [
+ "REQUIREMENTS_ID",
+ "REQUIREMENTS_DESCRIPTION",
+ "REQUIREMENTS_ATTRIBUTES_SECTION",
+ "CHECKID",
+ "STATUS",
+ "REGION",
+ "ACCOUNTID",
+ "RESOURCEID",
+ ]
+ ].copy()
+
+ return get_section_containers_cis(
+ aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
+ )
diff --git a/dashboard/compliance/cis_7_0_m365.py b/dashboard/compliance/cis_7_0_m365.py
new file mode 100644
index 0000000000..94558f33ad
--- /dev/null
+++ b/dashboard/compliance/cis_7_0_m365.py
@@ -0,0 +1,24 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_cis
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+ aux = data[
+ [
+ "REQUIREMENTS_ID",
+ "REQUIREMENTS_DESCRIPTION",
+ "REQUIREMENTS_ATTRIBUTES_SECTION",
+ "CHECKID",
+ "STATUS",
+ "REGION",
+ "ACCOUNTID",
+ "RESOURCEID",
+ ]
+ ].copy()
+
+ return get_section_containers_cis(
+ aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
+ )
diff --git a/dashboard/lib/layouts.py b/dashboard/lib/layouts.py
index 3fb230f314..6d1e7947fa 100644
--- a/dashboard/lib/layouts.py
+++ b/dashboard/lib/layouts.py
@@ -156,7 +156,7 @@ def create_layout_compliance(
html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
html.Span("Subscribe to Prowler Cloud"),
],
- href="https://cloud.prowler.com/",
+ href="https://cloud.prowler.com/sign-up?utm_source=prowler-local-dashboard&utm_content=compliance",
target="_blank",
className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
),
diff --git a/dashboard/pages/cloud.py b/dashboard/pages/cloud.py
new file mode 100644
index 0000000000..49778f8e26
--- /dev/null
+++ b/dashboard/pages/cloud.py
@@ -0,0 +1,265 @@
+"""Prowler Cloud upsell (gated) informational pages.
+
+These routes live inside the Local Dashboard but do NOT reproduce any Prowler
+Cloud functionality. Each renders the same reusable upgrade template with a
+feature-specific name, icon, description, benefit bullets and UTM-tagged CTA.
+All copy in ``CLOUD_FEATURES`` is normative — do not change wording,
+capitalization or punctuation without Product approval.
+"""
+
+import dash
+from dash import html
+
+# Shared subtitle used across every gated page header.
+CLOUD_SUBTITLE = "Discover more ways to protect and operate your cloud."
+
+# Base Prowler Cloud URL; the UTM content value identifies the feature.
+CLOUD_CTA_BASE = (
+ "https://cloud.prowler.com/sign-up?utm_source=prowler-local-dashboard&utm_content="
+)
+
+# Path to the recolorable checkmark mask used for benefit bullets.
+CHECK_ICON = "/assets/images/icons/cloud/check.svg"
+
+
+# Normative feature definitions. ``icon`` points to a local mask asset so no
+# external requests are needed and the glyph recolors per context.
+CLOUD_FEATURES = [
+ {
+ "slug": "lighthouse-ai",
+ "route": "/cloud/lighthouse-ai",
+ "nav_label": "Lighthouse AI",
+ "page_title": "Lighthouse AI",
+ "card_title": "Unlock Lighthouse AI",
+ "description": (
+ "Work with an AI security analyst that understands your cloud "
+ "posture and helps turn risk into action."
+ ),
+ "benefits": [
+ "Ask questions about your security posture in plain language",
+ "Investigate findings with context from your connected providers",
+ "Move from insight to remediation faster",
+ ],
+ "utm_content": "lighthouse-ai",
+ "icon": "/assets/images/icons/cloud/lighthouse-ai.svg",
+ },
+ {
+ "slug": "attack-paths",
+ "route": "/cloud/attack-paths",
+ "nav_label": "Attack Paths",
+ "page_title": "Attack Paths",
+ "card_title": "Unlock Attack Paths",
+ "description": (
+ "Visualize the paths an attacker could take through connected "
+ "resources before risk becomes compromise."
+ ),
+ "benefits": [
+ "See exploitable relationships across your AWS environment",
+ "Focus remediation on the paths with the greatest impact",
+ "Explore each scan as a point-in-time security graph",
+ ],
+ "utm_content": "attack-paths",
+ "icon": "/assets/images/icons/cloud/attack-paths.svg",
+ },
+ {
+ "slug": "findings",
+ "route": "/cloud/findings",
+ "nav_label": "Findings",
+ "page_title": "Findings",
+ "card_title": "Unlock Findings",
+ "description": (
+ "Filter, investigate, and prioritize security findings across "
+ "providers and scans from one workspace."
+ ),
+ "benefits": [
+ "Search and filter findings across all connected accounts",
+ "Track status, severity, ownership, and remediation context",
+ "Triage findings and share a consistent source of truth with your security team",
+ ],
+ "utm_content": "findings",
+ "icon": "/assets/images/icons/cloud/findings.svg",
+ },
+ {
+ "slug": "alerts",
+ "route": "/cloud/alerts",
+ "nav_label": "Alerts",
+ "page_title": "Alerts",
+ "card_title": "Unlock Alerts",
+ "description": (
+ "Create alert rules and stay informed when scan results reveal "
+ "the risks your team cares about."
+ ),
+ "benefits": [
+ "Define alerts around the findings that matter most",
+ "Route security signals to the right responders",
+ "Reduce the time between detection and action",
+ ],
+ "utm_content": "alerts",
+ "icon": "/assets/images/icons/cloud/alerts.svg",
+ },
+ {
+ "slug": "mutelist",
+ "route": "/cloud/mutelist",
+ "nav_label": "Mutelist",
+ "page_title": "Mutelist",
+ "card_title": "Unlock Mutelist",
+ "description": (
+ "Quiet expected findings, document accepted risk, and keep your "
+ "team focused on actionable work."
+ ),
+ "benefits": [
+ "Create reusable rules for known exceptions",
+ "Keep muted findings available for audit and review",
+ "Cut noise without losing security context",
+ ],
+ "utm_content": "mutelist",
+ "icon": "/assets/images/icons/cloud/mutelist.svg",
+ },
+ {
+ "slug": "integrations",
+ "route": "/cloud/integrations",
+ "nav_label": "Integrations",
+ "page_title": "Integrations",
+ "card_title": "Unlock Integrations",
+ "description": (
+ "Connect Prowler to your security workflow so findings and scan "
+ "data reach the tools your team already uses."
+ ),
+ "benefits": [
+ "Connect ticketing, notification, and cloud security services",
+ "Automate the handoff from detection to response",
+ "Keep teams aligned without manual exports",
+ ],
+ "utm_content": "integrations",
+ "icon": "/assets/images/icons/cloud/integrations.svg",
+ },
+ {
+ "slug": "organization",
+ "route": "/cloud/organization",
+ "nav_label": "Organization",
+ "page_title": "Organization",
+ "card_title": "Unlock Organization",
+ "description": (
+ "Manage users, roles, and invitations while organizing cloud "
+ "security work across your team."
+ ),
+ "benefits": [
+ "Invite teammates into a shared security workspace",
+ "Control access with role-based permissions",
+ "Coordinate security operations across accounts and teams",
+ ],
+ "utm_content": "organization",
+ "icon": "/assets/images/icons/cloud/organization.svg",
+ },
+]
+
+# Convenience lookup for the navigation builder in ``__main__``.
+CLOUD_FEATURES_BY_SLUG = {feature["slug"]: feature for feature in CLOUD_FEATURES}
+
+
+def _mask_style(icon_url):
+ """Return the inline style that renders a recolorable mask icon."""
+ return {
+ "WebkitMaskImage": f"url({icon_url})",
+ "maskImage": f"url({icon_url})",
+ }
+
+
+def _benefit_item(text):
+ return html.Li(
+ [
+ html.Span(
+ className="pc-ico pc-benefit-check",
+ style=_mask_style(CHECK_ICON),
+ ),
+ html.Span(text),
+ ],
+ className="pc-benefit",
+ )
+
+
+def build_cloud_layout(feature):
+ """Build the reusable gated informational page for a single feature."""
+ cta_url = f"{CLOUD_CTA_BASE}{feature['utm_content']}"
+
+ return html.Div(
+ html.Div(
+ [
+ # Page header: title + Prowler Cloud badge + shared subtitle.
+ html.Div(
+ [
+ html.Div(
+ [
+ html.H1(
+ feature["page_title"],
+ className="pc-page-title",
+ ),
+ html.Span("Prowler Cloud", className="pc-pill"),
+ ],
+ className="pc-page-title-row",
+ ),
+ html.P(CLOUD_SUBTITLE, className="pc-page-subtitle"),
+ ],
+ className="pc-page-header",
+ ),
+ # Centered upgrade card.
+ html.Div(
+ [
+ html.Div(className="pc-card-glow"),
+ html.Div(
+ [
+ html.Div(
+ html.Span(
+ className="pc-ico",
+ style=_mask_style(feature["icon"]),
+ ),
+ className="pc-feature-icon",
+ ),
+ html.Div(
+ "Available in Prowler Cloud",
+ className="pc-avail",
+ ),
+ html.H2(
+ feature["card_title"],
+ className="pc-card-title",
+ ),
+ html.P(
+ feature["description"],
+ className="pc-card-desc",
+ ),
+ html.Ul(
+ [
+ _benefit_item(benefit)
+ for benefit in feature["benefits"]
+ ],
+ className="pc-benefits",
+ ),
+ html.A(
+ "Upgrade to Prowler Cloud",
+ href=cta_url,
+ target="_blank",
+ rel="noopener noreferrer",
+ className="pc-cta",
+ ),
+ ],
+ className="pc-card-body",
+ ),
+ ],
+ className="pc-card",
+ ),
+ ],
+ className="pc-page pc-font",
+ ),
+ )
+
+
+# Register one page per gated feature. A distinct module key keeps each entry
+# unique in Dash's page registry while sharing the same template.
+for _feature in CLOUD_FEATURES:
+ dash.register_page(
+ f"cloud_{_feature['slug'].replace('-', '_')}",
+ path=_feature["route"],
+ name=_feature["nav_label"],
+ title=f"Prowler Dashboard - {_feature['page_title']}",
+ layout=build_cloud_layout(_feature),
+ )
diff --git a/dashboard/pages/overview.py b/dashboard/pages/overview.py
index e705f15e9f..8f786412d9 100644
--- a/dashboard/pages/overview.py
+++ b/dashboard/pages/overview.py
@@ -1538,7 +1538,7 @@ def filter_data(
html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
html.Span("Subscribe to Prowler Cloud"),
],
- href="https://cloud.prowler.com/",
+ href="https://cloud.prowler.com/sign-up?utm_source=prowler-local-dashboard&utm_content=overview",
target="_blank",
className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
),
diff --git a/docs/AGENTS.md b/docs/AGENTS.md
index 8278a7f88a..45bd3f04fa 100644
--- a/docs/AGENTS.md
+++ b/docs/AGENTS.md
@@ -78,11 +78,25 @@ b. National security is of the utmost concern nowadays.
Prowler Features are considered proper nouns. They are to be referenced without articles in all pieces of writing.
-This is a list of Prowler Features:
+Prowler ships two product families. Use these names exactly; the former names Prowler App (now Prowler Local Server) and Prowler Enterprise (now Prowler Private Cloud) must not appear in new writing. The only allowed former-name notes are on the Prowler Product Families page (`getting-started/products/index.mdx`) and in the site-wide banner, which document the mapping.
+
+Prowler Products:
+
+* **Prowler Cloud**
+* **Prowler Private Cloud** (formerly Prowler Enterprise)
+* **Prowler Hub**
+* **Prowler Lighthouse AI**
+* **Prowler MCP**
+
+Open Source projects:
-* **Prowler App**
* **Prowler CLI**
+* **Prowler Local Server** (formerly Prowler App)
+* **Prowler Local Dashboard** (the Prowler CLI dashboard)
* **Prowler SDK**
+
+Other Prowler Features:
+
* **Built-in Compliance Checks**
* **Multi-cloud Security Scanning**
* **Autonomous Cloud Security Analyst (AI)**
@@ -97,8 +111,6 @@ This is a list of Prowler Features:
* **AI-Generated Detections & Remediations**
* **Prowler Studio**
* **Custom Security Policies**
-* **Prowler Cloud**
-* **Prowler Registry**
* **Open Source & Full APIs**
---
@@ -137,10 +149,10 @@ Explicit use of second-person pronouns (you) and possessives (your) should be mi
### Example of Improvement Through Avoiding Second Person Pronouns
**Original:**
-Prowler App can be installed in different ways, depending on your environment:
+Prowler Local Server can be installed in different ways, depending on your environment:
**Improved Version:**
-Prowler App offers flexible installation methods tailored to various environments:
+Prowler Local Server offers flexible installation methods tailored to various environments:
---
@@ -262,7 +274,7 @@ There are several options for punctuating bullet points. Regardless of the style
* **No punctuation (minimalistic):** This strategy is suitable when no verbs are involved and is best used to highlight products or features in isolation. For example:
- Prowler App is composed of three key components:
+ Prowler Local Server is composed of three key components:
* Prowler UI
* Prowler API
* Prowler SDK
@@ -271,7 +283,7 @@ There are several options for punctuating bullet points. Regardless of the style
* **Periods for full sentences:** This approach works best when each bullet point forms a full sentence or includes verbs. For example:
- Prowler App is composed of three key components:
+ Prowler Local Server is composed of three key components:
* Prowler UI, a web-based interface, built with Next.js, providing a user-friendly experience for executing Prowler scans and visualizing results.
* Prowler API, a backend service, developed with Django REST Framework, responsible for running Prowler scans and storing the generated results.
* Prowler SDK, a Python SDK designed to extend the functionality of the Prowler CLI for advanced capabilities.
@@ -539,6 +551,43 @@ Tag-Based Scanning allows filtering resources by AWS tags during security assess
---
+## AppliesTo Banner for Product Scope
+
+The AppliesTo component states which products a guide covers and links to the product families page. It is located at `docs/snippets/applies-to.mdx`.
+
+### When to Use the AppliesTo Banner
+
+Use it on web UI tutorial pages that apply to more than one product (for example, a guide written for Prowler Cloud whose steps also work on Prowler Local Server). Do not combine it with the SubscriptionBanner: pages carrying the SubscriptionBanner already state their availability.
+
+### How to Use the AppliesTo Banner
+
+```mdx
+import { AppliesTo } from "/snippets/applies-to.mdx"
+
+
+```
+
+The default covers Prowler Cloud, Prowler Private Cloud, and Prowler Local Server. Pass the `products` prop to narrow the scope:
+
+```mdx
+
+```
+
+Place it on its own line below the Version Badge when one is present, otherwise directly after the imports.
+
+### Cloud Marker for Subscription Content
+
+The custom green cloud glyph (`docs/images/icons/cloud-bold.svg`) marks content that requires a Prowler Cloud or Prowler Private Cloud subscription. It renders as a trailing `::after` element through the "Cloud marker" rules in `docs/style.css`, so sidebar labels stay left-aligned.
+
+* Pages: add a `li[id=""] a span::after` selector to the Cloud marker rule in `docs/style.css` for every page whose content is subscription-gated. The `li` id equals the page URL path. Pages where only one section is gated (for example the Support page, where only the Support Desk carries the SubscriptionBanner) get no marker.
+* Navigation groups: add a selector only when every page in the group is subscription-gated. One sanctioned exception: the Prowler MCP group is marked because the hosted server at `mcp.prowler.com` includes tools for Prowler Cloud-specific features, and its overview page explains the free local alternative. Nested groups render as `li[data-title=""]` with a button toggle, so use `li[data-title=""] > button span:first-child::after`. Top-level groups render as `h3` headings without `data-title`, which means name collisions with top-level groups resolve themselves; a gated top-level group (always expanded) is selected through its sibling list with `:has()`, like the Security tab group. Do not use `:has()` on child links of nested groups: collapsed groups do not render their children.
+
+Do not use the `icon` field for this marker (icons render before the label and misalign the sidebar), and do not use `"tag"` on navigation groups (group-level tags crash `mint broken-links` with a stack overflow, verified with mint 4.2.689). The SVG stroke uses the fixed brand green `#10B981` on purpose: it must be visible on both themes without `currentColor` support.
+
+The marker meaning is explained on the Prowler Product Families page at `getting-started/products/index.mdx`: keep that note in place.
+
+---
+
## Avoid Assumptions Regarding Audience’s Expertise
### Understand Your Audience’s Expertise
diff --git a/docs/README.md b/docs/README.md
index 595f79bc5a..7934972c9b 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -5,7 +5,7 @@ This repository contains the Prowler Open Source documentation powered by [Mintl
## Documentation Structure
- **Getting Started**: Overview, installation, and basic usage guides
-- **User Guide**: Comprehensive guides for Prowler App, CLI, providers, and compliance
+- **User Guide**: Comprehensive guides for Prowler Cloud, Prowler Local Server, Prowler CLI, providers, and compliance
- **Developer Guide**: Technical documentation for developers contributing to Prowler
## Local Development
@@ -13,7 +13,7 @@ This repository contains the Prowler Open Source documentation powered by [Mintl
Install a reviewed version of the [Mintlify CLI](https://www.npmjs.com/package/mint) to preview documentation changes locally:
```bash
-npm install --global mint@4.2.560
+npm install --global mint@4.2.689
```
Run the following command at the root of your documentation (where `mint.json` is located):
diff --git a/docs/developer-guide/checks.mdx b/docs/developer-guide/checks.mdx
index 2f0f45cd96..5334799d36 100644
--- a/docs/developer-guide/checks.mdx
+++ b/docs/developer-guide/checks.mdx
@@ -445,3 +445,5 @@ The metadata structure is enforced in code using a Pydantic model. For reference
## Specific Check Patterns
Details for specific providers can be found in documentation pages named using the pattern `-details`.
+
+Checks that scan resources for plaintext secrets follow a dedicated batched structure. Refer to [Secret-Scanning Checks](/developer-guide/secret-scanning-checks) before creating or updating one.
diff --git a/docs/developer-guide/configurable-checks.mdx b/docs/developer-guide/configurable-checks.mdx
index 760dc80f58..f550ff4f52 100644
--- a/docs/developer-guide/configurable-checks.mdx
+++ b/docs/developer-guide/configurable-checks.mdx
@@ -42,10 +42,14 @@ When adding a new configurable check to Prowler, update the following files:
```
- **Provider Schema:** Add the typed field to the provider's Pydantic schema in `prowler/config/schema/.py`. This is required: the loader validates user configs against these schemas and the shipped `config.yaml` must round-trip with zero warnings. See [Adding a Parameter to the Provider Schema](#adding-a-parameter-to-the-provider-schema) below.
- **Test Fixtures:** If tests depend on this configuration, add the variable to `tests/config/fixtures/config.yaml`.
-- **Documentation:** Document the new variable in the list of configurable checks in `docs/tutorials/configuration_file.md`.
+- **Documentation:** Document the new variable in the list of configurable checks in [Configuration File](/user-guide/cli/tutorials/configuration_file) (`docs/user-guide/cli/tutorials/configuration_file.mdx`).
For a complete list of checks that already support configuration, see the [Configuration File Tutorial](/user-guide/cli/tutorials/configuration_file).
+
+Because a configurable check's verdict depends on the `audit_config` value it reads, a compliance requirement can lose meaning if the scan ran with a looser threshold than the control demands. Compliance frameworks can guard against this with **configuration guardrails**: a requirement declares the strictest configuration it tolerates and is forced to FAIL when the scan's config falls short. See [Configuration Guardrails for Requirements](/developer-guide/security-compliance-framework#configuration-guardrails-for-requirements).
+
+
## Adding a Parameter to the Provider Schema
Most providers have a typed Pydantic schema in `prowler/config/schema/`, registered in `prowler/config/schema/registry.py`. When a config is loaded and the provider has a registered schema, `validate_provider_config` checks each user-supplied key against it, logs a warning, and drops any field that fails validation. The consumer's `.get(key, default)` then falls back to the built-in default. Providers without a registered schema are passed through unchanged.
@@ -149,7 +153,6 @@ Only fields with a numeric range, a fixed value set, or a length cap are listed.
| `max_days_secret_unused` | `7..365` days | |
| `max_days_secret_unrotated` | `1..180` days | NIST IA-5: rotate quarterly; CIS ≤90 |
| `min_kinesis_stream_retention_hours` | `24..8760` h | 1 day .. 1 year |
-| `detect_secrets_plugins[].limit` | `0.0..10.0` | Shannon entropy threshold |
| `shodan_api_key` | ≤512 chars | |
### Azure
diff --git a/docs/developer-guide/documentation.mdx b/docs/developer-guide/documentation.mdx
index d0fb808af2..fd045a1751 100644
--- a/docs/developer-guide/documentation.mdx
+++ b/docs/developer-guide/documentation.mdx
@@ -8,9 +8,9 @@ Prowler documentation is built using [Mintlify](https://www.mintlify.com/docs),
The Prowler documentation is organized into several sections. The main ones are:
-- **Getting Started**: Provides an overview of the Prowler platform and its different solutions, including Prowler Cloud/App, Prowler CLI, Prowler MCP Server, Prowler Hub, and Prowler Lighthouse AI. This section helps new users understand which Prowler solution best fits their needs and includes product comparisons.
+- **Getting Started**: Provides an overview of the Prowler platform and its two product families, Prowler Products (Prowler Cloud, Prowler Hub, Prowler MCP, Prowler Lighthouse AI) and Open Source (Prowler CLI, Prowler Local Server). This section helps new users understand which Prowler solution best fits their needs and includes product comparisons.
-- **Guides**: Contains practical tutorials and how-to guides organized by product (Prowler Cloud/App, CLI) and provider (AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub, etc.). This section covers authentication, integrations, compliance, and advanced usage scenarios.
+- **Guides**: Contains practical tutorials and how-to guides organized by product (Prowler Cloud, CLI) and provider (AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub, etc.). This section covers authentication, integrations, compliance, and advanced usage scenarios.
- **Developer Guide**: Documentation for contributors looking to extend Prowler functionality. This includes guides on creating providers, services, checks, output formats, integrations, and compliance frameworks. Provider-specific implementation details and testing strategies are also covered here.
diff --git a/docs/developer-guide/end2end-testing.mdx b/docs/developer-guide/end2end-testing.mdx
index 9013a32245..df99de6fee 100644
--- a/docs/developer-guide/end2end-testing.mdx
+++ b/docs/developer-guide/end2end-testing.mdx
@@ -1,12 +1,12 @@
---
-title: 'End-2-End Tests for Prowler App'
+title: 'End-2-End Tests for Prowler Local Server'
---
-End-to-end (E2E) tests validate complete user flows in Prowler App (UI + API). These tests are implemented with [Playwright](https://playwright.dev/) under the `ui/tests` folder and are designed to run against a Prowler App environment.
+End-to-end (E2E) tests validate complete user flows in Prowler Local Server (UI + API). These tests are implemented with [Playwright](https://playwright.dev/) under the `ui/tests` folder and are designed to run against a Prowler Local Server environment.
## General Recommendations
-When adding or maintaining E2E tests for Prowler App, follow these guidelines:
+When adding or maintaining E2E tests for Prowler Local Server, follow these guidelines:
1. **Test real user journeys**
Focus on full workflows (for example, sign-up → login → add provider → launch scan) instead of low-level UI details already covered by unit or integration tests.
@@ -19,8 +19,8 @@ When adding or maintaining E2E tests for Prowler App, follow these guidelines:
3. **Use a Page Model (Page Object Model)**
- Encapsulate selectors and common actions in page classes instead of repeating them in each test.
- Leverage and extend the existing Playwright page models in `ui/tests`—such as `ProvidersPage`, `ScansPage`, and others—which are all based on the shared `BasePage`.
- - Page models for Prowler App pages should be placed in their respective entity folders (for example, `ui/tests/providers/providers-page.ts`).
- - Page models for external pages (not part of Prowler App) should be grouped in the `external` folder (for example, `ui/tests/external/github-page.ts`).
+ - Page models for Prowler Local Server pages should be placed in their respective entity folders (for example, `ui/tests/providers/providers-page.ts`).
+ - Page models for external pages (not part of Prowler Local Server) should be grouped in the `external` folder (for example, `ui/tests/external/github-page.ts`).
- This approach improves readability, reduces duplication, and makes refactors safer.
4. **Reuse authentication states (StorageState)**
@@ -193,7 +193,7 @@ When adding or maintaining E2E tests for Prowler App, follow these guidelines:
## Running Prowler Tests
-E2E tests for Prowler App run from the `ui` project using Playwright. The Playwright configuration lives in `ui/playwright.config.ts` and defines:
+E2E tests for Prowler Local Server run from the `ui` project using Playwright. The Playwright configuration lives in `ui/playwright.config.ts` and defines:
- `testDir: "./tests"` – location of E2E test files (relative to the `ui` project root, so `ui/tests`).
- `webServer` – how to start the Next.js development server and connect to Prowler API.
@@ -225,7 +225,7 @@ Before running E2E tests:
- Start Prowler API so it is reachable on that URL (for example, via `docker-compose-dev.yml` or the development orchestration used locally).
- If a different API URL is required, set `UI_API_BASE_URL` accordingly before running the tests.
-- **Ensure Prowler App UI is available**
+- **Ensure Prowler Local Server UI is available**
- Playwright automatically starts the Next.js server through the `webServer` block in `playwright.config.ts` (`pnpm run dev` by default).
- If the UI is already running on `http://localhost:3000`, Playwright will reuse the existing server when `reuseExistingServer` is `true`.
@@ -246,7 +246,7 @@ Before running E2E tests:
### Executing Tests
-To execute E2E tests for Prowler App:
+To execute E2E tests for Prowler Local Server:
1. **Run the full E2E suite (headless)**
diff --git a/docs/developer-guide/environment-variables.mdx b/docs/developer-guide/environment-variables.mdx
index 1f4d17ee2e..913444d84b 100644
--- a/docs/developer-guide/environment-variables.mdx
+++ b/docs/developer-guide/environment-variables.mdx
@@ -2,7 +2,7 @@
title: 'Environment Variable Naming Convention'
---
-Prowler is a monorepo composed of several runtime components — Prowler App (the web user interface), Prowler API (the backend), Prowler SDK, and Prowler MCP Server (Model Context Protocol) — that frequently share a single `.env` file. To keep that shared configuration unambiguous, each component namespaces its environment variables with a component-specific prefix.
+Prowler is a monorepo composed of several runtime components — Prowler Local Server (the web user interface), Prowler API (the backend), Prowler SDK, and Prowler MCP Server (Model Context Protocol) — that frequently share a single `.env` file. To keep that shared configuration unambiguous, each component namespaces its environment variables with a component-specific prefix.
## Component Prefixes
@@ -10,7 +10,7 @@ Each component owns a dedicated prefix for the environment variables it reads:
| Component | Prefix | Status |
|-----------|--------|--------|
-| Prowler App (web UI) | `UI_` | Adopted |
+| Prowler Local Server (web UI) | `UI_` | Adopted |
| Prowler API (backend) | `API_` | Planned |
| Prowler SDK | `SDK_` | Planned |
| Prowler MCP Server | `MCP_` | Planned |
@@ -21,11 +21,11 @@ Component prefixes solve three concrete problems in a shared configuration file:
- **Collisions in a shared `.env`:** Several components historically read identically named variables. The API base URL, for example, is consumed by more than one component, so a single unprefixed name is ambiguous. A component prefix removes that ambiguity.
- **Explicit ownership:** A prefix states, at a glance, which component consumes a variable.
-- **Reduced accidental exposure:** For Prowler App, scoping browser-facing configuration under one intentional prefix prevents server-only values from leaking into the client bundle.
+- **Reduced accidental exposure:** For Prowler Local Server, scoping browser-facing configuration under one intentional prefix prevents server-only values from leaking into the client bundle.
-## Prowler App
+## Prowler Local Server
-Prowler App has adopted the `UI_` prefix. Its public configuration is resolved from the container environment at runtime rather than inlined at build time, so a single pre-built image serves any deployment. For the operational details on changing these values without rebuilding the image, see [Troubleshooting](/troubleshooting).
+Prowler Local Server has adopted the `UI_` prefix. Its public configuration is resolved from the container environment at runtime rather than inlined at build time, so a single pre-built image serves any deployment. For the operational details on changing these values without rebuilding the image, see [Troubleshooting](/troubleshooting).
The former build-time variables map to the new runtime variables as follows:
@@ -37,7 +37,25 @@ The former build-time variables map to the new runtime variables as follows:
| `NEXT_PUBLIC_SENTRY_DSN`, `SENTRY_DSN` | `UI_SENTRY_DSN` |
| `NEXT_PUBLIC_SENTRY_ENVIRONMENT`, `SENTRY_ENVIRONMENT` | `UI_SENTRY_ENVIRONMENT` |
-The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of the App's runtime configuration.
+The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of Prowler Local Server's runtime configuration.
+
+## Enabling Third-Party Integrations
+
+Prowler Local Server gates each optional third-party integration behind an explicit enable flag. When an integration is configured through its new `UI_*` variables, it loads only when its flag is set to the exact string `"true"`; any other value, including unset, leaves it off. This default-off behavior keeps a deployment free of third-party egress unless it opts in. Deployments still using the deprecated legacy variable names keep loading without the flag, for backward compatibility (see [Deprecated Names](#deprecated-names)).
+
+| Integration | Enable flag | Required configuration when enabled |
+|-------------|-------------|-------------------------------------|
+| Sentry (error monitoring) | `UI_SENTRY_ENABLED` | `UI_SENTRY_DSN` |
+| Google Tag Manager | `UI_GOOGLE_TAG_MANAGER_ENABLED` | `UI_GOOGLE_TAG_MANAGER_ID` |
+| PostHog (product analytics) | `UI_POSTHOG_ENABLED` | `UI_POSTHOG_KEY` and `UI_POSTHOG_HOST` |
+
+When an integration is enabled but its required configuration is missing, Prowler Local Server fails fast at server startup with a clear error, so a misconfigured container never starts silently. A new `UI_*` value set while its enable flag is not `"true"` is ignored, and the server logs a one-time startup warning noting that the integration will not load. Legacy names follow the backward-compatible rule described in [Deprecated Names](#deprecated-names).
+
+PostHog support is currently limited to configuration validation: Prowler Local Server reads and validates the PostHog variables but does not yet load a PostHog client.
+
+
+Configuring an integration through the new `UI_*` variables now requires its enable flag. A deployment that adopted `UI_SENTRY_DSN` or `UI_GOOGLE_TAG_MANAGER_ID` must also set `UI_SENTRY_ENABLED=true` or `UI_GOOGLE_TAG_MANAGER_ENABLED=true` to keep the integration active. Deployments still using the legacy names (`NEXT_PUBLIC_*`, or `POSTHOG_KEY` and `POSTHOG_HOST`) keep working without the flag.
+
## Upcoming Breaking Change
@@ -49,5 +67,5 @@ Prowler API, Prowler SDK, and Prowler MCP Server have not yet adopted the conven
## Deprecated Names
-- **Prowler App:** The bare server-side `SENTRY_DSN` and `SENTRY_ENVIRONMENT` are no longer read; the server and edge runtimes now read `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT`. The former `NEXT_PUBLIC_*` build-time variables are deprecated but still read at runtime as a fallback when the matching `UI_*` variable is unset. This fallback will be removed in a future release, so set the `UI_*` runtime variables on the running container.
+- **Prowler Local Server:** The bare server-side `SENTRY_DSN` and `SENTRY_ENVIRONMENT` are no longer read; the server and edge runtimes now read `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT`. The former `NEXT_PUBLIC_*` names — and, for PostHog, the unprefixed `POSTHOG_KEY` and `POSTHOG_HOST` — are deprecated but stay backward compatible: they are read at runtime regardless of the enable flag, so an existing deployment keeps its integration active without opting in. The new `UI_*` names, by contrast, load only when the matching enable flag is set to `"true"`. These legacy names will be removed in a future release, so migrate to the `UI_*` runtime variables — and set the enable flag — on the running container.
- **Prowler API, Prowler SDK, and Prowler MCP Server:** The current, unprefixed variable names are deprecated. They continue to work today and will be removed once the prefixed convention is adopted for each component, as described in [Upcoming Breaking Change](#upcoming-breaking-change).
diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx
index 1d434912ef..08c38ee17c 100644
--- a/docs/developer-guide/introduction.mdx
+++ b/docs/developer-guide/introduction.mdx
@@ -240,7 +240,7 @@ prowler/
├── README.md # Project overview and getting started
├── Makefile # Common development commands
├── Dockerfile # SDK Docker container
-├── docker-compose.yml # Prowler App Docker compose
+├── docker-compose.yml # Prowler Local Server Docker compose
└── ... # Other supporting files
```
diff --git a/docs/developer-guide/lighthouse-architecture.mdx b/docs/developer-guide/lighthouse-architecture.mdx
index e8acc6278c..e12eff9549 100644
--- a/docs/developer-guide/lighthouse-architecture.mdx
+++ b/docs/developer-guide/lighthouse-architecture.mdx
@@ -132,7 +132,7 @@ The MCP client manages connections to the Prowler MCP Server using a singleton p
- **Connection Management**: Retry logic with configurable attempts and delays
- **Tool Discovery**: Fetches available tools from MCP server on initialization
-- **Authentication Injection**: Automatically adds JWT tokens to `prowler_app_*` tool calls
+- **Authentication Injection**: Automatically adds JWT tokens to `prowler_*` tool calls
- **Reconnection**: Supports forced reconnection after server restarts
Key constants:
@@ -141,10 +141,14 @@ Key constants:
- `RECONNECT_INTERVAL_MS`: 5 minutes before retry after failure
```typescript
-// Authentication injection for Prowler App tools
+// Authentication injection for core prowler_ tools (Hub/Docs excluded)
private handleBeforeToolCall = ({ name, args }) => {
- // Only inject auth for prowler_app_* tools (user-specific data)
- if (!name.startsWith("prowler_app_")) {
+ // Only inject auth for prowler_* tools (user-specific data).
+ // The legacy prowler_app_ prefix is also accepted for a resilient rollout.
+ if (
+ !name.startsWith("prowler_") &&
+ !name.startsWith("prowler_app_")
+ ) {
return { args };
}
@@ -307,15 +311,15 @@ MCP tools are organized into three namespaces based on authentication requiremen
| Namespace | Auth Required | Description |
|-----------|---------------|-------------|
-| `prowler_app_*` | Yes (JWT) | Prowler Cloud/App tools for findings, providers, scans, resources |
+| `prowler_*` | Yes (JWT) | Prowler Cloud, Prowler Private Cloud, and Prowler Local Server tools for findings, providers, scans, resources |
| `prowler_hub_*` | No | Security checks catalog, compliance frameworks |
| `prowler_docs_*` | No | Documentation search and retrieval |
### Authentication Flow
-1. User authenticates with Prowler App, receiving a JWT token
+1. User authenticates with Prowler Local Server, receiving a JWT token
2. Token is stored in session and propagated via `authContextStorage`
-3. MCP client injects `Authorization: Bearer ` header for `prowler_app_*` calls
+3. MCP client injects `Authorization: Bearer ` header for `prowler_*` calls
4. MCP Server validates token and applies RLS filtering
### Tool Execution Pattern
@@ -323,7 +327,7 @@ MCP tools are organized into three namespaces based on authentication requiremen
The agent uses meta-tools rather than direct tool registration:
```
-Agent needs data → describe_tool("prowler_app_search_findings")
+Agent needs data → describe_tool("prowler_search_findings")
→ Returns parameter schema → execute_tool with parameters
→ MCP client adds auth header → MCP Server executes
→ Results returned to agent → Agent continues reasoning
diff --git a/docs/developer-guide/llm-details.mdx b/docs/developer-guide/llm-details.mdx
index 3647552c0f..3dc0f2653d 100644
--- a/docs/developer-guide/llm-details.mdx
+++ b/docs/developer-guide/llm-details.mdx
@@ -101,4 +101,4 @@ The LLM provider seamlessly integrates with Prowler's existing infrastructure:
- **Output Formats**: Supports all Prowler output formats (JSON, CSV, HTML, etc.)
- **Compliance Frameworks**: Integrates with Prowler's compliance reporting
- **Fixer Integration**: Supports automated remediation recommendations
-- **Dashboard Integration**: Compatible with Prowler App for centralized management
+- **Dashboard Integration**: Compatible with Prowler Cloud and Prowler Local Server for centralized management
diff --git a/docs/developer-guide/mcp-server.mdx b/docs/developer-guide/mcp-server.mdx
index 4174f0f730..6d409ccc02 100644
--- a/docs/developer-guide/mcp-server.mdx
+++ b/docs/developer-guide/mcp-server.mdx
@@ -18,11 +18,15 @@ The Prowler MCP Server brings the entire Prowler ecosystem to AI assistants thro
The server follows a modular architecture with three independent sub-servers:
-| Sub-Server | Auth Required | Description |
-|------------|---------------|-------------|
-| Prowler App | Yes | Full access to Prowler Cloud and Self-Managed features |
-| Prowler Hub | No | Security checks catalog with **over 1000 checks**, fixers, and **70+ compliance frameworks** |
-| Prowler Documentation | No | Full-text search and retrieval of official documentation |
+| Sub-Server | Tool Prefix | Auth Required | Description |
+|------------|-------------|---------------|-------------|
+| Prowler | `prowler_` | Yes | Full access to Prowler Cloud, Prowler Private Cloud, and Prowler Local Server features |
+| Prowler Hub | `prowler_hub_` | No | Security checks catalog with **over 2,000 checks**, fixers, and **70+ compliance frameworks** |
+| Prowler Documentation | `prowler_docs_` | No | Full-text search and retrieval of official documentation |
+
+
+The core Prowler sub-server is served under the `prowler_` tool prefix, while its source lives in the `prowler_app/` module for historical reasons. Tool names use the prefix; import paths use the module.
+
For a complete list of tools and their descriptions, see the [Tools Reference](/getting-started/basic-usage/prowler-mcp-tools).
@@ -53,9 +57,9 @@ mcp_server/prowler_mcp_server/
The MCP Server uses two patterns for tool registration:
1. **Direct Decorators** (Prowler Hub/Docs): Tools are registered using `@mcp.tool()` decorators
-2. **Auto-Discovery** (Prowler App): All public methods of `BaseTool` subclasses are auto-registered
+2. **Auto-Discovery** (`prowler_app`): All public methods of `BaseTool` subclasses are auto-registered
-## Adding Tools to Prowler App
+## Adding Tools to the `prowler_app` Sub-Server
### Step 1: Create the Tool Class
@@ -413,7 +417,7 @@ uv run prowler-mcp
uv run prowler-mcp --transport http --host 0.0.0.0 --port 8000
# Run with environment variables
-PROWLER_APP_API_KEY="pk_xxx" uv run prowler-mcp
+PROWLER_API_KEY="pk_xxx" uv run prowler-mcp
```
For complete installation and deployment options, see:
diff --git a/docs/developer-guide/provider.mdx b/docs/developer-guide/provider.mdx
index d3e7d3631f..af621c005a 100644
--- a/docs/developer-guide/provider.mdx
+++ b/docs/developer-guide/provider.mdx
@@ -3211,21 +3211,18 @@ class YourProviderAPITestCase(APITestCase):
#### 2.6.1. Add your mocked provider to the tests
-If needed, add your mocked provider to the tests config file so you can use it on the tests.
+If needed, add a named provider fixture or extend the provider factory defaults so tests can request only the provider they need.
**File:** `api/src/backend/conftest.py`
```python
@pytest.fixture
-def providers_fixture(tenants_fixture):
- tenant, *_ = tenants_fixture
- providerX = Provider.objects.create(
+def your_provider(provider_factory):
+ return provider_factory(
provider="your_provider",
uid="your_uid",
alias="your_alias",
- tenant_id=tenant.id,
)
- return provider1, provider2, provider3, ... providerX
```
### 2.7. Compliance and Output Support
@@ -3421,7 +3418,7 @@ Use existing providers as templates, this will help you to understand better the
- **Documentation & Maintenance**
- **README Updates**: Update provider-specific documentation
- - **Changelog**: Document changes and new features
+ - **Changelog**: Document changes and new features with a fragment under `prowler/changelog.d/` (see the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md))
- **Examples**: Provide usage examples and common scenarios
- **Troubleshooting**: Include common issues and solutions
- **Documentation**: Update the provider documentation to include your new tool provider in the examples and implementation guidance.
diff --git a/docs/developer-guide/prowler-studio.mdx b/docs/developer-guide/prowler-studio.mdx
index a4a2a609b5..b89eea7175 100644
--- a/docs/developer-guide/prowler-studio.mdx
+++ b/docs/developer-guide/prowler-studio.mdx
@@ -5,7 +5,7 @@ title: 'Prowler Studio'
**Prowler Studio is an AI workflow that ensures Claude Code follows Prowler's skills, guardrails, and best practices when creating new security checks.** What lands in the resulting pull request is consistent, tested, and ready for human review — not half-correct boilerplate that needs to be rewritten.
-**Contributor Tool**: Prowler Studio is a workflow for advanced contributors adding new Prowler security checks. It is not part of Prowler Cloud, Prowler App, or Prowler CLI.
+**Contributor Tool**: Prowler Studio is a workflow for advanced contributors adding new Prowler security checks. It is not part of Prowler Cloud, Prowler Local Server, or Prowler CLI.
diff --git a/docs/developer-guide/secret-scanning-checks.mdx b/docs/developer-guide/secret-scanning-checks.mdx
new file mode 100644
index 0000000000..5044366b7e
--- /dev/null
+++ b/docs/developer-guide/secret-scanning-checks.mdx
@@ -0,0 +1,119 @@
+---
+title: 'Secret-Scanning Checks'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+
+
+Prowler scans audited resources for plaintext secrets using [Kingfisher](https://github.com/mongodb/kingfisher), an open-source secret-scanning engine that Prowler invokes as a subprocess. This guide explains the structure every secret-scanning check must follow to keep scanning correct and efficient on large accounts.
+
+
+Since Prowler 5.32.0 the secret-scanning checks scan with Kingfisher. Earlier versions used the `detect-secrets` library.
+
+
+## Overview
+
+Secret detection runs through a single helper in `prowler/lib/utils/utils.py`:
+
+- **`detect_secrets_scan_batch(payloads, excluded_secrets=..., validate=...)`** scans many payloads in chunked subprocess invocations and returns a `{key: [findings]}` dictionary. To scan a single payload, pass a one-entry mapping (for example, `{0: data}`).
+
+Every Kingfisher invocation carries a fixed process-startup cost (around 100 ms). Scanning once per resource would spawn thousands of subprocesses on large accounts (for example, thousands of CloudWatch log groups). `detect_secrets_scan_batch` amortizes that cost: it writes each payload to a temporary file as it consumes them, runs one subprocess per chunk (500 payloads by default), and maps the findings back to each payload by key.
+
+## The Batched Structure
+
+Every secret-scanning check follows three phases.
+
+### Phase 1: Collect
+
+Define a generator that yields `(key, payload)` for each scannable unit. The generator builds payload strings only — it does not call Kingfisher. Lazy yielding keeps memory and temporary-disk usage bounded to a single chunk, which matters when an account holds thousands of resources.
+
+### Phase 2: Batch
+
+Call `detect_secrets_scan_batch` once with the generator. The helper consumes it in chunks, runs Kingfisher per chunk, and returns the keys that produced findings mapped to their finding lists.
+
+### Phase 3: Report
+
+Iterate the resources, look up the findings by key, and build one report per resource. Emit a finding for **every** iterated resource — never drop one silently. When a resource's payload cannot be prepared for scanning (for example, user data that fails to base64-decode or decompress), report it as `MANUAL` with a status explaining the scan could not inspect it, rather than omitting it or claiming `PASS`.
+
+```python
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import (
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
+from prowler.providers.aws.services.example.example_client import example_client
+
+
+class example_resource_no_secrets(Check):
+ def execute(self):
+ findings = []
+ excluded = example_client.audit_config.get("secrets_ignore_patterns", [])
+ validate = example_client.audit_config.get("secrets_validate", False)
+ resources = list(example_client.resources)
+
+ # Phase 1: collect — builds strings only, no scan.
+ def payloads():
+ for index, resource in enumerate(resources):
+ if resource.scannable_data:
+ yield index, serialize(resource)
+
+ # Phase 2: batch — one call, chunked subprocesses.
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=excluded, validate=validate
+ )
+
+ # Phase 3: report — look up findings by key.
+ for index, resource in enumerate(resources):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=resource)
+ report.status = "PASS"
+ report.status_extended = f"No secrets found in {resource.name}."
+ detect_secrets_output = batch_results.get(index)
+ if detect_secrets_output:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Potential secret found in {resource.name} -> ..."
+ )
+ annotate_verified_secrets(report, detect_secrets_output)
+ findings.append(report)
+
+ return findings
+```
+
+## Choosing the Key
+
+The key maps each finding back to its source. Two shapes cover every check:
+
+- **One payload per resource:** use the resource index. This fits checks that serialize a single payload per resource, such as launch configurations, CloudFormation outputs, SSM documents, Step Functions definitions, and OpenStack metadata.
+- **Several payloads per resource:** use a `(resource_index, fragment)` tuple, where the fragment identifies the variable, log stream, container, file, or version. Phase 3 groups the per-fragment findings to build the resource report. This fits CloudWatch log streams, ECS containers, CodeBuild variables, Glue arguments, and Lambda code files.
+
+Derive the indices from the same `list(...)` of resources in both Phase 1 and Phase 3 so the order stays stable and the keys align.
+
+## Preserving Per-Payload Results
+
+`detect_secrets_scan_batch` runs Kingfisher with `--no-dedup`, so a secret that appears in more than one payload is reported for each one. This reproduces the result of scanning each payload individually. Build payload strings exactly as a single scan would: serialize the same data and keep line ordering, because messages often map a finding's `line_number` back to a variable name or metadata key.
+
+## Validation and Severity
+
+`detect_secrets_scan_batch` accepts `validate`, read from `secrets_validate` in the provider configuration or the `--scan-secrets-validate` flag. When enabled, Kingfisher confirms whether each secret is live, and confirmed secrets carry `is_verified: True`.
+
+After marking a report as `FAIL`, pass the findings to `annotate_verified_secrets(report, findings)`. When any secret is verified, the helper escalates the finding to critical severity and appends a note that the secret was confirmed live. Validation stays off by default because it sends the discovered secret to the provider API.
+
+## Excluded Secrets
+
+`detect_secrets_scan_batch` applies `secrets_ignore_patterns` — regular expressions from the provider configuration — against each finding's source line and drops the matches, mirroring single-scan behavior.
+
+## Testing
+
+To assert on the verified-secret path, mock `detect_secrets_scan_batch` in the check module and return the keyed dictionary. For a single resource scanned at index `0`:
+
+```python
+mock.patch(
+ "prowler.providers.aws.services.example.example_resource_no_secrets.example_resource_no_secrets.detect_secrets_scan_batch",
+ return_value={
+ 0: [{"type": "...", "line_number": 1, "is_verified": True}]
+ },
+)
+```
+
+Most tests need no mock at all: they seed resources that contain example secrets and assert on the `FAIL` status and message, which exercises the real batched path. Refer to the [Testing](/developer-guide/unit-testing) documentation for the general structure.
diff --git a/docs/developer-guide/security-compliance-framework.mdx b/docs/developer-guide/security-compliance-framework.mdx
index cf756c4da0..2eeabebe2a 100644
--- a/docs/developer-guide/security-compliance-framework.mdx
+++ b/docs/developer-guide/security-compliance-framework.mdx
@@ -2,6 +2,8 @@
title: 'Creating a New Security Compliance Framework in Prowler'
---
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
This guide explains how to add a new security compliance framework to Prowler, end to end. It covers directory layout, the two supported JSON schemas (universal and legacy), the Pydantic models that validate each framework, check mapping conventions, output formatting, local validation, testing, and the pull request process.
## Introduction
@@ -23,7 +25,7 @@ Requirement coverage feeds the compliance percentage calculations and the metada
| **Universal (recommended for new frameworks)** | Multi-provider frameworks, or single-provider frameworks that benefit from declarative table/PDF rendering | `prowler/compliance/.json` (top-level) | Available for **every** provider whose key appears in any `requirement.checks` dict |
| **Legacy provider-specific** | Single-provider frameworks with framework-specific attribute classes already declared in the codebase (CIS, ENS, ISO 27001, etc.) | `prowler/compliance//__.json` | Available only under that provider |
-Auto-discovery happens in `get_bulk_compliance_frameworks_universal(provider)` (`prowler/lib/check/compliance_models.py:915`), which scans **both** the top-level `prowler/compliance/` directory and every per-provider sub-directory. Legacy frameworks are transparently converted to the universal `ComplianceFramework` model via `adapt_legacy_to_universal()` before being returned, so the rest of Prowler — CLI table rendering, CSV/OCSF outputs, PDF generation — works the same regardless of the source schema.
+Auto-discovery happens in `get_bulk_compliance_frameworks_universal(provider)` (`prowler/lib/check/compliance_models.py`), which scans **both** the top-level `prowler/compliance/` directory and every per-provider sub-directory. Legacy frameworks are transparently converted to the universal `ComplianceFramework` model via `adapt_legacy_to_universal()` before being returned, so the rest of Prowler — CLI table rendering, CSV/OCSF outputs, PDF generation — works the same regardless of the source schema.
> The legacy entry-point `Compliance.get_bulk(provider)` (used by older code paths) only scans per-provider sub-directories. Universal top-level files are picked up exclusively via the universal loader; this matters if you are wiring a new code path against the legacy API.
@@ -70,13 +72,13 @@ The file is auto-discovered — there is **no** need to register it in any `__in
}
```
-A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py:739`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora_2022_2554.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
+A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora_2022_2554.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
Provider keys inside `requirement.checks` must match the directory names under `prowler/providers/`. The valid keys at present are: `aws`, `azure`, `gcp`, `m365`, `kubernetes`, `iac`, `github`, `googleworkspace`, `alibabacloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `oraclecloud`, `llm`. Comparison in `supports_provider()` is case-insensitive, but lowercase is the convention used everywhere in the repository.
### `attributes_metadata`
-Declares the shape of the per-requirement `attributes` dict. When this field is present, the root validator `validate_attributes_against_metadata` (`compliance_models.py:669`) enforces the schema at load time and rejects:
+Declares the shape of the per-requirement `attributes` dict. When this field is present, the root validator `validate_attributes_against_metadata` (`compliance_models.py`) enforces the schema at load time and rejects:
- Missing keys marked `required: true`.
- Keys present in `attributes` but not declared in `attributes_metadata` (typo / drift guard).
@@ -192,6 +194,7 @@ Per requirement:
- `name`: short title shown alongside the id.
- `attributes`: flat dict; keys must conform to `attributes_metadata`.
- `checks`: dict keyed by provider name (the same lowercase keys listed in the previous section). Each value is a list of Prowler check names that evidence this requirement for that provider. The list **may be empty** and the dict itself defaults to `{}` if omitted; either way the requirement is still loaded and listed by `--list-compliance-requirements`, it just has zero checks to execute. Note: there is **no automatic check-existence validation** at load time — referencing a non-existent check name will silently produce a requirement with no findings. Validate this yourself (see "Validating Your Framework" below).
+- `config_requirements`: optional list of configuration guardrails. Each entry asserts that a configurable check referenced by this requirement ran with a configuration strict enough to actually satisfy the requirement; otherwise the requirement is forced to FAIL. See [Configuration Guardrails for Requirements](#configuration-guardrails-for-requirements) for the full schema and semantics. In the universal schema the field name is lowercase (`config_requirements`); legacy files use `ConfigRequirements`.
For MITRE-style frameworks, additional optional fields are available on the requirement: `tactics`, `sub_techniques`, `platforms`, `technique_url` (these are populated automatically when adapting a legacy MITRE JSON to the universal model).
@@ -258,12 +261,12 @@ prowler/lib/outputs/compliance//
### JSON schema reference
-Every legacy compliance file is a JSON document with the following top-level keys. `Framework`, `Name` and `Provider` are validated non-empty by the root validator `framework_and_provider_must_not_be_empty` (`compliance_models.py:329`).
+Every legacy compliance file is a JSON document with the following top-level keys. `Framework`, `Name` and `Provider` are validated non-empty by the root validator `framework_and_provider_must_not_be_empty` (`compliance_models.py`).
| Field | Type | Required | Description |
|---|---|---|---|
| `Framework` | string | Yes | Canonical framework identifier, for example `CIS`, `NIST-800-53-Revision-5`, `ENS`, `CCC`. |
-| `Name` | string | Yes | Human-readable framework name displayed by Prowler App. |
+| `Name` | string | Yes | Human-readable framework name displayed by Prowler Cloud and Prowler Local Server. |
| `Version` | string | Yes (recommended) | Framework version, e.g. `2.0`. See [Version Handling](#version-handling). |
| `Provider` | string | Yes | Upper-cased provider identifier: `AWS`, `AZURE`, `GCP`, `KUBERNETES`, `M365`, `GITHUB`, `GOOGLEWORKSPACE`, and so on. |
| `Description` | string | Yes | Short description of the framework's scope and purpose. |
@@ -280,10 +283,11 @@ Each entry in `Requirements` describes one control or requirement.
| `Description` | string | Yes | Verbatim description from the source framework. |
| `Attributes` | array | Yes | List of [attribute objects](#attribute-objects). The shape depends on the framework. |
| `Checks` | array of strings | Yes | Prowler check identifiers that automate the requirement. Leave the list empty when the control cannot be automated. |
+| `ConfigRequirements` | array of objects | No | Optional [configuration guardrails](#configuration-guardrails-for-requirements). Each entry asserts that a configurable check ran with a configuration strict enough to satisfy the requirement; when it did not, the requirement is forced to FAIL. |
#### Attribute Objects
-`Attributes` is parsed against the union declared in `Compliance_Requirement.Attributes` (`compliance_models.py:293`). Pydantic v1 tries each member of the union in declaration order and falls back to `Generic_Compliance_Requirement_Attribute` (the last entry) when nothing else matches — so a brand-new shape that doesn't match any existing class will silently be accepted as Generic, losing its specific fields.
+`Attributes` is parsed against the union declared in `Compliance_Requirement.Attributes` (`compliance_models.py`). Pydantic v1 tries each member of the union in declaration order and falls back to `Generic_Compliance_Requirement_Attribute` (the last entry) when nothing else matches — so a brand-new shape that doesn't match any existing class will silently be accepted as Generic, losing its specific fields.
As of today, the registered attribute classes are: `CIS_Requirement_Attribute`, `ENS_Requirement_Attribute`, `ASDEssentialEight_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `AWS_Well_Architected_Requirement_Attribute`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `CCC_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, `CSA_CCM_Requirement_Attribute`, and `Generic_Compliance_Requirement_Attribute` (fallback). MITRE-style frameworks use the separate `Mitre_Requirement` model with `Tactics` / `SubTechniques` / `Platforms` / `TechniqueURL` at the requirement top level. The most common shapes are summarized below.
@@ -472,13 +476,188 @@ For NIST-style catalogs that use `Generic_Compliance_Requirement_Attribute`, no
### Legacy-to-universal adapter
-At load time, every legacy file is transparently adapted to a `ComplianceFramework` via `adapt_legacy_to_universal()` (`compliance_models.py:819`), which: (a) flattens the first element of `Attributes` into a flat `attributes` dict, (b) wraps `Checks` as `{provider_lower: [...]}`, (c) infers `attributes_metadata` from the matched Pydantic class via `_infer_attribute_metadata()`. The rest of Prowler (CSV/OCSF/PDF output, CLI table) then treats both formats identically.
+At load time, every legacy file is transparently adapted to a `ComplianceFramework` via `adapt_legacy_to_universal()` (`compliance_models.py`), which: (a) flattens the first element of `Attributes` into a flat `attributes` dict, (b) wraps `Checks` as `{provider_lower: [...]}`, (c) infers `attributes_metadata` from the matched Pydantic class via `_infer_attribute_metadata()`. The rest of Prowler (CSV/OCSF/PDF output, CLI table) then treats both formats identically.
Loader-error behaviour differs between the two entry points:
-- `load_compliance_framework()` (legacy) is **fail-fast**: it calls `sys.exit(1)` on any `ValidationError` (`compliance_models.py:464`).
+- `load_compliance_framework()` (legacy) is **fail-fast**: it calls `sys.exit(1)` on any `ValidationError` (`compliance_models.py`).
- `load_compliance_framework_universal()` is more lenient — it logs the error and returns `None`, so `get_bulk_compliance_frameworks_universal()` simply skips the broken file and keeps loading the rest.
+## Configuration Guardrails for Requirements
+
+
+
+Some requirements are only truly satisfied when the configurable checks behind them ran with a configuration strict enough to meet the control. A [configurable check](/developer-guide/configurable-checks) reads thresholds from the scan's `audit_config`, so loosening a value can make the check PASS while the requirement it backs is, in fact, not satisfied.
+
+A worked example: CIS AWS 6.0 requirement 2.11 ("credentials unused for 45 days or more are disabled") maps to `iam_user_accesskey_unused`, which is driven by the `max_unused_access_keys_days` config key. If a user raises that value to `120`, the check passes for a key unused for 90 days — yet the requirement explicitly demands a 45-day threshold, so the PASS is misleading.
+
+Configuration guardrails close that gap. A requirement declares the configuration it expects, and when the scan ran with a configuration too loose to honor it, the requirement is forced to **FAIL** in every compliance output, with the reason surfaced in the finding's extended status.
+
+
+Guardrails are an **optional** safety net for configurable checks. A requirement that maps only to non-configurable checks does not need them. When the field is absent, behavior is unchanged.
+
+
+### Where guardrails are declared
+
+The field is attached to each requirement and exists in both schemas:
+
+- **Legacy** (`prowler/compliance//...`): `ConfigRequirements`, a list of objects, validated against the `Compliance_Requirement_ConfigConstraint` Pydantic model (`prowler/lib/check/compliance_models.py`).
+- **Universal** (`prowler/compliance/...`): `config_requirements`, the same list of objects as plain dicts on `UniversalComplianceRequirement`.
+
+When a legacy file is adapted to the universal model, `adapt_legacy_to_universal()` copies `ConfigRequirements` into `config_requirements` (`compliance_models.py`), so downstream code only ever reads one shape.
+
+### Constraint schema
+
+Each entry in the list is a single constraint with the following fields:
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `Check` | string | Yes | The configurable check this constraint guards. Should be one of the requirement's `Checks`. Used only to build a human-readable reason. |
+| `ConfigKey` | string | Yes | The `audit_config` key the check reads (for example `max_unused_access_keys_days`). |
+| `Operator` | enum | Yes | How to compare the applied value against `Value`. One of `lte`, `gte`, `eq`, `in`, `subset`, `superset`. |
+| `Value` | bool, int, float, string, or list | Yes | The strictest configuration the requirement tolerates. The accepted Python type depends on the operator (see below). |
+| `Provider` | string | No | The provider this constraint applies to (e.g. `aws`). **Required for universal (multi-provider) frameworks**, where the same requirement maps checks across providers — the constraint is only evaluated when the scanned provider matches. Single-provider (legacy) frameworks omit it. |
+
+### Operators
+
+| Operator | Applied value satisfies the guardrail when… | Typical use |
+|---|---|---|
+| `lte` | `applied <= Value` | Maximum-age / maximum-count thresholds (e.g. `max_unused_access_keys_days <= 45`). |
+| `gte` | `applied >= Value` | Minimum-retention / minimum-count thresholds. |
+| `eq` | `applied == Value` | Boolean toggles or an exact required value (e.g. `mute_non_default_regions == false`). |
+| `in` | `applied` is one of `Value` (a list) | The applied scalar must belong to an allowed set. |
+| `subset` | `set(applied) <= set(Value)` | **Allowlist** configs — every applied value must already be permitted. Widening the allowlist with a weaker value (e.g. adding TLS `1.0` to `recommended_minimal_tls_versions`) breaks the guardrail. |
+| `superset` | `set(applied) >= set(Value)` | **Denylist** configs — every forbidden value must remain forbidden. Removing an entry from a denylist (e.g. dropping a weak algorithm from `insecure_key_algorithms`) breaks the guardrail. |
+
+
+`subset` / `superset` require both the applied value and `Value` to be lists; any other type is treated as not satisfied. For `eq` against a boolean, declare `Value` as a JSON boolean (`false`, not `0`) — the model keeps booleans distinct from integers.
+
+
+### How guardrails are evaluated
+
+All evaluation lives in one shared module, `prowler/lib/check/compliance_config_eval.py`, consumed by every compliance output (CSV, OCSF, and the CLI tables) and reused by the Prowler API backend so the rule is defined exactly once.
+
+1. The applied configuration is the scan-global `audit_config` (the same mapping for every resource and region), resolved via `get_scan_audit_config()`.
+2. For each requirement that declares constraints, `evaluate_config_constraints()` walks the list and returns `(is_compliant, reason)`. The requirement is compliant when **every** explicitly-set key satisfies its constraint.
+3. A constraint tagged with a `Provider` that does **not** match the provider being scanned (resolved via `get_scan_provider_type()`) is **skipped**. This scopes a universal framework's constraints to the right provider, so a guardrail authored for an AWS check never affects a GCP or Azure scan of the same requirement. Untagged constraints (legacy single-provider frameworks) always apply.
+4. A constraint whose `ConfigKey` is **not present** in `audit_config` is **skipped** — the check's built-in default is assumed to already match what the requirement expects. This is why nothing changes for the default configuration.
+5. When a constraint is violated, the finding's status is overridden to `FAIL` and a plain-language explanation is prepended to `status_extended` (via `apply_config_status()`). The message opens with `Configuration not valid for this requirement.` and names the check, the value the scan applied, what the requirement needs and how to fix it. For the table generators, `get_effective_status()` applies the same FAIL roll-up so per-section counts stay consistent.
+
+
+Guardrails only ever make a result **stricter** (they can turn PASS into FAIL); they never relax a real FAIL into PASS. A requirement with no constraints, or whose keys all use defaults, is reported exactly as before.
+
+
+### Example: legacy framework
+
+From `prowler/compliance/aws/cis_6.0_aws.json`, requirement 2.11 declares two guardrails — one per configurable check it maps to:
+
+```json title="prowler/compliance/aws/cis_6.0_aws.json"
+{
+ "Id": "2.11",
+ "Description": "Ensure credentials unused for 45 days or more are disabled.",
+ "Checks": [
+ "iam_user_accesskey_unused",
+ "iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
+ "Attributes": [ /* ... */ ]
+}
+```
+
+A boolean guardrail from the same file: requirement 2.5 (IAM Access Analyzer) only holds when regions are not muted, so a scan with `mute_non_default_regions: true` cannot be trusted for it:
+
+```json
+"ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+]
+```
+
+### Example: universal framework
+
+The universal schema uses the lowercase `config_requirements` key with the identical object shape:
+
+```json
+{
+ "id": "MF-2.1",
+ "name": "Restrict TLS to modern versions",
+ "description": "Endpoints must negotiate only TLS 1.2 or higher.",
+ "checks": {
+ "aws": ["elbv2_listener_ssl_listeners"]
+ },
+ "config_requirements": [
+ {
+ "Check": "elbv2_listener_ssl_listeners",
+ "Provider": "aws",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": ["TLS 1.2", "TLS 1.3"]
+ }
+ ]
+}
+```
+
+Each constraint declares the `Provider` it targets so the guardrail is only evaluated on scans of that provider — essential for universal frameworks like CSA CCM and DORA, where one requirement maps checks across `aws`, `azure`, `gcp` and more. Because the operator is `subset`, adding `"TLS 1.0"` to `recommended_minimal_tls_versions` widens the allowlist beyond `["TLS 1.2", "TLS 1.3"]` and the requirement is forced to FAIL.
+
+### What the user sees
+
+With a loosened config, the affected requirement's findings report:
+
+```text
+Status: FAIL
+StatusExtended: Configuration not valid for this requirement. The check
+ iam_user_accesskey_unused has max_unused_access_keys_days set
+ to 120, but the requirement needs a value of 45 or lower.
+ Update it to 45 or lower.
+```
+
+The same `Configuration not valid for this requirement.` message appears identically across the CSV, OCSF, and console-table outputs.
+
+### Authoring guidelines
+
+- Declare a guardrail only for keys whose value actually changes whether the requirement is met. Most configurable checks do not need one.
+- Set `Value` to the **strictest** configuration the control tolerates — the same number the control text cites (CIS 45 days, NIST ≤90, and so on).
+- Keep `ConfigKey` spelled exactly as the check reads it from `audit_config`; an unknown key is never present in the config and the constraint is silently skipped.
+- In a **universal (multi-provider) framework**, always set `Provider` to the provider that owns `Check` — otherwise the guardrail would leak onto scans of the other providers the requirement maps. Legacy single-provider files omit it.
+- Pick the operator from the value's role: a max threshold is `lte`, a min threshold is `gte`, a toggle is `eq`, an allowlist is `subset`, a denylist is `superset`.
+- An unrecognized operator does **not** block the requirement — a malformed constraint is treated as satisfied rather than failing the whole framework. Validate your JSON with the tests below.
+
+### Testing guardrails
+
+The shared evaluator and the per-output integration are covered by:
+
+- `tests/lib/check/compliance_config_eval_test.py` — operator semantics, skipped-key behavior, and the FAIL override.
+- `tests/lib/check/compliance_config_constraint_model_test.py` — model validation (types, operator enum, bool-vs-int).
+- `tests/lib/check/compliance_config_requirements_data_test.py` — sanity-checks the guardrails shipped in the JSON catalog.
+- Per-output tests under `tests/lib/outputs/compliance/` (CIS AWS/Azure, ENS AWS, OCSF, universal table) confirm the override reaches each format.
+
+Run them with:
+
+```bash
+uv run pytest -n auto \
+ tests/lib/check/compliance_config_eval_test.py \
+ tests/lib/check/compliance_config_constraint_model_test.py \
+ tests/lib/check/compliance_config_requirements_data_test.py \
+ tests/lib/outputs/compliance/
+```
+
## Version handling
Prowler matches frameworks by concatenating `Framework` and `Version`. A missing or empty `Version` collapses several frameworks to the same key and breaks CLI filtering with `--compliance`.
@@ -557,9 +736,9 @@ Open the generated CSV and confirm:
- Every requirement has at least one row per scanned resource (when there are findings).
- Attribute values such as `Requirements_Attributes_Section` reflect the JSON content.
-### 5. Verify the framework in Prowler App
+### 5. Verify the Framework in Prowler Local Server
-Launch Prowler App locally (`docker compose up` from the repository root) and run a scan with the new compliance framework. Confirm the compliance page renders the requirements, sections, and status widgets correctly.
+Launch Prowler Local Server (`docker compose up` from the repository root) and run a scan with the new compliance framework. Confirm the compliance page renders the requirements, sections, and status widgets correctly.
## Testing
@@ -599,7 +778,7 @@ Before opening the pull request:
uv run pre-commit run --all-files
uv run pytest -n auto
```
-2. Add a changelog entry under the `### 🚀 Added` section of `prowler/CHANGELOG.md`, describing the new framework and the providers it covers.
+2. Add a changelog fragment `prowler/changelog.d/.added.md`, describing the new framework and the providers it covers (no PR link in the text; it is attached automatically at release time).
3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, e.g. `feat(compliance): add My Framework 1.0 for AWS`.
4. Request review from the compliance codeowners listed in `.github/CODEOWNERS`.
@@ -609,7 +788,7 @@ The following issues are the most common when contributing a compliance framewor
- **`ValidationError: field required` during scan (legacy).** The JSON is missing a required attribute field. Re-check the matching Pydantic model in `prowler/lib/check/compliance_models.py`.
- **All attributes collapse to `Generic_Compliance_Requirement_Attribute` values (legacy).** The Pydantic `Union` is ordered incorrectly, or the JSON matches only the generic shape. Keep the generic model in the last Union position and ensure every required field is present in the JSON.
-- **`attributes_metadata validation failed` (universal).** The root validator in `compliance_models.py:669` rejected the file. The error message lists each offending requirement; common causes are unknown attribute keys (typo or missing entry in `attributes_metadata`), enum violations, or missing required keys.
+- **`attributes_metadata validation failed` (universal).** The root validator in `compliance_models.py` rejected the file. The error message lists each offending requirement; common causes are unknown attribute keys (typo or missing entry in `attributes_metadata`), enum violations, or missing required keys.
- **`--compliance` filter does not find the framework.** For legacy: the filename does not match `__.json`, the version is empty, or the file lives outside `prowler/compliance//`. For universal: the file is not at the top level of `prowler/compliance/` or it loaded as `None` (check logs for the validation error).
- **CLI summary table is empty but the CSV is populated (legacy).** The dispatcher branch in `prowler/lib/outputs/compliance/compliance.py` is missing or its substring match does not catch the framework key.
- **CSV file is missing after the scan (legacy).** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
diff --git a/docs/developer-guide/stackit-details.mdx b/docs/developer-guide/stackit-details.mdx
index 9d4ea5d458..58a5cf19a5 100644
--- a/docs/developer-guide/stackit-details.mdx
+++ b/docs/developer-guide/stackit-details.mdx
@@ -59,7 +59,7 @@ StackIT uses service account keys for API authentication. Service account keys a
1. **Navigate to Service Accounts**
- Go to the [StackIT Portal](https://portal.stackit.cloud/)
- Select your project
- - Click on **Service Accounts** in the left sidebar
+ - Click **Service Accounts** in the left sidebar
2. **Create or Select Service Account**
- If you don't have a service account, click **Create Service Account**
diff --git a/docs/docs.json b/docs/docs.json
index 5b88b5d2da..b9bc195182 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -38,61 +38,73 @@
{
"group": "Welcome",
"pages": [
- "introduction"
+ "introduction",
+ "getting-started/products/index"
]
},
{
- "group": "Prowler Cloud",
+ "group": "Prowler Products",
"pages": [
- "getting-started/products/prowler-cloud",
- "getting-started/products/prowler-cloud-pricing",
- "getting-started/products/prowler-cloud-aws-marketplace",
- "getting-started/goto/prowler-cloud",
- "getting-started/goto/prowler-api-reference"
+ {
+ "group": "Prowler Cloud",
+ "pages": [
+ "getting-started/products/prowler-cloud",
+ "getting-started/products/prowler-cloud-pricing",
+ "getting-started/products/prowler-cloud-aws-marketplace",
+ "getting-started/goto/prowler-cloud",
+ "getting-started/goto/prowler-api-reference"
+ ]
+ },
+ {
+ "group": "Prowler Lighthouse AI",
+ "pages": [
+ "getting-started/products/prowler-cloud-lighthouse"
+ ]
+ },
+ {
+ "group": "Prowler Hub",
+ "pages": [
+ "getting-started/products/prowler-hub",
+ "getting-started/goto/prowler-hub"
+ ]
+ },
+ {
+ "group": "Prowler MCP",
+ "pages": [
+ "getting-started/products/prowler-mcp",
+ "getting-started/basic-usage/prowler-mcp",
+ "getting-started/basic-usage/prowler-mcp-tools",
+ "getting-started/installation/prowler-mcp"
+ ]
+ },
+ {
+ "group": "Prowler for AI Agents",
+ "pages": [
+ "getting-started/products/prowler-claude-code-plugin"
+ ]
+ }
]
},
{
- "group": "Prowler CLI",
+ "group": "Open Source",
"pages": [
- "getting-started/products/prowler-cli",
- "getting-started/installation/prowler-cli",
- "getting-started/basic-usage/prowler-cli"
- ]
- },
- {
- "group": "Prowler App",
- "pages": [
- "getting-started/products/prowler-app",
- "getting-started/installation/prowler-app",
- "getting-started/basic-usage/prowler-app"
- ]
- },
- {
- "group": "Prowler Lighthouse AI",
- "pages": [
- "getting-started/products/prowler-lighthouse-ai"
- ]
- },
- {
- "group": "Prowler for Claude Code",
- "pages": [
- "getting-started/products/prowler-claude-code-plugin"
- ]
- },
- {
- "group": "Prowler MCP Server",
- "pages": [
- "getting-started/products/prowler-mcp",
- "getting-started/installation/prowler-mcp",
- "getting-started/basic-usage/prowler-mcp",
- "getting-started/basic-usage/prowler-mcp-tools"
- ]
- },
- {
- "group": "Prowler Hub",
- "pages": [
- "getting-started/products/prowler-hub",
- "getting-started/goto/prowler-hub"
+ {
+ "group": "Prowler CLI",
+ "pages": [
+ "getting-started/products/prowler-cli",
+ "getting-started/installation/prowler-cli",
+ "getting-started/basic-usage/prowler-cli"
+ ]
+ },
+ {
+ "group": "Prowler Local Server",
+ "pages": [
+ "getting-started/products/prowler-app",
+ "getting-started/installation/prowler-app",
+ "getting-started/basic-usage/prowler-app"
+ ]
+ },
+ "getting-started/products/prowler-sdk"
]
},
{
@@ -111,32 +123,38 @@
"tab": "Guides",
"groups": [
{
- "group": "Prowler Cloud/App",
+ "group": "Prowler Cloud",
"pages": [
"user-guide/tutorials/prowler-app",
{
- "group": "Authentication",
+ "group": "Authentication & Access",
"pages": [
+ "user-guide/tutorials/prowler-app-api-keys",
+ "user-guide/tutorials/prowler-app-multi-tenant",
+ "user-guide/tutorials/prowler-app-sso",
"user-guide/tutorials/prowler-app-social-login",
- "user-guide/tutorials/prowler-app-sso"
+ "user-guide/tutorials/prowler-app-rbac"
]
},
- "user-guide/tutorials/prowler-app-rbac",
- "user-guide/tutorials/prowler-app-multi-tenant",
- "user-guide/tutorials/prowler-app-api-keys",
- "user-guide/tutorials/prowler-import-findings",
- "user-guide/tutorials/prowler-alerts",
{
- "group": "Mutelist",
- "expanded": true,
+ "group": "Compliance",
"pages": [
- "user-guide/tutorials/prowler-app-simple-mutelist",
- "user-guide/tutorials/prowler-app-mute-findings"
+ "user-guide/compliance/tutorials/compliance",
+ "user-guide/compliance/tutorials/cross-provider-compliance",
+ "user-guide/compliance/tutorials/threatscore"
+ ]
+ },
+ {
+ "group": "Findings",
+ "pages": [
+ "user-guide/tutorials/prowler-alerts",
+ "user-guide/tutorials/prowler-app-attack-paths",
+ "user-guide/tutorials/prowler-app-finding-groups",
+ "user-guide/tutorials/prowler-app-findings-triage"
]
},
{
"group": "Integrations",
- "expanded": true,
"pages": [
"user-guide/tutorials/prowler-app-s3-integration",
"user-guide/tutorials/prowler-app-security-hub-integration",
@@ -144,33 +162,64 @@
]
},
{
- "group": "AWS Organizations",
- "expanded": true,
+ "group": "Mutelist",
"pages": [
- "user-guide/tutorials/prowler-cloud-aws-organizations"
+ "user-guide/tutorials/prowler-app-mute-findings",
+ "user-guide/tutorials/prowler-app-simple-mutelist"
]
},
{
- "group": "Lighthouse AI",
+ "group": "Providers",
"pages": [
- "user-guide/tutorials/prowler-app-lighthouse",
- "user-guide/tutorials/prowler-app-lighthouse-multi-llm"
+ "user-guide/tutorials/prowler-cloud-aws-organizations",
+ "user-guide/tutorials/prowler-cloud-azure-management-groups",
+ "user-guide/tutorials/prowler-cloud-gcp-organizations"
+ ]
+ },
+ {
+ "group": "Scans",
+ "pages": [
+ "user-guide/tutorials/prowler-app-scan-configuration",
+ "user-guide/tutorials/prowler-import-findings",
+ "user-guide/tutorials/prowler-scan-scheduling"
]
},
- "user-guide/tutorials/prowler-app-attack-paths",
- "user-guide/tutorials/prowler-app-finding-groups",
- "user-guide/tutorials/prowler-cloud-public-ips",
{
"group": "Tutorials",
"pages": [
- "user-guide/tutorials/prowler-app-sso-entra",
- "user-guide/tutorials/prowler-app-sso-google-workspace",
+ "user-guide/tutorials/aws-organizations-bulk-provisioning",
"user-guide/tutorials/bulk-provider-provisioning",
- "user-guide/tutorials/aws-organizations-bulk-provisioning"
+ "user-guide/tutorials/prowler-app-sso-entra",
+ "user-guide/tutorials/prowler-app-sso-google-workspace"
]
}
]
},
+ {
+ "group": "Prowler Lighthouse AI",
+ "pages": [
+ {
+ "group": "Prowler Cloud",
+ "pages": [
+ "user-guide/tutorials/prowler-cloud-lighthouse-multi-llm"
+ ]
+ },
+ {
+ "group": "Prowler Local Server",
+ "pages": [
+ "getting-started/products/prowler-lighthouse-ai",
+ "user-guide/tutorials/prowler-app-lighthouse",
+ "user-guide/tutorials/prowler-app-lighthouse-multi-llm"
+ ]
+ }
+ ]
+ },
+ {
+ "group": "Prowler for AI Agents",
+ "pages": [
+ "getting-started/products/prowler-claude-code-plugin"
+ ]
+ },
{
"group": "CI/CD",
"pages": [
@@ -212,6 +261,13 @@
{
"group": "Providers",
"pages": [
+ {
+ "group": "Alibaba Cloud",
+ "pages": [
+ "user-guide/providers/alibabacloud/getting-started-alibabacloud",
+ "user-guide/providers/alibabacloud/authentication"
+ ]
+ },
{
"group": "AWS",
"pages": [
@@ -235,9 +291,31 @@
"user-guide/providers/azure/authentication",
"user-guide/providers/azure/use-non-default-cloud",
"user-guide/providers/azure/subscriptions",
+ "user-guide/providers/azure/resource-groups",
"user-guide/providers/azure/create-prowler-service-principal"
]
},
+ {
+ "group": "Cloudflare",
+ "pages": [
+ "user-guide/providers/cloudflare/getting-started-cloudflare",
+ "user-guide/providers/cloudflare/authentication"
+ ]
+ },
+ {
+ "group": "E2E Networks",
+ "pages": [
+ "user-guide/providers/e2enetworks/getting-started-e2enetworks",
+ "user-guide/providers/e2enetworks/authentication"
+ ]
+ },
+ {
+ "group": "GitHub",
+ "pages": [
+ "user-guide/providers/github/getting-started-github",
+ "user-guide/providers/github/authentication"
+ ]
+ },
{
"group": "Google Cloud",
"pages": [
@@ -249,10 +327,24 @@
]
},
{
- "group": "Alibaba Cloud",
+ "group": "Google Workspace",
"pages": [
- "user-guide/providers/alibabacloud/getting-started-alibabacloud",
- "user-guide/providers/alibabacloud/authentication"
+ "user-guide/providers/googleworkspace/getting-started-googleworkspace",
+ "user-guide/providers/googleworkspace/authentication"
+ ]
+ },
+ {
+ "group": "IaC",
+ "pages": [
+ "user-guide/providers/iac/getting-started-iac",
+ "user-guide/providers/iac/authentication"
+ ]
+ },
+ {
+ "group": "Image",
+ "pages": [
+ "user-guide/providers/image/getting-started-image",
+ "user-guide/providers/image/authentication"
]
},
{
@@ -262,6 +354,19 @@
"user-guide/providers/kubernetes/misc"
]
},
+ {
+ "group": "Linode",
+ "pages": [
+ "user-guide/providers/linode/getting-started-linode",
+ "user-guide/providers/linode/authentication"
+ ]
+ },
+ {
+ "group": "LLM",
+ "pages": [
+ "user-guide/providers/llm/getting-started-llm"
+ ]
+ },
{
"group": "Microsoft 365",
"pages": [
@@ -270,27 +375,6 @@
"user-guide/providers/microsoft365/use-of-powershell"
]
},
- {
- "group": "Google Workspace",
- "pages": [
- "user-guide/providers/googleworkspace/getting-started-googleworkspace",
- "user-guide/providers/googleworkspace/authentication"
- ]
- },
- {
- "group": "GitHub",
- "pages": [
- "user-guide/providers/github/getting-started-github",
- "user-guide/providers/github/authentication"
- ]
- },
- {
- "group": "IaC",
- "pages": [
- "user-guide/providers/iac/getting-started-iac",
- "user-guide/providers/iac/authentication"
- ]
- },
{
"group": "MongoDB Atlas",
"pages": [
@@ -299,30 +383,11 @@
]
},
{
- "group": "Cloudflare",
+ "group": "Okta",
"pages": [
- "user-guide/providers/cloudflare/getting-started-cloudflare",
- "user-guide/providers/cloudflare/authentication"
- ]
- },
- {
- "group": "Image",
- "pages": [
- "user-guide/providers/image/getting-started-image",
- "user-guide/providers/image/authentication"
- ]
- },
- {
- "group": "LLM",
- "pages": [
- "user-guide/providers/llm/getting-started-llm"
- ]
- },
- {
- "group": "Oracle Cloud Infrastructure",
- "pages": [
- "user-guide/providers/oci/getting-started-oci",
- "user-guide/providers/oci/authentication"
+ "user-guide/providers/okta/getting-started-okta",
+ "user-guide/providers/okta/authentication",
+ "user-guide/providers/okta/retry-configuration"
]
},
{
@@ -332,6 +397,13 @@
"user-guide/providers/openstack/authentication"
]
},
+ {
+ "group": "Oracle Cloud Infrastructure",
+ "pages": [
+ "user-guide/providers/oci/getting-started-oci",
+ "user-guide/providers/oci/authentication"
+ ]
+ },
{
"group": "Scaleway",
"pages": [
@@ -352,30 +424,9 @@
"user-guide/providers/vercel/getting-started-vercel",
"user-guide/providers/vercel/authentication"
]
- },
- {
- "group": "Okta",
- "pages": [
- "user-guide/providers/okta/getting-started-okta",
- "user-guide/providers/okta/authentication"
- ]
- },
- {
- "group": "Linode",
- "pages": [
- "user-guide/providers/linode/getting-started-linode",
- "user-guide/providers/linode/authentication"
- ]
}
]
},
- {
- "group": "Compliance",
- "pages": [
- "user-guide/compliance/tutorials/compliance",
- "user-guide/compliance/tutorials/threatscore"
- ]
- },
{
"group": "Cookbooks",
"pages": [
@@ -396,6 +447,7 @@
"developer-guide/provider",
"developer-guide/services",
"developer-guide/checks",
+ "developer-guide/secret-scanning-checks",
"developer-guide/outputs",
"developer-guide/integrations",
"developer-guide/security-compliance-framework",
@@ -482,10 +534,6 @@
"tab": "Changelog",
"icon": "github",
"href": "https://github.com/prowler-cloud/prowler/releases"
- },
- {
- "tab": "Public Roadmap",
- "href": "https://roadmap.prowler.com/"
}
],
"global": {
@@ -521,6 +569,13 @@
}
]
},
+ "banner": {
+ "content": "Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. See [Prowler product families](/getting-started/products).",
+ "dismissible": false
+ },
+ "markdown": {
+ "instructions": "Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP."
+ },
"analytics": {
"ga4": {
"measurementId": "G-KBKV70W5Y2"
@@ -601,6 +656,10 @@
{
"source": "/user-guide/tutorials/prowler-app-alerts",
"destination": "/user-guide/tutorials/prowler-alerts"
+ },
+ {
+ "source": "/user-guide/tutorials/prowler-cloud-public-ips",
+ "destination": "/security/networking"
}
]
}
diff --git a/docs/getting-started/basic-usage/prowler-app.mdx b/docs/getting-started/basic-usage/prowler-app.mdx
index bc39353dcc..0f4cf80a91 100644
--- a/docs/getting-started/basic-usage/prowler-app.mdx
+++ b/docs/getting-started/basic-usage/prowler-app.mdx
@@ -2,7 +2,7 @@
title: 'Basic Usage'
---
-## Access Prowler App
+## Access Prowler Local Server
After [installation](/getting-started/installation/prowler-app), navigate to [http://localhost:3000](http://localhost:3000) and sign up with email and password.
@@ -28,7 +28,7 @@ This mechanism ensures that the first user in a newly created tenant has adminis
## Log In
-Access Prowler App by logging in with **email and password**.
+Access Prowler Local Server by logging in with **email and password**.
@@ -62,7 +62,7 @@ Review findings during scan execution in the following sections:
- **Compliance** – Displays compliance insights based on security frameworks.
-> For detailed usage instructions, refer to the [Prowler App Guide](/user-guide/tutorials/prowler-app).
+> For detailed usage instructions, refer to the [Prowler Cloud guide](/user-guide/tutorials/prowler-app), which also applies to Prowler Local Server.
Prowler will automatically scan all configured providers every **24 hours**, ensuring your cloud environment stays continuously monitored.
diff --git a/docs/getting-started/basic-usage/prowler-mcp-tools.mdx b/docs/getting-started/basic-usage/prowler-mcp-tools.mdx
index ec11680dd5..acb50c9e81 100644
--- a/docs/getting-started/basic-usage/prowler-mcp-tools.mdx
+++ b/docs/getting-started/basic-usage/prowler-mcp-tools.mdx
@@ -10,7 +10,7 @@ Complete reference guide for all tools available in the Prowler MCP Server. Tool
|----------|------------|------------------------|
| Prowler Hub | 10 tools | No |
| Prowler Documentation | 2 tools | No |
-| Prowler Cloud/App | 32 tools | Yes |
+| Prowler Cloud, Private Cloud & Local Server | 32 tools | Yes |
## Tool Naming Convention
@@ -18,11 +18,11 @@ All tools follow a consistent naming pattern with prefixes:
- `prowler_hub_*` - Prowler Hub catalog and compliance tools
- `prowler_docs_*` - Prowler documentation search and retrieval
-- `prowler_app_*` - Prowler Cloud and App (Self-Managed) management tools
+- `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools
-## Prowler Cloud/App Tools
+## Prowler Tools
-Manage Prowler Cloud or Prowler App (Self-Managed) features. **Requires authentication.**
+Manage your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server. **Requires authentication.**
These tools require a valid API key. See the [Configuration Guide](/getting-started/basic-usage/prowler-mcp) for authentication setup.
@@ -32,44 +32,44 @@ These tools require a valid API key. See the [Configuration Guide](/getting-star
Tools for searching, viewing, and analyzing security findings across all cloud providers.
-- **`prowler_app_search_security_findings`** - Search and filter security findings with advanced filtering options (severity, status, provider, region, service, check ID, date range, muted status)
-- **`prowler_app_get_finding_details`** - Get comprehensive details about a specific finding including remediation guidance, check metadata, and resource relationships
-- **`prowler_app_get_findings_overview`** - Get aggregate statistics and trends about security findings as a markdown report
+- **`prowler_search_security_findings`** - Search and filter security findings with advanced filtering options (severity, status, provider, region, service, check ID, date range, muted status)
+- **`prowler_get_finding_details`** - Get comprehensive details about a specific finding including remediation guidance, check metadata, and resource relationships
+- **`prowler_get_findings_overview`** - Get aggregate statistics and trends about security findings as a markdown report
### Finding Groups Management
Tools for listing finding groups aggregated by check ID, viewing complete group counters, and drilling down into affected resources.
-- **`prowler_app_list_finding_groups`** - List latest or historical finding groups with filters for provider, region, service, resource, category, check, severity, status, muted state, delta, date range, and sorting
-- **`prowler_app_get_finding_group_details`** - Get complete details for a specific finding group including counters, description, timestamps, and impacted providers
-- **`prowler_app_list_finding_group_resources`** - List actionable unmuted resources affected by a finding group by default, including nested resource and provider data plus the `finding_id` for remediation details. Set `include_muted` to include suppressed resources
+- **`prowler_list_finding_groups`** - List latest or historical finding groups with filters for provider, region, service, resource, category, check, severity, status, muted state, delta, date range, and sorting
+- **`prowler_get_finding_group_details`** - Get complete details for a specific finding group including counters, description, timestamps, and impacted providers
+- **`prowler_list_finding_group_resources`** - List actionable unmuted resources affected by a finding group by default, including nested resource and provider data plus the `finding_id` for remediation details. Set `include_muted` to include suppressed resources
### Provider Management
Tools for managing cloud provider connections in Prowler.
-- **`prowler_app_search_providers`** - Search and view configured providers with their connection status
-- **`prowler_app_connect_provider`** - Register and connect a provider with credentials for security scanning
-- **`prowler_app_delete_provider`** - Permanently remove a provider from Prowler
+- **`prowler_search_providers`** - Search and view configured providers with their connection status
+- **`prowler_connect_provider`** - Register and connect a provider with credentials for security scanning
+- **`prowler_delete_provider`** - Permanently remove a provider from Prowler
### Scan Management
Tools for managing and monitoring security scans.
-- **`prowler_app_list_scans`** - List and filter security scans across all providers
-- **`prowler_app_get_scan`** - Get comprehensive details about a specific scan (progress, duration, resource counts)
-- **`prowler_app_trigger_scan`** - Trigger a manual security scan for a provider
-- **`prowler_app_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring
-- **`prowler_app_update_scan`** - Update scan name for better organization
+- **`prowler_list_scans`** - List and filter security scans across all providers
+- **`prowler_get_scan`** - Get comprehensive details about a specific scan (progress, duration, resource counts)
+- **`prowler_trigger_scan`** - Trigger a manual security scan for a provider
+- **`prowler_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring
+- **`prowler_update_scan`** - Update scan name for better organization
### Resources Management
Tools for searching, viewing, and analyzing cloud resources discovered by Prowler.
-- **`prowler_app_list_resources`** - List and filter cloud resources with advanced filtering options (provider, region, service, resource type, tags)
-- **`prowler_app_get_resource`** - Get comprehensive details about a specific resource including configuration, metadata, and finding relationships
-- **`prowler_app_get_resource_events`** - Get the timeline of cloud API actions performed on a resource (AWS CloudTrail). Shows who did what and when, with full request/response payloads
-- **`prowler_app_get_resources_overview`** - Get aggregate statistics about cloud resources as a markdown report
+- **`prowler_list_resources`** - List and filter cloud resources with advanced filtering options (provider, region, service, resource type, tags)
+- **`prowler_get_resource`** - Get comprehensive details about a specific resource including configuration, metadata, and finding relationships
+- **`prowler_get_resource_events`** - Get the timeline of cloud API actions performed on a resource (AWS CloudTrail). Shows who did what and when, with full request/response payloads
+- **`prowler_get_resources_overview`** - Get aggregate statistics about cloud resources as a markdown report
### Muting Management
@@ -77,33 +77,33 @@ Tools for managing finding muting, including pattern-based bulk muting (mutelist
#### Mutelist (Pattern-Based Muting)
-- **`prowler_app_get_mutelist`** - Retrieve the current mutelist configuration for the tenant
-- **`prowler_app_set_mutelist`** - Create or update the mutelist configuration for pattern-based bulk muting
-- **`prowler_app_delete_mutelist`** - Remove the mutelist configuration from the tenant
+- **`prowler_get_mutelist`** - Retrieve the current mutelist configuration for the tenant
+- **`prowler_set_mutelist`** - Create or update the mutelist configuration for pattern-based bulk muting
+- **`prowler_delete_mutelist`** - Remove the mutelist configuration from the tenant
#### Mute Rules (Finding-Specific Muting)
-- **`prowler_app_list_mute_rules`** - Search and filter mute rules with pagination support
-- **`prowler_app_get_mute_rule`** - Retrieve comprehensive details about a specific mute rule
-- **`prowler_app_create_mute_rule`** - Create a new mute rule to mute specific findings with documentation and audit trail
-- **`prowler_app_update_mute_rule`** - Update a mute rule's name, reason, or enabled status
-- **`prowler_app_delete_mute_rule`** - Delete a mute rule from the system
+- **`prowler_list_mute_rules`** - Search and filter mute rules with pagination support
+- **`prowler_get_mute_rule`** - Retrieve comprehensive details about a specific mute rule
+- **`prowler_create_mute_rule`** - Create a new mute rule to mute specific findings with documentation and audit trail
+- **`prowler_update_mute_rule`** - Update a mute rule's name, reason, or enabled status
+- **`prowler_delete_mute_rule`** - Delete a mute rule from the system
### Attack Paths Analysis
Tools for analyzing privilege escalation chains and security misconfigurations using graph-based analysis. Attack Paths maps relationships between cloud resources, permissions, and security findings to detect how privileges can be escalated and how misconfigurations can be exploited.
-- **`prowler_app_list_attack_paths_scans`** - List Attack Paths scans with filtering by provider, provider type, and scan state (available, scheduled, executing, completed, failed, cancelled)
-- **`prowler_app_list_attack_paths_queries`** - Discover available Attack Paths queries for a completed scan, including query names, descriptions, and required parameters
-- **`prowler_app_run_attack_paths_query`** - Execute an Attack Paths query against a completed scan and retrieve graph results with nodes (cloud resources, findings, virtual nodes) and relationships (access paths, role assumptions, security group memberships)
-- **`prowler_app_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema (node labels, relationships, properties) for writing accurate custom openCypher queries
+- **`prowler_list_attack_paths_scans`** - List Attack Paths scans with filtering by provider, provider type, and scan state (available, scheduled, executing, completed, failed, cancelled)
+- **`prowler_list_attack_paths_queries`** - Discover available Attack Paths queries for a completed scan, including query names, descriptions, and required parameters
+- **`prowler_run_attack_paths_query`** - Execute an Attack Paths query against a completed scan and retrieve graph results with nodes (cloud resources, findings, virtual nodes) and relationships (access paths, role assumptions, security group memberships)
+- **`prowler_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema (node labels, relationships, properties) for writing accurate custom openCypher queries
### Compliance Management
Tools for viewing compliance status and framework details across all cloud providers.
-- **`prowler_app_get_compliance_overview`** - Get high-level compliance status across all frameworks for a specific scan or provider, including pass/fail statistics per framework
-- **`prowler_app_get_compliance_framework_state_details`** - Get detailed requirement-level breakdown for a specific compliance framework, including failed requirements and associated finding IDs
+- **`prowler_get_compliance_overview`** - Get high-level compliance status across all frameworks for a specific scan or provider, including pass/fail statistics per framework
+- **`prowler_get_compliance_framework_state_details`** - Get detailed requirement-level breakdown for a specific compliance framework, including failed requirements and associated finding IDs
## Prowler Hub Tools
@@ -145,7 +145,7 @@ Search and access official Prowler documentation. **No authentication required.*
- Use natural language to interact with the tools through your AI assistant
- Tools can be combined for complex workflows
- Filter options are available on most list tools
-- Authentication is only required for Prowler Cloud/App tools
+- Authentication is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server)
## Additional Resources
diff --git a/docs/getting-started/basic-usage/prowler-mcp.mdx b/docs/getting-started/basic-usage/prowler-mcp.mdx
index 2c32dbdbfc..120e5c038b 100644
--- a/docs/getting-started/basic-usage/prowler-mcp.mdx
+++ b/docs/getting-started/basic-usage/prowler-mcp.mdx
@@ -7,10 +7,10 @@ Configure your MCP client to connect to Prowler MCP Server.
## Step 1: Get Your API Key
-**Authentication is optional**: Prowler Hub and Prowler Documentation features work without authentication. An API key is only required for Prowler Cloud and Prowler App (Self-Managed) features.
+**Authentication is optional**: Prowler Hub and Prowler Documentation features work without authentication. An API key is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).
-To use Prowler Cloud or Prowler App (Self-Managed) features. To get the API key, please refer to the [API Keys](/user-guide/tutorials/prowler-app-api-keys) guide.
+An API key authenticates the Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server). To get the API key, please refer to the [API Keys](/user-guide/tutorials/prowler-app-api-keys) guide.
Keep the API key secure. Never share it publicly or commit it to version control.
@@ -18,12 +18,14 @@ Keep the API key secure. Never share it publicly or commit it to version control
## Step 2: Configure Your MCP Host/Client
-Choose the configuration based on your deployment:
+Most users should use the **Cloud MCP Server** — it needs no installation and is maintained by Prowler. The [Local MCP Server](#local-mcp-server-configuration) configuration is provided afterwards for users who run the server themselves.
-- **HTTP Mode**: Prowler Cloud MCP Server or self-hosted Prowler MCP Server.
-- **STDIO Mode**: Local installation only (runs as subprocess of your MCP client).
+- **Cloud MCP Server (HTTP)**: the managed server at `https://mcp.prowler.com/mcp` (or your own self-hosted HTTP server).
+- **Local MCP Server (STDIO)**: local installation only (runs as a subprocess of your MCP client).
-### HTTP Mode
+## Cloud MCP Server Configuration (Recommended)
+
+Connect to the **Cloud MCP Server** at `https://mcp.prowler.com/mcp` over HTTP. This is the recommended path — no installation, always up to date. The same configuration works for a self-hosted HTTP server: just swap the URL.
@@ -61,10 +63,10 @@ Choose the configuration based on your deployment:
"args": [
"https://mcp.prowler.com/mcp", // or your self-hosted Prowler MCP Server URL
"--header",
- "Authorization: Bearer ${PROWLER_APP_API_KEY}"
+ "Authorization: Bearer ${PROWLER_API_KEY}"
],
"env": {
- "PROWLER_APP_API_KEY": ""
+ "PROWLER_API_KEY": ""
}
}
}
@@ -96,10 +98,10 @@ Choose the configuration based on your deployment:
"args": [
"https://mcp.prowler.com/mcp",
"--header",
- "Authorization: Bearer ${PROWLER_APP_API_KEY}"
+ "Authorization: Bearer ${PROWLER_API_KEY}"
],
"env": {
- "PROWLER_APP_API_KEY": ""
+ "PROWLER_API_KEY": ""
}
}
}
@@ -110,8 +112,8 @@ Choose the configuration based on your deployment:
Run the following command:
```bash
- export PROWLER_APP_API_KEY=""
- claude mcp add --transport http prowler https://mcp.prowler.com/mcp --header "Authorization: Bearer $PROWLER_APP_API_KEY" --scope user
+ export PROWLER_API_KEY=""
+ claude mcp add --transport http prowler https://mcp.prowler.com/mcp --header "Authorization: Bearer $PROWLER_API_KEY" --scope user
```
@@ -137,9 +139,9 @@ Choose the configuration based on your deployment:
-### STDIO Mode
+## Local MCP Server Configuration
-STDIO mode is only available when running the MCP server locally.
+STDIO mode is only available when running the **Local MCP Server** on your own machine. See the [Installation guide](/getting-started/installation/prowler-mcp) to set it up first.
@@ -152,7 +154,7 @@ STDIO mode is only available when running the MCP server locally.
"command": "uvx",
"args": ["/absolute/path/to/prowler/mcp_server/"],
"env": {
- "PROWLER_APP_API_KEY": "",
+ "PROWLER_API_KEY": "",
"API_BASE_URL": "https://api.prowler.com/api/v1"
}
}
@@ -179,7 +181,7 @@ STDIO mode is only available when running the MCP server locally.
"--rm",
"-i",
"--env",
- "PROWLER_APP_API_KEY=",
+ "PROWLER_API_KEY=",
"--env",
"API_BASE_URL=https://api.prowler.com/api/v1",
"prowlercloud/prowler-mcp"
@@ -205,7 +207,7 @@ Restart your MCP client and start asking questions:
## Authentication Methods
-Prowler MCP Server supports two authentication methods to connect to Prowler Cloud or Prowler App (Self-Managed):
+Prowler MCP Server supports two authentication methods to connect to Prowler (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server):
### API Key (Recommended)
diff --git a/docs/getting-started/installation/prowler-app.mdx b/docs/getting-started/installation/prowler-app.mdx
index 598b2ac44a..1994b8ad0f 100644
--- a/docs/getting-started/installation/prowler-app.mdx
+++ b/docs/getting-started/installation/prowler-app.mdx
@@ -4,9 +4,9 @@ title: "Installation"
### Installation
-Prowler App offers flexible installation methods tailored to various environments.
+Prowler Local Server offers flexible installation methods tailored to various environments.
-Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detailed usage instructions.
+Refer to the [Prowler Cloud guide](/user-guide/tutorials/prowler-app) for detailed usage instructions.
Prowler configuration is based on `.env` files. Every version of Prowler can have differences on that file, so, please, use the file that corresponds with that version or repository branch or tag.
@@ -109,17 +109,17 @@ Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detai
pnpm start
```
- > Enjoy Prowler App at http://localhost:3000 by signing up with your email and password.
+ > Enjoy Prowler Local Server at http://localhost:3000 by signing up with your email and password.
- Google and GitHub authentication is only available in [Prowler Cloud](https://prowler.com).
+ Google and GitHub authentication works out of the box in [Prowler Cloud](https://prowler.com). In Prowler Local Server it requires OAuth credentials: see [Social Login Configuration](/user-guide/tutorials/prowler-app-social-login).
-### Updating Prowler App
+### Updating Prowler Local Server
-Upgrade Prowler App installation using one of two options:
+Upgrade Prowler Local Server installation using one of two options:
#### Option 1: Updating the Environment File
@@ -128,12 +128,12 @@ To update the environment file:
Edit the `.env` file and change version values:
```env
-PROWLER_UI_VERSION="5.31.0"
-PROWLER_API_VERSION="5.31.0"
+PROWLER_UI_VERSION="5.35.0"
+PROWLER_API_VERSION="5.35.0"
```
- You can find the latest versions of Prowler App in the [Releases Github section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation.
+ You can find the latest versions of Prowler Local Server in the [Releases Github section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation.
@@ -172,7 +172,7 @@ docker compose up -d
### Container Versions
-The available versions of Prowler App are the following:
+The available versions of Prowler Local Server are the following:
- `latest`: in sync with `master` branch (please note that it is not a stable version)
- `v4-latest`: in sync with `v4` branch (please note that it is not a stable version)
@@ -184,6 +184,6 @@ The available versions of Prowler App are the following:
The container images are available here:
-- Prowler App:
+- Prowler Local Server:
- [DockerHub - Prowler UI](https://hub.docker.com/r/prowlercloud/prowler-ui/tags)
- [DockerHub - Prowler API](https://hub.docker.com/r/prowlercloud/prowler-api/tags)
diff --git a/docs/getting-started/installation/prowler-mcp.mdx b/docs/getting-started/installation/prowler-mcp.mdx
index 06f204da6a..5be469b5b2 100644
--- a/docs/getting-started/installation/prowler-mcp.mdx
+++ b/docs/getting-started/installation/prowler-mcp.mdx
@@ -5,12 +5,12 @@ title: "Installation"
There are **two ways** to use Prowler MCP Server:
-
+
**No installation required** - Just configuration
Use `https://mcp.prowler.com/mcp`
-
+
**Local installation** - Full control
Install via Docker, PyPI, or source code
@@ -18,8 +18,8 @@ There are **two ways** to use Prowler MCP Server:
-For "Option 1: Managed by Prowler", go directly to the [Configuration Guide](/getting-started/basic-usage/prowler-mcp#hosted-server-configuration-recommended) to set up your Claude Desktop, Cursor, or other MCP client.
-**This guide is focused on local installation, "Option 2: Run Locally"**.
+For the Cloud MCP Server, go directly to the [Configuration Guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended) to set up your Claude Desktop, Cursor, or other MCP client.
+**This guide is focused on local installation, the Local MCP Server**.
## Installation Methods
@@ -51,7 +51,7 @@ Choose one of the following installation methods:
```bash
docker run --rm -i \
- -e PROWLER_APP_API_KEY="pk_your_api_key" \
+ -e PROWLER_API_KEY="pk_your_api_key" \
-e API_BASE_URL="https://api.prowler.com/api/v1" \
prowlercloud/prowler-mcp
```
@@ -143,7 +143,7 @@ Choose one of the following installation methods:
## Updating Prowler MCP Server
-When running Prowler MCP Server locally ("Option 2: Run Locally"), upgrade to the latest version using the same method chosen for installation. The hosted server (`https://mcp.prowler.com/mcp`) is always kept up to date by Prowler and requires no action.
+When running the Local MCP Server, upgrade to the latest version using the same method chosen for installation. The Cloud MCP Server (`https://mcp.prowler.com/mcp`) is always kept up to date by Prowler and requires no action.
@@ -219,19 +219,19 @@ Configure the server using environment variables:
| Variable | Description | Required | Default |
|----------|-------------|----------|---------|
-| `PROWLER_APP_API_KEY` | Prowler API key | Only for STDIO mode | - |
+| `PROWLER_API_KEY` | Prowler API key | Only for STDIO mode | - |
| `API_BASE_URL` | Custom Prowler API endpoint | No | `https://api.prowler.com/api/v1` |
| `PROWLER_MCP_TRANSPORT_MODE` | Default transport mode (overwritten by `--transport` argument) | No | `stdio` |
```bash macOS/Linux
-export PROWLER_APP_API_KEY="pk_your_api_key_here"
+export PROWLER_API_KEY="pk_your_api_key_here"
export API_BASE_URL="https://api.prowler.com/api/v1"
export PROWLER_MCP_TRANSPORT_MODE="http"
```
```bash Windows PowerShell
-$env:PROWLER_APP_API_KEY="pk_your_api_key_here"
+$env:PROWLER_API_KEY="pk_your_api_key_here"
$env:API_BASE_URL="https://api.prowler.com/api/v1"
$env:PROWLER_MCP_TRANSPORT_MODE="http"
```
@@ -246,7 +246,7 @@ Never commit your API key to version control. Use environment variables or secur
For convenience, create a `.env` file in the `mcp_server` directory:
```bash .env
-PROWLER_APP_API_KEY=pk_your_api_key_here
+PROWLER_API_KEY=pk_your_api_key_here
API_BASE_URL=https://api.prowler.com/api/v1
PROWLER_MCP_TRANSPORT_MODE=stdio
```
diff --git a/docs/getting-started/products/index.mdx b/docs/getting-started/products/index.mdx
new file mode 100644
index 0000000000..c14ea37471
--- /dev/null
+++ b/docs/getting-started/products/index.mdx
@@ -0,0 +1,52 @@
+---
+title: 'Prowler Product Families'
+description: 'Official names for Prowler Open Source projects and Prowler Products, including former product names.'
+boost: 2
+---
+
+Prowler ships two product families: Prowler Products, operated or licensed by the Prowler team, and Open Source projects, free to run and extend. This page is the reference for every official name. If a page or blog post uses a former name, the [Former Names](#former-names) table maps it to the current one.
+
+
+Read the [public announcement of the Prowler product families](https://prowler-workspace.slack.com/archives/C03JUQVM33L/p1784120677833319) in our Slack community.
+
+
+## Prowler Products
+
+| Name | Description |
+|------|-------------|
+| [Prowler Cloud](/getting-started/products/prowler-cloud) | Managed cloud security platform operated by the Prowler team. See [pricing](https://prowler.com/pricing). |
+| Prowler Private Cloud | Prowler Cloud deployed in your own environment. Formerly Prowler Enterprise. See [pricing](https://prowler.com/pricing). |
+| [Prowler Hub](https://hub.prowler.com) | Free public library of versioned checks, cloud service artifacts, and compliance frameworks. |
+| [Prowler Lighthouse AI](/getting-started/products/prowler-cloud-lighthouse) | AI security analyst capabilities within Prowler Cloud and Prowler Private Cloud. |
+| [Prowler MCP](/getting-started/products/prowler-mcp) | MCP server that connects AI assistants and agents to Prowler, including IDE plugins such as [Prowler for Claude Code](/getting-started/products/prowler-claude-code-plugin). |
+
+{/* Unreleased products. Uncomment these rows in the Prowler Products table when announced:
+| Prowler Registry | Distribution service for Prowler content such as checks and compliance frameworks. Free and paid tiers. |
+| Prowler Local Registry | Prowler Registry running in your own environment. Paid. |
+*/}
+
+
+Throughout this documentation, the green cloud icon in the sidebar marks sections and pages for capabilities that require a Prowler Cloud or Prowler Private Cloud [subscription](https://prowler.com/pricing).
+
+
+Products without a documentation page here are available through the Prowler team. [Contact us](https://prowler.com/contact) for details.
+
+## Open Source Projects
+
+| Name | Description |
+|------|-------------|
+| [Prowler CLI](/getting-started/products/prowler-cli) | Command line tool to run security scans across all supported providers. |
+| [Prowler Local Server](/getting-started/products/prowler-app) | Self-hosted web application and API to run scans, visualize findings, and manage cloud providers. Formerly Prowler App. |
+| [Prowler Local Dashboard](/user-guide/cli/tutorials/dashboard) | Local web dashboard to visualize scan results from Prowler CLI CSV outputs. Shipped with Prowler CLI. |
+| [Prowler SDK](/getting-started/products/prowler-sdk) | Python library that powers Prowler CLI and Prowler Local Server. Part of the [prowler repository](https://github.com/prowler-cloud/prowler). |
+
+## Former Names
+
+| Former name | Current name |
+|-------------|--------------|
+| Prowler App | [Prowler Local Server](/getting-started/products/prowler-app) |
+| Prowler Enterprise | Prowler Private Cloud |
+
+## Prowler for MSPs and MSSPs
+
+Prowler partners with managed service providers (MSPs) and managed security service providers (MSSPs) that operate Prowler for their customers. Visit [partners.prowler.com](https://partners.prowler.com) to become a partner.
diff --git a/docs/getting-started/products/prowler-app.mdx b/docs/getting-started/products/prowler-app.mdx
index 2df6015d06..76af591ba0 100644
--- a/docs/getting-started/products/prowler-app.mdx
+++ b/docs/getting-started/products/prowler-app.mdx
@@ -2,16 +2,16 @@
title: 'Overview'
---
-Prowler App is a web application that simplifies running Prowler. It provides:
+Prowler Local Server is a self-hosted web application that simplifies running Prowler. It provides:
- **User-friendly interface** for configuring and executing scans
- Dashboard to **view results** and manage **security findings**
-
+
## Components
-Prowler App consists of four main components:
+Prowler Local Server consists of four main components:
- **Prowler UI**: User-friendly web interface for running Prowler and viewing results, powered by Next.js
- **Prowler API**: Backend API that executes Prowler scans and stores results, built with Django REST Framework
@@ -26,4 +26,42 @@ Supporting infrastructure includes:
- **Valkey**: In-memory database serving as message broker for Celery workers
- **Neo4j**: Graph database used by the Attack Paths feature to combine cloud inventory with Prowler findings (currently populated by AWS scans)
-
+```mermaid
+flowchart TB
+ user([User / Security Team])
+ cli([Prowler CLI])
+
+ subgraph APP["Prowler Local Server"]
+ ui["Prowler UI (Next.js)"]
+ api["Prowler API (Django REST Framework)"]
+ worker["API Worker (Celery)"]
+ beat["API Scheduler (Celery Beat)"]
+ mcp["Prowler MCP Server (Lighthouse AI tools)"]
+ end
+
+ sdk["Prowler SDK (Python)"]
+
+ subgraph DATA["Data Layer"]
+ pg[("PostgreSQL")]
+ valkey[("Valkey / Redis")]
+ neo4j[("Neo4j")]
+ end
+
+ providers["Providers"]
+
+ user --> ui
+ user --> cli
+ ui -->|REST| api
+ ui -->|MCP HTTP| mcp
+ mcp -->|REST| api
+ api --> pg
+ api --> valkey
+ beat -->|enqueue jobs| valkey
+ valkey -->|dispatch| worker
+ worker --> pg
+ worker -->|Attack Paths| neo4j
+ worker -->|invokes| sdk
+ cli --> sdk
+
+ sdk --> providers
+```
diff --git a/docs/getting-started/products/prowler-claude-code-plugin.mdx b/docs/getting-started/products/prowler-claude-code-plugin.mdx
index e3c11ec810..99c92a1488 100644
--- a/docs/getting-started/products/prowler-claude-code-plugin.mdx
+++ b/docs/getting-started/products/prowler-claude-code-plugin.mdx
@@ -1,5 +1,6 @@
---
title: 'Prowler for Claude Code'
+sidebarTitle: 'Claude Code'
---
End-to-end cloud security and compliance from inside [Claude Code](https://www.claude.com/product/claude-code), powered by the [Prowler MCP server](/getting-started/products/prowler-mcp). The plugin lets Claude walk a Prowler Cloud-connected account through a compliance assessment and remediate findings until the chosen security or industry framework is compliant.
diff --git a/docs/getting-started/products/prowler-cli.mdx b/docs/getting-started/products/prowler-cli.mdx
index ac4f37c291..fa75e0456e 100644
--- a/docs/getting-started/products/prowler-cli.mdx
+++ b/docs/getting-started/products/prowler-cli.mdx
@@ -9,12 +9,12 @@ prowler
```
-## Prowler Dashboard
+## Prowler Local Dashboard
```console
prowler dashboard
```
-
+
Prowler includes hundreds of security controls aligned with widely recognized industry frameworks and standards, including:
diff --git a/docs/getting-started/products/prowler-cloud-lighthouse.mdx b/docs/getting-started/products/prowler-cloud-lighthouse.mdx
new file mode 100644
index 0000000000..d32118d468
--- /dev/null
+++ b/docs/getting-started/products/prowler-cloud-lighthouse.mdx
@@ -0,0 +1,154 @@
+---
+title: 'Overview'
+---
+
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+Prowler Cloud runs an enhanced version of Lighthouse AI in Open Source repository, the Agentic Cloud Defender that helps teams understand, prioritize, and remediate security findings across cloud environments.
+
+
+
+
+
+## What's New
+
+The Agentic Cloud Defender does more than answer questions, it helps teams **find and remediate what actually matters**, cutting through the noise to focus on the risk that counts. Prowler Cloud sharpens Lighthouse AI with the following improvements over the open-source version:
+
+
+
+ Conversations are saved and can be revisited or resumed at any time.
+
+
+ An upgraded default model delivers stronger reasoning and tool calling.
+
+
+ Switch between the standard interface and a chat-first agentic view.
+
+
+ Open Lighthouse AI as a side panel from any page to get help in context.
+
+
+ Credentials are validated automatically when a provider is configured.
+
+
+
+## Chat View
+
+Lighthouse AI is no longer a separate section in the left navigation. Prowler Cloud now offers two application views: a normal view for browsing dashboards, findings, and configuration, and an agentic chat view, powered by Lighthouse AI, for conversational, multi-step security analysis. Conversations are saved automatically, so earlier sessions can be reopened and resumed at any time.
+
+Promoting the chat to a top-level view gives Lighthouse AI the room it needs for a fully agentic workflow and makes the Agentic Cloud Defender a primary way to work in Prowler Cloud.
+
+
+
+### Side Panel
+
+You do not have to switch to the full chat view to reach Lighthouse AI. A side panel is available on every page of Prowler Cloud. While collapsed it stays out of the way; open it from any dashboard, findings list, or configuration screen to ask questions without leaving what you are working on. Open it using the Lighthouse AI button, circled in red in the image below.
+
+
+
+Once open, the panel slides in alongside your current page and shares the same agent, tools, and persistent chat sessions as the full Chat View, so a conversation started in the panel can be reopened and continued later from either place.
+
+
+
+- **Available everywhere:** Summon the assistant from any page while you keep working in the normal view.
+- **Context-aware help:** Ask about the findings, resources, or compliance data you are currently looking at.
+- **Continuous sessions:** Conversations opened in the side panel are saved alongside the rest of your chat history.
+
+### Tool Usage
+
+Lighthouse AI on Prowler Cloud renders the agent's work as it happens, so responses are easier to follow and to trust. Tool calls and reasoning steps appear in the order they occur within the conversation.
+
+- **Ordered steps:** Tool calls and reasoning are shown in sequence, reflecting how the agent reached its answer.
+- **Tool visibility:** The data tools invoked to retrieve findings and other Prowler information are displayed as the agent uses them.
+- **Thought process:** The agent's reasoning is presented alongside its actions, and can be expanded to review the full chain of steps.
+
+
+
+## Configuration
+
+Configure Lighthouse AI on Prowler Cloud from **Configuration** → **Lighthouse AI**:
+
+1. Click the desired provider (OpenAI, Amazon Bedrock, or OpenAI Compatible).
+2. Enter the required credentials.
+3. Click **Save**. The connection is validated automatically before the provider becomes available.
+
+
+
+### Business Context
+
+At the top of the configuration page, the optional **Business Context** field lets teams add environment priorities, compliance requirements, and ownership details, so responses align with organizational needs.
+
+Lighthouse AI on Prowler Cloud supports OpenAI, Amazon Bedrock, and OpenAI-compatible providers, with GPT-5.5 as the default. For per-provider setup and how to switch the default provider or model, see [Using Multiple LLM Providers](/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm).
+
+## Capabilities
+
+Lighthouse AI works through the [Prowler MCP Server](/getting-started/products/prowler-mcp), which gives the agent a growing catalog of tools to explore and act on your security data. These actions run inside Prowler and never modify your cloud resources. Everything the agent can do maps to one of the following capability areas.
+
+### Findings and Finding Groups
+
+- Search and filter security findings across every connected provider by severity, status, region, service, check, date range, and muted state.
+- Retrieve full finding details, including remediation guidance, check metadata, and affected resources.
+- Summarize findings with aggregate statistics and trends.
+- Browse finding groups aggregated by check and drill down into the specific resources each group affects.
+
+### Resources
+
+- List and filter cloud resources by provider, region, service, resource type, and tags.
+- Inspect a resource's configuration, metadata, and related findings.
+- Review the timeline of cloud API actions performed on a resource (AWS CloudTrail), including who did what and when.
+- Get an aggregate overview of the resources Prowler has discovered.
+
+### Compliance
+
+- Review high-level compliance status across all frameworks, with pass/fail statistics per framework.
+- Get a requirement-level breakdown for a specific framework, including failed requirements and their associated findings.
+
+### Attack Paths
+
+- List Attack Paths scans and discover the queries available for each completed scan.
+- Run graph-based queries to reveal privilege-escalation chains and exploitable misconfigurations.
+- Retrieve the Cartography graph schema to build accurate custom queries.
+
+### Scans and Providers
+
+- List, inspect, and rename security scans across providers.
+- Trigger manual scans and schedule automated daily scans for continuous monitoring.
+- Search connected providers and check their connection status, connect new providers, or remove existing ones.
+
+### Muting
+
+- Manage the mutelist for pattern-based bulk muting.
+- Create, update, list, and delete finding-specific mute rules, each with a documented reason and audit trail.
+
+### Security Check Catalog and Documentation
+
+- Browse and search the Prowler Hub catalog of security checks and compliance frameworks, including check code and automated fixers.
+- Search and retrieve official Prowler documentation to answer how-to and product questions.
+
+For the complete list of underlying tools, see the [Prowler MCP Tools Reference](/getting-started/basic-usage/prowler-mcp-tools).
+
+## FAQ
+
+**Which LLM providers are supported?**
+
+OpenAI (GPT models, including the default GPT-5.5), Amazon Bedrock (Claude, Llama, Titan, and others), and any OpenAI-compatible service such as OpenRouter.
+
+**Can Lighthouse AI change my cloud environment?**
+
+No. Lighthouse AI cannot modify the resources in your connected cloud providers (AWS, Azure, GCP, and others). It has read-only access to that environment and no tools to change it, even when the connected cloud credentials would allow it.
+
+**Can Lighthouse AI change my Prowler Cloud environment?**
+
+Yes. Lighthouse AI can take action within Prowler Cloud itself, such as connecting or removing providers, triggering and scheduling scans, and managing mute rules and the mutelist. See [Capabilities](#capabilities) for the full list of what it can do. These actions only affect your Prowler Cloud workspace, never the resources in your cloud providers.
+
+## Looking for the Open Source Version?
+
+Lighthouse AI is also available in the open-source Prowler Local Server. For its capabilities, FAQs, and limitations, see the open-source documentation.
+
+
+ Capabilities, FAQs, and limitations for Lighthouse AI in the open-source Prowler Local Server
+
+
+## Getting Help
+
+For issues or suggestions with Lighthouse AI on Prowler Cloud, request support at [support.prowler.com](https://support.prowler.com) or [reach out through our Slack channel](https://goto.prowler.com/slack).
diff --git a/docs/getting-started/products/prowler-lighthouse-ai.mdx b/docs/getting-started/products/prowler-lighthouse-ai.mdx
index 4e2eed8538..6cb6edf502 100644
--- a/docs/getting-started/products/prowler-lighthouse-ai.mdx
+++ b/docs/getting-started/products/prowler-lighthouse-ai.mdx
@@ -8,11 +8,16 @@ import { VersionBadge } from "/snippets/version-badge.mdx"
Prowler Lighthouse AI is a Cloud Security Analyst chatbot that helps you understand, prioritize, and remediate security findings in your cloud environments. It's designed to provide security expertise for teams without dedicated resources, acting as your 24/7 virtual cloud security analyst.
-
+
-
- Learn how to configure Lighthouse AI with your preferred LLM provider
-
+
+
+ Discover the enhanced Cloud experience: persistent chat sessions, GPT-5.5 by default, a dedicated agentic view, and transparent reasoning
+
+
+ Learn how to configure Lighthouse AI with your preferred LLM provider
+
+
## Capabilities
@@ -26,7 +31,7 @@ Ask questions in plain English about your security findings. Examples:
- "Show me all S3 buckets with public access."
- "What security issues were found in my production accounts?"
-
+
### Detailed Remediation Guidance
@@ -36,7 +41,7 @@ Get tailored step-by-step instructions for fixing security issues:
- Commands or console steps to implement fixes
- Alternative approaches with different solutions
-
+
### Enhanced Context and Analysis
@@ -46,9 +51,9 @@ Lighthouse AI can provide additional context to help you understand the findings
- Provide risk assessments based on your environment and context
- Connect related findings to show broader security patterns
-
+
-
+
## Important Notes
diff --git a/docs/getting-started/products/prowler-mcp.mdx b/docs/getting-started/products/prowler-mcp.mdx
index 762b088326..93159b2e7d 100644
--- a/docs/getting-started/products/prowler-mcp.mdx
+++ b/docs/getting-started/products/prowler-mcp.mdx
@@ -8,6 +8,31 @@ title: "Overview"
**Preview Feature**: This MCP server is currently under active development. Features and functionality may change. We welcome your feedback—please report any issues on [GitHub](https://github.com/prowler-cloud/prowler/issues) or join our [Slack community](https://goto.prowler.com/slack) to discuss and share your thoughts.
+## Quickest Way to Connect: Cloud MCP Server
+
+The fastest way to get started is the **Cloud MCP Server** at `https://mcp.prowler.com/mcp` — no installation, always up to date, and maintained by Prowler. Just point your MCP client at the URL and authenticate with a [Prowler API key](/user-guide/tutorials/prowler-app-api-keys) as a Bearer token:
+
+```json
+{
+ "mcpServers": {
+ "prowler": {
+ "url": "https://mcp.prowler.com/mcp",
+ "headers": {
+ "Authorization": "Bearer "
+ }
+ }
+ }
+}
+```
+
+
+ Step-by-step setup for Claude Desktop, Claude Code, Cursor, and other clients.
+
+
+
+Prefer to run it yourself? The **Local MCP Server** runs on your own machine or infrastructure. The Cloud MCP Server additionally provides tools for Prowler Cloud-specific features such as [Alerts](/user-guide/tutorials/prowler-alerts), [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling), and [Findings Triage](/user-guide/tutorials/prowler-app-findings-triage). See [Cloud vs Local MCP Server](#cloud-vs-local-mcp-server).
+
+
## What is the Model Context Protocol?
The [Model Context Protocol (MCP)](https://modelcontextprotocol.io) is an open standard developed by Anthropic that enables AI assistants to securely connect to external data sources and tools. It functions as a universal adapter enabling AI assistants to interact with various services through a standardized interface.
@@ -16,9 +41,9 @@ The [Model Context Protocol (MCP)](https://modelcontextprotocol.io) is an open s
The Prowler MCP Server provides three main integration points:
-### 1. Prowler Cloud and Prowler App (Self-Managed)
+### 1. Prowler Cloud, Private Cloud & Local Server
-Full access to Prowler Cloud platform and self-managed Prowler App for:
+Full access to your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server — for:
- **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments
- **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.)
- **Scan Orchestration**: Trigger on-demand scans and schedule recurring security assessments
@@ -29,7 +54,7 @@ Full access to Prowler Cloud platform and self-managed Prowler App for:
### 2. Prowler Hub
Access to Prowler's comprehensive security knowledge base:
-- **Security Checks Catalog**: Browse and search **over 1000 security checks** across multiple cloud providers.
+- **Security Checks Catalog**: Browse and search **over 2,000 security checks** across multiple cloud providers.
- **Check Implementation**: View the Python code that powers each security check.
- **Automated Fixers**: Access remediation scripts for common security issues.
- **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks**.
@@ -44,12 +69,53 @@ Search and retrieve official Prowler documentation:
## MCP Server Architecture
-The following diagram illustrates the Prowler MCP Server architecture and its integration points:
+The following diagram illustrates the Prowler MCP Server architecture and its integration points. MCP clients connect to either the **Cloud MCP Server** (recommended) or a **Local MCP Server**; both expose the same tools and reach the same Prowler backends:
-
+```mermaid
+flowchart LR
+ subgraph HOSTS["MCP Clients"]
+ chat["Chat Interfaces (Claude Desktop, LobeChat)"]
+ ide["IDEs and Code Editors (Claude Code, Cursor)"]
+ apps["Other AI Applications (5ire, custom agents)"]
+ end
+
+ subgraph SERVERS["Prowler MCP Server"]
+ direction TB
+ cloud["☁️ Cloud MCP Server (Recommended) mcp.prowler.com/mcp · HTTP Managed by Prowler · always up to date Adds Cloud-only tools (Alerts, Scan Scheduling, Findings Triage)"]
+ local["💻 Local MCP Server Self-run · STDIO or HTTP Python 3.12+ or Docker You manage updates"]
+ end
+
+ subgraph TOOLS["Prowler MCP Tools"]
+ prowler_tools["prowler_* tools (API key or JWT auth) Findings · Providers · Scans Resources · Muting · Compliance Attack Paths"]
+ hub_tools["prowler_hub_* tools (no auth) Checks Catalog · Check Code Fixers · Compliance Frameworks"]
+ docs_tools["prowler_docs_* tools (no auth) Search · Document Retrieval"]
+ end
+
+ api["Prowler API (REST) Cloud · Private Cloud · Local Server"]
+ hub["hub.prowler.com (REST)"]
+ docs["docs.prowler.com (Mintlify)"]
+
+ chat -->|HTTP| cloud
+ ide -->|HTTP| cloud
+ apps -->|HTTP| cloud
+ chat -->|STDIO or HTTP| local
+ ide -->|STDIO or HTTP| local
+ apps -->|STDIO or HTTP| local
+
+ cloud --> prowler_tools
+ cloud --> hub_tools
+ cloud --> docs_tools
+ local --> prowler_tools
+ local --> hub_tools
+ local --> docs_tools
+
+ prowler_tools -->|REST| api
+ hub_tools -->|REST| hub
+ docs_tools -->|REST| docs
+```
The architecture shows how AI assistants connect through the MCP protocol to access Prowler's three main components:
-- Prowler Cloud/App for security operations
+- Prowler Cloud, Prowler Private Cloud, or Prowler Local Server for security operations
- Prowler Hub for security knowledge
- Prowler Documentation for guidance and reference.
@@ -88,8 +154,8 @@ REQUIREMENTS:
DATA TO FETCH:
Use these MCP tools in this order:
-1. Prowler app list providers - To get all available configured provider in the account
-2. Prowler app get latest findings - To get findings information, if there are so many you can use the filter_fields to get less information, or pagination to get in different batches
+1. Prowler list providers - To get all available configured provider in the account
+2. Prowler get latest findings - To get findings information, if there are so many you can use the filter_fields to get less information, or pagination to get in different batches
3. For most critical findings you can get more context and remediation with Prowler Hub to get remediations for example
DESIGN REQUIREMENTS:
@@ -126,65 +192,48 @@ Generate the complete HTML file and display it
>
-## Deployment Options
+## Cloud vs Local MCP Server
-Prowler MCP Server can be used in three ways:
+There are two ways to run the Prowler MCP Server. For almost everyone, the **Cloud MCP Server** is the right choice — it needs no installation and is maintained by Prowler. The **Local MCP Server** exists for users who need to run it on their own machine or infrastructure.
-### 1. Prowler Cloud MCP Server
+| | ☁️ **Cloud MCP Server** (Recommended) | 💻 **Local MCP Server** |
+|---|---|---|
+| **Endpoint** | `https://mcp.prowler.com/mcp` | Runs on your machine or infrastructure |
+| **Setup** | Just configure your MCP client | Install via Docker, or source |
+| **Transport** | HTTP | STDIO (subprocess) or self-hosted HTTP |
+| **Maintenance** | Managed by Prowler, always up to date | You manage updates |
+| **Requirements** | None (just an MCP client) | Python 3.12+ or Docker |
+| **Cloud-only tools** | ✅ Alerts, Scan Scheduling, Findings Triage | ❌ Not available |
+| **Authentication** | API key or JWT token | API key/JWT (HTTP) or env vars (STDIO) |
-**Use Prowler's managed MCP server at `https://mcp.prowler.com/mcp`**
+### ☁️ Cloud MCP Server (Recommended)
-- No installation required.
-- Managed and maintained by Prowler team.
-- Authentication to Prowler Cloud or Prowler App (self-managed) via API key or JWT token.
+Prowler's managed MCP server at `https://mcp.prowler.com/mcp`. No installation, always up to date, and it includes tools for Prowler Cloud-specific features such as Alerts, Scan Scheduling, and Findings Triage. This is the path we recommend for nearly all users — go straight to the [Configuration guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended).
-### 2. Local STDIO Mode
+### 💻 Local MCP Server
-**Run the server locally on your machine**
+Run the server yourself when you need full control over the deployment. It connects to Prowler Cloud, Prowler Private Cloud, or Prowler Local Server and can run in two modes:
-- Runs as a subprocess of your MCP client.
-- Possibility to connect to a self-hosted Prowler App (e.g. self-hosted Prowler App).
-- Authentication to Prowler Cloud or Prowler App (self-managed) via environment variables.
-- Requires Python 3.12+ or Docker.
+- **STDIO mode** — the server runs as a subprocess of your MCP client. Authentication via environment variables.
+- **Self-hosted HTTP mode** — deploy your own remote HTTP server. Authentication via API key or JWT token.
-### 3. Self-Hosted HTTP Mode
-
-**Deploy your own remote MCP server**
-
-- Full control over deployment.
-- Possibility to connect to a self-hosted Prowler App (e.g. self-hosted Prowler App).
-- Authentication to Prowler App (self-managed) via API key or JWT token.
-- Requires Python 3.12+ or Docker.
-
-## Requirements
-
-Requirements vary based on deployment option:
-
-**For Prowler Cloud MCP Server:**
-- Prowler Cloud account and API key (only for Prowler Cloud/App features)
-
-**For self-hosted STDIO/HTTP Mode:**
-- Python 3.12+ or Docker
-- Network access to:
- - `https://hub.prowler.com` (for Prowler Hub)
- - `https://docs.prowler.com` (for Prowler Documentation)
- - Prowler Cloud API or self-hosted Prowler App API (for Prowler Cloud/App features)
+Both require Python 3.12+ or Docker, plus network access to `https://hub.prowler.com` (Prowler Hub), `https://docs.prowler.com` (Prowler Documentation), and the Prowler API or Prowler Local Server API (Prowler features). See the [Installation guide](/getting-started/installation/prowler-mcp) to get started.
-**No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication in both deployment options. A Prowler API key is only required to access Prowler Cloud or Prowler App (Self-Managed) features.
+**No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication on both the Cloud and Local MCP Server. A Prowler API key is only required to access Prowler features (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).
## Next Steps
-
- Install the Prowler MCP Server using uv or Docker
-
- Configure your MCP client to connect to the server
+ Connect your MCP client to the Cloud MCP Server
+
+
+ Explore all available tools and capabilities
-
- Explore all available tools and capabilities
+
+ Run the Local MCP Server yourself using Docker, source, or uvx
diff --git a/docs/getting-started/products/prowler-sdk.mdx b/docs/getting-started/products/prowler-sdk.mdx
new file mode 100644
index 0000000000..b19f576e12
--- /dev/null
+++ b/docs/getting-started/products/prowler-sdk.mdx
@@ -0,0 +1,11 @@
+---
+title: 'Prowler SDK'
+---
+
+Prowler SDK is the Python library that powers Prowler CLI and Prowler Local Server. It implements the providers, services, and security checks that every Prowler product runs.
+
+To use or extend Prowler SDK, start with the Developer Guide:
+
+
+ Providers, services, checks, and testing: everything needed to work with Prowler SDK.
+
diff --git a/docs/images/compliance/prowler-app-cross-provider-detail.png b/docs/images/compliance/prowler-app-cross-provider-detail.png
new file mode 100644
index 0000000000..8ee82562e2
Binary files /dev/null and b/docs/images/compliance/prowler-app-cross-provider-detail.png differ
diff --git a/docs/images/compliance/prowler-app-cross-provider-overview.png b/docs/images/compliance/prowler-app-cross-provider-overview.png
new file mode 100644
index 0000000000..d818da1b80
Binary files /dev/null and b/docs/images/compliance/prowler-app-cross-provider-overview.png differ
diff --git a/docs/images/compliance/prowler-app-cross-provider-report.png b/docs/images/compliance/prowler-app-cross-provider-report.png
new file mode 100644
index 0000000000..e3b45ef74e
Binary files /dev/null and b/docs/images/compliance/prowler-app-cross-provider-report.png differ
diff --git a/docs/images/compliance/prowler-app-cross-provider-requirements-accordion.png b/docs/images/compliance/prowler-app-cross-provider-requirements-accordion.png
new file mode 100644
index 0000000000..cd87e3ee35
Binary files /dev/null and b/docs/images/compliance/prowler-app-cross-provider-requirements-accordion.png differ
diff --git a/docs/images/compliance/prowler-app-cross-provider-tab.png b/docs/images/compliance/prowler-app-cross-provider-tab.png
new file mode 100644
index 0000000000..b3aa8ed2b5
Binary files /dev/null and b/docs/images/compliance/prowler-app-cross-provider-tab.png differ
diff --git a/docs/images/icons/cloud-bold.svg b/docs/images/icons/cloud-bold.svg
new file mode 100644
index 0000000000..623bb36c11
--- /dev/null
+++ b/docs/images/icons/cloud-bold.svg
@@ -0,0 +1 @@
+
diff --git a/docs/images/lighthouse-architecture.mmd b/docs/images/lighthouse-architecture.mmd
index 47407544e9..6798801fb8 100644
--- a/docs/images/lighthouse-architecture.mmd
+++ b/docs/images/lighthouse-architecture.mmd
@@ -15,7 +15,7 @@ flowchart TB
llm["LLM Provider (OpenAI / Bedrock / OpenAI-compatible)"]
subgraph MCP["Prowler MCP Server"]
- app_tools["prowler_app_* tools (auth required)"]
+ app_tools["prowler_* tools (auth required)"]
hub_tools["prowler_hub_* tools (no auth)"]
docs_tools["prowler_docs_* tools (no auth)"]
end
@@ -29,7 +29,7 @@ flowchart TB
agent <-->|LLM API| llm
agent --> metatools
metatools --> mcpclient
- mcpclient -->|MCP HTTP · Bearer token for prowler_app_* only| app_tools
+ mcpclient -->|MCP HTTP · Bearer token for prowler_* only| app_tools
mcpclient -->|MCP HTTP| hub_tools
mcpclient -->|MCP HTTP| docs_tools
app_tools -->|REST| api
diff --git a/docs/images/organizations/authentication-details.png b/docs/images/organizations/authentication-details.png
index 2b4ae782cf..aec5060afd 100644
Binary files a/docs/images/organizations/authentication-details.png and b/docs/images/organizations/authentication-details.png differ
diff --git a/docs/images/organizations/onboarding-flow.svg b/docs/images/organizations/onboarding-flow.svg
index f6e11fc0a3..b5ba7858a0 100644
--- a/docs/images/organizations/onboarding-flow.svg
+++ b/docs/images/organizations/onboarding-flow.svg
@@ -3,41 +3,37 @@
+
+
+ Onboarding Flow
-
+ 1
- Create Management
- Account Role
-
- Quick Create or Manual
- Allows Prowler to
- discover your org
- structure
+ Start the Wizard
+
+ In Prowler Cloud
+ Enter your Org ID
+ and OU/root target
-
-
-
-
- 2
- Deploy StackSet
-
- In AWS Console
- Creates ProwlerScan
- role in every
- member account
+ Deploy the Roles
+
+ Single CF Stack
+ Management role +
+ StackSet to members
+ in one CF stack
@@ -46,11 +42,11 @@
3
- Run the Wizard
-
- In Prowler Cloud
- Discovers accounts,
- tests connections
+ Discover & Connect
+
+ In Prowler Cloud
+ Discovers accounts,
+ tests connections
@@ -59,13 +55,13 @@
4
- Launch Scans
-
- Automatic
- Scans run on all
- connected accounts
- on your schedule
+ Launch Scans
+
+ Automatic
+ Scans run on all
+ connected accounts
+ on your schedule
- Steps 1 and 2 are done once in AWS | Steps 3 and 4 are done in Prowler Cloud
+ Step 2 runs once in AWS | Steps 1, 3 and 4 are in Prowler Cloud
diff --git a/docs/images/organizations/two-roles-architecture.svg b/docs/images/organizations/two-roles-architecture.svg
index c67588b049..f8c40d5b21 100644
--- a/docs/images/organizations/two-roles-architecture.svg
+++ b/docs/images/organizations/two-roles-architecture.svg
@@ -47,7 +47,7 @@
- Deploy: Quick Create link or Manual
+ Deploy: single stack or standalone
@@ -86,7 +86,7 @@
- Deploy: via CloudFormation StackSet
+ Deploy: StackSet (single stack)Prowler discovers
diff --git a/docs/images/products/prowler-app-architecture.mmd b/docs/images/products/prowler-app-architecture.mmd
index 0c13d580c3..da99d0ab96 100644
--- a/docs/images/products/prowler-app-architecture.mmd
+++ b/docs/images/products/prowler-app-architecture.mmd
@@ -1,8 +1,10 @@
+%% Source of truth for the architecture diagram.
+%% Inlined as native mermaid blocks in the root README.md and in docs/getting-started/products/prowler-app.mdx: keep all copies in sync.
flowchart TB
user([User / Security Team])
cli([Prowler CLI])
- subgraph APP["Prowler App"]
+ subgraph APP["Prowler Local Server"]
ui["Prowler UI (Next.js)"]
api["Prowler API (Django REST Framework)"]
worker["API Worker (Celery)"]
diff --git a/docs/images/prowler-app/attack-paths/execute-query.png b/docs/images/prowler-app/attack-paths/execute-query.png
index 3872f0de2f..683c7c5bd3 100644
Binary files a/docs/images/prowler-app/attack-paths/execute-query.png and b/docs/images/prowler-app/attack-paths/execute-query.png differ
diff --git a/docs/images/prowler-app/attack-paths/fullscreen-mode.png b/docs/images/prowler-app/attack-paths/fullscreen-mode.png
index c5156925ba..190d973638 100644
Binary files a/docs/images/prowler-app/attack-paths/fullscreen-mode.png and b/docs/images/prowler-app/attack-paths/fullscreen-mode.png differ
diff --git a/docs/images/prowler-app/attack-paths/graph-filtered.png b/docs/images/prowler-app/attack-paths/graph-filtered.png
index 3ff4822a26..3eddf04473 100644
Binary files a/docs/images/prowler-app/attack-paths/graph-filtered.png and b/docs/images/prowler-app/attack-paths/graph-filtered.png differ
diff --git a/docs/images/prowler-app/attack-paths/graph-visualization.png b/docs/images/prowler-app/attack-paths/graph-visualization.png
index 2ea160a6b2..d7f2a747eb 100644
Binary files a/docs/images/prowler-app/attack-paths/graph-visualization.png and b/docs/images/prowler-app/attack-paths/graph-visualization.png differ
diff --git a/docs/images/prowler-app/attack-paths/navigation.png b/docs/images/prowler-app/attack-paths/navigation.png
index d133c7f6b4..0526e05e5c 100644
Binary files a/docs/images/prowler-app/attack-paths/navigation.png and b/docs/images/prowler-app/attack-paths/navigation.png differ
diff --git a/docs/images/prowler-app/attack-paths/node-details.png b/docs/images/prowler-app/attack-paths/node-details.png
index 9343eedd7d..8b02128604 100644
Binary files a/docs/images/prowler-app/attack-paths/node-details.png and b/docs/images/prowler-app/attack-paths/node-details.png differ
diff --git a/docs/images/prowler-app/attack-paths/query-parameters.png b/docs/images/prowler-app/attack-paths/query-parameters.png
index 9f44f81838..683c7c5bd3 100644
Binary files a/docs/images/prowler-app/attack-paths/query-parameters.png and b/docs/images/prowler-app/attack-paths/query-parameters.png differ
diff --git a/docs/images/prowler-app/attack-paths/query-selector.png b/docs/images/prowler-app/attack-paths/query-selector.png
index d8b7414156..828183fdbf 100644
Binary files a/docs/images/prowler-app/attack-paths/query-selector.png and b/docs/images/prowler-app/attack-paths/query-selector.png differ
diff --git a/docs/images/prowler-app/attack-paths/scan-list-table.png b/docs/images/prowler-app/attack-paths/scan-list-table.png
index 092b539dd0..45d0af41dc 100644
Binary files a/docs/images/prowler-app/attack-paths/scan-list-table.png and b/docs/images/prowler-app/attack-paths/scan-list-table.png differ
diff --git a/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png b/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png
new file mode 100644
index 0000000000..9d7926997d
Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-note-modal.png differ
diff --git a/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png b/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png
new file mode 100644
index 0000000000..7fb7790610
Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-status-dropdown.png differ
diff --git a/docs/images/prowler-app/findings-triage/findings-triage-table.png b/docs/images/prowler-app/findings-triage/findings-triage-table.png
new file mode 100644
index 0000000000..c8fa79e379
Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-table.png differ
diff --git a/docs/images/prowler-app/lighthouse-config.png b/docs/images/prowler-app/lighthouse/oss/config.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-config.png
rename to docs/images/prowler-app/lighthouse/oss/config.png
diff --git a/docs/images/prowler-app/lighthouse-configuration.png b/docs/images/prowler-app/lighthouse/oss/configuration.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-configuration.png
rename to docs/images/prowler-app/lighthouse/oss/configuration.png
diff --git a/docs/images/prowler-app/lighthouse-feature1.png b/docs/images/prowler-app/lighthouse/oss/feature1.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-feature1.png
rename to docs/images/prowler-app/lighthouse/oss/feature1.png
diff --git a/docs/images/prowler-app/lighthouse-feature2.png b/docs/images/prowler-app/lighthouse/oss/feature2.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-feature2.png
rename to docs/images/prowler-app/lighthouse/oss/feature2.png
diff --git a/docs/images/prowler-app/lighthouse-feature3.png b/docs/images/prowler-app/lighthouse/oss/feature3.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-feature3.png
rename to docs/images/prowler-app/lighthouse/oss/feature3.png
diff --git a/docs/images/prowler-app/lighthouse-intro.png b/docs/images/prowler-app/lighthouse/oss/intro.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-intro.png
rename to docs/images/prowler-app/lighthouse/oss/intro.png
diff --git a/docs/images/prowler-app/lighthouse-set-default-provider.png b/docs/images/prowler-app/lighthouse/oss/set-default-provider.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-set-default-provider.png
rename to docs/images/prowler-app/lighthouse/oss/set-default-provider.png
diff --git a/docs/images/prowler-app/lighthouse-switch-models.png b/docs/images/prowler-app/lighthouse/oss/switch-models.png
similarity index 100%
rename from docs/images/prowler-app/lighthouse-switch-models.png
rename to docs/images/prowler-app/lighthouse/oss/switch-models.png
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/chat-animation.gif b/docs/images/prowler-app/lighthouse/prowler-cloud/chat-animation.gif
new file mode 100644
index 0000000000..c2e69c4816
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/chat-animation.gif differ
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/config-page.png b/docs/images/prowler-app/lighthouse/prowler-cloud/config-page.png
new file mode 100644
index 0000000000..ad1b812e03
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/config-page.png differ
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/main-chat-page.png b/docs/images/prowler-app/lighthouse/prowler-cloud/main-chat-page.png
new file mode 100644
index 0000000000..7a83637285
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/main-chat-page.png differ
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-closed.png b/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-closed.png
new file mode 100644
index 0000000000..c36da34a95
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-closed.png differ
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-open.png b/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-open.png
new file mode 100644
index 0000000000..fd10f5a00b
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/side-panel-open.png differ
diff --git a/docs/images/prowler-app/lighthouse/prowler-cloud/tool-usage.png b/docs/images/prowler-app/lighthouse/prowler-cloud/tool-usage.png
new file mode 100644
index 0000000000..ae637b3ff3
Binary files /dev/null and b/docs/images/prowler-app/lighthouse/prowler-cloud/tool-usage.png differ
diff --git a/docs/images/prowler-app/rbac/provider_group.png b/docs/images/prowler-app/rbac/provider_group.png
index 878306e02f..8698cc9c41 100644
Binary files a/docs/images/prowler-app/rbac/provider_group.png and b/docs/images/prowler-app/rbac/provider_group.png differ
diff --git a/docs/images/prowler-app/rbac/provider_group_edit.png b/docs/images/prowler-app/rbac/provider_group_edit.png
index 5de9649578..3d37b329b7 100644
Binary files a/docs/images/prowler-app/rbac/provider_group_edit.png and b/docs/images/prowler-app/rbac/provider_group_edit.png differ
diff --git a/docs/images/prowler-app/rbac/provider_group_edit_1.png b/docs/images/prowler-app/rbac/provider_group_edit_1.png
index ed4a090eed..4369983a20 100644
Binary files a/docs/images/prowler-app/rbac/provider_group_edit_1.png and b/docs/images/prowler-app/rbac/provider_group_edit_1.png differ
diff --git a/docs/images/prowler-app/rbac/provider_group_remove.png b/docs/images/prowler-app/rbac/provider_group_remove.png
index 580a8533cf..f504617159 100644
Binary files a/docs/images/prowler-app/rbac/provider_group_remove.png and b/docs/images/prowler-app/rbac/provider_group_remove.png differ
diff --git a/docs/images/prowler-app/rbac/role_create_1.png b/docs/images/prowler-app/rbac/role_create_1.png
index a96b0ac9ef..b88fe990db 100644
Binary files a/docs/images/prowler-app/rbac/role_create_1.png and b/docs/images/prowler-app/rbac/role_create_1.png differ
diff --git a/docs/images/prowler-app/scan-scheduling/edit-scan-schedule.png b/docs/images/prowler-app/scan-scheduling/edit-scan-schedule.png
new file mode 100644
index 0000000000..e76809b810
Binary files /dev/null and b/docs/images/prowler-app/scan-scheduling/edit-scan-schedule.png differ
diff --git a/docs/images/prowler-app/scan-scheduling/launch-scan-schedule.png b/docs/images/prowler-app/scan-scheduling/launch-scan-schedule.png
new file mode 100644
index 0000000000..980b16bf7f
Binary files /dev/null and b/docs/images/prowler-app/scan-scheduling/launch-scan-schedule.png differ
diff --git a/docs/images/prowler-app/scan-scheduling/providers-scan-schedule.png b/docs/images/prowler-app/scan-scheduling/providers-scan-schedule.png
new file mode 100644
index 0000000000..a7dab3310c
Binary files /dev/null and b/docs/images/prowler-app/scan-scheduling/providers-scan-schedule.png differ
diff --git a/docs/images/prowler-app/scan-scheduling/scheduled-scans-tab.png b/docs/images/prowler-app/scan-scheduling/scheduled-scans-tab.png
new file mode 100644
index 0000000000..26b4b160ec
Binary files /dev/null and b/docs/images/prowler-app/scan-scheduling/scheduled-scans-tab.png differ
diff --git a/docs/images/prowler_mcp_schema.mmd b/docs/images/prowler_mcp_schema.mmd
index 96973546f6..2b8508cd18 100644
--- a/docs/images/prowler_mcp_schema.mmd
+++ b/docs/images/prowler_mcp_schema.mmd
@@ -1,29 +1,40 @@
flowchart LR
- subgraph HOSTS["MCP Hosts"]
+ subgraph HOSTS["MCP Clients"]
chat["Chat Interfaces (Claude Desktop, LobeChat)"]
ide["IDEs and Code Editors (Claude Code, Cursor)"]
apps["Other AI Applications (5ire, custom agents)"]
end
- subgraph MCP["Prowler MCP Server"]
- app_tools["prowler_app_* tools (JWT or API key auth) Findings · Providers · Scans Resources · Muting · Compliance Attack Paths"]
+ subgraph SERVERS["Prowler MCP Server"]
+ direction TB
+ cloud["☁️ Cloud MCP Server (Recommended) mcp.prowler.com/mcp · HTTP Managed by Prowler · always up to date Adds Cloud-only tools (Alerts, Scan Scheduling, Findings Triage)"]
+ local["💻 Local MCP Server Self-run · STDIO or HTTP Python 3.12+ or Docker You manage updates"]
+ end
+
+ subgraph TOOLS["Prowler MCP Tools"]
+ prowler_tools["prowler_* tools (API key or JWT auth) Findings · Providers · Scans Resources · Muting · Compliance Attack Paths"]
hub_tools["prowler_hub_* tools (no auth) Checks Catalog · Check Code Fixers · Compliance Frameworks"]
docs_tools["prowler_docs_* tools (no auth) Search · Document Retrieval"]
end
- api["Prowler API (REST)"]
+ api["Prowler API (REST) Cloud · Private Cloud · Local Server"]
hub["hub.prowler.com (REST)"]
docs["docs.prowler.com (Mintlify)"]
- chat -->|STDIO or HTTP| app_tools
- chat -->|STDIO or HTTP| hub_tools
- chat -->|STDIO or HTTP| docs_tools
- ide -->|STDIO or HTTP| app_tools
- ide -->|STDIO or HTTP| hub_tools
- ide -->|STDIO or HTTP| docs_tools
- apps -->|STDIO or HTTP| app_tools
- apps -->|STDIO or HTTP| hub_tools
- apps -->|STDIO or HTTP| docs_tools
- app_tools -->|REST| api
+ chat -->|HTTP| cloud
+ ide -->|HTTP| cloud
+ apps -->|HTTP| cloud
+ chat -->|STDIO or HTTP| local
+ ide -->|STDIO or HTTP| local
+ apps -->|STDIO or HTTP| local
+
+ cloud --> prowler_tools
+ cloud --> hub_tools
+ cloud --> docs_tools
+ local --> prowler_tools
+ local --> hub_tools
+ local --> docs_tools
+
+ prowler_tools -->|REST| api
hub_tools -->|REST| hub
docs_tools -->|REST| docs
diff --git a/docs/images/prowler_mcp_schema.png b/docs/images/prowler_mcp_schema.png
deleted file mode 100644
index 8a8884fa5e..0000000000
Binary files a/docs/images/prowler_mcp_schema.png and /dev/null differ
diff --git a/docs/introduction.mdx b/docs/introduction.mdx
index 51a27eb555..9307fa351a 100644
--- a/docs/introduction.mdx
+++ b/docs/introduction.mdx
@@ -1,21 +1,36 @@
# What is Prowler?
-**Prowler** is the world’s most widely used open-source cloud security platform that **automates security and compliance** across any cloud environment. With hundreds of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler delivers AI-driven, customizable, and easy-to-use monitoring and integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
+**Prowler** is the world’s most widely used open-source cloud security platform that **automates security and compliance** across any cloud environment. With thousands of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler delivers AI-driven, customizable, and easy-to-use monitoring and integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
+Prowler ships two product families: Prowler Products, operated or licensed by the Prowler team, and Open Source projects, free to run and extend. See [Prowler product families](/getting-started/products) for every official name, including former names.
+
+### Prowler Products
+
-
- Command Line Interface
-
-
- Web Application
-
-
- A managed service built on top of Prowler App.
+
+ Managed cloud security platform operated by the Prowler team.
- A public library of versioned checks, cloud service artifacts, and compliance frameworks.
+ Free public library of versioned checks, cloud service artifacts, and compliance frameworks.
+
+
+ MCP server that connects AI assistants and agents to Prowler.
+
+
+ Prowler Private Cloud, Prowler Lighthouse AI, and more.
+
+
+
+### Open Source
+
+
+
+ Command line tool to run security scans across all supported providers.
+
+
+ Self-hosted web application and API.
@@ -31,6 +46,7 @@ Prowler supports a wide range of providers organized by category:
| [AWS](/user-guide/providers/aws/getting-started-aws) | Official | Accounts | UI, API, CLI |
| [Azure](/user-guide/providers/azure/getting-started-azure) | Official | Subscriptions | UI, API, CLI |
| [Cloudflare](/user-guide/providers/cloudflare/getting-started-cloudflare) | Official | Accounts | UI, API, CLI |
+| [E2E Networks](/user-guide/providers/e2enetworks/getting-started-e2enetworks) | [Contact us](https://prowler.com/contact) | Projects | CLI |
| [Google Cloud](/user-guide/providers/gcp/getting-started-gcp) | Official | Projects | UI, API, CLI |
| [Linode](/user-guide/providers/linode/getting-started-linode) | [Contact us](https://prowler.com/contact) | Accounts | CLI |
| **NHN** | [Contact us](https://prowler.com/contact) | Tenants | CLI |
@@ -69,7 +85,7 @@ Prowler supports a wide range of providers organized by category:
| ------------------------------------------------------------------- | -------- | -------------------- | --------- |
| [Image](/user-guide/providers/image/getting-started-image) | Official | Container Images / Registries | CLI, API |
-### Custom Providers (Prowler Cloud Enterprise Only)
+### Custom Providers (Prowler Private Cloud Only)
| Provider | Support | Audit Scope/Entities | Interface |
| -------------------- | -------- | -------------------- | --------- |
diff --git a/docs/scripts/generate_provider_cards.py b/docs/scripts/generate_provider_cards.py
new file mode 100644
index 0000000000..1b35755507
--- /dev/null
+++ b/docs/scripts/generate_provider_cards.py
@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+"""Generate docs/snippets/provider-cards.mdx from provider getting-started pages.
+
+Scans docs/user-guide/providers//getting-started-*.mdx, keeps only the
+providers that Prowler Cloud and Prowler Local Server actually support (source of truth: the
+`ProviderChoices` enum in api/src/backend/api/models.py — CLI-only providers
+such as Linode/LLM/Scaleway/StackIT are excluded), reads the frontmatter
+`title`, derives a display name, and emits a snippet exporting a
+`ProviderCards` component. Wired into pre-commit so the snippet stays in sync
+whenever a provider page or the API enum changes.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PROVIDERS_DIR = REPO_ROOT / "docs" / "user-guide" / "providers"
+SNIPPET_PATH = REPO_ROOT / "docs" / "snippets" / "provider-cards.mdx"
+API_MODELS_PATH = REPO_ROOT / "api" / "src" / "backend" / "api" / "models.py"
+
+# Docs folder names that don't match the API enum key. Keep tiny — only rename
+# entries when the docs folder disagrees with the API-side identifier.
+DOCS_DIR_TO_API_KEY = {
+ "microsoft365": "m365",
+ "oci": "oraclecloud",
+}
+
+# Folder-name → Mintlify icon override. Providers not listed fall back to
+# DEFAULT_ICON. Add an entry only when the default looks wrong for a provider.
+ICON_OVERRIDES = {
+ "alibabacloud": "cloud",
+ "aws": "aws",
+ "azure": "microsoft",
+ "cloudflare": "cloudflare",
+ "gcp": "google",
+ "github": "github",
+ "googleworkspace": "users",
+ "iac": "code",
+ "image": "docker",
+ "kubernetes": "dharmachakra",
+ "microsoft365": "briefcase",
+ "mongodbatlas": "leaf",
+ "oci": "database",
+ "okta": "key",
+ "openstack": "cubes",
+ "vercel": "triangle",
+}
+DEFAULT_ICON = "cloud"
+
+TITLE_RE = re.compile(r"^\s*title\s*:\s*['\"](?P.+?)['\"]\s*$", re.MULTILINE)
+NAME_CLEANUP_RE = re.compile(
+ r"^Getting Started [Ww]ith (?:the )?(?P<name>.+?)(?: on Prowler)?(?: Provider)?$"
+)
+
+
+def app_supported_provider_keys() -> set[str]:
+ """Return the set of provider keys declared in the API's ProviderChoices enum.
+
+ Uses ast rather than regex so formatting changes, decorators, comments, or
+ multi-line values in the enum body don't silently drop or invent providers.
+ """
+ tree = ast.parse(API_MODELS_PATH.read_text(encoding="utf-8"))
+ for node in ast.walk(tree):
+ if not (isinstance(node, ast.ClassDef) and node.name == "ProviderChoices"):
+ continue
+ keys: set[str] = set()
+ for item in node.body:
+ if not isinstance(item, ast.Assign):
+ continue
+ value = item.value
+ # Django TextChoices members look like: NAME = "key", _("Label")
+ # which parses as an ast.Tuple whose first element is the key.
+ if isinstance(value, ast.Tuple) and value.elts:
+ first = value.elts[0]
+ if isinstance(first, ast.Constant) and isinstance(first.value, str):
+ keys.add(first.value)
+ return keys
+ raise RuntimeError(
+ f"Could not locate ProviderChoices class in {API_MODELS_PATH.relative_to(REPO_ROOT)}"
+ )
+
+
+def extract_title(mdx_path: Path) -> str:
+ text = mdx_path.read_text(encoding="utf-8")
+ match = TITLE_RE.search(text)
+ if not match:
+ raise ValueError(f"No frontmatter title in {mdx_path}")
+ return match.group("title")
+
+
+def display_name(title: str) -> str:
+ match = NAME_CLEANUP_RE.match(title)
+ return match.group("name") if match else title
+
+
+def collect_providers() -> list[dict]:
+ supported = app_supported_provider_keys()
+ providers = []
+ for provider_dir in sorted(PROVIDERS_DIR.iterdir()):
+ if not provider_dir.is_dir():
+ continue
+ api_key = DOCS_DIR_TO_API_KEY.get(provider_dir.name, provider_dir.name)
+ if api_key not in supported:
+ continue
+ pages = sorted(provider_dir.glob("getting-started-*.mdx"))
+ if not pages:
+ continue
+ page = pages[0]
+ name = display_name(extract_title(page))
+ href = f"/user-guide/providers/{provider_dir.name}/{page.stem}"
+ icon = ICON_OVERRIDES.get(provider_dir.name, DEFAULT_ICON)
+ providers.append({"name": name, "href": href, "icon": icon})
+ providers.sort(key=lambda p: p["name"].lower())
+ return providers
+
+
+def render_snippet(providers: list[dict]) -> str:
+ cards = "\n".join(
+ f' <Card title="{p["name"]}" icon="{p["icon"]}" href="{p["href"]}" />'
+ for p in providers
+ )
+ return (
+ "{/* AUTO-GENERATED by docs/scripts/generate_provider_cards.py — do not edit by hand. */}\n"
+ "{/* Regenerated on pre-commit whenever any provider getting-started page changes. */}\n"
+ "\n"
+ "export const ProviderCards = () => (\n"
+ " <Columns cols={3}>\n"
+ f"{cards}\n"
+ " </Columns>\n"
+ ");\n"
+ )
+
+
+def main() -> int:
+ providers = collect_providers()
+ if not providers:
+ print("No provider getting-started pages found", file=sys.stderr)
+ return 1
+ new_content = render_snippet(providers)
+ current = SNIPPET_PATH.read_text(encoding="utf-8") if SNIPPET_PATH.exists() else ""
+ if new_content == current:
+ return 0
+ SNIPPET_PATH.write_text(new_content, encoding="utf-8")
+ print(
+ f"Regenerated {SNIPPET_PATH.relative_to(REPO_ROOT)} ({len(providers)} providers)"
+ )
+ return 1 # signal pre-commit that the file changed
+
+
+if __name__ == "__main__":
+ sys.exit(main())
diff --git a/docs/security/index.mdx b/docs/security/index.mdx
index 30364d5b82..45b39d608b 100644
--- a/docs/security/index.mdx
+++ b/docs/security/index.mdx
@@ -27,7 +27,7 @@ All Prowler code goes through the same security pipeline, whether running on Pro
| **Updates** | Automatic | Manual |
<Note>
-Self-Managed includes Prowler App and Prowler CLI. They can run anywhere — any cloud provider, any region, on-premises, or air-gapped environments. Full control over data residency and infrastructure decisions. See the [Prowler App Installation Guide](/getting-started/installation/prowler-app) to get started.
+Self-Managed includes Prowler Local Server and Prowler CLI. They can run anywhere — any cloud provider, any region, on-premises, or air-gapped environments. Full control over data residency and infrastructure decisions. See the [Prowler Local Server Installation Guide](/getting-started/installation/prowler-app) to get started.
</Note>
---
diff --git a/docs/security/networking.mdx b/docs/security/networking.mdx
index 767e6ac4bf..eb00c9a840 100644
--- a/docs/security/networking.mdx
+++ b/docs/security/networking.mdx
@@ -16,6 +16,18 @@ Resolve the egress IP via DNS:
dig egress.prowler.com +short
```
+<Note>
+The egress IP address is stable, but it is recommended to periodically verify it remains current by querying `egress.prowler.com`.
+</Note>
+
+## Use Cases
+
+Allowlisting Prowler Cloud's egress IP address enables:
+
+- **Credential Usage Control**: Restrict where cloud provider credentials can be used from across AWS, Azure, GCP, and other providers
+- **Kubernetes Security**: Limit inbound HTTPS traffic to clusters by allowing only Prowler Cloud's IP address
+- **Compliance Requirements**: Meet security policies requiring allowlisting of external services
+
## Contact
For questions about networking, visit the [Support page](/support).
diff --git a/docs/security/software-security.mdx b/docs/security/software-security.mdx
index 3fee8d1251..64c2645d3f 100644
--- a/docs/security/software-security.mdx
+++ b/docs/security/software-security.mdx
@@ -158,7 +158,7 @@ The MCP Server has a small direct-dependency surface and does not yet declare a
The UI uses [pnpm](https://pnpm.io) with supply-chain controls configured in [`ui/pnpm-workspace.yaml`](https://github.com/prowler-cloud/prowler/blob/master/ui/pnpm-workspace.yaml).
- **Minimum release age** (`minimumReleaseAge: 1440`): packages must publish at least 24 hours before install. This reduces exposure during the window when a compromised release has not yet been detected and yanked.
-- **Lifecycle script allow-list** (`strictDepBuilds: true` + `allowBuilds`): only explicitly approved packages may run `install` or `postinstall` scripts (currently `sharp`, `esbuild`, `@sentry/cli`, `@heroui/shared-utils`, `unrs-resolver`, `msw`). Any unlisted package with lifecycle scripts fails the install.
+- **Lifecycle script allow-list** (`strictDepBuilds: true` + `allowBuilds`): only explicitly approved packages may run `install` or `postinstall` scripts (currently `sharp`, `esbuild`, `@sentry/cli`, `unrs-resolver`, `msw`). Any unlisted package with lifecycle scripts fails the install.
- **Trust policy** (`trustPolicy: no-downgrade`): the install fails when a package's trust evidence drops, for example after a new publisher takes over.
- **Block exotic subdeps** (`blockExoticSubdeps: true`): transitive dependencies cannot ship as git URLs or tarballs. Every package in the tree resolves from the configured registry.
- **Transitive overrides** in [`ui/package.json`](https://github.com/prowler-cloud/prowler/blob/master/ui/package.json) force specific versions for transitive packages (`lodash`, `serialize-javascript`, `qs`, `rollup`, `minimatch`, `ajv`, and others).
diff --git a/docs/snippets/applies-to.mdx b/docs/snippets/applies-to.mdx
new file mode 100644
index 0000000000..0ce22af78d
--- /dev/null
+++ b/docs/snippets/applies-to.mdx
@@ -0,0 +1,14 @@
+export const AppliesTo = ({ products = ["Prowler Cloud", "Prowler Private Cloud", "Prowler Local Server"] }) => {
+ return (
+ <Info>
+ This guide applies to{" "}
+ {products.map((name, index) => (
+ <span key={name}>
+ {index > 0 && (index === products.length - 1 ? (products.length > 2 ? ", and " : " and ") : ", ")}
+ <b>{name}</b>
+ </span>
+ ))}
+ . See <a href="/getting-started/products">Prowler product families</a>.
+ </Info>
+ );
+};
diff --git a/docs/snippets/provider-cards.mdx b/docs/snippets/provider-cards.mdx
new file mode 100644
index 0000000000..f469616cde
--- /dev/null
+++ b/docs/snippets/provider-cards.mdx
@@ -0,0 +1,23 @@
+{/* AUTO-GENERATED by docs/scripts/generate_provider_cards.py — do not edit by hand. */}
+{/* Regenerated on pre-commit whenever any provider getting-started page changes. */}
+
+export const ProviderCards = () => (
+ <Columns cols={3}>
+ <Card title="Alibaba Cloud" icon="cloud" href="/user-guide/providers/alibabacloud/getting-started-alibabacloud" />
+ <Card title="AWS" icon="aws" href="/user-guide/providers/aws/getting-started-aws" />
+ <Card title="Azure" icon="microsoft" href="/user-guide/providers/azure/getting-started-azure" />
+ <Card title="Cloudflare" icon="cloudflare" href="/user-guide/providers/cloudflare/getting-started-cloudflare" />
+ <Card title="GCP" icon="google" href="/user-guide/providers/gcp/getting-started-gcp" />
+ <Card title="GitHub" icon="github" href="/user-guide/providers/github/getting-started-github" />
+ <Card title="Google Workspace" icon="users" href="/user-guide/providers/googleworkspace/getting-started-googleworkspace" />
+ <Card title="IaC" icon="code" href="/user-guide/providers/iac/getting-started-iac" />
+ <Card title="Image" icon="docker" href="/user-guide/providers/image/getting-started-image" />
+ <Card title="Kubernetes" icon="dharmachakra" href="/user-guide/providers/kubernetes/getting-started-k8s" />
+ <Card title="Microsoft 365" icon="briefcase" href="/user-guide/providers/microsoft365/getting-started-m365" />
+ <Card title="MongoDB Atlas" icon="leaf" href="/user-guide/providers/mongodbatlas/getting-started-mongodbatlas" />
+ <Card title="Okta" icon="key" href="/user-guide/providers/okta/getting-started-okta" />
+ <Card title="OpenStack" icon="cubes" href="/user-guide/providers/openstack/getting-started-openstack" />
+ <Card title="Oracle Cloud Infrastructure (OCI)" icon="database" href="/user-guide/providers/oci/getting-started-oci" />
+ <Card title="Vercel" icon="triangle" href="/user-guide/providers/vercel/getting-started-vercel" />
+ </Columns>
+);
diff --git a/docs/snippets/subscription-banner.mdx b/docs/snippets/subscription-banner.mdx
new file mode 100644
index 0000000000..90d9b651b5
--- /dev/null
+++ b/docs/snippets/subscription-banner.mdx
@@ -0,0 +1,8 @@
+export const SubscriptionBanner = ({ children, label = "feature" }) => {
+ return (
+ <Note>
+ This {label} is available exclusively in <b>Prowler Cloud</b> and <b>Prowler Private Cloud</b> with a <a href="https://prowler.com/pricing">subscription</a>.
+ {children}
+ </Note>
+ );
+};
diff --git a/docs/style.css b/docs/style.css
index 5c626fb06b..9a1ed19a0f 100644
--- a/docs/style.css
+++ b/docs/style.css
@@ -66,3 +66,59 @@
color: #000000;
border: none;
}
+
+/* Cloud marker: subscription-gated sections and pages (Prowler Cloud / Prowler Private Cloud).
+ Rendered as a trailing ::after glyph so sidebar labels stay left-aligned.
+ Nested groups render as li[data-title] with a button toggle; top-level groups
+ render as h3 headings. Every ungated group that shares a name with a gated one
+ (Providers, Prowler Cloud, Prowler Lighthouse AI) is top-level,
+ so plain li[data-title] selectors match only the gated nested groups, folded
+ or unfolded. The Security tab group is top-level (h3) and always expanded,
+ so it is selected through its sibling list content with :has().
+ Pages are selected by their li id, which equals the page URL. The strict
+ > div > div > span:first-child path targets the title span only, never the
+ nested spans of a tag pill such as Coming Soon.
+ Icon source: /images/icons/cloud-bold.svg. See AGENTS.md "Cloud Marker" convention. */
+li[data-title="Prowler Cloud"] > button span:first-child::after,
+li[data-title="Prowler Lighthouse AI"] > button span:first-child::after,
+li[data-title="Providers"] > button span:first-child::after,
+li[data-title="Scans"] > button span:first-child::after,
+li[data-title="Prowler MCP"] > button span:first-child::after,
+div:has(+ ul a[href="/security/encryption"]) h3 span::after,
+li[id="/user-guide/compliance/tutorials/cross-provider-compliance"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-alerts"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-app-findings-triage"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-app-scan-configuration"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-cloud-aws-organizations"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-cloud-azure-management-groups"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-cloud-gcp-organizations"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-import-findings"] a > div > div > span:first-child::after,
+li[id="/user-guide/tutorials/prowler-scan-scheduling"] a > div > div > span:first-child::after {
+ content: "";
+ display: inline-block;
+ width: 0.875rem;
+ height: 0.875rem;
+ margin-left: 0.375rem;
+ vertical-align: -0.125rem;
+ background: url("/images/icons/cloud-bold.svg") no-repeat center / contain;
+}
+/* Wider sidebar: +2rem over the theme default (18rem) so gated labels with the
+ cloud marker fit on one line. The content column offsets are coupled to the
+ sidebar width and must shift by the same amount, hence the two companion
+ overrides selected by their Tailwind arbitrary-value class substrings. */
+@media (min-width: 1024px) {
+ #sidebar {
+ width: 20rem !important;
+ }
+
+ div[class*="pl-[23.7rem]"] {
+ padding-left: 25.7rem !important;
+ }
+}
+
+@media (min-width: 1280px) {
+ div[class*="(100%-28rem)"] {
+ width: calc(100% - 30rem) !important;
+ }
+}
diff --git a/docs/support.mdx b/docs/support.mdx
index 6999d5efbf..07c9843e12 100644
--- a/docs/support.mdx
+++ b/docs/support.mdx
@@ -3,23 +3,25 @@ title: 'Support'
description: 'Get help with Prowler'
---
-## Lighthouse AI
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
-Lighthouse AI is a Cloud Security Analyst chatbot powered by [Prowler MCP](/getting-started/products/prowler-mcp), your 24/7 virtual cloud security analyst. It can:
+## Prowler Lighthouse AI
+
+Prowler Lighthouse AI is your 24/7 cloud security analyst chatbot, the agentic cloud defender. Powered by [Prowler MCP](/getting-started/products/prowler-mcp), it can:
- **Query your security data**: Findings, compliance status, resources, and remediation guidance
-- **Search Prowler Hub**: Over 1,000 security checks and 70+ compliance frameworks
+- **Search Prowler Hub**: Over 2,000 security checks and 70+ compliance frameworks
- **Access documentation**: Search and retrieve Prowler docs contextually
-Available in Prowler Cloud and Prowler App.
+Available in Prowler Cloud, Prowler Private Cloud, and Prowler Local Server.
-[Learn more about Lighthouse AI](/getting-started/products/prowler-lighthouse-ai)
+[Learn more about Prowler Lighthouse AI](/getting-started/products/prowler-cloud-lighthouse)
## Support Desk
-> Available to **Prowler Cloud** customers.
+<SubscriptionBanner label="service" />
-For Prowler Cloud customers, submit support requests through our support desk. We'll route your request to the right team and respond via email.
+Submit support requests through our support desk. We'll route your request to the right team and respond via email.
<Card title="Submit a request" icon="ticket" href="https://support.prowler.com">
Contact our support team
diff --git a/docs/troubleshooting.mdx b/docs/troubleshooting.mdx
index 3125d74ef5..9e0c849796 100644
--- a/docs/troubleshooting.mdx
+++ b/docs/troubleshooting.mdx
@@ -4,7 +4,9 @@ title: 'Troubleshooting'
import { VersionBadge } from "/snippets/version-badge.mdx"
-## Running `prowler` I get `[File: utils.py:15] [Module: utils] CRITICAL: path/redacted: OSError[13]`
+## Prowler CLI
+
+### Running `prowler` I get `[File: utils.py:15] [Module: utils] CRITICAL: path/redacted: OSError[13]`
That is an error related to file descriptors or opened files allowed by your operating system.
@@ -16,13 +18,15 @@ This error is also related with a lack of system requirements. To improve perfor
See section [Logging](/user-guide/cli/tutorials/logging) for further information or [contact us](/contact).
-## Common Issues with Docker Compose Installation
+## Prowler Local Server
+
+Common issues with the Docker Compose installation of Prowler Local Server.
### Problem adding AWS Provider using "Connect assuming IAM Role" in Docker
See [GitHub Issue #7745](https://github.com/prowler-cloud/prowler/issues/7745) for more details.
-When running Prowler App via Docker, you may encounter errors such as `Provider not set`, `AWS assume role error - Unable to locate credentials`, or `Provider has no secret` when trying to add an AWS Provider using the "Connect assuming IAM Role" option. This typically happens because the container does not have access to the necessary AWS credentials or profiles.
+When running Prowler Local Server via Docker, you may encounter errors such as `Provider not set`, `AWS assume role error - Unable to locate credentials`, or `Provider has no secret` when trying to add an AWS Provider using the "Connect assuming IAM Role" option. This typically happens because the container does not have access to the necessary AWS credentials or profiles.
**Workaround:**
@@ -53,7 +57,7 @@ AWS_PROFILE=prowler-profile
### Scans Complete but Reports Are Missing or Compliance Data Is Empty (`Too many open files` Error)
-When running Prowler App via Docker Compose, scans may complete successfully but reports are not available for download, compliance data shows as empty, or 404 errors appear when trying to access scan reports. Checking the `worker` container logs may reveal errors like `[Errno 24] Too many open files`.
+When running Prowler Local Server via Docker Compose, scans may complete successfully but reports are not available for download, compliance data shows as empty, or 404 errors appear when trying to access scan reports. Checking the `worker` container logs may reveal errors like `[Errno 24] Too many open files`.
This issue occurs because the default file descriptor limits in Docker containers are too low for Prowler's operations. The default `docker-compose.yml` already includes `ulimits` configuration with `nofile` set to `65536` for the `worker` and `worker-beat` services to prevent this issue.
@@ -87,7 +91,7 @@ docker compose up -d
<VersionBadge version="5.31.0" />
-When Prowler App runs self-hosted on a machine or Kubernetes node with many CPUs,
+When Prowler Local Server runs on a machine or Kubernetes node with many CPUs,
the Celery worker may create one prefork process per detected CPU if concurrency
is not configured explicitly. Each process loads the SDK runtime and cloud
provider clients, so idle memory can be high and worker containers can be
@@ -196,7 +200,7 @@ A fix addressing this permission issue is being evaluated in [PR #9953](https://
### Scan Stuck in Executing State After Worker Crash
-When running Prowler App via Docker Compose, a scan may remain indefinitely in the `executing` state if the worker process crashes (for example, due to an Out of Memory condition) before it can update the scan status. Since it is not currently possible to cancel a scan in `executing` state through the UI, the workaround is to manually update the scan record in the database.
+When running Prowler Local Server via Docker Compose, a scan may remain indefinitely in the `executing` state if the worker process crashes (for example, due to an Out of Memory condition) before it can update the scan status. Since it is not currently possible to cancel a scan in `executing` state through the UI, the workaround is to manually update the scan record in the database.
**Root Cause:**
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index 657549f8b0..e637ea9c9a 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -2,6 +2,8 @@
title: "Configuration File"
---
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
Several Prowler's checks have user configurable variables that can be modified in a common **configuration file**. This file can be found in the following [path](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml):
```
@@ -20,71 +22,181 @@ Numeric thresholds enforce hard limits. A value outside the accepted range is dr
The following list includes all the AWS checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|--------------------------------------------------|-----------------|
-| `acm_certificates_expiration_check` | `days_to_expire_threshold` | Integer |
-| `acmpca_certificate_authority_pqc_key_algorithm` | `acmpca_pqc_key_algorithms` | List of Strings |
-| `appstream_fleet_maximum_session_duration` | `max_session_duration_seconds` | Integer |
-| `appstream_fleet_session_disconnect_timeout` | `max_disconnect_timeout_in_seconds` | Integer |
-| `appstream_fleet_session_idle_disconnect_timeout` | `max_idle_disconnect_timeout_in_seconds` | Integer |
-| `autoscaling_find_secrets_ec2_launch_configuration` | `secrets_ignore_patterns` | List of Strings |
-| `awslambda_function_no_secrets_in_code` | `secrets_ignore_patterns` | List of Strings |
-| `awslambda_function_no_secrets_in_variables` | `secrets_ignore_patterns` | List of Strings |
-| `awslambda_function_using_supported_runtimes` | `obsolete_lambda_runtimes` | Integer |
-| `awslambda_function_vpc_is_in_multi_azs` | `lambda_min_azs` | Integer |
-| `cloudformation_stack_outputs_find_secrets` | `secrets_ignore_patterns` | List of Strings |
-| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_actions` | List of Strings |
-| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_entropy` | Integer |
-| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_minutes` | Integer |
-| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_actions` | List of Strings |
-| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_entropy` | Integer |
-| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_minutes` | Integer |
-| `cloudwatch_log_group_no_secrets_in_logs` | `secrets_ignore_patterns` | List of Strings |
-| `cloudwatch_log_group_retention_policy_specific_days_enabled` | `log_group_retention_days` | Integer |
-| `codebuild_github_allowed_organizations` | `github_allowed_organizations` | List of Strings |
-| `codebuild_project_no_secrets_in_variables` | `excluded_sensitive_environment_variables` | List of Strings |
-| `codebuild_project_no_secrets_in_variables` | `secrets_ignore_patterns` | List of Strings |
-| `config_recorder_all_regions_enabled` | `mute_non_default_regions` | Boolean |
-| `drs_job_exist` | `mute_non_default_regions` | Boolean |
-| `ec2_elastic_ip_shodan` | `shodan_api_key` | String |
-| `ec2_instance_older_than_specific_days` | `max_ec2_instance_age_in_days` | Integer |
-| `ec2_instance_secrets_user_data` | `secrets_ignore_patterns` | List of Strings |
-| `ec2_launch_template_no_secrets` | `secrets_ignore_patterns` | List of Strings |
-| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_instance_owners` | List of Strings |
-| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_interface_types` | List of Strings |
-| `ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports`| `ec2_high_risk_ports` | List of Integer |
-| `ec2_securitygroup_with_many_ingress_egress_rules` | `max_security_group_rules` | Integer |
-| `ecs_task_definitions_no_environment_secrets` | `secrets_ignore_patterns` | List of Strings |
-| `ecr_repositories_scan_vulnerabilities_in_latest_image` | `ecr_repository_vulnerability_minimum_severity` | String |
-| `eks_cluster_uses_a_supported_version` | `eks_cluster_oldest_version_supported` | String |
-| `eks_control_plane_logging_all_types_enabled` | `eks_required_log_types` | List of Strings |
-| `elasticache_redis_cluster_backup_enabled` | `minimum_snapshot_retention_period` | Integer |
-| `elb_is_in_multiple_az` | `elb_min_azs` | Integer |
-| `elbv2_is_in_multiple_az` | `elbv2_min_azs` | Integer |
-| `rolesanywhere_trust_anchor_pqc_pki` | `rolesanywhere_pqc_pca_key_algorithms` | List of Strings |
-| `cloudfront_distributions_pqc_tls_enabled` | `cloudfront_pqc_min_protocol_versions` | List of Strings |
-| `apigateway_domain_name_pqc_tls_enabled` | `apigateway_pqc_tls_allowed_policies` | List of Strings |
-| `guardduty_is_enabled` | `mute_non_default_regions` | Boolean |
-| `iam_user_access_not_stale_to_sagemaker` | `max_unused_sagemaker_access_days` | Integer |
-| `iam_user_accesskey_unused` | `max_unused_access_keys_days` | Integer |
-| `iam_user_console_access_unused` | `max_console_access_days` | Integer |
-| `organizations_delegated_administrators` | `organizations_trusted_delegated_administrators` | List of Strings |
-| `organizations_scp_check_deny_regions` | `organizations_enabled_regions` | List of Strings |
-| `rds_instance_backup_enabled` | `check_rds_instance_replicas` | Boolean |
-| `securityhub_enabled` | `mute_non_default_regions` | Boolean |
-| `secretsmanager_secret_unused` | `max_days_secret_unused` | Integer |
-| `secretsmanager_secret_rotated_periodically` | `max_days_secret_unrotated` | Integer |
-| `ssm_document_secrets` | `secrets_ignore_patterns` | List of Strings |
-| `trustedadvisor_premium_support_plan_subscribed` | `verify_premium_support_plans` | Boolean |
-| `transfer_server_pqc_ssh_kex_enabled` | `transfer_pqc_ssh_allowed_policies` | List of Strings |
-| `dynamodb_table_cross_account_access` | `trusted_account_ids` | List of Strings |
-| `eventbridge_bus_cross_account_access` | `trusted_account_ids` | List of Strings |
-| `eventbridge_schema_registry_cross_account_access` | `trusted_account_ids` | List of Strings |
-| `s3_bucket_cross_account_access` | `trusted_account_ids` | List of Strings |
-| `ssm_documents_set_as_public` | `trusted_account_ids` | List of Strings |
-| `vpc_endpoint_connections_trust_boundaries` | `trusted_account_ids` | List of Strings |
-| `vpc_endpoint_services_allowed_principals_trust_boundaries` | `trusted_account_ids` | List of Strings |
-| `opensearch_service_domains_not_publicly_accessible` | `trusted_ips` | List of Strings |
+| Check Name | Value | Type | Default |
+|------------------------------------------------------------------------|---------------------------------------------------|-----------------|--------------------------------------------------------------------------------------------------------------------------------------|
+| `accessanalyzer_enabled` | `mute_non_default_regions` | Boolean | `False` |
+| `acm_certificates_expiration_check` | `days_to_expire_threshold` | Integer | `7` |
+| `acm_certificates_with_secure_key_algorithms` | `insecure_key_algorithms` | List of Strings | `["RSA-1024", "P-192"]` |
+| `acmpca_certificate_authority_pqc_key_algorithm` | `acmpca_pqc_key_algorithms` | List of Strings | `["ML_DSA_44", "ML_DSA_65", "ML_DSA_87"]` |
+| `apigateway_domain_name_pqc_tls_enabled` | `apigateway_pqc_tls_allowed_policies` | List of Strings | `["SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09", "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09", "SecurityPolicy_TLS13_1_2_PQ_2025_09"]` |
+| `apigateway_restapi_no_secrets_in_stage_variables` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `appstream_fleet_maximum_session_duration` | `max_session_duration_seconds` | Integer | `36000` |
+| `appstream_fleet_session_disconnect_timeout` | `max_disconnect_timeout_in_seconds` | Integer | `300` |
+| `appstream_fleet_session_idle_disconnect_timeout` | `max_idle_disconnect_timeout_in_seconds` | Integer | `600` |
+| `autoscaling_find_secrets_ec2_launch_configuration` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `awslambda_function_no_secrets_in_code` | `secrets_ignore_files` | List of Strings | `[]` |
+| `awslambda_function_no_secrets_in_code` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `awslambda_function_no_secrets_in_variables` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `awslambda_function_using_supported_runtimes` | `obsolete_lambda_runtimes` | List of Strings | See `config.yaml` |
+| `awslambda_function_vpc_multi_az` | `lambda_min_azs` | Integer | `2` |
+| `cloudformation_stack_cdktoolkit_bootstrap_version` | `recommended_cdk_bootstrap_version` | Integer | `21` |
+| `cloudformation_stack_outputs_find_secrets` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `cloudfront_distributions_pqc_tls_enabled` | `cloudfront_pqc_min_protocol_versions` | List of Strings | `["TLSv1.3_2025"]` |
+| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_actions` | List of Strings | See `config.yaml` |
+| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_minutes` | Integer | `1440` |
+| `cloudtrail_threat_detection_enumeration` | `threat_detection_enumeration_threshold` | Float | `0.3` |
+| `cloudtrail_threat_detection_llm_jacking` | `threat_detection_llm_jacking_actions` | List of Strings | See `config.yaml` |
+| `cloudtrail_threat_detection_llm_jacking` | `threat_detection_llm_jacking_minutes` | Integer | `1440` |
+| `cloudtrail_threat_detection_llm_jacking` | `threat_detection_llm_jacking_threshold` | Float | `0.4` |
+| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_actions` | List of Strings | See `config.yaml` |
+| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_minutes` | Integer | `1440` |
+| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_threshold` | Float | `0.2` |
+| `cloudwatch_log_group_no_secrets_in_logs` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `cloudwatch_log_group_retention_policy_specific_days_enabled` | `log_group_retention_days` | Integer | `365` |
+| `codebuild_project_no_secrets_in_variables` | `excluded_sensitive_environment_variables` | List of Strings | `[]` |
+| `codebuild_project_no_secrets_in_variables` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `codebuild_project_uses_allowed_github_organizations` | `codebuild_github_allowed_organizations` | List of Strings | `[]` |
+| `config_delegated_admin_and_org_aggregator_all_regions` | `mute_non_default_regions` | Boolean | `False` |
+| `config_recorder_all_regions_enabled` | `mute_non_default_regions` | Boolean | `False` |
+| `documentdb_cluster_backup_enabled` | `minimum_backup_retention_period` | Integer | `7` |
+| `drs_job_exist` | `mute_non_default_regions` | Boolean | `False` |
+| `dynamodb_table_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
+| `ec2_elastic_ip_shodan` | `shodan_api_key` | String | `null` |
+| `ec2_instance_older_than_specific_days` | `max_ec2_instance_age_in_days` | Integer | `180` |
+| `ec2_instance_secrets_user_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `ec2_launch_template_no_secrets` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_instance_owners` | List of Strings | `["amazon-elb"]` |
+| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_interface_types` | List of Strings | `["api_gateway_managed", "vpc_endpoint"]` |
+| `ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports` | `ec2_high_risk_ports` | List of Integer | `[25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088]` |
+| `ec2_securitygroup_with_many_ingress_egress_rules` | `max_security_group_rules` | Integer | `50` |
+| `ecr_repositories_scan_vulnerabilities_in_latest_image` | `ecr_repository_vulnerability_minimum_severity` | String | `"MEDIUM"` |
+| `ecs_service_fargate_latest_platform_version` | `fargate_linux_latest_version` | String | `"1.4.0"` |
+| `ecs_service_fargate_latest_platform_version` | `fargate_windows_latest_version` | String | `"1.0.0"` |
+| `ecs_task_definitions_no_environment_secrets` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `eks_cluster_uses_a_supported_version` | `eks_cluster_oldest_version_supported` | String | `"1.28"` |
+| `eks_control_plane_logging_all_types_enabled` | `eks_required_log_types` | List of Strings | `["api", "audit", "authenticator", "controllerManager", "scheduler"]` |
+| `elasticache_redis_cluster_backup_enabled` | `minimum_snapshot_retention_period` | Integer | `7` |
+| `elb_is_in_multiple_az` | `elb_min_azs` | Integer | `2` |
+| `elbv2_is_in_multiple_az` | `elbv2_min_azs` | Integer | `2` |
+| `elbv2_listener_pqc_tls_enabled` | `elbv2_listener_pqc_tls_allowed_policies` | List of Strings | See `config.yaml` |
+| `eventbridge_bus_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
+| `eventbridge_schema_registry_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
+| `glue_etl_jobs_no_secrets_in_arguments` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `guardduty_delegated_admin_enabled_all_regions` | `mute_non_default_regions` | Boolean | `False` |
+| `guardduty_is_enabled` | `mute_non_default_regions` | Boolean | `False` |
+| `iam_role_access_not_stale_to_bedrock` | `max_unused_bedrock_access_days` | Integer | `60` |
+| `iam_user_access_not_stale_to_bedrock` | `max_unused_bedrock_access_days` | Integer | `60` |
+| `iam_user_access_not_stale_to_sagemaker` | `max_unused_sagemaker_access_days` | Integer | `90` |
+| `iam_user_accesskey_unused` | `max_unused_access_keys_days` | Integer | `45` |
+| `iam_user_console_access_unused` | `max_console_access_days` | Integer | `45` |
+| `kinesis_stream_data_retention_period` | `min_kinesis_stream_retention_hours` | Integer | `168` |
+| `neptune_cluster_backup_enabled` | `minimum_backup_retention_period` | Integer | `7` |
+| `opensearch_service_domains_not_publicly_accessible` | `trusted_ips` | List of Strings | `[]` |
+| `organizations_delegated_administrators` | `organizations_trusted_delegated_administrators` | List of Strings | `[]` |
+| `organizations_scp_check_deny_regions` | `organizations_enabled_regions` | List of Strings | `[]` |
+| `rds_instance_backup_enabled` | `check_rds_instance_replicas` | Boolean | `False` |
+| `rolesanywhere_trust_anchor_pqc_pki` | `rolesanywhere_pqc_pca_key_algorithms` | List of Strings | `["ML_DSA_44", "ML_DSA_65", "ML_DSA_87"]` |
+| `s3_bucket_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
+| `s3_bucket_object_public` | `s3_bucket_object_public_enabled` | Boolean | `False` |
+| `s3_bucket_object_public` | `s3_bucket_object_public_max_objects` | Integer | `100` |
+| `s3_bucket_object_public` | `s3_bucket_object_public_sample_size` | Integer | `3` |
+| `secretsmanager_has_restrictive_resource_policy` | `organizations_trusted_ids` | List of Strings | `[]` |
+| `secretsmanager_secret_rotated_periodically` | `max_days_secret_unrotated` | Integer | `90` |
+| `secretsmanager_secret_unused` | `max_days_secret_unused` | Integer | `90` |
+| `securityhub_delegated_admin_enabled_all_regions` | `mute_non_default_regions` | Boolean | `False` |
+| `securityhub_enabled` | `mute_non_default_regions` | Boolean | `False` |
+| `ssm_document_secrets` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `ssm_documents_set_as_public` | `trusted_account_ids` | List of Strings | `[]` |
+| `stepfunctions_statemachine_no_secrets_in_definition` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `transfer_server_pqc_ssh_kex_enabled` | `transfer_pqc_ssh_allowed_policies` | List of Strings | `["TransferSecurityPolicy-2025-03", "TransferSecurityPolicy-FIPS-2025-03", "TransferSecurityPolicy-AS2Restricted-2025-07"]` |
+| `trustedadvisor_premium_support_plan_subscribed` | `verify_premium_support_plans` | Boolean | `True` |
+| `vpc_endpoint_connections_trust_boundaries` | `trusted_account_ids` | List of Strings | `[]` |
+| `vpc_endpoint_services_allowed_principals_trust_boundaries` | `trusted_account_ids` | List of Strings | `[]` |
+
+### Resource Scan Limit
+
+<VersionBadge version="5.32.0" />
+
+Some AWS services accumulate large numbers of resources (EBS snapshots, backup recovery points, CloudWatch log groups, Lambda functions, ECS task definitions, and CodeArtifact packages). Scanning every resource increases scan time, cost, API throttling, and finding volume. By default, Prowler scans every resource. Configure a positive resource scan limit to cap how many resources Prowler analyzes for these high-volume AWS resource paths.
+
+The global default applies to the supported resources below and is overridable per resource. The default global value is `0`, which disables the limit and scans every resource. A global `null` value is also unlimited. For per-resource values, `null` means inherit the global default; set `0` or a negative value to disable that resource limit explicitly. Positive values enable limits.
+
+<Warning>
+When positive resource scan limits are configured, compliance results are based only on the selected resources, not on the full set of matching resources in the account. Treat compliance summaries and percentages as partial evidence, because unselected resources are not analyzed and can change the real compliance posture.
+</Warning>
+
+#### Global Behavior
+
+Resource scan limits select resources for analysis. They do not cap, prioritize, or reorder findings.
+
+* **`0`, negative, or global `null` values:** Disable the limit and keep the legacy behavior for that resource path. Prowler analyzes every discovered matching resource.
+* **Positive values:** Select at most that many resources for the affected resource path. A selected resource can produce zero, one, or many findings.
+* **No PASS/FAIL prioritization:** Prowler does not inspect the compliance result before selecting resources. Limits do not prefer failed resources, passed resources, or resources with more findings.
+* **Latest-first where possible:** When AWS exposes timestamps or useful ordering, Prowler selects the newest resources first. When AWS only exposes API order, Prowler preserves that API order and documents the behavior as best effort.
+* **Findings are downstream:** Checks only evaluate the resources exposed by the service client after selection. Findings from unselected resources are not produced because those resources are not analyzed.
+
+Exact list API call reduction depends on each AWS API's ordering and pagination capabilities. When Prowler must enumerate candidates locally to select the latest resources, list calls may still read candidates, but expensive per-resource enrichment calls are bounded to the selected resources for the supported paths below.
+
+#### Full Collections Versus Limited Analysis Sets
+
+Some checks need lightweight evidence from a complete resource collection to avoid incorrect cross-service conclusions, while other checks perform primary analysis on a limited resource set.
+
+Prowler keeps full lightweight collections where they are needed for cross-service evidence. For example:
+
+* **Lambda security groups and regions:** Prowler records security groups used by all discovered Lambda functions and the regions where functions exist before it limits Lambda functions for primary Lambda checks. This helps Amazon EC2 and Amazon Inspector checks avoid false positives such as treating Lambda security groups as unused or assuming a region has no Lambda functions.
+* **CloudWatch `all_log_groups`:** Prowler records all discovered CloudWatch log groups in `all_log_groups` before limiting the primary `log_groups` analysis set. Other services can still resolve log group evidence, while CloudWatch log group checks only analyze the selected log groups.
+
+This split is intentional. It reduces expensive per-resource analysis calls without discarding lightweight context that other services need for accurate results.
+
+#### Supported AWS Resource Limits
+
+| Value | Scope | Type |
+|-------|-------|------|
+| `max_scanned_resources_per_service` | Global default for all supported high-volume AWS resources (default `0`, disabled/unlimited) | Integer |
+| `max_ebs_snapshots` | EBS snapshots (`ec2_ebs_*` checks) | Integer |
+| `max_backup_recovery_points` | Backup recovery points (`backup_recovery_point_*`) | Integer |
+| `max_cloudwatch_log_groups` | CloudWatch log groups (`cloudwatch_log_group_*`) | Integer |
+| `max_lambda_functions` | Lambda functions (`awslambda_function_*`) | Integer |
+| `max_ecs_task_definitions` | ECS task definitions (`ecs_task_definitions_*`) | Integer |
+| `max_codeartifact_packages` | CodeArtifact packages (`codeartifact_packages_*`) | Integer |
+
+#### Resource Limit Behavior By Resource Path
+
+| Resource Path | What Prowler Discovers | What A Positive Limit Selects For Analysis | Ordering And Latest Behavior | AWS Calls Reduced | Drawbacks And Consequences |
+|---------------|------------------------|--------------------------------------------|------------------------------|-------------------|----------------------------|
+| EBS snapshots (`max_ebs_snapshots`) | Prowler lists self-owned snapshots and keeps lightweight evidence that volumes and regions have snapshots. | The selected EBS snapshots exposed to `ec2_ebs_*` checks. | Prowler sorts discovered snapshots by `StartTime` newest first, then applies the limit. Snapshots without a timestamp sort last. | Bounds expensive per-snapshot public attribute checks to selected snapshots. Snapshot listing still runs so Prowler can choose the newest snapshots and keep volume/region evidence. | Older unselected snapshots are not analyzed by snapshot checks. A public, unencrypted, or otherwise noncompliant older snapshot can be missed when the limit is lower than the number of snapshots. |
+| Backup recovery points (`max_backup_recovery_points`) | Prowler lists backup vaults, plans, selections, and recovery point candidates in discovered vaults. | The selected recovery points exposed to `backup_recovery_point_*` checks and tag hydration. | Prowler sorts discovered recovery points by `CreationDate` newest first across vaults, then applies the limit. Recovery points without a timestamp sort last. | Bounds recovery point tag calls to selected recovery points. Vault and recovery point list calls still run so Prowler can choose the newest points. | Older unselected recovery points are not analyzed. A nonencrypted or otherwise noncompliant older recovery point can be missed. |
+| CloudWatch log groups (`max_cloudwatch_log_groups`) | Prowler lists log groups into both `all_log_groups` and the primary `log_groups` collection. `all_log_groups` remains available as lightweight cross-service evidence. | The selected log groups exposed to `cloudwatch_log_group_*` checks, tag hydration, and log event retrieval for checks that need log contents. | Prowler sorts discovered log groups by `creationTime` newest first, then applies the limit. Log groups without a creation time sort last. | Bounds tag calls and log event retrieval to selected log groups. Log group listing still runs to build `all_log_groups` and choose newest log groups. | Older unselected log groups are not analyzed by CloudWatch log group checks. Retention, encryption, or secrets-in-logs issues in older log groups can be missed, although cross-service evidence can still use `all_log_groups`. |
+| Lambda functions (`max_lambda_functions`) | Prowler lists Lambda functions and records lightweight security group and region evidence for all discovered functions. | The selected Lambda functions exposed to `awslambda_function_*` checks and per-function enrichment such as tags, policies, function URLs, and event source mappings. | Prowler sorts discovered functions by `LastModified` newest first, then applies the limit. Functions without `LastModified` sort last. | Bounds per-function enrichment calls to selected functions. Function listing still runs to choose newest functions and keep security group/region evidence. | Older unselected functions are not analyzed by Lambda checks. Runtime, policy, URL, environment secret, or dead-letter queue issues in older functions can be missed. Cross-service checks can still use full Lambda security group and region evidence to avoid false positives. |
+| ECS task definitions (`max_ecs_task_definitions`) | Prowler lists ECS task definition ARN candidates in each region. Candidate ARNs can remain visible and discoverable through AWS list operations, even when not all are described. | The selected task definitions that Prowler describes and exposes to `ecs_task_definitions_*` checks. | Selection is not random. Prowler calls `ListTaskDefinitions` with `sort=DESC`, which asks AWS to return task definition ARNs in descending family and revision order. Prowler then interleaves regional candidate lists to avoid starving later regions before applying the limit. This selects the latest task definition revisions according to the ARN order AWS provides, while preserving regional fairness. | Bounds `DescribeTaskDefinition` calls to selected task definitions. Prowler may still list candidates so it can select the bounded set and keep discovery deterministic. | Unselected task definitions are not described or analyzed. Issues in older task definition revisions, or in lower-priority families outside the selected AWS `sort=DESC` order, can be missed. Because ECS ordering is family/revision based rather than a registration timestamp sort across every family, this is latest-first according to AWS task definition ARN ordering, not a global newest-by-time guarantee. |
+| CodeArtifact packages (`max_codeartifact_packages`) | Prowler lists CodeArtifact repositories and lazily lists packages inside them. | The selected packages exposed to `codeartifact_packages_*` checks, including latest-version metadata for those packages. | AWS `ListPackages` does not provide a newest-package timestamp ordering in this path. Prowler preserves repository order and package API order, then applies the limit. Latest package version metadata is retrieved for selected packages with `sortBy=PUBLISHED_TIME` and `maxResults=1`. | Bounds `ListPackageVersions` calls to selected packages and can stop package listing once the limit is reached. Repository listing still runs. | Package selection is best effort by API order, not newest package order. Packages outside the selected repository/API order are not analyzed, so origin restriction or latest-version issues can be missed. |
+
+Use limits when scan duration, API throttling, or cost are more important than exhaustive coverage for these high-volume resources. Keep limits disabled when you need complete evidence for every resource in the affected checks.
+
+### Validating Discovered Secrets
+
+<VersionBadge version="5.32.0" />
+
+By default, the secret-scanning checks run fully offline: secrets are detected but never sent anywhere. Setting `secrets_validate` to `True` additionally confirms whether each discovered secret is live by authenticating with it against the corresponding provider API. The discovered secret itself serves as the credential, so Prowler requires no additional permissions to validate it.
+
+`secrets_validate` applies to every AWS secret-scanning check listed above (those that accept `secrets_ignore_patterns`). The `--scan-secrets-validate` CLI flag is provider-wide: it also enables validation for the secret-scanning checks of other providers, such as the OpenStack metadata checks.
+
+To enable validation through the configuration file, set the value under the `aws` section:
+
+```yaml
+aws:
+ secrets_validate: True
+```
+
+To enable validation for a single scan (any provider), use Prowler CLI:
+
+```
+prowler aws --scan-secrets-validate
+```
+
+<Warning>
+Secret validation makes outbound network calls that authenticate with each discovered secret. The credential is exercised against the provider, so the call appears in the audited account's logs and can trigger its monitoring (for example, AWS CloudTrail records the validation request). Validation stays disabled by default so that scans remain fully offline.
+</Warning>
## Azure
@@ -92,20 +204,20 @@ The following list includes all the AWS checks with configurable variables that
### Configurable Checks
The following list includes all the Azure checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|--------------------------------------------------|-----------------|
-| `network_public_ip_shodan` | `shodan_api_key` | String |
-| `app_ensure_php_version_is_latest` | `php_latest_version` | String |
-| `app_ensure_python_version_is_latest` | `python_latest_version` | String |
-| `app_ensure_java_version_is_latest` | `java_latest_version` | String |
-| `sqlserver_recommended_minimal_tls_version` | `recommended_minimal_tls_versions` | List of Strings |
-| `vm_sufficient_daily_backup_retention_period` | `vm_backup_min_daily_retention_days` | Integer |
-| `vm_desired_sku_size` | `desired_vm_sku_sizes` | List of Strings |
-| `storage_smb_channel_encryption_with_secure_algorithm` | `recommended_smb_channel_encryption_algorithms` | List of Strings |
-| `defender_attack_path_notifications_properly_configured` | `defender_attack_path_minimal_risk_level` | String |
-| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_threshold` | Float |
-| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_minutes` | Integer |
-| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_actions` | List of Strings |
+| Check Name | Value | Type | Default |
+|----------------------------------------------------------|-------------------------------------------------|-----------------|------------------------------------------------------------|
+| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_actions` | List of Strings | See `config.yaml` |
+| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_minutes` | Integer | `1440` |
+| `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_threshold` | Float | `0.1` |
+| `app_ensure_java_version_is_latest` | `java_latest_version` | String | `"17"` |
+| `app_ensure_php_version_is_latest` | `php_latest_version` | String | `"8.2"` |
+| `app_ensure_python_version_is_latest` | `python_latest_version` | String | `"3.12"` |
+| `defender_attack_path_notifications_properly_configured` | `defender_attack_path_minimal_risk_level` | String | `"High"` |
+| `network_public_ip_shodan` | `shodan_api_key` | String | `null` |
+| `sqlserver_recommended_minimal_tls_version` | `recommended_minimal_tls_versions` | List of Strings | `["1.2", "1.3"]` |
+| `storage_smb_channel_encryption_with_secure_algorithm` | `recommended_smb_channel_encryption_algorithms` | List of Strings | `["AES-256-GCM"]` |
+| `vm_desired_sku_size` | `desired_vm_sku_sizes` | List of Strings | `["Standard_A8_v2", "Standard_DS3_v2", "Standard_D4s_v3"]` |
+| `vm_sufficient_daily_backup_retention_period` | `vm_backup_min_daily_retention_days` | Integer | `7` |
## GCP
@@ -113,23 +225,28 @@ The following list includes all the Azure checks with configurable variables tha
### Configurable Checks
The following list includes all the GCP checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|--------------------------------------------------|-----------------|
-| `compute_configuration_changes` | `compute_audit_log_lookback_days` | Integer |
-| `compute_instance_group_multiple_zones` | `mig_min_zones` | Integer |
+| Check Name | Value | Type | Default |
+|---------------------------------------------------|-----------------------------------|---------|---------|
+| `cloudstorage_bucket_sufficient_retention_period` | `storage_min_retention_days` | Integer | `90` |
+| `compute_instance_group_multiple_zones` | `mig_min_zones` | Integer | `2` |
+| `compute_public_address_shodan` | `shodan_api_key` | String | `null` |
+| `compute_snapshot_not_outdated` | `max_snapshot_age_days` | Integer | `90` |
+| `iam_sa_user_managed_key_unused` | `max_unused_account_days` | Integer | `180` |
+| `iam_service_account_unused` | `max_unused_account_days` | Integer | `180` |
+| `secretmanager_secret_rotation_enabled` | `secretmanager_max_rotation_days` | Integer | `90` |
## Kubernetes
### Configurable Checks
The following list includes all the Kubernetes checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|--------------------------------------------------|-----------------|
-| `audit_log_maxbackup` | `audit_log_maxbackup` | String |
-| `audit_log_maxsize` | `audit_log_maxsize` | String |
-| `audit_log_maxage` | `audit_log_maxage` | String |
-| `apiserver_strong_ciphers` | `apiserver_strong_ciphers` | String |
-| `kubelet_strong_ciphers_only` | `kubelet_strong_ciphers` | String |
+| Check Name | Value | Type | Default |
+|-------------------------------------|----------------------------|-----------------|----------------------------------------------------------------------------------------|
+| `apiserver_audit_log_maxage_set` | `audit_log_maxage` | Integer | `30` |
+| `apiserver_audit_log_maxbackup_set` | `audit_log_maxbackup` | Integer | `10` |
+| `apiserver_audit_log_maxsize_set` | `audit_log_maxsize` | Integer | `100` |
+| `apiserver_strong_ciphers_only` | `apiserver_strong_ciphers` | List of Strings | `["TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"]` |
+| `kubelet_strong_ciphers_only` | `kubelet_strong_ciphers` | List of Strings | See `config.yaml` |
## M365
@@ -137,11 +254,13 @@ The following list includes all the Kubernetes checks with configurable variable
### Configurable Checks
The following list includes all the Microsoft 365 checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|--------------------------------------------------|-----------------|
-| `entra_admin_users_sign_in_frequency_enabled` | `sign_in_frequency` | Integer |
-| `teams_external_file_sharing_restricted` | `allowed_cloud_storage_services` | List of Strings |
-| `exchange_organization_mailtips_enabled` | `recommended_mailtips_large_audience_threshold` | Integer |
+| Check Name | Value | Type | Default |
+|--------------------------------------------------------------------|-------------------------------------------------|-----------------|--------------------|
+| `defender_malware_policy_comprehensive_attachments_filter_applied` | `recommended_blocked_file_types` | List of Strings | See check defaults |
+| `entra_admin_users_sign_in_frequency_enabled` | `sign_in_frequency` | Integer | `4` |
+| `exchange_organization_mailtips_enabled` | `recommended_mailtips_large_audience_threshold` | Integer | `25` |
+| `exchange_user_mailbox_auditing_enabled` | `audit_log_age` | Integer | `90` |
+| `teams_external_file_sharing_restricted` | `allowed_cloud_storage_services` | List of Strings | `[]` |
## GitHub
@@ -149,35 +268,76 @@ The following list includes all the Microsoft 365 checks with configurable varia
### Configurable Checks
The following list includes all the GitHub checks with configurable variables that can be changed in the configuration yaml file:
-| Check Name | Value | Type |
-|--------------------------------------------|---------------------------------------------|---------|
-| `repository_inactive_not_archived` | `inactive_not_archived_days_threshold` | Integer |
+| Check Name | Value | Type | Default |
+|------------------------------------|----------------------------------------|---------|---------|
+| `repository_inactive_not_archived` | `inactive_not_archived_days_threshold` | Integer | `180` |
## Vercel
### Configurable Checks
The following list includes all the Vercel checks with configurable variables that can be changed in the configuration YAML file:
-| Check Name | Value | Type |
-|-----------------------------------------------------|------------------------------------|-----------------|
-| `authentication_no_stale_tokens` | `stale_token_threshold_days` | Integer |
-| `authentication_token_not_expired` | `days_to_expire_threshold` | Integer |
-| `deployment_production_uses_stable_target` | `stable_branches` | List of Strings |
-| `domain_ssl_certificate_valid` | `days_to_expire_threshold` | Integer |
-| `project_environment_no_secrets_in_plain_type` | `secret_suffixes` | List of Strings |
-| `team_member_role_least_privilege` | `max_owner_percentage` | Integer |
-| `team_member_role_least_privilege` | `max_owners` | Integer |
-| `team_no_stale_invitations` | `stale_invitation_threshold_days` | Integer |
+| Check Name | Value | Type | Default |
+|------------------------------------------------|-----------------------------------|-----------------|--------------------------------------------------------------------------|
+| `authentication_no_stale_tokens` | `stale_token_threshold_days` | Integer | `90` |
+| `authentication_token_not_expired` | `days_to_expire_threshold` | Integer | `7` |
+| `deployment_production_uses_stable_target` | `stable_branches` | List of Strings | `["main", "master"]` |
+| `domain_ssl_certificate_valid` | `days_to_expire_threshold` | Integer | `7` |
+| `project_environment_no_secrets_in_plain_type` | `secret_suffixes` | List of Strings | `["_KEY", "_SECRET", "_TOKEN", "_PASSWORD", "_API_KEY", "_PRIVATE_KEY"]` |
+| `team_member_role_least_privilege` | `max_owner_percentage` | Integer | `20` |
+| `team_member_role_least_privilege` | `max_owners` | Integer | `3` |
+| `team_no_stale_invitations` | `stale_invitation_threshold_days` | Integer | `30` |
## Okta
### Configurable Checks
The following list includes all the Okta checks with configurable variables that can be changed in the configuration YAML file:
-| Check Name | Value | Type |
-|---------------------------------------------------------------|------------------------------------|---------|
-| `application_admin_console_session_idle_timeout_15min` | `okta_admin_console_idle_timeout_max_minutes` | Integer |
-| `signon_global_session_idle_timeout_15min` | `okta_max_session_idle_minutes` | Integer |
+| Check Name | Value | Type | Default |
+|--------------------------------------------------------|-----------------------------------------------|-----------------|---------|
+| `application_admin_console_session_idle_timeout_15min` | `okta_admin_console_idle_timeout_max_minutes` | Integer | `15` |
+| `idp_smart_card_dod_approved_ca` | `okta_dod_approved_ca_issuer_patterns` | List of Strings | `[]` |
+| `signon_global_session_idle_timeout_15min` | `okta_max_session_idle_minutes` | Integer | `15` |
+| `signon_global_session_lifetime_18h` | `okta_max_session_lifetime_minutes` | Integer | `1080` |
+| `user_inactivity_automation_35d_enabled` | `okta_user_inactivity_max_days` | Integer | `35` |
+
+## Alibaba Cloud
+
+### Configurable Checks
+The following list includes all the Alibaba Cloud checks with configurable variables that can be changed in the configuration YAML file:
+
+| Check Name | Value | Type | Default |
+|--------------------------------------|--------------------------------|---------|---------|
+| `cs_kubernetes_cluster_check_recent` | `max_cluster_check_days` | Integer | `7` |
+| `cs_kubernetes_cluster_check_weekly` | `max_cluster_check_days` | Integer | `7` |
+| `ram_user_console_access_unused` | `max_console_access_days` | Integer | `90` |
+| `rds_instance_sql_audit_retention` | `min_rds_audit_retention_days` | Integer | `180` |
+| `sls_logstore_retention_period` | `min_log_retention_days` | Integer | `365` |
+
+
+## MongoDB Atlas
+
+### Configurable Checks
+The following list includes all the MongoDB Atlas checks with configurable variables that can be changed in the configuration YAML file:
+
+| Check Name | Value | Type | Default |
+|----------------------------------------------------|---------------------------------------------|---------|---------|
+| `organizations_service_account_secrets_expiration` | `max_service_account_secret_validity_hours` | Integer | `8` |
+
+
+## OpenStack
+
+### Configurable Checks
+The following list includes all the OpenStack checks with configurable variables that can be changed in the configuration YAML file:
+
+| Check Name | Value | Type | Default |
+|---------------------------------------------------|---------------------------|-----------------|---------|
+| `blockstorage_snapshot_metadata_sensitive_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `blockstorage_volume_metadata_sensitive_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `compute_instance_metadata_sensitive_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
+| `image_not_shared_with_multiple_projects` | `image_sharing_threshold` | Integer | `5` |
+| `objectstorage_container_metadata_sensitive_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
+
## Config YAML File Structure
@@ -191,6 +351,19 @@ aws:
# AWS Global Configuration
# aws.mute_non_default_regions --> Set to True to muted failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config
mute_non_default_regions: False
+
+ # AWS Resource Scan Limit Configuration
+ # Disabled by default: scan every resource unless a positive limit is configured.
+ # Findings are not capped. Set to 0 (or a negative value) to disable the limit.
+ # aws.max_scanned_resources_per_service --> global default for all services below
+ max_scanned_resources_per_service: 0
+ # Per-service overrides. Leave as null to fall back to the global default.
+ max_ebs_snapshots: null
+ max_backup_recovery_points: null
+ max_cloudwatch_log_groups: null
+ max_lambda_functions: null
+ max_ecs_task_definitions: null
+ max_codeartifact_packages: null
# If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`:
# Mutelist:
# Accounts:
diff --git a/docs/user-guide/cli/tutorials/dashboard.mdx b/docs/user-guide/cli/tutorials/dashboard.mdx
index 0fe3c69fed..abb3872657 100644
--- a/docs/user-guide/cli/tutorials/dashboard.mdx
+++ b/docs/user-guide/cli/tutorials/dashboard.mdx
@@ -1,8 +1,8 @@
---
-title: "Dashboard"
+title: "Prowler Local Dashboard"
---
-Prowler allows you to run your own local dashboards using the csv outputs provided by Prowler
+Prowler Local Dashboard is a local web dashboard built from the CSV outputs produced by Prowler CLI. Launch it with:
```sh
prowler dashboard
@@ -12,7 +12,7 @@ prowler dashboard
You can expose the `dashboard` server in another address using the `HOST` environment variable.
</Note>
-To run Prowler local dashboard with Docker, use:
+To run Prowler Local Dashboard with Docker, use:
```sh
docker run -v /your/local/dir/prowler-output:/home/prowler/output --env HOST=0.0.0.0 --publish 127.0.0.1:11666:11666 toniblyx/prowler:latest dashboard
diff --git a/docs/user-guide/cli/tutorials/integrations.mdx b/docs/user-guide/cli/tutorials/integrations.mdx
index f3e698d799..bfd53b0c3c 100644
--- a/docs/user-guide/cli/tutorials/integrations.mdx
+++ b/docs/user-guide/cli/tutorials/integrations.mdx
@@ -33,7 +33,7 @@ To configure the Slack Integration, follow the next steps:
2. Optionally, create a Slack Channel (you can use an existing one)
3. Integrate the created Slack App to your Slack channel:
- - Click on the channel, go to the Integrations tab, and Add an App.
+ - Click the channel, go to the Integrations tab, and Add an App.
4. Set the following environment variables that Prowler will read:
diff --git a/docs/user-guide/cli/tutorials/pentesting.mdx b/docs/user-guide/cli/tutorials/pentesting.mdx
index 0ad5313611..a9a8c728df 100644
--- a/docs/user-guide/cli/tutorials/pentesting.mdx
+++ b/docs/user-guide/cli/tutorials/pentesting.mdx
@@ -6,20 +6,34 @@ Prowler has some checks that analyse pentesting risks (Secrets, Internet Exposed
## Detect Secrets
-Prowler uses `detect-secrets` library to search for any secrets that are stores in plaintext within your environment.
+Prowler scans for secrets stored in plaintext within the audited environment using [Kingfisher](https://github.com/mongodb/kingfisher), an open-source secret-scanning engine. By default these scans run fully offline, so no data leaves the audited environment. Discovered secrets can optionally be validated against the provider APIs to confirm whether they are live — see [Validating Discovered Secrets](/user-guide/cli/tutorials/configuration_file#validating-discovered-secrets).
-The actual checks that have this functionality are the following:
+The checks with this functionality are the following.
+AWS:
+
+- apigateway\_restapi\_no\_secrets\_in\_stage\_variables
- autoscaling\_find\_secrets\_ec2\_launch\_configuration
- awslambda\_function\_no\_secrets\_in\_code
- awslambda\_function\_no\_secrets\_in\_variables
- cloudformation\_stack\_outputs\_find\_secrets
+- cloudwatch\_log\_group\_no\_secrets\_in\_logs
+- codebuild\_project\_no\_secrets\_in\_variables
- ec2\_instance\_secrets\_user\_data
- ec2\_launch\_template\_no\_secrets
- ecs\_task\_definitions\_no\_environment\_secrets
+- glue\_etl\_jobs\_no\_secrets\_in\_arguments
- ssm\_document\_secrets
+- stepfunctions\_statemachine\_no\_secrets\_in\_definition
-To execute detect-secrets related checks, you can run the following command:
+OpenStack:
+
+- compute\_instance\_metadata\_sensitive\_data
+- blockstorage\_volume\_metadata\_sensitive\_data
+- blockstorage\_snapshot\_metadata\_sensitive\_data
+- objectstorage\_container\_metadata\_sensitive\_data
+
+To execute the secret-scanning checks, run the following command:
```console
prowler <provider> --categories secrets
diff --git a/docs/user-guide/compliance/tutorials/compliance.mdx b/docs/user-guide/compliance/tutorials/compliance.mdx
index 63b2502b25..6c13f60529 100644
--- a/docs/user-guide/compliance/tutorials/compliance.mdx
+++ b/docs/user-guide/compliance/tutorials/compliance.mdx
@@ -1,14 +1,15 @@
---
title: 'Compliance'
-description: 'Run security checks against compliance frameworks, review posture across providers, and download CSV or PDF reports from Prowler Cloud, Prowler App, and Prowler CLI.'
+sidebarTitle: 'Overview'
+description: 'Run security checks against compliance frameworks, review posture across providers, and download CSV or PDF reports from Prowler Cloud and Prowler Local Server, or CSV reports from Prowler CLI.'
---
-Prowler maps every security check to one or more industry-standard compliance frameworks, so a single scan produces both technical findings and framework-aligned evidence. The same evaluation runs identically whether scans are launched from Prowler Cloud, Prowler App, or Prowler CLI.
+Prowler maps every security check to one or more industry-standard compliance frameworks, so a single scan produces both technical findings and framework-aligned evidence. The same evaluation runs identically whether scans are launched from Prowler Cloud, Prowler Local Server, or Prowler CLI.
Out of the box, Prowler covers frameworks such as CIS Benchmarks, NIST 800-53, NIST CSF, NIS2, ENS RD2022, ISO 27001, PCI-DSS, SOC 2, GDPR, HIPAA, AWS Well-Architected, BSI C5, CSA CCM, MITRE ATT&CK, KISA ISMS-P, FedRAMP, and Prowler ThreatScore. The full catalog is available at [Prowler Hub](https://hub.prowler.com/compliance).
<Note>
-For the unified compliance score methodology used across frameworks, see [Prowler ThreatScore Documentation](/user-guide/compliance/tutorials/threatscore).
+For the unified compliance score methodology used across frameworks, see [Prowler ThreatScore](/user-guide/compliance/tutorials/threatscore).
</Note>
<CardGroup cols={2}>
@@ -20,15 +21,15 @@ For the unified compliance score methodology used across frameworks, see [Prowle
</Card>
</CardGroup>
-## Prowler Cloud
+## Prowler Cloud and Prowler Local Server
-The Compliance section in Prowler Cloud and Prowler App centralizes compliance posture across every connected provider. It aggregates scan results, surfaces Prowler ThreatScore, and exposes detailed requirement-level evidence for each supported framework.
+The Compliance section in Prowler Cloud and Prowler Local Server centralizes compliance posture across every connected provider. It aggregates scan results, surfaces Prowler ThreatScore, and exposes detailed requirement-level evidence for each supported framework.
### Accessing the Compliance Section
To open the compliance overview, follow these steps:
-1. Sign in to Prowler Cloud at [cloud.prowler.com](https://cloud.prowler.com/sign-in) or to a self-hosted Prowler App instance.
+1. Sign in to Prowler Cloud at [cloud.prowler.com](https://cloud.prowler.com/sign-in) or to a Prowler Local Server instance.
2. Select **Compliance** from the left navigation.
The page lists every framework evaluated by the most recent completed scan of the selected provider.
@@ -74,7 +75,7 @@ When the selected scan includes Prowler ThreatScore data, a dedicated card appea
Selecting the card opens the ThreatScore framework detail page, covered in [Working With the Framework Detail Page](#working-with-the-framework-detail-page).
-For a complete explanation of the methodology, formula, and weighting, see [Prowler ThreatScore Documentation](/user-guide/compliance/tutorials/threatscore).
+For a complete explanation of the methodology, formula, and weighting, see [Prowler ThreatScore](/user-guide/compliance/tutorials/threatscore).
### Exploring the Framework Grid
@@ -169,7 +170,7 @@ Region filters disable the per-card download dropdown to avoid generating partia
#### Downloading the Full Scan Output
-To export every framework, finding, and resource at once, use the **Scan Jobs** section instead. The ZIP archive contains the CSV, JSON-OCSF, and HTML reports plus a `compliance/` subfolder with one CSV per framework. See [Prowler App — Getting Started](/user-guide/tutorials/prowler-app) for details.
+To export every framework, finding, and resource at once, use the **Scan Jobs** section instead. The ZIP archive contains the CSV, JSON-OCSF, and HTML reports plus a `compliance/` subfolder with one CSV per framework. See [Prowler Cloud — Getting Started](/user-guide/tutorials/prowler-app) for details.
### API Access
@@ -262,6 +263,7 @@ To request a new framework or contribute one, see [Creating a New Security Compl
## Related Documentation
-* [Prowler ThreatScore Documentation](/user-guide/compliance/tutorials/threatscore)
+* [Cross-Provider Compliance](/user-guide/compliance/tutorials/cross-provider-compliance)
+* [Prowler ThreatScore](/user-guide/compliance/tutorials/threatscore)
* [Creating a New Security Compliance Framework in Prowler](/developer-guide/security-compliance-framework)
-* [Prowler App — Getting Started](/user-guide/tutorials/prowler-app)
+* [Prowler Cloud — Getting Started](/user-guide/tutorials/prowler-app)
diff --git a/docs/user-guide/compliance/tutorials/cross-provider-compliance.mdx b/docs/user-guide/compliance/tutorials/cross-provider-compliance.mdx
new file mode 100644
index 0000000000..545f5fb834
--- /dev/null
+++ b/docs/user-guide/compliance/tutorials/cross-provider-compliance.mdx
@@ -0,0 +1,209 @@
+---
+title: 'Cross-Provider Compliance'
+sidebarTitle: 'Cross-Provider Compliance'
+description: 'Aggregate a single universal compliance framework across every connected provider in Prowler Cloud, review a consolidated roll-up and per-provider breakdown, and download a combined PDF report.'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+<VersionBadge version="5.34.0" />
+
+Cross-Provider Compliance consolidates a single **universal compliance framework** across all of your connected providers into one unified view. Instead of reviewing the same framework on AWS, Azure, Google Cloud, and every other provider as separate reports, Prowler takes the most recent completed scan of every compatible provider, aggregates them by requirement, and produces a single roll-up posture with a per-provider breakdown and a combined executive PDF.
+
+<SubscriptionBanner />
+
+## What Is a Universal Compliance Framework
+
+Most Prowler compliance frameworks target a single provider (for example, CIS AWS or CIS Azure). A **universal** framework declares its requirements once in a single JSON and maps each requirement to checks for many providers at the same time, so the same CSA CCM control maps to both AWS and Azure checks. Universal frameworks live at the top of the compliance catalog (`prowler/compliance/<framework>.json`), as opposed to the legacy per-provider frameworks under `prowler/compliance/<provider>/`. For real definitions, see [`csa_ccm_4.0.json`](https://github.com/prowler-cloud/prowler/blob/master/prowler/compliance/csa_ccm_4.0.json), [`cis_controls_8.1.json`](https://github.com/prowler-cloud/prowler/blob/master/prowler/compliance/cis_controls_8.1.json), and [`dora_2022_2554.json`](https://github.com/prowler-cloud/prowler/blob/master/prowler/compliance/dora_2022_2554.json) in the Prowler repository.
+
+Prowler currently ships three universal frameworks: [CSA CCM](https://hub.prowler.com/compliance/csa_ccm_4.0), [CIS Controls](https://hub.prowler.com/compliance/cis_controls_8.1), and [DORA](https://hub.prowler.com/compliance/dora_2022_2554). Each framework page on Prowler Hub lists the full requirement-to-check mapping per provider.
+
+## How Cross-Provider Compliance Works
+
+Cross-Provider Compliance uses this structure to answer a single question: **"How compliant is my whole estate against this framework, regardless of provider?"** For a chosen universal framework, Prowler Cloud:
+
+1. Selects **one scan per compatible provider**: by default, the latest completed scan of each provider the framework supports and that you are allowed to see.
+2. Aggregates the requirement results across those scans, folding multiple accounts of the same provider type together.
+3. Computes a **roll-up status** for each requirement and an overall pass / fail / manual summary for the framework.
+4. Exposes a **per-provider breakdown** so you can see exactly which provider is failing a given control.
+
+<Note>
+Cross-Provider Compliance never mixes different frameworks. It aggregates one universal framework at a time across providers. To review a single provider in isolation, use the standard per-scan [Compliance](/user-guide/compliance/tutorials/compliance) view.
+</Note>
+
+### Supported Universal Frameworks
+
+The Cross-Provider Compliance view currently supports the following universal frameworks. The compatible providers are the ones each framework declares checks for; a provider only contributes to the roll-up when it has a completed scan.
+
+| Framework | Version | Compatible providers |
+|-----------|---------|----------------------|
+| [**CSA CCM**](https://hub.prowler.com/compliance/csa_ccm_4.0) (Cloud Controls Matrix) | 4.0 | AWS, Azure, Google Cloud, Alibaba Cloud, Oracle Cloud |
+| [**CIS Controls**](https://hub.prowler.com/compliance/cis_controls_8.1) | 8.1 | AWS, Azure, Google Cloud, Microsoft 365, Kubernetes, GitHub, Google Workspace, Okta, Oracle Cloud, Alibaba Cloud, Cloudflare, MongoDB Atlas, OpenStack, Vercel |
+| [**DORA**](https://hub.prowler.com/compliance/dora_2022_2554) (Digital Operational Resilience Act) | 2022/2554 | AWS, Azure, Google Cloud, Alibaba Cloud, Cloudflare |
+
+The catalog grows as new universal frameworks ship in Prowler. Browse the full compliance catalog at [Prowler Hub](https://hub.prowler.com/compliance).
+
+## Accessing the Cross-Provider View
+
+<Steps>
+ <Step title="Open the Compliance section">
+ Sign in to Prowler Cloud at [cloud.prowler.com](https://cloud.prowler.com/sign-in) and select **Compliance** from the left navigation.
+ </Step>
+ <Step title="Switch to the Cross-provider tab">
+ At the top of the Compliance page, select the **Cross-provider** tab. The **Per Scan** tab (the default) keeps the single-provider compliance experience unchanged.
+ </Step>
+</Steps>
+
+<img src="/images/compliance/prowler-app-cross-provider-tab.png" alt="Compliance page showing the Per Scan and Cross-provider tabs, with the Cross-provider tab highlighted" width="900" />
+
+<Note>
+Cross-Provider Compliance requires at least one completed scan for a compatible provider. If no compatible provider has finished a scan yet, the page shows a notice prompting you to launch or wait for a scan to complete.
+</Note>
+
+## Exploring the Overview
+
+The overview presents one card per supported universal framework, each summarizing the consolidated posture across every contributing provider.
+
+<img src="/images/compliance/prowler-app-cross-provider-overview.png" alt="Cross-Provider Compliance overview showing the provider filters and the framework grid (CSA CCM, CIS Controls, DORA) with per-provider chips, scores, and failed/manual counts" width="900" />
+
+Each **framework card** includes:
+
+* **Framework logo, name, and version:** Identifies the universal standard (CSA CCM, CIS Controls, DORA).
+* **Score:** The percentage of passing requirements over the total evaluated, aggregated across every contributing provider. Color coding follows three thresholds: red for severely low compliance, amber for partial compliance, and green for healthy posture.
+* **Passing Requirements:** A `passed / total` counter with the aggregated roll-up.
+* **Provider chips:** One icon per compatible provider. Providers with a completed scan appear active with their passing percentage; providers without a scan appear dimmed with a "no completed scan yet" tooltip so coverage gaps are obvious at a glance.
+* **Failed and manual counts:** The number of failing and manual requirements in the roll-up.
+
+Select any card to open the framework detail page.
+
+### Filtering the Roll-Up
+
+The filters bar controls which providers and accounts feed every card and detail view. Cross-Provider Compliance supports three filters:
+
+* **Provider type:** Narrow the roll-up to specific provider types (for example, only AWS and Azure).
+* **Provider / account:** Narrow to specific connected accounts.
+* **Provider group:** Narrow to accounts within one or more provider groups.
+
+Select **Clear filters** to reset all filters. Filters applied on the overview are carried through into the detail page and the PDF report so the view stays consistent end to end.
+
+<Note>
+Filters narrow **which providers contribute** to the aggregation. They do not change how a requirement rolls up (see [Understanding the Roll-Up Status](#understanding-the-roll-up-status)).
+</Note>
+
+## Working With the Framework Detail Page
+
+The detail page provides the full breakdown for a single universal framework: aggregate metrics, provider coverage, top failing sections, and a requirement-by-requirement view with per-provider status.
+
+<img src="/images/compliance/prowler-app-cross-provider-detail.png" alt="Cross-Provider Compliance detail page for CSA CCM 4.0 showing the header with providers scanned and the Report button, the filters, and the Requirements Status, Provider Coverage, and Top Failed Sections summary cards" width="900" />
+
+### Header
+
+The header shows the framework name and version, a link to the framework page on [Prowler Hub](https://hub.prowler.com/compliance), and a summary such as *"X of Y compatible providers scanned · N scans aggregated"* so you always know the coverage behind the numbers. The **Report** button in the top-right generates and downloads the combined PDF (see [Downloading the Combined PDF Report](#downloading-the-combined-pdf-report)).
+
+### Summary Cards
+
+Below the header, three summary cards condense the framework state:
+
+* **Requirements Status:** Donut chart with `Pass`, `Fail`, and `Manual` counts plus the total number of requirements, reflecting the consolidated roll-up.
+* **Provider Coverage:** Shows which compatible providers contributed a scan and their individual posture, so coverage gaps and per-provider weak spots are visible at a glance.
+* **Top Failed Sections:** Ranks the framework sections with the highest number of failing requirements, with deep links into the requirements accordion.
+
+### Requirements Accordion
+
+The accordion organizes every requirement of the framework. For each requirement you see:
+
+* **Requirement ID and title:** The official identifier from the framework.
+* **Roll-up status badge:** A single `Pass`, `Fail`, or `Manual` badge representing the consolidated status across all contributing providers.
+* **Per-provider status:** The status each contributing provider returned for that requirement, so a single failing provider is immediately attributable.
+* **Provider-labeled checks:** When you expand a requirement, the underlying checks are labeled with the provider they belong to (each universal requirement maps to different check IDs per provider).
+
+Expand a requirement to review the failing checks per provider, the affected resources, and remediation guidance. Findings are queried across every contributing scan and merged into a single table.
+
+<img src="/images/compliance/prowler-app-cross-provider-requirements-accordion.png" alt="Expanded DORA requirement showing the per-provider Fail badges for AWS, Azure, and Google Cloud, the requirement description and attributes, the checks count, and the merged findings table with a Provider column" width="900" />
+
+## Understanding the Roll-Up Status
+
+Cross-Provider Compliance rolls up results in two stages, with a strict **FAIL > PASS > MANUAL** precedence.
+
+**Per provider, per requirement:**
+
+* If any check fails → the provider contributes **FAIL** for that requirement.
+* Else if every check passes → **PASS**.
+* Otherwise (no pass/fail evidence) → **MANUAL**.
+
+Multiple accounts of the same provider type (for example, three AWS accounts) are folded together first, so a failure in any one account marks that provider type as failing.
+
+**Across providers, per requirement (the roll-up badge):**
+
+* If at least one contributing provider is **FAIL** → the requirement is **FAIL**.
+* Else if at least one contributing provider is **PASS** → **PASS**.
+* Otherwise → **MANUAL**.
+
+<Note>
+Only providers that **actually contributed a result** for a requirement are counted. A provider that has a scan in the aggregation but produced no result for a specific requirement (for example, because the framework maps no checks to that provider for that control) does **not** degrade the requirement to Manual. This keeps the roll-up focused on real evidence.
+</Note>
+
+### How Scans Are Selected
+
+By default, Cross-Provider Compliance auto-selects the **latest completed scan** of each compatible provider you are allowed to see. This means:
+
+* The view always reflects your most recent posture per provider, without any manual scan selection.
+* Adding a new compatible provider and running a scan automatically brings it into the roll-up.
+* Provider visibility follows your role: you only ever see providers your permissions allow, and the roll-up is scoped accordingly.
+
+## Downloading the Combined PDF Report
+
+The **Report** button on the detail page generates a single PDF that combines every contributing provider's latest scan for the framework into one executive document: a cover page listing all providers and accounts, an executive summary with the consolidated roll-up, charts, a requirements index, and detailed findings grouped by requirement, provider, and account.
+
+### The Report Follows Your Filters
+
+A report covers the exact set of scans your current filters resolve to. The provider type, provider / account, and provider group filters applied on the detail page determine which providers contribute, and the auto-select rule pins each contributing provider's latest completed scan. The PDF is built from that resolved scan set together with the framework.
+
+As a result, each filter combination produces its own report. For example:
+
+* No filters → a report covering every compatible provider that has a completed scan.
+* `Provider type = AWS, Azure` → a report covering only your AWS and Azure scans.
+* `Provider group = Production` → a report covering only the accounts in that group.
+
+Changing the filters and generating again produces a different, independent report. Each combination is tracked on its own, so switching filters back and forth never overwrites a previously generated report.
+
+<Note>
+Region filtering is **not** supported for the combined PDF report. The report recomputes status live across every region of the contributing scans, so a region-scoped request is rejected rather than producing a report that contradicts a region-filtered view.
+</Note>
+
+### Generating and Reusing a Report
+
+Because the report aggregates many scans, it is generated **asynchronously**:
+
+<Steps>
+ <Step title="Start the report">
+ Select **Report → Generate new report…**, optionally give it a name, and confirm. Prowler starts a background job and shows a "Report generation started" confirmation.
+ </Step>
+ <Step title="Wait for completion">
+ The button shows a "Generating report…" state while the job runs. Generation continues in the background: you can navigate away, and a toast notification appears when the report is ready, even after a page reload.
+ </Step>
+ <Step title="Download">
+ When the report is ready, select **Download** from the notification, or use **Report → Download latest** at any time to fetch the most recent report for the current filters.
+ </Step>
+</Steps>
+
+<img src="/images/compliance/prowler-app-cross-provider-report.png" alt="Report dropdown on the Cross-Provider Compliance detail page showing the Generate new report option" width="420" />
+
+A report already generated for a given set of filters does not need to be generated again. When you open the detail page with a filter combination that was reported before, Prowler detects the existing report and surfaces **Report → Download latest** so you can download it immediately, without launching a new job. You only need to generate a fresh report when:
+
+* You apply a filter combination that has never been reported before, or
+* A contributing provider has run a new scan since the report was generated. The report is tied to the specific scans it was built from, so a newer scan makes the previous report stale; Prowler recognizes it no longer matches the current selection and offers to generate an up-to-date one.
+
+"Download latest" reuses an existing report only when it matches the framework, the exact resolved scan set for the current filters, and the same report options. This guarantees the PDF you download reflects the posture you are looking at, rather than a report generated for a different filter or an older scan.
+
+<Note>
+The PDF detail section renders only **failed** requirements by default so the report stays focused as an executive/auditor document. As with every Prowler PDF, the detail section is capped at the first 100 failed findings per check; use the per-scan CSV or JSON-OCSF exports for the complete, untruncated list. See [Downloading Compliance Reports](/user-guide/compliance/tutorials/compliance#downloading-compliance-reports) for the full PDF behavior and the `DJANGO_PDF_MAX_FINDINGS_PER_CHECK` setting.
+</Note>
+
+## Related Documentation
+
+* [Compliance](/user-guide/compliance/tutorials/compliance)
+* [Prowler ThreatScore](/user-guide/compliance/tutorials/threatscore)
+* [Creating a New Security Compliance Framework in Prowler](/developer-guide/security-compliance-framework)
+* [Prowler Cloud — Getting Started](/user-guide/tutorials/prowler-app)
diff --git a/docs/user-guide/compliance/tutorials/threatscore.mdx b/docs/user-guide/compliance/tutorials/threatscore.mdx
index bb5a006342..8d790cf90d 100644
--- a/docs/user-guide/compliance/tutorials/threatscore.mdx
+++ b/docs/user-guide/compliance/tutorials/threatscore.mdx
@@ -1,19 +1,17 @@
---
-title: "Prowler ThreatScore Documentation"
+title: "Prowler ThreatScore"
---
-
-
-
## Introduction
-The **Prowler ThreatScore** is a comprehensive compliance scoring system that provides a unified metric for assessing your organization's security posture across compliance frameworks. It aggregates findings from individual security checks into a single, normalized score ranging from 0 to 100.
+Prowler ThreatScore is a comprehensive compliance scoring system that provides a unified metric for assessing security posture across compliance frameworks. It aggregates findings from individual security checks into a single, normalized score ranging from 0 to 100.
### Purpose
-- **Unified View**: Get a single metric representing overall compliance health
-- **Risk Prioritization**: Understand which areas pose the highest security risks
-- **Progress Tracking**: Monitor improvements in compliance posture over time
-- **Executive Reporting**: Provide clear, quantifiable security metrics to stakeholders
+
+- **Unified view:** A single metric represents overall compliance health.
+- **Risk prioritization:** Highlights which areas pose the highest security risks.
+- **Progress tracking:** Monitors improvements in compliance posture over time.
+- **Executive reporting:** Delivers clear, quantifiable security metrics to stakeholders.
## How ThreatScore Works
@@ -29,7 +27,7 @@ Pass Rate = (Number of PASS findings) / (Total findings)
The total number of checks performed (both PASS and FAIL) for a requirement. This represents the amount of evidence available - more findings provide greater confidence in the assessment.
### 3. Weight (`weight_i`)
-A numerical value (1-1000) representing the business importance or criticality of the requirement within your organization's context.
+A numerical value (1-1000) representing the business importance or criticality of the requirement within the organizational context.
### 4. Risk Level (`risk_i`)
A severity rating (1-5) indicating the potential impact of non-compliance with this requirement.
@@ -380,7 +378,7 @@ This comprehensive example demonstrates how:
### Example 4: Impact of Parameter Changes
-Using the scenario, let's see how parameter changes affect the score:
+Using the scenario, the following changes show how parameter adjustments affect the score:
#### Scenario A: Increase Encryption Risk Level
diff --git a/docs/user-guide/cookbooks/powerbi-cis-benchmarks.mdx b/docs/user-guide/cookbooks/powerbi-cis-benchmarks.mdx
index 9b9e41ed93..15985aab28 100644
--- a/docs/user-guide/cookbooks/powerbi-cis-benchmarks.mdx
+++ b/docs/user-guide/cookbooks/powerbi-cis-benchmarks.mdx
@@ -14,7 +14,7 @@ The template and its source files live in the Prowler repository under [`contrib
The setup requires the following components:
* **Microsoft Power BI Desktop:** free download from Microsoft.
-* **Prowler compliance CSV exports:** produced by Prowler CLI or downloaded from Prowler Cloud or Prowler App.
+* **Prowler compliance CSV exports:** produced by Prowler CLI or downloaded from Prowler Cloud or Prowler Local Server.
* **Local directory:** holds the CSV exports that the template ingests at load time.
## Supported CIS Benchmarks
@@ -40,7 +40,7 @@ Download and install Microsoft Power BI Desktop from the official Microsoft site
### Step 2: Generate Compliance CSV Exports
-Compliance CSV exports can be generated through Prowler CLI or downloaded from Prowler Cloud and Prowler App.
+Compliance CSV exports can be generated through Prowler CLI or downloaded from Prowler Cloud and Prowler Local Server.
#### Option A: Prowler CLI
@@ -55,7 +55,7 @@ prowler kubernetes --compliance cis_1.12_kubernetes
The compliance CSV exports are written to `output/compliance/` by default.
-#### Option B: Prowler Cloud or Prowler App
+#### Option B: Prowler Cloud or Prowler Local Server
Open the Compliance section, select the desired CIS Benchmark, and download the CSV export.
@@ -160,7 +160,7 @@ A full walkthrough is available on YouTube:
<CardGroup cols={2}>
<Card title="Compliance Frameworks" icon="shield-check" href="/user-guide/compliance/tutorials/compliance">
- Review the Compliance workflow across Prowler Cloud, Prowler App, and Prowler CLI.
+ Review the Compliance workflow across Prowler Cloud, Prowler Local Server, and Prowler CLI.
</Card>
<Card title="Prowler Dashboard" icon="chart-line" href="/user-guide/cli/tutorials/dashboard">
Explore the built-in local dashboard for Prowler CSV exports.
diff --git a/docs/user-guide/providers/alibabacloud/getting-started-alibabacloud.mdx b/docs/user-guide/providers/alibabacloud/getting-started-alibabacloud.mdx
index 36520a8f8c..ce9778a3b5 100644
--- a/docs/user-guide/providers/alibabacloud/getting-started-alibabacloud.mdx
+++ b/docs/user-guide/providers/alibabacloud/getting-started-alibabacloud.mdx
@@ -32,14 +32,14 @@ Before you begin, make sure you have:
### Step 1: Get Your Alibaba Cloud Account ID
1. Log in to the [Alibaba Cloud Console](https://home.console.alibabacloud.com/)
-2. Click on your profile avatar in the top-right corner
+2. Click your profile avatar in the top-right corner
3. Locate and copy your Account ID
### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"
diff --git a/docs/user-guide/providers/aws/authentication.mdx b/docs/user-guide/providers/aws/authentication.mdx
index 22deb6ab99..e3c20ca99d 100644
--- a/docs/user-guide/providers/aws/authentication.mdx
+++ b/docs/user-guide/providers/aws/authentication.mdx
@@ -7,9 +7,9 @@ Prowler requires AWS credentials to function properly. Authentication is availab
- Static Credentials
- Assumed Role
-When using **Assumed Role**, the Prowler UI exposes two credential sources for calling `sts:AssumeRole`. The labels differ between Prowler Cloud and self-hosted Prowler App, but both map to the same underlying credential types:
+When using **Assumed Role**, the Prowler UI exposes two credential sources for calling `sts:AssumeRole`. The labels differ between Prowler Cloud and Prowler Local Server, but both map to the same underlying credential types:
-- **AWS SDK Default** (shown as *"Prowler Cloud will assume your IAM role"* in Prowler Cloud and *"AWS SDK Default"* in self-hosted Prowler App): Prowler uses the credentials already available to the API and worker containers through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). This is the default in Prowler Cloud and requires extra configuration in self-hosted Prowler App (see [Configuring AWS SDK Default for Self-Hosted Prowler App](#configuring-aws-sdk-default-for-self-hosted-prowler-app)).
+- **AWS SDK Default** (shown as *"Prowler Cloud will assume your IAM role"* in Prowler Cloud and *"AWS SDK Default"* in Prowler Local Server): Prowler uses the credentials already available to the API and worker containers through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). This is the default in Prowler Cloud and requires extra configuration in Prowler Local Server (see [Configuring AWS SDK Default for Prowler Local Server](#configuring-aws-sdk-default-for-prowler-local-server)).
- **Access & Secret Key**: You paste an IAM user's `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optionally `AWS_SESSION_TOKEN` into the form. Prowler uses those keys to call `sts:AssumeRole`.
## Required Permissions
@@ -81,9 +81,9 @@ This method grants permanent access and is the recommended setup for production
---
-## Configuring AWS SDK Default for Self-Hosted Prowler App
+## Configuring AWS SDK Default for Prowler Local Server
-When self-hosting Prowler App with Docker Compose, the API and worker containers do not have AWS credentials by default. Selecting **AWS SDK Default** without configuring those credentials produces:
+When running Prowler Local Server with Docker Compose, the API and worker containers do not have AWS credentials by default. Selecting **AWS SDK Default** without configuring those credentials produces:
```
AWSAssumeRoleError[1012]: AWS assume role error - An error occurred (InvalidClientTokenId) when calling the AssumeRole operation: The security token included in the request is invalid.
@@ -116,7 +116,7 @@ docker compose up -d --force-recreate api worker worker-beat
### Option 2: IAM Role (Host with Instance Metadata)
-If you run Prowler App on an EC2 instance, ECS task, or EKS pod with an attached IAM role that can assume the scan role, no extra configuration is needed — `boto3` resolves credentials through instance or task metadata automatically.
+If you run Prowler Local Server on an EC2 instance, ECS task, or EKS pod with an attached IAM role that can assume the scan role, no extra configuration is needed — `boto3` resolves credentials through instance or task metadata automatically.
### Trust Policy: Align `IAMPrincipal` With Your Identity
diff --git a/docs/user-guide/providers/aws/getting-started-aws.mdx b/docs/user-guide/providers/aws/getting-started-aws.mdx
index f0c5ab882a..11516e88b3 100644
--- a/docs/user-guide/providers/aws/getting-started-aws.mdx
+++ b/docs/user-guide/providers/aws/getting-started-aws.mdx
@@ -18,7 +18,7 @@ title: 'Getting Started With AWS on Prowler'
### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"
@@ -67,7 +67,7 @@ This method grants permanent access and is the recommended setup for production
For detailed instructions on how to create the role, see [Authentication > Assume Role](/user-guide/providers/aws/authentication#assume-role-recommended).
-7. Once the role is created, go to the **IAM Console**, click on the "ProwlerScan" role to open its details:
+7. Once the role is created, go to the **IAM Console**, click the "ProwlerScan" role to open its details:
@@ -75,13 +75,13 @@ For detailed instructions on how to create the role, see [Authentication > Assum
-9. Paste the ARN into the corresponding field in Prowler Cloud or Prowler App
+9. Paste the ARN into the corresponding field in Prowler Cloud or Prowler Local Server
10. Select the credential source Prowler should use to call `sts:AssumeRole`. The option label differs between deployments but both map to the same `aws-sdk-default` credential type:
- - **"Prowler Cloud will assume your IAM role"** (default in Prowler Cloud) / **"AWS SDK Default"** (in self-hosted Prowler App): Prowler uses the credentials available in the API and worker environment through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). In self-hosted Prowler App, these containers have no AWS credentials by default — see [Configuring AWS SDK Default for Self-Hosted Prowler App](/user-guide/providers/aws/authentication#configuring-aws-sdk-default-for-self-hosted-prowler-app) before choosing this option, or the connection test will fail with `InvalidClientTokenId`.
+ - **"Prowler Cloud will assume your IAM role"** (default in Prowler Cloud) / **"AWS SDK Default"** (in Prowler Local Server): Prowler uses the credentials available in the API and worker environment through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). In Prowler Local Server, these containers have no AWS credentials by default — see [Configuring AWS SDK Default for Prowler Local Server](/user-guide/providers/aws/authentication#configuring-aws-sdk-default-for-prowler-local-server) before choosing this option, or the connection test will fail with `InvalidClientTokenId`.
- **Access & Secret Key**: Paste an IAM user's `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` (and optional `AWS_SESSION_TOKEN`) into the form. The IAM principal must be allowed to assume the target role and must match the `IAMPrincipal` parameter of the scan role template (default: `role/prowler*`).
11. Click "Next", then "Launch Scan"
@@ -110,7 +110,7 @@ AWS accounts can also be configured using static credentials (not recommended fo
For detailed instructions on how to create the credentials, see [Authentication > Credentials](/user-guide/providers/aws/authentication#credentials).
-1. Complete the form in Prowler Cloud or Prowler App and click "Next"
+1. Complete the form in Prowler Cloud or Prowler Local Server and click "Next"
diff --git a/docs/user-guide/providers/aws/organizations.mdx b/docs/user-guide/providers/aws/organizations.mdx
index bbdedef50b..b48df1c442 100644
--- a/docs/user-guide/providers/aws/organizations.mdx
+++ b/docs/user-guide/providers/aws/organizations.mdx
@@ -2,10 +2,12 @@
title: 'AWS Organizations in Prowler'
---
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
<Info>
**Using Prowler Cloud?** You can onboard your entire AWS Organization through the UI with automatic account discovery, OU-aware tree selection, and bulk connection testing — no scripts or YAML files required.
-See [AWS Organizations in Prowler Cloud](/user-guide/tutorials/prowler-cloud-aws-organizations) for the full walkthrough.
+See [AWS Organizations](/user-guide/tutorials/prowler-cloud-aws-organizations) in Prowler Cloud for the full walkthrough.
</Info>
Prowler can integrate with AWS Organizations to manage the visibility and onboarding of accounts centrally.
@@ -71,11 +73,43 @@ The additional fields in CSV header output are as follows:
## Deploying Prowler IAM Roles Across AWS Organizations
+<VersionBadge version="5.35.0" />
+
When onboarding multiple AWS accounts into Prowler Cloud, it is important to deploy the Prowler Scan IAM Role in each account. The most efficient way to do this across an AWS Organization is by leveraging AWS CloudFormation StackSets, which rolls out infrastructure—like IAM roles—to all accounts centrally from the Management or Delegated Admin account.
-When using Infrastructure as Code (IaC), Terraform is recommended to manage this deployment systematically.
+### Native CloudFormation StackSet Deployment (Recommended)
-### Recommended Approach
+The [Prowler Scan IAM Role CloudFormation template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml) can deploy the role across your entire AWS Organization on its own—no third-party modules required. When launched in the **Management Account** (or a **Delegated Administrator** account) with `DeployStackSet=true` and `EnableOrganizations=true`, it creates a service-managed CloudFormation StackSet that rolls the ProwlerScan role out to every account under the target Organizational Unit (or the organization root), and keeps new accounts covered automatically through auto-deployment.
+
+To deploy from the CloudFormation console: open **CloudFormation → Create stack → With new resources**, choose **Upload a template file** and select `prowler-scan-role.yml` (or paste its S3 URL), then set the parameters below on the **Specify stack details** step. Leave the **Configure stack options** step at its defaults.
+
+Deploy a single CloudFormation Stack in the Management Account with the following parameters:
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `ExternalId` | External ID provided by Prowler Cloud to secure role assumption. | — |
+| `DeployLocalRole` | Create the ProwlerScan role in this (Management) account. | `true` |
+| `DeployStackSet` | Create a service-managed StackSet that deploys the role to member accounts. | `false` |
+| `AWSOrganizationalUnitId` | Target OU (`ou-xxxx-yyyyyyyy`) or organization root (`r-xxxx`) for the StackSet. Required when `DeployStackSet=true`. | `""` |
+| `DeployFromDelegatedAdmin` | Set to `true` when deploying from a Delegated Administrator account instead of the Management Account (uses `CallAs: DELEGATED_ADMIN`). | `false` |
+| `EnableOrganizations` | Add AWS Organizations permissions to the Management Account role: read-only account discovery plus the StackSet-management permissions the deployment needs. Set to `true` when deploying in the Management Account. | `false` |
+| `FailureTolerancePercentage` | Percentage of accounts in which the StackSet operation can fail before CloudFormation stops the operation. | `10` |
+| `RetainStacksOnAccountRemoval` | Keep the role in an account after it leaves the Organization or OU. | `false` |
+
+<Warning>
+On the review step, select **"I acknowledge that AWS CloudFormation might create IAM resources with custom names"** — the template provisions the named `ProwlerScan` IAM role, so the stack requires the `CAPABILITY_NAMED_IAM` capability and fails without this acknowledgment. (The quick-create link handles this for you.)
+</Warning>
+
+<Note>
+The service-managed StackSet does **not** deploy to the Management Account itself. Keeping `DeployLocalRole=true` ensures the role also exists there, so a single stack covers both the Management and member accounts.
+
+Trusted access for CloudFormation StackSets must be enabled in the Organization (see the note at the top of this page) before `DeployStackSet` will work.
+
+Deploying for the CLI or a self-hosted Prowler (not Prowler Cloud)? Also set `AccountId` to the account you assume the role from and `IAMPrincipal` to your identity — the defaults target Prowler Cloud. See [Aligning the trust policy with your identity](/user-guide/providers/aws/authentication#trust-policy-align-iamprincipal-with-your-identity).
+
+</Note>
+
+### Alternative: Deploy with Terraform
- **Use StackSets** from the **Management Account** (or a Delegated Admin/Security Account).
- **Use Terraform** to orchestrate the deployment.
diff --git a/docs/user-guide/providers/aws/regions-and-partitions.mdx b/docs/user-guide/providers/aws/regions-and-partitions.mdx
index 377612013e..8556ccc74e 100644
--- a/docs/user-guide/providers/aws/regions-and-partitions.mdx
+++ b/docs/user-guide/providers/aws/regions-and-partitions.mdx
@@ -64,7 +64,7 @@ When more than one source is set, precedence is:
3. `aws.disallowed_regions` in `config.yaml`
<Note>
-For self-hosted App or API-triggered scans, set `PROWLER_AWS_DISALLOWED_REGIONS` in the runtime environment of the backend scan containers such as `api` and `worker`. The `ui` container does not enforce AWS region selection.
+For Prowler Local Server or API-triggered scans, set `PROWLER_AWS_DISALLOWED_REGIONS` in the runtime environment of the backend scan containers such as `api` and `worker`. The `ui` container does not enforce AWS region selection.
</Note>
diff --git a/docs/user-guide/providers/aws/role-assumption.mdx b/docs/user-guide/providers/aws/role-assumption.mdx
index b714beafbd..54dd0e214a 100644
--- a/docs/user-guide/providers/aws/role-assumption.mdx
+++ b/docs/user-guide/providers/aws/role-assumption.mdx
@@ -77,6 +77,15 @@ The template requires the following parameters:
- **AccountId:** *(Optional)* AWS Account ID that will assume the role (default: Prowler Cloud account)
- **IAMPrincipal:** *(Optional)* The IAM principal allowed to assume the role (default: `role/prowler*`)
+<Warning>
+From the CLI you assume the role with **your own** identity, not from Prowler Cloud. The `AccountId` and `IAMPrincipal` defaults target Prowler Cloud, so set **`AccountId`** to the account you run Prowler from and **`IAMPrincipal`** to your identity (for example `role/<name>` or `user/<name>`). Otherwise `sts:AssumeRole` fails with `AccessDenied`. See [Aligning the trust policy with your identity](/user-guide/providers/aws/authentication#trust-policy-align-iamprincipal-with-your-identity).
+</Warning>
+
+<Note>
+To deploy the role across an entire AWS Organization from a single stack (Management Account role plus a service-managed StackSet for the member accounts), the template also accepts `DeployLocalRole`, `DeployStackSet`, `AWSOrganizationalUnitId`, `DeployFromDelegatedAdmin`, `EnableOrganizations`, `FailureTolerancePercentage`, and `RetainStacksOnAccountRemoval`. See [AWS Organizations in Prowler](/user-guide/providers/aws/organizations#native-cloudformation-stackset-deployment-recommended) for the full parameter reference.
+
+</Note>
+
When running Prowler CLI, include the External ID using the `-I/--external-id` flag:
```sh
diff --git a/docs/user-guide/providers/azure/authentication.mdx b/docs/user-guide/providers/azure/authentication.mdx
index 852e79d115..f41e9dd9b3 100644
--- a/docs/user-guide/providers/azure/authentication.mdx
+++ b/docs/user-guide/providers/azure/authentication.mdx
@@ -2,9 +2,9 @@
title: 'Azure Authentication in Prowler'
---
-Prowler for Azure supports multiple authentication types. Authentication methods vary between Prowler App and Prowler CLI:
+Prowler for Azure supports multiple authentication types. Authentication methods vary between Prowler Cloud and Prowler CLI:
-**Prowler App:**
+**Prowler Cloud:**
- [**Service Principal Application**](#service-principal-application-authentication-recommended)
@@ -210,13 +210,15 @@ For more detailed guidance on subscription management and permissions:
The following security checks require the `ProwlerRole` permissions for execution. Ensure the role is assigned to the identity assumed by Prowler before running these checks:
- `app_function_access_keys_configured`
+- `app_function_application_insights_enabled`
- `app_function_ftps_deployment_disabled`
+- `app_function_latest_runtime_version`
---
## Service Principal Application Authentication (Recommended)
-This method is required for Prowler App and recommended for Prowler CLI.
+This method is required for Prowler Cloud and recommended for Prowler CLI.
### Creating the Service Principal
For more information, see [Creating Prowler Service Principal](/user-guide/providers/azure/create-prowler-service-principal).
diff --git a/docs/user-guide/providers/azure/getting-started-azure.mdx b/docs/user-guide/providers/azure/getting-started-azure.mdx
index 66b3b14e3a..034e8eacfe 100644
--- a/docs/user-guide/providers/azure/getting-started-azure.mdx
+++ b/docs/user-guide/providers/azure/getting-started-azure.mdx
@@ -16,7 +16,7 @@ Government cloud subscriptions (Azure Government) are not currently supported, b
</Note>
### Prerequisites
-Before setting up Azure in Prowler App, you need to create a Service Principal with proper permissions.
+Before setting up Azure in Prowler Cloud, you need to create a Service Principal with proper permissions.
For detailed instructions on how to create the Service Principal and configure permissions, see [Authentication > Service Principal](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended).
@@ -34,12 +34,12 @@ For detailed instructions on how to create the Service Principal and configure p
### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Navigate to `Configuration` > `Providers`
-3. Click on `Add Provider`
+3. Click `Add Provider`
@@ -53,14 +53,14 @@ For detailed instructions on how to create the Service Principal and configure p
### Step 3: Add Credentials to Prowler Cloud
-For Azure, Prowler App uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](/user-guide/providers/azure/authentication). When you finish creating and adding the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
+For Azure, Prowler Cloud uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](/user-guide/providers/azure/authentication). When you finish creating and adding the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`
-2. Go to Prowler App and paste:
+2. Go to Prowler Cloud and paste:
- `Client ID`
- `Tenant ID`
diff --git a/docs/user-guide/providers/azure/resource-groups.mdx b/docs/user-guide/providers/azure/resource-groups.mdx
new file mode 100644
index 0000000000..0dbda18235
--- /dev/null
+++ b/docs/user-guide/providers/azure/resource-groups.mdx
@@ -0,0 +1,47 @@
+---
+title: 'Azure Resource Group Scope'
+---
+
+Prowler supports narrowing security scans to specific resource groups within Azure subscriptions. This is useful when you want to audit only a subset of resources rather than scanning an entire subscription.
+
+By default, Prowler scans all resource groups it has permission to access. Passing `--azure-resource-group` limits the scan to only the specified resource groups across all accessible subscriptions.
+
+## Configuring Resource Group Scoped Scans
+
+To restrict a scan to one or more resource groups, pass them as arguments using the `--azure-resource-group` flag:
+
+```console
+prowler azure --az-cli-auth --azure-resource-group <resource-group-1> <resource-group-2> ... <resource-group-N>
+```
+
+For example, to scan only `rg-production` and `rg-staging`:
+
+```console
+prowler azure --az-cli-auth --azure-resource-group rg-production rg-staging
+```
+
+This works with all supported authentication methods:
+
+```console
+# Service Principal
+prowler azure --sp-env-auth --azure-resource-group rg-production
+
+# Browser
+prowler azure --browser-auth --tenant-id <tenant-id> --azure-resource-group rg-production
+
+# Managed Identity
+prowler azure --managed-identity-auth --azure-resource-group rg-production
+```
+
+## How It Works
+
+When `--azure-resource-group` is provided, Prowler validates each specified resource group against all accessible subscriptions. A resource group is included in the scan if it exists in **at least one** subscription.
+
+- If a resource group is found in one or more subscriptions, it will be scanned in those subscriptions only.
+- If a resource group is **not found in any** subscription, Prowler logs a warning and skips it.
+- If **none** of the provided resource groups are found across any subscription, Prowler logs a warning and no resource group scoped checks will run.
+- Resource group names are matched case-insensitively, so `MyGroup` and `mygroup` are treated as the same group, mirroring Azure's own behavior.
+
+<Warning>
+If `--azure-resource-group` is used, checks that apply to specific resources are limited to the relevant resource groups. But if checks that apply to tenant or subscription scope (identity, policy, or subscription-level configuration checks) are involved, then these checks will run in their natural scope.
+</Warning>
diff --git a/docs/user-guide/providers/azure/subscriptions.mdx b/docs/user-guide/providers/azure/subscriptions.mdx
index 8fa6c73740..efd37c13e5 100644
--- a/docs/user-guide/providers/azure/subscriptions.mdx
+++ b/docs/user-guide/providers/azure/subscriptions.mdx
@@ -17,7 +17,7 @@ prowler azure --az-cli-auth --subscription-ids <subscription ID 1> <subscription
Prowler allows you to specify one or more subscriptions for scanning (up to N), enabling flexible audit configurations.
<Warning>
-The multi-subscription feature is available only in the CLI. In Prowler App, each scan is limited to a single subscription.
+The multi-subscription feature is available only in the CLI. In Prowler Cloud, each scan is limited to a single subscription.
</Warning>
## Assigning Permissions for Subscription Scans
diff --git a/docs/user-guide/providers/cloudflare/authentication.mdx b/docs/user-guide/providers/cloudflare/authentication.mdx
index fe69656a04..37e2ffafef 100644
--- a/docs/user-guide/providers/cloudflare/authentication.mdx
+++ b/docs/user-guide/providers/cloudflare/authentication.mdx
@@ -56,8 +56,8 @@ Template URLs only pre-fill the token creation form. Review the permissions, con
### Step 1: Create a User API Token
1. Log into the [Cloudflare Dashboard](https://dash.cloudflare.com).
-2. Click on the profile icon in the top right corner, then select "My Profile".
-3. Click on the **API Tokens** tab.
+2. Click the profile icon in the top right corner, then select "My Profile".
+3. Click the **API Tokens** tab.
4. Click **Create Token**, then select **Create Custom Token** at the bottom of the page.
5. Configure the token with the following settings:
- **Token name:** A descriptive name (e.g., "Prowler Security Scanner")
@@ -102,8 +102,8 @@ API Keys provide full access to the Cloudflare account. While supported, this me
### Step 1: Get the Global API Key
1. Log into the [Cloudflare Dashboard](https://dash.cloudflare.com).
-2. Click on the profile icon in the top right corner, then select "My Profile".
-3. Click on the **API Tokens** tab.
+2. Click the profile icon in the top right corner, then select "My Profile".
+3. Click the **API Tokens** tab.
4. Scroll down to the **API Keys** section.
5. Click **View** next to **Global API Key**.
6. Enter the account password to reveal the key, then copy it.
diff --git a/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx b/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx
index c4303b4d50..9af3dbe589 100644
--- a/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx
+++ b/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx
@@ -50,7 +50,7 @@ The Account ID is a 32-character hexadecimal string (e.g., `372e67954025e0ba6aaa
### Step 2: Open Prowler Cloud
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Navigate to "Configuration" > "Providers".
diff --git a/docs/user-guide/providers/e2enetworks/authentication.mdx b/docs/user-guide/providers/e2enetworks/authentication.mdx
new file mode 100644
index 0000000000..67d031861d
--- /dev/null
+++ b/docs/user-guide/providers/e2enetworks/authentication.mdx
@@ -0,0 +1,99 @@
+---
+title: "E2E Networks Authentication in Prowler"
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.34.0" />
+
+Prowler for E2E Networks authenticates against the E2E Networks MyAccount API using an **API key**, an **auth token**, and a numeric **project ID**. Set the API key and auth token as environment variables to avoid exposing secrets in shell history or process listings. Compatibility CLI flags are still accepted, but Prowler warns when secret values are passed directly on the command line.
+
+## Required Credentials
+
+Prowler requires read access to the E2E Networks project. The following values are needed:
+
+| Credential | Environment Variable | Description |
+|------------|----------------------|-------------|
+| API Key | `E2E_NETWORKS_API_KEY` | Identifies the MyAccount API key used for requests |
+| Auth Token | `E2E_NETWORKS_AUTH_TOKEN` | Bearer token authorizing the API key |
+| Project ID | `E2E_NETWORKS_PROJECT_ID` | Numeric ID of the project to scan |
+| Region | `E2E_NETWORKS_REGION` | Optional region to scan (defaults to all regions: Delhi, Chennai) |
+
+<Warning>
+The project ID must be an integer. A missing or non-numeric project ID stops the scan before any resource is read.
+</Warning>
+
+---
+
+## API Credentials
+
+### Step 1: Create the API Key and Auth Token
+
+1. Log into the [E2E Networks MyAccount portal](https://myaccount.e2enetworks.com).
+2. Open the **API Tokens** section under the account settings.
+3. Create a new API token and copy both the API key and the auth token.
+4. Copy the values immediately — the auth token is not shown again.
+
+### Step 2: Find the Project ID
+
+Select the target project in MyAccount and copy its numeric project ID from the project settings or the API context.
+
+### Step 3: Configure Authentication
+
+Export the credentials as environment variables:
+
+```bash
+export E2E_NETWORKS_API_KEY="your-api-key"
+export E2E_NETWORKS_AUTH_TOKEN="your-auth-token"
+export E2E_NETWORKS_PROJECT_ID="your-project-id"
+```
+
+Then run Prowler:
+
+```bash
+prowler e2enetworks
+```
+
+---
+
+## Verifying Authentication
+
+To confirm that Prowler can reach the E2E Networks project, run a scan against a single location:
+
+```bash
+prowler e2enetworks --region Delhi
+```
+
+A successful run reports findings for the discovered resources. A failed run displays an error message indicating the credential or connectivity issue.
+
+---
+
+## CI/CD Integration
+
+For automated pipelines, set the credentials as secret environment variables:
+
+**GitHub Actions:**
+
+```yaml
+env:
+ E2E_NETWORKS_API_KEY: ${{ secrets.E2E_NETWORKS_API_KEY }}
+ E2E_NETWORKS_AUTH_TOKEN: ${{ secrets.E2E_NETWORKS_AUTH_TOKEN }}
+ E2E_NETWORKS_PROJECT_ID: ${{ secrets.E2E_NETWORKS_PROJECT_ID }}
+
+steps:
+ - name: Run Prowler
+ run: prowler e2enetworks
+```
+
+**GitLab CI:**
+
+```yaml
+variables:
+ E2E_NETWORKS_API_KEY: $E2E_NETWORKS_API_KEY
+ E2E_NETWORKS_AUTH_TOKEN: $E2E_NETWORKS_AUTH_TOKEN
+ E2E_NETWORKS_PROJECT_ID: $E2E_NETWORKS_PROJECT_ID
+
+prowler_scan:
+ script:
+ - prowler e2enetworks
+```
diff --git a/docs/user-guide/providers/e2enetworks/getting-started-e2enetworks.mdx b/docs/user-guide/providers/e2enetworks/getting-started-e2enetworks.mdx
new file mode 100644
index 0000000000..6b67f4e32c
--- /dev/null
+++ b/docs/user-guide/providers/e2enetworks/getting-started-e2enetworks.mdx
@@ -0,0 +1,66 @@
+---
+title: 'Getting Started With E2E Networks on Prowler'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.34.0" />
+
+Prowler for E2E Networks scans E2E Networks infrastructure for security misconfigurations across compute nodes, networking, security groups, load balancers, storage, and managed databases.
+
+<Note>
+E2E Networks support in Prowler is community-maintained. For commercial support or to request additional service coverage, [contact us](https://prowler.com/contact).
+</Note>
+
+## Prerequisites
+
+Set up authentication for E2E Networks with the [E2E Networks Authentication](/user-guide/providers/e2enetworks/authentication) guide before starting:
+
+- Create an E2E Networks API key and auth token from the MyAccount API Tokens section
+- Note the numeric project ID of the project to scan
+
+## Prowler CLI
+
+### Run Prowler for E2E Networks
+
+Once authenticated, export the credentials as environment variables and run Prowler for E2E Networks. Environment variables keep secrets out of shell history and process listings:
+
+```bash
+export E2E_NETWORKS_API_KEY="your-api-key"
+export E2E_NETWORKS_AUTH_TOKEN="your-auth-token"
+export E2E_NETWORKS_PROJECT_ID="your-project-id"
+prowler e2enetworks
+```
+
+### Run Specific Checks
+
+```bash
+prowler e2enetworks --checks node_encryption_enabled storage_block_volume_not_orphaned
+```
+
+### Run a Specific Service
+
+```bash
+prowler e2enetworks --services node
+```
+
+### Scan Specific Regions
+
+Use `--region` (aliases `--filter-region` and `-f`) to limit the scan to one or more E2E Networks regions. When the flag is omitted, Prowler reads `E2E_NETWORKS_REGION` and otherwise scans all regions (Delhi, Chennai).
+
+```bash
+prowler e2enetworks --region Delhi Chennai
+```
+
+## Available Services
+
+Prowler for E2E Networks currently supports the following services:
+
+| Service | Description |
+|---------|-------------|
+| `database` | Managed database clusters and their backup, network, and encryption settings |
+| `loadbalancer` | Application load balancers and their TLS, health-check, and protection settings |
+| `network` | Virtual Private Clouds, peering, and reserved public IP addresses |
+| `node` | Compute nodes and their encryption, protection, and network configuration |
+| `securitygroup` | Security groups and their inbound and default traffic rules |
+| `storage` | Block volumes and file storage (EFS/EPFS) with their protection settings |
diff --git a/docs/user-guide/providers/gcp/authentication.mdx b/docs/user-guide/providers/gcp/authentication.mdx
index ec53445c84..ce01c1ba23 100644
--- a/docs/user-guide/providers/gcp/authentication.mdx
+++ b/docs/user-guide/providers/gcp/authentication.mdx
@@ -55,7 +55,7 @@ This method uses the Google Cloud CLI to authenticate and is suitable for develo
### Setup Application Default Credentials
-1. In the [GCP Console](https://console.cloud.google.com/), click on "Activate Cloud Shell"
+1. In the [GCP Console](https://console.cloud.google.com/), click "Activate Cloud Shell"
@@ -89,7 +89,7 @@ This method uses the Google Cloud CLI to authenticate and is suitable for develo
-8. Extract the following values for Prowler Cloud/App:
+8. Extract the following values for Prowler Cloud or Prowler Local Server:
- `client_id`
- `client_secret`
diff --git a/docs/user-guide/providers/gcp/getting-started-gcp.mdx b/docs/user-guide/providers/gcp/getting-started-gcp.mdx
index e16114e19a..f40542a151 100644
--- a/docs/user-guide/providers/gcp/getting-started-gcp.mdx
+++ b/docs/user-guide/providers/gcp/getting-started-gcp.mdx
@@ -13,7 +13,7 @@ title: 'Getting Started With GCP on Prowler'
### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"
@@ -66,7 +66,7 @@ For Google Cloud, first enter your `GCP Project ID` and then select the authenti
2. Once authenticated, get the `Client ID`, `Client Secret` and `Refresh Token` from `~/.config/gcloud/application_default_credentials`.
- 3. Paste the `Client ID`, `Client Secret` and `Refresh Token` into Prowler App.
+ 3. Paste the `Client ID`, `Client Secret` and `Refresh Token` into Prowler Cloud.
<img src="/images/gcp-credentials.png" alt="GCP Credentials" width="700" />
diff --git a/docs/user-guide/providers/github/authentication.mdx b/docs/user-guide/providers/github/authentication.mdx
index 0b5ab6b720..1546bf284a 100644
--- a/docs/user-guide/providers/github/authentication.mdx
+++ b/docs/user-guide/providers/github/authentication.mdx
@@ -12,7 +12,7 @@ Prowler offers three authentication methods. Fine-Grained Personal Access Tokens
| Method | Best For | Key Benefit |
|--------|----------|-------------|
-| [**Fine-Grained Personal Access Token**](#fine-grained-personal-access-token-recommended) | Individual users, quick setup | Simple, user-scoped access |
+| [**Fine-Grained Personal Access Token**](#fine-grained-personal-access-token-recommended-for-individual-use) | Individual users, quick setup | Simple, user-scoped access |
| [**GitHub App**](#github-app-credentials) | Organizations, automation, CI/CD | Organization-scoped, no personal account dependency |
| [**OAuth App Token**](#oauth-app-token) | Delegated user authorization | User-consented access flows |
@@ -271,7 +271,7 @@ Store the `.pem` private key securely. Anyone with this key can authenticate as
## Prowler Cloud Authentication
-For step-by-step setup instructions for Prowler Cloud, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloudapp).
+For step-by-step setup instructions for Prowler Cloud, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloud-and-prowler-local-server).
### Using Personal Access Token
@@ -301,7 +301,7 @@ For step-by-step setup instructions for Prowler Cloud, see the [Getting Started
3. Enter your GitHub App ID and upload the private key (`.pem` file).
-For complete step-by-step instructions, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloudapp).
+For complete step-by-step instructions, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloud-and-prowler-local-server).
---
diff --git a/docs/user-guide/providers/github/getting-started-github.mdx b/docs/user-guide/providers/github/getting-started-github.mdx
index 079f9a1d7b..09acdfe0c9 100644
--- a/docs/user-guide/providers/github/getting-started-github.mdx
+++ b/docs/user-guide/providers/github/getting-started-github.mdx
@@ -16,7 +16,7 @@ Prowler can scan either:
</Note>
<CardGroup cols={2}>
- <Card title="Prowler Cloud/App" icon="cloud" href="#prowler-cloudapp">
+ <Card title="Prowler Cloud & Local Server" icon="cloud" href="#prowler-cloud-and-prowler-local-server">
Web-based interface with centralized management
</Card>
<Card title="Prowler CLI" icon="terminal" href="#prowler-cli">
@@ -26,7 +26,7 @@ Prowler can scan either:
---
-## Prowler Cloud/App
+## Prowler Cloud and Prowler Local Server
<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/9ETI84Xpu2g" title="Prowler Cloud Onboarding Github" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
@@ -34,7 +34,7 @@ Prowler can scan either:
### Prerequisites
-Before adding GitHub to Prowler Cloud/App, ensure you have:
+Before adding GitHub to Prowler Cloud or Prowler Local Server, ensure you have:
1. **GitHub Account Access**
- Personal GitHub account, OR
@@ -46,9 +46,9 @@ Before adding GitHub to Prowler Cloud/App, ensure you have:
- OAuth App Token
- GitHub App Credentials (Not Recommended - limited data access)
-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to **Configuration** → **Providers**
diff --git a/docs/user-guide/providers/googleworkspace/getting-started-googleworkspace.mdx b/docs/user-guide/providers/googleworkspace/getting-started-googleworkspace.mdx
index 8931c43ebd..01e6e89986 100644
--- a/docs/user-guide/providers/googleworkspace/getting-started-googleworkspace.mdx
+++ b/docs/user-guide/providers/googleworkspace/getting-started-googleworkspace.mdx
@@ -42,7 +42,7 @@ The Customer ID starts with the letter "C" followed by alphanumeric characters (
### Step 2: Open Prowler Cloud
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Navigate to "Configuration" > "Providers".
diff --git a/docs/user-guide/providers/iac/getting-started-iac.mdx b/docs/user-guide/providers/iac/getting-started-iac.mdx
index d1e978dc75..9a941c633d 100644
--- a/docs/user-guide/providers/iac/getting-started-iac.mdx
+++ b/docs/user-guide/providers/iac/getting-started-iac.mdx
@@ -24,7 +24,7 @@ Prowler IaC provider scans the following Infrastructure as Code configurations f
## How It Works
-- Prowler App leverages [Trivy](https://trivy.dev/docs/latest/guide/coverage/iac/#scanner) to scan local directories (or specified paths) for supported IaC files, or scans remote repositories.
+- Prowler Cloud leverages [Trivy](https://trivy.dev/docs/latest/guide/coverage/iac/#scanner) to scan local directories (or specified paths) for supported IaC files, or scans remote repositories.
- No cloud credentials or authentication are required for local scans.
- For remote repository scans, authentication can be provided via [git URL](https://git-scm.com/docs/git-clone#_git_urls), CLI flags or environment variables.
- Check the [IaC Authentication](/user-guide/providers/iac/authentication) page for more details.
@@ -37,11 +37,11 @@ Prowler IaC provider scans the following Infrastructure as Code configurations f
### Supported Scanners
-Scanner selection is not configurable in Prowler App. Default scanners, misconfig and secret, run automatically during each scan.
+Scanner selection is not configurable in Prowler Cloud. Default scanners, misconfig and secret, run automatically during each scan.
-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"
diff --git a/docs/user-guide/providers/image/getting-started-image.mdx b/docs/user-guide/providers/image/getting-started-image.mdx
index b9c305d0ef..6382f10e5c 100644
--- a/docs/user-guide/providers/image/getting-started-image.mdx
+++ b/docs/user-guide/providers/image/getting-started-image.mdx
@@ -33,7 +33,7 @@ Prowler Cloud does not support scanner selection. The vulnerability, secret, and
### Step 1: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Navigate to "Configuration" > "Providers"
diff --git a/docs/user-guide/providers/kubernetes/getting-started-k8s.mdx b/docs/user-guide/providers/kubernetes/getting-started-k8s.mdx
index 9ca791110f..c62ec2b8a1 100644
--- a/docs/user-guide/providers/kubernetes/getting-started-k8s.mdx
+++ b/docs/user-guide/providers/kubernetes/getting-started-k8s.mdx
@@ -4,9 +4,9 @@ title: 'Getting Started with Kubernetes'
## Prowler Cloud
-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
2. Go to "Configuration" > "Providers"
@@ -21,7 +21,11 @@ title: 'Getting Started with Kubernetes'
### Step 2: Configure Kubernetes Authentication
-For Kubernetes, Prowler App uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.
+For Kubernetes, Prowler Cloud uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.
+
+<Note>
+Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud or Prowler Local Server. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
+</Note>
By default, the `kubeconfig` file is located at `~/.kube/config`.
diff --git a/docs/user-guide/providers/linode/authentication.mdx b/docs/user-guide/providers/linode/authentication.mdx
index feac121f40..3ebb7ef326 100644
--- a/docs/user-guide/providers/linode/authentication.mdx
+++ b/docs/user-guide/providers/linode/authentication.mdx
@@ -29,7 +29,7 @@ Ensure the token has all required scopes. Missing permissions will cause some ch
### Step 1: Create a Personal Access Token
1. Log into the [Linode Cloud Manager](https://cloud.linode.com).
-2. Click on your username in the top-right corner, then select **API Tokens** under the "My Profile" section.
+2. Click your username in the top-right corner, then select **API Tokens** under the "My Profile" section.
3. Click **Create a Personal Access Token**.
4. Configure the token:
- **Label:** A descriptive name (e.g., "Prowler Security Scanner")
diff --git a/docs/user-guide/providers/microsoft365/getting-started-m365.mdx b/docs/user-guide/providers/microsoft365/getting-started-m365.mdx
index a21b796b5c..fd791cbbca 100644
--- a/docs/user-guide/providers/microsoft365/getting-started-m365.mdx
+++ b/docs/user-guide/providers/microsoft365/getting-started-m365.mdx
@@ -41,7 +41,7 @@ Set up authentication for Microsoft 365 with the [Microsoft 365 Authentication](
### Step 2: Open Prowler Cloud
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Navigate to "Configuration" > "Providers".
diff --git a/docs/user-guide/providers/mongodbatlas/getting-started-mongodbatlas.mdx b/docs/user-guide/providers/mongodbatlas/getting-started-mongodbatlas.mdx
index c68bfac9c2..2fb415a11b 100644
--- a/docs/user-guide/providers/mongodbatlas/getting-started-mongodbatlas.mdx
+++ b/docs/user-guide/providers/mongodbatlas/getting-started-mongodbatlas.mdx
@@ -15,12 +15,12 @@ Before you begin, make sure you have:
3. An **API Key pair** (public and private keys) with appropriate permissions:
- **Organization Read Only**: Provides read-only access to everything in the organization, including all projects in the organization. This permission is sufficient for most security checks.
- **Organization Owner**: Required to audit the [Auditing configuration](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/group/endpoint-auditing) for projects. Database auditing tracks database operations and security events, including authentication attempts, data definition language (DDL) changes, user and role modifications, and privilege grants. This configuration is essential for security monitoring, forensics, and compliance. Without **Organization Owner** permission, the `projects_auditing_enabled` check cannot retrieve the audit configuration status.
-4. Prowler App access (cloud or self-hosted) or the Prowler CLI (`pip install prowler`).
+4. Access to Prowler Cloud or Prowler Local Server, or Prowler CLI (`pip install prowler`).
For detailed instructions on creating API keys, see the [MongoDB Atlas authentication guide](./authentication.mdx).
<Warning>
-If **Require IP Access List for the Atlas Administration API** is enabled in your organization settings, you **must** add the IP address of the host running Prowler (or the public IP of Prowler Cloud) to the organization IP Access List or Atlas will reject every API call. You can manage this under **Settings → Organization Settings → Security**. See step 7 of the [authentication guide](./authentication.mdx) for detailed instructions, and refer to the [Prowler Cloud public IP list](../../tutorials/prowler-cloud-public-ips) when using Prowler Cloud.
+If **Require IP Access List for the Atlas Administration API** is enabled in the organization settings, add the IP address of the host running Prowler (or the public IP of Prowler Cloud) to the organization IP Access List or Atlas will reject every API call. Manage this under **Settings → Organization Settings → Security**. See step 7 of the [authentication guide](./authentication.mdx) for detailed instructions, and refer to the [Prowler Cloud egress IPs](/security/networking) when using Prowler Cloud.
</Warning>
<CardGroup cols={2}>
@@ -53,7 +53,7 @@ If **Require IP Access List for the Atlas Administration API** is enabled in you
### Step 3: Test the connection and start scanning
-1. Click **Test connection** to ensure Prowler App can reach the Atlas API.
+1. Click **Test connection** to ensure Prowler Cloud can reach the Atlas API.
2. Save the credentials. The provider will appear in the list with its current connection status.
3. Launch a scan from the provider row or from the **Scans** page.
@@ -108,6 +108,6 @@ prowler mongodbatlas --atlas-project-id <project-id>
- Combine flags (for example, `--checks` or `--services`) just like with other providers.
- Use `--output-modes` to export findings in JSON, CSV, ASFF, etc.
-- Rotate API keys regularly and update the stored credentials in Prowler App to maintain connectivity.
+- Rotate API keys regularly and update the stored credentials in Prowler Cloud to maintain connectivity.
For more examples (filters, outputs, scheduling), refer back to the [MongoDB Atlas documentation hub](./authentication.mdx) and the main Prowler CLI usage guide.
diff --git a/docs/user-guide/providers/oci/authentication.mdx b/docs/user-guide/providers/oci/authentication.mdx
index f977a80eb2..9627e88cd4 100644
--- a/docs/user-guide/providers/oci/authentication.mdx
+++ b/docs/user-guide/providers/oci/authentication.mdx
@@ -55,7 +55,7 @@ After running `oci session authenticate`, you need to manually add your user OCI
**Get your user OCID from the OCI Console:**
-Navigate to: **Identity & Security** → **Users** → Click on your username → Copy the OCID
+Navigate to: **Identity & Security** → **Users** → Click your username → Copy the OCID
diff --git a/docs/user-guide/providers/oci/getting-started-oci.mdx b/docs/user-guide/providers/oci/getting-started-oci.mdx
index fc9fb620bf..2f610cd09c 100644
--- a/docs/user-guide/providers/oci/getting-started-oci.mdx
+++ b/docs/user-guide/providers/oci/getting-started-oci.mdx
@@ -6,7 +6,7 @@ Prowler supports security scanning of Oracle Cloud Infrastructure (OCI) environm
## Prowler Cloud
-The following steps apply to Prowler Cloud and the self-hosted Prowler App.
+The following steps apply to Prowler Cloud and Prowler Local Server.
### Step 1: Collect OCI Identifiers
1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
@@ -15,14 +15,14 @@ The following steps apply to Prowler Cloud and the self-hosted Prowler App.
4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).
### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Go to **Configuration** → **Providers** and click **Add Provider**.
3. Select **Oracle Cloud** and enter the **Tenancy OCID** and an optional alias, then choose **Next**.
### Step 3: Add OCI API Key Credentials
-Prowler App connects to OCI with API key credentials. Provide:
+Prowler Cloud connects to OCI with API key credentials. Provide:
- **User OCID** for the API key owner
- **Fingerprint** of the API key
@@ -78,7 +78,7 @@ The easiest and most secure method is using OCI session authentication, which au
**Get your user OCID from the OCI Console:**
- Navigate to: **Identity & Security** → **Users** → Click on your username → Copy the OCID
+ Navigate to: **Identity & Security** → **Users** → Click your username → Copy the OCID
diff --git a/docs/user-guide/providers/okta/authentication.mdx b/docs/user-guide/providers/okta/authentication.mdx
index 2e08cac8af..8f664160a2 100644
--- a/docs/user-guide/providers/okta/authentication.mdx
+++ b/docs/user-guide/providers/okta/authentication.mdx
@@ -20,7 +20,7 @@ Prowler authenticates to Okta as a **service application** using **OAuth 2.0 wit
| Method | Status | Use Case |
|---|---|---|
-| **OAuth 2.0 (private-key JWT)** | Supported | Production scans, CI/CD, Prowler App. |
+| **OAuth 2.0 (private-key JWT)** | Supported | Production scans, CI/CD, Prowler Cloud. |
The private-key JWT flow is the only supported authentication method in the initial release. The service application proves possession of a private key on every token request; Okta returns a short-lived access token, refreshed automatically by the SDK.
diff --git a/docs/user-guide/providers/okta/getting-started-okta.mdx b/docs/user-guide/providers/okta/getting-started-okta.mdx
index e04e0d4a13..dbe63807d7 100644
--- a/docs/user-guide/providers/okta/getting-started-okta.mdx
+++ b/docs/user-guide/providers/okta/getting-started-okta.mdx
@@ -30,7 +30,7 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid
### Step 1: Add the Provider
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Navigate to "Configuration" > "Providers".
diff --git a/docs/user-guide/providers/okta/retry-configuration.mdx b/docs/user-guide/providers/okta/retry-configuration.mdx
new file mode 100644
index 0000000000..1575cf6329
--- /dev/null
+++ b/docs/user-guide/providers/okta/retry-configuration.mdx
@@ -0,0 +1,123 @@
+---
+title: "Okta Rate Limit Configuration in Prowler"
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.32.0" />
+
+Prowler's Okta Provider manages API rate limits with two complementary controls:
+
+- **Request throttling (proactive):** Prowler paces outbound requests through a shared limiter so scans stay under Okta's rate limits and rarely trigger a rate-limit response in the first place.
+- **Retries (reactive):** When Okta still returns a rate-limit response (HTTP 429), the official Okta Python SDK reads the `X-Rate-Limit-Reset` header and waits until the window resets before retrying. This acts as a safety net for occasional bursts.
+
+Both controls are configurable through the configuration file or command line flags.
+
+## Request Throttling (Requests per Second)
+
+Throttling is the primary control for avoiding rate limits. Prowler limits the aggregate number of Okta API requests per second across every service in a scan.
+
+### Using the Command Line Flag
+
+```bash
+prowler okta --okta-requests-per-second 4
+```
+
+Set the value to `0` to disable throttling.
+
+### Using the Configuration File
+
+```yaml
+okta:
+ # Maximum aggregate Okta API requests per second. Default: 4. Set to 0 to disable.
+ okta_requests_per_second: 4
+```
+
+Okta enforces rate limits per endpoint, so this single global cap is a deliberately simple control. Lower the value if scans still hit limits on large organizations; raise it to scan faster when the organization has generous limits.
+
+## Retries
+
+Retries cover the cases throttling does not prevent, such as short bursts or per-endpoint limits lower than the global cap.
+
+### Using the Command Line Flag
+
+```bash
+prowler okta --okta-retries-max-attempts 8
+```
+
+### Using the Configuration File
+
+```yaml
+okta:
+ # Maximum retries on HTTP 429. Default: 5.
+ okta_max_retries: 8
+ # Per-request timeout in seconds. Default: 300.
+ okta_request_timeout: 300
+```
+
+The command line flags override the configuration file values.
+
+## How It Works
+
+- **Automatic detection:** The Okta SDK retries the retryable statuses 429, 503, and 504.
+- **Reset-aware backoff:** On a 429 response the SDK sleeps until the `X-Rate-Limit-Reset` window before each retry, rather than using a fixed delay.
+- **Bounded attempts:** `okta_max_retries` caps how many times a single request is retried. The Okta SDK default is 2, which is often too low for large organizations, so Prowler defaults to 5.
+
+## Request Timeout
+
+The `okta_request_timeout` setting plays a dual role in the Okta SDK:
+
+- It is the per-request socket timeout, bounding how long a single HTTP call can hang.
+- It is also the total wall-clock budget for the whole retry-and-backoff loop of one request.
+
+For this reason, the value defaults to 300 seconds rather than 0 (no timeout). A value of 0 leaves hung connections unbounded, while a value that is too low cuts the rate-limit waits short and reintroduces the errors. As a guideline, keep `okta_request_timeout` greater than or equal to `okta_max_retries` multiplied by 60 when raising the retry count, because Okta reset windows are typically up to one minute.
+
+## Error Example Handled
+
+```
+Okta HTTP 429: Too Many Requests. Hit rate limit. Retry request in 42 seconds.
+```
+
+## Validation
+
+### Debug Logging
+
+To confirm that throttling and retries are active, run a scan with debug logging:
+
+```bash
+prowler okta --okta-requests-per-second 4 --log-level DEBUG --log-file debuglogs.txt
+```
+
+### Check the Messages
+
+```bash
+grep -i "throttling\|rate limit\|retry" debuglogs.txt
+```
+
+### Expected Output
+
+When throttling is enabled, Prowler logs the configured rate at startup:
+
+```
+Okta request throttling enabled at 4 req/s
+```
+
+If a rate limit is still hit, the SDK logs the backoff:
+
+```
+Hit rate limit. Retry request in 42 seconds.
+```
+
+## Troubleshooting
+
+If scans continue to hit rate limits:
+
+1. Lower `--okta-requests-per-second` so requests are paced more conservatively.
+2. Raise `--okta-retries-max-attempts` (and keep `okta_request_timeout` proportionally large) so the safety net absorbs more bursts.
+3. Review the rate-limit allocation for the Okta organization and request an increase if needed.
+4. Verify throttling and retry behavior with debug logging.
+
+## Official References
+
+- [Okta Rate Limits](https://developer.okta.com/docs/reference/rate-limits/)
+- [Okta SDK for Python](https://github.com/okta/okta-sdk-python)
diff --git a/docs/user-guide/providers/vercel/getting-started-vercel.mdx b/docs/user-guide/providers/vercel/getting-started-vercel.mdx
index c39c5f1e6a..da02019b6f 100644
--- a/docs/user-guide/providers/vercel/getting-started-vercel.mdx
+++ b/docs/user-guide/providers/vercel/getting-started-vercel.mdx
@@ -28,7 +28,7 @@ Set up authentication for Vercel with the [Vercel Authentication](/user-guide/pr
### Step 1: Add the Provider
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
2. Navigate to "Configuration" > "Providers".
diff --git a/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx
index 88a084dd17..188ac3540d 100644
--- a/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx
+++ b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx
@@ -9,9 +9,9 @@ The tool, `aws_org_generator.py`, complements the [Bulk Provider Provisioning
<Note>
**Native AWS Organizations support is now available in Prowler Cloud.** You can onboard all accounts via the UI wizard — with automatic discovery, hierarchical tree selection, connection testing, and bulk scan launch — without any scripts or YAML files.
-See [AWS Organizations in Prowler Cloud](/user-guide/tutorials/prowler-cloud-aws-organizations).
+See [AWS Organizations](/user-guide/tutorials/prowler-cloud-aws-organizations) in Prowler Cloud.
-The CLI-based tool below remains useful for self-hosted Prowler App and advanced automation scenarios.
+The CLI-based tool below remains useful for Prowler Local Server and advanced automation scenarios.
</Note>
{/* TODO: Add screenshot of the tool in action */}
@@ -32,9 +32,9 @@ The AWS Organizations Bulk Provisioning tool simplifies multi-account onboarding
* Python 3.7 or higher
* AWS credentials with Organizations read access
* ProwlerRole (or custom role) deployed across all target accounts
-* Prowler API key (from Prowler Cloud or self-hosted Prowler App)
- * For self-hosted Prowler App, remember to [point to your API base URL](./bulk-provider-provisioning#custom-api-endpoints)
- * Learn how to create API keys: [Prowler App API Keys](../tutorials/prowler-app-api-keys)
+* Prowler API key (from Prowler Cloud or Prowler Local Server)
+ * For Prowler Local Server, remember to [point to your API base URL](./bulk-provider-provisioning#custom-api-endpoints)
+ * Learn how to create API keys: [Prowler Cloud API Keys](../tutorials/prowler-app-api-keys)
### Deploying ProwlerRole Across AWS Organizations
@@ -97,13 +97,13 @@ export PROWLER_API_KEY="pk_example-api-key"
To create an API key:
-1. Log in to Prowler Cloud or Prowler App
+1. Log in to Prowler Cloud or Prowler Local Server
2. Click **Profile** → **Account**
3. Click **Create API Key**
4. Provide a descriptive name and optionally set an expiration date
5. Copy the generated API key (it will only be shown once)
-For detailed instructions, see: [Prowler App API Keys](../tutorials/prowler-app-api-keys)
+For detailed instructions, see: [Prowler Cloud API Keys](../tutorials/prowler-app-api-keys)
## Basic Usage
@@ -272,6 +272,8 @@ python aws_org_generator.py \
4. Deploy to all organizational units
5. Use a unique external ID (e.g., `prowler-org-2024-abc123`)
+ Alternatively, deploy the same template as a **single stack** with `DeployStackSet=true` and `AWSOrganizationalUnitId` set to your root/OU ID — it creates the StackSet for you. See [Native CloudFormation StackSet Deployment](../providers/aws/organizations#native-cloudformation-stackset-deployment-recommended).
+
{/* TODO: Add screenshot of CloudFormation StackSets deployment */}
</Step>
@@ -324,7 +326,7 @@ python aws_org_generator.py \
</Step>
<Step title="Run Bulk Provisioning">
- Provision all accounts to Prowler Cloud or Prowler App:
+ Provision all accounts to Prowler Cloud or Prowler Local Server:
```bash
# Set Prowler API key
@@ -487,7 +489,7 @@ grep "provider: aws" aws-org-accounts.yaml | wc -l
<Card title="Bulk Provider Provisioning" icon="terminal" href="/user-guide/tutorials/bulk-provider-provisioning">
Learn how to bulk provision providers in Prowler.
</Card>
- <Card title="Prowler App" icon="pen-to-square" href="/user-guide/tutorials/prowler-app">
+ <Card title="Prowler Cloud" icon="pen-to-square" href="/user-guide/tutorials/prowler-app">
Detailed instructions on how to use Prowler.
</Card>
</Columns>
diff --git a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx
index 3ad5d9c0d5..cc759b6f85 100644
--- a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx
+++ b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx
@@ -10,7 +10,7 @@ The tool is available in the Prowler repository at: [util/prowler-bulk-provision
## Overview
-The Bulk Provider Provisioning tool automates the creation of cloud providers in Prowler App or Prowler Cloud by:
+The Bulk Provider Provisioning tool automates the creation of cloud providers in Prowler Cloud or Prowler Local Server by:
* Reading provider configurations from YAML files
* Creating providers with appropriate authentication credentials
@@ -26,9 +26,9 @@ The Bulk Provider Provisioning tool automates the creation of cloud providers in
### Requirements
* Python 3.7 or higher
-* Prowler API key (from Prowler Cloud or self-hosted Prowler App)
- * For self-hosted Prowler App, remember to [point to your API base URL](#custom-api-endpoints)
- * Learn how to create API keys: [Prowler App API Keys](../tutorials/prowler-app-api-keys)
+* Prowler API key (from Prowler Cloud or Prowler Local Server)
+ * For Prowler Local Server, remember to [point to your API base URL](#custom-api-endpoints)
+ * Learn how to create API keys: [Prowler Cloud API Keys](../tutorials/prowler-app-api-keys)
* Authentication credentials for target cloud providers
### Installation
@@ -51,13 +51,13 @@ export PROWLER_API_KEY="pk_example-api-key"
To create an API key:
-1. Log in to Prowler Cloud or Prowler App
+1. Log in to Prowler Cloud or Prowler Local Server
2. Click **Profile** → **Account**
3. Click **Create API Key**
4. Provide a descriptive name and optionally set an expiration date
5. Copy the generated API key (it will only be shown once)
-For detailed instructions, see: [Prowler App API Keys](../tutorials/prowler-app-api-keys)
+For detailed instructions, see: [Prowler Cloud API Keys](../tutorials/prowler-app-api-keys)
## Configuration File Structure
@@ -261,7 +261,7 @@ python prowler_bulk_provisioning.py providers.yaml --concurrency 10
### Custom API Endpoints
-For self-hosted Prowler App installations:
+For Prowler Local Server installations:
```bash
python prowler_bulk_provisioning.py providers.yaml \
diff --git a/docs/user-guide/tutorials/prowler-alerts.mdx b/docs/user-guide/tutorials/prowler-alerts.mdx
index 3fa49f84ff..fc205b72be 100644
--- a/docs/user-guide/tutorials/prowler-alerts.mdx
+++ b/docs/user-guide/tutorials/prowler-alerts.mdx
@@ -1,17 +1,17 @@
---
title: 'Alerts'
+sidebarTitle: 'Alerts'
description: 'Create email alerts from Prowler Cloud findings to monitor relevant security changes after scans or in daily digests.'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
<VersionBadge version="5.26.0" />
Alerts notify recipients by email when security findings match saved filter conditions. Use Alerts to track high-priority findings, monitor specific providers or services, and keep teams informed about scan results that match defined criteria.
-<Note>
-This feature is available exclusively in **Prowler Cloud** and **Prowler Enterprise** with a [paid subscription](https://prowler.com/pricing).
-</Note>
+<SubscriptionBanner />
## Prerequisites
diff --git a/docs/user-guide/tutorials/prowler-app-api-keys.mdx b/docs/user-guide/tutorials/prowler-app-api-keys.mdx
index 4e51e62bac..c7d5f86ec4 100644
--- a/docs/user-guide/tutorials/prowler-app-api-keys.mdx
+++ b/docs/user-guide/tutorials/prowler-app-api-keys.mdx
@@ -3,14 +3,17 @@ title: 'API Keys'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.13.0" />
-API key authentication in Prowler App provides an alternative to JWT tokens and empowers automation, CI/CD pipelines, and third-party integrations. This guide explains how to create, manage, and safeguard API keys when working with the Prowler API.
+<AppliesTo />
+
+API key authentication in Prowler Cloud provides an alternative to JWT tokens and empowers automation, CI/CD pipelines, and third-party integrations. This guide explains how to create, manage, and safeguard API keys when working with the Prowler API.
## API Key Advantages
-- **Programmatic access:** Enables automated workflows and scripts to interact with Prowler App.
+- **Programmatic access:** Enables automated workflows and scripts to interact with Prowler Cloud.
- **Long-lived authentication:** Allows optional expiration dates, with a default of 1 year.
- **Granular control:** Supports multiple keys with distinct names and purposes.
- **Secure automation:** Simplifies safe integration into CI/CD pipelines and infrastructure-as-code tooling.
@@ -19,7 +22,7 @@ API key authentication in Prowler App provides an alternative to JWT tokens and
API keys provide a secure authentication mechanism for accessing the Prowler API:
-1. API keys are created through Prowler App with a user-defined name and optional expiration date.
+1. API keys are created through Prowler Cloud with a user-defined name and optional expiration date.
2. The full API key appears only once upon creation and cannot be retrieved later.
3. Each API key consists of a prefix (visible in the interface) and an encrypted secret portion.
4. Requests include the API key in the header as `Authorization: Api-Key <api-key>`.
@@ -63,13 +66,13 @@ Creating, viewing, or managing API keys requires the **MANAGE_ACCOUNT** RBAC per
Without this permission, the API Keys section remains hidden. Access requests should be routed through the tenant administrator.
-For more information about RBAC permissions, refer to the [Prowler App RBAC documentation](/user-guide/tutorials/prowler-app-rbac).
+For more information about RBAC permissions, refer to the [Prowler Cloud RBAC documentation](/user-guide/tutorials/prowler-app-rbac).
## Creating API Keys
-Follow these steps to create an API key in Prowler App:
+Follow these steps to create an API key in Prowler Cloud:
-1. Navigate to **Profile** → **Account** in Prowler App.
+1. Navigate to **Profile** → **Account** in Prowler Cloud.
2. Select the **Create API Key** button.
@@ -206,7 +209,7 @@ When using API keys in CI/CD pipelines:
* Ensure the key has not been revoked by checking the Revoked column in the API Keys list.
* Confirm that the key has not expired by reviewing the expiration date.
* Confirm that the correct API key format is in use, including both prefix and secret portions.
-* Verify that the key prefix matches what is displayed in Prowler App.
+* Verify that the key prefix matches what is displayed in Prowler Cloud.
### API Key Not Working After Creation
diff --git a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx
index 23d8b8d5a2..22e56e5634 100644
--- a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx
+++ b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx
@@ -3,13 +3,16 @@ title: "Attack Paths"
description: "Identify privilege escalation chains and security misconfigurations across cloud environments using graph-based analysis."
---
-import { VersionBadge } from "/snippets/version-badge.mdx"
+import { VersionBadge } from "/snippets/version-badge.mdx";
+import { AppliesTo } from "/snippets/applies-to.mdx";
<VersionBadge version="5.17.0" />
+<AppliesTo />
+
Attack Paths analyzes relationships between cloud resources, permissions, and security findings to detect how privileges can be escalated and how misconfigurations can be exploited by threat actors.
-By mapping these relationships as a graph, Attack Paths reveals risks that individual security checks cannot detect on their own — such as an IAM role that can escalate its own permissions, or a chain of policies that grants unintended access to sensitive resources.
+By mapping these relationships as a graph, Attack Paths reveals risks that individual security checks cannot detect on their own, such as an IAM role that can escalate its own permissions, or a chain of policies that grants unintended access to sensitive resources.
<Note>
Attack Paths is currently available for **AWS** providers. Support for
@@ -20,14 +23,14 @@ By mapping these relationships as a graph, Attack Paths reveals risks that indiv
The following prerequisites are required for Attack Paths:
-- **An AWS provider is configured** with valid credentials in Prowler App. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws).
-- **At least one scan has completed** on the configured AWS provider. Attack Paths scans run automatically alongside regular security scans — no separate configuration is required.
+- **An AWS provider is configured** with valid credentials in Prowler Cloud. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws).
+- **At least one scan has completed** on the configured AWS provider and produced graph data. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required.
## How Attack Paths Scans Work
Attack Paths scans are generated automatically when a security scan runs on an AWS provider. Each completed scan produces graph data that maps relationships between IAM principals, policies, trust configurations, and other resources.
-Once the scan finishes and the graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status. Scans that are still processing display as **Executing** or **Scheduled**.
+Once the scan finishes and graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status and a check in the **Graph** column. Scans that are still queued or running remain visible, but they cannot be selected until graph data is ready.
<Note>
Since Prowler scans all configured providers every **24 hours** by default,
@@ -41,25 +44,28 @@ To open Attack Paths, click **Attack Paths** in the left navigation menu.
<img
src="/images/prowler-app/attack-paths/navigation.png"
alt="Attack Paths navigation menu entry"
- width="700"
+ width="320"
/>
-The main interface is divided into two areas:
+The Attack Paths page guides you through the workflow on one page:
-- **Left panel:** A table listing all available Attack Paths scans
-- **Right panel:** The query selector, parameter form, and execute controls
+- Select a scan with graph data.
+- Choose a built-in query or a custom openCypher query.
+- Add parameters when the selected query requires them.
+- Execute the query and explore the resulting graph.
## Selecting a Scan
The scans table displays all Attack Paths scans with the following columns:
-- **Provider / Account:** The AWS provider alias and account identifier
-- **Last scan date:** When the scan completed
-- **Status:** Current state of the scan (Completed, Executing, Scheduled, or Failed)
-- **Progress:** Completion percentage for in-progress scans
-- **Duration:** Total scan time
+- **Select:** A radio button used to choose a scan. The radio button is disabled when graph data is not available.
+- **Provider:** The AWS provider alias and account identifier.
+- **Last Scan Date:** When the scan completed.
+- **Status:** Current state of the scan, such as **Completed**, **Executing**, **Scheduled**, or **Failed**.
+- **Graph:** Whether Attack Paths graph data is available for the scan.
+- **Duration:** Total scan time.
-To select a scan for analysis, click **Select** on any row with a **Completed** status.
+To select a scan for analysis, click the radio button on any row with a **Completed** status and available graph data.
<img
src="/images/prowler-app/attack-paths/scan-list-table.png"
@@ -68,19 +74,18 @@ To select a scan for analysis, click **Select** on any row with a **Completed**
/>
<Note>
- Only scans with a **Completed** status and ready graph data can be selected.
- Scans that are still executing or have failed appear with disabled action
- buttons.
+ Only scans with graph data can be selected. Disabled rows include a tooltip
+ that explains why the graph is not available yet.
</Note>
## Choosing a Query
-After selecting a scan, the right panel activates a query dropdown. Each query targets a specific type of privilege escalation or misconfiguration pattern.
+After selecting a scan, the query selector becomes available. Each query targets a specific privilege escalation, exposure, inventory, or misconfiguration pattern.
To choose a query, click the dropdown and select from the available options. Each option displays:
-- **Query name:** A descriptive title (e.g., "IAM Privilege Escalation via AssumeRole")
-- **Short description:** A brief summary of what the query detects
+- **Query name:** A descriptive title, such as **Internet-Exposed EC2 with Sensitive S3 Access**.
+- **Short description:** A brief summary of what the query detects.
<img
src="/images/prowler-app/attack-paths/query-selector.png"
@@ -88,16 +93,17 @@ To choose a query, click the dropdown and select from the available options. Eac
width="700"
/>
-Once selected, a description card appears below the dropdown with additional context about the query, including attribution links to external references when available.
+Once selected, a description panel appears below the dropdown with more context about the query.
## Configuring Query Parameters
-Some queries accept optional or required parameters to narrow the scope of the analysis. When a query has parameters, a dynamic form appears below the query description.
+Some queries accept optional or required parameters to narrow the scope of the analysis. When a query has parameters, a form appears below the query description.
-- **Required fields** are marked with an asterisk (\*) and must be filled before executing
-- **Optional fields** refine the query results but are not mandatory
+- **Required fields** are marked with an asterisk (\*) and must be filled before executing.
+- **Optional fields** refine the query results but are not mandatory.
+- Queries without parameters show no parameter form.
-If a query requires no parameters, the form displays a message confirming that the query is ready to execute.
+For example, **Internet-Exposed EC2 with Sensitive S3 Access** uses **Tag key** and **Tag value** fields to identify sensitive S3 buckets.
<img
src="/images/prowler-app/attack-paths/query-parameters.png"
@@ -117,7 +123,7 @@ Custom queries are sandboxed to keep the graph database safe and responsive:
- **Read-only:** Only read operations are allowed. Statements that mutate the graph (`CREATE`, `MERGE`, `SET`, `DELETE`, `REMOVE`, `DROP`, `LOAD CSV`, `CALL { ... }` writes, etc.) are rejected before execution.
- **Length limit:** Each query is capped at **10,000 characters**.
-- **Scoped to the selected scan:** Results are automatically scoped to the provider and scan selected on the left panel. There is no need to filter by tenant or scan identifier in the query body.
+- **Scoped to the selected scan:** Results are automatically scoped to the provider and scan selected in the scan table. There is no need to filter by tenant or scan identifier in the query body.
### Example Queries
@@ -145,11 +151,10 @@ LIMIT 25
**IAM principals with wildcard Allow statements:**
```cypher
-MATCH (principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
-WHERE stmt.effect = 'Allow'
- AND ANY(action IN stmt.action WHERE action = '*')
-RETURN principal.arn AS principal, policy.arn AS policy,
- stmt.action AS actions, stmt.resource AS resources
+MATCH (principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
+MATCH (stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem)
+WHERE a.value = '*'
+RETURN DISTINCT principal.arn AS principal, policy.arn AS policy
LIMIT 25
```
@@ -173,218 +178,89 @@ RETURN r.name AS role_name, r.arn AS role_arn, p.arn AS trusted_service
LIMIT 25
```
-### Advanced Attack Path Scenarios
+### Working with List-Typed Properties
-The following scenarios show how to compose graph traversals into real attack-path stories. Each query can be pasted directly into the custom query box: the API auto-scopes them to the selected provider and injects tenant/provider isolation, so there is no need to include account identifiers or `$provider_uid` in the text. All queries are openCypher v9 (Neo4j and Neptune compatible).
+Some Cartography node properties carry a list of values, such as `action`, `resource`, `notaction`, and `notresource` on `AWSPolicyStatement` nodes, the algorithms on `KMSKey`, the container-definition lists on `ECSContainerDefinition`, and many others. The Attack Paths graph models each such property as a set of child item nodes connected to the parent by a typed edge. To read the values, traverse the edge; the parent does not carry the list as a single field.
-#### 1. Live attacker on the box that owns the keys
+The naming convention for any list-typed property on a parent label is:
-**Query story:** Finds an internet-exposed EC2 under an active GuardDuty SSH brute-force whose instance role can assume a higher-privileged role that can read a sensitive S3 bucket.
+- **Child label:** `<ParentLabel><PropertyPascal>Item`. Example: `AWSPolicyStatement.resource` resolves to `AWSPolicyStatementResourceItem`.
+- **Edge type:** `HAS_<PROPERTY_UPPER>`. Example: `resource` resolves to `HAS_RESOURCE`.
+- **Child property:** `value` for scalar lists (one string per list element). List-of-dict properties (rare; for example `SecretsManagerSecretVersion.tags`) carry the original dict keys as named fields on the child node.
+
+To express "at least one item in the list satisfies a predicate", traverse the `HAS_*` edge in its own `MATCH` clause and apply the predicate in the attached `WHERE`. `RETURN DISTINCT` collapses duplicate parent rows produced when multiple child items satisfy the filter:
```cypher
-MATCH path_ec2 = (acct:AWSAccount)--(ec2:EC2Instance)
-WHERE ec2.exposed_internet = true
-MATCH p0 = (gd:GuardDutyFinding)-[:AFFECTS]->(ec2)
-MATCH p1 = (ec2)-[:INSTANCE_PROFILE]->(prof:AWSInstanceProfile)-[:ASSOCIATED_WITH]->(low:AWSRole)
-MATCH p2 = (low)-[:STS_ASSUMEROLE_ALLOW]-(high:AWSRole)
-MATCH p3 = (high)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
-OPTIONAL MATCH path_net = (internet:Internet)-[:CAN_ACCESS]->(ec2)
-MATCH path_s3 = (acct)--(s3:S3Bucket)
-WHERE high <> low
- AND stmt.effect = 'Allow'
- AND size([a IN stmt.action WHERE
- toLower(a) STARTS WITH 's3:getobject'
- OR toLower(a) STARTS WITH 's3:listbucket'
- OR toLower(a) IN ['s3:*']
- ]) > 0
- AND size([r IN stmt.resource WHERE
- r CONTAINS s3.name
- ]) > 0
-RETURN path_net, path_ec2, p0, p1, p2, p3, path_s3
-```
-
-**How it's built:**
-
-- `path_ec2` anchors the graph on the account node and its internet-exposed EC2 instance, via a real account-to-resource edge. This is the visible spine that keeps everything connected.
-- `p0` ties a `GuardDutyFinding` to that instance through the `AFFECTS` edge (the live SSH brute-force alert).
-- `p1` walks the real graph edges from the instance to its instance profile to the role it runs as.
-- `p2` follows the `STS_ASSUMEROLE_ALLOW` edge to the higher-privileged role the low role can assume. It is undirected so it works regardless of how the assume edge was ingested. `high <> low` stops a role matching itself.
-- `p3` walks that role into its policy and policy statement.
-- `path_net` is the optional `Internet -[:CAN_ACCESS]-> instance` edge. It makes "from the internet" literal on screen. Optional so a missing `Internet` node never breaks the query live.
-- `path_s3` connects the sensitive bucket to the same account node, so it draws connected instead of floating. There is no physical edge from a role to a bucket; the grant is logical, enforced in the `WHERE`: the statement must allow an S3 read action (list comprehension over the `action` array) and its resource must cover the bucket (`CONTAINS s3.name`). The account is the shared hub; the bucket hanging off it next to the role chain is the teaching moment — the access exists only in IAM.
-
-#### 2. Who can read the crown jewels
-
-**Query story:** The sensitive bucket from the previous scenario seen from the data side: every role whose IAM policy can read it, regardless of how the role is reached.
-
-```cypher
-MATCH (s3:S3Bucket)
-WHERE toLower(s3.name) CONTAINS 'sensitive'
-MATCH (role:AWSRole)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
-WHERE stmt.effect = 'Allow'
- AND size([a IN stmt.action WHERE
- toLower(a) STARTS WITH 's3:get'
- OR toLower(a) STARTS WITH 's3:list'
- OR toLower(a) IN ['s3:*']
- ]) > 0
- AND size([r IN stmt.resource WHERE
- r CONTAINS s3.name
- ]) > 0
-WITH DISTINCT s3, role
+MATCH (stmt:AWSPolicyStatement {effect: 'Allow'})
+MATCH (stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem)
+WHERE toLower(a.value) STARTS WITH 's3:get'
+ OR toLower(a.value) STARTS WITH 's3:list'
+RETURN DISTINCT stmt
LIMIT 25
-MATCH path_s3 = (acct:AWSAccount)--(s3)
-MATCH path_role = (acct)--(role)
-RETURN path_s3, path_role
```
-**How it's built:** data-centric, not attacker-centric — the same bucket the previous kill chain exfiltrates, approached from the other direction.
-
-- The `S3Bucket` is bound first by name (one node), so everything else filters against it.
-- `(role:AWSRole)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)` reaches statements only *through a role*, never via a global statement scan. A blanket `AWSPolicyStatement` scan also hits resource-policy statements whose shape differs and makes the list comprehension fail outright.
-- The `WHERE` filters in place: an S3 read action plus a resource that names that bucket.
-- `WITH DISTINCT s3, role LIMIT 25` collapses undirected-traversal duplicates and hard-caps the result.
-- `path_s3` and `path_role` attach the account hubs only after the cap, against at most 25 rows, so the bucket and role(s) draw connected through the account instead of floating.
-- No internet or EC2 here; this answers "who has the keys" instead of "how would an attacker get in."
-
-#### 3. Lateral reach from an internet-exposed instance
-
-**Query story:** The wide-angle view of the live-attacker scenario: every internet-exposed EC2, the role it runs as, and every role that role can assume. The first scenario is one specific exfiltration path inside this reach, under live attack.
+To check whether every item in the list satisfies a predicate, count the counter-examples and require zero, together with a guard that ensures at least one item is attached. This is the one case where the pattern-comprehension form is the right tool:
```cypher
-MATCH path_ec2 = (acct:AWSAccount)--(ec2:EC2Instance)
-WHERE ec2.exposed_internet = true
-MATCH p1 = (ec2)-[:INSTANCE_PROFILE]->(prof:AWSInstanceProfile)-[:ASSOCIATED_WITH]->(low:AWSRole)
-MATCH p2 = (low)-[:STS_ASSUMEROLE_ALLOW]-(high:AWSRole)
-OPTIONAL MATCH path_net = (internet:Internet)-[:CAN_ACCESS]->(ec2)
-WHERE high <> low
-RETURN path_net, path_ec2, p1, p2
+MATCH (stmt:AWSPolicyStatement)
+WHERE size([
+ (stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem)
+ WHERE NOT toLower(a.value) STARTS WITH 's3:'
+ | a
+ ]) = 0
+ AND size([(stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem) | a]) > 0
+RETURN stmt
+LIMIT 25
```
-**How it's built:** widens the lens instead of filtering down. It stops at the assume-role hop and shows every role reachable from any internet-exposed instance, without filtering down to a specific S3 leg.
-
-- `path_ec2` is the account-to-instance spine.
-- `p1` walks to the instance role.
-- `p2` fans out to every role that role can assume.
-- `path_net` adds the optional `Internet -[:CAN_ACCESS]->` edge.
-- The first scenario is the specific exfiltration path under live attack; this is the broader privilege reach an attacker inherits the moment they land on the box.
-
-#### 4. Role-chain privilege escalation
-
-**Query story:** A pure-IAM escalation, no compromised instance: a role that can assume a second role whose policy lets it assume a third, admin-level role.
+For the "is any item of this list a substring of a dynamic value" case, such as "does any resource pattern in this policy match a target role ARN", add the `HAS_*` traversal as its own `MATCH` and check the substring relationship between the item value and the dynamic node in `WHERE`:
```cypher
-MATCH path_root = (acct:AWSAccount)--(r1:AWSRole)
-MATCH p1 = (r1)-[:STS_ASSUMEROLE_ALLOW]-(r2:AWSRole)
-MATCH p2 = (r2)--(pol:AWSPolicy)--(stmt:AWSPolicyStatement)
-MATCH path_admin = (acct)--(admin:AWSRole)
-WHERE r1 <> r2 AND r1 <> admin AND r2 <> admin
- AND stmt.effect = 'Allow'
- AND size([a IN stmt.action WHERE
- toLower(a) IN ['sts:*', 'sts:assumerole']
- ]) > 0
- AND size([res IN stmt.resource WHERE
- res CONTAINS admin.name
- ]) > 0
-RETURN path_root, p1, p2, path_admin
+MATCH (role:AWSRole)
+WHERE role.name = 'Admin'
+MATCH (principal:AWSPrincipal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
+MATCH (stmt)-[:HAS_RESOURCE]->(r:AWSPolicyStatementResourceItem)
+WHERE r.value = '*'
+ OR r.value CONTAINS role.name
+ OR role.arn CONTAINS r.value
+RETURN DISTINCT principal.arn AS principal, stmt, role
+LIMIT 25
```
-**How it's built:**
-
-- `path_root` anchors role 1 to the account node, the spine that keeps the picture connected.
-- `p1` is the one real assume edge in the chain (role 1 to role 2).
-- `p2` walks role 2 into its policy and statement.
-- `path_admin` connects the target admin role to the same account node so it draws connected. The third hop is not a graph edge: it exists only as `sts:AssumeRole` on that role's ARN inside the statement. The query proves it the same way the first scenario proves S3 access — the statement action must include an assume-role action and its resource list must reference the admin role's name.
-- The three `<>` guards stop a role matching itself at any position.
-
-#### 5. External identity trust map
-
-**Query story:** Finds external identity providers (SSO, GitHub, GitLab, Terraform Cloud) and the AWS roles they are trusted to assume.
+To return the list of values directly, collect them from the child items:
```cypher
-MATCH p = (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]-(idp:AWSPrincipal)
-WHERE idp.arn CONTAINS 'saml-provider'
- OR idp.arn CONTAINS 'oidc-provider'
-MATCH path_role = (acct:AWSAccount)--(role)
-RETURN p, path_role
+MATCH (stmt:AWSPolicyStatement {effect: 'Allow'})
+OPTIONAL MATCH (stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem)
+RETURN stmt, collect(a.value) AS actions
+LIMIT 25
```
-**How it's built:** federated principals are stored as `AWSPrincipal` nodes whose ARN contains `saml-provider` (SSO) or `oidc-provider` (GitHub, GitLab, Terraform Cloud).
+### Working with JSON-Encoded Properties
-- `p` matches the trust edge undirected. It is written `(AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(AWSPrincipal)`, role to principal, so a directed `principal -> role` match returns nothing; undirected matches regardless of ingest direction.
-- The `WHERE` keeps only SAML or OIDC providers, drawing a fan-out from each external identity provider to every role it can assume (including reserved SSO admin roles).
-- `path_role` ties every trusted role to the account node so the provider stars share one spine instead of drawing as separate islands.
+Some Cartography properties represent nested objects, most notably `condition` on `AWSPolicyStatement` and `S3PolicyStatement` nodes. In the Attack Paths graph, object-typed properties are stored as JSON-encoded strings to keep the schema portable across graph backends. The value looks like:
-#### 6. Federated SSO roles flagged as admin or privesc
+```
+'{"StringEquals":{"aws:SourceAccount":"123456789012"}}'
+```
-**Query story:** The dangerous subset of the trust map above — externally-federated SSO roles that Prowler also flags for AdministratorAccess or privilege escalation.
+There is no JSON parser available at query time, so use `CONTAINS` for substring checks against keys or known values:
```cypher
-MATCH (idp:AWSPrincipal)-[:TRUSTS_AWS_PRINCIPAL]-(role:AWSRole)
-WHERE idp.arn CONTAINS 'saml-provider'
- OR idp.arn CONTAINS 'oidc-provider'
-MATCH (role)-[:HAS_FINDING]-(pf:ProwlerFinding)
-WHERE pf.status = 'FAIL'
- AND pf.check_id IN [
- 'iam_inline_policy_allows_privilege_escalation',
- 'iam_role_administratoraccess_policy',
- 'iam_inline_policy_no_administrative_privileges',
- 'iam_user_administrator_access_policy'
- ]
-WITH DISTINCT idp, role, pf
-LIMIT 60
-MATCH path_root = (acct:AWSAccount)--(role)
-MATCH p_trust = (idp)-[:TRUSTS_AWS_PRINCIPAL]-(role)
-MATCH p_find = (role)-[:HAS_FINDING]-(pf)
-RETURN path_root, p_trust, p_find
+MATCH (stmt:AWSPolicyStatement)
+WHERE stmt.effect = 'Allow'
+ AND stmt.condition CONTAINS '"aws:SourceAccount"'
+RETURN stmt
+LIMIT 25
```
-**How it's built:** a plain "list every flagged identity" query is a wide fan that draws as a column, and `ProwlerFinding` nodes accumulate across scans with no scan filter available in custom queries.
-
-- The first MATCH plus `WHERE` keeps only roles trusted by a SAML or OIDC provider (trust edge undirected, so direction does not matter).
-- The second MATCH plus `check_id IN [...]` keeps only those carrying one of the four privilege-escalation or admin checks.
-- `WITH DISTINCT ... LIMIT 60` collapses duplicate finding nodes and hard-caps the result.
-- `p_trust`, `p_find`, and `path_root` draw it connected three ways: provider to role through the trust edge, role to its finding, and role to the account.
-- The previous scenario shows who can walk in; this shows which of those roles Prowler already flags as over-privileged.
-
-#### 7. World-readable S3 buckets
-
-**Query story:** Unlike the IAM-gated sensitive bucket in scenarios 1 and 2, these buckets are open to anyone on the internet with no credentials at all.
-
-```cypher
-MATCH path_s3 = (acct:AWSAccount)--(s3:S3Bucket)
-WHERE s3.anonymous_access = true
-OPTIONAL MATCH p = (s3)--(stmt:S3PolicyStatement)
-RETURN path_s3, p
-```
-
-**How it's built:** the counterpoint to scenarios 1 and 2 — there the sensitive bucket is reachable only through an IAM role chain; here the bucket needs no role at all.
-
-- `path_s3` connects each public bucket to its account node so they draw connected. Cartography sets `anonymous_access = true` when a bucket's policy or ACL allows public access.
-- `p` is an optional match that pulls in the `S3PolicyStatement` granting the access where one exists, so the public grant is visible next to the bucket. Buckets that are public via ACL only still show, connected to the account.
-
-#### 8. Internet exposure surface
-
-**Query story:** The raw external attack surface behind scenarios 1 and 3: every internet-exposed EC2 instance with its security groups and the exact inbound ports left open.
-
-```cypher
-MATCH path_ec2 = (acct:AWSAccount)--(ec2:EC2Instance)
-WHERE ec2.exposed_internet = true
-MATCH p1 = (ec2)--(sg:EC2SecurityGroup)--(rule:IpPermissionInbound)
-OPTIONAL MATCH path_net = (internet:Internet)-[:CAN_ACCESS]->(ec2)
-OPTIONAL MATCH p2 = (ec2)-[:INSTANCE_PROFILE]->(:AWSInstanceProfile)-[:ASSOCIATED_WITH]->(:AWSRole)
-RETURN path_net, path_ec2, p1, p2
-```
-
-**How it's built:** `exposed_internet = true` is Cartography's computed reachability flag.
-
-- `path_ec2` hubs all exposed instances on the account node so they draw as one picture.
-- `p1` joins each instance to its security groups and inbound rules so the open ports are on screen.
-- `path_net` adds the optional `Internet -[:CAN_ACCESS]->` edge so the external reachability is explicit.
-- `p2` optionally adds the instance role, which connects this surface view back to the kill chains in scenarios 1 and 3.
+When a query needs to inspect the structured members of a condition (for example, evaluate every operator and key), fetch the rows first and parse the JSON in application code. Cypher cannot navigate JSON object keys or values.
### Tips for Writing Queries
- Start small with `LIMIT` to inspect the shape of the data before broadening the pattern.
+- Traverse `HAS_*` edges to reach list-typed property values (for example `action`, `resource`). The parent node does not carry the list as a single field; see [Working with List-Typed Properties](#working-with-list-typed-properties) for the patterns.
+- On large scans, avoid broad disconnected patterns such as `MATCH (a:Label), (b:OtherLabel)`. Bind one side with a selective predicate first, and use `WITH DISTINCT` between expanding traversals when duplicates are possible.
- Use `RETURN` projections (`RETURN n.name, n.region`) instead of returning whole nodes to keep responses compact.
- Combine resource nodes with `ProwlerFinding` nodes via `HAS_FINDING` to correlate misconfigurations with the affected resources.
- When a query times out or returns no rows, simplify the pattern step by step until the first variant runs successfully, then add constraints back.
@@ -401,64 +277,88 @@ In addition to the upstream schema, Prowler enriches the graph with:
- **`ProwlerFinding`** nodes representing Prowler check results, linked to affected resources via `HAS_FINDING` relationships.
- **`Internet`** nodes used to model exposure paths from the public internet to internal resources.
+- **List-typed properties** such as `action` or `resource` on `AWSPolicyStatement`, the algorithm lists on `KMSKey`, and similar lists on other node types are modeled as child item nodes linked by typed `HAS_*` edges. See [Working with List-Typed Properties](#working-with-list-typed-properties) for the read pattern.
+- **Object-typed properties** such as `condition` on `AWSPolicyStatement` are stored as JSON-encoded strings. See [Working with JSON-Encoded Properties](#working-with-json-encoded-properties) for the read pattern.
<Note>
AI assistants connected through Prowler MCP Server can fetch the exact
Cartography schema for the active scan via the
- `prowler_app_get_attack_paths_cartography_schema` tool. This guarantees that
+ `prowler_get_attack_paths_cartography_schema` tool. This guarantees that
generated queries match the schema version pinned by the running Prowler
release.
</Note>
## Executing a Query
-To run the selected query against the scan data, click **Execute Query**. The button displays a loading state while the query processes.
+To run the selected query against the scan data, click **Execute Query**. The button is disabled until a query is selected and all required parameters are valid.
+
+The button displays a loading state while the query runs. After the query completes, the graph appears below the query builder.
If the query returns no results, an informational message appears. Common reasons include:
-- **No matching patterns found:** The scanned environment does not contain the privilege escalation chain the query targets
-- **Insufficient permissions:** The scan credentials may not have captured all the data the query needs
+- **No matching patterns found:** The scanned environment does not contain the pattern the query targets.
+- **Not enough permissions:** The scan credentials may not have captured all the data the query needs.
+- **Server unavailable:** The graph service may be temporarily unavailable.
<img
src="/images/prowler-app/attack-paths/execute-query.png"
- alt="Attack Paths right panel with query selected and execute button"
+ alt="Attack Paths query builder with query selected and execute button"
width="700"
/>
## Exploring the Graph
-After a successful execution, the graph visualization renders below the query builder in a full-width panel. The graph maps relationships between cloud resources, IAM entities, and security findings.
+After a successful execution, the graph visualization renders below the query builder. The graph maps relationships between cloud resources, IAM entities, public exposure, and security findings.
### Node Types
-- **Resource nodes** (rounded pills): Represent cloud resources such as IAM roles, policies, EC2 instances, and S3 buckets. Each resource type has a distinct color.
-- **Finding nodes** (hexagons): Represent Prowler security findings linked to resources in the graph. Colors indicate severity level (critical, high, medium, low).
+- **Provider root nodes:** Represent the AWS account or provider root for the selected scan.
+- **Resource nodes:** Represent cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets.
+- **Internet nodes:** Represent exposure from the public internet.
+- **Finding nodes:** Represent Prowler findings linked to resources. Finding colors indicate risk level, such as critical, high, medium, or low.
### Edge Types
-- **Solid lines:** Direct relationships between resources (e.g., a role attached to a policy)
-- **Dashed lines:** Connections between resources and their associated findings
+- **Normal edges:** Direct relationships between graph nodes, such as role-to-policy or resource-to-security-group relationships.
+- **Finding edges:** Dashed relationships between resources and their associated findings.
+- **Highlighted paths:** Green edges that show the active path when you hover a node or focus a finding.
-A **legend** at the bottom of the graph lists all node types and edge types present in the current view.
+The standard graph view includes a minimap and a legend below the canvas. The legend shows the provider roots, visible node types, finding risk levels, node states, and edge types present in the current view.
<img
src="/images/prowler-app/attack-paths/graph-visualization.png"
- alt="Attack Paths graph showing nodes, edges, and legend"
+ alt="Attack Paths graph showing nodes and edges"
width="700"
/>
## Interacting with the Graph
-### Filtering by Node
+The graph banner describes the main interactions:
-Click any node in the graph to filter the view and display only paths that pass through that node. When a filter is active:
+- Click a finding to focus its connected path.
+- Click a resource with findings to show or hide its related findings.
+- Hover a node to highlight its connected path.
-- An information banner shows which node is selected
-- Click **Back to Full View** to restore the complete graph
+### Showing Related Findings
+
+Resource nodes with related findings are clickable. Click one of these resources to show its finding nodes. Click the resource again to hide them.
+
+The graph automatically fits the selected resource and its related findings when the findings are shown.
+
+### Focusing a Finding Path
+
+Click a finding node to focus the graph on the path connected to that finding. When the graph is focused:
+
+- The graph shows **Back to Full View**.
+- The status banner shows the selected finding.
+- The graph keeps only the connected path in view.
+- The finding detail drawer opens.
+
+After you close the drawer, the graph remains focused on the selected path.
<img
src="/images/prowler-app/attack-paths/graph-filtered.png"
- alt="Attack Paths graph filtered to show paths through a selected node"
+ alt="Attack Paths graph focused on a selected finding path"
width="700"
/>
@@ -467,29 +367,29 @@ Click any node in the graph to filter the view and display only paths that pass
The toolbar in the top-right corner of the graph provides:
- **Zoom in / Zoom out:** Adjust the zoom level
-- **Fit to screen:** Reset the view to fit all nodes
-- **Export:** Download the current graph as an SVG file
-- **Fullscreen:** Open the graph in a full-screen modal with a side-by-side node detail panel
+- **Fit graph to view:** Reset the view to fit the visible graph
+- **Export graph:** Download the current graph as a PNG file
+- **Fullscreen:** Open the graph in a full-size modal
<Note>
Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within
the graph area.
</Note>
-## Viewing Node Details
+## Viewing Finding Details
-Click any node to open the **Node Details** panel below the graph. This panel displays:
+Click a finding node to open the finding detail drawer. The drawer uses the same finding detail layout as the Findings page and includes:
-- **Node type:** The resource category (e.g., "IAM Role," "EC2 Instance")
-- **Properties:** All attributes of the selected node, including identifiers, timestamps, and configuration details
-- **Related findings** (for resource nodes): A list of Prowler findings linked to the resource, with severity, title, and status
-- **Affected resources** (for finding nodes): A list of resources associated with the finding
+- The finding title, status, and severity.
+- The affected resource summary.
+- Overview, remediation, evidence, related findings, scans, and events tabs when data is available.
+- A Lighthouse AI action when the account has access to Lighthouse AI.
-For finding nodes, a "View Finding" button links directly to the finding detail page for further investigation.
+Resource nodes do not open a node detail panel. When a resource has related findings, clicking it expands or collapses those finding nodes in the graph.
<img
src="/images/prowler-app/attack-paths/node-details.png"
- alt="Attack Paths node detail panel showing properties and related findings"
+ alt="Attack Paths finding detail drawer"
width="700"
/>
@@ -497,16 +397,28 @@ For finding nodes, a "View Finding" button links directly to the finding detail
To expand the graph for detailed exploration, click the fullscreen icon in the graph toolbar. The fullscreen modal provides:
-- The full graph visualization with all zoom and export controls
-- A side panel for node details that appears when a node is selected
-- All filtering and interaction capabilities available in the standard view
+- The graph in a full-size modal.
+- The same zoom, fit, and export controls.
+- The same node expansion, finding focus, hover highlight, and minimap interactions available in the standard view.
<img
src="/images/prowler-app/attack-paths/fullscreen-mode.png"
- alt="Attack Paths fullscreen mode with graph and node detail side panel"
+ alt="Attack Paths fullscreen graph mode"
width="700"
/>
+## Available Queries
+
+The query selector includes custom openCypher and built-in AWS queries for common security investigation workflows. Available queries are loaded from the selected scan and may change as new query packs are added.
+
+Available queries include:
+
+- **Custom openCypher query:** Write and run a read-only graph query.
+- **Exposure queries:** Find internet-exposed EC2 instances, load balancers, open security groups, and resources by public IP.
+- **Inventory queries:** List resources such as RDS instances.
+- **Misconfiguration queries:** Find unencrypted RDS instances, public S3 buckets, and wildcard IAM statements.
+- **Privilege escalation queries:** Detect IAM and AWS service paths based on known attack techniques, including queries based on [pathfinding.cloud](https://pathfinding.cloud) research by Datadog.
+
## Using Attack Paths with the MCP Server and Lighthouse AI
Attack Paths capabilities are also available through the [Prowler MCP Server](/getting-started/products/prowler-mcp), enabling interaction with Attack Paths data via AI assistants like Claude Desktop, Cursor, and other MCP clients.
@@ -515,10 +427,10 @@ Attack Paths capabilities are also available through the [Prowler MCP Server](/g
The following MCP tools are available for Attack Paths:
-- **`prowler_app_list_attack_paths_scans`** - List and filter Attack Paths scans
-- **`prowler_app_list_attack_paths_queries`** - Discover available queries for a completed scan
-- **`prowler_app_run_attack_paths_query`** - Execute a query and retrieve graph results with nodes and relationships
-- **`prowler_app_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema for custom openCypher queries
+- **`prowler_list_attack_paths_scans`** - List and filter Attack Paths scans.
+- **`prowler_list_attack_paths_queries`** - Discover available queries for a completed scan.
+- **`prowler_run_attack_paths_query`** - Execute a query and retrieve graph results with nodes and relationships.
+- **`prowler_get_attack_paths_cartography_schema`** - Retrieve the Cartography graph schema for custom openCypher queries.
### Example Questions
@@ -533,111 +445,8 @@ Ask through the MCP Server or Lighthouse AI:
- "Are there any CloudFormation stacks that could be hijacked for privilege escalation?"
- "Show me all roles that can be assumed for lateral movement"
-### Supported Queries
-
-Attack Paths currently supports the following built-in queries for AWS:
-
-#### Custom Attack Path Queries
-
-| Query | Description |
-|---|---|
-| **Internet-Exposed EC2 with Sensitive S3 Access** | Find SSH-exposed EC2 instances that can assume roles to read tagged sensitive S3 buckets |
-
-#### Basic Resource Queries
-
-| Query | Description |
-|---|---|
-| **RDS Instances Inventory** | List all provisioned RDS database instances in the account |
-| **Unencrypted RDS Instances** | Find RDS instances with storage encryption disabled |
-| **S3 Buckets with Anonymous Access** | Find S3 buckets that allow anonymous access |
-| **IAM Statements Allowing All Actions** | Find IAM policy statements that allow all actions via wildcard (\*) |
-| **IAM Statements Allowing Policy Deletion** | Find IAM policy statements that allow iam:DeletePolicy |
-| **IAM Statements Allowing Create Actions** | Find IAM policy statements that allow any create action |
-
-#### Network Exposure Queries
-
-| Query | Description |
-|---|---|
-| **Internet-Exposed EC2 Instances** | Find EC2 instances flagged as exposed to the internet |
-| **Open Security Groups on Internet-Facing Resources** | Find internet-facing resources with security groups allowing inbound from 0.0.0.0/0 |
-| **Internet-Exposed Classic Load Balancers** | Find Classic Load Balancers exposed to the internet with their listeners |
-| **Internet-Exposed ALB/NLB Load Balancers** | Find ELBv2 (ALB/NLB) load balancers exposed to the internet with their listeners |
-| **Resource Lookup by Public IP** | Find the AWS resource associated with a given public IP address |
-
-#### Privilege Escalation Queries
-
-These queries are based on research from [pathfinding.cloud](https://pathfinding.cloud) by Datadog.
-
-| Query | Description |
-|---|---|
-| **App Runner Service Creation with Privileged Role (APPRUNNER-001)** | Create an App Runner service with a privileged IAM role to gain its permissions |
-| **App Runner Service Update for Role Access (APPRUNNER-002)** | Update an existing App Runner service to leverage its already-attached privileged role |
-| **Bedrock Code Interpreter with Privileged Role (BEDROCK-001)** | Create a Bedrock AgentCore Code Interpreter with a privileged role attached |
-| **Bedrock Code Interpreter Session Hijacking (BEDROCK-002)** | Start a session on an existing Bedrock code interpreter to exfiltrate its privileged role credentials |
-| **CloudFormation Stack Creation with Privileged Role (CLOUDFORMATION-001)** | Create a CloudFormation stack with a privileged role to provision arbitrary AWS resources |
-| **CloudFormation Stack Update for Role Access (CLOUDFORMATION-002)** | Update an existing CloudFormation stack to leverage its already-attached privileged service role |
-| **CloudFormation StackSet Creation with Privileged Role (CLOUDFORMATION-003)** | Create a CloudFormation StackSet with a privileged execution role to provision arbitrary resources across accounts |
-| **CloudFormation StackSet Update with Privileged Role (CLOUDFORMATION-004)** | Update an existing CloudFormation StackSet to inject malicious resources using a privileged execution role |
-| **CloudFormation Change Set Privilege Escalation (CLOUDFORMATION-005)** | Create and execute a change set on an existing stack to leverage its privileged service role |
-| **CodeBuild Project Creation with Privileged Role (CODEBUILD-001)** | Create a CodeBuild project with a privileged role to execute arbitrary code via a malicious buildspec |
-| **CodeBuild Buildspec Override for Role Access (CODEBUILD-002)** | Start a build on an existing CodeBuild project with a buildspec override to execute code with its privileged role |
-| **CodeBuild Batch Buildspec Override for Role Access (CODEBUILD-003)** | Start a batch build on an existing CodeBuild project with a buildspec override to execute code with its privileged role |
-| **CodeBuild Batch Project Creation with Privileged Role (CODEBUILD-004)** | Create a CodeBuild project configured for batch builds with a privileged role to execute arbitrary code via a malicious buildspec |
-| **Data Pipeline Creation with Privileged Role (DATAPIPELINE-001)** | Create a Data Pipeline with a privileged role to execute arbitrary commands on provisioned infrastructure |
-| **EC2 Instance Launch with Privileged Role (EC2-001)** | Launch EC2 instances with privileged IAM roles to gain their permissions via IMDS |
-| **EC2 Role Hijacking via UserData Injection (EC2-002)** | Inject malicious scripts into EC2 instance userData to gain the attached role's permissions |
-| **Spot Instance Launch with Privileged Role (EC2-003)** | Launch EC2 Spot Instances with privileged IAM roles to gain their permissions via IMDS |
-| **Launch Template Poisoning for Role Access (EC2-004)** | Inject malicious userData into launch templates that reference privileged roles, no PassRole needed |
-| **EC2 Instance Connect SSH Access for Role Credentials (EC2INSTANCECONNECT-003)** | Push a temporary SSH key to an EC2 instance via Instance Connect to access its attached role credentials through IMDS |
-| **ECS Service Creation with Privileged Role (ECS-001 - New Cluster)** | Create an ECS cluster and service with a privileged Fargate task role to execute arbitrary code |
-| **ECS Task Execution with Privileged Role (ECS-002 - New Cluster)** | Create an ECS cluster and run a one-off Fargate task with a privileged role to execute arbitrary code |
-| **ECS Service Creation with Privileged Role (ECS-003 - Existing Cluster)** | Deploy a Fargate service with a privileged role on an existing ECS cluster |
-| **ECS Task Execution with Privileged Role (ECS-004 - Existing Cluster)** | Run a one-off Fargate task with a privileged role on an existing ECS cluster |
-| **ECS Task Start with Privileged Role on EC2 (ECS-005 - Existing Cluster)** | Register a task definition with a privileged role and start it on an EC2 container instance to execute arbitrary code |
-| **ECS Exec Container Hijacking for Role Credentials (ECS-006)** | Shell into a running ECS container via ECS Exec to steal the attached task role's credentials |
-| **Glue Dev Endpoint with Privileged Role (GLUE-001)** | Create a Glue development endpoint with a privileged role attached to gain its permissions |
-| **Glue Dev Endpoint SSH Hijacking via Update (GLUE-002)** | Update an existing Glue development endpoint to inject an SSH public key and access its attached role credentials |
-| **Glue Job Creation with Privileged Role (GLUE-003)** | Create a Glue job with a privileged role and start it to execute arbitrary code with that role's permissions |
-| **Glue Job Creation with Scheduled Trigger and Privileged Role (GLUE-004)** | Create a Glue job with a privileged role and a scheduled trigger to persistently execute arbitrary code |
-| **Glue Job Hijacking via Update with Privileged Role (GLUE-005)** | Update an existing Glue job to attach a privileged role and inject malicious code, then start it to gain that role's permissions |
-| **Glue Job Hijacking with Scheduled Trigger and Privileged Role (GLUE-006)** | Update an existing Glue job to attach a privileged role and inject malicious code, then create a scheduled trigger for persistent automated execution |
-| **Policy Version Override for Self-Escalation (IAM-001)** | Create a new version of an attached policy with administrative permissions, instantly escalating the principal's own privileges |
-| **Access Key Creation for Lateral Movement (IAM-002)** | Create access keys for other IAM users to gain their permissions and move laterally across the account |
-| **Access Key Rotation Attack for Lateral Movement (IAM-003)** | Delete and recreate access keys for other IAM users to bypass the two-key limit and gain their permissions |
-| **Console Login Profile Creation for Lateral Movement (IAM-004)** | Create console login profiles for other IAM users to access the AWS Console with their permissions |
-| **Inline Policy Injection for Self-Escalation (IAM-005)** | Attach an inline policy with administrative permissions to your own role, instantly escalating privileges |
-| **Console Password Override for Lateral Movement (IAM-006)** | Change the console password of other IAM users to log in as them and gain their permissions |
-| **Inline Policy Injection on User for Self-Escalation (IAM-007)** | Attach an inline policy with administrative permissions to your own IAM user, instantly escalating privileges |
-| **Managed Policy Attachment on User for Self-Escalation (IAM-008)** | Attach existing managed policies with administrative permissions to your own IAM user, instantly escalating privileges |
-| **Managed Policy Attachment on Role for Self-Escalation (IAM-009)** | Attach existing managed policies with administrative permissions to your own IAM role, instantly escalating privileges |
-| **Managed Policy Attachment on Group for Self-Escalation (IAM-010)** | Attach existing managed policies with administrative permissions to a group you belong to, escalating privileges for all group members |
-| **Inline Policy Injection on Group for Self-Escalation (IAM-011)** | Attach an inline policy with administrative permissions to a group you belong to, escalating privileges for all group members |
-| **Trust Policy Hijacking for Role Assumption (IAM-012)** | Modify a role's trust policy to allow yourself to assume it, gaining the role's permissions |
-| **Group Membership Hijacking for Privilege Escalation (IAM-013)** | Add yourself to a privileged IAM group to inherit its permissions, gaining access to all policies attached to the group |
-| **Managed Policy Attachment with Role Assumption for Lateral Movement (IAM-014)** | Attach administrative managed policies to another role you can assume, then assume it to gain elevated privileges |
-| **Managed Policy Attachment with Access Key Creation for Lateral Movement (IAM-015)** | Attach administrative managed policies to another IAM user and create access keys for them to gain programmatic access with elevated privileges |
-| **Policy Version Override with Role Assumption for Lateral Movement (IAM-016)** | Create a new version of a customer-managed policy attached to another role with administrative permissions, then assume that role to gain elevated access |
-| **Inline Policy Injection with Role Assumption for Lateral Movement (IAM-017)** | Attach an inline policy with administrative permissions to another role you can assume, then assume it to gain elevated privileges |
-| **Inline Policy Injection with Access Key Creation for Lateral Movement (IAM-018)** | Attach an inline policy with administrative permissions to another IAM user and create access keys for them to gain programmatic access with elevated privileges |
-| **Managed Policy Attachment with Trust Policy Hijacking for Privilege Escalation (IAM-019)** | Attach administrative managed policies to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access |
-| **Policy Version Override with Trust Policy Hijacking for Privilege Escalation (IAM-020)** | Create a new version of a customer-managed policy attached to a role with administrative permissions and modify its trust policy to assume it, without prior assume-role access |
-| **Inline Policy Injection with Trust Policy Hijacking for Privilege Escalation (IAM-021)** | Add an inline policy with administrative permissions to a role and modify its trust policy to allow yourself to assume it, gaining elevated privileges without prior assume-role access |
-| **Lambda Function Creation with Privileged Role (LAMBDA-001)** | Create a Lambda function with a privileged IAM role and invoke it to execute code with that role's permissions |
-| **Lambda Function Creation with Event Source Trigger (LAMBDA-002)** | Create a Lambda function with a privileged IAM role and an event source mapping to trigger it automatically, executing code with the role's permissions |
-| **Lambda Function Code Injection (LAMBDA-003)** | Modify the code of an existing Lambda function to execute arbitrary commands with the function's execution role permissions |
-| **Lambda Function Code Injection with Direct Invocation (LAMBDA-004)** | Modify the code of an existing Lambda function and invoke it directly to execute arbitrary commands with the function's execution role permissions |
-| **Lambda Function Code Injection with Resource Policy Grant (LAMBDA-005)** | Modify the code of an existing Lambda function and grant yourself invocation permission via its resource-based policy to execute code with the function's execution role |
-| **Lambda Function Creation with Resource Policy Invocation (LAMBDA-006)** | Create a Lambda function with a privileged IAM role and grant yourself invocation permission via its resource-based policy to execute code with the role's permissions |
-| **SageMaker Notebook Creation with Privileged Role (SAGEMAKER-001)** | Create a SageMaker notebook instance with a privileged IAM role to execute arbitrary code with the role's permissions via the Jupyter environment |
-| **SageMaker Training Job Creation with Privileged Role (SAGEMAKER-002)** | Create a SageMaker training job with a privileged IAM role to execute arbitrary container code with the role's permissions |
-| **SageMaker Processing Job Creation with Privileged Role (SAGEMAKER-003)** | Create a SageMaker processing job with a privileged IAM role to execute arbitrary container code with the role's permissions |
-| **SageMaker Presigned Notebook URL for Privilege Escalation (SAGEMAKER-004)** | Generate a presigned URL to access an existing SageMaker notebook instance and execute code with its execution role's permissions |
-| **SageMaker Notebook Lifecycle Config Injection (SAGEMAKER-005)** | Inject a malicious lifecycle configuration into an existing SageMaker notebook to execute code with the notebook's execution role during startup |
-| **SSM Session Access for EC2 Role Credentials (SSM-001)** | Start an SSM session on an EC2 instance to access its attached role credentials through IMDS |
-| **SSM Send Command for EC2 Role Credentials (SSM-002)** | Execute commands on an EC2 instance via SSM Run Command to access its attached role credentials through IMDS |
-| **Role Assumption for Privilege Escalation (STS-001)** | Assume IAM roles with elevated permissions by exploiting bidirectional trust between the starting principal and the target role |
-
These tools enable workflows such as:
+
- Asking an AI assistant to identify privilege escalation paths in a specific AWS account
- Automating attack path analysis across multiple scans
- Combining attack path data with findings and compliance information for comprehensive security reports
diff --git a/docs/user-guide/tutorials/prowler-app-finding-groups.mdx b/docs/user-guide/tutorials/prowler-app-finding-groups.mdx
index e1bf83a50f..c5234bb41f 100644
--- a/docs/user-guide/tutorials/prowler-app-finding-groups.mdx
+++ b/docs/user-guide/tutorials/prowler-app-finding-groups.mdx
@@ -1,12 +1,16 @@
---
title: 'Finding Groups'
+sidebarTitle: 'Groups'
description: 'Organize and triage security findings by check to reduce noise and prioritize remediation effectively.'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.23.0" />
+<AppliesTo />
+
Finding Groups transforms security findings triage by grouping them by check instead of displaying a flat list. This dramatically reduces noise and enables faster, more effective prioritization.
## Triage Challenges with Flat Finding Lists
@@ -112,7 +116,7 @@ This provides full context without leaving the drawer.
## Getting Started
-1. Navigate to the **Findings** section in Prowler Cloud/App.
+1. Navigate to the **Findings** section in Prowler Cloud.
2. Toggle to the **Grouped View** to see findings organized by check.
3. Select any group row to expand and see affected resources.
4. Select a resource to open the detail drawer with full context.
diff --git a/docs/user-guide/tutorials/prowler-app-findings-triage.mdx b/docs/user-guide/tutorials/prowler-app-findings-triage.mdx
new file mode 100644
index 0000000000..bbceaef992
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-app-findings-triage.mdx
@@ -0,0 +1,125 @@
+---
+title: "Findings Triage"
+sidebarTitle: 'Triage'
+description: "Track finding review status and team notes in Prowler Cloud."
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+<VersionBadge version="5.32.0" />
+
+Findings Triage lets teams track review status and notes for individual findings in Prowler Cloud. Use it to record investigation state, remediation work, accepted risk, or false positive decisions without leaving the Findings workflow.
+
+<SubscriptionBanner />
+
+## What Is Findings Triage?
+
+Findings Triage adds a **Triage** status and team note workflow to individual finding rows. It is available from:
+
+- Expanded rows in **Finding Groups**
+- Standalone finding tables
+- Finding and resource detail drawers, including related findings tables
+
+Finding Groups rows do not show triage controls because a group row represents several findings. Expand a group to work with each affected resource.
+
+
+
+## Required Permissions
+
+To update triage statuses and notes, the user role must have the **Manage Scans** permission. For more information, see [Role-Based Access Control (RBAC)](/user-guide/tutorials/prowler-app-rbac).
+
+Users without this permission can still see existing triage context when it is available, but cannot change statuses or save notes.
+
+## Triage Statuses
+
+The status selector includes manual statuses. Prowler also sets automatic statuses after scans.
+
+| Status | Type | Use It When |
+| --- | --- | --- |
+| **Open** | Manual | A failed finding has not been reviewed yet. A failed finding with no saved triage state also appears as **Open**. |
+| **Under Review** | Manual | A team is investigating the finding. |
+| **Remediating** | Manual | Work is in progress to fix the finding. |
+| **Risk Accepted** | Manual | The team accepts the risk and wants to mute the finding. |
+| **False Positive** | Manual | The finding does not apply and should be muted. |
+| **Resolved** | Automatic | A finding changed from `FAIL` to `PASS` in a later scan. A passed finding with no saved triage state also appears as **Resolved**. |
+| **Reopened** | Automatic | A finding changed from `PASS` to `FAIL` in a later scan. |
+
+
+
+Resolved and Reopened are not manual selector options.
+
+These automatic states keep triage tied to the finding UID across scans, even when each scan creates a new finding snapshot.
+
+## Change a Triage Status
+
+<Steps>
+ <Step title="Open Findings">
+ Go to **Findings** in Prowler Cloud.
+ </Step>
+ <Step title="Select an individual finding">
+ Expand a Finding Group, open a resource findings table, or use a standalone finding row.
+ </Step>
+ <Step title="Open the triage selector">
+ In the **Triage** column, click the current status.
+ </Step>
+ <Step title="Choose a status">
+ Select **Open**, **Under Review**, **Remediating**, **Risk Accepted**, or **False Positive**.
+ </Step>
+</Steps>
+
+Changing a finding to **Risk Accepted** or **False Positive** will mute the finding. Prowler asks for confirmation and creates a mute rule for the finding.
+
+## Add or Edit a Triage Note
+
+Triage notes are visible only to the team in the current organization. Each note supports up to 500 characters.
+
+<Steps>
+ <Step title="Open the finding actions menu">
+ On an individual finding row, click the actions menu.
+ </Step>
+ <Step title="Open the note modal">
+ Click **Add Triage Note**. If a note already exists, click **Open note**.
+ </Step>
+ <Step title="Set status and note text">
+ Optionally change the status, then write the note.
+ </Step>
+ <Step title="Save changes">
+ Click **Save changes**.
+ </Step>
+</Steps>
+
+
+
+To remove an existing note, clear the note text and save the change.
+
+## Mutelist Behavior
+
+Findings Triage uses Mutelist when a status means the finding should be muted:
+
+- **Risk Accepted** creates a mute rule because the team accepts the finding as a known risk.
+- **False Positive** creates a mute rule because the finding should not count as an active issue.
+
+Use [Simple Mutelist](/user-guide/tutorials/prowler-app-simple-mutelist) to review, disable, or delete mute rules created through this workflow. For pattern-based muting, use [Advanced Mutelist](/user-guide/tutorials/prowler-app-mute-findings).
+
+<Warning>
+Muting a finding does not fix the underlying configuration. Review the finding before using **Risk Accepted** or **False Positive**.
+</Warning>
+
+## Troubleshooting
+
+### Triage controls do not appear
+
+Make sure the row is an individual finding row. Finding Groups rows do not show triage controls. Expand a group to see affected resources and their triage controls.
+
+### Changes cannot be saved
+
+Confirm that the user role has **Manage Scans** permission. Prowler Local Server does not support Findings Triage writes.
+
+### Resolved or Reopened is missing from the selector
+
+This is expected. Prowler sets **Resolved** and **Reopened** automatically from scan result changes.
+
+### Risk Accepted or False Positive muted a finding
+
+This is expected. Those statuses create a mute rule through Mutelist.
diff --git a/docs/user-guide/tutorials/prowler-app-jira-integration.mdx b/docs/user-guide/tutorials/prowler-app-jira-integration.mdx
index 01779a6a96..83554ee8c0 100644
--- a/docs/user-guide/tutorials/prowler-app-jira-integration.mdx
+++ b/docs/user-guide/tutorials/prowler-app-jira-integration.mdx
@@ -1,13 +1,17 @@
---
title: "Jira Integration"
+sidebarTitle: 'Jira'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.12.0" />
-Prowler App enables automatic export of security findings to Jira, providing seamless integration with Atlassian's work item tracking and project management platform. This comprehensive guide demonstrates how to configure and manage Jira integrations to streamline security incident management and enhance team collaboration across security workflows.
+<AppliesTo />
-Integrating Prowler App with Jira provides:
+Prowler Cloud enables automatic export of security findings to Jira, providing seamless integration with Atlassian's work item tracking and project management platform. This comprehensive guide demonstrates how to configure and manage Jira integrations to streamline security incident management and enhance team collaboration across security workflows.
+
+Integrating Prowler Cloud with Jira provides:
* **Streamlined management:** Convert security findings directly into actionable Jira work items
* **Enhanced team collaboration:** Leverage existing project management workflows for security remediation
@@ -22,9 +26,9 @@ When enabled and configured:
## Configuration
-To configure Jira integration in Prowler App:
+To configure Jira integration in Prowler Cloud:
-1. Navigate to **Integrations** in the Prowler App interface
+1. Navigate to **Integrations** in Prowler Cloud
2. Locate the **Jira** card and click **Manage**, then select **Add integration**
@@ -50,7 +54,7 @@ Once configured successfully, the integration is ready to send findings to Jira.
To manually send individual findings to Jira:
-1. Navigate to the **Findings** section in Prowler App
+1. Navigate to the **Findings** section in Prowler Cloud
2. Select one finding you want to export
3. Click the action button on the table row and select **Send to Jira**
4. Select the Jira integration and project
diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx
index 0a0179ee79..eee7564bcb 100644
--- a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx
+++ b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx
@@ -1,5 +1,6 @@
---
title: 'Using Multiple LLM Providers with Lighthouse'
+sidebarTitle: 'Multiple LLM Providers'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
@@ -32,13 +33,13 @@ All three providers can be configured for a tenant, but only one can be set as t
When visiting Lighthouse AI chat, the default provider's default model loads automatically. Users can switch to any available LLM model (including those from non-default providers) using the dropdown in chat.
-<img src="/images/prowler-app/lighthouse-switch-models.png" alt="Switch models in Lighthouse AI chat interface" />
+<img src="/images/prowler-app/lighthouse/oss/switch-models.png" alt="Switch models in Lighthouse AI chat interface" />
## Configuring Providers
Navigate to **Configuration** → **Lighthouse AI** to see all three provider options with a **Connect** button under each.
-<img src="/images/prowler-app/lighthouse-configuration.png" alt="Prowler Lighthouse Configuration" />
+<img src="/images/prowler-app/lighthouse/oss/configuration.png" alt="Prowler Lighthouse Configuration" />
### Connecting a Provider
@@ -128,6 +129,25 @@ To connect a provider:
3. Configure in Lighthouse AI:
- **API Key**: OpenRouter API key
- **Base URL**: `https://openrouter.ai/api/v1`
+
+ ### Base URL Validation
+
+ To prevent server-side request forgery (SSRF), Prowler API validates the base URL before connecting to it:
+
+ - The URL must use HTTPS.
+ - The host must resolve to a public IP address. Private, loopback, link-local, and cloud metadata addresses are rejected.
+
+ <Warning>
+ This validation can break configurations that point to internal endpoints, such as a self-hosted Ollama server. This is intentional: it fixes a security issue where the Prowler API could be directed to internal services. Internal endpoints must now be allowed explicitly through `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS`.
+ </Warning>
+
+ To allow internal endpoints, set a comma-separated list of hostnames or IP addresses in the Prowler API environment (for Docker Compose deployments, the shared `.env` file):
+
+ ```bash
+ LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=custom-openai.internal,10.0.0.20
+ ```
+
+ Hosts in this list skip the public-endpoint validation. HTTPS is still required, so the endpoint needs a certificate the Prowler API trusts.
</Tab>
</Tabs>
@@ -139,7 +159,7 @@ To set a different provider as default:
2. Click **Configure** under the desired provider to set as default
3. Click **Set as Default**
-<img src="/images/prowler-app/lighthouse-set-default-provider.png" alt="Set default LLM provider" />
+<img src="/images/prowler-app/lighthouse/oss/set-default-provider.png" alt="Set default LLM provider" />
## Updating Provider Credentials
diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx
index b119893cb5..5b4a0f5847 100644
--- a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx
+++ b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx
@@ -8,6 +8,10 @@ import { VersionBadge } from "/snippets/version-badge.mdx"
Prowler Lighthouse AI integrates Large Language Models (LLMs) with Prowler security findings data.
+<Info>
+Using Prowler Cloud? Lighthouse AI on Prowler Cloud adds persistent chat sessions, GPT-5.5 as the default model, a dedicated agentic (chat) view, and transparent reasoning. See [Lighthouse AI on Prowler Cloud](/getting-started/products/prowler-cloud-lighthouse).
+</Info>
+
Behind the scenes, Lighthouse AI works as follows:
- Lighthouse AI runs as a [Langchain agent](https://docs.langchain.com/oss/javascript/langchain/agents) in NextJS
@@ -15,7 +19,7 @@ Behind the scenes, Lighthouse AI works as follows:
- The agent accesses Prowler data through [Prowler MCP](https://docs.prowler.com/getting-started/products/prowler-mcp), which exposes tools from multiple sources, including:
- Prowler Hub
- Prowler Docs
- - Prowler App
+ - Prowler Local Server
- Instead of calling every tool directly, the agent uses two meta-tools:
- `describe_tool` to retrieve a tool schema and parameter requirements.
- `execute_tool` to run the selected tool with the required input.
@@ -47,7 +51,7 @@ Getting started with Prowler Lighthouse AI is easy:
For detailed configuration instructions for each provider, see [Using Multiple LLM Providers with Lighthouse](/user-guide/tutorials/prowler-app-lighthouse-multi-llm).
</Note>
-<img src="/images/prowler-app/lighthouse-configuration.png" alt="Lighthouse AI Configuration" />
+<img src="/images/prowler-app/lighthouse/oss/configuration.png" alt="Lighthouse AI Configuration" />
### Adding Business Context
diff --git a/docs/user-guide/tutorials/prowler-app-multi-tenant.mdx b/docs/user-guide/tutorials/prowler-app-multi-tenant.mdx
index b353bc85c5..8de9365fe9 100644
--- a/docs/user-guide/tutorials/prowler-app-multi-tenant.mdx
+++ b/docs/user-guide/tutorials/prowler-app-multi-tenant.mdx
@@ -1,12 +1,16 @@
---
title: 'Managing Organizations (Multi-Tenant)'
+sidebarTitle: 'Organizations'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.23.0" />
-Prowler App supports multi-tenancy through **Organizations**, allowing users to belong to multiple isolated environments within a single account. Each organization maintains its own providers, scans, findings, and user memberships, ensuring complete data separation between teams or business units.
+<AppliesTo />
+
+Prowler Cloud supports multi-tenancy through **Organizations**, allowing users to belong to multiple isolated environments within a single account. Each organization maintains its own providers, scans, findings, and user memberships, ensuring complete data separation between teams or business units.
## Key Concepts
@@ -128,7 +132,7 @@ When invited to join an organization, the invited user receives a link to accept
1. Open the invitation link.
-2. If already authenticated, the invitation is accepted automatically and the user is redirected to Prowler App.
+2. If already authenticated, the invitation is accepted automatically and the user is redirected to Prowler Cloud.
3. If not authenticated, choose **I have an account -- Sign in**, authenticate with existing credentials, and the invitation is accepted upon sign-in.
diff --git a/docs/user-guide/tutorials/prowler-app-mute-findings.mdx b/docs/user-guide/tutorials/prowler-app-mute-findings.mdx
index 82623b54cf..c2ada47e9c 100644
--- a/docs/user-guide/tutorials/prowler-app-mute-findings.mdx
+++ b/docs/user-guide/tutorials/prowler-app-mute-findings.mdx
@@ -1,11 +1,14 @@
---
-title: 'Advanced Mutelist (YAML)'
+title: 'Advanced Mutelist'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.9.0" />
-Prowler App allows users to mute specific findings to focus on the most critical security issues. This guide demonstrates how to use the Advanced Mutelist feature with YAML configuration for complex, pattern-based muting rules.
+<AppliesTo />
+
+Prowler Cloud allows users to mute specific findings to focus on the most critical security issues. This guide demonstrates how to use the Advanced Mutelist feature with YAML configuration for complex, pattern-based muting rules.
<Note>
For muting individual findings without YAML configuration, use [Simple Mutelist](/user-guide/tutorials/prowler-app-simple-mutelist) to mute findings directly from the Findings table.
@@ -31,8 +34,8 @@ Advanced Mutelist requires the **Manage Account** permission. See [RBAC Administ
Before muting findings, ensure:
-- Valid access to Prowler App with appropriate permissions
-- A provider added to the Prowler App
+- Valid access to Prowler Cloud with appropriate permissions
+- A provider added to Prowler Cloud
- Understanding of the security implications of muting specific findings
<Warning>
@@ -43,7 +46,7 @@ Muting findings does not resolve underlying security issues. Review each finding
To configure Advanced Mutelist:
-1. Log into Prowler App
+1. Log into Prowler Cloud
2. Navigate to the Providers page
3. Connect a provider to enable Mutelist configuration
@@ -423,7 +426,7 @@ Mutelist:
### Priority: Advanced vs. Simple Mutelist
-When both Advanced Mutelist (YAML) and [Simple Mutelist](/user-guide/tutorials/prowler-app-simple-mutelist) rules match the same finding, the **Advanced Mutelist takes higher priority**. The finding will be muted with the reason "Muted by mutelist". If a finding is not matched by the Advanced Mutelist but matches a Simple Mutelist rule, the Simple rule's custom justification is used instead.
+When both Advanced Mutelist and [Simple Mutelist](/user-guide/tutorials/prowler-app-simple-mutelist) rules match the same finding, the **Advanced Mutelist takes higher priority**. The finding will be muted with the reason "Muted by mutelist". If a finding is not matched by the Advanced Mutelist but matches a Simple Mutelist rule, the Simple rule's custom justification is used instead.
### Best Practices
@@ -436,7 +439,7 @@ When both Advanced Mutelist (YAML) and [Simple Mutelist](/user-guide/tutorials/p
### Validation
-Prowler App validates your mutelist configuration and will display errors for:
+Prowler Cloud validates the mutelist configuration and will display errors for:
- Invalid YAML syntax
- Missing required fields
diff --git a/docs/user-guide/tutorials/prowler-app-rbac.mdx b/docs/user-guide/tutorials/prowler-app-rbac.mdx
index cabea5bd35..4533e0423c 100644
--- a/docs/user-guide/tutorials/prowler-app-rbac.mdx
+++ b/docs/user-guide/tutorials/prowler-app-rbac.mdx
@@ -1,12 +1,16 @@
---
title: 'Managing Users and Role-Based Access Control (RBAC)'
+sidebarTitle: 'Users & RBAC'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.1.0" />
-**Prowler App** supports multiple users within a single tenant, enabling seamless collaboration by allowing team members to easily share insights and manage security findings.
+<AppliesTo />
+
+**Prowler Cloud** supports multiple users within a single tenant, enabling seamless collaboration by allowing team members to easily share insights and manage security findings.
[Roles](#roles) help you control user permissions, determining what actions each user can perform and the data they can access within Prowler. By default, each account includes an immutable **admin** role, ensuring that your account always retains administrative access.
@@ -40,6 +44,11 @@ Follow these steps to edit a user of your account:
<img src="/images/prowler-app/rbac/user_edit_details.png" alt="Edit User Details" width="700" />
+<Note>
+Users can edit their own account details. Editing another user's account details requires the **Invite and Manage Users** or **admin** permission.
+
+</Note>
+
#### Removing a User
Follow these steps to remove a user of your account:
@@ -119,7 +128,7 @@ To resend the invitation to the user, it is necessary to explicitly **delete the
## Managing Groups and Roles
-The Roles section in Prowler is designed to facilitate the assignment of custom user privileges. This section allows administrators to define roles with specific permissions for Prowler administrative tasks and Account visibility.
+Roles combine administrative permissions with provider visibility. Administrative permissions control the actions a role can perform. Provider Groups and Unlimited Visibility control the providers, resources, findings, scans, and compliance results the role can access.
<Note>
**Only users that have the _Manage Account_ or _admin_ permission can access this section.**
@@ -127,47 +136,53 @@ The Roles section in Prowler is designed to facilitate the assignment of custom
</Note>
### Provider Groups
-Provider Groups control visibility across specific providers. When creating a new role, you can assign specific groups to define their Provider visibility. This ensures that users with that role have access only to the Providers that are required.
+Provider Groups limit visibility to selected providers. Assigning one or more Provider Groups to a role grants access to the providers in those groups and their resources, findings, scans, and compliance results.
-By default, a new user role does not have visibility into any group.
+New roles have no provider visibility by default. Assign at least one Provider Group or enable **Unlimited Visibility** before assigning the role to users who need access to provider data.
-Alternatively, to grant the role unlimited visibility across all providers, check the Grant Unlimited Visibility checkbox.
+**Unlimited Visibility** grants organization-wide visibility across every provider, regardless of the Provider Groups assigned to the role. It does not grant administrative permissions.
#### Creating a Provider Group
Follow these steps to create a provider group in your account:
-1. Navigate to **Provider Groups** from the side menu..
+1. Click **Providers** in the side menu.
-2. In this view you can select the provider groups you want to assign to one or more roles.
+2. Select the **Provider Groups** tab.
-3. Click the **Create Group** button on the center of the screen.
+3. Enter a group name in the **Create a new provider group** form.
- <img src="/images/prowler-app/rbac/provider_group.png" alt="Create Provider Group" width="700" />
+4. Select the providers that the group controls. Optionally, select the roles that should use the group.
+
+5. Click **Create Group**.
+
+ <img src="/images/prowler-app/rbac/provider_group.png" alt="Create a Provider Group" width="700" />
#### Editing a Provider Group
Follow these steps to edit a provider group on your account:
-1. Navigate to **Provider Groups** from the side menu.
+1. Click **Providers** in the side menu and select the **Provider Groups** tab.
-2. Click the edit button of the provider group you want to modify.
+2. Open the actions menu for the Provider Group and click **Edit Provider Group**.
- <img src="/images/prowler-app/rbac/provider_group_edit.png" alt="Edit Provider Group" width="700" />
+ <img src="/images/prowler-app/rbac/provider_group_edit.png" alt="Edit Provider Group action" width="300" />
-3. Change the provider group parameters you need and save the changes.
+3. Update the group name, providers, or roles, and save the changes.
- <img src="/images/prowler-app/rbac/provider_group_edit_1.png" alt="Edit Provider Group Details" width="700" />
+ <img src="/images/prowler-app/rbac/provider_group_edit_1.png" alt="Edit Provider Group form" width="700" />
#### Removing a Provider Group
-Follow these steps to remove a provider group of your account:
+Follow these steps to remove a provider group from your account:
-1. Navigate to **Provider Groups** from the side menu.
+1. Click **Providers** in the side menu and select the **Provider Groups** tab.
-2. Click on the delete button of the provider group you want to remove.
+2. Open the actions menu for the Provider Group and click **Delete Provider Group**.
- <img src="/images/prowler-app/rbac/provider_group_remove.png" alt="Remove Provider Group" width="700" />
+3. Confirm the deletion.
+
+ <img src="/images/prowler-app/rbac/provider_group_remove.png" alt="Delete Provider Group confirmation" width="700" />
### Roles
@@ -177,19 +192,20 @@ Follow these steps to create a role for your account:
1. Navigate to **Roles** from the side menu.
-2. Click on the **Add Role** button on the top right-hand corner of the screen.
+2. Click **Add Role**.
- <img src="/images/prowler-app/rbac/role_create.png" alt="Create Role" width="700" />
+3. Enter the role name and select the required administrative permissions.
-3. In the Add Role screen, enter the role name, the administration permissions and the groups of providers to which the Role will have access to.
-
-4. In the Groups and Account Visibility section, you will see a list of available groups with checkboxes next to them. To assign a group to the user role, simply click the checkbox next to the group name. If you need to assign multiple groups, repeat the process for each group you wish to add.
+4. Configure **Visibility**:
+ - To grant organization-wide visibility, select **Enable Unlimited Visibility for this role**.
+ - To limit visibility, leave Unlimited Visibility cleared and select one or more Provider Groups.
<img src="/images/prowler-app/rbac/role_create_1.png" alt="Role parameters" width="700" />
+5. Click **Add Role**.
<Note>
-To assign read-only access, select only the `Unlimited Visibility` permission when creating the role. Then, go to the Users page and assign this role to the appropriate user.
+To grant read-only access across the organization, enable **Unlimited Visibility** without selecting administrative permissions. Then, assign the role from the **Users** page.
</Note>
#### Editing a Role
@@ -198,25 +214,21 @@ Follow these steps to edit a role on your account:
1. Navigate to **Roles** from the side menu.
-2. Click on the edit button of the role you want to modify.
+2. Open the actions menu for the role and click **Edit Role**.
- <img src="/images/prowler-app/rbac/role_edit.png" alt="Edit Role" width="700" />
-
-3. Adjust the settings as needed and save the changes.
-
- <img src="/images/prowler-app/rbac/role_edit_details.png" alt="Edit Role Details" width="700" />
+3. Update the role name, administrative permissions, Unlimited Visibility setting, or Provider Groups.
+4. Save the changes.
#### Removing a Role
-Follow these steps to remove a role of your account:
+Follow these steps to remove a role from your account:
1. Navigate to **Roles** from the side menu.
-2. Click on the delete button of the role you want to remove.
-
- <img src="/images/prowler-app/rbac/role_remove.png" alt="Remove Role" width="700" />
+2. Open the actions menu for the role and click **Delete Role**.
+3. Confirm the deletion.
## RBAC Administrative Permissions
@@ -226,8 +238,8 @@ Assign administrative permissions by selecting from the following options:
|------------|-------|-------------|
| Invite and Manage Users | All | Invite new users and manage existing ones. |
| Manage Account | All | Adjust account settings, delete users and read/manage users permissions. |
-| Manage Scans | All | Run and review scans. |
-| Manage Providers | All | Add or modify connected providers. |
+| Manage Scans | All | Run and review scans, and manage [Scan Configuration](/user-guide/tutorials/prowler-app-scan-configuration) settings. |
+| Manage Providers | All | Add or modify connected providers, and attach or detach providers from a [Scan Configuration](/user-guide/tutorials/prowler-app-scan-configuration) (in addition to Manage Scans). |
| Manage Integrations | All | Add or modify the Prowler Integrations. |
| Manage Ingestions | Prowler Cloud | Allow or deny the ability to submit findings ingestion batches via the API. |
| Manage Billing | Prowler Cloud | Access and manage billing settings and subscription information. |
diff --git a/docs/user-guide/tutorials/prowler-app-s3-integration.mdx b/docs/user-guide/tutorials/prowler-app-s3-integration.mdx
index 284b10eaaf..9b7d7a9a2e 100644
--- a/docs/user-guide/tutorials/prowler-app-s3-integration.mdx
+++ b/docs/user-guide/tutorials/prowler-app-s3-integration.mdx
@@ -1,12 +1,16 @@
---
title: 'Amazon S3 Integration'
+sidebarTitle: 'Amazon S3'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.10.0" />
-**Prowler App** allows automatic export of scan results to Amazon S3 buckets, providing seamless integration with existing data workflows and storage infrastructure. This comprehensive guide demonstrates configuration and management of Amazon S3 integrations to streamline security finding management and reporting.
+<AppliesTo />
+
+**Prowler Cloud** allows automatic export of scan results to Amazon S3 buckets, providing seamless integration with existing data workflows and storage infrastructure. This comprehensive guide demonstrates configuration and management of Amazon S3 integrations to streamline security finding management and reporting.
When enabled and configured, scan results are automatically stored in the configured bucket. Results are provided in `csv`, `html` and `json-ocsf` formats, offering flexibility for custom integrations:
@@ -201,7 +205,7 @@ Replace `<SOURCE ACCOUNT ID>` with the AWS account ID that contains the IAM role
</Note>
### Available Templates
-**Prowler App** provides Infrastructure as Code (IaC) templates to automate IAM role setup with S3 integration permissions.
+**Prowler Cloud** provides Infrastructure as Code (IaC) templates to automate IAM role setup with S3 integration permissions.
<Note>
Templates are optional. Custom IAM roles or static credentials can be used instead.
@@ -259,8 +263,8 @@ If using Prowler's CloudFormation template, execute the following command to upd
- `EnableS3Integration`: Select "true"
- `S3IntegrationBucketName`: Your bucket name
- `S3IntegrationBucketAccountId`: Bucket owner's AWS account ID
-5. In the "Configure stack options" screen, again, leave everything as it is and click on "Next"
-6. Finally, under "Review Prowler", at the bottom click on "Submit"
+5. In the "Configure stack options" screen, again, leave everything as it is and click "Next"
+6. Finally, under "Review Prowler", at the bottom click "Submit"
#### Terraform
@@ -278,7 +282,7 @@ If using Prowler's CloudFormation template, execute the following command to upd
3. Edit `terraform.tfvars` with your specific values:
```hcl
- # Required: External ID from Prowler App
+ # Required: External ID from Prowler Cloud
external_id = "your-unique-external-id-here"
# S3 Integration Configuration
@@ -310,11 +314,11 @@ For detailed information, refer to the [Terraform README](https://github.com/pro
## Configuration
-Once the required permissions are set up, proceed to configure the S3 integration in **Prowler App**.
+Once the required permissions are set up, proceed to configure the S3 integration in **Prowler Cloud**.
1. Navigate to "Integrations"
-2. Locate the Amazon S3 Integration card and click on the "Configure" button
+2. Locate the Amazon S3 Integration card and click the "Configure" button
3. Click the "Add Integration" button
diff --git a/docs/user-guide/tutorials/prowler-app-scan-configuration.mdx b/docs/user-guide/tutorials/prowler-app-scan-configuration.mdx
new file mode 100644
index 0000000000..60e0db2f4c
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-app-scan-configuration.mdx
@@ -0,0 +1,231 @@
+---
+title: 'Scan Configuration'
+sidebarTitle: 'Configuration'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+<VersionBadge version="5.32.0" />
+
+Scan Configuration lets you override, per provider, specific values in the default configuration Prowler's checks use during a scan. Each configuration can modify how specific checks behave, such as thresholds, allowed values, and retention windows, or exclude checks and services from the scan scope. Attach it to the providers that should use it on their next scan.
+
+<SubscriptionBanner />
+
+## What Is a Scan Configuration?
+
+A Scan Configuration lets you **override specific values, per provider**, on top of Prowler's defaults. It's merged with those defaults, not a full replacement:
+
+- A provider type you don't add a section for keeps using `config.yaml` untouched.
+- **A provider type you do add a section for has its keys merged over `config.yaml` for that provider.** Only the keys you set are overridden; every key you leave out keeps its default from `config.yaml`, because each check falls back to the default configuration when a value isn't provided. See [How It's Applied](#how-its-applied) for details.
+- It is stored per organization and applied to the **providers you attach** to it.
+- **Attaching a provider is optional at creation time.** You can save a Scan Configuration with no providers attached and associate them later, either from the configuration's editor or from the **Providers** page (see [Attaching Providers](#attaching-providers)). It has no effect on any scan until at least one provider is attached.
+- A provider can be attached to **at most one** Scan Configuration at a time.
+- Changes take effect on the provider's **next scan** and do not re-run past scans.
+
+
+<Note>
+The full set of configurable values and their defaults lives in [`prowler/config/config.yaml`](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml). For what each key means and which checks read it, see the [Configuration File tutorial](/user-guide/cli/tutorials/configuration_file).
+</Note>
+
+## Required Permissions
+
+Scan Configuration access is governed by Role-Based Access Control (RBAC). See [RBAC Administrative Permissions](/user-guide/tutorials/prowler-app-rbac#rbac-administrative-permissions) for details on each permission.
+
+- **Viewing** a Scan Configuration doesn't require any specific permission.
+- **Creating, editing, and deleting** a Scan Configuration requires the **Manage Scans** permission.
+- **Attaching or detaching providers** requires the **Manage Providers** permission as well, in addition to Manage Scans. This applies to explicit changes to the attached providers, and to deleting a Scan Configuration that still has providers attached (deleting it detaches them too).
+- Attaching or detaching a provider also requires that provider to be **visible to your role**. Visibility comes from the [Provider Groups](/user-guide/tutorials/prowler-app-rbac#provider-groups) assigned to your role, or from **Unlimited Visibility**. You can't attach a provider you can't see, and you can't detach one either, whether by removing it from the list or by deleting the Scan Configuration it's attached to.
+
+## Config Schema
+
+The YAML follows the structure of `config.yaml`: a mapping keyed by provider, with each provider section holding the keys you want to change. You only list the keys you want to override; they're merged over that provider's `config.yaml` defaults.
+
+```yaml
+aws:
+ max_unused_access_keys_days: 30
+ max_console_access_days: 30
+ max_security_group_rules: 25
+
+azure:
+ defender_attack_path_minimal_risk_level: "Critical"
+
+gcp:
+ storage_min_retention_days: 30
+```
+
+### Limiting the Scan Scope
+
+<VersionBadge version="5.35.0" />
+
+Use `excluded_checks` to skip individual checks and `excluded_services` to skip every check in a service for the matching provider type:
+
+```yaml
+aws:
+ excluded_checks:
+ - s3_bucket_public_access
+ excluded_services:
+ - ec2
+```
+
+<Warning>
+When a Scan Configuration excludes checks or services, Prowler calculates overviews, aggregations, and other result-based information from the reduced scan scope. The displayed information reflects only the checks and services that ran, not a complete assessment of the provider. Consider the applied Scan Configuration when interpreting totals and security posture.
+</Warning>
+
+## Creating a Scan Configuration
+
+<Steps>
+ <Step title="Open the editor">
+ On the **Scan** page (under **Configuration**), click **New Scan Configuration**.
+ </Step>
+ <Step title="Name it">
+ Give the configuration a descriptive **Name** (3–100 characters), e.g. `stricter-iam-aws`.
+ </Step>
+ <Step title="Write the configuration file">
+ In the **Configuration (YAML)** field, add the keys you want to change, grouped by provider. Only the keys you set are overridden; every other key keeps its `config.yaml` default. The editor is pre-filled with a representative default placeholder you can use as a starting point.
+ </Step>
+ <Step title="Attach providers (optional)">
+ Under **Attach to providers**, pick the providers that should use this configuration. This is optional, you can save without any provider and attach them later, either by editing this configuration or from the **Providers** page (see [Attaching Providers](#attaching-providers)).
+ </Step>
+ <Step title="Save">
+ Click **Save**. The server validates the configuration values and, if everything is valid, stores it and attaches the selected providers.
+ </Step>
+</Steps>
+
+<Tip>
+You don't need to fill in every provider. A section you don't include leaves that provider's `config.yaml` untouched. Within a section you do include, only add the keys you want to change; the rest keep their `config.yaml` defaults. The placeholder shown in the editor is just an example; if you leave the field with only the placeholder (greyed-out) text, nothing is saved.
+</Tip>
+
+## How Validation Works
+
+Prowler checks your configuration in two stages, the same way the Advanced Mutelist editor does:
+
+1. **As you type: is it well-formed?** The editor checks that what you've written is valid YAML. If something is off, you'll see an `Invalid YAML format` message and **Save** stays disabled until you fix it. Once it's clean, it shows **Valid YAML format**.
+2. **When you save: are the values allowed?** Saving checks that each value is one Prowler accepts, the right type, within range, and one of the allowed options where a key only takes a fixed set of choices. If a value isn't allowed, the editor points to the exact key and explains why, right beneath the field, so you can correct it and save again.
+
+For example, `azure.defender_attack_path_minimal_risk_level` only accepts `Low`, `Medium`, `High`, or `Critical`. Saving any other value returns an inline error like:
+
+```
+azure.defender_attack_path_minimal_risk_level: Input should be 'Low', 'Medium', 'High' or 'Critical'
+```
+
+<Warning>
+**Valid YAML format** only means the text is well-formed; it doesn't mean your values are accepted. Those are checked when you save.
+
+Be careful with indentation. A line like `azure: defender_attack_path_minimal_risk_level: Critical` (no line break and indent after `azure:`) is still valid YAML, but Prowler reads it as one long key name instead of a setting inside the `azure` section, so the value is silently ignored. Always nest provider keys:
+
+```yaml
+azure:
+ defender_attack_path_minimal_risk_level: "Critical"
+```
+</Warning>
+
+<Info>
+Prowler won't flag a section or key it doesn't recognize. It accepts them without error, so custom checks and plugins can add their own settings. The trade-off: a typo in a key or section name isn't rejected either, and that misspelled setting simply won't apply. Double-check your spelling against `config.yaml`.
+</Info>
+
+## Attaching Providers
+
+A Scan Configuration only has an effect once it's attached to one or more providers. There are two ways to manage attachments.
+
+### From the Scan Config Editor
+
+In the **Attach to providers** field, select the providers that should use this configuration. Providers already attached to **another** configuration are hidden from the selector, since each provider can belong to only one configuration at a time.
+
+### From the Provider's Row Menu
+
+You can also manage a provider's configuration from **Providers**:
+
+<Steps>
+ <Step title="Open the provider menu">
+ On the **Providers** page, open the **⋮** menu on a provider row.
+ </Step>
+ <Step title="Click **Edit Scan Configuration**.">
+ </Step>
+ <Step title="Pick a configuration">
+ In the dialog, pick a configuration from the dropdown to apply it (picking a different one moves the provider), or pick **Default** to detach it and go back to the built-in `config.yaml` defaults. Then click **Save**.
+ </Step>
+</Steps>
+
+<Note>
+This dialog only **associates or disassociates** an existing configuration. To create or edit the configuration's YAML, use the **Scan Config** view (a link is provided in the dialog).
+</Note>
+
+<Info>
+Because a provider can belong to only one configuration, associating a provider that is already attached elsewhere **moves** it to the new configuration automatically; it is removed from the previous one.
+</Info>
+
+## Editing and Deleting
+
+On the **Scan Config** page, open the **⋮** menu on a configuration row:
+
+- **Edit:** Choose **Edit** to open the editor, change its name, YAML, or attached providers, and click **Update**. Editing the YAML always happens here, never from the provider row.
+- **Delete:** Choose **Delete** (in the danger zone) and confirm. Providers that were attached fall back to the built-in defaults from `config.yaml` on their next scan.
+
+## How It's Applied
+
+When a scan runs for a provider:
+
+1. If the provider is attached to a Scan Configuration **and that configuration has a section for the provider's type** (e.g. `aws` for an AWS provider), Prowler merges that section over `config.yaml` for that provider's scan: the keys you set win, and every key you didn't set keeps its `config.yaml` default.
+2. If the provider is attached to a Scan Configuration, but that configuration **has no section for the provider's type** (for example, a configuration that only defines an `aws` section, attached to a GCP provider), the scan uses the built-in defaults from `config.yaml` for that provider, exactly as if no Scan Configuration were attached at all.
+3. If the provider isn't attached to any Scan Configuration, the built-in defaults from `config.yaml` are used.
+
+<Note>
+The merge is per key. A key you don't set keeps its `config.yaml` default, because each check falls back to the default configuration when a value isn't provided. You only need to list the keys you want to change.
+</Note>
+
+<Tip>
+A single Scan Configuration can hold sections for several provider types at once (see [Config Schema](#config-schema)) and be attached to providers of different types. Each provider only ever picks up the section matching its own type; the rest of the YAML is ignored for that provider.
+</Tip>
+
+## Effect on Compliance Results
+
+Some compliance requirements only hold if the checks they map to ran with a strict-enough configuration. For example, a requirement expecting unused access keys to be disabled within 45 days loses its meaning if a Scan Configuration raises `max_unused_access_keys_days` to 120: the check would still PASS, but the requirement wouldn't really be met.
+
+When a scan's applied configuration doesn't meet a requirement's expectations, Prowler marks that requirement as **FAIL** on the Compliance page, even if every individual finding passed. The requirement shows an info icon (and, when expanded, an inline alert) with:
+
+> Marked as FAIL because the applied scan configuration does not meet this requirement, even though all findings passed.
+
+This only affects requirements built around a configurable check that declares this kind of expectation; requirements without one are never affected by an attached Scan Configuration.
+
+## Common Examples
+
+Each example below shows only the keys being changed for that provider.
+
+<Note>
+Only the keys shown are overridden. Every other key for that provider keeps its `config.yaml` default (see [How It's Applied](#how-its-applied)).
+</Note>
+
+**Stricter IAM (Identity and Access Management) hygiene for AWS:**
+
+```yaml
+aws:
+ max_unused_access_keys_days: 30
+ max_console_access_days: 30
+ max_unused_sagemaker_access_days: 45
+```
+
+**Raise Azure Defender attack-path sensitivity:**
+
+```yaml
+azure:
+ defender_attack_path_minimal_risk_level: "Critical"
+```
+
+**Tighten GCP storage retention and key rotation:**
+
+```yaml
+gcp:
+ storage_min_retention_days: 30
+ secretmanager_max_rotation_days: 30
+```
+
+## Troubleshooting
+
+### A Provider Doesn't Appear in the Selector
+
+The provider is already attached to another Scan Configuration. Detach it there first, or use the provider row menu to move it.
+
+### You Can't Attach or Detach Providers
+
+If you can edit the configuration but not change its providers, or an error mentions a provider ID that "wasn't found", you're missing the **Manage Providers** permission or the provider isn't visible to your role. A provider outside your visibility is reported the same way as one that doesn't exist, so it isn't revealed to roles that shouldn't see it. See [Required Permissions](#required-permissions).
diff --git a/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx b/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx
index 592ff2b26d..977ad8e6f1 100644
--- a/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx
+++ b/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx
@@ -1,13 +1,17 @@
---
title: "AWS Security Hub Integration"
+sidebarTitle: 'AWS Security Hub'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.11.0" />
-Prowler App enables automatic export of security findings to AWS Security Hub, providing seamless integration with AWS's native security and compliance service. This comprehensive guide demonstrates how to configure and manage AWS Security Hub integrations to centralize security findings and enhance compliance tracking across AWS environments.
+<AppliesTo />
-Integrating Prowler App with AWS Security Hub provides:
+Prowler Cloud enables automatic export of security findings to AWS Security Hub, providing seamless integration with AWS's native security and compliance service. This comprehensive guide demonstrates how to configure and manage AWS Security Hub integrations to centralize security findings and enhance compliance tracking across AWS environments.
+
+Integrating Prowler Cloud with AWS Security Hub provides:
* **Centralized security visibility:** Consolidate findings from multiple AWS accounts and regions
* **Native AWS integration:** Leverage existing AWS security workflows and compliance frameworks
@@ -30,7 +34,7 @@ Refer to [AWS Security Hub pricing](https://aws.amazon.com/security-hub/pricing/
</Note>
## Prerequisites
-Before configuring AWS Security Hub Integration in Prowler App, complete these steps:
+Before configuring AWS Security Hub Integration in Prowler Cloud, complete these steps:
### AWS Security Hub Setup
@@ -42,9 +46,9 @@ Configure AWS credentials by following the [AWS authentication setup guide](/use
## Configuration
-To configure AWS Security Hub integration in Prowler App:
+To configure AWS Security Hub integration in Prowler Cloud:
-1. Navigate to **Integrations** in the Prowler App interface
+1. Navigate to **Integrations** in Prowler Cloud
2. Locate the **AWS Security Hub** card and click **Manage**, then select **Add integration**
diff --git a/docs/user-guide/tutorials/prowler-app-simple-mutelist.mdx b/docs/user-guide/tutorials/prowler-app-simple-mutelist.mdx
index c0bd7db9b4..4b0d59e24a 100644
--- a/docs/user-guide/tutorials/prowler-app-simple-mutelist.mdx
+++ b/docs/user-guide/tutorials/prowler-app-simple-mutelist.mdx
@@ -3,10 +3,13 @@ title: "Simple Mutelist"
---
import { VersionBadge } from "/snippets/version-badge.mdx";
+import { AppliesTo } from "/snippets/applies-to.mdx";
<VersionBadge version="5.16.0" />
-Prowler App provides Simple Mutelist, an intuitive way to mute findings directly from the Findings page without writing YAML configuration. This feature streamlines the muting workflow by allowing individual or bulk muting with just a few clicks.
+<AppliesTo />
+
+Prowler Cloud provides Simple Mutelist, an intuitive way to mute findings directly from the Findings page without writing YAML configuration. This feature streamlines the muting workflow by allowing individual or bulk muting with just a few clicks.
## What Is Simple Mutelist?
diff --git a/docs/user-guide/tutorials/prowler-app-social-login.mdx b/docs/user-guide/tutorials/prowler-app-social-login.mdx
index 45fe8ec62f..62de6fbc9c 100644
--- a/docs/user-guide/tutorials/prowler-app-social-login.mdx
+++ b/docs/user-guide/tutorials/prowler-app-social-login.mdx
@@ -1,12 +1,16 @@
---
title: 'Social Login Configuration'
+sidebarTitle: 'Social Login'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.5.0" />
-**Prowler App** supports social login using Google and GitHub OAuth providers. This document guides you through configuring the required environment variables to enable social authentication.
+<AppliesTo />
+
+Prowler supports social login using Google and GitHub OAuth providers. In **Prowler Cloud** social login is available out of the box. In **Prowler Local Server**, enable it by configuring the environment variables described in this guide.
<img src="/images/prowler-app/social-login/social_login_buttons.png" alt="Social login buttons" width="700" />
## Configuring Social Login Credentials
diff --git a/docs/user-guide/tutorials/prowler-app-sso-entra.mdx b/docs/user-guide/tutorials/prowler-app-sso-entra.mdx
index 37f3bbdda5..07cf4709be 100644
--- a/docs/user-guide/tutorials/prowler-app-sso-entra.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso-entra.mdx
@@ -2,7 +2,11 @@
title: 'Entra ID Configuration'
---
-This page provides instructions for creating and configuring a Microsoft Entra ID (formerly Azure AD) application to use SAML SSO with Prowler App.
+import { AppliesTo } from "/snippets/applies-to.mdx"
+
+<AppliesTo />
+
+This page provides instructions for creating and configuring a Microsoft Entra ID (formerly Azure AD) application to use SAML SSO with Prowler Cloud.
You can find a walkthrough video [here](https://www.youtube.com/watch?v=zegqm55oJVk).
@@ -28,7 +32,7 @@ You can find a walkthrough video [here](https://www.youtube.com/watch?v=zegqm55o
-6. Enter the "Identifier (Entity ID)" and "Reply URL (Assertion Consumer Service URL)". These values can be obtained from the SAML SSO integration setup in Prowler App. For detailed instructions, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso) page.
+6. Enter the "Identifier (Entity ID)" and "Reply URL (Assertion Consumer Service URL)". These values can be obtained from the SAML SSO integration setup in Prowler Cloud. For detailed instructions, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso) page.
@@ -44,4 +48,4 @@ You can find a walkthrough video [here](https://www.youtube.com/watch?v=zegqm55o
-10. Save the downloaded Metadata XML to a file. To complete the setup, upload this file during the Prowler App integration. (See the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso) page for details).
+10. Save the downloaded Metadata XML to a file. To complete the setup, upload this file during the SAML SSO integration setup in Prowler Cloud. (See the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso) page for details).
diff --git a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
index 2f10d443ae..ce0e5edc79 100644
--- a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
@@ -2,20 +2,24 @@
title: 'SAML SSO: Google Workspace'
---
-This page explains how to configure SAML-based Single Sign-On (SSO) in Prowler App using **Google Workspace** as the Identity Provider (IdP). The setup is divided into two parts: create a custom SAML app in Google Admin Console, then complete the configuration in Prowler App.
+import { AppliesTo } from "/snippets/applies-to.mdx"
+
+<AppliesTo />
+
+This page explains how to configure SAML-based Single Sign-On (SSO) in Prowler Cloud using **Google Workspace** as the Identity Provider (IdP). The setup is divided into two parts: create a custom SAML app in Google Admin Console, then complete the configuration in Prowler Cloud.
<Info>
**Parallel Setup Required**
-Google Admin Console requires the ACS URL and Entity ID from Prowler App, while Prowler App displays these values only after opening the SAML configuration dialog. To work around this, open Prowler App in a separate browser tab, navigate to the profile page, open the "Configure SAML SSO" dialog, and copy the ACS URL and Entity ID before proceeding with the Google configuration.
+Google Admin Console requires the ACS URL and Entity ID from Prowler Cloud, while Prowler Cloud displays these values only after opening the SAML configuration dialog. To work around this, open Prowler Cloud in a separate browser tab, navigate to the profile page, open the "Configure SAML SSO" dialog, and copy the ACS URL and Entity ID before proceeding with the Google configuration.
</Info>
## Prerequisites
- **Google Workspace**: Super Admin access (or delegated admin with app management permissions).
-- **Prowler App**: Administrator access to the organization (role with "Manage Account" permission).
-- Prowler App version **5.9.0** or later.
+- **Prowler Cloud**: Administrator access to the organization (role with "Manage Account" permission).
+- Prowler version **5.9.0** or later.
---
@@ -44,7 +48,7 @@ On the **Google Identity Provider details** screen:
1. Google displays two options:
- **Option 1**: Click "Download Metadata" to save the XML file directly. This is the recommended approach.
- **Option 2**: Manually copy the **SSO URL**, **Entity ID**, and **Certificate**.
-2. Download the metadata. This file is required to complete the Prowler App configuration in Part B.
+2. Download the metadata. This file is required to complete the configuration in Prowler Cloud (Part B).
3. Click "Continue".
@@ -52,18 +56,18 @@ On the **Google Identity Provider details** screen:
<Warning>
**Save the Metadata File**
-Download and save the IdP metadata XML file before proceeding. This file cannot be easily retrieved later and is required to complete the SAML configuration in Prowler App.
+Download and save the IdP metadata XML file before proceeding. This file cannot be easily retrieved later and is required to complete the SAML configuration in Prowler Cloud.
</Warning>
### Step 4: Configure the Service Provider Details
-Enter the following values obtained from the SAML SSO configuration dialog in Prowler App (see [Part B, Step 1](#step-1-open-the-saml-configuration-dialog) for details on where to find them):
+Enter the following values obtained from the SAML SSO configuration dialog in Prowler Cloud (see [Part B, Step 1](#step-1-open-the-saml-configuration-dialog) for details on where to find them):
| Google Workspace Field | Value |
|------------------------|-------|
-| **ACS URL** | The Assertion Consumer Service (ACS) URL displayed in Prowler App (e.g., `https://api.prowler.com/api/v1/accounts/saml/your-domain.com/acs/`). Self-hosted deployments use a different base URL. |
-| **Entity ID** | The Audience URI displayed in Prowler App (e.g., `urn:prowler.com:sp`). |
+| **ACS URL** | The Assertion Consumer Service (ACS) URL displayed in Prowler Cloud (e.g., `https://api.prowler.com/api/v1/accounts/saml/your-domain.com/acs/`). Prowler Local Server deployments use a different base URL. |
+| **Entity ID** | The Audience URI displayed in Prowler Cloud (e.g., `urn:prowler.com:sp`). |
| **Name ID format** | Select `EMAIL` from the dropdown. |
| **Name ID** | Select `Basic Information > Primary email` from the dropdown. |
@@ -82,7 +86,7 @@ Click "Add mapping" for each entry:
| `Basic Information > First name` | `firstName` | Yes | |
| `Basic Information > Last name` | `lastName` | Yes | |
| `Employee Details > Department` | `userType` | No | Determines the Prowler role. **Case-sensitive.** |
-| `Employee Details > Organization` | `organization` | No | Company name displayed in Prowler App profile. |
+| `Employee Details > Organization` | `organization` | No | Company name displayed in the user profile in Prowler Cloud. |
<Info>
**Remember the Mapped Fields**
@@ -98,7 +102,7 @@ Click "Finish" to create the SAML app.
<Info>
**Dynamic Updates**
-Prowler App updates user attributes each time a user logs in. Any changes made in Google Workspace are reflected on the next login.
+Prowler Cloud updates user attributes each time a user logs in. Any changes made in Google Workspace are reflected on the next login.
</Info>
@@ -108,7 +112,7 @@ Prowler App updates user attributes each time a user logs in. Any changes made i
The `userType` attribute controls which Prowler role is assigned to the user:
- If `userType` matches an existing Prowler role name, the user receives that role automatically.
-- If `userType` does not match any existing role, Prowler App creates a new role with that name **with read-only access** (visibility over all providers, no management permissions). A Prowler administrator can adjust its permissions afterward through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
+- If `userType` does not match any existing role, Prowler Cloud creates a new role with that name **with read-only access** (visibility over all providers, no management permissions). A Prowler administrator can adjust its permissions afterward through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
- If `userType` is not set, the user's existing roles are left unchanged.
The `userType` value is **case-sensitive** - for example, `Backend` and `backend` are treated as different roles.
@@ -148,13 +152,13 @@ If attempting to use the "Test SAML login" option in Google Admin Console and re
---
-## Part B - Prowler App Configuration
+## Part B - Prowler Cloud Configuration
### Step 1: Open the SAML Configuration Dialog
1. Navigate to the profile settings page:
- **Prowler Cloud**: `https://cloud.prowler.com/profile`
- - **Self-hosted**: `http://{your-domain}/profile`
+ - **Prowler Local Server**: `http://{your-domain}/profile`
2. Find the "SAML SSO Integration" card and click "Enable" (or "Update" if already configured).
3. The "Configure SAML SSO" dialog opens, displaying:
- **ACS URL**: The Assertion Consumer Service URL (copy this value for Part A, Step 4). This URL updates dynamically when the email domain is entered.
@@ -162,21 +166,21 @@ If attempting to use the "Test SAML login" option in Google Admin Console and re
- **Name ID Format**: The expected format (`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`).
- **Supported Assertion Attributes**: The list of accepted attributes (`firstName`, `lastName`, `userType`, `organization`).
-
+
### Step 2: Enter the Email Domain and Upload Metadata
-1. Enter the **email domain** for the organization (e.g., `prowler.cloud`). Prowler App uses this domain to identify users who should authenticate via SAML. The ACS URL updates automatically to reflect the configured domain.
+1. Enter the **email domain** for the organization (e.g., `prowler.cloud`). Prowler Cloud uses this domain to identify users who should authenticate via SAML. The ACS URL updates automatically to reflect the configured domain.
2. Upload the **metadata XML file** downloaded in Part A, Step 3.
3. Click "Save".
-
+
### Step 3: Verify the Enabled Status
The "SAML SSO Integration" card should now display a **"Status: Enabled"** indicator with a checkmark, confirming that the configuration is complete.
-
+
---
@@ -214,13 +218,13 @@ To test the `userType` → role mapping, set the **Department** attribute in the
1. Navigate to the Prowler login page.
2. Click "Continue with SAML SSO".
3. Enter an email from the configured domain (e.g., `adrian@prowler.cloud`).
-4. Click "Log in". The browser redirects to Google for authentication and returns to Prowler App upon success.
+4. Click "Log in". The browser redirects to Google for authentication and returns to Prowler Cloud upon success.
-
+
### Verify User Profile and Role Mapping
-After a successful SSO login, the user profile in Prowler App reflects the attributes sent by Google Workspace:
+After a successful SSO login, the user profile in Prowler Cloud reflects the attributes sent by Google Workspace:
- **Name**: Populated from the `firstName` and `lastName` attributes.
- **Role**: Created automatically from the `userType` attribute (e.g., `Backend`). If the role did not exist previously, it is created with read-only access by default.
@@ -230,14 +234,14 @@ After a successful SSO login, the user profile in Prowler App reflects the attri
For more details on role assignment behavior and attribute mapping, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso#configure-attribute-mapping-in-the-idp) page.
-
+
### IdP-Initiated SSO (from Google)
1. Sign in to Google Workspace with an account that has access to the Prowler SAML app.
2. Open the Google Workspace app launcher (the grid icon in the top-right corner of any Google page).
-3. Click the Prowler app tile.
-4. The browser redirects directly to Prowler App, authenticated.
+3. Click the Prowler tile.
+4. The browser redirects directly to Prowler Cloud, authenticated.
For more information on the SSO login flows, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso#idp-initiated-sso) page.
@@ -270,7 +274,7 @@ Prowler does not allow two tenants to share the same email domain. If the domain
<Info>
**Just-in-Time Provisioning**
-Users who authenticate via SAML for the first time are automatically created in Prowler App. No prior invitation is needed. User attributes (`firstName`, `lastName`, `userType`) are updated on every login from the Google directory.
+Users who authenticate via SAML for the first time are automatically created in Prowler Cloud. No prior invitation is needed. User attributes (`firstName`, `lastName`, `userType`) are updated on every login from the Google directory.
</Info>
@@ -278,10 +282,10 @@ Users who authenticate via SAML for the first time are automatically created in
## Quick Summary
-1. In **Google Admin Console**, create a custom SAML app using the ACS URL and Entity ID from Prowler App.
+1. In **Google Admin Console**, create a custom SAML app using the ACS URL and Entity ID from Prowler Cloud.
2. Configure **attribute mapping**: `firstName`, `lastName`, and optionally `userType` and `organization`.
3. **Download the metadata XML** from Google.
4. **Enable the app** in Google Workspace for the relevant users or groups.
-5. In **Prowler App**, enter the email domain, upload the metadata XML, and save.
+5. In **Prowler Cloud**, enter the email domain, upload the metadata XML, and save.
6. Verify the SAML SSO Integration shows **"Status: Enabled"**.
7. Test login via "Continue with SAML SSO" on the Prowler login page.
diff --git a/docs/user-guide/tutorials/prowler-app-sso.mdx b/docs/user-guide/tutorials/prowler-app-sso.mdx
index 1e61ec1060..bb993942cd 100644
--- a/docs/user-guide/tutorials/prowler-app-sso.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso.mdx
@@ -1,18 +1,22 @@
---
title: 'SAML Single Sign-On (SSO)'
+sidebarTitle: 'SAML SSO'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { AppliesTo } from "/snippets/applies-to.mdx"
<VersionBadge version="5.9.0" />
-This guide provides comprehensive instructions to configure SAML-based Single Sign-On (SSO) in Prowler App. This configuration allows users to authenticate using the organization's Identity Provider (IdP).
+<AppliesTo />
+
+This guide provides comprehensive instructions to configure SAML-based Single Sign-On (SSO) in Prowler Cloud. This configuration allows users to authenticate using the organization's Identity Provider (IdP).
This document is divided into two main sections:
-- **[User Guide](#user-guide-configuration)**: For organization administrators to configure SAML SSO through Prowler App.
+- **[User Guide](#user-guide-configuration)**: For organization administrators to configure SAML SSO through Prowler Cloud.
-- **[Developer and Administrator Guide](#developer-and-administrator-guide)**: For developers and system administrators running self-hosted Prowler App instances, providing technical details on environment configuration, API usage, and testing.
+- **[Developer and Administrator Guide](#developer-and-administrator-guide)**: For developers and system administrators running Prowler Local Server instances, providing technical details on environment configuration, API usage, and testing.
---
@@ -43,7 +47,7 @@ If the SAML configuration is removed, users who previously authenticated via SAM
#### Step 1: Access Profile Settings
-To access the account settings, click the "Account" button in the top-right corner of Prowler App, or navigate directly to `https://cloud.prowler.com/profile` (or `http://localhost:3000/profile` for local setups).
+To access the account settings, click the "Account" button in the top-right corner of Prowler Cloud, or navigate directly to `https://cloud.prowler.com/profile` (or `http://localhost:3000/profile` for local setups).
@@ -63,12 +67,12 @@ Choose a Method:
<Tabs>
<Tab title="Generic Method">
- Prowler App displays the SAML configuration information needed to configure the IdP. Use this information to create a new SAML application in the IdP.
+ Prowler Cloud displays the SAML configuration information needed to configure the IdP. Use this information to create a new SAML application in the IdP.
1. **Assertion Consumer Service (ACS) URL**: The endpoint in Prowler that will receive the SAML assertion from the IdP.
2. **Audience URI (Entity ID)**: A unique identifier for the Prowler application (Service Provider).
- To configure the IdP, copy the **ACS URL** and **Audience URI** from Prowler App and use them to set up a new SAML application.
+ To configure the IdP, copy the **ACS URL** and **Audience URI** from Prowler Cloud and use them to set up a new SAML application.
@@ -81,13 +85,13 @@ Choose a Method:
**Configure Attribute Mapping in the IdP**
- For Prowler App to correctly identify and provision users, configure the IdP to send the following attributes in the SAML assertion:
+ For Prowler Cloud to correctly identify and provision users, configure the IdP to send the following attributes in the SAML assertion:
| Attribute Name | Description | Required |
|----------------|---------------------------------------------------------------------------------------------------------|----------|
| `firstName` | The user's first name. | Yes |
| `lastName` | The user's last name. | Yes |
- | `userType` | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler App creates a new role with that name with read-only access (visibility over all providers, no management permissions). If `userType` is not defined, the user's existing roles are left unchanged. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No |
+ | `userType` | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler Cloud creates a new role with that name with read-only access (visibility over all providers, no management permissions). If `userType` is not defined, the user's existing roles are left unchanged. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No |
| `organization` | The user's company name. | No |
<Info>
@@ -98,9 +102,15 @@ Choose a Method:
</Info>
<Warning>
+ **Single-Value `userType` Required**
+
+ Map `userType` to an IdP attribute that always contains a single value. If the IdP sends multiple values, Prowler Cloud uses only the first value and does not assign multiple roles or select the highest-privilege role.
+
+ </Warning>
+ <Warning>
**Dynamic Updates**
- Prowler App updates these attributes each time a user logs in. Any changes made in the Identity Provider (IdP) will be reflected when the user logs in again.
+ Prowler Cloud updates these attributes each time a user logs in. Any changes made in the Identity Provider (IdP) will be reflected when the user logs in again.
</Warning>
@@ -132,30 +142,31 @@ Choose a Method:
- 7. **Configure User Attributes in Okta**: Okta acts as the central source for user profile information. Prowler App maps the following Okta user profile attributes during each SAML login:
+ 7. **Configure User Attributes in Okta**: Okta acts as the central source for user profile information. Prowler Cloud maps the following Okta user profile attributes during each SAML login:
- * **First name** (`firstName`): Maps to the user's first name in Prowler App.
- * **Last name** (`lastName`): Maps to the user's last name in Prowler App.
+ * **First name** (`firstName`): Maps to the user's first name in Prowler Cloud.
+ * **Last name** (`lastName`): Maps to the user's last name in Prowler Cloud.
- * **Organization** (`organization`): Maps to the company name displayed in Prowler App. This attribute is optional.
- * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive**: if it matches the exact name of an existing role in Prowler App the user receives that role; if no role with that name exists, a new one is created with read-only access.
+ * **Organization** (`organization`): Maps to the company name displayed in Prowler Cloud. This attribute is optional.
+ * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive**: if it matches the exact name of an existing role in Prowler Cloud the user receives that role; if no role with that name exists, a new one is created with read-only access.
- To modify these values, edit the user's profile directly in the Okta admin console under the "Profile" tab. Changes are reflected in Prowler App the next time the user logs in via SAML.
+ To modify these values, edit the user's profile directly in the Okta admin console under the "Profile" tab. Changes are reflected in Prowler Cloud the next time the user logs in via SAML.
<Warning>
**User Type and Role Assignment**
The `userType` attribute controls which Prowler role is assigned to the user:
- * If a role with the specified name already exists in Prowler App, the user automatically receives that role.
- * If the role does not exist, Prowler App creates a new role with that exact name with read-only access: the user can see all providers and their findings but cannot manage anything. A Prowler administrator (a user whose role includes the "Manage Account" permission) can adjust its permissions afterward through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
- * If `userType` is not defined in the user's Okta profile, the user's existing roles in Prowler App are left unchanged.
+ * If a role with the specified name already exists in Prowler Cloud, the user automatically receives that role.
+ * If the role does not exist, Prowler Cloud creates a new role with that exact name with read-only access: the user can see all providers and their findings but cannot manage anything. A Prowler administrator (a user whose role includes the "Manage Account" permission) can adjust its permissions afterward through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
+ * If `userType` is not defined in the user's Okta profile, the user's existing roles in Prowler Cloud are left unchanged.
+ * `userType` must contain a single value. If the IdP sends multiple values, Prowler Cloud uses only the first value and does not assign multiple roles.
- **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler App, the user receives it automatically upon login. If it does not exist, Prowler App creates a new role called `IT` with read-only access, and a Prowler administrator can adjust its permissions as needed.
+ **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler Cloud, the user receives it automatically upon login. If it does not exist, Prowler Cloud creates a new role called `IT` with read-only access, and a Prowler administrator can adjust its permissions as needed.
</Warning>
@@ -171,11 +182,11 @@ Choose a Method:
Once the IdP is configured, it provides a **metadata XML file**. This file contains the IdP's configuration information, such as its public key and login URL.
-To complete the Prowler App configuration:
+To complete the Prowler Cloud configuration:
1. Return to the Prowler SAML configuration page.
-2. Enter the **email domain** for the organization (e.g., `mycompany.com`). Prowler App uses this to identify users who should authenticate via SAML.
+2. Enter the **email domain** for the organization (e.g., `mycompany.com`). Prowler Cloud uses this to identify users who should authenticate via SAML.
3. Upload the **metadata XML file** downloaded from the IdP.
@@ -203,7 +214,7 @@ SAML SSO can be disabled by removing the existing configuration from the integra
Once SAML SSO is configured, users can access Prowler Cloud directly from their Identity Provider's dashboard:
1. Navigate to the IdP dashboard or portal
-2. Click on the Prowler Cloud application tile
+2. Click the Prowler Cloud application tile
3. The system automatically authenticates users and redirects them to Prowler Cloud
This method is convenient for users who primarily work from the IdP portal and prefer a seamless single-click access.
@@ -218,7 +229,7 @@ Users can also initiate the login process directly from Prowler's login page:
3. Enter their email address from the configured domain
4. The system redirects users to the IdP for authentication
-5. After successful authentication, users are returned to Prowler App
+5. After successful authentication, users are returned to Prowler Cloud
This method is useful when users bookmark Prowler or navigate directly to the application.
@@ -226,11 +237,11 @@ This method is useful when users bookmark Prowler or navigate directly to the ap
## Developer and Administrator Guide
-This section provides technical details for developers and administrators of self-hosted Prowler instances.
+This section provides technical details for developers and administrators of Prowler Local Server instances.
### Environment Configuration
-For self-hosted deployments, several environment variables must be configured to ensure SAML SSO functions correctly. These variables are typically set in an `.env` file.
+For Prowler Local Server deployments, several environment variables must be configured to ensure SAML SSO functions correctly. These variables are typically set in an `.env` file.
| Variable | Description | Example |
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|
diff --git a/docs/user-guide/tutorials/prowler-app.mdx b/docs/user-guide/tutorials/prowler-app.mdx
index 5e99a41ae7..6c3131d136 100644
--- a/docs/user-guide/tutorials/prowler-app.mdx
+++ b/docs/user-guide/tutorials/prowler-app.mdx
@@ -1,34 +1,34 @@
---
title: 'Prowler Cloud'
+sidebarTitle: 'Getting Started'
---
+import { ProviderCards } from "/snippets/provider-cards.mdx"
+
**Prowler Cloud** is a web application that simplifies running Prowler. This tutorial will guide you through setting up and using it.
-We refer to **Prowler App** as the self-hosted version of **Prowler Cloud**.
+**Prowler Local Server** is the self-hosted version of **Prowler Cloud**. See [Prowler product families](/getting-started/products) for every official product name.
## Accessing Prowler Cloud and API Documentation
If you are a [Prowler Cloud](https://cloud.prowler.com/sign-in) user, you can access API docs at [https://api.prowler.com/api/v1/docs](https://api.prowler.com/api/v1/docs)
<Note>
-**For Prowler App users**
+**For Prowler Local Server users**
-After [installing](/getting-started/installation/prowler-app) **Prowler App**, access it at [http://localhost:3000](http://localhost:3000).
+After [installing](/getting-started/installation/prowler-app) **Prowler Local Server**, access it at [http://localhost:3000](http://localhost:3000).
To view the auto-generated **Prowler API** documentation, navigate to [http://localhost:8080/api/v1/docs](http://localhost:8080/api/v1/docs). This documentation provides details on available endpoints, parameters, and responses.
</Note>
-## **Step 1: Sign Up**
-
-### **Sign Up with Email**
-
+## Step 1: Sign Up
+### Sign Up with Email
To get started, sign up using your email and password:
<img src="/images/sign-up-button.png" alt="Sign Up Button" width="320" />
<img src="/images/sign-up.png" alt="Sign Up" width="285" />
-### **Sign Up with Social Login**
-
+### Sign Up with Social Login
If Social Login is enabled, you can sign up using your preferred provider (e.g., Google, GitHub).
<Note>
@@ -44,16 +44,14 @@ If your email is not registered, a new account will be created using your social
See [how to configure Social Login for Prowler](/user-guide/tutorials/prowler-app-social-login) to enable this feature in your own deployments.
</Note>
-## **Step 2: Log In**
-
-Once registered, log in with your email and password to access Prowler App.
+## Step 2: Log In
+Once registered, log in with your email and password to access Prowler Cloud.
<img src="/images/log-in.png" alt="Log In" width="350" />
Upon logging in, the Overview page will display. At this stage, no data is present: add a provider to begin scanning your cloud environment.
-## **Step 3: Add a Provider**
-
+## Step 3: Add a Provider
To perform security scans, link a cloud provider account. Prowler supports the following providers and more:
- **AWS**
@@ -77,48 +75,21 @@ Steps to add a provider:
<img src="/images/add-provider.png" alt="Add Provider" width="700" />
-## **Step 4: Configure the Provider**
-
+## Step 4: Configure the Provider
Select the cloud provider to scan and configure authentication credentials. Each provider has specific requirements and authentication methods.
<img src="/images/select-provider.png" alt="Select a Provider" width="700" />
For detailed instructions on configuring credentials for each provider, refer to the provider-specific getting started guides:
-<Columns cols={3}>
- <Card title="AWS" icon="aws" href="/user-guide/providers/aws/getting-started-aws">
- Configure AWS authentication using IAM Access Keys or Assumed Role credentials.
- </Card>
- <Card title="Azure" icon="microsoft" href="/user-guide/providers/azure/getting-started-azure">
- Set up Azure authentication using Service Principal credentials.
- </Card>
- <Card title="Google Cloud" icon="google" href="/user-guide/providers/gcp/getting-started-gcp">
- Configure GCP authentication with Service Account or Application Default Credentials.
- </Card>
- <Card title="Oracle Cloud Infrastructure" icon="cloud" href="/user-guide/providers/oci/getting-started-oci">
- Connect OCI with API key credentials to scan compartments and regions.
- </Card>
- <Card title="Kubernetes" icon="cloud" href="/user-guide/providers/kubernetes/getting-started-k8s">
- Set up Kubernetes authentication using kubeconfig files for cluster access.
- </Card>
- <Card title="Microsoft 365" icon="microsoft" href="/user-guide/providers/microsoft365/getting-started-m365">
- Configure M365 authentication with Application Certificate or Client Secret.
- </Card>
- <Card title="GitHub" icon="github" href="/user-guide/providers/github/getting-started-github">
- Set up GitHub authentication using Personal Access Token, OAuth App, or GitHub App.
- </Card>
- <Card title="Infrastructure as Code" icon="code" href="/user-guide/providers/iac/getting-started-iac">
- Scan IaC public or private repositories for security issues.
- </Card>
-</Columns>
-## **Step 5: Test Connection**
+<ProviderCards />
-After adding your credentials of your cloud account, click the `Launch` button to verify that Prowler App can successfully connect to your provider:
+## Step 5: Test Connection
+After adding your credentials of your cloud account, click the `Launch` button to verify that Prowler can successfully connect to your provider:
<img src="/images/test-connection-button.png" alt="Test Connection" width="700" />
-## **Step 6: Scan started**
-
+## Step 6: Scan Started
After successfully adding and testing your credentials, Prowler will start scanning your cloud environment, click the `Go to Scans` button to see the progress:
<img src="/images/provider-added.png" alt="Start Now" width="700" />
@@ -127,8 +98,7 @@ After successfully adding and testing your credentials, Prowler will start scann
Prowler will automatically scan all configured providers every **24 hours**, ensuring your cloud environment stays continuously monitored.
</Note>
-## **Step 7: Monitor Scan Progress**
-
+## Step 7: Monitor Scan Progress
Track the progress of your scan in the `Scans` section:
<img src="/images/scan-progress.png" alt="Scan Progress" width="700" />
@@ -146,8 +116,7 @@ Each dashboard handles scan data differently:
When a new scan completes or a new data ingestion is processed, the dashboards automatically reflect the updated results.
</Note>
-## **Step 8: Analyze the Findings**
-
+## Step 8: Analyze the Findings
While the scan is running, start exploring the findings in these sections:
- **Overview**: High-level summary of the scans.
@@ -168,8 +137,7 @@ While the scan is running, start exploring the findings in these sections:
To view all `new` findings that have not been seen prior to this scan, click the `Delta` filter and select `new`. To view all `changed` findings that have had a status change (from `PASS` to `FAIL` for example), click the `Delta` filter and select `changed`.
-## **Step 9: Download the Outputs**
-
+## Step 9: Download the Outputs
Once a scan is complete, navigate to the Scan Jobs section to download the output files generated by Prowler:
<img src="/images/scan_jobs_section.png" alt="Scan Jobs section" width="700" />
@@ -190,8 +158,7 @@ The `zip` file unpacks into a folder named like `prowler-output-<provider_id>-<t
For more information about the API endpoint used by the UI to download the ZIP archive, refer to: [Prowler API Reference - Download Scan Output](https://api.prowler.com/api/v1/docs#tag/Scan/operation/scans_report_retrieve)
</Note>
-## **Step 10: Download specified compliance report**
-
+## Step 10: Download Specified Compliance Report
Once your scan has finished, you don’t need to grab the entire ZIP—just pull down the specific compliance report you want:
- Navigate to the **Compliance** section of the UI.
diff --git a/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx b/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx
index d9c17aaa5f..8b2124e004 100644
--- a/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx
+++ b/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx
@@ -1,17 +1,20 @@
---
-title: 'AWS Organizations in Prowler Cloud'
+title: 'AWS Organizations'
description: 'Onboard all AWS accounts in your Organization through a single guided wizard'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
<VersionBadge version="5.19.0" />
-Prowler Cloud enables you to onboard all AWS accounts in your Organization through a single guided wizard. Instead of connecting accounts one by one, you can discover every account in your AWS Organization, select the ones you want to monitor, test connectivity, and launch scans — all from the Prowler Cloud UI.
+Prowler Cloud onboards every AWS account in your Organization through a single guided wizard. Instead of connecting accounts one by one, you can discover every account in your AWS Organization, select the ones you want to monitor, test connectivity, and launch scans — all from the Prowler Cloud UI.
-<Note>
-This feature is **exclusively available in Prowler Cloud**. For CLI-based multi-account scanning, see [AWS Organizations in Prowler CLI](/user-guide/providers/aws/organizations).
-</Note>
+<SubscriptionBanner>
+For CLI-based multi-account scanning, see [AWS Organizations in Prowler CLI](/user-guide/providers/aws/organizations).
+</SubscriptionBanner>
+
+To follow this guide you need an active [Prowler Cloud](https://cloud.prowler.com) account and access to your AWS Organization [management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) (or a registered delegated administrator account).
## Overview
@@ -22,227 +25,19 @@ This feature is **exclusively available in Prowler Cloud**. For CLI-based multi-
| **Individual accounts** | A few AWS accounts | Connect each account one by one with its own IAM role. |
| **AWS Organizations** | 10+ accounts, or any org-managed environment | Connect once to your management account, discover all member accounts automatically, and scan them in bulk. |
-### How it works
+### How It Works
-Before using the AWS Organizations wizard, you need to deploy **two IAM roles** in your AWS environment. The onboarding follows this sequence:
+<VersionBadge version="5.35.0" />
+
+Onboarding deploys the **ProwlerScan Identity and Access Management (IAM) role** in your management account and in every member account. A **single CloudFormation stack** — launched from the wizard's **Create Stack in Management Account** button ([Step 2](#step-2-authenticate-with-your-management-account)) — creates the management account role **and** a service-managed StackSet that rolls the role out to your member accounts in one operation. Prefer to deploy the roles yourself? See [Deploy the Roles Manually](#deploy-the-roles-manually).
<Frame>
- <img src="/images/organizations/onboarding-flow.svg" alt="Onboarding flow: 1. Create Management Account Role (Quick Create or Manual), 2. Deploy StackSet, 3. Run the Wizard, 4. Launch Scans" />
+ <img src="/images/organizations/onboarding-flow.svg" alt="Onboarding flow: 1. Start the Wizard, 2. Deploy the Roles (single CloudFormation stack), 3. Discover and Connect, 4. Launch Scans" />
</Frame>
-## Key Concepts
+## Step 1: Start the Organization Wizard
-### What is an External ID?
-
-An **External ID** is a security token that Prowler generates unique to your tenant. When Prowler assumes the IAM role in your AWS account, it presents this External ID to prove its identity.
-
-This prevents the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) — a scenario where an unauthorized party could trick AWS into granting access to your account. By requiring the External ID, only your specific Prowler tenant can assume the role.
-
-You don't need to create the External ID yourself — Prowler generates it automatically and displays it in the wizard for you to copy.
-
-### Two Roles Architecture
-
-Prowler requires **two separate IAM roles** deployed in different places, each with a distinct purpose:
-
-| Role | Where it lives | What it does | How to deploy it |
-|------|---------------|--------------|------------------|
-| **ProwlerScan** (management account) | Your management (root) account only | Discovers the Organization structure **and** scans the management account. Has additional Organizations discovery permissions. | Via **Quick Create** link or **manually** in the IAM Console ([Step 1](#step-1-create-the-management-account-role)). Cannot be deployed via StackSet. |
-| **ProwlerScan** (member accounts) | Every member account | Scans the account for security findings. | Via **CloudFormation StackSet** ([Step 2](#step-2-deploy-the-cloudformation-stackset)). Automated across all accounts. |
-
-<Frame caption="Both roles share the same name `ProwlerScan`. The management account role includes additional Organization discovery permissions.">
- <img src="/images/organizations/two-roles-architecture.svg" alt="Two Roles Architecture: ProwlerScan in management account (Quick Create or Manual, discovery + scanning) and ProwlerScan in member accounts (via StackSet, scanning only)" />
-</Frame>
-
-<Note>
-**Same name, different permissions.** Both roles are named `ProwlerScan` — Prowler expects a consistent role name across all accounts. The management account role has the same scanning permissions as member accounts, plus additional Organizations discovery permissions (see [Step 1](#step-1-create-the-management-account-role) for the full list).
-</Note>
-
-### What is a CloudFormation StackSet?
-
-A [CloudFormation StackSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html) lets you deploy the same CloudFormation template across multiple AWS accounts in a single operation. Prowler uses a StackSet to deploy the **ProwlerScan** IAM role into every member account of your organization, so you don't have to create the role manually in each account.
-
-## Prerequisites
-
-### Prowler Cloud Account
-
-You need an active [Prowler Cloud](https://cloud.prowler.com) account. Each AWS account you connect will count as a provider in your subscription. See [Billing Impact](#billing-impact) for details.
-
-### AWS Organization Enabled
-
-Your AWS environment must have [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) enabled. You will need access to the **management account** (or a delegated administrator account) to provide the Organization ID and IAM Role ARN.
-
-## Step 1: Create the Management Account Role
-
-The first role you need to create is the **management account role**. This role allows Prowler to discover your Organization structure — listing accounts, OUs, and hierarchy.
-
-<Warning>
-**StackSets do not deploy to the management account.** Organizational CloudFormation StackSets with service-managed permissions only target member accounts — this is an AWS limitation, not a Prowler one. You must create the management account role separately, either via the Quick Create link ([Option A](#option-a-quick-create-link-fastest)) or manually ([Option B](#option-b-create-the-role-manually)).
-</Warning>
-
-<Note>
-**The role must be named `ProwlerScan`** — the same name as the role deployed to member accounts via StackSet. Prowler expects a consistent role name across all accounts in the Organization. If you use a different name, connection tests and scans will fail for the management account.
-</Note>
-
-### Option A: Quick Create Link (Fastest)
-
-The Prowler wizard provides a one-click link that opens the AWS Console with the CloudFormation template pre-configured. This creates a **CloudFormation Stack** (not a StackSet) that deploys the ProwlerScan role with Organizations permissions enabled in your management account.
-
-<Tip>
-**[Open Quick Create Stack in AWS Console →](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fprowler-cloud-public.s3.eu-west-1.amazonaws.com%2Fpermissions%2Ftemplates%2Faws%2Fcloudformation%2Fprowler-scan-role.yml&stackName=Prowler¶m_EnableOrganizations=true)**
-
-Opens the CloudFormation Console with the Prowler scan role template and `EnableOrganizations=true` pre-filled. You will need to enter the **ExternalId** parameter manually — copy it from the Prowler wizard ([Step 4](#step-4-authenticate-with-your-management-account)).
-</Tip>
-
-1. Click **[Open Quick Create Stack in AWS Console →](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fprowler-cloud-public.s3.eu-west-1.amazonaws.com%2Fpermissions%2Ftemplates%2Faws%2Fcloudformation%2Fprowler-scan-role.yml&stackName=Prowler¶m_EnableOrganizations=true)** or use the **Create Stack in Management Account** button in the Prowler wizard (which also pre-fills the ExternalId).
-2. Enter the **ExternalId** parameter if not pre-filled.
-3. Check **"I acknowledge that AWS CloudFormation might create IAM resources with custom names"** and click **Create stack**.
-4. Wait for the stack to reach **CREATE_COMPLETE** status.
-
-Take note of the **Role ARN** from the stack's **Outputs** tab — you will need it in the wizard.
-
-### Option B: Create the Role Manually
-
-1. Sign in to the [AWS IAM Console](https://console.aws.amazon.com/iam/) in your **management account**.
-
-2. Go to **Roles > Create role** and select **Custom trust policy**.
-
-3. Paste the following trust policy. This allows Prowler Cloud to assume the role using your tenant's External ID (you will get this from the Prowler wizard in [Step 3](#step-3-start-the-organization-wizard)):
-
-```json
-{
- "Version": "2012-10-17",
- "Statement": [
- {
- "Effect": "Allow",
- "Principal": {
- "AWS": "arn:aws:iam::232136659152:root"
- },
- "Action": "sts:AssumeRole",
- "Condition": {
- "StringEquals": {
- "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
- },
- "StringLike": {
- "aws:PrincipalArn": "arn:aws:iam::232136659152:role/prowler*"
- }
- }
- }
- ]
-}
-```
-
-Replace `<YOUR_EXTERNAL_ID>` with the External ID shown in the Prowler wizard.
-
-4. Attach the following AWS managed policies:
- - **SecurityAudit**
- - **ViewOnlyAccess**
-
- This allows Prowler to also scan the management account for security findings, just like any other account.
-
-5. Create an additional inline policy with the following permissions. These are specific to the management account and allow Prowler to discover your Organization structure:
-
-```json
-{
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "ProwlerOrganizationDiscovery",
- "Effect": "Allow",
- "Action": [
- "organizations:DescribeAccount",
- "organizations:DescribeOrganization",
- "organizations:ListAccounts",
- "organizations:ListAccountsForParent",
- "organizations:ListOrganizationalUnitsForParent",
- "organizations:ListRoots",
- "organizations:ListTagsForResource"
- ],
- "Resource": "*"
- },
- {
- "Sid": "ProwlerStackSetManagement",
- "Effect": "Allow",
- "Action": [
- "organizations:RegisterDelegatedAdministrator",
- "iam:CreateServiceLinkedRole"
- ],
- "Resource": "*"
- }
- ]
-}
-```
-
-<Tip>
-You can optionally restrict the `Resource` field to your specific Organization ARN (e.g., `arn:aws:organizations::123456789012:organization/o-abc123def4`) instead of `"*"` to minimize the blast radius.
-</Tip>
-
-6. Name the role **`ProwlerScan`** and click **Create role**. Take note of the **Role ARN** — you will need it in the Prowler wizard.
-
-The ARN follows this format: `arn:aws:iam::<account-id>:role/ProwlerScan`
-
-<Warning>
-The role **must** be named `ProwlerScan`. Do not use a different name.
-</Warning>
-
-<Note>
-If you just created the role, it may take up to **60 seconds** for AWS to propagate it. If you get an error in the Prowler wizard, wait a moment and try again.
-</Note>
-
-## Step 2: Deploy the CloudFormation StackSet
-
-After creating the management account role, the next step is to deploy the **ProwlerScan** role to your member accounts using a CloudFormation StackSet. This is the recommended method for consistent, scalable deployment across your entire organization.
-
-The StackSet uses **service-managed permissions**, which means AWS Organizations handles the cross-account deployment automatically — you don't need to create execution roles manually in each account. The StackSet deploys the ProwlerScan IAM role in every target member account, enabling Prowler to assume that role for cross-account scanning.
-
-<Note>
-**Trusted access required:** CloudFormation StackSets must have trusted access enabled in your management account. Verify this in the AWS Console under **AWS Organizations > Settings > Trusted access for AWS CloudFormation StackSets**.
-</Note>
-
-<Warning>
-**The Quick Create link creates a Stack, not a StackSet.** The link in the Prowler wizard creates a CloudFormation **Stack** that deploys the ProwlerScan role in your management account only ([Step 1](#step-1-create-the-management-account-role)). To deploy the role across **member accounts**, you must create a StackSet manually as described below. AWS does not support Quick Create links for StackSets.
-</Warning>
-
-<Tip>
-**[Open StackSets Console →](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacksets/create)**
-
-Opens the CloudFormation StackSets creation page directly. You will need to paste the template URL and ExternalId manually.
-</Tip>
-
-1. Click the link above or navigate to **CloudFormation > StackSets > Create StackSet** in your management account.
-2. Choose **Service-managed permissions**.
-3. Select **Amazon S3 URL** as the template source and paste the following URL:
- ```
- https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml
- ```
-4. Set the **ExternalId** parameter to the External ID shown in the Prowler wizard.
-5. Choose your deployment targets (entire organization or specific OUs).
-6. Select the AWS regions where you want the role deployed.
-7. Click **Create StackSet**.
-
-### Verify StackSet Deployment
-
-After deploying, verify that all stack instances completed successfully:
-
-1. In the CloudFormation Console, go to **StackSets** and select your Prowler StackSet.
-2. Click the **Stack instances** tab.
-3. Confirm that all instances show **Status: CURRENT** and **Stack status: CREATE_COMPLETE**.
-
-Deployment typically takes **2–5 minutes** for medium-sized organizations. Large organizations (500+ accounts) may take longer.
-
-<Note>
-**Prefer Terraform?** You can deploy the ProwlerScan role using Terraform instead. See the [StackSets deployment guide](/user-guide/providers/aws/organizations#deploying-prowler-iam-roles-across-aws-organizations) for the Terraform module.
-</Note>
-
-### Key Considerations
-
-- **Service-managed permissions**: Always select **Service-managed permissions** when creating the StackSet. This lets AWS Organizations manage the deployment automatically across current and future member accounts.
-- **Least privilege**: The ProwlerScan role deployed by the StackSet uses `SecurityAudit` and `ViewOnlyAccess` — AWS managed policies that grant read-only access — plus a small set of additional read-only permissions for services not covered by those policies. See the [CloudFormation template](https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml) for the full list. Prowler does not make any changes to your accounts.
-- **New accounts**: When you add new accounts to your AWS Organization, the StackSet automatically deploys the ProwlerScan role to them if you targeted the organization root or the relevant OU. Combined with Prowler's 6-hour automatic sync, new accounts are onboarded end-to-end without manual intervention.
-- **Management account**: Organizational StackSets **do not deploy to the management account itself**. If you want to scan the management account, you need to create the ProwlerScan role there separately using a regular CloudFormation Stack.
-
-## Step 3: Start the Organization Wizard
-
-Now that both roles are deployed — the management account role (Step 1) and the ProwlerScan role in member accounts (Step 2) — you can start the Prowler wizard.
+The Prowler wizard walks you through the entire flow: deploying both roles from a single CloudFormation stack, discovering your accounts, testing connectivity, and launching scans.
### Open the Wizard
@@ -279,29 +74,50 @@ Now that both roles are deployed — the management account role (Step 1) and th
Click **Next** to proceed to the authentication phase.
-## Step 4: Authenticate with Your Management Account
+## Step 2: Authenticate with Your Management Account
-The wizard's **Authentication Details** page guides you through three actions: deploying the roles in AWS, entering the management account Role ARN, and confirming the deployment.
+The **Authentication Details** page guides you through three actions: deploying the roles in AWS, entering the deployment account Role ARN, and confirming the deployment. The deployment account is either the management account or, when delegated administrator mode is selected, the delegated administrator account.
### External ID
-The wizard displays a **Prowler External ID** at the top — auto-generated and unique to your tenant. Click the copy icon to copy it. You will need this External ID for both the management account Stack and the member accounts StackSet.
+The wizard displays a **Prowler External ID** at the top — auto-generated and unique to your tenant. Click the copy icon to copy it. The External ID is pre-filled into the deployment link, and the single stack applies it to both the management account role and the member-account StackSet. Learn more in [What Is an External ID?](#what-is-an-external-id).
### Deploy the Roles
-The wizard provides two deployment actions:
+<VersionBadge version="5.35.0" />
-1. **Create Stack in Management Account** — opens a Quick Create link that deploys the ProwlerScan role with `EnableOrganizations=true` in your management account ([Step 1](#step-1-create-the-management-account-role)). The External ID is pre-filled.
+The wizard deploys the deployment account role and the member-account StackSet in a **single** CloudFormation Stack:
-2. **Open StackSets Console** — links to the CloudFormation StackSets console where you create a StackSet for member accounts ([Step 2](#step-2-deploy-the-cloudformation-stackset)). Copy the template URL shown in the wizard and paste the External ID manually.
+<Note>
+**Prefer to use your own role?** You do not have to use the Quick Create template. Create the ProwlerScan role yourself — through the IAM Console, Terraform, or your own CloudFormation [(Following this guide)](#deploy-the-roles-manually) — and paste its ARN into the Role ARN field below. The role must use the external ID from the earlier step and include the trust policy and permissions described in [Deploy the Roles Manually](#deploy-the-roles-manually).
+</Note>
+
+1. **Organizational Unit or Root ID** — enter the AWS OU (`ou-xxxx-yyyyyyyy`) or organization root (`r-xxxx`) you want to onboard. Prowler rolls the ProwlerScan role out to every member account under this target. Find it in the [AWS Organizations Console](https://console.aws.amazon.com/organizations/); use the **root ID** (`r-`) to cover the entire organization or an **OU ID** (`ou-`) to target a specific unit.
+
+2. *(Optional)* Check **"I'm deploying from a delegated administrator account"** if you launch the stack from a delegated administrator account instead of the management account.
+
+3. **Create Stack in Management Account** — or **Create Stack in Delegated Administrator Account** when delegated administrator mode is selected — opens a Quick Create link that deploys, in a single stack: the ProwlerScan role in the account where you launch the stack (`DeployLocalRole`, with `EnableOrganizations=true`) **and** a service-managed StackSet (`DeployStackSet`) that rolls the role out to your member accounts. The External ID, OU/Root ID, and deployment options are pre-filled.
<Frame>
- <img src="/images/organizations/authentication-details.png" alt="Authentication Details form showing External ID, two deployment buttons (Create Stack in Management Account and Open StackSets Console), Management Account Role ARN field, and deployment confirmation checkbox" />
+ <img src="/images/organizations/authentication-details.png" alt="Authentication Details form showing External ID, Organizational Unit or Root ID field, delegated administrator checkbox, deployment account stack button, deployment account Role ARN field, and deployment confirmation checkbox" />
</Frame>
-### Enter the Management Account Role ARN
+<Tip>
+**Finding your Organizational Unit or Root ID.** In the [AWS Organizations Console](https://console.aws.amazon.com/organizations/) the root (`r-…`) and OU (`ou-…`) IDs appear in the account tree, or run these from your management account:
-Paste the **Role ARN** of the management account role you created in [Step 1](#step-1-create-the-management-account-role) into the **Management Account Role ARN** field.
+```bash
+# Root ID — deploys the role to the entire organization
+aws organizations list-roots --query 'Roots[0].Id' --output text
+
+# OU IDs under the root — to target a specific unit instead
+aws organizations list-organizational-units-for-parent --parent-id r-xxxx \
+ --query 'OrganizationalUnits[].{Name:Name,Id:Id}' --output table
+```
+</Tip>
+
+### Enter the Deployment Account Role ARN
+
+Paste the **Role ARN** created by the stack above into the **Management Account Role ARN** field or, when delegated administrator mode is selected, the **Delegated Administrator Account Role ARN** field.
The ARN follows this format:
```
@@ -311,12 +127,16 @@ arn:aws:iam::<account-id>:role/ProwlerScan
For example: `arn:aws:iam::123456789012:role/ProwlerScan`
<Frame>
- <img src="/images/organizations/role-arn-field.png" alt="Management Account Role ARN field in the Authentication Details form" />
+ <img src="/images/organizations/role-arn-field.png" alt="Deployment account Role ARN field in the Authentication Details form" />
</Frame>
+<Note>
+It may take up to **60 seconds** for AWS to generate the IAM Role ARN after the stack completes. If the wizard reports an error, wait a moment and try again.
+</Note>
+
### Confirm and Discover
-1. Check the box: **"The Stack and StackSet have been successfully deployed in AWS"**.
+1. Check the box: **"The Stack has been successfully deployed in AWS"**.
2. Click **Authenticate**.
Here's what happens behind the scenes:
@@ -324,7 +144,7 @@ Here's what happens behind the scenes:
- An asynchronous discovery is triggered to query your AWS Organization structure.
- You will see a **"Gathering AWS Accounts..."** spinner — this typically takes **30 seconds to 2 minutes** depending on your organization size.
-## Step 5: Select Accounts to Scan
+## Step 3: Select Accounts to Scan
### Understanding the Tree View
@@ -335,6 +155,7 @@ Once discovery completes, the wizard displays a **hierarchical tree view** of yo
</Frame>
- The tree supports up to **5 levels of nesting** (Root > OUs > Sub-OUs > Accounts).
+- If you deployed the stack for just one OU, that OU will be preselected in the tree.
- **Selecting an OU** automatically selects all accounts within it.
- **Individual overrides**: deselect specific accounts even if the parent OU is selected.
- The header shows **"X of Y accounts selected"** to track your selection.
@@ -351,14 +172,12 @@ Only **ACTIVE** accounts can be selected for scanning:
| **CLOSED** | No | Account has been closed. |
<Note>
-**Your existing data is safe.** If an AWS account is already connected to Prowler as an individual provider, it will appear in the tree with a checkmark indicator.
+**Your existing data is safe.** If an AWS account is already connected to Prowler as an individual provider, it appears in the tree with a checkmark indicator.
When you proceed:
- The existing provider is **linked** to the organization — it is **not** duplicated.
- All your **historical scan data and findings are preserved** — nothing is overwritten.
- There is **no additional billing** — the existing provider is reused.
-
-This is completely safe. You are simply associating the account with the organization for easier management.
</Note>
### Custom Aliases
@@ -367,14 +186,9 @@ You can edit the display name for each account before connecting. This alias is
### Blocked Accounts
-Some accounts may appear as **blocked** (grayed out, not selectable). This happens when:
-- The account is **already linked to a different organization** in Prowler (`linked_to_other_organization`).
+Some accounts may appear as **blocked** (grayed out, not selectable) when the account is **already linked to a different organization** in Prowler (`linked_to_other_organization`). Hover over the blocked account to see the specific reason.
-Hover over the blocked account to see the specific reason.
-
-## Step 6: Test Connections
-
-### How Connection Testing Works
+## Step 4: Test Connections
Click **Test Connections** to verify that Prowler can assume the **ProwlerScan** role in each selected member account.
@@ -382,157 +196,225 @@ Click **Test Connections** to verify that Prowler can assume the **ProwlerScan**
<img src="/images/organizations/test-connections.png" alt="Connection testing in progress with spinners on each account" />
</Frame>
-- Each account shows a real-time status indicator:
- - **Spinner** — test in progress
- - **Green checkmark (✓)** — connection successful
- - **Red icon (✗)** — connection failed (hover to see the error)
-
-### All Tests Pass
+Each account shows a real-time status indicator:
+- **Spinner** — test in progress
+- **Green checkmark (✓)** — connection successful
+- **Red icon (✗)** — connection failed (hover to see the error)
If every account connects successfully, you automatically advance to the next step.
-### Some Tests Fail
+### When Some Tests Fail
-An error banner appears: **"There was a problem connecting to some accounts."**
-
-You have two options:
+An error banner appears: **"There was a problem connecting to some accounts."** You have two options:
**a) Fix and retry:**
1. Go to the AWS Console and verify the StackSet deployed to the failing accounts.
2. Check that the External ID in the StackSet matches the one shown in Prowler.
3. Return to Prowler and click **Test Connections** — only the **failed accounts are re-tested** (smart retry). Accounts that already passed are not tested again.
-<Frame>
- <img src="/images/organizations/test-connections-button.png" alt="Test Connections button" />
-</Frame>
-
**b) Skip and continue:**
-Click **Skip Connection Validation** to proceed with only the accounts that connected successfully. The failed accounts will not be scanned.
+Click **Skip Connection Validation** to proceed with only the accounts that connected successfully. The failed accounts will not be scanned. This option is only available when at least one account connected successfully.
<Frame>
<img src="/images/organizations/connection-failures-skip.png" alt="Connection test results showing failed accounts with error banner and Skip Connection Validation button" />
</Frame>
-<Note>
-**Skip Connection Validation** is only available when at least one account connected successfully.
-</Note>
+If **no accounts** connected successfully, you cannot proceed. Fix the underlying connection issues — see [Troubleshooting](#troubleshooting) — and retry before launching scans.
-### All Tests Fail
+## Step 5: Launch Scans
-If **no accounts** connected successfully, you cannot proceed:
+The Organizations wizard uses the same schedule controls described in [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling#schedule-options).
-> *"No accounts connected successfully. Fix the connection errors and retry before launching scans."*
-
-You must fix the underlying connection issues before continuing. See [Updating Credentials](#updating-credentials) below.
-
-### Updating Credentials
-
-If connection tests fail, here's how to fix common issues:
-
-1. Open the [CloudFormation Console](https://console.aws.amazon.com/cloudformation/) and check that your StackSet instances show **CREATE_COMPLETE** for the failing accounts. If not, update the StackSet to include the missing OUs.
-2. Compare the **ExternalId** parameter in your StackSet with the External ID displayed in the Prowler wizard. They must match exactly.
-3. After fixing the issue in AWS, return to Prowler and click **Test Connections**. Only the previously failed accounts will be re-tested.
-
-## Step 7: Launch Scans
-
-### Choose Scan Schedule
-
-| Schedule Option | Description |
-|-----------------|-------------|
-| **Scan Daily (every 24 hours)** | Creates a recurring daily scan for all connected accounts (default). |
-| **Run a single scan (no recurring schedule)** | Launches a one-time scan. |
-
-### Launch
-
-Click **Launch scan**. A toast notification confirms: *"Scan Launched — Daily scan scheduled for X accounts"* with a link to the Scans page. You will be redirected to the **Providers** page.
-
-Scans are only launched for accounts that are accessible (passed connection testing) and were selected.
+Click **Save**, **Save and launch scan**, or **Launch scan**, depending on the selected schedule option. A toast notification confirms whether the schedule was saved, scans were launched, or both, and includes a link to the **Scans** page. Prowler then redirects to the **Providers** page. Scans launch only for accounts that passed connection testing and were selected.
<Frame>
<img src="/images/organizations/launch-scan.png" alt="Launch Scan step showing Accounts Connected confirmation, scan schedule selector, and Launch scan button" />
</Frame>
-### What Happens Next
-
+After launching:
- Scans appear in the **Scans** page as they start and complete.
- Results populate the **Overview** and **Findings** pages.
-- Prowler runs an **automatic sync every 6 hours** to detect new accounts added to your Organization or accounts that have been removed. New accounts are onboarded automatically based on the parent OU configuration.
+- Prowler runs an **automatic sync every 6 hours** to detect accounts added to or removed from your Organization. New accounts under the targeted OU or root are onboarded automatically.
## Billing Impact
Each AWS account you connect through the Organizations wizard counts as one **provider** in your Prowler Cloud subscription.
- **Already-connected accounts**: if an account was already linked as a provider, adding it to the organization does **not** incur additional billing. The existing provider is reused.
-- **Large organizations**: connecting a 500-account organization will result in up to 500 providers on your subscription. Review your plan limits before proceeding.
+- **Large organizations**: connecting a 500-account organization results in up to 500 providers on your subscription. Review your plan limits before proceeding.
- **Deleted providers**: if you later remove an account, the deleted provider no longer counts toward your subscription.
-For pricing details, see [Prowler Cloud Pricing](/getting-started/products/prowler-cloud-pricing).
+For pricing details, see [Prowler Cloud Pricing](https://prowler.com/pricing).
## Troubleshooting
-### Invalid AWS Organization ID
+### Only Some Accounts Connect
-*"Must be a valid AWS Organization ID"*
+Discovery succeeds and the tree view appears, but only one account — or a handful — passes the connection test. This almost always means the ProwlerScan role reached the deployment account but not every member account.
-- Verify the Organization ID format: `o-` followed by 10–32 lowercase alphanumeric characters (e.g., `o-abc123def4`)
-- Copy it directly from the [AWS Organizations Console](https://console.aws.amazon.com/organizations/) to avoid typos
+- **Confirm the StackSet deployed.** Open the [CloudFormation Console](https://console.aws.amazon.com/cloudformation/) in the deployment account, select your Prowler StackSet, open the **Stack instances** tab, and confirm every instance shows **Status: CURRENT** and **Stack status: CREATE_COMPLETE**. Instances still in progress or in a failed state explain the missing accounts.
+- **Check the targeted OU or root.** The single stack only rolls the role out to accounts under the **Organizational Unit or Root ID** you entered in [Step 2](#step-2-authenticate-with-your-management-account). Accounts in other OUs are not covered — redeploy targeting the organization root (`r-`) or add the missing OUs.
+- **Verify the deployment account.** The role is created only in the account where you launched the stack. If you deployed from a **delegated administrator account**, confirm that account is a **registered delegated administrator** for CloudFormation StackSets (registered through AWS Organizations), not just a regular member account. A regular member account cannot create a service-managed StackSet, so only its own role is created — leaving every other account without the role.
+- **Suspended accounts** cannot be scanned. Deselect them and proceed.
-### Invalid IAM Role ARN
+### No Accounts Connect
-*"Must be a valid IAM Role ARN"*
+No account passes the connection test.
-- Verify the ARN format: `arn:aws:iam::<12-digit-account-id>:role/<role-name>`
-- Copy the ARN directly from the [IAM Console](https://console.aws.amazon.com/iam/) in your management account
+- **External ID mismatch.** Compare the **ExternalId** parameter in your StackSet with the External ID shown in the Prowler wizard. They must match exactly.
+- **StackSet not deployed.** Confirm the StackSet exists and its instances reached **CREATE_COMPLETE**. If you deployed the roles manually, verify [trusted access for CloudFormation StackSets](#member-account-role-stackset) is enabled.
+- **IP-based policies.** If your accounts restrict access by IP, allow the [Prowler Cloud egress IPs](/security/networking).
-### Authentication Failed
+### Authentication Fails or Times Out
-*"Authentication failed. Please verify the StackSet deployment and Role ARN"*
+*"Authentication failed. Please verify the StackSet deployment and Role ARN"* or *"Authentication timed out"*
-- Verify the management account role exists and was created in [Step 1](#step-1-create-the-management-account-role)
-- Confirm the trust policy includes the correct External ID from the wizard
-- Check the role has all Organizations discovery permissions listed in [Step 1](#step-1-create-the-management-account-role)
-- Double-check the Role ARN format and account ID for typos
+- Verify the deployment account role exists and is named exactly `ProwlerScan`.
+- Confirm the trust policy includes the correct External ID from the wizard.
+- Check the role has the Organizations discovery permissions listed in [Deploy the Roles Manually](#management-account-role).
+- Double-check the Role ARN format and account ID for typos.
+- Retry — the role can take up to **60 seconds** to propagate, and a second attempt often succeeds. For very large organizations (500+ accounts), allow extra time for discovery.
-### Authentication Timed Out
+### Invalid Organization ID or Role ARN
-*"Authentication timed out"*
+*"Must be a valid AWS Organization ID"* or *"Must be a valid IAM Role ARN"*
-- Retry the authentication step — the second attempt often succeeds
-- Check for AWS API rate limiting on the Organizations service
-- For very large organizations (500+ accounts), allow extra time for discovery
-
-### Connection Test Fails for All Accounts
-
-No accounts pass the connection test.
-
-- Verify the CloudFormation StackSet was deployed — complete [Step 2](#step-2-deploy-the-cloudformation-stackset) and wait for stack instances to reach **CREATE_COMPLETE**
-- Check that the **ExternalId** parameter in the StackSet matches the External ID shown in the Prowler wizard
-- If your accounts use IP-based IAM policies, allow [Prowler Cloud public IPs](/user-guide/tutorials/prowler-cloud-public-ips)
-
-### Connection Test Fails for Some Accounts
-
-Some accounts show a red icon while others pass.
-
-- Expand the StackSet deployment to include the OUs containing the failing accounts
-- Suspended accounts cannot be scanned — deselect them and proceed
-- Ensure the [STS regional endpoint](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) is enabled in the account's region
-- After fixing, click **Test Connections** — only the failed accounts will be re-tested
-
-### No Accounts Connected Successfully
-
-*"No accounts connected successfully. Fix the connection errors and retry before launching scans."*
-
-- Hover over the red icon on each account to see the specific error
-- Fix the underlying issues using the guidance above
-- Click **Test Connections** to retry
+- Organization ID format: `o-` followed by 10–32 lowercase alphanumeric characters (e.g., `o-abc123def4`).
+- Role ARN format: `arn:aws:iam::<12-digit-account-id>:role/ProwlerScan`.
+- Copy both directly from the AWS Console to avoid typos.
### Failed to Apply Discovery
*"Failed to apply discovery"*
-- Check the `blocked_reasons` field for any blocked accounts
-- Retry the operation
-- If the error persists, contact [Prowler Support](mailto:support@prowler.com)
+- Check the `blocked_reasons` field for any blocked accounts and retry the operation.
+- If the error persists, contact [Prowler Support](mailto:support@prowler.com).
+
+## Deploy the Roles Manually
+
+The wizard's **Create Stack** button is the fastest path, but you can create both roles yourself — for example with Terraform or your own CloudFormation — and paste the management account Role ARN into [Step 2](#step-2-authenticate-with-your-management-account). Both roles must be named `ProwlerScan`, since Prowler expects a consistent role name across all accounts.
+
+<Note>
+**Prefer Terraform?** You can deploy the ProwlerScan role across the organization with Terraform instead of CloudFormation. See the [StackSets deployment guide](/user-guide/providers/aws/organizations#deploying-prowler-iam-roles-across-aws-organizations) for the module.
+</Note>
+
+### Management Account Role
+
+The management account role lets Prowler discover your Organization structure — listing accounts, OUs, and hierarchy — and scan the management account itself. StackSets with service-managed permissions do not deploy to the management account, so this role is always created separately from the member-account StackSet.
+
+1. Sign in to the [AWS IAM Console](https://console.aws.amazon.com/iam/) in your **management account** (or delegated administrator account).
+2. Go to **Roles > Create role** and select **Custom trust policy**.
+3. Paste the following trust policy, replacing `<YOUR_EXTERNAL_ID>` with the External ID shown in the Prowler wizard:
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": "arn:aws:iam::232136659152:root"
+ },
+ "Action": "sts:AssumeRole",
+ "Condition": {
+ "StringEquals": {
+ "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
+ },
+ "StringLike": {
+ "aws:PrincipalArn": "arn:aws:iam::232136659152:role/prowler*"
+ }
+ }
+ }
+ ]
+}
+```
+
+4. Attach the AWS managed policies **SecurityAudit** and **ViewOnlyAccess** so Prowler can scan the management account for security findings.
+5. Add an inline policy with the Organizations discovery permissions:
+
+```json
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Sid": "ProwlerOrganizationDiscovery",
+ "Effect": "Allow",
+ "Action": [
+ "organizations:DescribeAccount",
+ "organizations:DescribeOrganization",
+ "organizations:ListAccounts",
+ "organizations:ListAccountsForParent",
+ "organizations:ListOrganizationalUnitsForParent",
+ "organizations:ListRoots",
+ "organizations:ListTagsForResource"
+ ],
+ "Resource": "*"
+ },
+ {
+ "Sid": "ProwlerStackSetManagement",
+ "Effect": "Allow",
+ "Action": [
+ "organizations:RegisterDelegatedAdministrator",
+ "iam:CreateServiceLinkedRole"
+ ],
+ "Resource": "*"
+ }
+ ]
+}
+```
+
+<Tip>
+You can restrict the `Resource` field to your specific Organization ARN (e.g., `arn:aws:organizations::123456789012:organization/o-abc123def4`) instead of `"*"` to minimize the blast radius.
+</Tip>
+
+6. Name the role **`ProwlerScan`** and click **Create role**. The ARN follows the format `arn:aws:iam::<account-id>:role/ProwlerScan` — paste it into the wizard.
+
+### Member Account Role (StackSet)
+
+Deploy the ProwlerScan role to every member account with a [CloudFormation StackSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html), so you don't create the role manually in each account.
+
+<Note>
+**Trusted access required.** CloudFormation StackSets must have trusted access enabled in your management account. Verify this under **AWS Organizations > Settings > Trusted access for AWS CloudFormation StackSets**.
+</Note>
+
+1. In your management account, navigate to **CloudFormation > StackSets > Create StackSet** ([open directly](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacksets/create)).
+2. Choose **Service-managed permissions** so AWS Organizations deploys the role automatically across current and future member accounts.
+3. Select **Amazon S3 URL** as the template source and paste:
+ ```
+ https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml
+ ```
+4. Set the **ExternalId** parameter to the External ID shown in the Prowler wizard.
+5. Choose your deployment targets (entire organization or specific OUs) and regions, then click **Create StackSet**.
+6. Open the **Stack instances** tab and confirm every instance shows **Status: CURRENT** and **Stack status: CREATE_COMPLETE**. Deployment typically takes **2–5 minutes**; large organizations (500+ accounts) may take longer.
+
+The StackSet role uses read-only access only (`SecurityAudit`, `ViewOnlyAccess`, plus a small set of additional read-only permissions). Prowler makes no changes to your accounts. See the [CloudFormation template](https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml) for the full list. When you add new accounts under the targeted OU or root, the StackSet deploys the role automatically, and Prowler's 6-hour sync onboards them end-to-end.
+
+## Key Concepts
+
+### What Is an External ID?
+
+An **External ID** is a security token that Prowler generates unique to your tenant. When Prowler assumes the IAM role in your AWS account, it presents this External ID to prove its identity.
+
+This prevents the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) — a scenario where an unauthorized party could trick AWS into granting access to your account. By requiring the External ID, only your specific Prowler tenant can assume the role. Prowler generates it automatically and displays it in the wizard for you to copy.
+
+### Two Roles Architecture
+
+Prowler uses **two IAM roles**, both named `ProwlerScan` but deployed in different places:
+
+| Role | Where it lives | What it does |
+|------|---------------|--------------|
+| **ProwlerScan** (management account) | Your management (or delegated administrator) account | Discovers the Organization structure **and** scans that account. Includes additional Organizations discovery permissions. |
+| **ProwlerScan** (member accounts) | Every member account | Scans the account for security findings. |
+
+Both roles share the name `ProwlerScan` because Prowler expects a consistent role name across all accounts. The single CloudFormation stack in [Step 2](#step-2-authenticate-with-your-management-account) deploys both at once.
+
+<Frame caption="Both roles share the same name `ProwlerScan`. The management account role includes additional Organization discovery permissions.">
+ <img src="/images/organizations/two-roles-architecture.svg" alt="Two Roles Architecture: ProwlerScan in management account (discovery + scanning) and ProwlerScan in member accounts (via StackSet, scanning only)" />
+</Frame>
+
+### What Is a CloudFormation StackSet?
+
+A [CloudFormation StackSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html) deploys the same CloudFormation template across multiple AWS accounts in a single operation. Prowler uses a service-managed StackSet to deploy the **ProwlerScan** IAM role into every member account of your organization, so you don't create the role manually in each account. StackSets do not deploy to the management account, which is why that role is created separately.
## What's Next
diff --git a/docs/user-guide/tutorials/prowler-cloud-azure-management-groups.mdx b/docs/user-guide/tutorials/prowler-cloud-azure-management-groups.mdx
new file mode 100644
index 0000000000..98cfe095ce
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-cloud-azure-management-groups.mdx
@@ -0,0 +1,11 @@
+---
+title: 'Azure Management Groups'
+description: 'Onboard all Azure subscriptions in your management groups through a single guided wizard'
+tag: "Coming Soon"
+---
+
+Onboarding Azure management groups through a single guided wizard is coming soon to Prowler Cloud.
+
+Today, Azure subscriptions are onboarded individually. See [Getting Started with Azure](/user-guide/providers/azure/getting-started-azure) and [Bulk Provider Provisioning](/user-guide/tutorials/bulk-provider-provisioning) to automate onboarding multiple subscriptions.
+
+Keep an eye on the [changelog](https://github.com/prowler-cloud/prowler/releases) for updates.
diff --git a/docs/user-guide/tutorials/prowler-cloud-gcp-organizations.mdx b/docs/user-guide/tutorials/prowler-cloud-gcp-organizations.mdx
new file mode 100644
index 0000000000..c0c11747a9
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-cloud-gcp-organizations.mdx
@@ -0,0 +1,11 @@
+---
+title: 'GCP Organizations'
+description: 'Onboard all GCP projects in your organization through a single guided wizard'
+tag: "Coming Soon"
+---
+
+Onboarding a full GCP organization through a single guided wizard is coming soon to Prowler Cloud.
+
+Today, GCP projects are onboarded individually. See [Getting Started with GCP](/user-guide/providers/gcp/getting-started-gcp) and [Bulk Provider Provisioning](/user-guide/tutorials/bulk-provider-provisioning) to automate onboarding multiple projects.
+
+Keep an eye on the [changelog](https://github.com/prowler-cloud/prowler/releases) for updates.
diff --git a/docs/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm.mdx b/docs/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm.mdx
new file mode 100644
index 0000000000..0cb251df1f
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm.mdx
@@ -0,0 +1,82 @@
+---
+title: 'Using Multiple LLM Providers'
+sidebarTitle: 'Multiple LLM Providers'
+---
+
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+Lighthouse AI on Prowler Cloud supports multiple Large Language Model (LLM) providers, so teams can choose the option that best fits their infrastructure, compliance requirements, and cost considerations. This guide explains how to configure and manage providers for Lighthouse AI on Prowler Cloud.
+
+<SubscriptionBanner />
+
+For a feature overview, see [Lighthouse AI on Prowler Cloud](/getting-started/products/prowler-cloud-lighthouse).
+
+## Supported Providers
+
+- **OpenAI:** GPT models, including the default GPT-5.5.
+- **Amazon Bedrock:** AWS-hosted access to Claude, Llama, Titan, and other models.
+- **OpenAI Compatible:** Any service exposing an OpenAI-compatible API endpoint, such as OpenRouter.
+
+## Model Requirements
+
+Lighthouse AI requires models that support all of the following:
+
+- **Text input:** Ability to receive text prompts.
+- **Text output:** Ability to generate text responses.
+- **Tool calling:** Ability to invoke tools to retrieve data from Prowler.
+
+Models without these capabilities are not going to work well.
+
+## Configuring Providers
+
+Navigate to **Configuration** → **Lighthouse AI** to see the available providers, each with its own connection option.
+
+To connect a provider:
+
+1. Click the desired provider.
+2. Enter the required credentials.
+3. Click **Save**. The connection is validated automatically before the provider becomes available.
+
+<img src="/images/prowler-app/lighthouse/prowler-cloud/config-page.png" alt="Lighthouse AI configuration page in Prowler Cloud" />
+
+The required information differs per provider:
+
+<Tabs>
+ <Tab title="OpenAI">
+ - **API Key:** OpenAI API key (starts with `sk-` or `sk-proj-`), created from the [OpenAI platform](https://platform.openai.com/api-keys).
+
+ Confirm the OpenAI account has sufficient credits and that the default GPT-5.5 model is not blocked in the organization settings.
+ </Tab>
+ <Tab title="Amazon Bedrock">
+ Connect using either an Amazon Bedrock API key or AWS IAM credentials.
+
+ **Amazon Bedrock API key**
+ - **Bedrock API Key:** The key generated from Amazon Bedrock.
+ - **AWS Region:** Region where Bedrock is available.
+
+ **AWS IAM Access Keys**
+ - **AWS Access Key ID** and **AWS Secret Access Key** for the IAM user.
+ - **AWS Region:** Region where Bedrock is available.
+ - The IAM user requires the `AmazonBedrockLimitedAccess` managed policy.
+ </Tab>
+ <Tab title="OpenAI Compatible">
+ Connect to any service exposing an OpenAI-compatible API endpoint that Prowler Cloud can reach over the Internet.
+
+ - **API Key:** API key from the compatible service.
+ - **Base URL:** API endpoint URL including the version (for example, `https://openrouter.ai/api/v1`).
+
+ ### Example: OpenRouter
+
+ 1. Create an account at [OpenRouter](https://openrouter.ai/).
+ 2. Generate an API key from the OpenRouter dashboard.
+ 3. Enter the API key and set the base URL to `https://openrouter.ai/api/v1`.
+ </Tab>
+</Tabs>
+
+## Model Recommendations
+
+GPT-5.5 is the default and recommended model for Lighthouse AI on Prowler Cloud. Models from Amazon Bedrock and OpenAI-compatible endpoints can also be used, but performance is not guaranteed. Ensure any selected model supports text input, text output, and tool calling.
+
+## Getting Help
+
+For issues or suggestions with Lighthouse AI on Prowler Cloud, request support at [support.prowler.com](https://support.prowler.com) or [reach out through our Slack channel](https://goto.prowler.com/slack).
diff --git a/docs/user-guide/tutorials/prowler-cloud-public-ips.mdx b/docs/user-guide/tutorials/prowler-cloud-public-ips.mdx
deleted file mode 100644
index f3b285056c..0000000000
--- a/docs/user-guide/tutorials/prowler-cloud-public-ips.mdx
+++ /dev/null
@@ -1,29 +0,0 @@
----
-title: 'Prowler Cloud Public IPs'
----
-
-## Overview
-
-Prowler Cloud uses a dedicated egress IPv4 address for all outbound connections to customer infrastructure. This enables organizations to implement network-level security controls by whitelisting Prowler's IP address.
-
-## Use Cases
-
-Whitelisting Prowler's egress IP address enables:
-
-- **Credential Usage Control**: Restrict where cloud provider credentials can be used from across AWS, Azure, GCP, and other providers
-- **Kubernetes Security**: Limit inbound HTTPS traffic to clusters by allowing only Prowler's IP address
-- **Compliance Requirements**: Meet security policies requiring allowlisting of external services
-
-## Query the Egress IP Address
-
-Retrieve Prowler Cloud's current egress IP address using the following command:
-
-```bash
-dig egress.prowler.com +short
-```
-
-This command returns the IPv4 address that Prowler Cloud uses for all outbound connections to customer infrastructure.
-
-<Note>
-The egress IP address is stable, but it is recommended to periodically verify it remains current by querying `egress.prowler.com`.
-</Note>
diff --git a/docs/user-guide/tutorials/prowler-import-findings.mdx b/docs/user-guide/tutorials/prowler-import-findings.mdx
index d4c8f8a74d..530cd160ee 100644
--- a/docs/user-guide/tutorials/prowler-import-findings.mdx
+++ b/docs/user-guide/tutorials/prowler-import-findings.mdx
@@ -1,19 +1,19 @@
---
title: 'Import Findings'
+sidebarTitle: 'Import Findings'
description: 'Upload OCSF scan results to Prowler Cloud from external sources or the CLI'
---
import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
<VersionBadge version="5.19.0" />
Findings Ingestion enables uploading OCSF (Open Cybersecurity Schema Framework) scan results to Prowler Cloud. This feature supports importing findings from Prowler CLI output files that use the [Detection Finding](https://schema.ocsf.io/classes/detection_finding) class.
-<Note>
-This feature is available exclusively in **Prowler Cloud** and **Prowler Enterprise** with a [paid subscription](https://prowler.com/pricing).
-</Note>
+<SubscriptionBanner />
-## OCSF Detection Finding format
+## OCSF Detection Finding Format
The ingestion API accepts `.ocsf.json` files containing a JSON array of OCSF Detection Finding records. Each finding represents a security check result from Prowler.
@@ -130,11 +130,11 @@ The ingestion API accepts `.ocsf.json` files containing a JSON array of OCSF Det
Only **Detection Finding** (`class_uid: 2004`) records are accepted. Other OCSF classes are not supported for ingestion.
</Note>
-## Required permissions
+## Required Permissions
The **Manage Ingestions** RBAC permission controls access to the ingestion endpoints. Without this permission, findings cannot be submitted via the API or `--push-to-cloud`.
-For more information about RBAC permissions, refer to the [Prowler App RBAC documentation](/user-guide/tutorials/prowler-app-rbac).
+For more information about RBAC permissions, refer to the [Prowler Cloud RBAC documentation](/user-guide/tutorials/prowler-app-rbac).
## Using the CLI
@@ -145,7 +145,7 @@ The `--push-to-cloud` flag uploads scan results directly to Prowler Cloud after
- A valid Prowler Cloud API key (see [API Keys](/user-guide/tutorials/prowler-app-api-keys))
- The `PROWLER_CLOUD_API_KEY` environment variable configured
-### Basic usage
+### Basic Usage
```bash
export PROWLER_CLOUD_API_KEY="pk_your_api_key_here"
@@ -153,7 +153,7 @@ export PROWLER_CLOUD_API_KEY="pk_your_api_key_here"
prowler aws --push-to-cloud
```
-### Combining with output formats
+### Combining with Output Formats
When using `--push-to-cloud` with custom output formats that exclude OCSF, Prowler generates a temporary OCSF file for upload:
@@ -169,7 +169,7 @@ When default output formats include OCSF, Prowler reuses the existing file. Defa
prowler aws --services accessanalyzer --push-to-cloud -o /tmp/scan-output
```
-### CLI output examples
+### CLI Output Examples
**Successful upload:**
```
@@ -228,7 +228,7 @@ curl -X POST \
https://api.prowler.com/api/v1/ingestions
```
-### Submit an ingestion batch
+### Submit an Ingestion Batch
Upload a `.ocsf.json` file containing a JSON array of OCSF Detection Finding records. See [OCSF Detection Finding format](#ocsf-detection-finding-format) for the expected structure.
@@ -266,7 +266,7 @@ curl -X POST \
}
```
-### Get ingestion status
+### Get Ingestion Status
Monitor the progress of an ingestion job.
@@ -304,7 +304,7 @@ curl -X GET \
}
```
-### List ingestion jobs
+### List Ingestion Jobs
Retrieve a list of ingestion jobs for the tenant.
@@ -332,7 +332,7 @@ curl -X GET \
"https://api.prowler.com/api/v1/ingestions?filter[status]=completed&page[size]=10"
```
-### Get ingestion errors
+### Get Ingestion Errors
Retrieve error details for a specific ingestion job.
@@ -346,7 +346,7 @@ curl -X GET \
https://api.prowler.com/api/v1/ingestions/3650fef9-8e5f-4808-a95f-74f0afae8499/errors
```
-## Ingestion status values
+## Ingestion Status Values
| Status | Description |
|--------|-------------|
@@ -355,7 +355,7 @@ curl -X GET \
| `completed` | All records processed successfully |
| `failed` | Job encountered errors during processing |
-## CI/CD integration
+## CI/CD Integration
Automate findings ingestion in CI/CD pipelines by setting the API key as a secret.
@@ -391,7 +391,7 @@ prowler_scan:
PROWLER_CLOUD_API_KEY: $PROWLER_CLOUD_API_KEY
```
-## Billing impact
+## Billing Impact
Each unique cloud account discovered in ingested OCSF findings counts as one **provider** in the Prowler Cloud subscription.
diff --git a/docs/user-guide/tutorials/prowler-scan-scheduling.mdx b/docs/user-guide/tutorials/prowler-scan-scheduling.mdx
new file mode 100644
index 0000000000..f909ed2fa0
--- /dev/null
+++ b/docs/user-guide/tutorials/prowler-scan-scheduling.mdx
@@ -0,0 +1,107 @@
+---
+title: 'Scan Scheduling'
+sidebarTitle: 'Scheduling'
+description: 'Create, edit, and monitor recurring scans in Prowler Cloud and Prowler Private Cloud.'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
+
+<VersionBadge version="5.31.0" />
+
+Scan Scheduling lets Prowler run recurring scans for connected providers. Use it to keep findings, compliance results, and resource inventory up to date without launching every scan manually.
+
+<SubscriptionBanner />
+
+## Prerequisites
+
+Before creating or editing scan schedules, ensure that:
+
+* At least one provider is connected.
+* The user role includes the **Manage Scans** permission, configured through Role-Based Access Control (RBAC). See [RBAC Administrative Permissions](/user-guide/tutorials/prowler-app-rbac#rbac-administrative-permissions) for details.
+
+## Schedule Options
+
+A Prowler Cloud or Prowler Private Cloud subscription supports the following custom recurring schedule options. Prowler Local Server runs a daily scan automatically and does not expose custom cadence controls.
+
+| Schedule Option | Description | Prowler Cloud & Prowler Private Cloud | Prowler Local Server |
+|-----------------|-------------|---------------------------------------|----------------------|
+| Daily | Runs one scan every day at the selected time. | Yes | Automatic |
+| Every 48 hours | Runs one scan every 48 hours, anchored to the selected time. | Yes | — |
+| Weekly | Runs one scan every week on the selected day and time. | Yes | — |
+| Monthly | Runs one scan every month on the selected day, from day 1 to day 28. | Yes | — |
+
+The scan time is always selected on the hour (for example, 14:00); minutes cannot be set. The schedule time uses the browser timezone when the schedule is saved. Prowler displays the next scheduled scan in that timezone.
+
+## Create a Schedule From Scans
+
+To create a schedule from the **Scans** page:
+
+1. Navigate to **Scans**.
+2. Click **Launch Scan**.
+3. Select a connected provider.
+4. Select **On a schedule**.
+5. Choose the **Scan Time** and **Repeats** values.
+6. Optional: select **Launch an initial scan now for immediate findings** to run a scan immediately after saving the recurring schedule.
+7. Click **Save Schedule**.
+
+<Frame>
+ <img src="/images/prowler-app/scan-scheduling/launch-scan-schedule.png" alt="Launch A Scan modal showing On a schedule mode, weekly schedule controls, and Save Schedule button" />
+</Frame>
+
+After the schedule is saved, Prowler shows a confirmation toast with a link to the **Scheduled** tab.
+
+## Edit Schedules From Providers
+
+The **Providers** page shows each provider's current schedule in the **Scan Schedule** column. Providers without a recurring schedule show **None**.
+
+<Frame>
+ <img src="/images/prowler-app/scan-scheduling/providers-scan-schedule.png" alt="Providers table showing the Scan Schedule column with Daily and None schedule states" />
+</Frame>
+
+To edit a provider schedule:
+
+1. Navigate to **Providers**.
+2. Open the provider row actions menu.
+3. Click **Edit Scan Schedule**.
+4. Update the schedule fields.
+5. Click **Save**.
+
+<Frame>
+ <img src="/images/prowler-app/scan-scheduling/edit-scan-schedule.png" alt="Edit Scan Schedule modal showing a weekly provider schedule and Remove Scan Schedule action" />
+</Frame>
+
+To stop automatic scans for a provider, click **Remove Scan Schedule** in the edit modal. Removing a schedule stops future automatic scans; existing completed scan results remain available.
+
+## Bulk Edit Schedules
+
+Use bulk schedule editing when several providers need the same recurring cadence.
+
+To bulk edit provider schedules:
+
+1. Navigate to **Providers**.
+2. Select the provider rows that should receive the same schedule.
+3. Open the selected-row actions menu.
+4. Click **Edit Scan Schedule (N)**, where **N** is the number of selected providers.
+5. Save the schedule.
+
+For AWS Organizations and Organizational Unit rows, **Edit Scan Schedule** applies the schedule to the connected child providers in that group.
+
+<Warning>
+Bulk schedule edits apply one schedule to every selected provider. If the wrong providers are selected, Prowler applies the same cadence to unintended providers. To recover, reopen bulk edit with the correct selection or update affected provider schedules individually.
+</Warning>
+
+## Review Scheduled Scans
+
+To review upcoming scheduled scans:
+
+1. Navigate to **Scans**.
+2. Click the **Scheduled** tab.
+
+The **Scheduled** tab shows configured schedules, next scan time, and last scan time. Pending rows represent configured schedules that have not started their next scan yet.
+
+<Frame>
+ <img src="/images/prowler-app/scan-scheduling/scheduled-scans-tab.png" alt="Scans Scheduled tab showing pending scheduled scans, schedule cadence, next scan, and last scan columns" />
+</Frame>
+
+To edit a schedule from this tab, open the row actions menu and click **Edit Scan Schedule**.
diff --git a/mcp_server/.env.template b/mcp_server/.env.template
index 11b8caa724..10aabd84cf 100644
--- a/mcp_server/.env.template
+++ b/mcp_server/.env.template
@@ -1,3 +1,3 @@
-PROWLER_APP_API_KEY="pk_your_api_key_here"
+PROWLER_API_KEY="pk_your_api_key_here"
API_BASE_URL="https://api.prowler.com/api/v1"
PROWLER_MCP_TRANSPORT_MODE="stdio"
diff --git a/mcp_server/AGENTS.md b/mcp_server/AGENTS.md
index a82cc42e33..1d3d808e6a 100644
--- a/mcp_server/AGENTS.md
+++ b/mcp_server/AGENTS.md
@@ -25,7 +25,7 @@ The Prowler MCP Server provides AI agents access to the Prowler ecosystem throug
## CRITICAL RULES
### Tool Implementation
-- ALWAYS: Extend `BaseTool` ABC for Prowler App tools (auto-registration)
+- ALWAYS: Extend `BaseTool` ABC for Prowler tools (auto-registration)
- ALWAYS: Use `@mcp.tool()` decorator for Hub/Docs tools
- NEVER: Manually register BaseTool subclasses
- NEVER: Import tools directly in server.py
@@ -56,7 +56,7 @@ await prowler_mcp_server.import_server(docs_mcp_server, prefix="prowler_docs")
### Tool Naming
- `prowler_hub_*` - Catalog and compliance (no auth)
- `prowler_docs_*` - Documentation search (no auth)
-- `prowler_app_*` - Cloud/App management (auth required)
+- `prowler_*` - Prowler Cloud, Private Cloud & Local Server management (auth required)
---
diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md
index 8f1438a3bb..5898f816c9 100644
--- a/mcp_server/CHANGELOG.md
+++ b/mcp_server/CHANGELOG.md
@@ -2,6 +2,16 @@
All notable changes to the **Prowler MCP Server** are documented in this file.
+<!-- changelog: release notes start -->
+
+## [0.8.0] (Prowler v5.35.0)
+
+### 🔄 Changed
+
+- Core Prowler tool namespace from the `prowler_app_*` prefix to `prowler_*` [(#12017)](https://github.com/prowler-cloud/prowler/pull/12017)
+
+---
+
## [0.7.2] (Prowler v5.28.1)
### 🐞 Fixed
diff --git a/mcp_server/Dockerfile b/mcp_server/Dockerfile
index c2759b20de..195bfe1eae 100644
--- a/mcp_server/Dockerfile
+++ b/mcp_server/Dockerfile
@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
# =============================================================================
# Final stage - Minimal runtime environment
# =============================================================================
-FROM python:3.13.14-alpine3.23@sha256:b0513989fa9be54569cac73f48a60320b74bb0f9ffa886568eea7e48a2432c04
+FROM python:3.13.14-alpine3.23@sha256:9fdbf2e3e82628351513560b121e2ee6ce31cac212be9e070c5a5e2769fb5e76
LABEL maintainer="https://github.com/prowler-cloud"
diff --git a/mcp_server/README.md b/mcp_server/README.md
index e990f0f363..c0e4fdb0fe 100644
--- a/mcp_server/README.md
+++ b/mcp_server/README.md
@@ -6,9 +6,9 @@
## Key Capabilities
-### Prowler Cloud and Prowler App (Self-Managed)
+### Prowler Cloud, Prowler Private Cloud & Prowler Local Server
-Full access to Prowler Cloud platform and self-managed Prowler App for:
+Full access to your Prowler data (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server) for:
- **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments
- **Finding Groups Analysis**: Triage findings grouped by check ID and drill down into affected resources
- **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.)
@@ -49,7 +49,7 @@ For comprehensive guides and tutorials, see the official documentation:
Prowler MCP Server can be used in three ways:
-### 1. Prowler Cloud MCP Server (Recommended)
+### 1. Hosted Prowler MCP (Recommended)
**Use Prowler's managed MCP server at `https://mcp.prowler.com/mcp`**
@@ -126,7 +126,7 @@ For complete tool descriptions and parameters, see the [Tools Reference](https:/
### Tool Naming Convention
All tools follow a consistent naming pattern with prefixes:
-- `prowler_app_*` - Prowler Cloud and App (Self-Managed) management tools
+- `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools
- `prowler_hub_*` - Prowler Hub catalog and compliance tools
- `prowler_docs_*` - Prowler documentation search and retrieval
@@ -146,7 +146,7 @@ prowler_mcp_server/
**Key Features:**
- **Modular Design**: Three independent sub-servers with prefixed namespacing
-- **Auto-Discovery**: Prowler App tools are automatically discovered and registered
+- **Auto-Discovery**: Prowler tools are automatically discovered and registered
- **LLM Optimization**: Response models minimize token usage by excluding empty values
- **Dual Transport**: Supports both STDIO (local) and HTTP (remote) modes
@@ -174,17 +174,17 @@ The Prowler MCP Server enables powerful workflows through AI assistants:
## Requirements
-**For Prowler Cloud MCP Server:**
-- Prowler Cloud account and API key (only for Prowler Cloud/App features)
+**For the hosted Prowler MCP:**
+- Prowler Cloud account and API key (only for Prowler features)
**For self-hosted STDIO/HTTP Mode:**
- Python 3.12+ or Docker
- Network access to:
- `https://hub.prowler.com` (for Prowler Hub)
- `https://docs.prowler.com` (for Prowler Documentation)
- - Prowler Cloud API or self-hosted Prowler App API (for Prowler Cloud/App features)
+ - Prowler Cloud API or Prowler Local Server API (for Prowler features)
-> **No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication. A Prowler API key is only required to access Prowler Cloud or Prowler App (Self-Managed) features.
+> **No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication. A Prowler API key is only required to access Prowler features (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).
## Configuring MCP Hosts
@@ -200,7 +200,7 @@ For developers looking to extend the MCP server with new tools or features:
## Related Products
- **[Prowler Hub](https://hub.prowler.com)**: Browse security checks and compliance frameworks
-- **[Prowler Cloud](https://cloud.prowler.com)**: Managed Prowler platform
+- **[Prowler Cloud](https://cloud.prowler.com)**: Fully managed Prowler in the cloud
- **[Lighthouse AI](https://docs.prowler.com/getting-started/products/prowler-lighthouse-ai)**: AI security analyst
## License
diff --git a/tests/config/__init__.py b/mcp_server/changelog.d/.gitkeep
similarity index 100%
rename from tests/config/__init__.py
rename to mcp_server/changelog.d/.gitkeep
diff --git a/mcp_server/changelog.d/README.md b/mcp_server/changelog.d/README.md
new file mode 100644
index 0000000000..0853174f30
--- /dev/null
+++ b/mcp_server/changelog.d/README.md
@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.
diff --git a/mcp_server/prowler_mcp_server/__init__.py b/mcp_server/prowler_mcp_server/__init__.py
index fe7af2dcea..1956a6ec41 100644
--- a/mcp_server/prowler_mcp_server/__init__.py
+++ b/mcp_server/prowler_mcp_server/__init__.py
@@ -5,7 +5,7 @@ This package provides MCP tools for accessing:
- Prowler Hub: All security artifacts (detections, remediations and frameworks) supported by Prowler
"""
-__version__ = "0.5.0"
+__version__ = "0.8.0"
__author__ = "Prowler Team"
__email__ = "engineering@prowler.com"
diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/__init__.py b/mcp_server/prowler_mcp_server/prowler_app/models/__init__.py
index 899ab4e866..1b15e35ac9 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/models/__init__.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/models/__init__.py
@@ -1,4 +1,4 @@
-"""Pydantic models for Prowler App MCP Server."""
+"""Pydantic models for Prowler MCP Server."""
from prowler_mcp_server.prowler_app.models.base import MinimalSerializerMixin
from prowler_mcp_server.prowler_app.models.findings import (
diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/finding_groups.py b/mcp_server/prowler_mcp_server/prowler_app/models/finding_groups.py
index ae8431ba63..c2429012c3 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/models/finding_groups.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/models/finding_groups.py
@@ -228,7 +228,7 @@ class FindingGroupResource(MinimalSerializerMixin):
resource: FindingGroupResourceInfo = Field(description="Affected resource")
provider: FindingGroupProviderInfo = Field(description="Affected provider")
finding_id: str = Field(
- description="Finding UUID to use with prowler_app_get_finding_details"
+ description="Finding UUID to use with prowler_get_finding_details"
)
status: FindingStatus = Field(description="Finding status for this resource")
severity: FindingSeverity = Field(description="Finding severity")
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/__init__.py b/mcp_server/prowler_mcp_server/prowler_app/tools/__init__.py
index 4d740b6efe..8b5be76076 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/__init__.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/__init__.py
@@ -1,4 +1,4 @@
-"""Domain-specific tools for Prowler App MCP Server.
+"""Domain-specific tools for Prowler MCP Server.
Each module in this package contains a BaseTool subclass that registers
and implements tools for a specific domain (findings, providers, scans, etc.).
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/attack_paths.py b/mcp_server/prowler_mcp_server/prowler_app/tools/attack_paths.py
index b08bbfe01f..5bd66760fa 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/attack_paths.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/attack_paths.py
@@ -1,4 +1,4 @@
-"""Attack Paths tools for Prowler App MCP Server.
+"""Attack Paths tools for Prowler MCP Server.
This module provides tools for analyzing Attack Paths data from Neo4j graph database.
Attack Paths help identify security risks by tracing potential attack vectors
@@ -22,16 +22,16 @@ class AttackPathsTools(BaseTool):
"""Tools for Attack Paths analysis.
Provides tools for:
- - prowler_app_list_attack_paths_scans: Find completed scans ready for analysis
- - prowler_app_list_attack_paths_queries: Discover available queries for a scan
- - prowler_app_run_attack_paths_query: Execute query and analyze attack paths
+ - prowler_list_attack_paths_scans: Find completed scans ready for analysis
+ - prowler_list_attack_paths_queries: Discover available queries for a scan
+ - prowler_run_attack_paths_query: Execute query and analyze attack paths
"""
async def list_attack_paths_scans(
self,
provider_id: list[str] = Field(
default=[],
- description="Filter by Prowler's internal UUID(s) (v4) for specific provider(s). Use `prowler_app_search_providers` tool to find provider IDs",
+ description="Filter by Prowler's internal UUID(s) (v4) for specific provider(s). Use `prowler_search_providers` tool to find provider IDs",
),
provider_type: list[str] = Field(
default=[],
@@ -73,8 +73,8 @@ class AttackPathsTools(BaseTool):
Workflow:
1. Use this tool to find completed attack paths scans
- 2. Use prowler_app_list_attack_paths_queries to see available queries for a scan
- 3. Use prowler_app_run_attack_paths_query to execute analysis
+ 2. Use prowler_list_attack_paths_queries to see available queries for a scan
+ 3. Use prowler_run_attack_paths_query to execute analysis
"""
try:
# Validate pagination
@@ -113,7 +113,7 @@ class AttackPathsTools(BaseTool):
async def list_attack_paths_queries(
self,
scan_id: str = Field(
- description="UUID of a COMPLETED attack paths scan. Use `prowler_app_list_attack_paths_scans` with state=['completed'] to find scan IDs"
+ description="UUID of a COMPLETED attack paths scan. Use `prowler_list_attack_paths_scans` with state=['completed'] to find scan IDs"
),
) -> list[dict[str, Any]]:
"""Discover available Attack Paths queries for a completed scan.
@@ -133,9 +133,9 @@ class AttackPathsTools(BaseTool):
- aws-ec2-instances-internet-exposed: Find internet-exposed EC2 instances
Workflow:
- 1. Use prowler_app_list_attack_paths_scans to find a completed scan
+ 1. Use prowler_list_attack_paths_scans to find a completed scan
2. Use this tool to discover available queries
- 3. Use prowler_app_run_attack_paths_query with query_id and any required parameters
+ 3. Use prowler_run_attack_paths_query with query_id and any required parameters
"""
try:
api_response = await self.api_client.get(
@@ -158,7 +158,7 @@ class AttackPathsTools(BaseTool):
description="UUID of a COMPLETED attack paths scan. The scan must be in 'completed' state"
),
query_id: str = Field(
- description="Query ID to execute (e.g., 'aws-internet-exposed-ec2-sensitive-s3-access'). Use `prowler_app_list_attack_paths_queries` to discover available queries"
+ description="Query ID to execute (e.g., 'aws-internet-exposed-ec2-sensitive-s3-access'). Use `prowler_list_attack_paths_queries` to discover available queries"
),
parameters: dict[str, str] = Field(
default_factory=dict,
@@ -194,7 +194,7 @@ class AttackPathsTools(BaseTool):
Workflow:
1. Ensure scan is completed
- 2. List available queries (use prowler_app_list_attack_paths_queries)
+ 2. List available queries (use prowler_list_attack_paths_queries)
3. Execute this tool with appropriate parameters
4. Analyze the returned graph for security insights
"""
@@ -231,7 +231,7 @@ class AttackPathsTools(BaseTool):
async def get_attack_paths_cartography_schema(
self,
scan_id: str = Field(
- description="UUID of a COMPLETED attack paths scan. Use `prowler_app_list_attack_paths_scans` with state=['completed'] to find scan IDs"
+ description="UUID of a COMPLETED attack paths scan. Use `prowler_list_attack_paths_scans` with state=['completed'] to find scan IDs"
),
) -> dict[str, Any]:
"""Retrieve the Cartography graph schema for a completed attack paths scan.
@@ -253,10 +253,10 @@ class AttackPathsTools(BaseTool):
- schema_content: Full Cartography schema markdown with node/relationship definitions
Workflow:
- 1. Use prowler_app_list_attack_paths_scans to find a completed scan
+ 1. Use prowler_list_attack_paths_scans to find a completed scan
2. Use this tool to get the schema for the scan's provider
3. Use the schema to craft custom openCypher queries
- 4. Execute queries with prowler_app_run_attack_paths_query
+ 4. Execute queries with prowler_run_attack_paths_query
"""
try:
api_response = await self.api_client.get(
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/compliance.py b/mcp_server/prowler_mcp_server/prowler_app/tools/compliance.py
index 360dd5510d..33cdd22a69 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/compliance.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/compliance.py
@@ -1,4 +1,4 @@
-"""Compliance framework tools for Prowler App MCP Server.
+"""Compliance framework tools for Prowler MCP Server.
This module provides tools for viewing compliance status and requirement details
across all cloud providers.
@@ -50,7 +50,7 @@ class ComplianceTools(BaseTool):
if not scans_data:
raise ValueError(
f"No completed scans found for provider {provider_id}. "
- "Run a scan first using prowler_app_trigger_scan."
+ "Run a scan first using prowler_trigger_scan."
)
scan_id = scans_data[0]["id"]
@@ -60,11 +60,11 @@ class ComplianceTools(BaseTool):
self,
scan_id: str | None = Field(
default=None,
- description="UUID of a specific scan to get compliance data for. Required if provider_id is not specified. Use `prowler_app_list_scans` to find scan IDs.",
+ description="UUID of a specific scan to get compliance data for. Required if provider_id is not specified. Use `prowler_list_scans` to find scan IDs.",
),
provider_id: str | None = Field(
default=None,
- description="Prowler's internal UUID (v4) for a specific provider. If provided without scan_id, the tool will automatically find the latest completed scan for this provider. Use `prowler_app_search_providers` tool to find provider IDs.",
+ description="Prowler's internal UUID (v4) for a specific provider. If provided without scan_id, the tool will automatically find the latest completed scan for this provider. Use `prowler_search_providers` tool to find provider IDs.",
),
) -> dict[str, Any]:
"""Get high-level compliance overview across all frameworks for a specific scan.
@@ -90,11 +90,11 @@ class ComplianceTools(BaseTool):
Workflow:
1. Use this tool to get an overview of all compliance frameworks
- 2. Use prowler_app_get_compliance_framework_state_details with a specific compliance_id to see which requirements failed
+ 2. Use prowler_get_compliance_framework_state_details with a specific compliance_id to see which requirements failed
"""
if not scan_id and not provider_id:
return {
- "error": "Either scan_id or provider_id must be provided. Use prowler_app_search_providers to find provider IDs or prowler_app_list_scans to find scan IDs."
+ "error": "Either scan_id or provider_id must be provided. Use prowler_search_providers to find provider IDs or prowler_list_scans to find scan IDs."
}
elif scan_id and provider_id:
return {
@@ -254,7 +254,7 @@ class ComplianceTools(BaseTool):
async def get_compliance_framework_state_details(
self,
compliance_id: str = Field(
- description="Compliance framework ID to get details for (e.g., 'cis_1.5_aws', 'pci_dss_v4.0_aws'). You can get compliance IDs from prowler_app_get_compliance_overview or consulting Prowler Hub/Prowler Documentation that you can also find in form of tools in this MCP Server",
+ description="Compliance framework ID to get details for (e.g., 'cis_1.5_aws', 'pci_dss_v4.0_aws'). You can get compliance IDs from prowler_get_compliance_overview or consulting Prowler Hub/Prowler Documentation that you can also find in form of tools in this MCP Server",
),
scan_id: str | None = Field(
default=None,
@@ -262,14 +262,14 @@ class ComplianceTools(BaseTool):
),
provider_id: str | None = Field(
default=None,
- description="Prowler's internal UUID (v4) for a specific provider. If provided without scan_id, the tool will automatically find the latest completed scan for this provider. Use `prowler_app_search_providers` tool to find provider IDs.",
+ description="Prowler's internal UUID (v4) for a specific provider. If provided without scan_id, the tool will automatically find the latest completed scan for this provider. Use `prowler_search_providers` tool to find provider IDs.",
),
) -> dict[str, Any]:
"""Get detailed requirement-level breakdown for a specific compliance framework.
IMPORTANT: This tool returns DETAILED requirement information for a single compliance framework,
focusing on FAILED requirements and their associated FAILED finding IDs.
- Use this after prowler_app_get_compliance_overview to drill down into specific frameworks.
+ Use this after prowler_get_compliance_overview to drill down into specific frameworks.
The markdown report includes:
@@ -280,7 +280,7 @@ class ComplianceTools(BaseTool):
2. Failed Requirements Breakdown:
- Each failed requirement's ID and description
- Associated failed finding IDs for each failed requirement
- - Use prowler_app_get_finding_details with these finding IDs for more details and remediation guidance
+ - Use prowler_get_finding_details with these finding IDs for more details and remediation guidance
Default behavior:
- Requires either scan_id OR provider_id
@@ -289,14 +289,14 @@ class ComplianceTools(BaseTool):
- Only shows failed requirements with their associated failed finding IDs
Workflow:
- 1. Use prowler_app_get_compliance_overview to identify frameworks with failures
+ 1. Use prowler_get_compliance_overview to identify frameworks with failures
2. Use this tool with the compliance_id to see failed requirements and their finding IDs
- 3. Use prowler_app_get_finding_details with the finding IDs to get remediation guidance
+ 3. Use prowler_get_finding_details with the finding IDs to get remediation guidance
"""
# Validate that either scan_id or provider_id is provided
if not scan_id and not provider_id:
return {
- "error": "Either scan_id or provider_id must be provided. Use prowler_app_search_providers to find provider IDs or prowler_app_list_scans to find scan IDs."
+ "error": "Either scan_id or provider_id must be provided. Use prowler_search_providers to find provider IDs or prowler_list_scans to find scan IDs."
}
# Resolve provider_id to latest scan_id if needed
@@ -395,7 +395,7 @@ class ComplianceTools(BaseTool):
report_lines.append("**Failed Finding IDs**: None found")
report_lines.append("")
report_lines.append(
- "*Use `prowler_app_get_finding_details` with these finding IDs to get remediation guidance.*"
+ "*Use `prowler_get_finding_details` with these finding IDs to get remediation guidance.*"
)
report_lines.append("")
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/finding_groups.py b/mcp_server/prowler_mcp_server/prowler_app/tools/finding_groups.py
index 905a352740..05adf8db2b 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/finding_groups.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/finding_groups.py
@@ -1,4 +1,4 @@
-"""Finding Groups tools for Prowler App MCP Server.
+"""Finding Groups tools for Prowler MCP Server.
This module provides read-only tools for finding group triage and drill-downs.
"""
@@ -233,8 +233,8 @@ class FindingGroupsTools(BaseTool):
`date_to`, this uses `/finding-groups` with a maximum 2-day date window.
Use this tool to find noisy or high-impact checks, then call
- prowler_app_get_finding_group_details for complete counters or
- prowler_app_list_finding_group_resources to drill into affected resources.
+ prowler_get_finding_group_details for complete counters or
+ prowler_list_finding_group_resources to drill into affected resources.
"""
try:
self.api_client.validate_page_size(page_size)
@@ -423,7 +423,7 @@ class FindingGroupsTools(BaseTool):
Default behavior returns FAIL, unmuted resources so the result is
actionable. Set `include_muted=True` to include accepted/suppressed
resources too. Each row includes nested resource and provider data plus
- `finding_id`. Use `prowler_app_get_finding_details(finding_id)` to
+ `finding_id`. Use `prowler_get_finding_details(finding_id)` to
retrieve complete remediation guidance for a specific resource finding.
"""
try:
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/findings.py b/mcp_server/prowler_mcp_server/prowler_app/tools/findings.py
index ec492c6a43..b556101cab 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/findings.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/findings.py
@@ -1,4 +1,4 @@
-"""Security Findings tools for Prowler App MCP Server.
+"""Security Findings tools for Prowler MCP Server.
This module provides tools for searching, viewing, and analyzing security findings
across all cloud providers.
@@ -92,7 +92,7 @@ class FindingsTools(BaseTool):
"""Search and filter security findings across all cloud providers with rich filtering capabilities.
IMPORTANT: This tool returns LIGHTWEIGHT findings. Use this for fast searching and filtering across many findings.
- For complete details use prowler_app_get_finding_details on specific findings.
+ For complete details use prowler_get_finding_details on specific findings.
Default behavior:
- Returns latest findings from most recent scans (no date parameters needed)
@@ -111,7 +111,7 @@ class FindingsTools(BaseTool):
Workflow:
1. Use this tool to search and filter findings by severity, status, provider, service, region, etc.
- 2. Use prowler_app_get_finding_details with the finding 'id' to get complete information about the finding
+ 2. Use prowler_get_finding_details with the finding 'id' to get complete information about the finding
"""
# Validate page_size parameter
self.api_client.validate_page_size(page_size)
@@ -187,9 +187,9 @@ class FindingsTools(BaseTool):
"""Retrieve comprehensive details about a specific security finding by its ID.
IMPORTANT: This tool returns COMPLETE finding details.
- Use this after finding a specific finding via prowler_app_search_security_findings
+ Use this after finding a specific finding via prowler_search_security_findings
- This tool provides ALL information that prowler_app_search_security_findings returns PLUS:
+ This tool provides ALL information that prowler_search_security_findings returns PLUS:
1. Check Metadata (information about the check script that generated the finding):
- title: Human-readable phrase used to summarize the check
@@ -217,7 +217,7 @@ class FindingsTools(BaseTool):
- resource_ids: List of UUIDs for cloud resources associated with this finding
Workflow:
- 1. Use prowler_app_search_security_findings to browse and filter findings
+ 1. Use prowler_search_security_findings to browse and filter findings
2. Use this tool with the finding 'id' to get remediation guidance and complete context
"""
params = {
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/muting.py b/mcp_server/prowler_mcp_server/prowler_app/tools/muting.py
index 639f1ec3b7..37e1504165 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/muting.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/muting.py
@@ -1,4 +1,4 @@
-"""Muting tools for Prowler App MCP Server.
+"""Muting tools for Prowler MCP Server.
This module provides tools for managing finding muting in Prowler, including:
- Mutelist management (pattern-based bulk muting)
@@ -43,7 +43,7 @@ class MutingTools(BaseTool):
Workflow:
1. Use this tool to check if a mutelist is configured
2. Examine current muting patterns before making updates
- 3. Use prowler_app_set_mutelist to create or update the configuration
+ 3. Use prowler_set_mutelist to create or update the configuration
"""
self.logger.info("Retrieving mutelist configuration...")
@@ -61,7 +61,7 @@ class MutingTools(BaseTool):
if len(data) == 0:
return {
"error": "No mutelist found",
- "message": "No mutelist configuration exists for this tenant. Use prowler_app_set_mutelist to create one.",
+ "message": "No mutelist configuration exists for this tenant. Use prowler_set_mutelist to create one.",
}
# Return the first (and only) mutelist
@@ -116,10 +116,10 @@ Structure:
- Exceptions: Accounts, Regions, Resources to exclude from muting
Workflow:
- 1. Use prowler_app_get_mutelist to check existing configuration
+ 1. Use prowler_get_mutelist to check existing configuration
2. Build configuration object following Prowler mutelist format
3. Use this tool to create or update the mutelist
- 4. Verify with prowler_app_get_mutelist
+ 4. Verify with prowler_get_mutelist
"""
self.logger.info("Setting mutelist configuration...")
@@ -171,12 +171,12 @@ Structure:
"""Remove the mutelist configuration from the tenant.
WARNING: This is a destructive operation that cannot be undone.
- - The mutelist will need to be re-created with prowler_app_set_mutelist
+ - The mutelist will need to be re-created with prowler_set_mutelist
- New findings from future scans will NOT be muted by the deleted mutelist
- Previously muted findings remain muted (deletion doesn't un-mute them)
Workflow:
- 1. Use prowler_app_get_mutelist to confirm what will be deleted
+ 1. Use prowler_get_mutelist to confirm what will be deleted
2. Use this tool to permanently remove the mutelist
3. New scans will no longer apply mutelist-based muting
"""
@@ -229,7 +229,7 @@ Structure:
"""Search and filter mute rules with pagination support.
IMPORTANT: This tool returns LIGHTWEIGHT mute rules without the full list of finding UIDs.
- Use prowler_app_get_mute_rule to get complete details including all finding UIDs and creator information.
+ Use prowler_get_mute_rule to get complete details including all finding UIDs and creator information.
Default behavior:
- Returns all mute rules (both enabled and disabled)
@@ -237,15 +237,15 @@ Structure:
- Includes basic rule information without full finding UID lists
Each mute rule includes:
- - Core identification: id (UUID for prowler_app_get_mute_rule), name
+ - Core identification: id (UUID for prowler_get_mute_rule), name
- Contextual information: reason, enabled status
- State tracking: finding_count (number of findings currently muted)
- Temporal data: inserted_at, updated_at timestamps
Workflow:
1. Use this tool to search and filter mute rules by name, enabled status, or keywords
- 2. Use prowler_app_get_mute_rule with the mute rule 'id' to get complete details including all finding UIDs
- 3. Use prowler_app_update_mute_rule or prowler_app_delete_mute_rule to modify rules
+ 2. Use prowler_get_mute_rule with the mute rule 'id' to get complete details including all finding UIDs
+ 3. Use prowler_update_mute_rule or prowler_delete_mute_rule to modify rules
"""
self.logger.info("Listing mute rules...")
self.api_client.validate_page_size(page_size)
@@ -289,17 +289,17 @@ Structure:
"""Retrieve comprehensive details about a specific mute rule by its ID.
IMPORTANT: This tool returns COMPLETE mute rule details including the full list of finding UIDs.
- Use this after finding a rule via prowler_app_list_mute_rules.
+ Use this after finding a rule via prowler_list_mute_rules.
- This tool provides ALL information that prowler_app_list_mute_rules returns PLUS:
+ This tool provides ALL information that prowler_list_mute_rules returns PLUS:
- finding_uids: Complete list of finding UIDs that are muted by this rule
- user_creator_id: UUID of the user who created the rule (audit trail)
Workflow:
- 1. Use prowler_app_list_mute_rules to find rules by name or filter criteria
+ 1. Use prowler_list_mute_rules to find rules by name or filter criteria
2. Use this tool with the rule 'id' to get complete details
3. Examine finding_uids list to understand which findings are muted
- 4. Use prowler_app_update_mute_rule or prowler_app_delete_mute_rule to modify if needed
+ 4. Use prowler_update_mute_rule or prowler_delete_mute_rule to modify if needed
"""
self.logger.info(f"Retrieving mute rule {rule_id}...")
@@ -323,7 +323,7 @@ Structure:
description="Reason for muting these findings. Document why this security issue is acceptable or intentional (e.g., 'Development environment with controlled access', 'Legacy application requires IMDSv1')."
),
finding_ids: list[str] = Field(
- description="List of finding IDs (UUIDs) to mute. Get these from the prowler_app_search_security_findings tool. Must provide at least 1 finding ID."
+ description="List of finding IDs (UUIDs) to mute. Get these from the prowler_search_security_findings tool. Must provide at least 1 finding ID."
),
) -> dict[str, Any]:
"""Create a new mute rule to mute specific findings with documentation and audit trail.
@@ -337,15 +337,15 @@ Structure:
- Records creator for audit trail
The mute rule includes:
- - Core identification: id (UUID for prowler_app_get_mute_rule), name, reason
+ - Core identification: id (UUID for prowler_get_mute_rule), name, reason
- Configuration: enabled status, finding_uids list
- Audit trail: user_creator_id (UUID of the Prowler user from the tenant that created the rule), timestamps when the rule was created and last modified
Workflow:
- 1. Use prowler_app_search_security_findings to identify findings to mute
+ 1. Use prowler_search_security_findings to identify findings to mute
2. Use this tool with finding IDs, descriptive name, and documented reason
- 3. Verify with prowler_app_get_mute_rule to confirm rule creation
- 4. Check findings are muted with prowler_app_search_security_findings (filter by muted=true)
+ 3. Verify with prowler_get_mute_rule to confirm rule creation
+ 4. Check findings are muted with prowler_search_security_findings (filter by muted=true)
"""
self.logger.info(f"Creating mute rule '{name}'...")
@@ -399,9 +399,9 @@ Structure:
- enabled: Toggle rule active status (doesn't affect already-muted findings)
Workflow:
- 1. Use prowler_app_get_mute_rule to see current rule state
+ 1. Use prowler_get_mute_rule to see current rule state
2. Use this tool to update name, reason, or enabled status
- 3. Verify changes with prowler_app_get_mute_rule
+ 3. Verify changes with prowler_get_mute_rule
"""
self.logger.info(f"Updating mute rule {rule_id}...")
@@ -451,9 +451,9 @@ Structure:
- Cannot be undone - rule must be recreated to restore
Workflow:
- 1. Use prowler_app_get_mute_rule to review what will be deleted
+ 1. Use prowler_get_mute_rule to review what will be deleted
2. Use this tool to permanently remove the rule
- 3. Verify deletion with prowler_app_list_mute_rules (rule should no longer appear)
+ 3. Verify deletion with prowler_list_mute_rules (rule should no longer appear)
"""
self.logger.info(f"Deleting mute rule {rule_id}...")
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/providers.py b/mcp_server/prowler_mcp_server/prowler_app/tools/providers.py
index b22d57d7b9..3ba417d677 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/providers.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/providers.py
@@ -1,4 +1,4 @@
-"""Provider Management tools for Prowler App MCP Server.
+"""Provider Management tools for Prowler MCP Server.
This module provides tools for managing provider connections,
including searching, connecting, and deleting providers.
@@ -19,9 +19,9 @@ class ProvidersTools(BaseTool):
"""Tools for provider management operations
Provides tools for:
- - prowler_app_search_providers: Search and view configured providers with their connection status
- - prowler_app_connect_provider: Connect or register a provider for security scanning in Prowler
- - prowler_app_delete_provider: Permanently remove a provider from Prowler
+ - prowler_search_providers: Search and view configured providers with their connection status
+ - prowler_connect_provider: Connect or register a provider for security scanning in Prowler
+ - prowler_delete_provider: Permanently remove a provider from Prowler
"""
async def search_providers(
@@ -145,7 +145,7 @@ class ProvidersTools(BaseTool):
) -> dict[str, Any]:
"""Register a provider to be scanned with Prowler.
- This tool will register a provider in Prowler App, even if the UID is wrong.
+ This tool will register a provider in Prowler, even if the UID is wrong.
If the provider is already registered, it will be updated with the new provided alias or credentials if provided.
If credentials are provided, they will be added to the indicated provider, if the provider does not exist, it will be created and the credentials will be added to it.
If the connection test is successful, the provider will be connected.
@@ -292,13 +292,13 @@ class ProvidersTools(BaseTool):
async def delete_provider(
self,
provider_id: str = Field(
- description="Prowler's internal UUID (v4) for the provider to permanently remove, generated when the provider was registered in the system. Use `prowler_app_search_providers` tool to find the provider_id if you only know the alias or the provider's own identifier (provider_uid)"
+ description="Prowler's internal UUID (v4) for the provider to permanently remove, generated when the provider was registered in the system. Use `prowler_search_providers` tool to find the provider_id if you only know the alias or the provider's own identifier (provider_uid)"
),
) -> dict[str, Any]:
"""Permanently remove a registered provider from Prowler.
WARNING: This is a destructive operation that cannot be undone. The provider will need to be
- re-added with prowler_app_connect_provider if you want to scan it again.
+ re-added with prowler_connect_provider if you want to scan it again.
The tool always returns the deletion status and message.
"""
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/resources.py b/mcp_server/prowler_mcp_server/prowler_app/tools/resources.py
index 011e013b91..88fcca25ae 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/resources.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/resources.py
@@ -1,4 +1,4 @@
-"""Cloud Resources tools for Prowler App MCP Server.
+"""Cloud Resources tools for Prowler MCP Server.
This module provides tools for searching, viewing, and analyzing cloud resources
across all providers.
@@ -86,7 +86,7 @@ class ResourcesTools(BaseTool):
IMPORTANT: This tool returns LIGHTWEIGHT resource information. Use this for fast searching
and filtering across many resources. For complete configuration details, metadata, and finding
- relationships, use prowler_app_get_resource on specific resources of interest.
+ relationships, use prowler_get_resource on specific resources of interest.
This is the primary tool for browsing resources with rich filtering capabilities.
Returns current state by default (latest scan per provider). Specify dates to query
@@ -102,16 +102,16 @@ class ResourcesTools(BaseTool):
- With dates: queries historical resource state (2-day maximum range between date_from and date_to)
Each resource includes:
- - Core identification: id (UUID for prowler_app_get_resource), uid, name
+ - Core identification: id (UUID for prowler_get_resource), uid, name
- Location context: region, service, type
- Security context: failed_findings_count (number of active security issues)
- Tags: tags associated with the resource
Useful Workflow:
1. Use this tool to search and filter resources by provider, region, service, tags, etc.
- 2. Use prowler_app_get_resource with the resource 'id' to get complete configuration and metadata
- 3. Use prowler_app_search_security_findings to find security issues for specific resources
- 4. Use prowler_app_get_finding_details to get details about the security issues for specific resources
+ 2. Use prowler_get_resource with the resource 'id' to get complete configuration and metadata
+ 3. Use prowler_search_security_findings to find security issues for specific resources
+ 4. Use prowler_get_finding_details to get details about the security issues for specific resources
"""
# Validate page_size parameter
self.api_client.validate_page_size(page_size)
@@ -177,15 +177,15 @@ class ResourcesTools(BaseTool):
async def get_resource(
self,
resource_id: str = Field(
- description="Prowler's internal UUID (v4) for the resource to retrieve, generated when the resource was discovered in the system. Use `prowler_app_list_resources` tool to find the right ID"
+ description="Prowler's internal UUID (v4) for the resource to retrieve, generated when the resource was discovered in the system. Use `prowler_list_resources` tool to find the right ID"
),
) -> dict[str, Any]:
"""Retrieve comprehensive details about a specific resource by its ID.
IMPORTANT: This tool provides COMPLETE resource details with all available information.
- Use this after finding a specific resource via prowler_app_list_resources.
+ Use this after finding a specific resource via prowler_list_resources.
- This tool provides ALL information that prowler_app_list_resources returns PLUS:
+ This tool provides ALL information that prowler_list_resources returns PLUS:
1. Configuration Details:
- metadata: Provider-specific configuration (tags, policies, encryption settings, network rules)
@@ -197,12 +197,12 @@ class ResourcesTools(BaseTool):
3. Security Relationships:
- finding_ids: Prowler's internal UUIDs (v4) of all security findings associated with this resource
- - Use prowler_app_get_finding_details on these IDs to get remediation guidance
+ - Use prowler_get_finding_details on these IDs to get remediation guidance
Useful Workflow:
- 1. Use prowler_app_list_resources to browse and filter across many resources
+ 1. Use prowler_list_resources to browse and filter across many resources
2. Use this tool to drill down into specific resources of interest
- 3. Use prowler_app_get_finding_details to get details about the security issues for specific resources
+ 3. Use prowler_get_finding_details to get details about the security issues for specific resources
"""
params = {}
@@ -348,7 +348,7 @@ class ResourcesTools(BaseTool):
async def get_resource_events(
self,
resource_id: str = Field(
- description="Prowler's internal UUID (v4) for the resource. Use `prowler_app_list_resources` to find the right ID, or get it from a finding's resource relationship via `prowler_app_get_finding_details`."
+ description="Prowler's internal UUID (v4) for the resource. Use `prowler_list_resources` to find the right ID, or get it from a finding's resource relationship via `prowler_get_finding_details`."
),
lookback_days: int = Field(
default=90,
@@ -386,8 +386,8 @@ class ResourcesTools(BaseTool):
- Identifying unauthorized or unexpected modifications
Workflows:
- 1. Resource browsing: prowler_app_list_resources → find resource → this tool for event history
- 2. Incident investigation: prowler_app_get_finding_details → get resource ID from finding → this tool to identify who caused the issue, what they changed, and when
+ 1. Resource browsing: prowler_list_resources → find resource → this tool for event history
+ 2. Incident investigation: prowler_get_finding_details → get resource ID from finding → this tool to identify who caused the issue, what they changed, and when
"""
params = {
"lookback_days": lookback_days,
diff --git a/mcp_server/prowler_mcp_server/prowler_app/tools/scans.py b/mcp_server/prowler_mcp_server/prowler_app/tools/scans.py
index 1df636ffc0..21d1431b71 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/tools/scans.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/tools/scans.py
@@ -1,4 +1,4 @@
-"""Security Scans tools for Prowler App MCP Server.
+"""Security Scans tools for Prowler MCP Server.
This module provides tools for managing and monitoring Prowler security scans.
"""
@@ -20,18 +20,18 @@ class ScansTools(BaseTool):
"""Tools for security scan operations.
Provides tools for:
- - prowler_app_list_scans: Search and filter scans with rich filtering capabilities
- - prowler_app_get_scan: Get comprehensive details about a specific scan
- - prowler_app_trigger_scan: Trigger manual security scans for providers
- - prowler_app_schedule_daily_scan: Schedule automated daily scans for continuous monitoring
- - prowler_app_update_scan: Update scan names for better organization
+ - prowler_list_scans: Search and filter scans with rich filtering capabilities
+ - prowler_get_scan: Get comprehensive details about a specific scan
+ - prowler_trigger_scan: Trigger manual security scans for providers
+ - prowler_schedule_daily_scan: Schedule automated daily scans for continuous monitoring
+ - prowler_update_scan: Update scan names for better organization
"""
async def list_scans(
self,
provider_id: list[str] = Field(
default=[],
- description="Filter by Prowler's internal UUID(s) (v4) for specific provider(s), generated when the provider was registered. Use `prowler_app_search_providers` tool to find provider IDs",
+ description="Filter by Prowler's internal UUID(s) (v4) for specific provider(s), generated when the provider was registered. Use `prowler_search_providers` tool to find provider IDs",
),
provider_type: list[str] = Field(
default=[],
@@ -56,7 +56,7 @@ class ScansTools(BaseTool):
),
trigger: Literal["manual", "scheduled"] | None = Field(
default=None,
- description="Filter by how the scan was initiated. Options: 'manual' (user-initiated via prowler_app_trigger_scan), 'scheduled' (automated via prowler_app_schedule_daily_scan)",
+ description="Filter by how the scan was initiated. Options: 'manual' (user-initiated via prowler_trigger_scan), 'scheduled' (automated via prowler_schedule_daily_scan)",
),
name: str | None = Field(
default=None,
@@ -75,7 +75,7 @@ class ScansTools(BaseTool):
IMPORTANT: This tool returns LIGHTWEIGHT scan information. Use this for fast searching and filtering
across many scans. For complete scan details including progress, duration, and resource counts,
- use prowler_app_get_scan on specific scans of interest.
+ use prowler_get_scan on specific scans of interest.
Default behavior:
- Returns all scans
@@ -83,15 +83,15 @@ class ScansTools(BaseTool):
- Includes all scan states (available, scheduled, executing, completed, failed, cancelled)
Each scan includes:
- - Core identification: id (UUID for prowler_app_get_scan), name
+ - Core identification: id (UUID for prowler_get_scan), name
- Execution context: state, trigger (manual/scheduled)
- Temporal data: started_at, completed_at
- Provider relationship: provider_id
Workflow:
1. Use this tool to search and filter scans by provider, state, or date range
- 2. Use prowler_app_get_scan with the scan 'id' to get progress, duration, and resource counts
- 3. Use prowler_app_search_security_findings filtered by scan dates to analyze scan results
+ 2. Use prowler_get_scan with the scan 'id' to get progress, duration, and resource counts
+ 3. Use prowler_search_security_findings filtered by scan dates to analyze scan results
"""
# Validate pagination
self.api_client.validate_page_size(page_size)
@@ -128,15 +128,15 @@ class ScansTools(BaseTool):
async def get_scan(
self,
scan_id: str = Field(
- description="Prowler's internal UUID (v4) for the scan to retrieve, generated when the scan was created (e.g., '123e4567-e89b-12d3-a456-426614174000'). Use `prowler_app_list_scans` tool to find scan IDs"
+ description="Prowler's internal UUID (v4) for the scan to retrieve, generated when the scan was created (e.g., '123e4567-e89b-12d3-a456-426614174000'). Use `prowler_list_scans` tool to find scan IDs"
),
) -> dict[str, Any]:
"""Retrieve comprehensive details about a specific scan by its ID.
IMPORTANT: This tool returns COMPLETE scan details.
- Use this after finding a specific scan via prowler_app_list_scans.
+ Use this after finding a specific scan via prowler_list_scans.
- This tool provides ALL information that prowler_app_list_scans returns PLUS:
+ This tool provides ALL information that prowler_list_scans returns PLUS:
1. Execution Details:
- progress: Scan completion progress as percentage (0-100%)
@@ -155,9 +155,9 @@ class ScansTools(BaseTool):
- Understanding scan scheduling patterns
Workflow:
- 1. Use prowler_app_list_scans to browse and filter scans
+ 1. Use prowler_list_scans to browse and filter scans
2. Use this tool with the scan 'id' to monitor progress or view detailed results
- 3. For completed scans, use prowler_app_search_security_findings filtered by date to analyze findings
+ 3. For completed scans, use prowler_search_security_findings filtered by date to analyze findings
"""
# Fetch scan with all fields
params = {
@@ -172,7 +172,7 @@ class ScansTools(BaseTool):
async def trigger_scan(
self,
provider_id: str = Field(
- description="Prowler's internal UUID (v4) for the provider to scan, generated when the provider was registered in the system (e.g., '4d0e2614-6385-4fa7-bf0b-c2e2f75c6877'). Use `prowler_app_search_providers` tool to find the provider ID"
+ description="Prowler's internal UUID (v4) for the provider to scan, generated when the provider was registered in the system (e.g., '4d0e2614-6385-4fa7-bf0b-c2e2f75c6877'). Use `prowler_search_providers` tool to find the provider ID"
),
name: str | None = Field(
default=None,
@@ -182,14 +182,14 @@ class ScansTools(BaseTool):
"""Trigger a manual security scan for a provider.
IMPORTANT: This tool returns immediately once the scan is created.
- The scan will continue running in the background. Use `prowler_app_get_scan`
+ The scan will continue running in the background. Use `prowler_get_scan`
with the returned scan ID to monitor progress and check when it completes.
Example Useful Workflow:
- 1. Use `prowler_app_search_providers` to find the provider_id you want to scan
+ 1. Use `prowler_search_providers` to find the provider_id you want to scan
2. Use this tool to trigger the scan
- 3. Use `prowler_app_get_scan` with the returned scan 'id' to monitor progress
- 4. Once completed, use `prowler_app_search_security_findings` to analyze results
+ 3. Use `prowler_get_scan` with the returned scan 'id' to monitor progress
+ 4. Once completed, use `prowler_search_security_findings` to analyze results
"""
try:
# Build request data
@@ -231,7 +231,7 @@ class ScansTools(BaseTool):
return ScanCreationResult(
scan=scan_info,
status="success",
- message=f"Scan {scan_id} created successfully. The scan may take some time to complete. Use prowler_app_get_scan tool with this ID to monitor progress.",
+ message=f"Scan {scan_id} created successfully. The scan may take some time to complete. Use prowler_get_scan tool with this ID to monitor progress.",
).model_dump()
except Exception as e:
@@ -245,7 +245,7 @@ class ScansTools(BaseTool):
async def schedule_daily_scan(
self,
provider_id: str = Field(
- description="Prowler's internal UUID (v4) for the provider to scan, generated when the provider was registered in the system (e.g., '4d0e2614-6385-4fa7-bf0b-c2e2f75c6877'). Use `prowler_app_search_providers` tool to find the provider ID"
+ description="Prowler's internal UUID (v4) for the provider to scan, generated when the provider was registered in the system (e.g., '4d0e2614-6385-4fa7-bf0b-c2e2f75c6877'). Use `prowler_search_providers` tool to find the provider ID"
),
) -> dict[str, Any]:
"""Schedule automated daily scans for a provider for continuous security monitoring.
@@ -256,17 +256,17 @@ class ScansTools(BaseTool):
you're not actively using the system.
IMPORTANT: This tool returns immediately once the daily schedule is created.
- The schedule will be set up in the background. Use `prowler_app_list_scans`
+ The schedule will be set up in the background. Use `prowler_list_scans`
filtered by provider_id and trigger='scheduled' to view scheduled scans.
IMPORTANT: This creates a PERSISTENT schedule. The provider will be scanned
automatically every 24 hours until the provider is deleted.
Example Useful Workflow:
- 1. Use `prowler_app_search_providers` to find the provider_id you want to monitor
+ 1. Use `prowler_search_providers` to find the provider_id you want to monitor
2. Use this tool to create the daily schedule
- 3. Use `prowler_app_list_scans` filtered by provider_id to view scheduled and completed scans
- 4. Monitor findings over time with `prowler_app_search_security_findings`
+ 3. Use `prowler_list_scans` filtered by provider_id to view scheduled and completed scans
+ 4. Monitor findings over time with `prowler_search_security_findings`
"""
self.logger.info(f"Creating daily schedule for provider {provider_id}")
task_response = await self.api_client.post(
@@ -285,7 +285,7 @@ class ScansTools(BaseTool):
)
if task_state == "available":
- return_message = "Daily schedule created successfully. The schedule is being set up in the background. Use prowler_app_list_scans with provider_id filter to view scheduled scans."
+ return_message = "Daily schedule created successfully. The schedule is being set up in the background. Use prowler_list_scans with provider_id filter to view scheduled scans."
else:
return_message = "Daily schedule creation failed. Please try again later."
@@ -297,7 +297,7 @@ class ScansTools(BaseTool):
async def update_scan(
self,
scan_id: str = Field(
- description="Prowler's internal UUID (v4) for the scan to update, generated when the scan was created (e.g., '123e4567-e89b-12d3-a456-426614174000'). Use `prowler_app_list_scans` tool to find the scan ID if you only know the provider or scan name. Returns an error if the scan ID is invalid or not found."
+ description="Prowler's internal UUID (v4) for the scan to update, generated when the scan was created (e.g., '123e4567-e89b-12d3-a456-426614174000'). Use `prowler_list_scans` tool to find the scan ID if you only know the provider or scan name. Returns an error if the scan ID is invalid or not found."
),
name: str = Field(
description="New human-friendly name for the scan (3-100 characters). Use descriptive names to improve organization and tracking, e.g., 'Production Security Audit - Q4 2025', 'Post-Deployment Compliance Check'. IMPORTANT: Only the scan name can be updated - other attributes (state, progress, duration) are read-only and managed by the system."
@@ -309,7 +309,7 @@ class ScansTools(BaseTool):
(state, progress, duration, etc.) are read-only and managed by the system.
Example Useful Workflow:
- 1. Use `prowler_app_list_scans` to find the scan you want to rename
+ 1. Use `prowler_list_scans` to find the scan you want to rename
2. Use this tool with the scan 'id' and new name
"""
api_response = await self.api_client.patch(
diff --git a/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py b/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
index a6aacc3ce1..187364bee1 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/utils/api_client.py
@@ -1,4 +1,4 @@
-"""Shared API client utilities for Prowler App tools."""
+"""Shared API client utilities for Prowler tools."""
import asyncio
from datetime import datetime, timedelta
diff --git a/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py b/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py
index 72c06000df..eff5d3a117 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py
@@ -10,7 +10,7 @@ from prowler_mcp_server.lib.logger import logger
class ProwlerAppAuth:
- """Handles authentication for Prowler App API using API keys or JWT tokens."""
+ """Handles authentication for Prowler API using API keys or JWT tokens."""
def __init__(
self,
@@ -18,19 +18,23 @@ class ProwlerAppAuth:
base_url: str = os.getenv("API_BASE_URL", "https://api.prowler.com/api/v1"),
):
self.base_url = base_url.rstrip("/")
- logger.info(f"Using Prowler App API base URL: {self.base_url}")
+ logger.info(f"Using Prowler API base URL: {self.base_url}")
self.mode = mode
self.access_token: str | None = None
self.api_key: str | None = None
if mode == "stdio": # STDIO mode
- self.api_key = os.getenv("PROWLER_APP_API_KEY")
+ # PROWLER_API_KEY is the current variable; PROWLER_APP_API_KEY is kept
+ # as a backward-compatible fallback so existing setups keep working.
+ self.api_key = os.getenv("PROWLER_API_KEY") or os.getenv(
+ "PROWLER_APP_API_KEY"
+ )
if not self.api_key:
- raise ValueError("PROWLER_APP_API_KEY environment variable is required")
+ raise ValueError("PROWLER_API_KEY environment variable is required")
if not self.api_key.startswith("pk_"):
- raise ValueError("Prowler App API key format is incorrect")
+ raise ValueError("Prowler API key format is incorrect")
def _parse_jwt(self, token: str) -> dict | None:
"""Parse JWT token and return payload
diff --git a/mcp_server/prowler_mcp_server/prowler_app/utils/tool_loader.py b/mcp_server/prowler_mcp_server/prowler_app/utils/tool_loader.py
index b85c13af35..3a00474b5f 100644
--- a/mcp_server/prowler_mcp_server/prowler_app/utils/tool_loader.py
+++ b/mcp_server/prowler_mcp_server/prowler_app/utils/tool_loader.py
@@ -13,18 +13,27 @@ from prowler_mcp_server.lib.logger import logger
from prowler_mcp_server.prowler_app.tools.base import BaseTool
-def load_all_tools(mcp: FastMCP) -> None:
- """Auto-discover and load all BaseTool subclasses from the tools package.
+def load_all_tools(
+ mcp: FastMCP,
+ tools_package: str = "prowler_mcp_server.prowler_app.tools",
+) -> None:
+ """Auto-discover and load all BaseTool subclasses from a tools package.
This function:
- 1. Dynamically imports all Python modules in the tools package
- 2. Discovers all concrete BaseTool subclasses
+ 1. Dynamically imports all Python modules in the given tools package
+ 2. Discovers all concrete BaseTool subclasses defined in that package
3. Instantiates each tool class
4. Registers all tools with the provided FastMCP instance
+ ``BaseTool.__subclasses__()`` returns every subclass in the process, so the
+ discovered classes are filtered by ``__module__`` prefix. This keeps sibling
+ sub-servers (e.g. ``prowler_app`` and ``prowler_cloud``) from cross-registering
+ each other's tools, regardless of import order.
+
Args:
mcp: The FastMCP instance to register tools with
- TOOLS_PACKAGE: The package path containing tool modules (default: prowler_mcp_server.prowler_app.tools)
+ tools_package: The package path containing tool modules
+ (default: prowler_mcp_server.prowler_app.tools)
Example:
from fastmcp import FastMCP
@@ -33,7 +42,7 @@ def load_all_tools(mcp: FastMCP) -> None:
app = FastMCP("prowler-app")
load_all_tools(app)
"""
- TOOLS_PACKAGE = "prowler_mcp_server.prowler_app.tools"
+ TOOLS_PACKAGE = tools_package
logger.info(f"Auto-discovering tools from package: {TOOLS_PACKAGE}")
# Import the tools package
@@ -59,11 +68,14 @@ def load_all_tools(mcp: FastMCP) -> None:
except Exception as e:
logger.error(f"Failed to import module {module_name}: {e}")
- # Discover all concrete BaseTool subclasses
+ # Discover all concrete BaseTool subclasses defined in this package only.
+ # __subclasses__() is process-wide, so filter by module to avoid sibling
+ # sub-servers cross-registering each other's tools.
concrete_tools = [
tool_class
for tool_class in BaseTool.__subclasses__()
if not getattr(tool_class, "__abstractmethods__", None)
+ and tool_class.__module__.startswith(TOOLS_PACKAGE)
]
logger.info(f"Discovered {len(concrete_tools)} tool classes")
diff --git a/mcp_server/prowler_mcp_server/server.py b/mcp_server/prowler_mcp_server/server.py
index 7c85641dee..a46ca12672 100644
--- a/mcp_server/prowler_mcp_server/server.py
+++ b/mcp_server/prowler_mcp_server/server.py
@@ -19,15 +19,15 @@ def setup_main_server():
except Exception as e:
logger.error(f"Failed to mount Prowler Hub server: {e}")
- # Mount Prowler App tools with prowler_app_ namespace
+ # Mount core Prowler tools with prowler_ namespace
try:
- logger.info("Mounting Prowler App server...")
+ logger.info("Mounting Prowler tools server...")
from prowler_mcp_server.prowler_app.server import app_mcp_server
- prowler_mcp_server.mount(app_mcp_server, namespace="prowler_app")
- logger.info("Successfully mounted Prowler App server")
+ prowler_mcp_server.mount(app_mcp_server, namespace="prowler")
+ logger.info("Successfully mounted Prowler tools server")
except Exception as e:
- logger.error(f"Failed to mount Prowler App server: {e}")
+ logger.error(f"Failed to mount Prowler tools server: {e}")
# Mount Prowler Documentation tools with prowler_docs_ namespace
try:
diff --git a/mcp_server/pyproject.toml b/mcp_server/pyproject.toml
index 63aefdf931..f27e08b743 100644
--- a/mcp_server/pyproject.toml
+++ b/mcp_server/pyproject.toml
@@ -19,11 +19,13 @@ description = "MCP server for Prowler ecosystem"
name = "prowler-mcp"
readme = "README.md"
requires-python = ">=3.12"
-version = "0.5.0"
+version = "0.8.0"
[project.scripts]
prowler-mcp = "prowler_mcp_server.main:main"
+[tool.pytest]
+
[tool.pytest.ini_options]
testpaths = ["tests"]
diff --git a/mcp_server/towncrier.toml b/mcp_server/towncrier.toml
new file mode 100644
index 0000000000..528e6129ec
--- /dev/null
+++ b/mcp_server/towncrier.toml
@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true
diff --git a/mcp_server/uv.lock b/mcp_server/uv.lock
index 3258767442..a9afbeafd7 100644
--- a/mcp_server/uv.lock
+++ b/mcp_server/uv.lock
@@ -676,7 +676,7 @@ wheels = [
[[package]]
name = "prowler-mcp"
-version = "0.5.0"
+version = "0.8.0"
source = { editable = "." }
dependencies = [
{ name = "fastmcp" },
diff --git a/permissions/prowler-additions-policy.json b/permissions/prowler-additions-policy.json
index c0da045603..6c58f6e184 100644
--- a/permissions/prowler-additions-policy.json
+++ b/permissions/prowler-additions-policy.json
@@ -4,6 +4,8 @@
{
"Action": [
"account:Get*",
+ "amplify:ListApps",
+ "amplify:ListBranches",
"appstream:Describe*",
"appstream:List*",
"backup:List*",
@@ -15,6 +17,9 @@
"codebuild:BatchGet*",
"codebuild:ListReportGroups",
"cognito-idp:GetUserPoolMfaConfig",
+ "datapipeline:DescribePipelines",
+ "datapipeline:GetPipelineDefinition",
+ "datapipeline:ListPipelines",
"dlm:Get*",
"drs:Describe*",
"ds:Get*",
@@ -39,6 +44,8 @@
"rolesanywhere:ListTagsForResource",
"rolesanywhere:ListTrustAnchors",
"s3:GetAccountPublicAccessBlock",
+ "s3:GetObjectAcl",
+ "s3:ListBucket",
"shield:DescribeProtection",
"shield:GetSubscriptionState",
"securityhub:BatchImportFindings",
diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml
index a7d91b0071..c9eee71950 100644
--- a/permissions/templates/cloudformation/prowler-scan-role.yml
+++ b/permissions/templates/cloudformation/prowler-scan-role.yml
@@ -1,27 +1,24 @@
AWSTemplateFormatVersion: "2010-09-09"
-# You can invoke CloudFormation and pass the principal ARN from a command line like this:
-# aws cloudformation create-stack \
-# --capabilities CAPABILITY_IAM --capabilities CAPABILITY_NAMED_IAM \
-# --template-body "file://prowler-scan-role.yaml" \
-# --stack-name "ProwlerScanRole" \
-# --parameters "ParameterKey=ExternalId,ParameterValue=ProvidedExternalID"
-
Description: |
- This template creates the ProwlerScan IAM Role in this account with
- all read-only permissions to scan your account for security issues.
+ This template creates the ProwlerScan IAM Role either locally in this account or across
+ multiple accounts via StackSets. It can deploy both simultaneously or just one option.
+ The role includes all read-only permissions to scan your accounts for security issues.
Contains two AWS managed policies (SecurityAudit and ViewOnlyAccess) and an inline policy.
- It sets the trust policy on that IAM Role to permit Prowler to assume that role.
This template is designed to be used in Prowler Cloud, but can also be used in other Prowler deployments.
+
If you are deploying this template to be used in Prowler Cloud please do not edit the AccountId, IAMPrincipal and ExternalId parameters.
+
Parameters:
+ # Core Prowler IAM Role Parameters
ExternalId:
Description: |
- This is the External ID that Prowler will use to assume the role ProwlerScan IAM Role.
+ This is the External ID that Prowler will use to assume the ProwlerScan IAM Role.
Type: String
MinLength: 1
AllowedPattern: ".+"
ConstraintDescription: "ExternalId must not be empty."
+
AccountId:
Description: |
AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this.
@@ -31,11 +28,13 @@ Parameters:
MaxLength: 12
AllowedPattern: "[0-9]{12}"
ConstraintDescription: "AccountId must be a valid AWS Account ID."
+
IAMPrincipal:
Description: |
The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this.
Type: String
Default: role/prowler*
+
EnableOrganizations:
Description: |
Enable AWS Organizations discovery permissions. Set to true only when deploying this role in the management account.
@@ -45,6 +44,7 @@ Parameters:
AllowedValues:
- true
- false
+
EnableS3Integration:
Description: |
Enable S3 integration for storing Prowler scan reports.
@@ -53,25 +53,102 @@ Parameters:
AllowedValues:
- true
- false
+
S3IntegrationBucketName:
Description: |
The S3 bucket name where Prowler will store scan reports for your cloud providers.
Type: String
Default: ""
+
S3IntegrationBucketAccountId:
Description: |
The AWS Account ID owner of the S3 Bucket.
Type: String
Default: ""
+ # Deployment Control Parameters
+ DeployStackSet:
+ Description: |
+ Set to true to deploy the ProwlerScan role across multiple accounts using StackSets.
+ Requires delegated administrator permissions for CloudFormation StackSets.
+ Type: String
+ Default: false
+ AllowedValues:
+ - true
+ - false
+
+ DeployLocalRole:
+ Description: |
+ Set to true to deploy the ProwlerScan role in this account (the account where this template is deployed).
+ Can be used independently or in conjunction with StackSet deployment.
+ Type: String
+ Default: true
+ AllowedValues:
+ - true
+ - false
+
+ # StackSet Configuration Parameters
+ AWSOrganizationalUnitId:
+ Description: |
+ AWS Organizations OU to deploy this stackset to (e.g., ou-xxxx-yyyyyyyy or r-xxxx for root).
+ Only required if DeployStackSet is true.
+ Type: String
+ Default: ""
+ AllowedPattern: '^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})?$'
+
+ RetainStacksOnAccountRemoval:
+ Description: |
+ When an account is removed from the Organization or OU, should the ProwlerScan role remain in that account?
+ False (Recommended for security): Automatically deletes the role when accounts leave, following principle of least privilege.
+ True: Retains the role even after account removal, useful if accounts may temporarily leave and rejoin.
+ Type: String
+ Default: false
+ AllowedValues:
+ - true
+ - false
+
+ DeployFromDelegatedAdmin:
+ Description: |
+ Is this StackSet being deployed from a Delegated Administrator account (not the Organization Management Account)?
+ True: Deploying from a delegated admin account - uses CallAs: DELEGATED_ADMIN.
+ False: Deploying from the Organization Management Account - omits CallAs property.
+ Only required if DeployStackSet is true.
+ Type: String
+ Default: false
+ AllowedValues:
+ - true
+ - false
+
+ FailureTolerancePercentage:
+ Description: |
+ The percentage of accounts in which stack operations can fail before CloudFormation stops the operation.
+ Only applies when DeployStackSet is true.
+ Type: Number
+ Default: 10
+ MinValue: 0
+ MaxValue: 100
+
Conditions:
OrganizationsEnabled: !Equals [!Ref EnableOrganizations, true]
S3IntegrationEnabled: !Equals [!Ref EnableS3Integration, true]
+ DeployStackSetEnabled: !Equals [!Ref DeployStackSet, true]
+ DeployLocalRoleEnabled: !Equals [!Ref DeployLocalRole, true]
+ UseDelegatedAdmin: !Equals [!Ref DeployFromDelegatedAdmin, true]
+Rules:
+ S3IntegrationRequiresParams:
+ RuleCondition: !Equals [!Ref EnableS3Integration, "true"]
+ Assertions:
+ - Assert: !Not [!Equals [!Ref S3IntegrationBucketName, ""]]
+ AssertDescription: "S3IntegrationBucketName is required when EnableS3Integration is true."
+ - Assert: !Not [!Equals [!Ref S3IntegrationBucketAccountId, ""]]
+ AssertDescription: "S3IntegrationBucketAccountId is required when EnableS3Integration is true."
Resources:
+ # Local ProwlerScan Role (deployed in this account)
ProwlerScan:
Type: AWS::IAM::Role
+ Condition: DeployLocalRoleEnabled
Properties:
RoleName: ProwlerScan
AssumeRolePolicyDocument:
@@ -88,8 +165,8 @@ Resources:
"aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:${IAMPrincipal}"
MaxSessionDuration: 3600
ManagedPolicyArns:
- - "arn:aws:iam::aws:policy/SecurityAudit"
- - "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
+ - !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
+ - !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
Policies:
- PolicyName: ProwlerScan
PolicyDocument:
@@ -99,9 +176,12 @@ Resources:
Effect: Allow
Action:
- "account:Get*"
+ - "amplify:ListApps"
+ - "amplify:ListBranches"
- "appstream:Describe*"
- "appstream:List*"
- "backup:List*"
+ - "backup:Get*"
- "bedrock:List*"
- "bedrock:Get*"
- "cloudtrail:GetInsightSelectors"
@@ -109,6 +189,9 @@ Resources:
- "codebuild:BatchGet*"
- "codebuild:ListReportGroups"
- "cognito-idp:GetUserPoolMfaConfig"
+ - "datapipeline:DescribePipelines"
+ - "datapipeline:GetPipelineDefinition"
+ - "datapipeline:ListPipelines"
- "dlm:Get*"
- "drs:Describe*"
- "ds:Get*"
@@ -124,6 +207,7 @@ Resources:
- "glue:GetConnections"
- "glue:GetSecurityConfiguration*"
- "glue:SearchTables"
+ - "glue:GetMLTransforms"
- "lambda:GetFunction*"
- "logs:FilterLogEvents"
- "lightsail:GetRelationalDatabases"
@@ -134,7 +218,6 @@ Resources:
- "s3:GetAccountPublicAccessBlock"
- "shield:DescribeProtection"
- "shield:GetSubscriptionState"
- - "securityhub:BatchImportFindings"
- "securityhub:GetFindings"
- "servicecatalog:Describe*"
- "servicecatalog:List*"
@@ -145,15 +228,20 @@ Resources:
- "tag:GetTagKeys"
- "wellarchitected:List*"
Resource: "*"
+ - Sid: AllowSecurityHubImportFindings
+ Effect: Allow
+ Action:
+ - "securityhub:BatchImportFindings"
+ Resource: "*"
- Sid: AllowAPIGatewayReadOnly
Effect: Allow
Action:
- "apigateway:GET"
Resource:
- - "arn:*:apigateway:*::/restapis/*"
- - "arn:*:apigateway:*::/apis/*"
- - "arn:*:apigateway:*::/domainnames"
- - "arn:*:apigateway:*::/domainnames/*"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/restapis/*"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/apis/*"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames/*"
- !If
- OrganizationsEnabled
- PolicyName: ProwlerOrganizations
@@ -175,8 +263,12 @@ Resources:
Effect: Allow
Action:
- "organizations:RegisterDelegatedAdministrator"
- - "iam:CreateServiceLinkedRole"
Resource: "*"
+ - Sid: AllowCreateStackSetSLR
+ Effect: Allow
+ Action:
+ - "iam:CreateServiceLinkedRole"
+ Resource: !Sub "arn:${AWS::Partition}:iam::*:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/*"
- !Ref AWS::NoValue
- !If
- S3IntegrationEnabled
@@ -219,12 +311,287 @@ Resources:
- Key: "Name"
Value: "ProwlerScan"
+ # StackSet for deploying ProwlerScan role across multiple accounts
+ ProwlerScanStackSet:
+ Type: AWS::CloudFormation::StackSet
+ Condition: DeployStackSetEnabled
+ Properties:
+ StackSetName: !Sub "${AWS::StackName}-ProwlerScan-StackSet"
+ Description: Organizational StackSet to Deploy ProwlerScan IAM Role across accounts
+ PermissionModel: SERVICE_MANAGED
+ CallAs: !If [UseDelegatedAdmin, DELEGATED_ADMIN, !Ref "AWS::NoValue"]
+ Capabilities:
+ - CAPABILITY_NAMED_IAM
+ AutoDeployment:
+ Enabled: True
+ RetainStacksOnAccountRemoval: !Ref RetainStacksOnAccountRemoval
+ OperationPreferences:
+ FailureTolerancePercentage: !Ref FailureTolerancePercentage
+ MaxConcurrentPercentage: 100
+ Parameters:
+ - ParameterKey: ExternalId
+ ParameterValue: !Ref ExternalId
+ - ParameterKey: AccountId
+ ParameterValue: !Ref AccountId
+ - ParameterKey: IAMPrincipal
+ ParameterValue: !Ref IAMPrincipal
+ - ParameterKey: EnableOrganizations
+ ParameterValue: !Ref EnableOrganizations
+ - ParameterKey: EnableS3Integration
+ ParameterValue: !Ref EnableS3Integration
+ - ParameterKey: S3IntegrationBucketName
+ ParameterValue: !Ref S3IntegrationBucketName
+ - ParameterKey: S3IntegrationBucketAccountId
+ ParameterValue: !Ref S3IntegrationBucketAccountId
+ StackInstancesGroup:
+ - DeploymentTargets:
+ OrganizationalUnitIds:
+ - !Ref AWSOrganizationalUnitId
+ Regions:
+ - us-east-1
+ TemplateBody: |
+ AWSTemplateFormatVersion: "2010-09-09"
+
+ Description: |
+ This template creates the ProwlerScan IAM Role in this account with
+ all read-only permissions to scan your account for security issues.
+ Contains two AWS managed policies (SecurityAudit and ViewOnlyAccess) and an inline policy.
+ It sets the trust policy on that IAM Role to permit Prowler to assume that role.
+ This template is designed to be used in Prowler Cloud, but can also be used in other Prowler deployments.
+
+ ** DEPLOYED VIA SERVICE-MANAGED STACKSET **
+ This stack was automatically deployed across your organization using CloudFormation StackSets
+ with SERVICE_MANAGED permissions. It will auto-deploy to new accounts and can be centrally managed.
+
+ Parameters:
+ ExternalId:
+ Description: |
+ This is the External ID that Prowler will use to assume the role ProwlerScan IAM Role.
+ Type: String
+ MinLength: 1
+ AllowedPattern: ".+"
+ ConstraintDescription: "ExternalId must not be empty."
+ AccountId:
+ Description: |
+ AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this.
+ Type: String
+ Default: "232136659152"
+ MinLength: 12
+ MaxLength: 12
+ AllowedPattern: "[0-9]{12}"
+ ConstraintDescription: "AccountId must be a valid AWS Account ID."
+ IAMPrincipal:
+ Description: |
+ The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this.
+ Type: String
+ Default: role/prowler*
+ EnableOrganizations:
+ Description: |
+ Enable AWS Organizations discovery permissions. Set to true only when deploying this role in the management account.
+ This adds read-only Organizations permissions (e.g. ListAccounts, DescribeOrganization) and StackSet management permissions.
+ Type: String
+ Default: false
+ AllowedValues:
+ - true
+ - false
+ EnableS3Integration:
+ Description: |
+ Enable S3 integration for storing Prowler scan reports.
+ Type: String
+ Default: false
+ AllowedValues:
+ - true
+ - false
+ S3IntegrationBucketName:
+ Description: |
+ The S3 bucket name where Prowler will store scan reports for your cloud providers.
+ Type: String
+ Default: ""
+ S3IntegrationBucketAccountId:
+ Description: |
+ The AWS Account ID owner of the S3 Bucket.
+ Type: String
+ Default: ""
+
+ Conditions:
+ OrganizationsEnabled: !Equals [!Ref EnableOrganizations, true]
+ S3IntegrationEnabled: !Equals [!Ref EnableS3Integration, true]
+
+ Resources:
+ ProwlerScan:
+ Type: AWS::IAM::Role
+ Properties:
+ RoleName: ProwlerScan
+ AssumeRolePolicyDocument:
+ Version: "2012-10-17"
+ Statement:
+ - Effect: Allow
+ Principal:
+ AWS: !Sub "arn:${AWS::Partition}:iam::${AccountId}:root"
+ Action: "sts:AssumeRole"
+ Condition:
+ StringEquals:
+ "sts:ExternalId": !Sub ${ExternalId}
+ StringLike:
+ "aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:${IAMPrincipal}"
+ MaxSessionDuration: 3600
+ ManagedPolicyArns:
+ - !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
+ - !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
+ Policies:
+ - PolicyName: ProwlerScan
+ PolicyDocument:
+ Version: "2012-10-17"
+ Statement:
+ - Sid: AllowMoreReadOnly
+ Effect: Allow
+ Action:
+ - "account:Get*"
+ - "appstream:Describe*"
+ - "appstream:List*"
+ - "backup:List*"
+ - "backup:Get*"
+ - "bedrock:List*"
+ - "bedrock:Get*"
+ - "cloudtrail:GetInsightSelectors"
+ - "codeartifact:List*"
+ - "codebuild:BatchGet*"
+ - "codebuild:ListReportGroups"
+ - "cognito-idp:GetUserPoolMfaConfig"
+ - "dlm:Get*"
+ - "drs:Describe*"
+ - "ds:Get*"
+ - "ds:Describe*"
+ - "ds:List*"
+ - "dynamodb:GetResourcePolicy"
+ - "ec2:GetEbsEncryptionByDefault"
+ - "ec2:GetSnapshotBlockPublicAccessState"
+ - "ec2:GetInstanceMetadataDefaults"
+ - "ecr:Describe*"
+ - "ecr:GetRegistryScanningConfiguration"
+ - "elasticfilesystem:DescribeBackupPolicy"
+ - "glue:GetConnections"
+ - "glue:GetSecurityConfiguration*"
+ - "glue:SearchTables"
+ - "glue:GetMLTransforms"
+ - "lambda:GetFunction*"
+ - "logs:FilterLogEvents"
+ - "lightsail:GetRelationalDatabases"
+ - "macie2:GetMacieSession"
+ - "macie2:GetAutomatedDiscoveryConfiguration"
+ - "s3:GetAccountPublicAccessBlock"
+ - "shield:DescribeProtection"
+ - "shield:GetSubscriptionState"
+ - "securityhub:GetFindings"
+ - "servicecatalog:Describe*"
+ - "servicecatalog:List*"
+ - "ssm:GetDocument"
+ - "ssm-incidents:List*"
+ - "states:ListTagsForResource"
+ - "support:Describe*"
+ - "tag:GetTagKeys"
+ - "wellarchitected:List*"
+ Resource: "*"
+ - Sid: AllowSecurityHubImportFindings
+ Effect: Allow
+ Action:
+ - "securityhub:BatchImportFindings"
+ Resource: "*"
+ - Sid: AllowAPIGatewayReadOnly
+ Effect: Allow
+ Action:
+ - "apigateway:GET"
+ Resource:
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/restapis/*"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/apis/*"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames"
+ - !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames/*"
+ - !If
+ - OrganizationsEnabled
+ - PolicyName: ProwlerOrganizations
+ PolicyDocument:
+ Version: "2012-10-17"
+ Statement:
+ - Sid: AllowOrganizationsReadOnly
+ Effect: Allow
+ Action:
+ - "organizations:DescribeAccount"
+ - "organizations:DescribeOrganization"
+ - "organizations:ListAccounts"
+ - "organizations:ListAccountsForParent"
+ - "organizations:ListOrganizationalUnitsForParent"
+ - "organizations:ListRoots"
+ - "organizations:ListTagsForResource"
+ Resource: "*"
+ - Sid: AllowStackSetManagement
+ Effect: Allow
+ Action:
+ - "organizations:RegisterDelegatedAdministrator"
+ Resource: "*"
+ - Sid: AllowCreateStackSetSLR
+ Effect: Allow
+ Action:
+ - "iam:CreateServiceLinkedRole"
+ Resource: !Sub "arn:${AWS::Partition}:iam::*:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/*"
+ - !Ref AWS::NoValue
+ - !If
+ - S3IntegrationEnabled
+ - PolicyName: S3Integration
+ PolicyDocument:
+ Version: "2012-10-17"
+ Statement:
+ - Effect: Allow
+ Action:
+ - "s3:PutObject"
+ Resource:
+ - !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*"
+ Condition:
+ StringEquals:
+ "s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
+ - Effect: Allow
+ Action:
+ - "s3:ListBucket"
+ Resource:
+ - !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}"
+ Condition:
+ StringEquals:
+ "s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
+ - Effect: Allow
+ Action:
+ - "s3:DeleteObject"
+ Resource:
+ - !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*test-prowler-connection.txt"
+ Condition:
+ StringEquals:
+ "s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
+ - !Ref AWS::NoValue
+ Tags:
+ - Key: "Service"
+ Value: "https://prowler.com"
+ - Key: "Support"
+ Value: "support@prowler.com"
+ - Key: "CloudFormation"
+ Value: "true"
+ - Key: "Name"
+ Value: "ProwlerScan"
+
+ Outputs:
+ ProwlerScanRoleArn:
+ Description: "ARN of the ProwlerScan IAM Role"
+ Value: !GetAtt ProwlerScan.Arn
+ Export:
+ Name: !Sub "${AWS::StackName}-ProwlerScanRoleArn"
+
Metadata:
- AWS::CloudFormation::StackName: "Prowler"
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
- default: Required
+ default: Deployment Options
+ Parameters:
+ - DeployLocalRole
+ - DeployStackSet
+ - Label:
+ default: Required Prowler Configuration
Parameters:
- ExternalId
- AccountId
@@ -232,14 +599,27 @@ Metadata:
- EnableOrganizations
- EnableS3Integration
- Label:
- default: Optional
+ default: Optional S3 Integration
Parameters:
- S3IntegrationBucketName
- S3IntegrationBucketAccountId
+ - Label:
+ default: StackSet Configuration (Required if DeployStackSet is true)
+ Parameters:
+ - AWSOrganizationalUnitId
+ - DeployFromDelegatedAdmin
+ - RetainStacksOnAccountRemoval
+ - FailureTolerancePercentage
Outputs:
- ProwlerScanRoleArn:
- Description: "ARN of the ProwlerScan IAM Role"
+ LocalProwlerScanRoleArn:
+ Condition: DeployLocalRoleEnabled
+ Description: "ARN of the ProwlerScan IAM Role deployed locally in this account"
Value: !GetAtt ProwlerScan.Arn
Export:
Name: !Sub "${AWS::StackName}-ProwlerScanRoleArn"
+
+ StackSetId:
+ Condition: DeployStackSetEnabled
+ Description: "StackSet ID for the ProwlerScan role deployment across accounts"
+ Value: !Ref ProwlerScanStackSet
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 1d6dd42262..408c76d3e1 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -2,12 +2,127 @@
All notable changes to the **Prowler SDK** are documented in this file.
-## [5.32.0] (Prowler UNRELEASED)
+<!-- changelog: release notes start -->
+
+## [5.35.0] (Prowler v5.35.0)
### 🚀 Added
+- `excluded_checks` and `excluded_services` in scan configurations to narrow the execution scope [(#12028)](https://github.com/prowler-cloud/prowler/pull/12028)
+
+### 🔐 Security
+
+- Jira tenant information requests validate site names and do not follow redirects [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
+
+---
+
+## [5.34.0] (Prowler v5.34.0)
+
+### 🚀 Added
+
+- `elbv2_listener_pqc_tls_enabled` check for AWS provider, verifying that ELBv2 listeners use post-quantum TLS policies [(#11254)](https://github.com/prowler-cloud/prowler/pull/11254)
+- `iaas_server_public_ip_attached` check for STACKIT provider, flagging IaaS servers that have a public IP address directly attached to a network interface [(#11549)](https://github.com/prowler-cloud/prowler/pull/11549)
+- Changelog fragment workflow for SDK, API, UI, and MCP Server releases, including PR attribution, fragment validation, release compilation, and preserved section ordering [(#11572)](https://github.com/prowler-cloud/prowler/pull/11572)
+- E2E Networks provider with 27 checks across compute nodes, networking, security groups, load balancers, block/file storage, and managed databases [(#11654)](https://github.com/prowler-cloud/prowler/pull/11654)
+- `datapipeline_pipeline_no_secrets_in_definition` check for AWS provider, scanning Data Pipeline object fields, parameter objects, and parameter values for hardcoded secrets with Kingfisher [(#11821)](https://github.com/prowler-cloud/prowler/pull/11821)
+- `amplify_app_no_secrets_in_environment` check for AWS provider, scanning Amplify app and branch environment variables and build settings for hardcoded secrets [(#11825)](https://github.com/prowler-cloud/prowler/pull/11825)
+- `ec2_ami_account_block_public_access` check for AWS provider, verifying AMI block public access is enabled at the account level in each Region so AMIs cannot be shared publicly [(#11828)](https://github.com/prowler-cloud/prowler/pull/11828)
+- `core_readonly_root_filesystem_enabled` check for Kubernetes provider, verifying that every container in each Pod explicitly sets `readOnlyRootFilesystem: true` in its security context [(#11835)](https://github.com/prowler-cloud/prowler/pull/11835)
+- `core_minimize_hostpath_volume_mounts` check for Kubernetes provider, detecting Pods that use `hostPath` volumes [(#11837)](https://github.com/prowler-cloud/prowler/pull/11837)
+- `app_function_ensure_http_is_redirected_to_https` check for Azure provider, verifying that Function Apps enforce HTTPS-only traffic [(#11929)](https://github.com/prowler-cloud/prowler/pull/11929)
+
+### 🔄 Changed
+
+- Add missing trailing newlines to compliance, region, and fixture data files for POSIX compliance [(#11765)](https://github.com/prowler-cloud/prowler/pull/11765)
+- Oracle Cloud API key authentication now uses an internal bootstrap region when no explicit scan region filter is provided [(#11853)](https://github.com/prowler-cloud/prowler/pull/11853)
+- Redesign the local dashboard sidebar and informational pages [(#11972)](https://github.com/prowler-cloud/prowler/pull/11972)
+
+---
+
+## [5.33.2] (Prowler v5.33.2)
+
+### 🐞 Fixed
+
+- EC2 AMI loading now targets Amazon-owned AMIs used by audited instances, reducing AWS API calls during EC2 scans [(#11958)](https://github.com/prowler-cloud/prowler/pull/11958)
+- `ec2_instance_account_imdsv2_enabled` findings now use regional resource ARNs, preventing findings from different AWS Regions from collapsing into one resource [(#11966)](https://github.com/prowler-cloud/prowler/pull/11966)
+
+---
+
+## [5.33.1] (Prowler v5.33.1)
+
+### 🐞 Fixed
+
+- ECS task definition resource limits now select the latest task definitions by registration date instead of relying on ARN ordering [(#11891)](https://github.com/prowler-cloud/prowler/pull/11891)
+- `dlm_ebs_snapshot_lifecycle_policy_exists` no longer initializes the full EC2 inventory just to detect EBS snapshots, avoiding slow scans when checking DLM lifecycle policies [(#11900)](https://github.com/prowler-cloud/prowler/pull/11900)
+- `dms_instance_no_public_access` no longer initializes the full EC2 service when there are no DMS replication instances [(#11902)](https://github.com/prowler-cloud/prowler/pull/11902)
+- `organizations_scp_check_deny_regions` no longer reports false `FAIL` for AWS Organizations that restrict regions with Allow-based SCPs; the Allow path now checks the statement `Effect` instead of an always-false comparison that made it unreachable [(#11915)](https://github.com/prowler-cloud/prowler/pull/11915)
+- Jira issue creation failures now preserve safe structured response details from Jira [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+- Azure Function App optional permission failures now log as warnings, and Function App environment variable fields use the correct spelling internally [(#11926)](https://github.com/prowler-cloud/prowler/pull/11926)
+
+---
+
+## [5.33.0] (Prowler v5.33.0)
+
+### 🐞 Fixed
+
+- Azure resource group scoped scans now keep subscription entries when scoped resource listing fails, clarify helper documentation and test organization, and align the resource group documentation example with the described values [(#11796)](https://github.com/prowler-cloud/prowler/pull/11796)
+- Azure `postgresql_flexible_server_log_retention_days_greater_3` check now queries the `logfiles.retention_days` configuration parameter instead of `log_retention_days` (which only exists on the retired Single Server), fixing false `FAIL` results on every Flexible Server regardless of the actual retention value [(#11761)](https://github.com/prowler-cloud/prowler/pull/11761)
+
+---
+
+## [5.32.1] (Prowler v5.32.1)
+
+### 🐞 Fixed
+
+- `KeyError: 'MANUAL'` crash while rendering the compliance summary table (e.g. CIS Microsoft 365) when a framework has manual, checks-less requirements with a Level 1/Level 2 profile; `MANUAL` findings are now skipped in the PASS/FAIL section tally instead of raising [(#11822)](https://github.com/prowler-cloud/prowler/issues/11822)
+
+---
+
+## [5.32.0] (Prowler v5.32.0)
+
+### 🚀 Added
+
+- `exchange_application_access_policy_restricts_mailbox_apps` check for M365 provider, verifying every service principal with Microsoft Graph application-level Exchange mailbox permissions is restricted by an Exchange Online Application Access Policy, preventing tenant-wide mailbox access by unscoped applications [(#11247)](https://github.com/prowler-cloud/prowler/pull/11247)
+- Per-requirement configuration validation for compliance frameworks via `ConfigRequirements`, so a requirement is reported as FAIL when its configurable checks ran with a configuration too loose to satisfy it (applied across all compliance outputs: CSV, OCSF, and console tables) [(#11669)](https://github.com/prowler-cloud/prowler/pull/11669)
- `entra_conditional_access_policy_explicitly_targets_azure_devops` check for M365 provider, verifying at least one enabled Conditional Access policy explicitly includes the Azure DevOps cloud application instead of relying on a broad "All cloud apps" policy [(#11182)](https://github.com/prowler-cloud/prowler/pull/11182)
- `entra_conditional_access_policy_no_exclusion_gaps` check for M365 provider, verifying every user, group, role, or application excluded from an enabled Conditional Access policy stays in scope of another enabled policy [(#11577)](https://github.com/prowler-cloud/prowler/pull/11577)
+- `entra_conditional_access_policy_groups_management_restricted` check for M365 provider, verifying every security group referenced by an enabled or report-only Conditional Access policy is management-restricted or role-assignable [(#11342)](https://github.com/prowler-cloud/prowler/pull/11342)
+- `stepfunctions_statemachine_encrypted_with_cmk` check for AWS provider, verifying that each Step Functions state machine uses a customer-managed KMS key for encryption at rest rather than the default AWS-owned key [(#11538)](https://github.com/prowler-cloud/prowler/pull/11538)
+- CIS Controls v8.1 universal compliance framework mapping existing checks across 18 providers (AWS, Azure, GCP, Kubernetes, M365, GitHub, AlibabaCloud, OracleCloud, GoogleWorkspace, Okta, Cloudflare, Vercel, MongoDB Atlas, OpenStack, Linode, StackIT, NHN, and Scaleway) to the 18 CIS Critical Security Controls and their Safeguards [(#11700)](https://github.com/prowler-cloud/prowler/pull/11700)
+- CIS Microsoft 365 Foundations Benchmark v7.0.0 compliance framework for the M365 provider [(#11699)](https://github.com/prowler-cloud/prowler/pull/11699)
+- `waf_regional_webacl_logging_enabled` check for AWS provider, verifying that each AWS WAF Classic Regional Web ACL has logging enabled to a Kinesis Data Firehose stream [(#11539)](https://github.com/prowler-cloud/prowler/pull/11539)
+- `sdk_only` provider property (default `true`) and `Provider.get_app_providers()`, so a provider (built-in or external) stays CLI/SDK-only and hidden from the app unless it declares `sdk_only = False` [(#11427)](https://github.com/prowler-cloud/prowler/pull/11427)
+- `Provider.get_scan_arguments()`, `Provider.get_connection_arguments()` and `Provider.get_credentials_schema()` contract methods, so a provider persisted as a stored uid plus a secret dict can be constructed and validated programmatically (to be consumed by the API in a later change) [(#11578)](https://github.com/prowler-cloud/prowler/pull/11578)
+- Okta API request throttling to proactively stay under rate limits, configurable via `okta_requests_per_second` in the config file and the `--okta-requests-per-second` CLI flag, plus configurable retries via `okta_max_retries` / `--okta-retries-max-attempts` as a safety net [(#11702)](https://github.com/prowler-cloud/prowler/pull/11702)
+- CIS Amazon Web Services Foundations Benchmark v7.0.0 compliance framework for the AWS provider, adding the new Organizations section (2.1.1-2.1.6), resource policy (2.21), web front-end access logging (4.10), and VPC Endpoints (6.8) recommendations [(#11707)](https://github.com/prowler-cloud/prowler/pull/11707)
+- CIS Microsoft Azure Foundations Benchmark v6.0.0 compliance framework for the Azure provider [(#11708)](https://github.com/prowler-cloud/prowler/pull/11708)
+- CIS Google Cloud Platform Foundation Benchmark v5.0.0 compliance framework for the GCP provider [(#11714)](https://github.com/prowler-cloud/prowler/pull/11714)
+- CIS Kubernetes Benchmark v2.0.1 compliance framework for the Kubernetes provider [(#11722)](https://github.com/prowler-cloud/prowler/pull/11722)
+- CIS GitHub Benchmark v1.2.0 compliance framework for the GitHub provider [(#11719)](https://github.com/prowler-cloud/prowler/pull/11719)
+- AWS Bedrock AgentCore privilege escalation paths in the IAM privilege escalation checks, covering Runtime, Harness, Code Interpreter and Custom Browser [(#11726)](https://github.com/prowler-cloud/prowler/pull/11726)
+- `--scan-secrets-validate` flag and `aws.secrets_validate` configuration option to optionally validate the secrets discovered by the secret-scanning checks against the provider APIs; secrets confirmed to be live are reported as critical [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- `apigateway_restapi_no_secrets_in_stage_variables` check for AWS provider, scanning API Gateway REST API stage variables for hardcoded secrets such as passwords, API keys, and tokens [(#11188)](https://github.com/prowler-cloud/prowler/pull/11188)
+- `s3_bucket_object_public` check for AWS provider, spot-checking a configurable sample of object ACLs in each bucket and flagging objects granted to the AllUsers or AuthenticatedUsers groups; disabled by default and opted into via the `s3_bucket_object_public_enabled` configuration option [(#9517)](https://github.com/prowler-cloud/prowler/pull/9517)
+- Azure provider now supports `--azure-resource-group` to scope resource-level checks to specific resource groups across all accessible subscriptions [(#10657)](https://github.com/prowler-cloud/prowler/pull/10657)
+
+### 🔄 Changed
+
+- Replaced the `detect-secrets` library with [Kingfisher](https://github.com/mongodb/kingfisher) as the engine for the secret-scanning checks; scans run fully offline by default and obvious placeholder values are no longer reported as findings [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- Removed the `detect_secrets_plugins` configuration option, which is no longer used by the new secret-scanning engine [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- `awslambda_function_no_secrets_in_code` now supports a `secrets_ignore_files` audit-config option to skip files inside the deployment package by glob pattern (e.g. `*.deps.json`), suppressing .NET dependency-manifest false positives without masking real secrets [(#11222)](https://github.com/prowler-cloud/prowler/pull/11222)
+- AWS scans for EBS snapshots, Backup recovery points, CloudWatch log groups, Lambda functions, ECS task definitions, and CodeArtifact packages now support configurable resource analysis limits via `aws.max_scanned_resources_per_service`; limits are disabled by default and only positive values cap analyzed resources [(#11228)](https://github.com/prowler-cloud/prowler/pull/11228)
+
+### 🐞 Fixed
+
+- GitHub `repository_has_codeowners_file` check no longer flags archived repositories, since they are read-only and cannot be updated without first being unarchived, making the finding not actionable [(#11735)](https://github.com/prowler-cloud/prowler/pull/11735)
+- Report secret-scanning checks as `MANUAL` instead of `PASS` when the scanner fails (non-zero exit, timeout, unparseable output or missing binary), so a scanner failure is no longer indistinguishable from "no secrets found" [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- Avoid a false `FAIL` in `cloudwatch_log_group_no_secrets_in_logs` when a multiline event's secrets are all removed by `secrets_ignore_patterns` during the rescan [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- Key the `cloudwatch_log_group_no_secrets_in_logs` secret scan by log group ARN instead of name, so same-named log groups and streams in different regions no longer collide and reuse each other's findings [(#11694)](https://github.com/prowler-cloud/prowler/pull/11694)
+- Compliance frameworks contributed by several external packages under the same provider are now merged instead of overwritten, so every entry-point directory a provider contributes is discovered [(#11578)](https://github.com/prowler-cloud/prowler/pull/11578)
+- Azure PostgreSQL flexible server collection no longer drops the remaining servers in a subscription when one server fails to collect; the `connection_throttle.enable` parameter (removed in PostgreSQL 16+) is treated as absent only when the Azure SDK reports it as not found, so unexpected lookup failures are not silently reported as throttling disabled [(#11595)](https://github.com/prowler-cloud/prowler/pull/11595)
+- Azure `keyvault_logging_enabled` now accepts Key Vault diagnostic settings that enable the explicit `AuditEvent` category, avoiding false failures when Azure returns category-based logs without category groups [(#11660)](https://github.com/prowler-cloud/prowler/pull/11660)
+- GitHub default branch protection checks now evaluate repository rulesets in addition to classic branch protection, avoiding false positives for repositories that enforce protection through rulesets [(#11723)](https://github.com/prowler-cloud/prowler/pull/11723)
+- Okta, Alibaba Cloud and OpenStack scan-config sections are now validated against a registered schema instead of being silently accepted, so their configurable thresholds (session/idle timeouts, retention days, image-sharing and secret-scanning settings) log a warning and fall back to the built-in default whenever a value is out of range [(#11725)](https://github.com/prowler-cloud/prowler/pull/11725)
---
@@ -284,7 +399,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
- `bedrock_prompt_management_exists` check for AWS provider [(#10878)](https://github.com/prowler-cloud/prowler/pull/10878)
- 8 Gmail attachment safety and spoofing protection checks for Google Workspace provider using the Cloud Identity Policy API [(#10980)](https://github.com/prowler-cloud/prowler/pull/10980)
- `bedrock_prompt_encrypted_with_cmk` check for AWS provider [(#10905)](https://github.com/prowler-cloud/prowler/pull/10905)
-
### 🔄 Changed
- Azure Network Watcher flow log checks now require workspace-backed Traffic Analytics for `network_flow_log_captured_sent` and align metadata with VNet-compatible flow log guidance [(#10645)](https://github.com/prowler-cloud/prowler/pull/10645)
diff --git a/prowler/__main__.py b/prowler/__main__.py
index d4c925f74f..12f4b24cac 100644
--- a/prowler/__main__.py
+++ b/prowler/__main__.py
@@ -140,6 +140,7 @@ from prowler.providers.azure.models import AzureOutputOptions
from prowler.providers.cloudflare.models import CloudflareOutputOptions
from prowler.providers.common.provider import Provider
from prowler.providers.common.quick_inventory import run_provider_quick_inventory
+from prowler.providers.e2enetworks.models import E2eNetworksOutputOptions
from prowler.providers.gcp.models import GCPOutputOptions
from prowler.providers.github.models import GithubOutputOptions
from prowler.providers.googleworkspace.models import GoogleWorkspaceOutputOptions
@@ -432,6 +433,10 @@ def prowler():
output_options = VercelOutputOptions(
args, bulk_checks_metadata, global_provider.identity
)
+ elif provider == "e2enetworks":
+ output_options = E2eNetworksOutputOptions(
+ args, bulk_checks_metadata, global_provider.identity
+ )
elif provider == "okta":
output_options = OktaOutputOptions(
args, bulk_checks_metadata, global_provider.identity
diff --git a/tests/config/schema/__init__.py b/prowler/changelog.d/.gitkeep
similarity index 100%
rename from tests/config/schema/__init__.py
rename to prowler/changelog.d/.gitkeep
diff --git a/prowler/changelog.d/README.md b/prowler/changelog.d/README.md
new file mode 100644
index 0000000000..0853174f30
--- /dev/null
+++ b/prowler/changelog.d/README.md
@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.
diff --git a/prowler/changelog.d/grouped-jira-dispatch.changed.md b/prowler/changelog.d/grouped-jira-dispatch.changed.md
new file mode 100644
index 0000000000..8dd2e43ab5
--- /dev/null
+++ b/prowler/changelog.d/grouped-jira-dispatch.changed.md
@@ -0,0 +1 @@
+Jira output rendering supports grouped Finding Group issues with caller-provided links and capped or uncapped finding copy
diff --git a/prowler/compliance/alibabacloud/cis_2.0_alibabacloud.json b/prowler/compliance/alibabacloud/cis_2.0_alibabacloud.json
index 7cda08efbb..9a05c1997f 100644
--- a/prowler/compliance/alibabacloud/cis_2.0_alibabacloud.json
+++ b/prowler/compliance/alibabacloud/cis_2.0_alibabacloud.json
@@ -109,6 +109,14 @@
],
"Checks": [
"ram_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "ram_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -841,6 +849,14 @@
],
"Checks": [
"sls_logstore_retention_period"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sls_logstore_retention_period",
+ "ConfigKey": "min_log_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
]
},
{
@@ -1353,6 +1369,14 @@
],
"Checks": [
"rds_instance_sql_audit_retention"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "rds_instance_sql_audit_retention",
+ "ConfigKey": "min_rds_audit_retention_days",
+ "Operator": "gte",
+ "Value": 180
+ }
]
},
{
@@ -1551,6 +1575,14 @@
],
"Checks": [
"cs_kubernetes_cluster_check_recent"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "cs_kubernetes_cluster_check_recent",
+ "ConfigKey": "max_cluster_check_days",
+ "Operator": "lte",
+ "Value": 7
+ }
]
},
{
diff --git a/prowler/compliance/alibabacloud/prowler_threatscore_alibabacloud.json b/prowler/compliance/alibabacloud/prowler_threatscore_alibabacloud.json
index ca7a030dc2..0bfd47df7e 100644
--- a/prowler/compliance/alibabacloud/prowler_threatscore_alibabacloud.json
+++ b/prowler/compliance/alibabacloud/prowler_threatscore_alibabacloud.json
@@ -47,6 +47,14 @@
"Checks": [
"ram_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "ram_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
+ ],
"Attributes": [
{
"Title": "Inactive users disabled for console access",
@@ -399,6 +407,14 @@
"LevelOfRisk": 3,
"Weight": 10
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "cs_kubernetes_cluster_check_weekly",
+ "ConfigKey": "max_cluster_check_days",
+ "Operator": "lte",
+ "Value": 7
+ }
]
},
{
@@ -695,6 +711,14 @@
"Checks": [
"rds_instance_sql_audit_retention"
],
+ "ConfigRequirements": [
+ {
+ "Check": "rds_instance_sql_audit_retention",
+ "ConfigKey": "min_rds_audit_retention_days",
+ "Operator": "gte",
+ "Value": 180
+ }
+ ],
"Attributes": [
{
"Title": "RDS SQL audit retention configured",
diff --git a/prowler/compliance/aws/asd_essential_eight_aws.json b/prowler/compliance/aws/asd_essential_eight_aws.json
index 00b39817e3..dd39c44268 100644
--- a/prowler/compliance/aws/asd_essential_eight_aws.json
+++ b/prowler/compliance/aws/asd_essential_eight_aws.json
@@ -13,6 +13,14 @@
"config_recorder_all_regions_enabled",
"inspector2_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Patch applications",
@@ -260,6 +268,14 @@
"config_recorder_all_regions_enabled",
"inspector2_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "2 Patch operating systems",
@@ -742,6 +758,14 @@
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Restrict administrative privileges",
diff --git a/prowler/compliance/aws/aws_account_security_onboarding_aws.json b/prowler/compliance/aws/aws_account_security_onboarding_aws.json
index 1d038537f0..1910bac223 100644
--- a/prowler/compliance/aws/aws_account_security_onboarding_aws.json
+++ b/prowler/compliance/aws/aws_account_security_onboarding_aws.json
@@ -37,6 +37,26 @@
"guardduty_is_enabled",
"accessanalyzer_enabled",
"macie_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -259,6 +279,20 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -514,6 +548,14 @@
"Checks": [
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -530,6 +572,20 @@
"securityhub_enabled",
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -666,6 +722,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -680,6 +744,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -694,6 +766,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -708,6 +788,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -722,6 +810,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -736,6 +832,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -762,6 +866,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -777,6 +889,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_centrally_managed"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -792,6 +912,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -807,6 +935,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -822,6 +958,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -837,6 +981,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -852,6 +1004,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -867,6 +1027,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -882,6 +1050,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -897,6 +1073,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -912,6 +1096,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/aws_ai_security_framework_aws.json b/prowler/compliance/aws/aws_ai_security_framework_aws.json
index c6a0a8504b..9b87f7464d 100644
--- a/prowler/compliance/aws/aws_ai_security_framework_aws.json
+++ b/prowler/compliance/aws/aws_ai_security_framework_aws.json
@@ -404,6 +404,14 @@
"Checks": [
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -860,6 +868,20 @@
"guardduty_lambda_protection_enabled",
"guardduty_rds_protection_enabled",
"guardduty_ec2_malware_protection_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_delegated_admin_enabled_all_regions",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -894,6 +916,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -964,6 +994,14 @@
"Checks": [
"config_recorder_all_regions_enabled",
"config_recorder_using_aws_service_role"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1157,4 +1195,4 @@
"Checks": []
}
]
-}
\ No newline at end of file
+}
diff --git a/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json b/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
index cea7ad1655..b58a74bcaa 100644
--- a/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
+++ b/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
@@ -20,6 +20,14 @@
"SectionDescription": "This section contains recommendations for configuring ACM resources.",
"Service": "ACM"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_expiration_check",
+ "ConfigKey": "days_to_expire_threshold",
+ "Operator": "gte",
+ "Value": 30
+ }
]
},
{
@@ -29,6 +37,17 @@
"Checks": [
"acm_certificates_with_secure_key_algorithms"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"ItemId": "ACM.2",
@@ -777,6 +796,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "Config.1",
@@ -892,6 +919,14 @@
"Checks": [
"documentdb_cluster_backup_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "documentdb_cluster_backup_enabled",
+ "ConfigKey": "minimum_backup_retention_period",
+ "Operator": "gte",
+ "Value": 7
+ }
+ ],
"Attributes": [
{
"ItemId": "DocumentDB.2",
@@ -1959,6 +1994,14 @@
"SectionDescription": "This section contains recommendations for configuring ELB resources.",
"Service": "ELB"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "elb_is_in_multiple_az",
+ "ConfigKey": "elb_min_azs",
+ "Operator": "gte",
+ "Value": 2
+ }
]
},
{
@@ -1993,6 +2036,14 @@
"SectionDescription": "This section contains recommendations for configuring ELB resources.",
"Service": "ELB"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "elbv2_is_in_multiple_az",
+ "ConfigKey": "elbv2_min_azs",
+ "Operator": "gte",
+ "Value": 2
+ }
]
},
{
@@ -2370,6 +2421,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "GuardDuty.1",
@@ -2547,6 +2606,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
+ ],
"Attributes": [
{
"ItemId": "IAM.8",
@@ -2635,6 +2708,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"ItemId": "IAM.22",
@@ -2791,6 +2878,40 @@
"SectionDescription": "This section contains recommendations for configuring Lambda resources.",
"Service": "Lambda"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "awslambda_function_using_supported_runtimes",
+ "ConfigKey": "obsolete_lambda_runtimes",
+ "Operator": "superset",
+ "Value": [
+ "java8",
+ "go1.x",
+ "provided",
+ "python3.6",
+ "python2.7",
+ "python3.7",
+ "python3.8",
+ "nodejs4.3",
+ "nodejs4.3-edge",
+ "nodejs6.10",
+ "nodejs",
+ "nodejs8.10",
+ "nodejs10.x",
+ "nodejs12.x",
+ "nodejs14.x",
+ "nodejs16.x",
+ "dotnet5.0",
+ "dotnet6",
+ "dotnet7",
+ "dotnetcore1.0",
+ "dotnetcore2.0",
+ "dotnetcore2.1",
+ "dotnetcore3.1",
+ "ruby2.5",
+ "ruby2.7"
+ ]
+ }
]
},
{
@@ -2951,6 +3072,14 @@
"Checks": [
"neptune_cluster_backup_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "neptune_cluster_backup_enabled",
+ "ConfigKey": "minimum_backup_retention_period",
+ "Operator": "gte",
+ "Value": 7
+ }
+ ],
"Attributes": [
{
"ItemId": "Neptune.5",
diff --git a/prowler/compliance/aws/aws_foundational_technical_review_aws.json b/prowler/compliance/aws/aws_foundational_technical_review_aws.json
index 691a8ba7f1..9d8e3cfdc8 100644
--- a/prowler/compliance/aws/aws_foundational_technical_review_aws.json
+++ b/prowler/compliance/aws/aws_foundational_technical_review_aws.json
@@ -176,6 +176,14 @@
"iam_user_with_temporary_credentials",
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
index 4c4eaee252..9dd009afb3 100644
--- a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
+++ b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
@@ -585,6 +585,14 @@
"cloudtrail_multi_region_enabled",
"vpc_flow_logs_enabled",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -646,6 +654,20 @@
"guardduty_no_high_severity_findings",
"macie_is_enabled",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -778,6 +800,14 @@
"guardduty_is_enabled",
"vpc_flow_logs_enabled",
"apigateway_restapi_authorizers_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1151,6 +1181,7 @@
"elb_insecure_ssl_ciphers",
"elb_ssl_listeners",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/c5_aws.json b/prowler/compliance/aws/c5_aws.json
index 8847469154..269a5ce308 100644
--- a/prowler/compliance/aws/c5_aws.json
+++ b/prowler/compliance/aws/c5_aws.json
@@ -382,6 +382,14 @@
"cloudtrail_multi_region_enabled",
"config_recorder_all_regions_enabled",
"s3_multi_region_access_point_public_access_block"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2234,6 +2242,14 @@
"vpc_different_regions",
"autoscaling_group_multiple_az",
"storagegateway_gateway_fault_tolerant"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2261,6 +2277,14 @@
"organizations_scp_check_deny_regions",
"s3_multi_region_access_point_public_access_block",
"vpc_different_regions"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2308,6 +2332,14 @@
"organizations_scp_check_deny_regions",
"s3_multi_region_access_point_public_access_block",
"vpc_different_regions"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2978,6 +3010,14 @@
"guardduty_is_enabled",
"athena_workgroup_enforce_configuration",
"shield_advanced_protection_in_global_accelerators"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -3481,6 +3521,14 @@
"cloudtrail_cloudwatch_logging_enabled",
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4299,6 +4347,14 @@
"guardduty_no_high_severity_findings",
"guardduty_rds_protection_enabled",
"guardduty_s3_protection_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4920,6 +4976,17 @@
"elbv2_nlb_tls_termination_enabled",
"transfer_server_in_transit_encryption_enabled",
"kafka_cluster_mutual_tls_authentication_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -4946,6 +5013,17 @@
"elbv2_nlb_tls_termination_enabled",
"transfer_server_in_transit_encryption_enabled",
"kafka_cluster_mutual_tls_authentication_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -5220,6 +5298,14 @@
"rds_instance_default_admin",
"accessanalyzer_enabled",
"efs_access_point_enforce_user_identity"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5737,6 +5823,14 @@
"Checks": [
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6100,6 +6194,17 @@
"cloudfront_distributions_origin_traffic_encrypted",
"glue_development_endpoints_job_bookmark_encryption_enabled",
"cloudtrail_kms_encryption_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6196,6 +6301,17 @@
"elb_ssl_listeners_use_acm_certificate",
"iam_no_expired_server_certificates_stored",
"rds_instance_certificate_expiration"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6307,6 +6423,17 @@
"elb_ssl_listeners_use_acm_certificate",
"iam_no_expired_server_certificates_stored",
"rds_instance_certificate_expiration"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6393,6 +6520,14 @@
"sns_topics_not_publicly_accessible",
"sqs_queues_not_publicly_accessible",
"vpc_peering_routing_tables_with_least_privilege"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6412,6 +6547,14 @@
"ec2_instance_profile_attached",
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6587,6 +6730,17 @@
"kms_cmk_not_multi_region",
"kms_key_not_publicly_accessible",
"ec2_ebs_volume_encryption"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6809,6 +6963,17 @@
"secretsmanager_not_publicly_accessible",
"secretsmanager_secret_rotated_periodically",
"secretsmanager_secret_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6842,6 +7007,17 @@
],
"Checks": [
"acm_certificates_with_secure_key_algorithms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6915,6 +7091,17 @@
"secretsmanager_secret_rotated_periodically",
"secretsmanager_secret_unused",
"acm_certificates_with_secure_key_algorithms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -6937,6 +7124,17 @@
"secretsmanager_secret_rotated_periodically",
"secretsmanager_secret_unused",
"acm_certificates_with_secure_key_algorithms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -8042,6 +8240,14 @@
"cloudtrail_multi_region_enabled",
"cloudtrail_multi_region_enabled_logging_management_events",
"cloudtrail_log_file_validation_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -8810,6 +9016,14 @@
"guardduty_is_enabled",
"cloudtrail_log_file_validation_enabled",
"ssmincidents_enabled_with_plans"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -9732,6 +9946,14 @@
"accessanalyzer_enabled_without_findings",
"cloudfront_distributions_s3_origin_access_control",
"cloudtrail_logs_s3_bucket_access_logging_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -10367,6 +10589,14 @@
"Checks": [
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -10457,6 +10687,14 @@
"ec2_instance_profile_attached",
"iam_role_cross_account_readonlyaccess_policy",
"iam_securityaudit_role_created"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json
index 003e9e17a0..ef31bfe1ea 100644
--- a/prowler/compliance/aws/ccc_aws.json
+++ b/prowler/compliance/aws/ccc_aws.json
@@ -49,6 +49,7 @@
"elb_insecure_ssl_ciphers",
"elb_ssl_listeners",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -275,6 +276,17 @@
"acm_certificates_expiration_check",
"acm_certificates_with_secure_key_algorithms",
"acm_certificates_transparency_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -794,6 +806,17 @@
],
"Checks": [
"acm_certificates_with_secure_key_algorithms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -1504,6 +1527,14 @@
"iam_policy_no_full_access_to_kms",
"iam_policy_no_full_access_to_cloudtrail",
"iam_policy_attached_only_to_group_or_roles"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1666,6 +1697,14 @@
"cloudwatch_changes_to_network_route_tables_alarm_configured",
"cloudwatch_changes_to_vpcs_alarm_configured",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1791,6 +1830,14 @@
"cloudtrail_threat_detection_enumeration",
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4311,6 +4358,14 @@
],
"Checks": [
"acm_certificates_expiration_check"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_expiration_check",
+ "ConfigKey": "days_to_expire_threshold",
+ "Operator": "gte",
+ "Value": 30
+ }
]
},
{
@@ -6176,6 +6231,20 @@
"Checks": [
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -6272,6 +6341,14 @@
"cloudwatch_log_metric_filter_root_usage",
"cloudwatch_log_metric_filter_sign_in_without_mfa",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6374,6 +6451,14 @@
"Checks": [
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/cis_1.4_aws.json b/prowler/compliance/aws/cis_1.4_aws.json
index 3efc29fd5b..b373a04665 100644
--- a/prowler/compliance/aws/cis_1.4_aws.json
+++ b/prowler/compliance/aws/cis_1.4_aws.json
@@ -75,6 +75,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -736,6 +758,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
diff --git a/prowler/compliance/aws/cis_1.5_aws.json b/prowler/compliance/aws/cis_1.5_aws.json
index f7307bb7f4..6a60d786a2 100644
--- a/prowler/compliance/aws/cis_1.5_aws.json
+++ b/prowler/compliance/aws/cis_1.5_aws.json
@@ -75,6 +75,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -802,6 +824,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
@@ -1054,6 +1084,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Monitoring",
diff --git a/prowler/compliance/aws/cis_2.0_aws.json b/prowler/compliance/aws/cis_2.0_aws.json
index 4f8c4b2c23..e255bd43e1 100644
--- a/prowler/compliance/aws/cis_2.0_aws.json
+++ b/prowler/compliance/aws/cis_2.0_aws.json
@@ -75,6 +75,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -802,6 +824,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
@@ -1054,6 +1084,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Monitoring",
diff --git a/prowler/compliance/aws/cis_3.0_aws.json b/prowler/compliance/aws/cis_3.0_aws.json
index dd4c75a2f7..5540bc40cf 100644
--- a/prowler/compliance/aws/cis_3.0_aws.json
+++ b/prowler/compliance/aws/cis_3.0_aws.json
@@ -75,6 +75,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -756,6 +778,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
@@ -1008,6 +1038,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Monitoring",
diff --git a/prowler/compliance/aws/cis_4.0_aws.json b/prowler/compliance/aws/cis_4.0_aws.json
index 0c40f8ac09..c8787ef409 100644
--- a/prowler/compliance/aws/cis_4.0_aws.json
+++ b/prowler/compliance/aws/cis_4.0_aws.json
@@ -254,6 +254,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -431,6 +445,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -750,6 +772,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
@@ -1234,6 +1264,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Monitoring",
diff --git a/prowler/compliance/aws/cis_5.0_aws.json b/prowler/compliance/aws/cis_5.0_aws.json
index e870878c6b..0c8d46e170 100644
--- a/prowler/compliance/aws/cis_5.0_aws.json
+++ b/prowler/compliance/aws/cis_5.0_aws.json
@@ -232,6 +232,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -409,6 +423,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "1 Identity and Access Management",
@@ -728,6 +750,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 Logging",
@@ -1212,6 +1242,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Monitoring",
diff --git a/prowler/compliance/aws/cis_6.0_aws.json b/prowler/compliance/aws/cis_6.0_aws.json
index 643c192b7b..7ad62a4b65 100644
--- a/prowler/compliance/aws/cis_6.0_aws.json
+++ b/prowler/compliance/aws/cis_6.0_aws.json
@@ -232,6 +232,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Section": "2 Identity and Access Management",
@@ -409,6 +423,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "2 Identity and Access Management",
@@ -728,6 +750,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "4 Logging",
@@ -1212,6 +1242,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "5 Monitoring",
diff --git a/prowler/compliance/aws/cis_7.0_aws.json b/prowler/compliance/aws/cis_7.0_aws.json
new file mode 100644
index 0000000000..a927c375bb
--- /dev/null
+++ b/prowler/compliance/aws/cis_7.0_aws.json
@@ -0,0 +1,1610 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS Amazon Web Services Foundations Benchmark v7.0.0",
+ "Version": "7.0",
+ "Provider": "AWS",
+ "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.",
+ "Requirements": [
+ {
+ "Id": "2.1.1",
+ "Description": "Ensure centralized root access in AWS Organizations",
+ "Checks": [
+ "iam_root_credentials_management_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure centralized root access management is enabled to manage and secure root user credentials for member accounts in AWS Organizations. This allows the management account and an optional delegated administrator account to centrally delete, prevent recovery of, and if necessary, perform short-lived, scoped root-required actions in member accounts without maintaining long-term root user credentials in each account.",
+ "RationaleStatement": "The AWS account root user is a powerful, default administrative identity that is difficult to manage safely across many accounts. When each member account manages its own root credentials, organizations often end up with numerous long-lived root passwords, access keys, and MFA devices that are hard to inventory, rotate, and protect. Centralized root access management lets security teams remove or avoid creating root user credentials in member accounts, centrally review and manage any remaining root credentials, and perform necessary root-only tasks via short-term, task-scoped root sessions. This significantly reduces privileged credential sprawl, supports least privilege and dedicated administrator models, and improves visibility and auditability of root-level activity across the organization.",
+ "ImpactStatement": "Enabling centralized root access management changes how root user access is obtained and used in member accounts, but it does not automatically remove existing root credentials. Organizations must plan when and how to delete or disable any existing root passwords, access keys, signing certificates, and MFA devices in member accounts and update any workflows that still rely on direct root sign-in. Security and operations teams will need to use centrally initiated, short-lived root sessions for exceptional tasks that truly require root. This may require procedural changes and additional training, but it significantly reduces long-lived privileged credential sprawl across the organization.",
+ "RemediationProcedure": "1. Sign in to the AWS Management Console with the management account. 2. In the console search bar, type Organizations and open AWS Organizations. - On the Overview page, confirm that an Organization exists and that this account is listed as the Management account. 3. In AWS Organizations, choose Services. Locate AWS Identity and Access Management in the list and, if it is not already enabled, choose Enable trusted access and confirm. - This allows IAM to integrate with AWS Organizations to manage root access centrally. 4. In the console search bar, type IAM and open IAM. In the left navigation pane, choose Root access management. If you see Root access management is disabled, choose Enable. - In the enable dialog, confirm that you want to - \"Root credentials management\" and if desired - \"Privileged root actions in member accounts\" - In the Delegated administrator field, enter the account ID of the account that will manage root user access and take privileged actions on member accounts. AWS recommends using an account intended for security or management purposes, not a general workload account. - When you enable centralized root access in the console, IAM also enables trusted access for IAM in AWS Organizations if it isn't already enabled. - Choose Enable to save the configuration.",
+ "AuditProcedure": "1. Sign in to the AWS Management Console with the management account. 2. In the console search bar, type Organizations and open AWS Organizations. - On the Overview page, confirm that an Organization exists and that this account is listed as the Management account. 3. In AWS Organizations, choose Services. - Confirm that AWS Identity and Access Management appears in the list of services with trusted access enabled. 4. In the console search bar, type IAM and open IAM. In the left navigation pane, choose Root access management. Check the status banner. - If you see that Root access management is enabled and the feature card shows that root credentials management is turned on for member accounts, the organization has centralized root access management enabled. - If you see Root access management is disabled with an option to Enable, centralized root access is not yet enabled. 5. (Optional) On the same Root access management page, review the Delegated administrator information (if shown). - Confirm that the delegated account (if present) is a security or management-focused account, not a general workload account.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.2",
+ "Description": "Ensure authorization guardrails for all AWS Organization accounts",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that one or more baseline authorization policies such as Service Control Policies (SCPs) and/or Resource Control Policies (RCPs) are attached to all member accounts in AWS Organizations in accordance with organizational security requirements. Authorization policies act as preventive permission guardrails: SCPs define the maximum available permissions for IAM principals within accounts, while RCPs define the maximum available permissions for resources within accounts. These policies can enforce security invariants such as preventing disabling of key security services, restricting use of unapproved AWS Regions, or blocking external access to sensitive resources.",
+ "RationaleStatement": "Authorization policies do not grant permissions but instead set organization-wide limits on what actions principals can perform (SCPs) and what access can be granted to resources (RCPs), regardless of local IAM or resource-based policies. Without baseline guardrail authorization policies, each account can grant excessive or inconsistent permissions that disable logging, weaken security services, allow use of unapproved Regions and services, or permit unintended external access to resources. Attaching standard authorization policies to all member accounts enforces preventive, centralized control over high-risk actions and access patterns, supports least-privilege and role-based access control at scale, and helps ensure that all accounts and resources operate within the organization's defined security baseline.",
+ "ImpactStatement": "Enforcing baseline authorization policies for all member accounts can initially block some existing patterns, such as use of unapproved Regions, disabling security services, or granting broader permissions than the guardrails allow. Teams may need to adjust IAM policies, deployment pipelines, and exception processes so legitimate use cases remain possible within the new guardrails. This can introduce short-term operational overhead and require careful testing, especially when attaching new policies at the root or OU level.",
+ "RemediationProcedure": "Design or confirm baseline guardrail SCPs. 1. From the AWS Organizations console, go to Policies → Service control policies. - If you already have standard guardrail SCPs that implement your security baseline, note their names. - If you do not have such policies, choose Create policy and create at least one baseline guardrail SCP that encodes non-negotiable security requirements. 2. Do the same step as above but for RCPs if needed. From the AWS Organizations console, go to Policies → Resource control policies. 3. Attach guardrail authorization policies to the root and/or OUs. In AWS Organizations, choose AWS accounts, then select the Root of the organization. - Go to the Policies tab, then within section for Service control policies, choose Attach, and select the baseline guardrail SCP(s) you identified or created in step 1. - If using RCPs, then within section for Resource control policies, choose Attach, and select the baseline guardrail RCP(s) you identified or created in step 2. - If your design uses different guardrails per OU (for example, stricter policies for production OU), select each OU in turn and attach the appropriate guardrail SCPs and RCPs to those OUs. - AWS recommends testing authorization policies in a staging OU before attaching them broadly to the root to avoid unintended service disruption.",
+ "AuditProcedure": "Pre-requisite: you must run these CLI commands in the management account for the AWS Organization. 1. Before auditing, document or confirm your organization's baseline guardrail requirements. Common examples include: - Prevent disabling CloudTrail, AWS Config, GuardDuty, or Security Hub - Restrict usage to approved AWS Regions only - Protect central security or logging roles from modification - Deny external principal access to sensitive resources 2. List all SCPs and RCPs in the organization: ``` aws organizations list-policies --filter SERVICE_CONTROL_POLICY aws organizations list-policies --filter RESOURCE_CONTROL_POLICY ``` This returns a list of SCP/RCP policy IDs and names. 3. For each SCP/RCP, retrieve and review the policy document to determine if it implements your baseline guardrail requirements: ``` aws organizations describe-policy --policy-id <policy-id> ``` Review the `Content` field in the output to confirm the policy enforces organizational security requirements. If no SCPs/RCPs exist that implement your documented baseline guardrail requirements, note this as a gap and proceed to remediation. 4. List all accounts in the organization and note the account IDs: ``` aws organizations list-accounts --query 'Accounts[?Status==`ACTIVE`].[Id,Name]' --output table ``` 5. For each baseline guardrail Authorization policy identified in Step 2, list the accounts and OUs to which it is attached: ``` aws organizations list-targets-for-policy --policy-id <policy-id> ``` The output shows `TargetId` values representing accounts, OUs, or the root. 6. Compare the list of attached targets to your full account list. - If the policy is attached to the root, all accounts in the organization inherit it and this policy passes for coverage. - If the policy is attached to specific OUs, verify that all active member accounts belong to those OUs. - If the policy is attached to individual accounts, verify that all active member accounts are included. The environment passes this recommendation if: - All baseline guardrail authorization policies required by organizational security requirements exist. - Each baseline guardrail authorization policy is attached to all active member accounts either directly or via OU/root inheritance.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.3",
+ "Description": "Ensure Organizations management account is not used for workloads",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the AWS Organizations management account is used only for organizational governance tasks and does not host production workloads, applications, or business data. The management account is the most privileged account in an AWS Organization and performs sensitive administrative functions such as creating and managing member accounts, applying service control policies (SCPs), and managing consolidated billing. Workloads, applications, and associated data should be deployed in dedicated member accounts, not in the management account.",
+ "RationaleStatement": "The management account has unique privileges that cannot be restricted by SCPs, making it the highest-risk account in an organization. Deploying workloads or storing business data in the management account increases the attack surface and blast radius of a compromise. If a workload vulnerability or misconfiguration occurs in the management account, it could grant attackers access to organization-wide administrative capabilities.",
+ "ImpactStatement": "Restricting the management account to governance-only use may require creating new member accounts, redesigning existing account boundaries, and migrating workloads and data out of the management account. This can introduce short-term complexity and operational overhead. However, it reduces the blast radius of a compromise, simplifies security controls in the most privileged account, and aligns the environment with AWS multi-account and workload-isolation best practices.",
+ "RemediationProcedure": "1. Inventory all workload resources currently in the management account (compute, storage, databases, application services). 2. For each class of workload resource (for example, production, non-production, shared services), create or confirm dedicated member accounts within the organization and place them into the appropriate OUs. 3. For each workload resource, design a migration plan to the appropriate member account. - Execute the migrations in phases, starting with lower-risk environments (for example, development/test) before production. 4. Review and adjust IAM roles and permissions in the management account so that only personnel responsible for organization governance and security have access 5. Update architecture diagrams, runbooks, and onboarding processes to state that new workloads must be deployed only into designated workload accounts, not the management account.",
+ "AuditProcedure": "1. Confirm which AWS account is the management account for the organization (for example, via AWS Organizations \"Overview\" page or organizational documentation). 2. Ensure you have read-only access to review resources in this account. 3. Use your organization's standard discovery methods (for example, AWS Config, CMDB/asset inventory, or CSPM) to obtain a list of services and resources running in the management account. - At a minimum, identify compute, storage, database, and application services (for example, EC2, Lambda, ECS, S3, RDS, DynamoDB, API Gateway, load balancers). 4. For each identified resource, determine whether it is: - Governance/security: resources that support centralized management, logging, audit, or security (for example, org-wide CloudTrail, Config aggregator, Security Hub or GuardDuty delegated admin, billing/cost tooling). - Workload/business: resources that support business applications, production or non-production workloads, or customer-facing systems. 5. If any workload/business resources are present in the management account, record this as a gap and document the affected services and resource types",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.4",
+ "Description": "Ensure Organizational Units are structured by environment and sensitivity",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that AWS Organizations Organizational Units (OUs) are structured primarily by environment (for example, production, non-production, sandbox) and sensitivity (for example, security, logging, shared services, regulated workloads), rather than mirroring the corporate org chart. OUs should group accounts that share similar security requirements and controls so that appropriate authorization policies and other guardrails can be applied consistently at the OU level.",
+ "RationaleStatement": "A clear OU structure based on environment and sensitivity makes it easier to apply consistent guardrails and centralized security controls to accounts that have similar risk profiles and compliance needs. Poorly defined or ad-hoc OU structures complicate policy management, increase the chance of misapplied controls, and can lead to mixing workloads with different data sensitivities under the same set of controls.",
+ "ImpactStatement": "Restructuring OUs by environment and sensitivity can require moving accounts, changing inherited policies, and updating automation that assumes existing OU paths. This may introduce short-term operational overhead, including policy revalidation, testing of workloads under new guardrails, and coordination with application and platform teams to avoid unintended service disruption.",
+ "RemediationProcedure": "1. Work with security, platform, and application teams to agree on a small set of top-level OUs such as: - Security / Management - Shared Services / Infrastructure - Prod - Non-Prod (dev, test, staging) - You may also define dedicated OUs for highly regulated workloads. 2. In the AWS Organizations console (management account), navigate to AWS Accounts. Under the root, create the agreed top-level OUs. If needed, create child OUs under these. 3. Export or list all existing accounts and their current OUs. Create a simple mapping from each account to its target OU based on environment and sensitivity. 4. In the AWS Organizations console (management account), navigate to AWS Accounts. Move accounts into the new environment/sensitivity-based OUs according to your mapping. - Start with low-risk accounts (for example, sandbox and non-production) to validate effects of inherited policies and guardrails before moving production and high-sensitivity accounts. 5. After accounts have been moved, remove old OUs that no longer reflect the target structure. - Ensure no active accounts remain directly under the root unless explicitly justified and documented. 6. Update architecture docs, onboarding runbooks, and account request processes to require new accounts to be created in the correct OU based on environment and sensitivity.",
+ "AuditProcedure": "1. From the management account, use AWS Organizations console to obtain: - The full OU hierarchy (root, top-level and child OUs). - The list of accounts in each OU. 2. Review top-level and key OUs and determine whether they are clearly aligned to: - Environment (for example, production, non-production, sandbox). - Sensitivity/function (for example, security, logging, shared services, regulated). - Note any OUs whose purpose is unclear or that appear to be organized mainly by department or owner rather than environment/sensitivity. 3. For each environment/sensitivity OU, select a sample of accounts and verify that their primary workloads match the OU's stated purpose. - Note any accounts that mix production and non-production workloads in the same OU when separate OUs are defined. - Note any accounts that place highly sensitive or regulated workloads in OUs that are intended for lower-sensitivity use.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.5",
+ "Description": "Ensure delegated admin manages AWS Organizations policies",
+ "Checks": [
+ "organizations_delegated_administrators"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that a dedicated member account is configured as a delegated administrator for AWS Organizations to manage organization policies (SCPs, RCPs, tag policies, backup policies, AI opt-out policies) and other Organizations features, instead of performing these tasks directly from the management account. The delegated administrator for AWS Organizations is configured via a resource-based delegation policy in the management account, which grants specific member accounts limited permissions to perform Organizations policy and account management actions across the organization. This allows policy management, OU operations, and other governance tasks to be handled from purpose-built accounts without requiring broad access to the management account.",
+ "RationaleStatement": "The management account has unique and high privileges to manage AWS Organizations (for example, creating/deleting accounts, managing org structures) and is not subject to guardrails like SCPs. Without a delegated administrator for Organizations, all policy management, OU changes, and account governance must be performed directly from the management account. This results in concentrating operational activity in the most powerful account. Configuring a dedicated member account as a delegated administrator for Organizations policy management distributes these tasks to a purpose-built AWS account that can be protected by SCPs and other controls, reduces the number of users and roles that need management-account access, and supports separation of duties while maintaining centralized control over organization-wide features.",
+ "ImpactStatement": "Configuring a delegated administrator for AWS Organizations requires creating or identifying a dedicated member account for policy management and granting it specific permissions via a resource-based delegation policy. Existing workflows, automation, and user access patterns that currently perform Organizations policy tasks directly from the management account must be updated to use the delegated account instead. This introduces short-term operational overhead and testing to ensure policy creation, attachment, and management continue to function correctly from the new account.",
+ "RemediationProcedure": "1. Identify a dedicated member account for governance/policy management (for example, create a new \"Policy Management\" account or use an existing Security account) 2. You must be in the management account with permissions to manage Organizations resource policies. Navigate to AWS Organizations console, then click on Settings and browse to \"Delegated administrator for AWS Organizations\" section. 3. If no policy exists, click on Delegate. If a policy exists, choose Edit policy. - In the policy editor, paste or construct a delegation policy statement mentioning the Principal as the AWS account Root which is being delegated access to, and the Actions with the list of least-privileged permissions that could be performed by the delegated AWS account. - Save and validate the delegation policy. 4. Sign in to the delegated administrator account and open the AWS Organizations console. - Confirm that policy management (Policies, Attach/Detach, etc.) is accessible and that users/roles in this account can perform Organizations tasks without management-account access. 5. Grant IAM roles/users in the delegated admin account only the permissions needed for Organizations policy management. 6. Update procedures so that routine Organizations policy tasks are performed from the delegated account, reserving the management account for tasks that only it can perform",
+ "AuditProcedure": "1. Sign in to the AWS Organizations console. From the AWS Accounts section, verify that this is the management account for the organization. 2. In the AWS Organizations console, navigate to Settings. Scroll to the Delegated administrator for AWS Organizations section 3. Review the delegation policy status: - If a delegation policy is configured and shows one or more member accounts registered to manage Organizations policies, proceed to step 4. - If no delegation policy is configured or the section shows No delegated administrator (or equivalent), the audit fails because Organizations management is performed directly from the management account. 4. In the Delegated administrator section, note the account IDs registered for Organizations policy management. Confirm that the delegated accounts are purpose-built governance, security, or policy management accounts, not general workload, sandbox, or development accounts. 5. View the delegation policy details to confirm it grants appropriate least-privilege permissions for policy types (for example, SCPs, tag policies, backup policies) and actions (CreatePolicy, AttachPolicy, UpdatePolicy, etc.).",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.6",
+ "Description": "Ensure delegated admins manage AWS Organizations-integrated services",
+ "Checks": [
+ "organizations_delegated_administrators"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that AWS services (such as AWS CloudTrail) which integrate with AWS Organizations and support delegated administration are managed through delegated administrator member accounts instead of directly from the Organizations management account. For each such service, the management account should enable trusted access and register a purpose-built member account as the delegated administrator, so that this account can perform service-level administration across all organization accounts.",
+ "RationaleStatement": "The management account has unique and high privileges to manage AWS Organizations (for example, creating/deleting accounts, managing org structures) and is not subject to guardrails like SCPs. Without delegated administrators, organization-wide security, logging, and management services must be operated directly from the management account, concentrating operational activity and credentials in the most privileged account in the organization. Registering member accounts as delegated administrators for AWS services distributes service-specific administration to dedicated security, logging, or operations accounts that can be restricted by SCPs, monitored like other workload accounts, and aligned with team responsibilities, while reducing day-to-day use of the management account.",
+ "ImpactStatement": "Configuring a delegated administrator for AWS Services that integrate with AWS Organizations requires creating or identifying a dedicated member account for policy management and granting it specific permissions. Existing workflows, automation, and user access patterns that currently perform tasks directly from the management account must be updated to use the delegated account instead. This introduces short-term operational overhead and testing to ensure policy creation, attachment, and management continue to function correctly from the new account.",
+ "RemediationProcedure": "Note: This remediation section uses AWS CloudTrail as a concrete example. You must perform similar procedure for all other AWS services that integrate with AWS Organizations and support delegated administration that are in use in your environment. 1. In the management account, verify that trusted access for CloudTrail is enabled in AWS Organizations (AWS Organizations → Services). 2. In the management account CloudTrail console, choose Settings in the left navigation pane. Scroll to Organization delegated administrators. 3. Click on \"Register administrator\" - Enter the account ID of the designated Logging or Security account. - Click on Register administrator. CloudTrail will automatically create the necessary service-linked roles and register the account. 4. In the delegated administrator account, open the CloudTrail console and confirm that the organization trail is visible and administrative actions are accessible. 5. Update operational runbooks so that routine CloudTrail administration is performed from the delegated admin account, not the management account.",
+ "AuditProcedure": "Note: This audit uses AWS CloudTrail as a concrete example. You must perform similar audits for all other AWS services that integrate with AWS Organizations and support delegated administration that are in use in your environment. 1. Sign in to the management account and open the CloudTrail console. 2. In the left navigation pane, choose Trails. - Verify that there is at least one organization trail (trail with Apply trail to all accounts in my organization or equivalent setting enabled) - If CloudTrail is only configured as single-account trails and no organization trail is in use, note that delegated admin for CloudTrail is not in scope and this recommendation is not applicable for CloudTrail in this environment. 3. In the same management account CloudTrail console, choose Settings in the left navigation pane, and scroll to the Organization delegated administrators section. 4. Verify the configuration for Organization delegated administrators: - Verify that at least one member account ID (not the management account) is listed as a delegated administrator for CloudTrail. - Verify that the account(s) are appropriate for security/logging operations (for example, a named Security or Logging account, not a sandbox or general workload account). - If the section shows \"No delegated administrators\" when an organization trail is in use, CloudTrail is effectively administered from the management account and this is a gap.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2",
+ "Description": "Maintain current AWS account contact details",
+ "Checks": [
+ "account_maintain_current_contact_details"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of the Acceptable Use Policy or indicative of a likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.",
+ "RationaleStatement": "If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS's best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:\\*Billing). **From Console:** 1. Sign in to the AWS Management Console and open the `Billing and Cost Management` console at https://console.aws.amazon.com/billing/home#/. 2. On the navigation bar, choose your account name, and then choose `Account`. 3. On the `Account Settings` page, next to `Account Settings`, choose `Edit`. 4. Next to the field that you need to update, choose `Edit`. 5. After you have entered your changes, choose `Save changes`. 6. After you have made your changes, choose `Done`. 7. To edit your contact information, under `Contact Information`, choose `Edit`. 8. For the fields that you want to change, type your updated information, and then choose `Update`. **From Command Line:** 1. Run the following command: ``` aws account put-contact-information --contact-information '{\"AddressLine1\": \"<AddressLine 1>\", \"AddressLine2\": \"<AddressLine 2>\", \"City\": \"<City>\", \"CompanyName\": \"<Company Name>\", \"CountryCode\": \"<Country Code>\", \"FullName\": \"<Full Name>\", \"PhoneNumber\": \"<Phone Number>\", \"PostalCode\": \"<Postal Code>\", \"StateOrRegion\": \"<State or Region>\"}' ```",
+ "AuditProcedure": "This activity can only be performed via the AWS Console, with a user who has permission to read and write Billing information (aws-portal:\\*Billing). 1. Sign in to the AWS Management Console and open the `Billing and Cost Management` console at https://console.aws.amazon.com/billing/home#/. 2. On the navigation bar, choose your account name, and then choose `Account`. 3. On the `Account Settings` page, review and verify the current details. 4. Under `Contact Information`, review and verify the current details.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#contact-info",
+ "DefaultValue": "By default, AWS account contact information (email and telephone) is set to the values provided at account creation. These usually reference a single individual rather than a shared alias or group contact."
+ }
+ ]
+ },
+ {
+ "Id": "2.3",
+ "Description": "Ensure security contact information is registered",
+ "Checks": [
+ "account_security_contact_information_is_registered"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.",
+ "RationaleStatement": "Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to establish security contact information: **From Console:** 1. Click on your account name at the top right corner of the console. 2. From the drop-down menu Click `My Account` 3. Scroll down to the `Alternate Contacts` section 4. Enter contact information in the `Security` section **From Command Line:** Run the following command with the following input parameters: --email-address, --name, and --phone-number. ``` aws account put-alternate-contact --alternate-contact-type SECURITY ``` **Note:** Consider specifying an internal email distribution list to ensure emails are regularly monitored by more than one individual.",
+ "AuditProcedure": "Perform the following to determine if security contact information is present: **From Console:** 1. Click on your account name at the top right corner of the console 2. From the drop-down menu Click `My Account` 3. Scroll down to the `Alternate Contacts` section 4. Ensure contact information is specified in the `Security` section **From Command Line:** 1. Run the following command: ``` aws account get-alternate-contact --alternate-contact-type SECURITY ``` 2. Ensure proper contact information is specified for the `Security` contact.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4",
+ "Description": "Ensure no 'root' user account access key exists",
+ "Checks": [
+ "iam_no_root_access_key"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.",
+ "RationaleStatement": "Deleting access keys associated with the 'root' user account limits vectors by which the account can be compromised. Additionally, deleting the 'root' access keys encourages the creation and use of role based accounts that are least privileged.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to delete active 'root' user access keys. **From Console:** 1. Sign in to the AWS Management Console as 'root' and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. Click on `<root_account>` at the top right and select `My Security Credentials` from the drop down list. 3. On the pop out screen Click on `Continue to Security Credentials`. 4. Click on `Access Keys` (Access Key ID and Secret Access Key). 5. If there are active keys, under `Status`, click `Delete` (Note: Deleted keys cannot be recovered). Note: While a key can be made inactive, this inactive key will still show up in the CLI command from the audit procedure, and may lead to the root user being falsely flagged as being non-compliant.",
+ "AuditProcedure": "Perform the following to determine if the 'root' user account has access keys: **From Console:** 1. Login to the AWS Management Console. 2. Click `Services`. 3. Click `IAM`. 4. Click on `Credential Report`. 5. This will download a `.csv` file which contains credential usage for all IAM users within an AWS Account - open this file. 6. For the `<root_account>` user, ensure the `access_key_1_active` and `access_key_2_active` fields are set to `FALSE`. **From Command Line:** Run the following command: ``` aws iam get-account-summary | grep AccountAccessKeysPresent ``` If no 'root' access keys exist the output will show `AccountAccessKeysPresent: 0,`. If the output shows a 1, then 'root' keys exist and should be deleted.",
+ "AdditionalInformation": "- IAM User account root for us-gov cloud regions is not enabled by default. However, on request to AWS support enables 'root' access only through access-keys (CLI, API methods) for us-gov cloud region. - Implement regular checks and alerts for any creation of new root access keys to promptly address any unauthorized or accidental creation.",
+ "References": "http://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html:http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html:http://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html:https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.5",
+ "Description": "Ensure MFA is enabled for the 'root' user account",
+ "Checks": [
+ "iam_root_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual personal devices (non-personal virtual MFA). This lessens the risks of losing access to the MFA due to device loss, device trade-in, or if the individual owning the device is no longer employed at the company. Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case it is neither possible nor necessary to configure root MFA in the member account.",
+ "RationaleStatement": "Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that emits a time-sensitive key and have knowledge of a credential.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**Note:** To manage MFA devices for the 'root' AWS account, you must use your 'root' account credentials to sign in to AWS. You cannot manage MFA devices for the 'root' account using other credentials. Perform the following to establish MFA for the 'root' user account: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. Choose `Dashboard` , and under `Security Status` , expand `Activate MFA` on your root account. 3. Choose `Activate MFA` 4. In the wizard, choose `A virtual MFA` device and then choose `Next Step` . 5. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes. 6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see [Virtual MFA Applications](http://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications).) If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device). 7. Determine whether the MFA app supports QR codes, and then do one of the following: - Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code. - In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application. When you are finished, the virtual MFA device starts generating one-time passwords. In the Manage MFA Device wizard, in the Authentication Code 1 box, type the one-time password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the Authentication Code 2 box. Choose Assign Virtual MFA.",
+ "AuditProcedure": "Perform the following to determine if the 'root' user account is enabled and has MFA setup: **From Console:** 1. Login to the AWS Management Console 2. Click `Services` 3. Click `IAM` 4. Click on `Credential Report` 5. This will download a `.csv` file which contains credential usage for all IAM users within an AWS Account - open this file 6. For the `<root_account>` user, ensure the `mfa_active` field is set to `TRUE` or the `password_enabled` field is set to `FALSE` **From Command Line:** 1. Run the following command: ``` aws iam get-account-summary | grep AccountMFAEnabled aws iam get-account-summary | grep AccountPasswordPresent ``` 2. Ensure the AccountMFAEnabled property is set to 1 or the AccountPasswordPresent property is set to 0",
+ "AdditionalInformation": "IAM User account root for us-gov cloud regions does not have console access. This recommendation is not applicable for us-gov cloud regions.",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-root:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.6",
+ "Description": "Ensure hardware MFA is enabled for the 'root' user account",
+ "Checks": [
+ "iam_root_hardware_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA. Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case it is neither possible nor necessary to configure root MFA in the member account.",
+ "RationaleStatement": "A hardware MFA has a smaller attack surface than a virtual MFA. For example, a hardware MFA does not suffer the attack surface introduced by the mobile smartphone on which a virtual MFA resides. **Note**: Using hardware MFA for numerous AWS accounts may create a logistical device management issue. If this is the case, consider implementing this Level 2 recommendation selectively for the highest security AWS accounts, while applying the Level 1 recommendation to the remaining accounts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**Note:** To manage MFA devices for the AWS 'root' user account, you must use your 'root' account credentials to sign in to AWS. You cannot manage MFA devices for the 'root' account using other credentials. Perform the following to establish a hardware MFA for the 'root' user account: 1. Open the AWS Management Console and sign in using your root user credentials. 2. On the right side of the navigation bar, choose your account name, and choose Security credentials. 3. In the Multi-Factor Authentication (MFA) section, choose Assign MFA device. 4. In the wizard, type a Device name, choose Authenticator app, and then choose Next. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the secret configuration key that is available for manual entry on devices that do not support QR codes. 5. Open the virtual MFA app on the device. If the virtual MFA app supports multiple virtual MFA devices or accounts, choose the option to create a new virtual MFA device or account. 6. The easiest way to configure the app is to use the app to scan the QR code. If you cannot scan the code, you can type the configuration information manually. The QR code and secret configuration key generated by IAM are tied to your AWS account. To use the QR code to configure the virtual MFA device, from the wizard, choose Show QR code. Then follow the app instructions for scanning the code. For example, you might need to choose the camera icon or choose a command like Scan account barcode, and then use the device's camera to scan the QR code. To manual entry secret key on devices, in the Set up device wizard, choose Show secret key, and then type the secret key into your MFA app. 7. In the wizard, in the MFA code 1 box, type the one-time password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the MFA code 2 box. Choose Add MFA. Remediation for this recommendation is not available through AWS CLI.",
+ "AuditProcedure": "Perform the following to determine if the 'root' user account has a hardware MFA setup: 1. Run the following command to determine if the 'root' account has MFA setup: ``` aws iam get-account-summary | grep \"AccountMFAEnabled\" aws iam get-account-summary | grep \"AccountPasswordPresent\" ``` The `AccountMFAEnabled` property is set to `1` will ensure that the 'root' user account has MFA (Virtual or Hardware) Enabled. `AccountPasswordPresent` set to `0` indicates that the `root` console credential has been removed. If `AccountMFAEnabled` property is set to `0` and `AccountPasswordPresent` is set to `1` the account is not compliant with this recommendation. 2. If `AccountMFAEnabled` property is set to `1`, determine 'root' account has Hardware MFA enabled. Run the following command to list all virtual MFA devices: ``` aws iam list-virtual-mfa-devices ``` If the output contains one MFA with the following Serial Number, it means the MFA is virtual, not hardware and the account is not compliant with this recommendation: `SerialNumber: arn:aws:iam::_<aws_account_number>_:mfa/root-account-mfa-device`",
+ "AdditionalInformation": "IAM User account 'root' for us-gov cloud regions does not have console access. This control is not applicable for us-gov cloud regions.",
+ "References": "CCE-78911-5:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html#enable-hw-mfa-for-root:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html",
+ "DefaultValue": "By default, the AWS root user does not have a hardware MFA device assigned. MFA must be explicitly configured, and if enabled by default it will be virtual (software-based), not hardware."
+ }
+ ]
+ },
+ {
+ "Id": "2.7",
+ "Description": "Eliminate use of the 'root' user for administrative and daily tasks",
+ "Checks": [
+ "iam_avoid_root_usage"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.",
+ "RationaleStatement": "The 'root user' has unrestricted access to and control over all account resources. Use of it is inconsistent with the principles of least privilege and separation of duties, and can lead to unnecessary harm due to error or account compromise.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you find that the 'root' user account is being used for daily activities, including administrative tasks that do not require the 'root' user: 1. Change the 'root' user password. 2. Deactivate or delete any access keys associated with the 'root' user. Remember, anyone who has 'root' user credentials for your AWS account has unrestricted access to and control of all the resources in your account, including billing information.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console at `https://console.aws.amazon.com/iam/`. 2. In the left pane, click `Credential Report`. 3. Click on `Download Report`. 4. Open or Save the file locally. 5. Locate the `<root account>` under the user column. 6. Review `password_last_used, access_key_1_last_used_date, access_key_2_last_used_date` to determine when the 'root user' was last used. **From Command Line:** Run the following CLI commands to provide a credential report for determining the last time the 'root user' was used: ``` aws iam generate-credential-report ``` ``` aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,5,11,16 | grep -B1 '<root_account>' ``` Review `password_last_used`, `access_key_1_last_used_date`, `access_key_2_last_used_date` to determine when the _root user_ was last used. **Note:** There are a few conditions under which the use of the 'root' user account is required. Please see the reference links for all of the tasks that require use of the 'root' user.",
+ "AdditionalInformation": "The 'root' user for us-gov cloud regions is not enabled by default. However, on request to AWS support, they can enable the 'root' user and grant access only through access-keys (CLI, API methods) for us-gov cloud region. If the 'root' user for us-gov cloud regions is enabled, this recommendation is applicable. Monitoring usage of the 'root' user can be accomplished by implementing recommendation 3.3 Ensure a log metric filter and alarm exist for usage of the 'root' user.",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html:https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.8",
+ "Description": "Ensure IAM password policy requires minimum length of 14 or greater",
+ "Checks": [
+ "iam_password_policy_minimum_length_14"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.",
+ "RationaleStatement": "Setting a password complexity policy increases account resiliency against brute force login attempts.",
+ "ImpactStatement": "Enforcing a minimum password length of 14 characters enhances security by making passwords more resistant to brute force attacks. However, it may require users to create longer and potentially more complex passwords, which could impact user convenience.",
+ "RemediationProcedure": "Perform the following to set the password policy as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Set Minimum password length to `14` or greater. 5. Click Apply password policy **From Command Line:** ``` aws iam update-account-password-policy --minimum-password-length 14 ``` Note: All commands starting with aws iam update-account-password-policy can be combined into a single command.",
+ "AuditProcedure": "Perform the following to ensure the password policy is configured as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Ensure Minimum password length is set to 14 or greater. **From Command Line:** ``` aws iam get-account-password-policy ``` Ensure the output of the above command includes MinimumPasswordLength: 14 (or higher)",
+ "AdditionalInformation": "Ensure the password policy also includes requirements for password complexity, such as the inclusion of uppercase letters, lowercase letters, numbers, and special characters: ``` aws iam update-account-password-policy --require-uppercase-characters --require-lowercase-characters --require-numbers --require-symbols ```",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.9",
+ "Description": "Ensure IAM password policy prevents password reuse",
+ "Checks": [
+ "iam_password_policy_reuse_24"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.",
+ "RationaleStatement": "Preventing password reuse increases account resiliency against brute force login attempts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to set the password policy as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Check Prevent password reuse 5. Set Number of passwords to remember is set to `24` **From Command Line:** ``` aws iam update-account-password-policy --password-reuse-prevention 24 ``` Note: All commands starting with aws iam update-account-password-policy can be combined into a single command.",
+ "AuditProcedure": "Perform the following to ensure the password policy is configured as prescribed: **From Console:** 1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings) 2. Go to IAM Service on the AWS Console 3. Click on Account Settings on the Left Pane 4. Ensure Prevent password reuse is checked 5. Ensure Number of passwords to remember is set to 24 **From Command Line:** ``` aws iam get-account-password-policy ``` Ensure the output of the above command includes PasswordReusePrevention: 24",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#configure-strong-password-policy",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.10",
+ "Description": "Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password",
+ "Checks": [
+ "iam_user_mfa_enabled_console_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.",
+ "RationaleStatement": "Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that displays a time-sensitive key and have knowledge of a credential.",
+ "ImpactStatement": "AWS will soon end support for SMS multi-factor authentication (MFA). New customers are not allowed to use this feature. We recommend that existing customers switch to an alternative method of MFA.",
+ "RemediationProcedure": "Perform the following to enable MFA: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at 'https://console.aws.amazon.com/iam/' 2. In the left pane, select `Users`. 3. In the `User Name` list, choose the name of the intended MFA user. 4. Choose the `Security Credentials` tab, and then choose `Manage MFA Device`. 5. In the `Manage MFA Device wizard`, choose `Virtual MFA` device, and then choose `Continue`. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes. 6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see Virtual MFA Applications at https://aws.amazon.com/iam/details/mfa/#Virtual_MFA_Applications). If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device). 7. Determine whether the MFA app supports QR codes, and then do one of the following: - Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code. - In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application. When you are finished, the virtual MFA device starts generating one-time passwords. 8. In the `Manage MFA Device wizard`, in the `MFA Code 1 box`, type the `one-time password` that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second `one-time password` into the `MFA Code 2 box`. 9. Click `Assign MFA`.",
+ "AuditProcedure": "Perform the following to determine if a MFA device is enabled for all IAM users having a console password: **From Console:** 1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the left pane, select `Users` 3. If the `MFA` or `Password age` columns are not visible in the table, click the gear icon at the upper right corner of the table and ensure a checkmark is next to both, then click `Close`. 4. Ensure that for each user where the `Password age` column shows a password age, the `MFA` column shows `Virtual`, `U2F Security Key`, or `Hardware`. **From Command Line:** 1. Run the following command (OSX/Linux/UNIX) to generate a list of all IAM users along with their password and MFA status: ``` aws iam generate-credential-report ``` ``` aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8 ``` 2. The output of this command will produce a table similar to the following: ``` user,password_enabled,mfa_active elise,false,false brandon,true,true rakesh,false,false helene,false,false paras,true,true anitha,false,false ``` 3. For any column having `password_enabled` set to `true` , ensure `mfa_active` is also set to `true.`",
+ "AdditionalInformation": "**Forced IAM User Self-Service Remediation** Amazon has published a pattern that requires users to set up MFA through self-service before they gain access to their complete set of permissions. Until they complete this step, they cannot access their full permissions. This pattern can be used for new AWS accounts. It can also be applied to existing accounts; it is recommended that users receive instructions and a grace period to complete MFA enrollment before active enforcement on existing AWS accounts.",
+ "References": "https://tools.ietf.org/html/rfc6238:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#enable-mfa-for-privileged-users:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html:https://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.11",
+ "Description": "Ensure credentials unused for 45 days or more are disabled",
+ "Checks": [
+ "iam_user_accesskey_unused",
+ "iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.",
+ "RationaleStatement": "Disabling or removing unnecessary credentials will reduce the window of opportunity for credentials associated with a compromised or abandoned account to be used.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** Perform the following to manage Unused Password (IAM user console access) 1. Login to the AWS Management Console: 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click on `Security Credentials` 6. Select user whose `Console last sign-in` is greater than 45 days 7. Click `Security credentials` 8. In section `Sign-in credentials`, `Console password` click `Manage` 9. Under Console Access select `Disable` 10. Click `Apply` Perform the following to deactivate Access Keys: 1. Login to the AWS Management Console: 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click on `Security Credentials` 6. Select any access keys that are over 45 days old and that have been used and - Click on `Make Inactive` 7. Select any access keys that are over 45 days old and that have not been used and - Click the X to `Delete`",
+ "AuditProcedure": "Perform the following to determine if unused credentials exist: **From Console:** 1. Login to the AWS Management Console 2. Click `Services` 3. Click `IAM` 4. Click on `Users` 5. Click the `Settings` (gear) icon. 6. Select `Console last sign-in`, `Access key last used`, and `Access Key Id` 7. Click on `Close` 8. Check and ensure that `Console last sign-in` is less than 45 days ago. **Note** - `Never` means the user has never logged in. 9. Check and ensure that `Access key age` is less than 45 days and that `Access key last used` does not say `None` If the user hasn't signed into the Console in the last 45 days or Access keys are over 45 days old refer to the remediation. **From Command Line:** **Download Credential Report:** 1. Run the following commands: ``` aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,5,6,9,10,11,14,15,16 | grep -v '^<root_account>' ``` **Ensure unused credentials do not exist:** 2. For each user having `password_enabled` set to `TRUE` , ensure `password_last_used_date` is less than `45` days ago. - When `password_enabled` is set to `TRUE` and `password_last_used` is set to `No_Information` , ensure `password_last_changed` is less than 45 days ago. 3. For each user having an `access_key_1_active` or `access_key_2_active` to `TRUE` , ensure the corresponding `access_key_n_last_used_date` is less than `45` days ago. - When a user having an `access_key_x_active` (where x is 1 or 2) to `TRUE` and corresponding access_key_x_last_used_date is set to `N/A`, ensure `access_key_x_last_rotated` is less than 45 days ago.",
+ "AdditionalInformation": "<root_account> is excluded in the audit since the root account should not be used for day-to-day business and would likely be unused for more than 45 days.",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#remove-credentials:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.12",
+ "Description": "Ensure access keys are rotated every 90 days or less",
+ "Checks": [
+ "iam_rotate_access_key_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be rotated regularly.",
+ "RationaleStatement": "Rotating access keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. Access keys should be rotated to ensure that data cannot be accessed with an old key which might have been lost, cracked, or stolen.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to rotate access keys: **From Console:** 1. Go to the Management Console (https://console.aws.amazon.com/iam) 2. Click on `Users` 3. Click on `Security Credentials` 4. As an Administrator - Click on `Make Inactive` for keys that have not been rotated in `90` Days 5. As an IAM User - Click on `Make Inactive` or `Delete` for keys which have not been rotated or used in `90` Days 6. Click on `Create Access Key` 7. Update programmatic calls with new Access Key credentials **From Command Line:** 1. While the first access key is still active, create a second access key, which is active by default. Run the following command: ``` aws iam create-access-key --user-name <iam_user> ``` At this point, the user has two active access keys. 2. Update all applications and tools to use the new access key. 3. Determine whether the first access key is still in use by using this command: ``` aws iam get-access-key-last-used --access-key-id <iam_access_key_id> ``` 4. One approach is to wait several days and then check the old access key for any use before proceeding. Even if step 3 indicates no use of the old key, it is recommended that you do not immediately delete the first access key. Instead, change the state of the first access key to Inactive using this command: ``` aws iam update-access-key --user-name <iam_user> --access-key-id <iam_access_key_id> --status Inactive ``` 5. Use only the new access key to confirm that your applications are working. Any applications and tools that still use the original access key will stop working at this point because they no longer have access to AWS resources. If you find such an application or tool, you can switch its state back to Active to reenable the first access key. Then return to step 2 and update this application to use the new key. 6. After you wait some period of time to ensure that all applications and tools have been updated, you can delete the first access key with this command: ``` aws iam delete-access-key --user-name <iam_user> --access-key-id <iam_access_key_id> ```",
+ "AuditProcedure": "Perform the following to determine if access keys are rotated as prescribed: **From Console:** 1. Go to the Management Console (https://console.aws.amazon.com/iam) 2. Click on `Users` 3. For each user, go to `Security Credentials` 4. Review each key under `Access Keys` 5. For each key that shows `Active` for status, ensure that `Created` is less than or equal to `90 days ago`. **From Command Line:** ``` aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d ``` The `access_key_1_last_rotated` and the `access_key_2_last_rotated` fields in this file notes the date and time, in ISO 8601 date-time format, when the user's access key was created or last changed. If the user does not have an active access key, the value in this field is N/A (not applicable).",
+ "AdditionalInformation": "",
+ "References": "CCE-78902-4:https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_finding-unused.html:https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",
+ "DefaultValue": "By default, AWS does not enforce access key rotation. Access keys remain valid until they are manually deactivated or deleted."
+ }
+ ]
+ },
+ {
+ "Id": "2.13",
+ "Description": "Ensure IAM users receive permissions only through groups",
+ "Checks": [
+ "iam_policy_attached_only_to_group_or_roles"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are four ways to define policies for a user: 1) Edit the user policy directly, also known as an inline or user policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy; 4) add the user to an IAM group that has an inline policy. Only the third implementation is recommended.",
+ "RationaleStatement": "Assigning IAM policies solely through groups unifies permissions management into a single, flexible layer that is consistent with organizational functional roles. By unifying permissions management, the likelihood of excessive permissions is reduced.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** Perform the following to create an IAM group and assign a policy to it: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/. 2. In the navigation pane, click `Groups` and then click `Create New Group`. 3. In the `Group Name` box, type the name of the group and then click `Next Step`. 4. In the list of policies, select the check box for each policy that you want to apply to all members of the group. Then click `Next Step`. 5. Click `Create Group`. Perform the following to add a user to a given group: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/. 2. In the navigation pane, click `Groups`. 3. Select the group to add a user to. 4. Click `Add Users To Group`. 5. Select the users to be added to the group. 6. Click `Add Users`. Perform the following to remove a direct association between a user and policy: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/. 2. In the left navigation pane, click on Users. 3. For each user: - Select the user - Click on the `Permissions` tab - Expand `Permissions policies` - Click `X` for each policy; then click Detach or Remove (depending on policy type) **From Command Line:** 1. Create the IAM user group: ``` aws iam create-group --group-name <new_IAM_group_name> ``` 2. Attach the policy to the IAM user group: ``` aws iam attach-group-policy --group-name <new_IAM_group_name> --policy-arn <IAM_policy_ARN> ``` 3. Perform the following to add a user to a given group: ``` aws iam add-user-to-group --user-name <IAM_user_name> --group-name <new_IAM_group_name> ``` 4. Perform the following to remove a direct association between a user and policy: ``` aws iam detach-user-policy --user-name <IAM_user_name> --policy-arn <IAM_policy_ARN> ``` 5. Delete an inline policy from an IAM user: ``` aws iam delete-user-policy --user-name <IAM_user_name> --policy-name <IAM_policy_name> ```",
+ "AuditProcedure": "Perform the following to determine if an inline policy is set or a policy is directly attached to users: 1. Run the following to get a list of IAM users: ``` aws iam list-users --query 'Users[*].UserName' --output text ``` 2. For each user returned, run the following command to determine if any policies are attached to them: ``` aws iam list-attached-user-policies --user-name <iam_user> aws iam list-user-policies --user-name <iam_user> ``` 3. If any policies are returned, the user has an inline policy or direct policy attachment.",
+ "AdditionalInformation": "",
+ "References": "http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html:CCE-78912-3",
+ "DefaultValue": "By default, AWS allows IAM policies to be attached directly to users, groups, or roles. There is no restriction preventing direct user policies unless explicitly enforced by organizational standards."
+ }
+ ]
+ },
+ {
+ "Id": "2.14",
+ "Description": "Ensure IAM policies that allow full \"*:*\" administrative privileges are not attached",
+ "Checks": [
+ "iam_aws_attached_policy_no_administrative_privileges",
+ "iam_customer_attached_policy_no_administrative_privileges"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege—that is, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.",
+ "RationaleStatement": "It's more secure to start with a minimum set of permissions and grant additional permissions as necessary, rather than starting with permissions that are too lenient and then attempting to tighten them later. Providing full administrative privileges instead of restricting access to the minimum set of permissions required for the user exposes resources to potentially unwanted actions. IAM policies that contain a statement with `Effect: Allow` and `Action: *` over `Resource: *` should be removed.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** Perform the following to detach the policy that has full administrative privileges: 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the navigation pane, click Policies and then search for the policy name found in the audit step. 3. Select the policy that needs to be deleted. 4. In the policy action menu, select `Detach`. 5. Select all Users, Groups, Roles that have this policy attached. 6. Click `Detach Policy`. 7. Select the newly detached policy and select `Delete`. **From Command Line:** Perform the following to detach the policy that has full administrative privileges as found in the audit step: 1. Lists all IAM users, groups, and roles that the specified managed policy is attached to. ``` aws iam list-entities-for-policy --policy-arn <policy_arn> ``` 2. Detach the policy from all IAM Users: ``` aws iam detach-user-policy --user-name <iam_user> --policy-arn <policy_arn> ``` 3. Detach the policy from all IAM Groups: ``` aws iam detach-group-policy --group-name <iam_group> --policy-arn <policy_arn> ``` 4. Detach the policy from all IAM Roles: ``` aws iam detach-role-policy --role-name <iam_role> --policy-arn <policy_arn> ```",
+ "AuditProcedure": "Perform the following to determine existing policies: **From Command Line:** 1. Run the following to get a list of IAM policies: ``` aws iam list-policies --only-attached --output text ``` 2. For each policy returned, run the following command to determine if any policy is allowing full administrative privileges on the account: ``` aws iam get-policy-version --policy-arn <policy_arn> --version-id <version> ``` 3. In the output, the policy should not contain any Statement block with `Effect: Allow` and `Action` set to `*` and `Resource` set to `*`.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html:https://docs.aws.amazon.com/cli/latest/reference/iam/index.html#cli-aws-iam",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.15",
+ "Description": "Ensure a support role has been created to manage incidents with AWS Support",
+ "Checks": [
+ "iam_support_role_created"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.",
+ "RationaleStatement": "By implementing least privilege for access control, an IAM Role will require an appropriate IAM Policy to allow Support Center Access in order to manage Incidents with AWS Support.",
+ "ImpactStatement": "All AWS Support plans include an unlimited number of account and billing support cases, with no long-term contracts. Support billing calculations are performed on a per-account basis for all plans. Enterprise Support plan customers have the option to include multiple enabled accounts in an aggregated monthly billing calculation. Monthly charges for the Business and Enterprise support plans are based on each month's AWS usage charges, subject to a monthly minimum, billed in advance. When assigning rights, keep in mind that other policies may grant access to Support as well. This may include AdministratorAccess and other policies including customer managed policies. Utilizing the AWS managed 'AWSSupportAccess' role is one simple way of ensuring that this permission is properly granted. To better support the principle of separation of duties, it would be best to only attach this role where necessary.",
+ "RemediationProcedure": "**From Command Line:** 1. Create an IAM role for managing incidents with AWS: - Create a trust relationship policy document that allows <iam_user> to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json: ``` { Version: 2012-10-17, Statement: [ { Effect: Allow, Principal: { AWS: <iam_user> }, Action: sts:AssumeRole } ] } ``` 2. Create the IAM role using the above trust policy: ``` aws iam create-role --role-name <aws_support_iam_role> --assume-role-policy-document file:///tmp/TrustPolicy.json ``` 3. Attach 'AWSSupportAccess' managed policy to the created IAM role: ``` aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name <aws_support_iam_role> ```",
+ "AuditProcedure": "**From Command Line:** 1. List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the Arn element value: ``` aws iam list-policies --query Policies[?PolicyName == 'AWSSupportAccess'] ``` 2. Check if the 'AWSSupportAccess' policy is attached to any role: ``` aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess ``` 3. In the output, ensure `PolicyRoles` does not return empty. 'Example: Example: PolicyRoles: [ ]' If it returns empty refer to the remediation below.",
+ "AdditionalInformation": "AWSSupportAccess policy is a global AWS resource. It has same ARN as `arn:aws:iam::aws:policy/AWSSupportAccess` for every account.",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html:https://aws.amazon.com/premiumsupport/pricing/:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policies.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-entities-for-policy.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.16",
+ "Description": "Ensure IAM instance roles are used for AWS resource access from instances",
+ "Checks": [
+ "ec2_instance_profile_attached"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS Access means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.",
+ "RationaleStatement": "AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. Compromised credentials can be used from outside the AWS account to which they provide access. In contrast, to leverage role permissions, an attacker would need to gain and maintain access to a specific instance to use the privileges associated with it. Additionally, if credentials are encoded into compiled applications or other hard-to-change mechanisms, they are even less likely to be properly rotated due to the risks of service disruption. As time passes, credentials that cannot be rotated are more likely to be known by an increasing number of individuals who no longer work for the organization that owns the credentials.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at `https://console.aws.amazon.com/ec2/`. 2. In the left navigation panel, choose `Instances`. 3. Select the EC2 instance you want to modify. 4. Click `Actions`. 5. Click `Security`. 6. Click `Modify IAM role`. 7. Click `Create new IAM role` if a new IAM role is required. 8. Select the IAM role you want to attach to your instance in the `IAM role` dropdown. 9. Click `Update IAM role`. 10. Repeat steps 3 to 9 for each EC2 instance in your AWS account that requires an IAM role to be attached. **From Command Line:** 1. Run the `describe-instances` command to list all EC2 instance IDs in the selected AWS region: ``` aws ec2 describe-instances --region <region-name> --query 'Reservations[*].Instances[*].InstanceId' ``` 2. Run the `associate-iam-instance-profile` command to attach an instance profile (which is attached to an IAM role) to the EC2 instance: ``` aws ec2 associate-iam-instance-profile --region <region-name> --instance-id <Instance-ID> --iam-instance-profile Name=Instance-Profile-Name ``` 3. Run the `describe-instances` command again for the recently modified EC2 instance. The command output should return the instance profile ARN and ID: ``` aws ec2 describe-instances --region <region-name> --instance-id <Instance-ID> --query 'Reservations[*].Instances[*].IamInstanceProfile' ``` 4. Repeat steps 2 and 3 for each EC2 instance in your AWS account that requires an IAM role to be attached.",
+ "AuditProcedure": "First, check if the instance has any API secrets stored using Secret Scanning. Currently, AWS does not have a solution for this. You can use open-source tools like TruffleHog to scan for secrets in the EC2 instance. If a secret is found, then assign the role to the instance. **From Console:** 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at `https://console.aws.amazon.com/ec2/`. 2. In the left navigation panel, choose `Instances`. 3. Select the EC2 instance you want to examine. 4. Select `Actions`. 5. Select `View details`. 6. Select `Security` in the lower panel. - If the value for **Instance profile arn** is an instance profile ARN, then an instance profile (that contains an IAM role) is attached. - If the value for **IAM Role** is blank, no role is attached. - If the value for **IAM Role** contains a role, a role is attached. - If the value for **IAM Role** is No roles attached to instance profile: <Instance-Profile-Name>, then an instance profile is attached to the instance, but it does not contain an IAM role. 7. Repeat steps 3 to 6 for each EC2 instance in your AWS account. **From Command Line:** 1. Run the `describe-instances` command to list all EC2 instance IDs in the selected AWS region: ``` aws ec2 describe-instances --region <region-name> --query 'Reservations[*].Instances[*].InstanceId' ``` 2. Run the `describe-instances` command again for each EC2 instance using the `IamInstanceProfile` identifier in the query filter to check if an IAM role is attached: ``` aws ec2 describe-instances --region <region-name> --instance-id <Instance-ID> --query 'Reservations[*].Instances[*].IamInstanceProfile' ``` 3. If an IAM role is attached, the command output will show the IAM instance profile ARN and ID. 4. Repeat steps 2 and 3 for each EC2 instance in your AWS account.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.17",
+ "Description": "Ensure that all expired SSL/TLS certificates stored in AWS IAM are removed",
+ "Checks": [
+ "iam_no_expired_server_certificates_stored"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use AWS Certificate Manager (ACM) or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.",
+ "RationaleStatement": "Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. As a best practice, it is recommended to delete expired certificates.",
+ "ImpactStatement": "Deleting the certificate could have implications for your application if you are using an expired server certificate with Elastic Load Balancing, CloudFront, etc. You must make configurations in the respective services to ensure there is no interruption in application functionality.",
+ "RemediationProcedure": "**From Console:** Removing expired certificates via AWS Management Console is not currently supported. To delete SSL/TLS certificates stored in IAM through the AWS API, use the Command Line Interface (CLI). **From Command Line:** To delete an expired certificate, run the following command by replacing <CERTIFICATE_NAME> with the name of the certificate to delete: ``` aws iam delete-server-certificate --server-certificate-name <CERTIFICATE_NAME> ``` When the preceding command is successful, it does not return any output.",
+ "AuditProcedure": "**From Console:** Getting the certificate expiration information via the AWS Management Console is not currently supported. To request information about the SSL/TLS certificates stored in IAM through the AWS API, use the Command Line Interface (CLI). **From Command Line:** Run the `list-server-certificates` command to list all the IAM-stored server certificates: ``` aws iam list-server-certificates ``` The command output should return an array that contains all the SSL/TLS certificates currently stored in IAM and their metadata (name, ID, expiration date, etc): ``` { ServerCertificateMetadataList: [ { ServerCertificateId: EHDGFRW7EJFYTE88D, ServerCertificateName: MyServerCertificate, Expiration: 2018-07-10T23:59:59Z, Path: /, Arn: arn:aws:iam::012345678910:server-certificate/MySSLCertificate, UploadDate: 2018-06-10T11:56:08Z } ] } ``` Verify the `ServerCertificateName` and `Expiration` parameter value (expiration date) for each SSL/TLS certificate returned by the list-server-certificates command and determine if there are any expired server certificates currently stored in AWS IAM. If so, use the AWS API to remove them. If this command returns: ``` { { ServerCertificateMetadataList: [] } ``` This means that there are no expired certificates; it **does not** mean that no certificates exist.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-server-certificate.html",
+ "DefaultValue": "By default, expired certificates will not be deleted."
+ }
+ ]
+ },
+ {
+ "Id": "2.18",
+ "Description": "Ensure that IAM External Access Analyzer is enabled for all regions",
+ "Checks": [
+ "accessanalyzer_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable the IAM External Access Analyzer regarding all resources in each active AWS region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. The results allow you to determine whether an unintended user is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only the policies that are applied to resources in the same AWS Region.",
+ "RationaleStatement": "AWS IAM External Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with external entities. This allows you to identify unintended access to your resources and data. Access Analyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAM External Access Analyzer continuously monitors all policies for S3 buckets, IAM roles, KMS (Key Management Service) keys, AWS Lambda functions, Amazon SQS (Simple Queue Service) queues and more",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** Perform the following to enable IAM Access Analyzer for IAM policies: 1. Open the IAM console at `https://console.aws.amazon.com/iam/.` 2. Choose `Access analyzer`. 3. Choose `Create external access analyzer`. 4. On the `Create analyzer` page, confirm that the `Region` displayed is the Region where you want to enable Access Analyzer. 5. Optionally enter a name for the analyzer. 6. Optionally add any tags that you want to apply to the analyzer. 7. Choose `Create Analyzer`. 8. Repeat these step for each active region. **From Command Line:** Run the following command: ``` aws accessanalyzer list-analyzers --type ORGANIZATION ``` Repeat this command for each active region. **Note:** The IAM Access Analyzer is successfully configured only when the account you use has the necessary permissions.",
+ "AuditProcedure": "**From Console:** 1. Open the IAM console at `https://console.aws.amazon.com/iam/` 2. Under `Access analyzer` choose `Analyzer Settings` 3. On the `Analyzer Settings` page, there will be a list of analyzers. 4. Look for analyzers where the `Finding type` is `External Access`. **From Command Line:** 1. Run the following command: ``` aws accessanalyzer list-analyzers --type ORGANIZATION | grep status ``` 2. Ensure that at least one Analyzer's `status` is set to `ACTIVE`. 3. Repeat the steps above for each active region. If an Access Analyzer is not listed for each region or the status is not set to active refer to the remediation procedure below.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html:https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/get-analyzer.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/create-analyzer.html",
+ "DefaultValue": "By default, IAM External Access Analyzer is not enabled in any region. An analyzer must be explicitly created and activated for each region where monitoring is required."
+ }
+ ]
+ },
+ {
+ "Id": "2.19",
+ "Description": "Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments",
+ "Checks": [
+ "iam_check_saml_providers_sts"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.",
+ "RationaleStatement": "Centralizing IAM user management to a single identity store reduces complexity and thus the likelihood of access management errors.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "The remediation procedure will vary based on each individual organization's implementation of identity federation and/or AWS Organizations, with the acceptance criteria that no non-service IAM users and non-root accounts are present outside the account providing centralized IAM user management.",
+ "AuditProcedure": "For multi-account AWS environments with an external identity provider: 1. Determine the master account for identity federation or IAM user management 2. Login to that account through the AWS Management Console 3. Click `Services` 4. Click `IAM` 5. Click `Identity providers` 6. Verify the configuration For multi-account AWS environments with an external identity provider, as well as for those implementing AWS Organizations without an external identity provider: 1. Determine all accounts that should not have local users present 2. Log into the AWS Management Console 3. Switch role into each identified account 4. Click `Services` 5. Click `IAM` 6. Click `Users` 7. Confirm that no IAM users representing individuals are present",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.20",
+ "Description": "Ensure access to AWSCloudShellFullAccess is restricted",
+ "Checks": [
+ "iam_policy_cloudshell_admin_not_attached"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. Therefore, it is feasible to install file transfer software, for example, and move data from CloudShell to external internet servers.",
+ "RationaleStatement": "Access to this policy should be restricted, as it presents a potential channel for data exfiltration by malicious cloud admins who are given full permissions to the service. AWS documentation describes how to create a more restrictive IAM policy that denies file transfer permissions.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console** 1. Open the IAM console at https://console.aws.amazon.com/iam/ 2. In the left pane, select Policies 3. Search for and select AWSCloudShellFullAccess 4. On the Entities attached tab, for each item, check the box and select Detach",
+ "AuditProcedure": "**From Console** 1. Open the IAM console at https://console.aws.amazon.com/iam/ 2. In the left pane, select Policies 3. Search for and select AWSCloudShellFullAccess 4. On the Entities attached tab, ensure that there are no entities using this policy **From Command Line** 1. List IAM policies, filter for the 'AWSCloudShellFullAccess' managed policy, and note the Arn element value: ``` aws iam list-policies --query Policies[?PolicyName == 'AWSCloudShellFullAccess'] ``` 2. Check if the 'AWSCloudShellFullAccess' policy is attached to any role: ``` aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess ``` 3. In the output, ensure PolicyRoles returns empty. 'Example: Example: PolicyRoles: [ ]' If it does not return empty, refer to the remediation below. **Note:** Keep in mind that other policies may grant access.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.21",
+ "Description": "Ensure AWS resource policies do not allow unrestricted access using 'Principal': '*'",
+ "Checks": [
+ "s3_bucket_policy_public_write_access",
+ "sqs_queues_not_publicly_accessible",
+ "sns_topics_not_publicly_accessible",
+ "awslambda_function_not_publicly_accessible",
+ "kms_key_not_publicly_accessible",
+ "glacier_vaults_policy_public_access",
+ "secretsmanager_not_publicly_accessible",
+ "eventbridge_bus_exposed"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure AWS resource-based policies, such as Amazon S3 bucket policies, Amazon SQS queue policies, Amazon SNS topic policies, and AWS Lambda resource policies, do not grant unrestricted access using \"Principal\": \"*\" with \"Effect\": \"Allow\" unless the policy includes restrictive conditions that limit access to specific trusted identities, accounts, services, or network boundaries.",
+ "RationaleStatement": "Resource-based policies are evaluated alongside identity-based IAM policies during authorization decisions. When a policy statement specifies \"Principal\": \"*\" with \"Effect\": \"Allow\", it grants the specified permissions to any AWS principal unless additional conditions restrict the request. This may unintentionally allow access from users, roles, or services in any AWS account. Such broad access significantly increases the risk of unauthorized data access, resource abuse, or data exfiltration.",
+ "ImpactStatement": "Unrestricted resource-based policies may expose data or services to unauthorized access, potentially leading to data breaches, service misuse, or unintended public exposure.",
+ "RemediationProcedure": "If a resource policy contains `\"Principal\": \"*\"` with `\"Effect\": \"Allow\"` and lacks sufficient restrictions, modify the policy to limit access. **OPTION 1 - Restrict the Principal:** Replace the wildcard principal (`\"Principal\": \"*\"`) with a specific account, role, user, or service. Example Non-Compliant Policy: ``` {\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"AllowPublicAccess\", \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"sqs:SendMessage\", \"Resource\": \"arn:aws:sqs:us-east-1:123456789012:my-queue\"}]} ``` Steps: 1. Retrieve the current policy: ``` aws sqs get-queue-attributes --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue --attribute-names Policy --query 'Attributes.Policy' ``` 2. Update the policy with a specific principal: ``` aws sqs set-queue-attributes --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue --attributes '{\"Policy\": \"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Sid\\\":\\\"AllowSpecificAccount\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::345678901234:root\\\"},\\\"Action\\\":\\\"sqs:SendMessage\\\",\\\"Resource\\\":\\\"arn:aws:sqs:us-east-1:123456789012:my-queue\\\"}]}\"}' ``` Resulting Compliant Policy: ``` {\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"AllowSpecificAccount\", \"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"arn:aws:iam::345678901234:root\"}, \"Action\": \"sqs:SendMessage\", \"Resource\": \"arn:aws:sqs:us-east-1:123456789012:my-queue\"}]} ``` **OPTION 2 - Restrict Using Conditions:** If a wildcard principal is required, add restrictive conditions. Example compliant policy: ``` {\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"AllowServiceIntegration\", \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"sqs:SendMessage\", \"Resource\": \"arn:aws:sqs:us-east-1:123456789012:my-queue\", \"Condition\": {\"StringEquals\": {\"aws:SourceAccount\": \"345678901234\"}}}]} ```",
+ "AuditProcedure": "1. Identify resources that support resource-based policies within the AWS account, such as S3 buckets, SQS queues, SNS topics, and Lambda functions. 2. Retrieve the resource policies for each resource. Example CLI commands: SQS Queue Policies: ``` aws sqs get-queue-attributes --queue-url https://sqs.region.amazonaws.com/account/QUEUE --attribute-names Policy ``` S3 Bucket Policies: ``` aws s3api get-bucket-policy --bucket YOUR-BUCKET-NAME ``` SNS Topic Policies: ``` aws sns get-topic-attributes --topic-arn TOPIC-ARN --query \"Attributes.Policy\" --output text ``` 3. Inspect the retrieved policies and identify statements containing: - `\"Effect\": \"Allow\"` AND `\"Principal\": \"*\"` OR - `\"Principal\": {\"AWS\": \"*\"}` 4. Evaluate whether the statement includes restrictive conditions such as: - `aws:SourceArn` - `aws:SourceAccount` - `aws:PrincipalArn` - Other service-specific condition keys 5. Determine audit status: - Compliant: Wildcard principals are present only when restrictive conditions limit access to trusted principals or services - Non-Compliant: Wildcard principals are used without sufficient restrictions",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, AWS does not prevent the use of \"Principal\": \"*\" in resource-based policies. Policies may allow unrestricted access unless explicitly restricted through policy definitions or organizational controls. It is the responsibility of the customer to ensure that resource policies are properly scoped and do not grant unintended public or cross-account access."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.1",
+ "Description": "Ensure S3 Bucket Policy is set to deny HTTP requests",
+ "Checks": [
+ "s3_bucket_secure_transport_policy"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.1 Simple Storage Service (S3)",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy, making the objects accessible only through HTTPS.",
+ "RationaleStatement": "By default, Amazon S3 allows both HTTP and HTTPS requests. To ensure that access to Amazon S3 objects is only permitted through HTTPS, you must explicitly deny HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests will not comply with this recommendation.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to the Bucket. 3. Click on 'Permissions'. 4. Click 'Bucket Policy'. 5. Add either of the following to the existing policy, filling in the required information: ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::<bucket_name>/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::<bucket_name>, arn:aws:s3:::<bucket_name>/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` 6. Save 7. Repeat for all the buckets in your AWS account that contain sensitive data. **From Console** Using AWS Policy Generator: 1. Repeat steps 1-4 above. 2. Click on `Policy Generator` at the bottom of the Bucket Policy Editor. 3. Select Policy Type `S3 Bucket Policy`. 4. Add Statements: - `Effect` = Deny - `Principal` = * - `AWS Service` = Amazon S3 - `Actions` = * - `Amazon Resource Name` = <ARN of the S3 Bucket> 5. Generate Policy. 6. Copy the text and add it to the Bucket Policy. **From Command Line:** 1. Export the bucket policy to a json file: ``` aws s3api get-bucket-policy --bucket <bucket_name> --query Policy --output text > policy.json ``` 2. Modify the policy.json file by adding either of the following: ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::<bucket_name>/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::<bucket_name>, arn:aws:s3:::<bucket_name>/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` 3. Apply this modified policy back to the S3 bucket: ``` aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json ```",
+ "AuditProcedure": "To allow access to HTTPS, you can use a bucket policy with the effect `allow` and a condition that checks for the key `aws:SecureTransport: true`. This means that HTTPS requests are allowed, but it does not deny HTTP requests. To explicitly deny HTTP access, ensure that there is also a bucket policy with the effect `deny` that contains the key `aws:SecureTransport: false`. You may also require TLS by setting a policy to deny any version lower than the one you wish to require, using the condition `NumericLessThan` and the key `s3:TlsVersion: 1.2`. **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to the Bucket. 3. Click on 'Permissions', then click on `Bucket Policy`. 4. Ensure that a policy is listed that matches either: ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: arn:aws:s3:::<bucket_name>/*, Condition: { Bool: { aws:SecureTransport: false } } } ``` or ``` { Sid: <optional>, Effect: Deny, Principal: *, Action: s3:*, Resource: [ arn:aws:s3:::<bucket_name>, arn:aws:s3:::<bucket_name>/* ], Condition: { NumericLessThan: { s3:TlsVersion: 1.2 } } } ``` `<optional>` and `<bucket_name>` will be specific to your account, and TLS version will be site/policy specific to your organisation. 5. Repeat for all the buckets in your AWS account. **From Command Line:** 1. List all of the S3 Buckets ``` aws s3 ls ``` 2. Using the list of buckets, run this command on each of them: ``` aws s3api get-bucket-policy --bucket <bucket_name> | grep aws:SecureTransport ``` or ``` aws s3api get-bucket-policy --bucket <bucket_name> | grep s3:TlsVersion ``` NOTE : If an error is thrown by the CLI, it means no policy has been configured for the specified S3 bucket, and that by default it is allowing both HTTP and HTTPS requests. 3. Confirm that `aws:SecureTransport` is set to false (such as `aws:SecureTransport:false`) or that `s3:TlsVersion` has a site-specific value. 4. Confirm that the policy line has Effect set to Deny 'Effect:Deny'",
+ "AdditionalInformation": "",
+ "References": "https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/:https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-policy.html",
+ "DefaultValue": "Both HTTP and HTTPS requests are allowed."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.2",
+ "Description": "Ensure MFA Delete is enabled on S3 buckets",
+ "Checks": [
+ "s3_bucket_no_mfa_delete"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.1 Simple Storage Service (S3)",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket, it requires the user to provide two forms of authentication.",
+ "RationaleStatement": "Adding MFA delete to an S3 bucket requires additional authentication when you change the version state of your bucket or delete an object version, adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.",
+ "ImpactStatement": "Enabling MFA delete on an S3 bucket could require additional administrator oversight. Enabling MFA delete may impact other services that automate the creation and/or deletion of S3 buckets.",
+ "RemediationProcedure": "Perform the steps below to enable MFA delete on an S3 bucket: **Note:** - You cannot enable MFA Delete using the AWS Management Console; you must use the AWS CLI or API. - You must use your 'root' account to enable MFA Delete on S3 buckets. **From Command line:** 1. Run the s3api `put-bucket-versioning` command: ``` aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa “arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode” ```",
+ "AuditProcedure": "Perform the steps below to confirm that MFA delete is configured on an S3 bucket: **From Console:** 1. Login to the S3 console at `https://console.aws.amazon.com/s3/`. 2. Click the `check` box next to the name of the bucket you want to confirm. 3. In the window under `Properties`: - Confirm that Versioning is `Enabled` - Confirm that MFA Delete is `Enabled` **From Command Line:** 1. Run the `get-bucket-versioning` command: ``` aws s3api get-bucket-versioning --bucket my-bucket ``` Example output: ``` <VersioningConfiguration xmlns=http://s3.amazonaws.com/doc/2006-03-01/> <Status>Enabled</Status> <MfaDelete>Enabled</MfaDelete> </VersioningConfiguration> ``` If the console or CLI output does not show that Versioning and MFA Delete are `enabled`, please refer to the remediation below.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.3",
+ "Description": "Ensure all data in Amazon S3 has been discovered, classified, and secured when necessary",
+ "Checks": [
+ "macie_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.1 Simple Storage Service (S3)",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Amazon S3 buckets can contain sensitive data that, for security purposes, should be discovered, monitored, classified, and protected. Macie, along with other third-party tools, can automatically provide an inventory of Amazon S3 buckets.",
+ "RationaleStatement": "Using a cloud service or third-party software to continuously monitor and automate the process of data discovery and classification for S3 buckets through machine learning and pattern matching is a strong defense in protecting that information. Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.",
+ "ImpactStatement": "There is a cost associated with using Amazon Macie, and there is typically a cost associated with third-party tools that perform similar processes and provide protection.",
+ "RemediationProcedure": "Perform the steps below to enable and configure Amazon Macie: **From Console:** 1. Log on to the Macie console at `https://console.aws.amazon.com/macie/`. 2. Click `Get started`. 3. Click `Enable Macie`. Set up a repository for sensitive data discovery results: 1. In the left pane, under Settings, click `Discovery results`. 2. Make sure `Create bucket` is selected. 3. Create a bucket and enter a name for it. The name must be unique across all S3 buckets, and it must start with a lowercase letter or a number. 4. Click `Advanced`. 5. For block all public access, make sure `Yes` is selected. 6. For KMS encryption, specify the AWS KMS key that you want to use to encrypt the results. The key must be a symmetric customer master key (CMK) that is in the same region as the S3 bucket. 7. Click `Save`. Create a job to discover sensitive data: 1. In the left pane, click `S3 buckets`. Macie displays a list of all the S3 buckets for your account. 2. Check the box for each bucket that you want Macie to analyze as part of the job. 3. Click `Create job`. 4. Click `Quick create`. 5. For the Name and Description step, enter a name and, optionally, a description of the job. 6. Click `Next`. 7. For the Review and create step, click `Submit`. Review your findings: 1. In the left pane, click `Findings`. 2. To view the details of a specific finding, choose any field other than the check box for the finding. If you are using a third-party tool to manage and protect your S3 data, follow the vendor documentation for implementing and configuring that tool.",
+ "AuditProcedure": "Perform the following steps to determine if Macie is running: **From Console:** 1. Login to the Macie console at https://console.aws.amazon.com/macie/. 2. In the left hand pane, click on `By job` under findings. 3. Confirm that you have a job set up for your S3 buckets. When you log into the Macie console, if you are not taken to the summary page and do not have a job set up and running, then refer to the remediation procedure below. If you are using a third-party tool to manage and protect your S3 data, you meet this recommendation.",
+ "AdditionalInformation": "",
+ "References": "https://aws.amazon.com/macie/getting-started/:https://docs.aws.amazon.com/workspaces/latest/adminguide/data-protection.html:https://docs.aws.amazon.com/macie/latest/user/data-classification.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.4",
+ "Description": "Ensure that S3 is configured with 'Block Public Access' enabled",
+ "Checks": [
+ "s3_bucket_level_public_access_block",
+ "s3_account_level_public_access_blocks"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.1 Simple Storage Service (S3)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket and its contained objects from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets and their contained objects from becoming publicly accessible across the entire account.",
+ "RationaleStatement": "Amazon S3 `Block public access (bucket settings)` prevents the accidental or malicious public exposure of data contained within the respective bucket(s). Amazon S3 `Block public access (account settings)` prevents the accidental or malicious public exposure of data contained within all buckets of the respective AWS account. Whether to block public access to all or some buckets is an organizational decision that should be based on data sensitivity, least privilege, and use case.",
+ "ImpactStatement": "When you apply Block Public Access settings to an account, the settings apply to all AWS regions globally. The settings may not take effect in all regions immediately or simultaneously, but they will eventually propagate to all regions.",
+ "RemediationProcedure": "**If utilizing Block Public Access (bucket settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to a bucket. 3. Click 'Edit public access settings'. 4. Click 'Block all public access' 5. Repeat for all the buckets in your AWS account that contain sensitive data. **From Command Line:** 1. List all of the S3 buckets: ``` aws s3 ls ``` 2. Enable Block Public Access on a specific bucket: ``` aws s3api put-public-access-block --bucket <bucket-name> --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true ``` **If utilizing Block Public Access (account settings)** **From Console:** If the output reads `true` for the separate configuration settings, then Block Public Access is enabled on the account. 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Click `Block Public Access (account settings)`. 3. Click `Edit` to change the block public access settings for all the buckets in your AWS account. 4. Update the settings and click `Save`. For details about each setting, pause on the `i` icons. 5. When you're asked for confirmation, enter `confirm`. Then click `Confirm` to save your changes. **From Command Line:** To enable Block Public Access for this account, run the following command: ``` aws s3control put-public-access-block --public-access-block-configuration BlockPublicAcls=true, IgnorePublicAcls=true, BlockPublicPolicy=true, RestrictPublicBuckets=true --account-id <account-id> ```",
+ "AuditProcedure": "**If utilizing Block Public Access (bucket settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Select the check box next to a bucket. 3. Click on 'Edit public access settings'. 4. Ensure that the block public access settings are configured appropriately for this bucket. 5. Repeat for all the buckets in your AWS account. **From Command Line:** 1. List all of the S3 buckets: ``` aws s3 ls ``` 2. Find the public access settings for a specific bucket: ``` aws s3api get-public-access-block --bucket <bucket-name> ``` Output if Block Public Access is enabled: ``` { PublicAccessBlockConfiguration: { BlockPublicAcls: true, IgnorePublicAcls: true, BlockPublicPolicy: true, RestrictPublicBuckets: true } } ``` If the output reads `false` for the separate configuration settings, then proceed with the remediation. **If utilizing Block Public Access (account settings)** **From Console:** 1. Login to the AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/. 2. Choose `Block public access (account settings)`. 3. Ensure that the block public access settings are configured appropriately for your AWS account. **From Command Line:** To check the block public access settings for this account, run the following command: `aws s3control get-public-access-block --account-id <account-id> --region <region-name>` Output if Block Public Access is enabled: ``` { PublicAccessBlockConfiguration: { IgnorePublicAcls: true, BlockPublicPolicy: true, BlockPublicAcls: true, RestrictPublicBuckets: true } } ``` If the output reads `false` for the separate configuration settings, then proceed with the remediation.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/block-public-access-account.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.1",
+ "Description": "Ensure that encryption-at-rest is enabled for RDS instances",
+ "Checks": [
+ "rds_instance_storage_encrypted"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.2 Relational Database Service (RDS)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Amazon RDS encrypted DB instances use the industry-standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles the authentication of access and the decryption of your data transparently, with minimal impact on performance.",
+ "RationaleStatement": "Databases are likely to hold sensitive and critical data; therefore, it is highly recommended to implement encryption to protect your data from unauthorized access or disclosure. With RDS encryption enabled, the data stored on the instance's underlying storage, the automated backups, read replicas, and snapshots are all encrypted.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click on `Databases`. 3. Select the Database instance that needs to be encrypted. 4. Click the `Actions` button placed at the top right and select `Take Snapshot`. 5. On the Take Snapshot page, enter the name of the database for which you want to take a snapshot in the `Snapshot Name` field and click on `Take Snapshot`. 6. Select the newly created snapshot, click the `Action` button placed at the top right, and select `Copy snapshot` from the Action menu. 7. On the Make Copy of DB Snapshot page, perform the following: - In the `New DB Snapshot Identifier` field, enter a name for the new snapshot. - Check `Copy Tags`. The new snapshot must have the same tags as the source snapshot. - Select `Yes` from the `Enable Encryption` dropdown list to enable encryption. You can choose to use the AWS default encryption key or a custom key from the Master Key dropdown list. 8. Click `Copy Snapshot` to create an encrypted copy of the selected instance's snapshot. 9. Select the new Snapshot Encrypted Copy and click the `Action` button located at the top right. Then, select the `Restore Snapshot` option from the Action menu. This will restore the encrypted snapshot to a new database instance. 10. On the Restore DB Instance page, enter a unique name for the new database instance in the DB Instance Identifier field. 11. Review the instance configuration details and click `Restore DB Instance`. 12. As the new instance provisioning process is completed, you can update the application configuration to refer to the endpoint of the new encrypted database instance. Once the database endpoint is changed at the application level, you can remove the unencrypted instance. **From Command Line:** 1. Run the `describe-db-instances` command to list the names of all RDS database instances in the selected AWS region. The command output should return database instance identifiers: ``` aws rds describe-db-instances --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Check if the specified RDS instance is encrypted. If it shows false, it means it is not yet encrypted: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].StorageEncrypted' ``` 3. Run the `create-db-snapshot` command to create a snapshot for a selected database instance. The command output will return the `new snapshot` with name DB Snapshot Name: ``` aws rds create-db-snapshot --region <region-name> --db-snapshot-identifier <db-snapshot-name> --db-instance-identifier <db-name> ``` 4. Now run the `list-aliases` command to list the KMS key aliases available in a specified region. The command output should return each `key alias currently available`. For our RDS encryption activation process, locate the ID of the AWS default KMS key: ``` aws kms list-aliases --region <region-name> ``` 5. Run the `copy-db-snapshot` command using the default KMS key ID for the RDS instances returned earlier to create an encrypted copy of the database instance snapshot. The command output will return the `encrypted instance snapshot configuration`: ``` aws rds copy-db-snapshot --region <region-name> --source-db-snapshot-identifier <db-snapshot-name> --target-db-snapshot-identifier <db-snapshot-name-encrypted> --copy-tags --kms-key-id <kms-id-for-rds> ``` 6. Run the `restore-db-instance-from-db-snapshot` command to restore the encrypted snapshot created in the previous step to a new database instance. If successful, the command output should return the configuration of the new encrypted database instance. If using the default VPC for the database network: ``` aws rds restore-db-instance-from-db-snapshot --region <region-name> --db-instance-identifier <db-name-encrypted> --db-snapshot-identifier <db-snapshot-name-encrypted> ``` If you created your own VPC and Subnets, you need to create a DB subnet group: ``` aws rds create-db-subnet-group --db-subnet-group-name <db-subnet-group-name> --db-subnet-group-description <db-subnet-group-description> --subnet-ids '[\"<subnet-id-1>\",\"<subnet-id-2>\",\"<subnet-id-3>\"]' ``` Restore the encrypted snapshot to an RDS database instance using the specified DB subnet group. The new instance will be encrypted using the KMS key specified during the snapshot copy: ``` aws rds restore-db-instance-from-db-snapshot --region <region-name> --db-subnet-group-name <db-subnet-group-name> --db-instance-identifier <db-name-encrypted> --db-snapshot-identifier <db-snapshot-name-encrypted> ``` 7. Run the `describe-db-instances` command to list all RDS database names available in the selected AWS region. The output will return the database instance identifier names. Select the encrypted database name that we just created, `db-name-encrypted`: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 8. Run the `describe-db-instances` command again using the RDS instance identifier returned earlier to determine if the selected database instance is encrypted. The command output should indicate that the encryption status is `True`: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name-encrypted> --query 'DBInstances[*].StorageEncrypted' ```",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the navigation pane, under RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click `Instance Name` to see details, then select the `Configuration` tab. 5. Under Configuration Details, in the Storage pane, search for the `Encryption Enabled` status. 6. If the current status is set to `Disabled`, encryption is not enabled for the selected RDS database instance. 7. Repeat steps 2 to 6 to verify the encryption status of other RDS instances in the same region. 8. Change the region from the top of the navigation bar, and repeat the audit steps for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all the RDS database instance names available in the selected AWS region. The output will return each database instance identifier (name): ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Run the `describe-db-instances` command again, using an RDS instance identifier returned from step 1, to determine if the selected database instance is encrypted. The output should return the encryption status `True` or `False`: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].StorageEncrypted' ``` 3. If the StorageEncrypted parameter value is `False`, encryption is not enabled for the selected RDS database instance. 4. Repeat steps 1 to 3 to audit each RDS instance, and change the region to verify RDS instances in other regions.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html:https://aws.amazon.com/blogs/database/selecting-the-right-encryption-options-for-amazon-rds-and-amazon-aurora-database-engines/#:~:text=With%20RDS%2Dencrypted%20resources%2C%20data,transparent%20to%20your%20database%20engine.:https://aws.amazon.com/rds/features/security/:https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-subnet-group.html",
+ "DefaultValue": "By default, Amazon RDS instances are created without encryption at rest. Encryption must be explicitly enabled at instance creation or by restoring from an encrypted snapshot."
+ }
+ ]
+ },
+ {
+ "Id": "3.2.2",
+ "Description": "Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances",
+ "Checks": [
+ "rds_instance_minor_version_upgrade_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.2 Relational Database Service (RDS)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled to automatically receive minor engine upgrades during the specified maintenance window. This way, RDS instances can obtain new features, bug fixes, and security patches for their database engines.",
+ "RationaleStatement": "AWS RDS will occasionally deprecate minor engine versions and provide new ones for upgrades. When the last version number within a release is replaced, the changed version is considered minor. With the Auto Minor Version Upgrade feature enabled, version upgrades will occur automatically during the specified maintenance window, allowing your RDS instances to receive new features, bug fixes, and security patches for their database engines.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click `Databases`. 3. Select the RDS instance that you want to update. 4. Click on the `Modify` button located at the top right side. 5. On the `Modify DB Instance: <instance identifier>` page, In the `Maintenance` section, select `Auto minor version upgrade` and click the `Yes` radio button. 6. At the bottom of the page, click `Continue`, and check `Apply Immediately` to apply the changes immediately, or select `Apply during the next scheduled maintenance window` to avoid any downtime. 7. Review the changes and click `Modify DB Instance`. The instance status should change from available to modifying and back to available. Once the feature is enabled, the `Auto Minor Version Upgrade` status should change to `Yes`. **From Command Line:** 1. Run the `describe-db-instances` command to list all RDS database instance names available in the selected AWS region: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `modify-db-instance` command to modify the configuration of a selected RDS instance. This command will apply the changes immediately. Remove `--apply-immediately` to apply changes during the next scheduled maintenance window and avoid any downtime: ``` aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-instance-identifier> --auto-minor-version-upgrade --apply-immediately ``` 4. The command output should reveal the new configuration metadata for the RDS instance, including the `AutoMinorVersionUpgrade` parameter value. 5. Run the `describe-db-instances` command to check if the Auto Minor Version Upgrade feature has been successfully enabled: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-identifier> --query 'DBInstances[*].AutoMinorVersionUpgrade' ``` 6. The command output should return the feature's current status set to `true`, indicating that the feature is `enabled`, and that the minor engine upgrades will be applied to the selected RDS instance.",
+ "AuditProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. In the left navigation panel, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click on the `Maintenance and backups` panel. 5. Under the `Maintenance` section, search for the Auto Minor Version Upgrade status. - If the current status is `Disabled`, it means that the feature is not enabled, and the minor engine upgrades released will not be applied to the selected RDS instance. **From Command Line:** 1. Run the `describe-db-instances` command to list all RDS database names available in the selected AWS region: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `describe-db-instances` command again using a RDS instance identifier returned earlier to determine the Auto Minor Version Upgrade status for the selected instance: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-identifier> --query 'DBInstances[*].AutoMinorVersionUpgrade' ``` 4. The command output should return the current status of the feature. If the current status is set to `true`, the feature is enabled and the minor engine upgrades will be applied to the selected RDS instance.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_RDS_Managing.html:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Upgrading.html:https://aws.amazon.com/rds/faqs/",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.3",
+ "Description": "Ensure that RDS instances are not publicly accessible",
+ "Checks": [
+ "rds_instance_no_public_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.2 Relational Database Service (RDS)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure and verify that the RDS database instances provisioned in your AWS account restrict unauthorized access in order to minimize security risks. To restrict access to any RDS database instance, you must disable the Publicly Accessible flag for the database and update the VPC security group associated with the instance.",
+ "RationaleStatement": "Ensure that no public-facing RDS database instances are provisioned in your AWS account, and restrict unauthorized access in order to minimize security risks. When the RDS instance allows unrestricted access (0.0.0.0/0), anyone and anything on the Internet can establish a connection to your database, which can increase the opportunity for malicious activities such as brute force attacks, PostgreSQL injections, or DoS/DDoS attacks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. Under the navigation panel, on the RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to update. 4. Click `Modify` from the dashboard top menu. 5. On the Modify DB Instance panel, under the `Connectivity` section, click on `Additional connectivity configuration` and update the value for `Publicly Accessible` to `Not publicly accessible` to restrict public access. 6. Follow the below steps to update subnet configurations: - Select the `Connectivity and security` tab, and click the VPC attribute value inside the `Networking` section. - Select the `Details` tab from the VPC dashboard's bottom panel and click the Route table configuration attribute value. - On the Route table details page, select the Routes tab from the dashboard's bottom panel and click `Edit routes`. - On the Edit routes page, update the Destination of Target which is set to `igw-xxxxx` and click `Save` routes. 7. On the Modify DB Instance panel, click `Continue`, and in the Scheduling of modifications section, perform one of the following actions based on your requirements: - Select `Apply during the next scheduled maintenance window` to apply the changes automatically during the next scheduled maintenance window. - Select `Apply immediately` to apply the changes right away. With this option, any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this RDS database instance. Note that any changes available in the pending modifications queue are also applied. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for the application. 8. Repeat steps 3-7 for each RDS instance in the current region. 9. Change the AWS region from the navigation bar to repeat the process for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all available RDS database identifiers in the selected AWS region: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance identifier. 3. Run the `modify-db-instance` command to modify the configuration of a selected RDS instance, disabling the `Publicly Accessible` flag for that instance. This command uses the `apply-immediately` flag. If you want to avoid any downtime, the `--no-apply-immediately` flag can be used: ``` aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-instance-name> --no-publicly-accessible --apply-immediately ``` 4. The command output should reveal the `PubliclyAccessible` configuration under pending values, to be applied at the specified time. 5. Updating the Internet Gateway destination via the AWS CLI is not currently supported. To update information about the Internet Gateway, please use the AWS Console procedure. 6. Repeat steps 1-5 for each RDS instance provisioned in the current region. 7. Change the AWS region by using the --region filter to repeat the process for other regions.",
+ "AuditProcedure": "**From Console:** 1. Log in to the AWS management console and navigate to the RDS dashboard at https://console.aws.amazon.com/rds/. 2. Under the navigation panel, on the RDS dashboard, click `Databases`. 3. Select the RDS instance that you want to examine. 4. Click `Instance Name` from the dashboard, under `Connectivity and Security`. 5. In the `Security` section, check if the Publicly Accessible flag status is set to `Yes`. 6. Follow the steps below to check database subnet access: - In the `networking` section, click the subnet link under `Subnets`. - The link will redirect you to the VPC Subnets page. - Select the subnet listed on the page and click the `Route Table` tab from the dashboard bottom panel. - If the route table contains any entries with the destination CIDR block set to `0.0.0.0/0` and an `Internet Gateway` attached, the selected RDS database instance was provisioned inside a public subnet; therefore, it is not running within a logically isolated environment and can be accessed from the Internet. 7. Repeat steps 3-6 to determine the configuration of other RDS database instances provisioned in the current region. 8. Change the AWS region from the navigation bar and repeat the audit process for other regions. **From Command Line:** 1. Run the `describe-db-instances` command to list all available RDS database names in the selected AWS region: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. The command output should return each database instance `identifier`. 3. Run the `describe-db-instances` command again, using the `PubliclyAccessible` parameter as a query filter to reveal the status of the database instance's Publicly Accessible flag: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-name> --query 'DBInstances[*].PubliclyAccessible' ``` 4. Check the Publicly Accessible parameter status. If the Publicly Accessible flag is set to `Yes`, then the selected RDS database instance is publicly accessible and insecure. Follow the steps mentioned below to check database subnet access. 5. Run the `describe-db-instances` command again using the RDS database instance identifier that you want to check, along with the appropriate filtering to describe the VPC subnet(s) associated with the selected instance: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-name> --query 'DBInstances[*].DBSubnetGroup.Subnets[]' ``` - The command output should list the subnets available in the selected database subnet group. 6. Run the `describe-route-tables` command using the ID of the subnet returned in the previous step to describe the routes of the VPC route table associated with the selected subnet: ``` aws ec2 describe-route-tables --region <region-name> --filters Name=association.subnet-id,Values=<subnet-id> --query 'RouteTables[*].Routes[]' ``` - If the command returns the route table associated with the database instance subnet ID, check the values of the `GatewayId` and `DestinationCidrBlock` attributes returned in the output. If the route table contains any entries with the `GatewayId` value set to `igw-xxxxxxxx` and the `DestinationCidrBlock` value set to `0.0.0.0/0`, the selected RDS database instance was provisioned within a public subnet. - Or, if the command returns empty results, the route table is implicitly associated with the subnet; therefore, the audit process continues with the next step. 7. Run the `describe-db-instances` command again using the RDS database instance identifier that you want to check, along with the appropriate filtering to describe the VPC ID associated with the selected instance: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-instance-name> --query 'DBInstances[*].DBSubnetGroup.VpcId' ``` - The command output should show the VPC ID in the selected database subnet group. 8. Now run the `describe-route-tables` command using the ID of the VPC returned in the previous step to describe the routes of the VPC's main route table that is implicitly associated with the selected subnet: ``` aws ec2 describe-route-tables --region <region-name> --filters Name=vpc-id,Values=<vpc-id> Name=association.main,Values=true --query 'RouteTables[*].Routes[]' ``` - The command output returns the VPC main route table implicitly associated with the database instance subnet ID. Check the values of the `GatewayId` and `DestinationCidrBlock` attributes returned in the output. If the route table contains any entries with the `GatewayId` value set to `igw-xxxxxxxx` and the `DestinationCidrBlock` value set to `0.0.0.0/0`, the selected RDS database instance was provisioned inside a public subnet; therefore, it is not running within a logically isolated environment and does not adhere to AWS security best practices.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html:https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html:https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html:https://aws.amazon.com/rds/faqs/",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.4",
+ "Description": "Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS",
+ "Checks": [
+ "rds_cluster_multi_az",
+ "rds_instance_multi_az"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.2 Relational Database Service (RDS)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Amazon RDS offers Multi-AZ deployments that provide enhanced availability and durability for your databases, using synchronous replication to replicate data to a standby instance in a different Availability Zone (AZ). In the event of an infrastructure failure, Amazon RDS automatically fails over to the standby to minimize downtime and ensure business continuity.",
+ "RationaleStatement": "Database availability is crucial for maintaining service uptime, particularly for applications that are critical to the business. Implementing Multi-AZ deployments with Amazon RDS ensures that your databases are protected against unplanned outages due to hardware failures, network issues, or other disruptions. This configuration enhances both the availability and durability of your database, making it a highly recommended practice for production environments.",
+ "ImpactStatement": "Multi-AZ deployments may increase costs due to the additional resources required to maintain a standby instance; however, the benefits of increased availability and reduced risk of downtime outweigh these costs for critical applications.",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at [AWS RDS Console](https://console.aws.amazon.com/rds/). 2. In the left navigation pane, click on `Databases`. 3. Select the database instance that needs Multi-AZ deployment to be enabled. 4. Click the `Modify` button at the top right. 5. Scroll down to the `Availability & Durability` section. 6. Under `Multi-AZ deployment`, select `Yes` to enable. 7. Review the changes and click `Continue`. 8. On the `Review` page, choose `Apply immediately` to make the change without waiting for the next maintenance window, or `Apply during the next scheduled maintenance window`. 9. Click `Modify DB Instance` to apply the changes. **From Command Line:** 1. Run the following command to modify the RDS instance and enable Multi-AZ: ``` aws rds modify-db-instance --region <region-name> --db-instance-identifier <db-name> --multi-az --apply-immediately ``` 2. Confirm that the Multi-AZ deployment is enabled by running the following command: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].MultiAZ' ``` - The output should return `True`, indicating that Multi-AZ is enabled. 3. Repeat the procedure for other instances as necessary.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the RDS dashboard at [AWS RDS Console](https://console.aws.amazon.com/rds/). 2. In the navigation pane, under `Databases`, select the RDS instance you want to examine. 3. Click the `Instance Name` to see details, then navigate to the `Configuration` tab. 4. Under the `Availability & Durability` section, check the `Multi-AZ` status. - If Multi-AZ deployment is enabled, it will display `Yes`. - If it is disabled, the status will display `No`. 5. Repeat steps 2-4 to verify the Multi-AZ status of other RDS instances in the same region. 6. Change the region from the top of the navigation bar and repeat the audit for other regions. **From Command Line:** 1. Run the following command to list all RDS instances in the selected AWS region: ``` aws rds describe-db-instances --region <region-name> --query 'DBInstances[*].DBInstanceIdentifier' ``` 2. Run the following command using the instance identifier returned earlier to check the Multi-AZ status: ``` aws rds describe-db-instances --region <region-name> --db-instance-identifier <db-name> --query 'DBInstances[*].MultiAZ' ``` - If the output is `True`, Multi-AZ is enabled. - If the output is `False`, Multi-AZ is not enabled. 3. Repeat steps 1 and 2 to audit each RDS instance, and change regions to verify in other regions.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.3.1",
+ "Description": "Ensure that encryption is enabled for EFS file systems",
+ "Checks": [
+ "efs_encryption_at_rest_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Storage",
+ "SubSection": "3.3 Elastic File System (EFS)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).",
+ "RationaleStatement": "Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**It is important to note that EFS file system data-at-rest encryption must be turned on when creating the file system. If an EFS file system has been created without data-at-rest encryption enabled, then you must create another EFS file system with the correct configuration and transfer the data.** **Steps to create an EFS file system with data encrypted at rest:** **From Console:** 1. Login to the AWS Management Console and Navigate to the `Elastic File System (EFS)` dashboard. 2. Select `File Systems` from the left navigation panel. 3. Click the `Create File System` button from the dashboard top menu to start the file system setup process. 4. On the `Configure file system access` configuration page, perform the following actions: - Choose an appropriate VPC from the VPC dropdown list. - Within the `Create mount targets` section, check the boxes for all of the Availability Zones (AZs) within the selected VPC. These will be your mount targets. - Click `Next step` to continue. 5. Perform the following on the `Configure optional settings` page: - Create `tags` to describe your new file system. - Choose `performance mode` based on your requirements. - Check the `Enable encryption` box and choose `aws/elasticfilesystem` from the `Select KMS master key` dropdown list to enable encryption for the new file system, using the default master key provided and managed by AWS KMS. - Click `Next step` to continue. 6. Review the file system configuration details on the `review and create` page and then click `Create File System` to create your new AWS EFS file system. 7. Copy the data from the old unencrypted EFS file system onto the newly created encrypted file system. 8. Remove the unencrypted file system as soon as your data migration to the newly created encrypted file system is completed. 9. Change the AWS region from the navigation bar and repeat the entire process for the other AWS regions. **From CLI:** 1. Run the `describe-file-systems` command to view the configuration information for the selected unencrypted file system identified in the Audit steps: ``` aws efs describe-file-systems --region <region> --file-system-id <file-system-id> ``` 2. The command output should return the configuration information. 3. To provision a new AWS EFS file system, you need to generate a universally unique identifier (UUID) to create the token required by the `create-file-system` command. To create the required token, you can use a randomly generated UUID from https://www.uuidgenerator.net. 4. Run the `create-file-system` command using the unique token created at the previous step: ``` aws efs create-file-system --region <region> --creation-token <uuid> --performance-mode generalPurpose --encrypted ``` 5. The command output should return the new file system configuration metadata. 6. Run the `create-mount-target` command using the EFS file system ID returned from step 4 as the identifier and the ID of the Availability Zone (AZ) that will represent the mount target: ``` aws efs create-mount-target --region <region> --file-system-id <file-system-id> --subnet-id <subnet-id> ``` 7. The command output should return the new mount target metadata. 8. Now you can mount your file system from an EC2 instance. 9. Copy the data from the old unencrypted EFS file system to the newly created encrypted file system. 10. Remove the unencrypted file system as soon as your data migration to the newly created encrypted file system is completed: ``` aws efs delete-file-system --region <region> --file-system-id <unencrypted-file-system-id> ``` 11. Change the AWS region by updating the --region and repeat the entire process for the other AWS regions.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and Navigate to the Elastic File System (EFS) dashboard. 2. Select `File Systems` from the left navigation panel. 3. Each item on the list has a visible Encrypted field that displays data at rest encryption status. 4. Validate that this field reads `Encrypted` for all EFS file systems in all AWS regions. **From CLI:** 1. Run the `describe-file-systems` command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region: ``` aws efs describe-file-systems --region <region> --output table --query 'FileSystems[*].FileSystemId' ``` 2. The command output should return a table with the requested file system IDs. 3. Run the `describe-file-systems` command using the ID of the file system that you want to examine as `file-system-id` and the necessary query filters: ``` aws efs describe-file-systems --region <region> --file-system-id <file-system-id> --query 'FileSystems[*].Encrypted' ``` 4. The command output should return the file system encryption status as `true` or `false`. If the returned value is `false`, the selected AWS EFS file system is not encrypted and if the returned value is `true`, the selected AWS EFS file system is encrypted.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs",
+ "DefaultValue": "EFS file system data is encrypted at rest by default when creating a file system through the Console. However, encryption at rest is not enabled by default when creating a new file system using the AWS CLI, API, or SDKs."
+ }
+ ]
+ },
+ {
+ "Id": "4.1",
+ "Description": "Ensure CloudTrail is enabled in all regions",
+ "Checks": [
+ "cloudtrail_multi_region_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).",
+ "RationaleStatement": "The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally, - ensuring that a multi-region trail exists will help detect unexpected activity occurring in otherwise unused regions - ensuring that a multi-region trail exists will ensure that `Global Service Logging` is enabled for a trail by default to capture recordings of events generated on AWS global services - for a multi-region trail, ensuring that management events are configured for all types of Read/Writes ensures the recording of management operations that are performed on all resources in an AWS account",
+ "ImpactStatement": "S3 lifecycle features can be used to manage the accumulation and management of logs over time. See the following AWS resource for more information on these features: 1. https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html",
+ "RemediationProcedure": "Perform the following to enable global (Multi-region) CloudTrail logging: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. Click `Get Started Now` if it is presented, then: - Click `Add new trail`. - Enter a trail name in the `Trail name` box. - A trail created in the console is a multi-region trail by default. - Specify an S3 bucket name in the `S3 bucket` box. - Specify the AWS KMS alias under the `Log file SSE-KMS encryption` section, or create a new key. - Click `Next`. 4. Ensure the `Management events` check box is selected. 5. Ensure both `Read` and `Write` are checked under API activity. 6. Click `Next`. 7. Review your trail settings and click `Create trail`. **From Command Line:** Create a multi-region trail: ``` aws cloudtrail create-trail --name <trail-name> --bucket-name <s3-bucket-for-cloudtrail> --is-multi-region-trail ``` Enable multi-region on an existing trail: ``` aws cloudtrail update-trail --name <trail-name> --is-multi-region-trail ``` **Note:** Creating a CloudTrail trail via the CLI without providing any overriding options configures all `read` and `write` `Management Events` to be logged by default.",
+ "AuditProcedure": "Perform the following to determine if CloudTrail is enabled for all regions: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail) 2. Click on `Trails` in the left navigation pane - You will be presented with a list of trails across all regions 3. Ensure that at least one Trail has `Yes` specified in the `Multi-region trail` column 4. Click on a trail via the link in the `Name` column 5. Ensure `Logging` is set to `ON` 6. Ensure `Multi-region trail` is set to `Yes` 7. In the section `Management Events`, ensure that `API activity` set to `ALL` **From Command Line:** 1. List all trails: ``` aws cloudtrail describe-trails ``` 2. Ensure `IsMultiRegionTrail` is set to `true`: ``` aws cloudtrail get-trail-status --name <trail-name> ``` 3. Ensure `IsLogging` is set to `true`: ``` aws cloudtrail get-event-selectors --trail-name <trail-name> ``` 4. Ensure there is at least one `fieldSelector` for a trail that equals `Management`: - This should NOT output any results for Field: readOnly. If either `true` or `false` is returned, one of the checkboxes (`read` or `write`) is not selected. Example of correct output: ``` TrailARN: <your_trail_ARN>, AdvancedEventSelectors: [ { Name: Management events selector, FieldSelectors: [ { Field: eventCategory, Equals: [ Management ] ```",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-management-events:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html?icmpid=docs_cloudtrail_console#logging-management-events:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-services.html#cloud-trail-supported-services-data-events",
+ "DefaultValue": "Not Enabled"
+ }
+ ]
+ },
+ {
+ "Id": "4.2",
+ "Description": "Ensure CloudTrail log file validation is enabled",
+ "Checks": [
+ "cloudtrail_log_file_validation_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.",
+ "RationaleStatement": "Enabling log file validation will provide additional integrity checks for CloudTrail logs.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to enable log file validation on a given trail: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. Click on the target trail. 4. Within the `General details` section, click `edit`. 5. Under `Advanced settings`, check the `enable` box under `Log file validation`. 6. Click `Save changes`. **From Command Line:** Enable log file validation on a trail: ``` aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation ``` Note that periodic validation of logs using these digests can be carried out by running the following command: ``` aws cloudtrail validate-logs --trail-arn <trail_arn> --start-time <start_time> --end-time <end_time> ```",
+ "AuditProcedure": "Perform the following on each trail to determine if log file validation is enabled: **From Console:** 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. Click on `Trails` in the left navigation pane. 3. For every trail: - Click on a trail via the link in the `Name` column. - Under the `General details` section, ensure `Log file validation` is set to `Enabled`. **From Command Line:** List all trails: ``` aws cloudtrail describe-trails ``` Ensure `LogFileValidationEnabled` is set to `true` for each trail.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html",
+ "DefaultValue": "Not Enabled"
+ }
+ ]
+ },
+ {
+ "Id": "4.3",
+ "Description": "Ensure AWS Config is enabled in all regions",
+ "Checks": [
+ "config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions.",
+ "RationaleStatement": "The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.",
+ "ImpactStatement": "Enabling AWS Config in all regions provides comprehensive visibility into resource configurations, enhancing security and compliance monitoring. However, this may incur additional costs and require proper configuration management.",
+ "RemediationProcedure": "To implement AWS Config configuration: **From Console:** 1. Select the region you want to focus on in the top right of the console. 2. Click `Services`. 3. Click `Config`. 4. If a Config Recorder is enabled in this region, navigate to the Settings page from the navigation menu on the left-hand side. If a Config Recorder is not yet enabled in this region, select Get Started. 5. Select Record all resources supported in this region. 6. Choose to include global resources (IAM resources). 7. Specify an S3 bucket in the same account or in another managed AWS account. 8. Create an SNS Topic from the same AWS account or another managed AWS account. **From Command Line:** 1. Ensure there is an appropriate S3 bucket, SNS topic, and IAM role per the [AWS Config Service prerequisites](http://docs.aws.amazon.com/config/latest/developerguide/gs-cli-prereq.html). 2. Run this command to create a new configuration recorder: ``` aws configservice put-configuration-recorder --configuration-recorder name=<config-recorder-name>,roleARN=arn:aws:iam::<account-id>:role/<iam-role> --recording-group allSupported=true,includeGlobalResourceTypes=true ``` 3. Create a delivery channel configuration file locally which specifies the channel attributes, populated from the prerequisites set up previously: ``` { name: <delivery-channel-name>, s3BucketName: <bucket-name>, snsTopicARN: arn:aws:sns:<region>:<account-id>:<sns-topic>, configSnapshotDeliveryProperties: { deliveryFrequency: Twelve_Hours } } ``` 4. Run this command to create a new delivery channel, referencing the json configuration file made in the previous step: ``` aws configservice put-delivery-channel --delivery-channel file://<delivery-channel-file>.json ``` 5. Start the configuration recorder by running the following command: ``` aws configservice start-configuration-recorder --configuration-recorder-name <config-recorder-name> ```",
+ "AuditProcedure": "Process to evaluate AWS Config configuration per region: **From Console:** 1. Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/). 1. On the top right of the console select the target region. 1. If a Config Recorder is enabled in this region, you should navigate to the Settings page from the navigation menu on the left-hand side. If a Config Recorder is not yet enabled in this region, proceed to the remediation steps. 1. Ensure Record all resources supported in this region is checked. 1. Ensure Include global resources (e.g., AWS IAM resources) is checked, unless it is enabled in another region (this is only required in one region). 1. Ensure the correct S3 bucket has been defined. 1. Ensure the correct SNS topic has been defined. 1. Repeat steps 2 to 7 for each region. **From Command Line:** 1. Run this command to show all AWS Config Recorders and their properties: ``` aws configservice describe-configuration-recorders ``` 2. Evaluate the output to ensure that all recorders have a `recordingGroup` object which includes `allSupported: true`. Additionally, ensure that at least one recorder has `includeGlobalResourceTypes: true`. **Note:** There is one more parameter, ResourceTypes, in the recordingGroup object. We don't need to check it, as whenever we set allSupported to true, AWS enforces the resource types to be empty (ResourceTypes: []). Sample output: ``` { ConfigurationRecorders: [ { recordingGroup: { allSupported: true, resourceTypes: [], includeGlobalResourceTypes: true }, roleARN: arn:aws:iam::<AWS_Account_ID>:role/service-role/<config-role-name>, name: default } ] } ``` 3. Run this command to show the status for all AWS Config Recorders: ``` aws configservice describe-configuration-recorder-status ``` 4. In the output, find recorders with `name` key matching the recorders that were evaluated in step 2. Ensure that they include `recording: true` and `lastStatus: SUCCESS`.",
+ "AdditionalInformation": "",
+ "References": "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/describe-configuration-recorder-status.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/configservice/describe-configuration-recorders.html:https://docs.aws.amazon.com/config/latest/developerguide/gs-cli-prereq.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.4",
+ "Description": "Ensure that server access logging is enabled on the CloudTrail S3 bucket",
+ "Checks": [
+ "cloudtrail_logs_s3_bucket_access_logging_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket.",
+ "RationaleStatement": "By enabling server access logging on target S3 buckets, it is possible to capture all events that may affect objects within any target bucket. Configuring the logs to be placed in a separate bucket allows access to log information that can be useful in security and incident response workflows.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to enable server access logging: **From Console:** 1. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3). 2. Under `All Buckets` click on the target S3 bucket. 3. Click on `Properties` in the top right of the console. 4. Under `Bucket: <bucket-name>`, click `Logging`. 5. Configure bucket logging: - Check the `Enabled` box. - Select a Target Bucket from the list. - Enter a Target Prefix. 6. Click `Save`. **From Command Line:** 1. Get the name of the S3 bucket that CloudTrail is logging to: ``` aws cloudtrail describe-trails --region <region-name> --query trailList[*].S3BucketName ``` 2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>`, and optionally add an email address in the following template, then save it as `<file-name>.json`: ``` { LoggingEnabled: { TargetBucket: <bucket-name>, TargetPrefix: <log-file-prefix>, TargetGrants: [ { Grantee: { Type: AmazonCustomerByEmail, EmailAddress: <email-address> }, Permission: FULL_CONTROL } ] } } ``` 3. Run the `put-bucket-logging` command with bucket name and `<file-name>.json` as input; for more information, refer to [put-bucket-logging](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html): ``` aws s3api put-bucket-logging --bucket <bucket-name> --bucket-logging-status file://<file-name>.json ```",
+ "AuditProcedure": "Perform the following ensure that the CloudTrail S3 bucket has access logging is enabled: **From Console:** 1. Go to the Amazon CloudTrail console at [https://console.aws.amazon.com/cloudtrail/home](https://console.aws.amazon.com/cloudtrail/home). 2. In the API activity history pane on the left, click `Trails`. 3. In the Trails pane, note the bucket names in the S3 bucket column. 4. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3). 5. Under `All Buckets` click on a target S3 bucket. 6. Click on `Properties` in the top right of the console. 7. Under `Bucket: <bucket-name>`, click `Logging`. 8. Ensure `Enabled` is checked. **From Command Line:** 1. Get the name of the S3 bucket that CloudTrail is logging to: ``` aws cloudtrail describe-trails --query 'trailList[*].S3BucketName' ``` 2. Ensure logging is enabled on the bucket: ``` aws s3api get-bucket-logging --bucket <s3-bucket-for-cloudtrail> ``` Ensure the command does not return an empty output. Sample output for a bucket with logging enabled: ``` { LoggingEnabled: { TargetPrefix: <log-file-prefix>, TargetBucket: <logging-bucket> } } ```",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html:https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html",
+ "DefaultValue": "Logging is disabled."
+ }
+ ]
+ },
+ {
+ "Id": "4.5",
+ "Description": "Ensure CloudTrail logs are encrypted at rest using KMS CMKs",
+ "Checks": [
+ "cloudtrail_kms_encryption_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer-created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.",
+ "RationaleStatement": "Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data, as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.",
+ "ImpactStatement": "Customer-created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.",
+ "RemediationProcedure": "Perform the following to configure CloudTrail to use SSE-KMS: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. In the left navigation pane, choose `Trails`. 3. Click on a trail. 4. Under the `S3` section, click the edit button (pencil icon). 5. Click `Advanced`. 6. Select an existing CMK from the `KMS key Id` drop-down menu. - **Note:** Ensure the CMK is located in the same region as the S3 bucket. - **Note:** You will need to apply a KMS key policy on the selected CMK in order for CloudTrail, as a service, to encrypt and decrypt log files using the CMK provided. View the AWS documentation for [editing the selected CMK Key policy](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html). 7. Click `Save`. 8. You will see a notification message stating that you need to have decryption permissions on the specified KMS key to decrypt log files. 9. Click `Yes`. **From Command Line:** Run the following command to specify a KMS key ID to use with a trail: ``` aws cloudtrail update-trail --name <trail-name> --kms-key-id <cloudtrail-kms-key> ``` Run the following command to attach a key policy to a specified KMS key: ``` aws kms put-key-policy --key-id <cloudtrail-kms-key> --policy <cloudtrail-kms-key-policy> ```",
+ "AuditProcedure": "Perform the following to determine if CloudTrail is configured to use SSE-KMS: **From Console:** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail). 2. In the left navigation pane, choose `Trails`. 3. Select a trail. 4. In the `General details` section, select `Edit` to edit the trail configuration. 5. Ensure the box at `Log file SSE-KMS encryption` is checked and that a valid `AWS KMS alias` of a KMS key is entered in the respective text box. **From Command Line:** 1. Run the following command: ``` aws cloudtrail describe-trails ``` 2. For each trail listed, SSE-KMS is enabled if the trail has a `KmsKeyId` property defined.",
+ "AdditionalInformation": "Three statements that need to be added to the CMK policy: 1. Enable CloudTrail to describe CMK properties: ``` { \"Sid\": \"Allow CloudTrail access\", \"Effect\": \"Allow\", \"Principal\": { \"Service\": \"cloudtrail.amazonaws.com\" }, \"Action\": \"kms:DescribeKey\", \"Resource\": \"*\" } ``` 2. Granting encrypt permissions: ``` { \"Sid\": \"Allow CloudTrail to encrypt logs\", \"Effect\": \"Allow\", \"Principal\": { \"Service\": \"cloudtrail.amazonaws.com\" }, \"Action\": \"kms:GenerateDataKey*\", \"Resource\": \"*\", \"Condition\": { \"StringLike\": { \"kms:EncryptionContext:aws:cloudtrail:arn\": [ \"arn:aws:cloudtrail:*:aws-account-id:trail/*\" ] } } } ``` 3. Granting decrypt permissions: ``` { \"Sid\": \"Enable CloudTrail log decrypt permissions\", \"Effect\": \"Allow\", \"Principal\": { \"AWS\": \"arn:aws:iam::aws-account-id:user/username\" }, \"Action\": \"kms:Decrypt\", \"Resource\": \"*\", \"Condition\": { \"Null\": { \"kms:EncryptionContext:aws:cloudtrail:arn\": \"false\" } } } ```",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html:CCE-78919-8:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/put-key-policy.html",
+ "DefaultValue": "By default, CloudTrail logs are not encrypted with a KMS CMK. Logs may be encrypted with SSE-S3, but this does not provide the same level of control or auditing as KMS CMKs."
+ }
+ ]
+ },
+ {
+ "Id": "4.6",
+ "Description": "Ensure rotation for customer-created symmetric CMKs is enabled",
+ "Checks": [
+ "kms_cmk_rotation_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key, which is key material stored within the KMS that is tied to the key ID of the customer-created customer master key (CMK). The backing key is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can occur transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation cannot be enabled for any asymmetric CMK.",
+ "RationaleStatement": "Rotating encryption keys helps reduce the potential impact of a compromised key, as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. Keys should be rotated every year or upon an event that could result in the compromise of that key.",
+ "ImpactStatement": "Creation, management, and storage of CMKs may require additional time from an administrator.",
+ "RemediationProcedure": "**From Console:** 1. Sign in to the AWS Management Console and open the KMS console at: [https://console.aws.amazon.com/kms](https://console.aws.amazon.com/kms). 2. In the left navigation pane, click `Customer-managed keys`. 3. Select a key with `Key spec = SYMMETRIC_DEFAULT` that does not have automatic rotation enabled. 4. Select the `Key rotation` tab. 5. Check the `Automatically rotate this KMS key every year` box. 6. Click `Save`. 7. Repeat steps 3–6 for all customer-managed CMKs that do not have automatic rotation enabled. **From Command Line:** 1. Run the following command to enable key rotation: ``` aws kms enable-key-rotation --key-id <kms-key-id> ```",
+ "AuditProcedure": "**From Console:** 1. Sign in to the AWS Management Console and open the KMS console at: [https://console.aws.amazon.com/kms](https://console.aws.amazon.com/kms). 2. In the left navigation pane, click `Customer-managed keys`. 3. Select a customer-managed CMK where `Key spec = SYMMETRIC_DEFAULT`. 4. Select the `Key rotation` tab. 5. Ensure the `Automatically rotate this KMS key every year` box is checked. 6. Repeat steps 3–5 for all customer-managed CMKs where `Key spec = SYMMETRIC_DEFAULT`. **From Command Line:** 1. Run the following command to get a list of all keys and their associated `KeyIds`: ``` aws kms list-keys ``` 2. For each key, note the KeyId and run the following command: ``` describe-key --key-id <kms-key-id> ``` 3. If the response contains `KeySpec = SYMMETRIC_DEFAULT`, run the following command: ``` aws kms get-key-rotation-status --key-id <kms-key-id> ``` 4. Ensure `KeyRotationEnabled` is set to `true`. 5. Repeat steps 2–4 for all remaining CMKs.",
+ "AdditionalInformation": "",
+ "References": "https://aws.amazon.com/kms/pricing/:https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.7",
+ "Description": "Ensure VPC flow logging is enabled in all VPCs",
+ "Checks": [
+ "vpc_flow_logs_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.",
+ "RationaleStatement": "VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or gain insights during security workflows.",
+ "ImpactStatement": "By default, CloudWatch Logs will store logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind that the average time it takes for an organization to realize they have been breached is 210 days (at the time of this writing). Since additional time is required to research a breach, a minimum retention policy of 365 days allows for detection and investigation. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods: 1. https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html",
+ "RemediationProcedure": "Perform the following to enable VPC Flow Logs: **From Console:** 1. Sign into the management console. 2. Select `Services`, then select `VPC`. 3. In the left navigation pane, select `Your VPCs`. 4. Select a VPC. 5. In the right pane, select the `Flow Logs` tab. 6. If no Flow Log exists, click `Create Flow Log`. 7. For Filter, select `Reject`. 8. Enter a `Role` and `Destination Log Group`. 9. Click `Create Log Flow`. 10. Click on `CloudWatch Logs Group`. **Note:** Setting the filter to Reject will dramatically reduce the accumulation of logging data for this recommendation and provide sufficient information for the purposes of breach detection, research, and remediation. However, during periods of least privilege security group engineering, setting the filter to All can be very helpful in discovering existing traffic flows required for the proper operation of an already running environment. **From Command Line:** 1. Create a policy document, name it `role_policy_document.json`, and paste the following content: ``` { Version: 2012-10-17, Statement: [ { Sid: test, Effect: Allow, Principal: { Service: ec2.amazonaws.com }, Action: sts:AssumeRole } ] } ``` 2. Create another policy document, name it `iam_policy.json`, and paste the following content: ``` { Version: 2012-10-17, Statement: [ { Effect: Allow, Action:[ logs:CreateLogGroup, logs:CreateLogStream, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:PutLogEvents, logs:GetLogEvents, logs:FilterLogEvents ], Resource: * } ] } ``` 3. Run the following command to create an IAM role: ``` aws iam create-role --role-name <aws-support-iam-role> --assume-role-policy-document file://<file-path>role_policy_document.json ``` 4. Run the following command to create an IAM policy: ``` aws iam create-policy --policy-name <iam-policy-name> --policy-document file://<file-path>iam-policy.json ``` 5. Run the `attach-group-policy` command, using the IAM policy ARN returned from the previous step to attach the policy to the IAM role: ``` aws iam attach-group-policy --policy-arn arn:aws:iam::<aws-account-id>:policy/<iam-policy-name> --group-name <group-name> ``` - If the command succeeds, no output is returned. 6. Run the `describe-vpcs` command to get a list of VPCs in the selected region: ``` aws ec2 describe-vpcs --region <region> ``` - The command output should return a list of VPCs in the selected region. 7. Run the `create-flow-logs` command to create a flow log for a VPC: ``` aws ec2 create-flow-logs --resource-type VPC --resource-ids <vpc-id> --traffic-type REJECT --log-group-name <log-group-name> --deliver-logs-permission-arn <iam-role-arn> ``` 8. Repeat step 7 for other VPCs in the selected region. 9. Change the region by updating --region, and repeat the remediation procedure for each region.",
+ "AuditProcedure": "Perform the following to determine if VPC Flow logs are enabled: **From Console:** 1. Sign into the management console. 2. Select `Services`, then select `VPC`. 3. In the left navigation pane, select `Your VPCs`. 4. Select a VPC. 5. In the right pane, select the `Flow Logs` tab. 6. Ensure a Log Flow exists that has `Active` in the `Status` column. **From Command Line:** 1. Run the `describe-vpcs` command (OSX/Linux/UNIX) to list the VPC networks available in the current AWS region: ``` aws ec2 describe-vpcs --region <region> --query Vpcs[].VpcId ``` 2. The command output returns the `VpcId` of VPCs available in the selected region. 3. Run the `describe-flow-logs` command (OSX/Linux/UNIX) using the VPC ID to determine if the selected virtual network has the Flow Logs feature enabled: ``` aws ec2 describe-flow-logs --filter Name=resource-id,Values=<vpc-id> ``` - If there are no Flow Logs created for the selected VPC, the command output will return an empty list `[]`. 4. Repeat step 3 for other VPCs in the same region. 5. Change the region by updating `--region`, and repeat steps 1-4 for each region.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.8",
+ "Description": "Ensure that object-level logging for write events is enabled for S3 buckets",
+ "Checks": [
+ "cloudtrail_s3_dataevents_write_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
+ "RationaleStatement": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analyses, monitor specific patterns of user behavior in your AWS account, or take immediate actions on any object-level API activity within your S3 buckets using Amazon CloudWatch Events.",
+ "ImpactStatement": "Enabling logging for these object-level events may significantly increase the number of events logged and may incur additional costs.",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the S3 dashboard at `https://console.aws.amazon.com/s3/`. 2. In the left navigation panel, click `buckets`, and then click the name of the S3 bucket you want to examine. 3. Click the `Properties` tab to see the bucket configuration in detail. 4. In the `AWS CloudTrail data events` section, select the trail name for recording activity. You can choose an existing trail or create a new one by clicking the `Configure in CloudTrail` button or navigating to the [CloudTrail console](https://console.aws.amazon.com/cloudtrail/). 5. Once the trail is selected, select the `Data Events` check box. 6. Select `S3` from the `Data event type` drop-down. 7. Select `Log all events` from the `Log selector template` drop-down. 8. Repeat steps 2-7 to enable object-level logging of write events for other S3 buckets. **From Command Line:** 1. To enable `object-level` data events logging for S3 buckets within your AWS account, run the `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier: ``` aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --event-selectors '[{ ReadWriteType: WriteOnly, IncludeManagementEvents:true, DataResources: [{ Type: AWS::S3::Object, Values: [arn:aws:s3:::<s3-bucket-name>/] }] }]' ``` 2. The command output will be `object-level` event trail configuration. 3. If you want to enable it for all buckets at once, change the Values parameter to `[arn:aws:s3]` in the previous command. 4. Repeat step 1 for each s3 bucket to update `object-level` logging of write events. 5. Change the AWS region by updating the `--region` command parameter, and perform the process for the other regions.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the CloudTrail dashboard at `https://console.aws.amazon.com/cloudtrail/`. 2. In the left panel, click `Trails`, and then click the name of the trail that you want to examine. 3. Review `General details`. 4. Confirm that `Multi-region trail` is set to `Yes`. 5. Scroll down to `Data events` and confirm the configuration: - If `advanced event selectors` is being used, it should read: ``` Data Events: S3 Log selector template Log all events ``` - If `basic event selectors` is being used, it should read: ``` Data events: S3 Bucket Name: All current and future S3 buckets Write: Enabled ``` 6. Repeat steps 2-5 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps. **From Command Line:** 1. Run the `list-trails` command to list all trails: ``` aws cloudtrail list-trails ``` 2. The command output will be a list of trails: ``` TrailARN: arn:aws:cloudtrail:<region>:<account#>:trail/<trail-name>, Name: <trail-name>, HomeRegion: <region> ``` 3. Run the `get-trail` command to determine whether a trail is a multi-region trail: ``` aws cloudtrail get-trail --name <trail-name> --region <region-name> ``` 4. The command output should include: `IsMultiRegionTrail: true`. 5. Run the `get-event-selectors` command, using the `Name` of the trail and the `region` returned in step 2, to determine if data event logging is configured: ``` aws cloudtrail get-event-selectors --region <home-region> --trail-name <trail-name> --query EventSelectors[*].DataResources[] ``` 6. The command output should be an array that includes the S3 bucket defined for data event logging: ``` Type: AWS::S3::Object, Values: [ arn:aws:s3 ``` 7. If the `get-event-selectors` command returns an empty array, data events are not included in the trail's logging configuration; therefore, object-level API operations performed on S3 buckets within your AWS account are not being recorded. 8. Repeat steps 1-7 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/enable-cloudtrail-events.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.9",
+ "Description": "Ensure that object-level logging for read events is enabled for S3 buckets",
+ "Checks": [
+ "cloudtrail_s3_dataevents_read_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.",
+ "RationaleStatement": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analyses, monitor specific patterns of user behavior in your AWS account, or take immediate actions on any object-level API activity within your S3 buckets using Amazon CloudWatch Events.",
+ "ImpactStatement": "Enabling logging for these object-level events may significantly increase the number of events logged and may incur additional costs.",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`. 2. In the left navigation panel, click `buckets` and then click the name of the S3 bucket that you want to examine. 3. Click the `Properties` tab to see the bucket configuration in detail. 4. In the `AWS Cloud Trail data events` section, select the trail name for recording activity. You can choose an existing trail or create a new one by clicking the `Configure in CloudTrail` button or navigating to the [CloudTrail console](https://console.aws.amazon.com/cloudtrail/). 5. Once the trail is selected, select the `Data Events` check box. 6. Select `S3` from the `Data event type` drop-down. 7. Select `Log all events` from the `Log selector template` drop-down. 8. Repeat steps 2-7 to enable object-level logging of read events for other S3 buckets. **From Command Line:** 1. To enable `object-level` data events logging for S3 buckets within your AWS account, run the `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier: ``` aws cloudtrail put-event-selectors --region <region-name> --trail-name <trail-name> --event-selectors '[{ ReadWriteType: ReadOnly, IncludeManagementEvents:true, DataResources: [{ Type: AWS::S3::Object, Values: [arn:aws:s3:::<s3-bucket-name>/] }] }]' ``` 2. The command output will be `object-level` event trail configuration. 3. If you want to enable it for all buckets at once, change the Values parameter to `[arn:aws:s3]` in the previous command. 4. Repeat step 1 for each s3 bucket to update `object-level` logging of read events. 5. Change the AWS region by updating the `--region` command parameter, and perform the process for the other regions.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and navigate to the CloudTrail dashboard at `https://console.aws.amazon.com/cloudtrail/`. 2. In the left panel, click `Trails`, and then click the name of the trail that you want to examine. 3. Review `General details`. 4. Confirm that `Multi-region trail` is set to `Yes` 5. Scroll down to `Data events` 5. Scroll down to `Data events` and confirm the configuration: - If `advanced event selectors` is being used, it should read: ``` Data Events: S3 Log selector template Log all events ``` - If `basic event selectors` is being used, it should read: ``` Data events: S3 Bucket Name: All current and future S3 buckets Read: Enabled ``` 6. Repeat steps 2-5 to verify that each trail has multi-region enabled and is configured to log data events. If a trail does not have multi-region enabled and data event logging configured, refer to the remediation steps. **From Command Line:** 1. Run the `describe-trails` command to list all trail names: ``` aws cloudtrail describe-trails --region <region-name> --output table --query trailList[*].Name ``` 2. The command output will be table of the trail names. 3. Run the `get-event-selectors` command using the name of a trail returned at the previous step and custom query filters to determine if data event logging is configured: ``` aws cloudtrail get-event-selectors --region <region-name> --trail-name <trail-name> --query EventSelectors[*].DataResources[] ``` 4. The command output should be an array that includes the S3 bucket defined for data event logging. 5. If the `get-event-selectors` command returns an empty array, data events are not included in the trail's logging configuration; therefore, object-level API operations performed on S3 buckets within your AWS account are not being recorded. 6. Repeat steps 1-5 to verify the configuration of each trail. 7. Change the AWS region by updating the `--region` command parameter, and perform the audit process for other regions.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AmazonS3/latest/user-guide/enable-cloudtrail-events.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.10",
+ "Description": "Ensure all AWS-managed web front-end services have access logging enabled",
+ "Checks": [
+ "cloudfront_distributions_logging_enabled",
+ "elbv2_logging_enabled",
+ "apigateway_restapi_logging_enabled",
+ "apigatewayv2_api_access_logging_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Logging",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that access logging is enabled for all AWS-managed web front-end services that terminate or front HTTP(S) traffic, including Amazon CloudFront distributions, Application Load Balancers (ALB), Network Load Balancers (NLB), and Amazon API Gateway REST/HTTP API stages with public endpoints. Access logs must be enabled with delivery to a designated S3 bucket or CloudWatch Logs destination that is protected with appropriate access controls. This control requires logging of request details such as client IP address, timestamp, HTTP method, requested URI, response status code, bytes transferred, and user agent for every request processed by these services. CloudTrail provides management event logging for these resources, but access logs are required to capture the actual HTTP request/response activity at the network edge layers.",
+ "RationaleStatement": "AWS-managed web front-end services (CloudFront, ALB/NLB, API Gateway) represent the primary HTTP(S) ingress points into AWS accounts and are the first line of defense against web attacks, reconnaissance, and abuse attempts. CloudTrail logs management actions (create/update/delete) and data events but does not capture the content of HTTP requests/responses or client activity, leaving a critical visibility gap for security monitoring and incident response. Access logs from these services enable reconstruction of all web traffic, detection of anomalous patterns, forensic analysis of incidents, and compliance proof that internet-facing entry points were monitored. Without these logs, security teams cannot distinguish legitimate traffic from attacks or prove access patterns during audits.",
+ "ImpactStatement": "Enabling access logging incurs additional storage costs for log delivery and retention, as well as minor configuration overhead for creating dedicated logging buckets, IAM roles, and retention policies. Costs can be managed through lifecycle policies, log sampling, and tiered storage classes.",
+ "RemediationProcedure": "Following instructions enable standard access logging for CloudFront distributions using the AWS Management Console. 1. Open the CloudFront console from the AWS Management Console. 2. Click Distributions in the left navigation and click on the Distribution ID needing remediation. 3. Go to the \"Logging\" tab and click on \"Create access log delivery\" - Select \"Deliver to\" for your preferred location: S3 or CloudWatch log group - Select the ARN of your log destination resource - Click on Submit 4. Confirm if you see the access log destination in the logging tab",
+ "AuditProcedure": "As an example with CloudFront, verify following the below steps if access logging is enabled: 1. Open the CloudFront console from the AWS Management Console. 2. Click Distributions in the left navigation. 3. For each Distribution ID (e.g., E123ABC...), click the Distribution ID and go to the \"Logging\" tab 4. Check if one or more \"Access log destinations\" are present with a destination type of S3 or CloudWatch log group.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1",
+ "Description": "Ensure unauthorized API calls are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_unauthorized_api_calls"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring unauthorized API calls will help reduce the time it takes to detect malicious activity and can alert you to potential security incidents.",
+ "ImpactStatement": "This alert may be triggered by normal read-only console activities that attempt to opportunistically gather optional information but gracefully fail if they lack the necessary permissions. If an excessive number of alerts are generated, then an organization may wish to consider adding read access to the limited IAM user permissions solely to reduce the number of alerts. In some cases, doing this may allow users to actually view some areas of the system; any additional access granted should be reviewed for alignment with the original limited IAM user intent.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for unauthorized API calls and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <unauthorized-api-calls-metric> --metric-transformations metricName=unauthorized_api_calls_metric,metricNamespace=CISBenchmark,metricValue=1 --filter-pattern { ($.errorCode =*UnauthorizedOperation) || ($.errorCode =AccessDenied*) && ($.sourceIPAddress!=delivery.logs.amazonaws.com) && ($.eventName!=HeadBucket) } ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name unauthorized_api_calls_alarm --metric-name unauthorized_api_calls_metric --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace CISBenchmark --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.errorCode =*UnauthorizedOperation) || ($.errorCode =AccessDenied*) && ($.sourceIPAddress!=delivery.logs.amazonaws.com) && ($.eventName!=HeadBucket) }, ``` 4. Note the `<unauthorized-api-calls-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<unauthorized-api-calls-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query MetricAlarms[?MetricName == <unauthorized-api-calls-metric>] ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://aws.amazon.com/sns/:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2",
+ "Description": "Ensure management console sign-in without MFA is monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_sign_in_without_mfa"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA. These type of accounts are more susceptible to compromise and unauthorized access.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Management Console sign-ins without MFA and uses the `<trail-log-group-name>` taken from audit step 1. ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name `<no-mfa-console-signin-metric>` --metric-transformations metricName= `<no-mfa-console-signin-metric>`,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) }' ``` Or, to reduce false positives in case Single Sign-On (SSO) is used in the organization: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name `<no-mfa-console-signin-metric>` --metric-transformations metricName= `<no-mfa-console-signin-metric>`,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name `<no-mfa-console-signin-alarm>` --metric-name `<no-mfa-console-signin-metric>` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: ``` aws cloudtrail describe-trails ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: ``` aws cloudtrail get-trail-status --name <trail-name> ``` - ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: ``` aws cloudtrail get-event-selectors --trail-name <trail-name> ``` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) } ``` Or, to reduce false positives in case Single Sign-On (SSO) is used in the organization: ``` filterPattern: { ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success) } ``` 4. Note the `<no-mfa-console-signin-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<no-mfa-console-signin-metric>` captured in step 4. ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName== <no-mfa-console-signin-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored Filter pattern set to `{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) && ($.userIdentity.type = IAMUser) && ($.responseElements.ConsoleLogin = Success}`: - reduces false alarms raised when a user logs in via SSO",
+ "References": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/viewing_metrics_with_cloudwatch.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.3",
+ "Description": "Ensure usage of the 'root' account is monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_root_usage"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts to detect unauthorized use or attempts to use the root account.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring 'root' account logins will provide visibility into the use of a fully privileged account and the opportunity to reduce its usage.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for 'root' account usage and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name `<trail-log-group-name>` --filter-name `<root-usage-metric>` --metric-transformations metricName= `<root-usage-metric>` ,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ $.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name `<root-usage-alarm>` --metric-name `<root-usage-metric>` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns_topic_arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: ``` aws cloudtrail describe-trails ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: ``` aws cloudtrail get-trail-status --name <trail-name> ``` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: ``` aws cloudtrail get-event-selectors --trail-name <trail-name> ``` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { $.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent } ``` 4. Note the `<root-usage-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<root-usage-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<root-usage-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.4",
+ "Description": "Ensure IAM policy changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_policy_changes"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to Identity and Access Management (IAM) policies.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.",
+ "ImpactStatement": "Monitoring these changes may result in a number of false positives, especially in larger environments. This alert may require more tuning than others to eliminate some of those erroneous notifications.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for IAM policy changes and the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name `<trail-log-group-name>` --filter-name `<iam-changes-metric>` --metric-transformations metricName= `<iam-changes-metric>`,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name `<iam-changes-alarm>` --metric-name `<iam-changes-metric>` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrails: ``` aws cloudtrail describe-trails ``` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: ``` aws cloudtrail get-trail-status --name <trail-name> ``` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: ``` aws cloudtrail get-event-selectors --trail-name <trail-name> ``` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: {($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)} ``` 4. Note the `<iam-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<iam-change-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<iam-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.5",
+ "Description": "Ensure CloudTrail configuration changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be used to detect changes to CloudTrail's configurations.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility into the activities performed in the AWS account.",
+ "ImpactStatement": "Ensuring that changes to CloudTrail configurations are monitored enhances security by maintaining the integrity of logging mechanisms. Automated monitoring can provide real-time alerts; however, it may require additional setup and resources to configure and manage these alerts effectively. These steps can be performed manually within a company's existing SIEM platform in cases where CloudTrail logs are monitored outside of the AWS monitoring tools in CloudWatch.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for CloudTrail configuration changes and the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <cloudtrail-cfg-changes-metric> --metric-transformations metricName=<cloudtrail-cfg-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <cloudtrail-cfg-changes-alarm> --metric-name <cloudtrail-cfg-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) } ``` 4. Note the `<cloudtrail-cfg-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<cloudtrail-cfg-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<cloudtrail-cfg-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.6",
+ "Description": "Ensure AWS Management Console authentication failures are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_authentication_failures"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring failed console logins may decrease the lead time to detect an attempt to brute-force a credential, which may provide an indicator, such as the source IP address, that can be used in other event correlations.",
+ "ImpactStatement": "Monitoring for these failures may generate a large number of alerts, especially in larger environments.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS management Console login failures and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <console-signin-failure-metric> --metric-transformations metricName=<console-signin-failure-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.errorMessage = Failed authentication) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <console-signin-failure-alarm> --metric-name <console-signin-failure-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = ConsoleLogin) && ($.errorMessage = Failed authentication) } ``` 4. Note the `<console-signin-failure-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<console-signin-failure-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<console-signin-failure-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.7",
+ "Description": "Ensure disabling or scheduled deletion of customer created CMKs is monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer-created CMKs that have changed state to disabled or are scheduled for deletion.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Data encrypted with disabled or deleted keys will no longer be accessible. Changes in the state of a CMK should be monitored to ensure that the change is intentional.",
+ "ImpactStatement": "Creation, storage, and management of CMK may require additional labor compared to the use of AWS-managed keys.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for CMKs that have been disabled or scheduled for deletion and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <disable-or-delete-cmk-changes-metric> --metric-transformations metricName=<disable-or-delete-cmk-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <disable-or-delete-cmk-changes-alarm> --metric-name <disable-or-delete-cmk-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: {($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) } ``` 4. Note the `<disable-or-delete-cmk-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<disable-or-delete-cmk-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<disable-or-delete-cmk-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.8",
+ "Description": "Ensure S3 bucket policy changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to S3 bucket policies may reduce the time it takes to detect and correct permissive policies on sensitive S3 buckets.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for changes to S3 bucket policies and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <s3-bucket-policy-changes-metric> --metric-transformations metricName=<s3-bucket-policy-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <s3-bucket-policy-changes-alarm> --metric-name <s3-bucket-policy-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) } ``` 4. Note the `<s3-bucket-policy-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<s3-bucket-policy-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<s3-bucket-policy-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.9",
+ "Description": "Ensure AWS Config configuration changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to the AWS Config configuration will help ensure sustained visibility of the configuration items within the AWS account.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Configuration changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <aws-config-changes-metric> --metric-transformations metricName=<aws-config-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <aws-config-changes-alarm> --metric-name <aws-config-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) } ``` 4. Note the `<aws-config-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<aws-config-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<aws-config-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.10",
+ "Description": "Ensure security group changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_security_group_changes"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Security groups are stateful packet filters that control ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established to detect changes to security groups.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to security groups will help ensure that resources and services are not unintentionally exposed.",
+ "ImpactStatement": "This may require additional 'tuning' to eliminate false positives and filter out expected activity so that anomalies are easier to detect.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for security groups changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <security-group-changes-metric> --metric-transformations metricName=<security-group-changes-metric>,metricNamespace=CISBenchmark,metricValue=1 --filter-pattern { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = ModifySecurityGroupRules) } ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <security-group-changes-alarm> --metric-name <security-group-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace CISBenchmark --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = ModifySecurityGroupRules) } ``` 4. Note the `<security-group-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<security-group-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query MetricAlarms[?MetricName==<security-group-changes-metric>] ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored AWS has recently introduced a new API, ModifySecurityGroupRules, which modifies the rules of a security group.",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html:https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySecurityGroupRules.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.11",
+ "Description": "Ensure Network Access Control List (NACL) changes are monitored",
+ "Checks": [
+ "cloudwatch_changes_to_network_acls_alarm_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for any changes made to NACLs.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to NACLs will help ensure that AWS resources and services are not unintentionally exposed.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for NACL changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <nacl-changes-metric> --metric-transformations metricName=<nacl-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <nacl-changes-alarm> --metric-name <nacl-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) } ``` 4. Note the `<nacl-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<nacl-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<nacl-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.12",
+ "Description": "Ensure changes to network gateways are monitored",
+ "Checks": [
+ "cloudwatch_changes_to_network_gateways_alarm_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Network gateways are required to send and receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.",
+ "ImpactStatement": "Monitoring changes to network gateways helps detect unauthorized modifications that could compromise network security. Implementing automated monitoring and alerts can improve incident response times, but it may require additional configuration and maintenance efforts.",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for network gateways changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <network-gw-changes-metric> --metric-transformations metricName=<network-gw-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <network-gw-changes-alarm> --metric-name <network-gw-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ``` 5. Implement logging and alerting mechanisms: ``` aws sns create-topic --name NetworkGatewayChangesAlerts ```` ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol email --notification-endpoint <email-address> ``` ``` aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChangesAlarm --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) } ``` 4. Note the `<network-gw-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<network-gw-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<network-gw-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>` 8. Ensure automated monitoring is enabled: ``` aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChanges --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions <sns-topic-arn> ```",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.13",
+ "Description": "Ensure route table changes are monitored",
+ "Checks": [
+ "cloudwatch_changes_to_network_route_tables_alarm_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring changes to route tables will help ensure that all VPC traffic flows through the expected path and prevent any accidental or intentional modifications that may lead to uncontrolled network traffic. An alarm should be triggered every time an AWS API call is performed to create, replace, delete, or disassociate a route table.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for route table changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-pattern '{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <route-table-changes-alarm> --metric-name <route-table-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: {($.eventSource = ec2.amazonaws.com) && ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) } ``` 4. Note the `<route-table-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<route-table-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<route-table-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.14",
+ "Description": "Ensure VPC changes are monitored",
+ "Checks": [
+ "cloudwatch_changes_to_vpcs_alarm_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is possible to have more than one VPC within an account; additionally, it is also possible to create a peer connection between two VPCs, enabling network traffic to route between them. It is recommended that a metric filter and alarm be established for changes made to VPCs.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. VPCs in AWS are logically isolated virtual networks that can be used to launch AWS resources. Monitoring changes to VPC configurations will help ensure that VPC traffic flow is not negatively impacted. Changes to VPCs can affect network accessibility from the public internet and additionally impact VPC traffic flow to and from the resources launched in the VPC.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for VPC changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <vpc-changes-metric> --metric-transformations metricName=<vpc-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <vpc-changes-alarm> --metric-name <vpc-changes-metric> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) } ``` 4. Note the `<vpc-changes-metric>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<vpc-changes-metric>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<vpc-changes-metric>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html:https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/sns/latest/dg/SubscribeTopic.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.15",
+ "Description": "Ensure AWS Organizations changes are monitored",
+ "Checks": [
+ "cloudwatch_log_metric_filter_aws_organizations_changes"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to AWS Organizations in the master AWS account.",
+ "RationaleStatement": "CloudWatch is an AWS native service that allows you to observe and monitor resources and applications. CloudTrail logs can also be sent to an external Security Information and Event Management (SIEM) environment for monitoring and alerting. Monitoring AWS Organizations changes can help you prevent unwanted, accidental, or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps ensure that any unexpected changes made within your AWS Organizations can be investigated and that any unwanted changes can be rolled back.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription: 1. Create a metric filter based on the provided filter pattern that checks for AWS Organizations changes and uses the `<trail-log-group-name>` taken from audit step 1: ``` aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <organizations-changes> --metric-transformations metricName=<organizations-changes>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit)) }' ``` **Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together. 2. Create an SNS topic that the alarm will notify: ``` aws sns create-topic --name <sns-topic-name> ``` **Note**: You can execute this command once and then reuse the same topic for all monitoring alarms. **Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2. 3. Create an SNS subscription for the topic created in step 2: ``` aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints> ``` **Note**: You can execute this command once and then reuse the same subscription for all monitoring alarms. 4. Create an alarm that is associated with the CloudWatch Logs metric filter created in step 1 and the SNS topic created in step 2: ``` aws cloudwatch put-metric-alarm --alarm-name <organizations-changes> --metric-name <organizations-changes> --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn> ```",
+ "AuditProcedure": "If you are using CloudTrail trails and CloudWatch, perform the following to ensure that there is at least one active multi-region CloudTrail trail with the prescribed metric filters and alarms configured: 1. Identify the log group name that is configured for use with the active multi-region CloudTrail trail: - List all CloudTrail trails: `aws cloudtrail describe-trails` - Identify multi-region CloudTrail trails: `Trails with IsMultiRegionTrail set to true` - Note the value associated with Name:`<trail-name>` - Note the `<trail-log-group-name>` within the value associated with CloudWatchLogsLogGroupArn - Example: `arn:aws:logs:<region>:<account-id>:log-group:<trail-log-group-name>:*` - Ensure the identified multi-region CloudTrail trail is active: - `aws cloudtrail get-trail-status --name <trail-name>` - Ensure `IsLogging` is set to `TRUE` - Ensure the identified multi-region CloudTrail trail captures all management events: - `aws cloudtrail get-event-selectors --trail-name <trail-name>` - Ensure there is at least one `event selector` for a trail with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All` 2. Get a list of all associated metric filters for the `<trail-log-group-name>` captured in step 1: ``` aws logs describe-metric-filters --log-group-name <trail-log-group-name> ``` 3. Ensure the output from the above command contains the following: ``` filterPattern: { ($.eventSource = organizations.amazonaws.com) && (($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit)) } ``` 4. Note the `<organizations-changes>` value associated with the `filterPattern` from step 3. 5. Get a list of CloudWatch alarms, and filter on the `<organizations-changes>` captured in step 4: ``` aws cloudwatch describe-alarms --query 'MetricAlarms[?MetricName==<organizations-changes>]' ``` 6. Note the `AlarmActions` value; this will provide the SNS topic ARN value. 7. Ensure there is at least one active subscriber to the SNS topic: ``` aws sns list-subscriptions-by-topic --topic-arn <sns-topic-arn> ``` - At least one subscription should have SubscriptionArn with a valid AWS ARN. - Example of valid SubscriptionArn: `arn:aws:sns:<region>:<account-id>:<sns-topic-name>:<subscription-id>`",
+ "AdditionalInformation": "Configuring a log metric filter and alarm on a multi-region (global) CloudTrail trail: - ensures that activities from all regions (both used and unused) are monitored - ensures that activities on all supported global services are monitored - ensures that all management events across all regions are monitored",
+ "References": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.16",
+ "Description": "Ensure AWS Security Hub is enabled",
+ "Checks": [
+ "securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.",
+ "RationaleStatement": "AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices, enabling you to quickly assess the security posture across your AWS accounts.",
+ "ImpactStatement": "It is recommended that AWS Security Hub be enabled in all regions. AWS Security Hub requires that AWS Config be enabled.",
+ "RemediationProcedure": "To grant the permissions required to enable Security Hub, attach the Security Hub managed policy `AWSSecurityHubFullAccess` to an IAM user, group, or role. Enabling Security Hub: **From Console:** 1. Use the credentials of the IAM identity to sign in to the Security Hub console. 2. When you open the Security Hub console for the first time, choose `Go to Security Hub`. 3. The `Security standards` section on the welcome page lists supported security standards. Check the box for a standard to enable it. 3. Choose `Enable Security Hub`. **From Command Line:** 1. Run the `enable-security-hub` command, including `--enable-default-standards` to enable the default standards: ``` aws securityhub enable-security-hub --enable-default-standards ``` 2. To enable Security Hub without the default standards, include `--no-enable-default-standards`: ``` aws securityhub enable-security-hub --no-enable-default-standards ```",
+ "AuditProcedure": "Follow this process to evaluate AWS Security Hub configuration per region: **From Console:** 1. Sign in to the AWS Management Console and open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/. 2. On the top right of the console, select the target Region. 3. If the Security Hub > Summary page is displayed, then Security Hub is set up for the selected region. 4. If presented with Setup Security Hub or Get Started With Security Hub, refer to the remediation steps. 5. Repeat steps 2 to 4 for each region. **From Command Line:** Run the following command to verify the Security Hub status: ``` aws securityhub describe-hub ``` This will list the Security Hub status by region. Check for a 'SubscribedAt' value. Example output: ``` { HubArn: <security-hub-arn>, SubscribedAt: 2022-08-19T17:06:42.398Z, AutoEnableControls: true } ``` An error will be returned if Security Hub is not enabled. Example error: ``` An error occurred (InvalidAccessException) when calling the DescribeHub operation: Account <Account ID> is not subscribed to AWS Security Hub ```",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-get-started.html:https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html#securityhub-enable-api:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/enable-security-hub.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1",
+ "Description": "Ensure EBS volume encryption is enabled in all regions",
+ "Checks": [
+ "ec2_ebs_default_encryption"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "SubSection": "6.1 Elastic Compute Cloud (EC2)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
+ "RationaleStatement": "Encrypting data at rest reduces the likelihood of unintentional exposure and can nullify the impact of disclosure if the encryption remains unbroken.",
+ "ImpactStatement": "Losing access to or removing the KMS key used by the EBS volumes will result in the inability to access the volumes.",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon EC2 console using https://console.aws.amazon.com/ec2/. 2. Under `Account attributes`, click `EBS encryption`. 3. Click `Manage`. 4. Check the `Enable` box. 5. Click `Update EBS encryption`. 6. Repeat for each region in which EBS volume encryption is not enabled by default. **Note:** EBS volume encryption is configured per region. **From Command Line:** 1. Run the following command: ``` aws --region <region> ec2 enable-ebs-encryption-by-default ``` 2. Verify that `EbsEncryptionByDefault: true` is displayed. 3. Repeat for each region in which EBS volume encryption is not enabled by default. **Note:** EBS volume encryption is configured per region.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console and open the Amazon EC2 console using https://console.aws.amazon.com/ec2/. 2. Under `Settings`, click `EBS encryption`. 3. Verify `Always encrypt new EBS volumes` displays `Enabled`. 4. Repeat for each region in use. **Note:** EBS volume encryption is configured per region. **From Command Line:** 1. Run the following command: ``` aws --region <region> ec2 get-ebs-encryption-by-default ``` 2. Verify that `EbsEncryptionByDefault: true` is displayed. 3. Repeat for each region in use. **Note:** EBS volume encryption is configured per region.",
+ "AdditionalInformation": "Default EBS volume encryption only applies to newly created EBS volumes; existing EBS volumes are **not** converted automatically.",
+ "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html:https://aws.amazon.com/blogs/aws/new-opt-in-to-default-encryption-for-new-ebs-volumes/",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2",
+ "Description": "Ensure CIFS access is restricted to trusted networks to prevent unauthorized access",
+ "Checks": [
+ "ec2_instance_port_cifs_exposed_to_internet"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "SubSection": "6.1 Elastic Compute Cloud (EC2)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Common Internet File System (CIFS) is a network file-sharing protocol that allows systems to share files over a network. However, unrestricted CIFS access can expose your data to unauthorized users, leading to potential security risks. It is important to restrict CIFS access to only trusted networks and users to prevent unauthorized access and data breaches.",
+ "RationaleStatement": "Allowing unrestricted CIFS access can lead to significant security vulnerabilities, as it may allow unauthorized users to access sensitive files and data. By restricting CIFS access to known and trusted networks, you can minimize the risk of unauthorized access and protect sensitive data from exposure to potential attackers. Implementing proper network access controls and permissions is essential for maintaining the security and integrity of your file-sharing systems.",
+ "ImpactStatement": "Restricting CIFS access may require additional configuration and management effort. However, the benefits of enhanced security and reduced risk of unauthorized access to sensitive data far outweigh the potential challenges.",
+ "RemediationProcedure": "**From Console:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 Dashboard and select the Security Groups section under `Network & Security`. 3. Identify the security group that allows unrestricted ingress on port 445. 4. Select the security group and click the `Edit Inbound Rules` button. 5. Locate the rule allowing unrestricted access on port 445 (typically listed as `0.0.0.0/0` or `::/0`). 6. Modify the rule to restrict access to specific IP ranges or trusted networks only. 7. Save the changes to the security group. **From Command Line:** 1. Run the following command to remove or modify the unrestricted rule for CIFS access: ``` aws ec2 revoke-security-group-ingress --region <region-name> --group-id <security-group-id> --protocol tcp --port 445 --cidr 0.0.0.0/0 ``` - Optionally, run the `authorise-security-group-ingress` command to create a new rule, specifying a trusted CIDR range instead of `0.0.0.0/0`. 2. Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted: ``` aws ec2 describe-security-groups --region <region-name> --group-ids <security-group-id> --query 'SecurityGroups[*].IpPermissions[?ToPort==`445`].{CIDR:IpRanges[*].CidrIp,Port:ToPort}' ``` 3. Repeat the remediation for other security groups and regions as necessary.",
+ "AuditProcedure": "**From Console:** 1. Login to the AWS Management Console. 2. Navigate to the EC2 Dashboard and select the Security Groups section under `Network & Security`. 3. Identify the security groups associated with instances or resources that may be using CIFS. 4. Review the inbound rules of each security group to check for rules that allow unrestricted access on port 445 (the port used by CIFS). - Specifically, look for inbound rules that allow access from `0.0.0.0/0` or `::/0` on port 445. 5. Document any instances where unrestricted access is allowed and verify whether it is necessary for the specific use case. **From Command Line:** 1. Run the following command to list all security groups and identify those associated with CIFS: ``` aws ec2 describe-security-groups --region <region-name> --query 'SecurityGroups[*].GroupId' ``` 2. Check for any inbound rules that allow unrestricted access on port 445 using the following command: ``` aws ec2 describe-security-groups --region <region-name> --group-ids <security-group-id> --query 'SecurityGroups[*].IpPermissions[?ToPort==`445`].{CIDR:IpRanges[*].CidrIp,Port:ToPort}' ``` - Look for `0.0.0.0/0` or `::/0` in the output, which indicates unrestricted access. 3. Repeat the audit for other regions and security groups as necessary.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.2",
+ "Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports",
+ "Checks": [
+ "ec2_networkacl_allow_ingress_any_port",
+ "ec2_networkacl_allow_ingress_tcp_port_22",
+ "ec2_networkacl_allow_ingress_tcp_port_3389"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
+ "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Console:** Perform the following steps to remediate a network ACL: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click `Network ACLs`. 3. For each network ACL that needs remediation, perform the following: - Select the network ACL. - Click the `Inbound Rules` tab. - Click `Edit inbound rules`. - Either A) update the Source field to a range other than 0.0.0.0/0, or B) click `Delete` to remove the offending inbound rule. - Click `Save`.",
+ "AuditProcedure": "**From Console:** Perform the following steps to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at https://console.aws.amazon.com/vpc/home. 2. In the left pane, click `Network ACLs`. 3. For each network ACL, perform the following: - Select the network ACL. - Click the `Inbound Rules` tab. - Ensure that no rule exists which has a port range that includes port `22` or `3389`, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, has a `Source` of `0.0.0.0/0`, and shows `ALLOW`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html:https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.3",
+ "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports",
+ "Checks": [
+ "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.",
+ "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases the attack surface of resources and unnecessarily raises the risk of resource compromise.",
+ "ImpactStatement": "When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the 0.0.0.0/0 inbound rule.",
+ "RemediationProcedure": "Perform the following to implement the prescribed state: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following: - Select the security group. - Click the `Inbound Rules` tab. - Click the `Edit inbound rules` button. - Identify the rules to be edited or removed. - Either A) update the Source field to a range other than 0.0.0.0/0, or B) click `Delete` to remove the offending inbound rule. - Click `Save rules`.",
+ "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following: - Select the security group. - Click the `Inbound Rules` tab. - Ensure that no rule exists which has a port range including port `22` or `3389`, uses the protocols TCP (6), UDP (17), or ALL (-1), or other remote server administration ports for your environment, and has a `Source` of `0.0.0.0/0`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.4",
+ "Description": "Ensure no security groups allow ingress from ::/0 to remote server administration ports",
+ "Checks": [
+ "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`.",
+ "RationaleStatement": "Public access to remote server administration ports, such as 22 (when used for SSH, not SFTP) and 3389, increases attack surface of resources and unnecessarily raises the risk of resource compromise.",
+ "ImpactStatement": "When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the ::/0 inbound rule.",
+ "RemediationProcedure": "Perform the following to implement the prescribed state: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following: - Select the security group. - Click the `Inbound Rules` tab. - Click the `Edit inbound rules` button. - Identify the rules to be edited or removed. - Either A) update the Source field to a range other than ::/0, or B) Click `Delete` to remove the offending inbound rule. - Click `Save rules`.",
+ "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click `Security Groups`. 3. For each security group, perform the following: - Select the security group. - Click the `Inbound Rules` tab. - Ensure that no rule exists which has a port range including port `22`, `3389`, or other remote server administration ports for your environment, and has a `Source` of `::/0`. **Note:** A port value of `ALL` or a port range such as `0-3389` includes port `22`, `3389`, and potentially other remote server administration ports.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#deleting-security-group-rule",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.5",
+ "Description": "Ensure the default security group of every VPC restricts all traffic",
+ "Checks": [
+ "ec2_securitygroup_default_restrict_traffic"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound. The default VPC in every region should have its default security group updated to comply with the following: - No inbound rules. - No outbound rules. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **Note:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.",
+ "RationaleStatement": "Configuring all VPC default security groups to restrict all traffic will encourage the development of least privilege security groups and promote the mindful placement of AWS resources into security groups, which will, in turn, reduce the exposure of those resources.",
+ "ImpactStatement": "Implementing this recommendation in an existing VPC that contains operating resources requires extremely careful migration planning, as the default security groups are likely enabling many ports that are unknown. Enabling VPC flow logging (for accepted connections) in an existing environment that is known to be breach-free will reveal the current pattern of ports being used for each instance to communicate successfully. The migration process should include: - Analyzing VPC flow logs to understand current traffic patterns. - Creating least privilege security groups based on the analyzed data. - Testing the new security group rules in a staging environment before applying them to production.",
+ "RemediationProcedure": "Perform the following to implement the prescribed state: **Security Group Members** 1. Identify AWS resources that exist within the default security group. 2. Create a set of least-privilege security groups for those resources. 3. Place the resources in those security groups, removing the resources noted in step 1 from the default security group. **Security Group State** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. For each default security group, perform the following: - Select the `default` security group. - Click the `Inbound Rules` tab. - Remove any inbound rules. - Click the `Outbound Rules` tab. - Remove any Outbound rules. **Recommended** IAM groups allow you to edit the name field. After remediating default group rules for all VPCs in all regions, edit this field to add text similar to DO NOT USE. DO NOT ADD RULES.",
+ "AuditProcedure": "Perform the following to determine if the account is configured as prescribed: **Security Group State** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. For each default security group, perform the following: - Select the `default` security group. - Click the `Inbound Rules` tab and ensure no rules exist. - Click the `Outbound Rules` tab and ensure no rules exist. **Security Group Members** 1. Login to the AWS VPC Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home). 2. Repeat the following steps for all default groups in all VPCs, including the default VPC in each AWS region: 3. In the left pane, click `Security Groups`. 4. Copy the ID of the default security group. 5. Change to the EC2 Management Console at https://console.aws.amazon.com/ec2/v2/home. 6. In the filter column type `Security Group ID : <security-group-id-from-step-4>`.",
+ "AdditionalInformation": "",
+ "References": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#default-security-group",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.6",
+ "Description": "Ensure routing tables for VPC peering are \"least access\"",
+ "Checks": [
+ "vpc_peering_routing_tables_with_least_privilege"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.",
+ "RationaleStatement": "Being highly selective in peering routing tables is a very effective way to minimize the impact of a breach, as resources outside of these routes are inaccessible to the peered VPC.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Remove and add route table entries to ensure that the least number of subnets or hosts required to accomplish the purpose of peering are routable. **From Command Line:** 1. For each `<route-table-id>` that contains routes that are non-compliant with your routing policy (granting more access than desired), delete the non-compliant route: ``` aws ec2 delete-route --route-table-id <route-table-id> --destination-cidr-block <non-compliant-destination-cidr> ``` 2. Create a new compliant route: ``` aws ec2 create-route --route-table-id <route-table-id> --destination-cidr-block <compliant-destination-cidr> --vpc-peering-connection-id <peering-connection-id> ```",
+ "AuditProcedure": "Review the routing tables of peered VPCs to determine whether they route all subnets of each VPC and whether this is necessary to accomplish the intended purposes of peering the VPCs. **From Command Line:** 1. List all the route tables from a VPC and check if the GatewayId is pointing to a `<peering-connection-id>` (e.g., pcx-1a2b3c4d) and if the DestinationCidrBlock is as specific as desired: ``` aws ec2 describe-route-tables --filter Name=vpc-id,Values=<vpc-id> --query RouteTables[*].{RouteTableId:RouteTableId, VpcId:VpcId, Routes:Routes, AssociatedSubnets:Associations[*].SubnetId} ```",
+ "AdditionalInformation": "If an organization has an AWS Transit Gateway implemented in its VPC architecture, it should look to apply the recommendation above for a least access routing architecture at the AWS Transit Gateway level, in combination with what must be implemented at the standard VPC route table. More specifically, to route traffic between two or more VPCs via a Transit Gateway, VPCs must have an attachment to a Transit Gateway route table as well as a route. Therefore, to avoid routing traffic between VPCs, an attachment to the Transit Gateway route table should only be added where there is an intention to route traffic between the VPCs. As Transit Gateways are capable of hosting multiple route tables, it is possible to group VPCs by attaching them to a common route table.",
+ "References": "https://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-partial-access.html:https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-vpc-peering-connection.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.7",
+ "Description": "Ensure that the EC2 Metadata Service only allows IMDSv2",
+ "Checks": [
+ "ec2_instance_imdsv2_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).",
+ "RationaleStatement": "Instance metadata is data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into [categories](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html), such as host name, events, and security groups. When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method). With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally stored EC2 instance metadata and credentials. Allowing Version 1 of the service may open EC2 instances to Server-Side Request Forgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instance security.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "From Console: 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 2. In the left navigation panel, under the `INSTANCES` section, choose `Instances`. 3. Select the EC2 instance that you want to examine. 4. Choose `Actions > Instance Settings > Modify instance metadata options`. 5. Set `Instance metadata service` to `Enable`. 6. Set `IMDSv2` to `Required`. 7. Repeat steps 1-6 to perform the remediation process for other EC2 instances in all applicable AWS region(s). From Command Line: 1. Run the `describe-instances` command, applying the appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region: ``` aws ec2 describe-instances --region <region-name> --output table --query Reservations[*].Instances[*].InstanceId ``` 2. The command output should return a table with the requested instance IDs. 3. Run the `modify-instance-metadata-options` command with an instance ID obtained from the previous step to update the Instance Metadata Version: ``` aws ec2 modify-instance-metadata-options --instance-id <instance-id> --http-tokens required --region <region-name> ``` 4. Repeat steps 1-3 to perform the remediation process for other EC2 instances in the same AWS region. 5. Change the region by updating `--region` and repeat the process for other regions.",
+ "AuditProcedure": "From Console: 1. Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/. 2. In the left navigation panel, under the `INSTANCES` section, choose `Instances`. 3. Select the EC2 instance that you want to examine. 4. Check the `IMDSv2` status, and ensure that it is set to `Required`. From Command Line: 1. Run the `describe-instances` command using appropriate filters to list the IDs of all existing EC2 instances currently available in the selected region: ``` aws ec2 describe-instances --region <region-name> --output table --query Reservations[*].Instances[*].InstanceId ``` 2. The command output should return a table with the requested instance IDs. 3. Run the `describe-instances` command using the instance ID returned in the previous step and apply custom filtering to determine whether the selected instance is using IMDSv2: ``` aws ec2 describe-instances --region <region-name> --instance-ids <instance-id> --query Reservations[*].Instances[*].MetadataOptions --output table ``` 4. Ensure that for all EC2 instances, `HttpTokens` is set to `required` and `State` is set to `applied`. 5. Repeat steps 3 and 4 to verify the other EC2 instances provisioned within the current region. 6. Repeat steps 1–5 to perform the audit process for other AWS regions.",
+ "AdditionalInformation": "",
+ "References": "https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/:https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.8",
+ "Description": "Ensure VPC Endpoints are used for access to AWS Services",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Amazon VPCs use VPC endpoints (gateway or interface endpoints) for access to AWS services such as Amazon S3 and DynamoDB, so that traffic from workloads to AWS services stays on the Amazon private network instead of traversing the public internet. VPC endpoints provide private connectivity between VPCs and supported AWS services without requiring an internet gateway, NAT gateway, or public IP addresses.",
+ "RationaleStatement": "Accessing AWS services over the public internet increases exposure to network-level threats, relies on internet routing, and makes it harder to tightly control egress paths. Using VPC endpoints allows workloads to reach AWS services over the Amazon private network, which reduces reliance on internet gateways and NAT gateways, simplifies egress filtering, and helps enforce data-perimeter and \"private-only\" patterns for sensitive workloads.",
+ "ImpactStatement": "Enforcing the use of VPC endpoints may require changes to existing network architectures, including creating and managing endpoints in each VPC, updating route tables, adjusting security groups, and potentially removing or tightening some internet/NAT gateway paths. This can introduce additional operational overhead and cost (per-endpoint charges for interface endpoints) and may require updates to IaC templates and deployment pipelines.",
+ "RemediationProcedure": "In this example, we are going to add S3 gateway endpoint and SQS interface endpoint to a VPC. You can follow similar remediation instructions for other services. 1. Create S3 Gateway Endpoint ``` aws ec2 create-vpc-endpoint --region REGION --route-table-ids ROUTE_TABLE_ID --vpc-id VPC_ID --service-name com.amazonaws.REGION.s3 --vpc-endpoint-type Gateway --query \"VpcEndpoint.VpcEndpointId\" --output text ``` - Provide values for REGION, ROUTE_TABLE_ID, VPC_ID - AWS automatically creates the routes for the AWS service in the route table provided as part of above command. 2. Verify that the gateway routes have been adequately created ``` aws ec2 describe-route-tables --region REGION --route-table-ids ROUTE_TABLE_ID --query \"RouteTables[0].Routes[?DestinationPrefixListId=='pl-xxxxxxxx']\" ``` - Provide values for REGION, ROUTE_TABLE_ID - pl-xxxxxxxx: replace with the specific prefix list for S3 in that region 3. Create an SQS Interface Endpoint ``` aws ec2 create-vpc-endpoint --vpc-id VPC_ID --service-name com.amazonaws.REGION.sqs --vpc-endpoint-type Interface --subnet-ids PRIVATE_SUBNET_1_ID PRIVATE_SUBNET_2_ID --security-group-ids SECURITY_GROUP_ID --vpc-endpoint-policy VPC_ENDPOINT_POLICY --query \"VpcEndpoint.VpcEndpointId\" --output text ``` - SECURITY_GROUP_ID: Update security groups for interface endpoint. Ensure the interface endpoint security group allows inbound traffic from your workloads. - VPC_ENDPOINT_POLICY: Create a restrictive Endpoint policy to ensure only certain AWS services could be reached and only specific actions can be performed. - AWS automatically creates Elastic Network Interfaces (ENIs) for the interface endpoint which allows any traffic from PRIVATE_SUBNET_1_ID PRIVATE_SUBNET_2_ID intended for SQS to be routed through the Interface Gateway. 4. Test and validate endpoint connectivity from an EC2 instance in a private subnet: - Test S3 (gateway endpoint) ``` aws s3 ls s3://your-test-bucket --region REGION ``` - Test SQS (interface endpoint) ``` aws sqs list-queues --region REGION ```",
+ "AuditProcedure": "1. Identify in-scope VPCs and services. - Determine which VPCs host production or sensitive workloads that should access AWS services securely via endpoints. - For those VPCs, identify the AWS services they depend on (for example, S3 for data storage, DynamoDB for database, etc.). 2. For each in-scope VPC, check for existing VPC endpoints. ``` aws ec2 describe-vpc-endpoints --region REGION --filters \"Name=vpc-id,Values=VPC_ID\" --query \"VpcEndpoints[*].[VpcEndpointId,VpcEndpointType,ServiceName,State]\" --output table ``` - Provide the REGION and VPC_ID - `VpcEndpointType` tells you whether the endpoint is Gateway or Interface. - `ServiceName` shows which AWS service the endpoint is for (for example, com.amazonaws.us-east-1.s3, com.amazonaws.us-east-1.dynamodb, com.amazonaws.us-east-1.ssm). 3. For each interface endpoint, verify subnet attachment across relevant AZs/subnets. ``` aws ec2 describe-vpc-endpoints --region REGION --vpc-endpoint-ids INTERFACE_ENDPOINT_ID --query \"VpcEndpoints[*].[VpcEndpointId,ServiceName,SubnetIds,State]\" --output json ``` - Provide the REGION and INTERFACE_ENDPOINT_ID 4. For each gateway endpoint, verify that the route tables for the relevant subnets send traffic to the endpoint (via the AWS-managed prefix list), not via internet/NAT gateways. - Identify relevant subnets in the VPC that need to have a route to gateway endpoint: ``` aws ec2 describe-subnets --region REGION --filters \"Name=vpc-id,Values=,VPC_ID\" --query \"Subnets[*].[SubnetId,AvailabilityZone,MapPublicIpOnLaunch,CidrBlock]\" --output table ``` - Provide the REGION and VPC_ID - For each relevant subnet, identify the route table associated with it: ``` aws ec2 describe-route-tables --region REGION --filters \"Name=association.subnet-id,Values=SUBNET_ID\" --query \"RouteTables[*].RouteTableId\" --output text ``` - Provide the REGION and SUBNET_ID - For each route table associated with relevant subnets, inspect routes: ``` aws ec2 describe-route-tables --region REGION --route-table-ids ROUTE_TABLE_ID --query \"RouteTables[0].Routes[*].[DestinationPrefixListId,GatewayId,NatGatewayId,State]\" --output table ``` - Provide the REGION and ROUTE_TABLE_ID For S3/DynamoDB gateway endpoints, you should see a `DestinationPrefixListId` (for example, pl-xxxxxxxx) with `GatewayId` equal to the endpoint (vpce-xxxx). If S3/DynamoDB are used by workloads in those subnets but traffic is only routed via igw-xxxx or nat-xxxx (and no prefix-list/endpoint route exists), then VPC endpoints are not being used for securing network traffic for these services.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/aws/cisa_aws.json b/prowler/compliance/aws/cisa_aws.json
index fa8e27a061..27b06a1ea4 100644
--- a/prowler/compliance/aws/cisa_aws.json
+++ b/prowler/compliance/aws/cisa_aws.json
@@ -136,6 +136,20 @@
"ec2_securitygroup_default_restrict_traffic",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
"ec2_securitygroup_allow_ingress_from_internet_to_all_ports"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -367,6 +381,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/ens_rd2022_aws.json b/prowler/compliance/aws/ens_rd2022_aws.json
index 8fcd3263e9..f81b8a3eea 100644
--- a/prowler/compliance/aws/ens_rd2022_aws.json
+++ b/prowler/compliance/aws/ens_rd2022_aws.json
@@ -598,6 +598,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -624,6 +632,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -755,6 +771,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -781,6 +805,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -913,6 +945,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -940,6 +980,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -966,6 +1014,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1743,6 +1799,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1821,6 +1885,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1873,6 +1945,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1925,6 +2005,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1951,6 +2039,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1977,6 +2073,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2003,6 +2107,14 @@
],
"Checks": [
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2056,6 +2168,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2082,6 +2202,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2367,6 +2495,7 @@
],
"Checks": [
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled"
@@ -2393,6 +2522,7 @@
],
"Checks": [
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled"
@@ -4310,6 +4440,14 @@
],
"Checks": [
"drs_job_exist"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/fedramp_20x_ksi_low_aws.json b/prowler/compliance/aws/fedramp_20x_ksi_low_aws.json
index 6c6c500582..15763ef48e 100644
--- a/prowler/compliance/aws/fedramp_20x_ksi_low_aws.json
+++ b/prowler/compliance/aws/fedramp_20x_ksi_low_aws.json
@@ -37,6 +37,14 @@
"ssm_managed_compliant_patching",
"ssm_managed_instance_compliance_association_compliant",
"ssm_managed_instance_compliance_patch_compliant"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -146,6 +154,20 @@
"inspector2_active_findings_exist",
"securityhub_enabled",
"sns_topics_kms_encryption_at_rest_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -205,6 +227,14 @@
"resourceexplorer_indexes_found",
"ssm_managed_instance_compliance_association_compliant",
"trustedadvisor_premium_support_plan_subscribed"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -349,6 +379,14 @@
"config_recorder_all_regions_enabled",
"inspector2_is_enabled",
"resourceexplorer_indexes_found"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
}
]
diff --git a/prowler/compliance/aws/fedramp_low_revision_4_aws.json b/prowler/compliance/aws/fedramp_low_revision_4_aws.json
index 9824798552..059de69675 100644
--- a/prowler/compliance/aws/fedramp_low_revision_4_aws.json
+++ b/prowler/compliance/aws/fedramp_low_revision_4_aws.json
@@ -46,6 +46,20 @@
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -115,6 +129,20 @@
"ec2_networkacl_allow_ingress_any_port",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
"ec2_networkacl_allow_ingress_any_port"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -173,6 +201,14 @@
],
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 90
+ }
]
},
{
@@ -198,6 +234,20 @@
"rds_instance_enhanced_monitoring_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -251,6 +301,14 @@
"guardduty_is_enabled",
"ssm_managed_compliant_patching",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -336,6 +394,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -373,6 +445,14 @@
"rds_instance_multi_az",
"redshift_cluster_automated_snapshot",
"s3_bucket_object_versioning"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
index 11f66ada6b..13c4624572 100644
--- a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
+++ b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
@@ -36,6 +36,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -65,6 +79,20 @@
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -82,6 +110,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -140,6 +182,20 @@
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -191,6 +247,38 @@
"iam_user_access_not_stale_to_sagemaker",
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_role_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_sagemaker",
+ "ConfigKey": "max_unused_sagemaker_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -371,6 +459,20 @@
"ec2_networkacl_allow_ingress_any_port",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
"ec2_networkacl_allow_ingress_any_port"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -507,6 +609,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -575,6 +691,14 @@
],
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 90
+ }
]
},
{
@@ -631,6 +755,20 @@
"rds_instance_enhanced_monitoring_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -720,6 +858,14 @@
"guardduty_is_enabled",
"ssm_managed_compliant_patching",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -887,6 +1033,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -909,6 +1069,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -927,6 +1101,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -945,6 +1133,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -961,6 +1163,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -995,6 +1205,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1061,6 +1285,14 @@
"guardduty_is_enabled",
"rds_instance_multi_az",
"s3_bucket_object_versioning"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1145,6 +1377,7 @@
"Checks": [
"apigateway_restapi_client_certificate_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -1167,6 +1400,7 @@
"Checks": [
"apigateway_restapi_client_certificate_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -1285,6 +1519,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1307,6 +1549,20 @@
"guardduty_is_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1334,6 +1590,20 @@
"guardduty_is_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1361,6 +1631,20 @@
"guardduty_is_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1388,6 +1672,20 @@
"guardduty_is_enabled",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1414,6 +1712,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/ffiec_aws.json b/prowler/compliance/aws/ffiec_aws.json
index 53f7275a85..4a2a1b943e 100644
--- a/prowler/compliance/aws/ffiec_aws.json
+++ b/prowler/compliance/aws/ffiec_aws.json
@@ -37,6 +37,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -74,6 +82,20 @@
"cloudtrail_cloudwatch_logging_enabled",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -148,6 +170,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -166,6 +202,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -183,6 +233,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -237,6 +301,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -254,6 +332,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -367,6 +459,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -386,6 +486,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -404,6 +518,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -487,6 +615,7 @@
"Checks": [
"apigateway_restapi_client_certificate_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -826,6 +955,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -871,6 +1014,20 @@
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/gdpr_aws.json b/prowler/compliance/aws/gdpr_aws.json
index 930af1db58..a97a11e3dc 100644
--- a/prowler/compliance/aws/gdpr_aws.json
+++ b/prowler/compliance/aws/gdpr_aws.json
@@ -59,6 +59,14 @@
"cloudwatch_log_metric_filter_security_group_changes",
"cloudwatch_log_metric_filter_unauthorized_api_calls",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -85,6 +93,14 @@
"kms_cmk_rotation_enabled",
"redshift_cluster_audit_logging",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
index bcf8f19c3b..76ad0c74a5 100644
--- a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
+++ b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
@@ -266,6 +266,7 @@
"ec2_ebs_default_encryption",
"efs_encryption_at_rest_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -350,6 +351,20 @@
"cloudtrail_cloudwatch_logging_enabled",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
}
]
diff --git a/prowler/compliance/aws/gxp_eu_annex_11_aws.json b/prowler/compliance/aws/gxp_eu_annex_11_aws.json
index 1ceb3f817b..fdca6d1747 100644
--- a/prowler/compliance/aws/gxp_eu_annex_11_aws.json
+++ b/prowler/compliance/aws/gxp_eu_annex_11_aws.json
@@ -19,6 +19,14 @@
"Checks": [
"cloudtrail_multi_region_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -146,6 +154,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -238,6 +254,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -253,6 +277,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/hipaa_aws.json b/prowler/compliance/aws/hipaa_aws.json
index 036489d712..9eb243e6cc 100644
--- a/prowler/compliance/aws/hipaa_aws.json
+++ b/prowler/compliance/aws/hipaa_aws.json
@@ -19,6 +19,20 @@
"Checks": [
"config_recorder_all_regions_enabled",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -102,6 +116,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -161,6 +189,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -328,6 +370,20 @@
"guardduty_is_enabled",
"cloudwatch_log_metric_filter_authentication_failures",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -373,6 +429,20 @@
"cloudwatch_log_metric_filter_authentication_failures",
"cloudwatch_log_metric_filter_root_usage",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -402,6 +472,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -514,6 +598,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -649,6 +747,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -756,6 +868,20 @@
"s3_bucket_secure_transport_policy",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/iso27001_2013_aws.json b/prowler/compliance/aws/iso27001_2013_aws.json
index 190693d121..c7ce030024 100644
--- a/prowler/compliance/aws/iso27001_2013_aws.json
+++ b/prowler/compliance/aws/iso27001_2013_aws.json
@@ -36,6 +36,7 @@
"Checks": [
"elb_insecure_ssl_ciphers",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled"
@@ -311,6 +312,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -875,6 +884,38 @@
"iam_user_access_not_stale_to_sagemaker",
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_role_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_sagemaker",
+ "ConfigKey": "max_unused_sagemaker_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -1052,6 +1093,20 @@
"Checks": [
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -1261,6 +1316,20 @@
"Checks": [
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
diff --git a/prowler/compliance/aws/iso27001_2022_aws.json b/prowler/compliance/aws/iso27001_2022_aws.json
index d47bfcf1d1..563b856317 100644
--- a/prowler/compliance/aws/iso27001_2022_aws.json
+++ b/prowler/compliance/aws/iso27001_2022_aws.json
@@ -20,6 +20,14 @@
"Checks": [
"securityhub_enabled",
"wellarchitected_workload_no_high_or_medium_risks"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -277,6 +285,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -331,6 +347,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -362,6 +386,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -378,6 +410,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -424,6 +464,14 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"guardduty_centrally_managed"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -472,6 +520,14 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"guardduty_centrally_managed"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -490,6 +546,14 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"guardduty_centrally_managed"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1004,6 +1068,14 @@
"organizations_account_part_of_organizations",
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1080,6 +1152,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1111,6 +1191,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1749,6 +1837,14 @@
"vpc_default_security_group_closed",
"vpc_flow_logs_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
index c24b5a23e5..65a6e8c8b8 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -1211,6 +1211,14 @@
"rds_instance_default_admin",
"redshift_cluster_non_default_database_name"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -1416,6 +1424,14 @@
"iam_user_administrator_access_policy",
"organizations_delegated_administrators"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -1486,6 +1502,14 @@
"ssm_documents_set_as_public",
"vpc_endpoint_services_allowed_principals_trust_boundaries"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -2040,6 +2064,7 @@
"elb_ssl_listeners",
"elb_ssl_listeners_use_acm_certificate",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -2082,6 +2107,17 @@
"transfer_server_in_transit_encryption_enabled",
"workspaces_volume_encryption_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -2819,6 +2855,20 @@
"wafv2_webacl_rule_logging_enabled",
"wafv2_webacl_with_rules"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -3093,6 +3143,7 @@
"elb_ssl_listeners_use_acm_certificate",
"elbv2_desync_mitigation_mode",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -3319,6 +3370,47 @@
"workspaces_volume_encryption_enabled",
"workspaces_vpc_2private_1public_subnets_nat"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -3711,6 +3803,14 @@
"s3_bucket_event_notifications_enabled",
"trustedadvisor_errors_and_warnings"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -3829,6 +3929,14 @@
"s3_bucket_object_lock",
"s3_bucket_object_versioning"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
@@ -3866,6 +3974,14 @@
"Checks": [
"drs_job_exist"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. Control Measures Requirements",
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
index 50e2a149a5..b99a36d38e 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -1211,6 +1211,14 @@
"rds_instance_default_admin",
"redshift_cluster_non_default_database_name"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -1416,6 +1424,14 @@
"iam_user_administrator_access_policy",
"organizations_delegated_administrators"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -1485,6 +1501,14 @@
"ssm_documents_set_as_public",
"vpc_endpoint_services_allowed_principals_trust_boundaries"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -2042,6 +2066,7 @@
"elb_ssl_listeners",
"elb_ssl_listeners_use_acm_certificate",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -2084,6 +2109,17 @@
"transfer_server_in_transit_encryption_enabled",
"workspaces_volume_encryption_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -2822,6 +2858,20 @@
"wafv2_webacl_rule_logging_enabled",
"wafv2_webacl_with_rules"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -3096,6 +3146,7 @@
"elb_ssl_listeners_use_acm_certificate",
"elbv2_desync_mitigation_mode",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -3322,6 +3373,47 @@
"workspaces_volume_encryption_enabled",
"workspaces_vpc_2private_1public_subnets_nat"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -3714,6 +3806,14 @@
"s3_bucket_event_notifications_enabled",
"trustedadvisor_errors_and_warnings"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -3832,6 +3932,14 @@
"s3_bucket_object_lock",
"s3_bucket_object_versioning"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
@@ -3869,6 +3977,14 @@
"Checks": [
"drs_job_exist"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Domain": "2. 보호대책 요구사항",
diff --git a/prowler/compliance/aws/mitre_attack_aws.json b/prowler/compliance/aws/mitre_attack_aws.json
index 3d1d5fd378..3ac8cf0432 100644
--- a/prowler/compliance/aws/mitre_attack_aws.json
+++ b/prowler/compliance/aws/mitre_attack_aws.json
@@ -35,6 +35,32 @@
"awslambda_function_not_publicly_accessible",
"ec2_instance_public_ip"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudEndure Disaster Recovery",
@@ -200,6 +226,26 @@
"organizations_scp_check_deny_regions",
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "Amazon GuardDuty",
@@ -348,6 +394,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -393,6 +447,26 @@
"guardduty_is_enabled",
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -444,6 +518,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -557,6 +639,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -634,6 +724,26 @@
"inspector2_is_enabled",
"inspector2_active_findings_exist"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -821,6 +931,26 @@
"inspector2_is_enabled",
"inspector2_active_findings_exist"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -984,6 +1114,14 @@
"cloudfront_distributions_https_enabled",
"s3_bucket_secure_transport_policy"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudWatch",
@@ -1057,6 +1195,14 @@
"ssm_document_secrets",
"secretsmanager_automatic_rotation_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudHSM",
@@ -1143,6 +1289,14 @@
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Network Firewall",
@@ -1218,6 +1372,14 @@
"s3_bucket_default_encryption",
"rds_instance_storage_encrypted"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -1264,6 +1426,20 @@
"securityhub_enabled",
"macie_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -1441,6 +1617,20 @@
"s3_bucket_object_versioning",
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1518,6 +1708,20 @@
"efs_have_backup_enabled",
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1566,6 +1770,20 @@
"drs_job_exist",
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1639,6 +1857,14 @@
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Shield",
@@ -1686,6 +1912,14 @@
"drs_job_exist",
"rds_instance_backup_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1743,6 +1977,20 @@
"cloudwatch_log_metric_filter_sign_in_without_mfa",
"cloudwatch_log_metric_filter_unauthorized_api_calls"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS CloudWatch",
@@ -1819,6 +2067,20 @@
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Config",
@@ -1910,6 +2172,20 @@
"iam_policy_no_full_access_to_cloudtrail",
"iam_policy_no_full_access_to_kms"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS Organizations",
@@ -1993,6 +2269,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "Amazon GuardDuty",
@@ -2071,6 +2355,14 @@
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"AWSService": "AWS IoT Device Defender",
diff --git a/prowler/compliance/aws/nis2_aws.json b/prowler/compliance/aws/nis2_aws.json
index d7f193c6c0..3a4d567d25 100644
--- a/prowler/compliance/aws/nis2_aws.json
+++ b/prowler/compliance/aws/nis2_aws.json
@@ -597,6 +597,14 @@
"accessanalyzer_enabled",
"cloudwatch_log_metric_filter_root_usage"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)",
@@ -1511,6 +1519,17 @@
"Checks": [
"acm_certificates_with_secure_key_algorithms"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)",
@@ -1528,6 +1547,17 @@
"route53_domains_privacy_protection_enabled",
"iam_no_expired_server_certificates_stored"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)",
@@ -1645,6 +1675,14 @@
"efs_access_point_enforce_user_identity",
"efs_not_publicly_accessible"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
@@ -1676,6 +1714,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
@@ -1726,6 +1772,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
diff --git a/prowler/compliance/aws/nist_800_171_revision_2_aws.json b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
index e5a456bbb3..31c45c6ae3 100644
--- a/prowler/compliance/aws/nist_800_171_revision_2_aws.json
+++ b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
@@ -230,6 +230,20 @@
"rds_instance_integration_cloudwatch_logs",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -321,6 +335,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -344,6 +372,14 @@
"guardduty_is_enabled",
"rds_instance_integration_cloudwatch_logs",
"s3_bucket_server_access_logging_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -383,6 +419,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -400,6 +450,20 @@
"cloudtrail_cloudwatch_logging_enabled",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -653,6 +717,7 @@
"apigateway_restapi_client_certificate_enabled",
"ec2_ebs_volume_encryption",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -687,6 +752,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -715,6 +794,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -732,6 +825,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -749,6 +856,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -772,6 +893,20 @@
"guardduty_is_enabled",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -809,6 +944,20 @@
"ec2_networkacl_allow_ingress_any_port",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
"ec2_networkacl_allow_ingress_any_port"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1028,6 +1177,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1047,6 +1210,20 @@
"securityhub_enabled",
"ssm_managed_compliant_patching",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1064,6 +1241,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1079,6 +1270,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1105,6 +1304,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1131,6 +1344,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
}
]
diff --git a/prowler/compliance/aws/nist_800_53_revision_4_aws.json b/prowler/compliance/aws/nist_800_53_revision_4_aws.json
index deb2a3cc25..8bd36a3910 100644
--- a/prowler/compliance/aws/nist_800_53_revision_4_aws.json
+++ b/prowler/compliance/aws/nist_800_53_revision_4_aws.json
@@ -27,6 +27,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -47,6 +61,38 @@
"iam_user_access_not_stale_to_sagemaker",
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_role_access_not_stale_to_bedrock",
+ "ConfigKey": "max_unused_bedrock_access_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_user_access_not_stale_to_sagemaker",
+ "ConfigKey": "max_unused_sagemaker_access_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
@@ -73,6 +119,20 @@
"rds_instance_integration_cloudwatch_logs",
"redshift_cluster_audit_logging",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -90,6 +150,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -125,6 +199,20 @@
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -270,6 +358,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -399,6 +501,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -421,6 +537,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -534,6 +664,20 @@
"guardduty_is_enabled",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -827,6 +971,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -860,6 +1012,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1110,6 +1276,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1133,6 +1307,20 @@
"ec2_instance_imdsv2_enabled",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1155,6 +1343,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1177,6 +1379,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1194,6 +1410,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1218,6 +1448,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/nist_800_53_revision_5_aws.json b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
index c9eb755e49..70864860bf 100644
--- a/prowler/compliance/aws/nist_800_53_revision_5_aws.json
+++ b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
@@ -220,6 +220,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -944,6 +952,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1629,6 +1645,14 @@
"Checks": [
"cloudtrail_multi_region_enabled",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1828,6 +1852,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1906,6 +1944,20 @@
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2290,6 +2342,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2352,6 +2418,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2387,6 +2467,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2466,6 +2560,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2487,6 +2595,20 @@
"guardduty_is_enabled",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2522,6 +2644,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -2904,6 +3040,14 @@
"guardduty_is_enabled",
"ssm_managed_compliant_patching",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4079,6 +4223,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4095,6 +4247,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4149,6 +4309,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4184,6 +4358,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4199,6 +4387,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4270,6 +4466,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4286,6 +4496,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4303,6 +4521,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4320,6 +4546,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4336,6 +4570,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4353,6 +4595,14 @@
"Checks": [
"guardduty_is_enabled",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4369,6 +4619,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4385,6 +4643,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4401,6 +4667,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4418,6 +4692,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4435,6 +4717,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4516,6 +4806,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4558,6 +4856,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4575,6 +4881,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4591,6 +4905,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -4607,6 +4929,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5262,6 +5592,7 @@
"Checks": [
"apigateway_restapi_client_certificate_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -5683,6 +6014,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5850,6 +6189,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5890,6 +6237,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5907,6 +6262,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5924,6 +6287,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5940,6 +6311,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5956,6 +6335,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -5988,6 +6375,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6012,6 +6407,14 @@
"rds_instance_integration_cloudwatch_logs",
"redshift_cluster_audit_logging",
"s3_bucket_server_access_logging_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6028,6 +6431,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6045,6 +6456,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6062,6 +6481,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6078,6 +6505,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6114,6 +6549,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6130,6 +6573,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6197,6 +6648,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6213,6 +6672,14 @@
],
"Checks": [
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6233,6 +6700,14 @@
"cloudwatch_changes_to_network_route_tables_alarm_configured",
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -6253,6 +6728,14 @@
"cloudwatch_changes_to_network_route_tables_alarm_configured",
"cloudwatch_changes_to_vpcs_alarm_configured",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/nist_csf_1.1_aws.json b/prowler/compliance/aws/nist_csf_1.1_aws.json
index a55097e70c..9921efce56 100644
--- a/prowler/compliance/aws/nist_csf_1.1_aws.json
+++ b/prowler/compliance/aws/nist_csf_1.1_aws.json
@@ -48,6 +48,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -99,6 +113,20 @@
"guardduty_no_high_severity_findings",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -144,6 +172,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -179,6 +221,26 @@
"cloudwatch_log_metric_filter_unauthorized_api_calls",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -201,6 +263,20 @@
"guardduty_is_enabled",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -218,6 +294,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -243,6 +333,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -265,6 +369,20 @@
"guardduty_is_enabled",
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -291,6 +409,20 @@
"s3_bucket_server_access_logging_enabled",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -316,6 +448,20 @@
"guardduty_is_enabled",
"guardduty_no_high_severity_findings",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -349,6 +495,14 @@
"Checks": [
"config_recorder_all_regions_enabled",
"ec2_instance_managed_by_ssm"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -454,6 +608,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -471,6 +639,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -488,6 +670,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -523,6 +719,26 @@
"cloudwatch_log_metric_filter_unauthorized_api_calls",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -554,6 +770,26 @@
"cloudwatch_log_metric_filter_unauthorized_api_calls",
"rds_instance_enhanced_monitoring_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -827,6 +1063,20 @@
"sagemaker_notebook_instance_without_direct_internet_access_configured",
"securityhub_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -881,6 +1131,14 @@
"Checks": [
"ec2_instance_managed_by_ssm",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1035,6 +1293,14 @@
"ec2_instance_managed_by_ssm",
"ssm_managed_compliant_patching",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/nist_csf_2.0_aws.json b/prowler/compliance/aws/nist_csf_2.0_aws.json
index e890b08573..c06eeec11d 100644
--- a/prowler/compliance/aws/nist_csf_2.0_aws.json
+++ b/prowler/compliance/aws/nist_csf_2.0_aws.json
@@ -72,6 +72,20 @@
"securityhub_enabled",
"wellarchitected_workload_no_high_or_medium_risks",
"servicecatalog_portfolio_shared_within_organization_only"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -322,6 +336,26 @@
"wellarchitected_workload_no_high_or_medium_risks",
"organizations_delegated_administrators",
"organizations_tags_policies_enabled_and_attached"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -352,6 +386,26 @@
"vpc_flow_logs_enabled",
"iam_root_mfa_enabled",
"iam_root_credentials_management_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -408,6 +462,20 @@
"accessanalyzer_enabled",
"guardduty_no_high_severity_findings",
"trustedadvisor_errors_and_warnings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -442,6 +510,26 @@
"organizations_scp_check_deny_regions",
"organizations_tags_policies_enabled_and_attached",
"organizations_delegated_administrators"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -574,6 +662,14 @@
"opensearch_service_domains_encryption_at_rest_enabled",
"redshift_cluster_encrypted_at_rest",
"sns_topics_kms_encryption_at_rest_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -610,6 +706,17 @@
"iam_inline_policy_allows_privilege_escalation",
"ssm_documents_set_as_public",
"s3_bucket_shadow_resource_vulnerability"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -726,6 +833,14 @@
"iam_role_administratoraccess_policy",
"iam_policy_no_full_access_to_cloudtrail",
"iam_policy_no_full_access_to_kms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -853,6 +968,14 @@
"iam_customer_unattached_policy_no_administrative_privileges",
"accessanalyzer_enabled",
"cognito_user_pool_password_policy_symbol"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1224,6 +1347,14 @@
"inspector2_active_findings_exist",
"secretsmanager_automatic_rotation_enabled",
"secretsmanager_secret_rotated_periodically"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1265,6 +1396,14 @@
"Checks": [
"ssmincidents_enabled_with_plans",
"drs_job_exist"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "drs_job_exist",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1283,6 +1422,14 @@
"inspector2_is_enabled",
"guardduty_is_enabled",
"inspector2_active_findings_exist"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1329,6 +1476,14 @@
"vpc_flow_logs_enabled",
"config_recorder_all_regions_enabled",
"config_recorder_using_aws_service_role"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1540,6 +1695,14 @@
"guardduty_is_enabled",
"inspector2_is_enabled",
"accessanalyzer_enabled_without_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1662,6 +1825,14 @@
"guardduty_rds_protection_enabled",
"guardduty_lambda_protection_enabled",
"guardduty_eks_runtime_monitoring_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/pci_3.2.1_aws.json b/prowler/compliance/aws/pci_3.2.1_aws.json
index c240548f6a..ca8e968bf9 100644
--- a/prowler/compliance/aws/pci_3.2.1_aws.json
+++ b/prowler/compliance/aws/pci_3.2.1_aws.json
@@ -628,6 +628,14 @@
"ssm_managed_compliant_patching",
"ec2_elastic_ip_unassigned"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "2.4",
@@ -643,6 +651,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "2.4.a",
@@ -2413,6 +2429,14 @@
"cloudtrail_log_file_validation_enabled",
"s3_bucket_cross_region_replication"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "10.5",
@@ -2430,6 +2454,14 @@
"s3_bucket_object_versioning",
"cloudtrail_log_file_validation_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "10.5.2",
@@ -2616,6 +2648,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.4",
@@ -2631,6 +2671,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.4.a",
@@ -2646,6 +2694,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.4.b",
@@ -2661,6 +2717,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.4.c",
@@ -2676,6 +2740,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.5",
@@ -2691,6 +2763,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.5.a",
@@ -2706,6 +2786,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"ItemId": "11.5.b",
diff --git a/prowler/compliance/aws/pci_4.0_aws.json b/prowler/compliance/aws/pci_4.0_aws.json
index dc8fab9140..e21b543556 100644
--- a/prowler/compliance/aws/pci_4.0_aws.json
+++ b/prowler/compliance/aws/pci_4.0_aws.json
@@ -4403,6 +4403,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ",
@@ -9281,6 +9289,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9363,6 +9379,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9459,6 +9483,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9551,6 +9583,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "10.5.1: Audit log history is retained and available for analysis. ",
@@ -10179,6 +10219,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ",
@@ -10343,6 +10391,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ",
@@ -10451,6 +10507,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ",
@@ -10625,6 +10689,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ",
@@ -10653,6 +10725,14 @@
"Checks": [
"guardduty_is_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ",
@@ -11445,6 +11525,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.2.1: Storage of account data is kept to a minimum. ",
@@ -11567,6 +11655,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11689,6 +11785,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11811,6 +11915,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11933,6 +12045,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -13573,6 +13693,17 @@
"Checks": [
"acm_certificates_with_secure_key_algorithms"
],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ",
@@ -15001,6 +15132,14 @@
"Checks": [
"cloudwatch_log_group_retention_policy_specific_days_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ",
@@ -22504,6 +22643,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ",
@@ -23000,6 +23147,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Section": "A3.5.1: Suspicious events are identified and responded to. ",
diff --git a/prowler/compliance/aws/prowler_threatscore_aws.json b/prowler/compliance/aws/prowler_threatscore_aws.json
index 902beb8abd..c8c093907a 100644
--- a/prowler/compliance/aws/prowler_threatscore_aws.json
+++ b/prowler/compliance/aws/prowler_threatscore_aws.json
@@ -174,6 +174,20 @@
"iam_user_accesskey_unused",
"iam_user_console_access_unused"
],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45
+ },
+ {
+ "Check": "iam_user_console_access_unused",
+ "ConfigKey": "max_console_access_days",
+ "Operator": "lte",
+ "Value": 45
+ }
+ ],
"Attributes": [
{
"Title": "IAM credentials unused disabled",
@@ -336,6 +350,14 @@
"Checks": [
"accessanalyzer_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Title": "Access Analyzer enabled",
@@ -1541,6 +1563,14 @@
"Checks": [
"config_recorder_all_regions_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Title": "AWS Config is enabled",
@@ -1829,6 +1859,14 @@
"Checks": [
"securityhub_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ],
"Attributes": [
{
"Title": "Security Hub enabled",
diff --git a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
index f4e8d1d70e..554b40cdad 100644
--- a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
+++ b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
@@ -40,6 +40,7 @@
"ec2_instance_public_ip",
"efs_encryption_at_rest_enabled",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -185,6 +186,14 @@
"securityhub_enabled",
"vpc_flow_logs_enabled",
"opensearch_service_domains_audit_logging_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/secnumcloud_3.2_aws.json b/prowler/compliance/aws/secnumcloud_3.2_aws.json
index d8736c2d6b..8075dc3610 100644
--- a/prowler/compliance/aws/secnumcloud_3.2_aws.json
+++ b/prowler/compliance/aws/secnumcloud_3.2_aws.json
@@ -202,6 +202,14 @@
"Checks": [
"config_recorder_all_regions_enabled",
"ec2_instance_managed_by_ssm"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -323,6 +331,14 @@
"iam_role_administratoraccess_policy",
"iam_user_administrator_access_policy",
"iam_user_two_active_access_key"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -474,6 +490,7 @@
"elbv2_ssl_listeners",
"elb_insecure_ssl_ciphers",
"elbv2_insecure_ssl_ciphers",
+ "elbv2_listener_pqc_tls_enabled",
"cloudfront_distributions_pqc_tls_enabled",
"apigateway_domain_name_pqc_tls_enabled",
"transfer_server_pqc_ssh_kex_enabled",
@@ -563,6 +580,17 @@
"Checks": [
"acm_certificates_expiration_check",
"acm_certificates_with_secure_key_algorithms"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ }
]
},
{
@@ -735,6 +763,14 @@
"config_recorder_all_regions_enabled",
"cloudtrail_multi_region_enabled",
"cloudtrail_multi_region_enabled_logging_management_events"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -774,6 +810,14 @@
"guardduty_lambda_protection_enabled",
"guardduty_eks_audit_log_enabled",
"guardduty_eks_runtime_monitoring_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -911,6 +955,20 @@
"cloudwatch_changes_to_network_gateways_alarm_configured",
"cloudwatch_changes_to_network_route_tables_alarm_configured",
"cloudwatch_changes_to_vpcs_alarm_configured"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1014,6 +1072,14 @@
"config_recorder_all_regions_enabled",
"config_recorder_using_aws_service_role",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1060,6 +1126,14 @@
"Checks": [
"guardduty_is_enabled",
"vpc_flow_logs_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1091,6 +1165,14 @@
"Checks": [
"config_recorder_all_regions_enabled",
"cloudtrail_multi_region_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1268,6 +1350,20 @@
"guardduty_is_enabled",
"securityhub_enabled",
"cloudwatch_alarm_actions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1418,6 +1514,14 @@
"Checks": [
"backup_plans_exist",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1481,6 +1585,20 @@
"Checks": [
"securityhub_enabled",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -1498,6 +1616,14 @@
"Checks": [
"inspector2_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/aws/soc2_aws.json b/prowler/compliance/aws/soc2_aws.json
index 5a027d0416..c0041a9dae 100644
--- a/prowler/compliance/aws/soc2_aws.json
+++ b/prowler/compliance/aws/soc2_aws.json
@@ -43,6 +43,14 @@
"cloudtrail_s3_dataevents_write_enabled",
"cloudtrail_multi_region_enabled",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -61,6 +69,26 @@
"guardduty_is_enabled",
"securityhub_enabled",
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -80,6 +108,14 @@
"ssm_managed_compliant_patching",
"guardduty_no_high_severity_findings",
"guardduty_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -116,6 +152,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -133,6 +177,14 @@
"Checks": [
"guardduty_is_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -312,6 +364,20 @@
"Checks": [
"guardduty_is_enabled",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -331,6 +397,20 @@
"securityhub_enabled",
"ec2_instance_managed_by_ssm",
"ssm_managed_compliant_patching"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -367,6 +447,20 @@
"guardduty_is_enabled",
"apigateway_restapi_logging_enabled",
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -399,6 +493,20 @@
"cloudwatch_log_group_retention_policy_specific_days_enabled",
"vpc_flow_logs_enabled",
"guardduty_no_high_severity_findings"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -426,6 +534,20 @@
"redshift_cluster_automated_snapshot",
"s3_bucket_object_versioning",
"securityhub_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -463,6 +585,14 @@
],
"Checks": [
"config_recorder_all_regions_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
@@ -600,6 +730,14 @@
"rds_cluster_integration_cloudwatch_logs",
"glue_etl_jobs_logging_enabled",
"stepfunctions_statemachine_logging_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
]
},
{
diff --git a/prowler/compliance/azure/c5_azure.json b/prowler/compliance/azure/c5_azure.json
index 4ac3b4dd53..6fff7a3691 100644
--- a/prowler/compliance/azure/c5_azure.json
+++ b/prowler/compliance/azure/c5_azure.json
@@ -2681,6 +2681,17 @@
"app_function_latest_runtime_version",
"mysql_flexible_server_minimum_tls_version_12",
"sqlserver_recommended_minimal_tls_version"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -2705,6 +2716,17 @@
"app_function_latest_runtime_version",
"mysql_flexible_server_minimum_tls_version_12",
"sqlserver_recommended_minimal_tls_version"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -3903,6 +3925,17 @@
"app_ensure_php_version_is_latest",
"storage_ensure_minimum_tls_version_12",
"storage_smb_protocol_version_is_latest"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -4352,6 +4385,17 @@
"sqlserver_recommended_minimal_tls_version",
"sqlserver_tde_encrypted_with_cmk",
"sqlserver_tde_encryption_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -5743,6 +5787,17 @@
"storage_ensure_minimum_tls_version_12",
"sqlserver_tde_encrypted_with_cmk",
"sqlserver_tde_encryption_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -5770,6 +5825,17 @@
"storage_ensure_minimum_tls_version_12",
"sqlserver_tde_encrypted_with_cmk",
"sqlserver_tde_encryption_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -6513,6 +6579,17 @@
"mysql_flexible_server_minimum_tls_version_12",
"sqlserver_recommended_minimal_tls_version",
"storage_ensure_minimum_tls_version_12"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/azure/ccc_azure.json b/prowler/compliance/azure/ccc_azure.json
index cb87346d13..661d38302f 100644
--- a/prowler/compliance/azure/ccc_azure.json
+++ b/prowler/compliance/azure/ccc_azure.json
@@ -56,6 +56,25 @@
"app_ensure_using_http20",
"app_ftp_deployment_disabled",
"app_function_ftps_deployment_disabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ },
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
]
},
{
@@ -726,6 +745,16 @@
],
"Checks": [
"storage_smb_channel_encryption_with_secure_algorithm"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/azure/cis_4.0_azure.json b/prowler/compliance/azure/cis_4.0_azure.json
index c075ff4047..5f3e4502f1 100644
--- a/prowler/compliance/azure/cis_4.0_azure.json
+++ b/prowler/compliance/azure/cis_4.0_azure.json
@@ -253,6 +253,18 @@
"References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications:https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path:https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path",
"DefaultValue": ""
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_attack_path_notifications_properly_configured",
+ "ConfigKey": "defender_attack_path_minimal_risk_level",
+ "Operator": "in",
+ "Value": [
+ "Low",
+ "Medium",
+ "High"
+ ]
+ }
]
},
{
@@ -375,6 +387,16 @@
"Checks": [
"storage_smb_channel_encryption_with_secure_algorithm"
],
+ "ConfigRequirements": [
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "10 Storage Services",
diff --git a/prowler/compliance/azure/cis_5.0_azure.json b/prowler/compliance/azure/cis_5.0_azure.json
index 8ea6f50d7c..71e43aeee9 100644
--- a/prowler/compliance/azure/cis_5.0_azure.json
+++ b/prowler/compliance/azure/cis_5.0_azure.json
@@ -2614,6 +2614,18 @@
"References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications:https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path:https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path",
"DefaultValue": ""
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_attack_path_notifications_properly_configured",
+ "ConfigKey": "defender_attack_path_minimal_risk_level",
+ "Operator": "in",
+ "Value": [
+ "Low",
+ "Medium",
+ "High"
+ ]
+ }
]
},
{
@@ -3006,6 +3018,16 @@
"Checks": [
"storage_smb_channel_encryption_with_secure_algorithm"
],
+ "ConfigRequirements": [
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "9 Storage Services",
diff --git a/prowler/compliance/azure/cis_6.0_azure.json b/prowler/compliance/azure/cis_6.0_azure.json
new file mode 100644
index 0000000000..625a0c18fa
--- /dev/null
+++ b/prowler/compliance/azure/cis_6.0_azure.json
@@ -0,0 +1,2863 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS Microsoft Azure Foundations Benchmark v6.0.0",
+ "Version": "6.0",
+ "Provider": "Azure",
+ "Description": "The CIS Azure Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Azure with an emphasis on foundational, testable, and architecture agnostic settings.",
+ "Requirements": [
+ {
+ "Id": "2.1.1",
+ "Description": "Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)",
+ "Checks": [
+ "databricks_workspace_vnet_injection_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)",
+ "RationaleStatement": "Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for: - Restricted outbound internet access to prevent unauthorized data exfiltration. - Integration with on-premises networks via VPN or ExpressRoute for hybrid connectivity. - Fine-grained NSG policies to restrict access at the subnet level. - Private Link for secure API access, avoiding public internet exposure.",
+ "ImpactStatement": "- Requires additional configuration during Databricks workspace deployment. - Might increase operational overhead for network maintenance. - May impact connectivity if misconfigured (e.g., restrictive NSG rules or missing routes).",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Delete the existing Databricks workspace (migration required). 1. Create a new Databricks workspace with VNet Injection: 1. Go to Azure Portal Create Databricks Workspace. 1. Select Advanced Networking. 1. Choose Deploy into your own Virtual Network. 1. Specify a customer-managed VNet and associated subnets. 1. Enable Private Link for secure API access. **Remediate from Azure CLI** Deploy a new Databricks workspace in a custom VNet: ``` az databricks workspace create --name <databricks-workspace-name> \\ --resource-group <resource-group-name> \\ --location <region> \\ --managed-resource-group <managed-rg-name> \\ --enable-no-public-ip true \\ --network-security-group-rule NoAzureServices \\ --public-network-access Disabled \\ --custom-virtual-network-id /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name> ``` Ensure NSG Rules are correctly configured: ``` az network nsg rule create --resource-group <resource-group-name> \\ --nsg-name <nsg-name> \\ --name DenyAllOutbound \\ --direction Outbound \\ --access Deny \\ --priority 4096 ``` **Remediate from PowerShell** ``` New-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> -Location <region> -ManagedResourceGroupName <managed-rg-name> -CustomVirtualNetworkId /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to Azure Portal Search for Databricks Workspaces. 1. Select the Databricks Workspace to audit. 1. Under Networking, check if the workspace is deployed in a Customer-Managed VNet. 1. If the Virtual Network field shows Databricks-Managed VNet, it is non-compliant. 1. Verify NSG rules and Private Endpoints for fine-grained access control. **Audit from Azure CLI** Run the following command to check if Databricks is using a customer-managed VNet: ``` az network vnet show --resource-group <resource-group-name> --name <vnet-name> ``` Ensure that Databricks subnets are present in the VNet configuration. Validate NSG rules attached to the Databricks subnets. **Audit from PowerShell** ``` Get-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> | Select-Object VirtualNetworkId ``` If VirtualNetworkId is null or shows a Databricks-Managed VNet, it is non-compliant. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [9c25c9e4-ee12-4882-afd2-11fb9d87893f](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%9c25c9e4-ee12-4882-afd2-11fb9d87893f) **- Name:** 'Azure Databricks Workspaces should be in a virtual network'",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, Azure Databricks uses a Databricks-Managed VNet."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.2",
+ "Description": "Ensure that Network Security Groups are Configured for Databricks Subnets",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Network Security Groups are Configured for Databricks Subnets",
+ "RationaleStatement": "Using NSGs with both explicit allow and deny rules provides clear documentation and control over permitted and prohibited traffic. While Azure NSGs implicitly deny all traffic not explicitly allowed, defining explicit deny rules for known malicious or unnecessary sources enhances clarity, simplifies troubleshooting, and supports compliance audits.",
+ "ImpactStatement": "* NSGs require periodic maintenance to ensure rule accuracy. * Misconfigured NSGs could inadvertently block required traffic.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Assign NSG to Databricks subnets under Networking > NSG Settings.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to Virtual Networks > Subnets, and review NSG assignments. **Audit from Azure CLI** ``` az network nsg list --query [].{Name:name, Rules:securityRules} ``` **Audit from PowerShell** ``` Get-AzNetworkSecurityGroup -ResourceGroupName <resource-group-name> ```",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-databricks-security-baseline:https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/vnet-inject#network-security-group-rules",
+ "DefaultValue": "By default, Databricks subnets do not have NSGs assigned."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.3",
+ "Description": "Ensure that Traffic is Encrypted Between Cluster Worker Nodes",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Traffic is Encrypted Between Cluster Worker Nodes",
+ "RationaleStatement": "* Protects sensitive data during transit between cluster nodes, mitigating risks of data interception or unauthorized access. * Aligns with organizational security policies and compliance requirements that mandate encryption of data in transit. * Enhances overall security posture by ensuring that all inter-node communications within the cluster are encrypted.",
+ "ImpactStatement": "* Enabling encryption may introduce a performance penalty due to the computational overhead associated with encrypting and decrypting traffic. This can result in longer query execution times, especially for data-intensive operations. * Implementing encryption requires creating and managing init scripts, which adds complexity to cluster configuration and maintenance. * The shared encryption secret is derived from the hash of the keystore stored in DBFS. If the keystore is updated or rotated, all running clusters must be restarted to prevent authentication failures between Spark workers and drivers.",
+ "RemediationProcedure": "Create a JKS keystore: 1. Generate a Java KeyStore (JKS) file that will be used for SSL/TLS encryption. 2. Upload the keystore file to a secure directory in DBFS (e.g. /dbfs/<keystore-directory>/jetty_ssl_driver_keystore.jks). Develop an init script: 3. Create an init script that performs the following tasks: - Retrieves the JKS keystore file and password. - Derives a shared encryption secret from the keystore. - Configures Spark driver and executor settings to enable encryption. 4. Example init script: ``` #!/bin/bash set -euo pipefail keystore_dbfs_file=/dbfs/<keystore-directory>/jetty_ssl_driver_keystore.jks max_attempts=30 while [ ! -f ${keystore_dbfs_file} ]; do if [ $max_attempts == 0 ]; then echo ERROR: Unable to find the file : $keystore_dbfs_file. Failing the script. exit 1 fi sleep 2s ((max_attempts--)) done sasl_secret=$(sha256sum $keystore_dbfs_file | cut -d' ' -f1) if [ -z ${sasl_secret} ]; then echo ERROR: Unable to derive the secret. Failing the script. exit 1 fi local_keystore_file=$DB_HOME/keys/jetty_ssl_driver_keystore.jks local_keystore_password=gb1gQqZ9ZIHS if [[ $DB_IS_DRIVER = TRUE ]]; then driver_conf=${DB_HOME}/driver/conf/spark-branch.conf echo Configuring driver conf at $driver_conf if [ ! -e $driver_conf ]; then echo spark.authenticate true >> $driver_conf echo spark.authenticate.secret $sasl_secret >> $driver_conf echo spark.authenticate.enableSaslEncryption true >> $driver_conf echo spark.network.crypto.enabled true >> $driver_conf echo spark.network.crypto.keyLength 256 >> $driver_conf echo spark.network.crypto.keyFactoryAlgorithm PBKDF2WithHmacSHA1 >> $driver_conf echo spark.io.encryption.enabled true >> $driver_conf echo spark.ssl.enabled true >> $driver_conf echo spark.ssl.keyPassword $local_keystore_password >> $driver_conf echo spark.ssl.keyStore $local_keystore_file >> $driver_conf echo spark.ssl.keyStorePassword $local_keystore_password >> $driver_conf echo spark.ssl.protocol TLSv1.3 >> $driver_conf fi fi executor_conf=${DB_HOME}/conf/spark.executor.extraJavaOptions echo Configuring executor conf at $executor_conf if [ ! -e $executor_conf ]; then echo -Dspark.authenticate=true >> $executor_conf echo -Dspark.authenticate.secret=$sasl_secret >> $executor_conf echo -Dspark.authenticate.enableSaslEncryption=true >> $executor_conf echo -Dspark.network.crypto.enabled=true >> $executor_conf echo -Dspark.network.crypto.keyLength=256 >> $executor_conf echo -Dspark.network.crypto.keyFactoryAlgorithm=PBKDF2WithHmacSHA1 >> $executor_conf echo -Dspark.io.encryption.enabled=true >> $executor_conf echo -Dspark.ssl.enabled=true >> $executor_conf echo -Dspark.ssl.keyPassword=$local_keystore_password >> $executor_conf echo -Dspark.ssl.keyStore=$local_keystore_file >> $executor_conf echo -Dspark.ssl.keyStorePassword=$local_keystore_password >> $executor_conf echo -Dspark.ssl.protocol=TLSv1.3 >> $executor_conf fi ``` 5. Save.",
+ "AuditProcedure": "**Audit from Azure Portal** Review cluster init scripts: 1. Navigate to your Azure Databricks workspace, go to the Clusters section, select a cluster, and check the Advanced Options for any init scripts that configure encryption settings. Verify spark configuration: 2. Ensure that the following Spark configurations are set: ``` spark.authenticate true spark.authenticate.enableSaslEncryption true spark.network.crypto.enabled true spark.network.crypto.keyLength 256 spark.network.crypto.keyFactoryAlgorithm PBKDF2WithHmacSHA1 spark.io.encryption.enabled true ``` These settings can be found in the cluster's Spark configuration properties. Check keystone management: 3. Verify that the Java KeyStore (JKS) file is securely stored in DBFS and that its integrity is maintained. 4. Ensure that the keystore password is securely managed and not hardcoded in scripts.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/security/keys/encrypt-otw",
+ "DefaultValue": "By default, traffic is not encrypted between cluster worker nodes."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.4",
+ "Description": "Ensure that Users and Groups are Synced from Microsoft Entra ID to Azure Databricks",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Users and Groups are Synced from Microsoft Entra ID to Azure Databricks",
+ "RationaleStatement": "Syncing users and groups from Microsoft Entra ID centralizes access control, enforces the least privilege principle by automatically revoking unnecessary access, reduces administrative overhead by eliminating manual user management, and ensures auditability and compliance with industry regulations.",
+ "ImpactStatement": "SCIM provisioning requires role mapping to avoid misconfigured user privileges.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Enable provisioning in Azure Portal: 1. Go to `Microsoft Entra ID`. 1. Under `Manage`, click `Enterprise applications`. 1. Click the name of the Azure Databricks SCIM application. 1. Under `Provisioning`, select `Automatic` and enter the SCIM endpoint and API token from Databricks. Enable provisioning in Databricks: 5. Navigate to `Admin Console` > `Identity and Access Management`. 6. Enable SCIM provisioning and generate an API token. Configure role assignments: 7. Ensure groups from Entra ID are mapped to appropriate Databricks roles. 8. Restrict administrative privileges to designated security groups. Regularly monitor sync logs: 9. Periodically review sync logs in Microsoft Entra ID and Databricks Admin Console. 10. Configure Azure Monitor alerts for provisioning failures. Disable manual user creation in Databricks: 11. Ensure that all user management is controlled via SCIM sync from Entra ID. 12. Disable personal access token usage for authentication. **Remediate from Azure CLI** Enable SCIM User and Group Provisioning in Azure Databricks: ``` az ad app update --id <databricks-app-id> --set provisioning.provisioningMode=Automatic ```",
+ "AuditProcedure": "**Audit from Azure Portal** Verify SCIM provisioning is enabled: 1. Go to `Microsoft Entra ID`. 1. Under `Manage`, click `Enterprise applications`. 1. Click the name of the Azure Databricks SCIM application. 1. Under `Provisioning`, confirm that SCIM provisioning is enabled and running. Check user sync status in Azure Portal: 5. Under `Provisioning Logs`, verify the last successful sync and any failed entries. Check user sync status in Databricks: 6. Go to `Admin Console` > `Identity and Access Management`. 7. Confirm that Users and Groups match those assigned in Microsoft Entra ID. Ensure role-based access control (RBAC) mapping is correct: 8. Verify that users are assigned appropriate Databricks roles (e.g. Admin, User, Contributor). 9. Confirm that groups are mapped to workspace access roles.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/administration-guide/users-groups/scim/aad",
+ "DefaultValue": "By default, Azure Databricks does not sync users and groups from Microsoft Entra ID."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.5",
+ "Description": "Ensure that Unity Catalog is Configured for Azure Databricks",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Unity Catalog is Configured for Azure Databricks",
+ "RationaleStatement": "* Enforces centralized access control policies and reduces data security risks. * Enables identity-based authentication via Microsoft Entra ID. * Improves compliance with industry regulations (e.g. GDPR, HIPAA, SOC 2) by providing audit logs and access visibility. * Prevents unauthorized data access through table-, row-, and column-level security (RLS & CLS).",
+ "ImpactStatement": "* Improperly configured permissions may lead to data exfiltration or unauthorized access. * Unity Catalog requires structured governance policies to be effective and prevent overly permissive access.",
+ "RemediationProcedure": "Use the remediation procedure written in this article: https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/get-started.",
+ "AuditProcedure": "Method 1: Verify unity catalog deployment: 1. As an Azure Databricks account admin, log into the account console. 1. Click Workspaces. 1. Find your workspace and check the Metastore column. If a metastore name is present, your workspace is attached to a Unity Catalog metastore and therefore enabled for Unity Catalog. Method 2: Run a SQL query to confirm Unity Catalog enablement Run the following SQL query in the SQL query editor or a notebook that is attached to a Unity Catalog-enabled compute resource. No admin role is required. ``` SELECT CURRENT_METASTORE(); ``` If the query returns a metastore ID like the following, then your workspace is attached to a Unity Catalog metastore and therefore enabled for Unity Catalog.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/:https://learn.microsoft.com/en-us/azure/databricks/admin/users-groups/:https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/enable-workspaces",
+ "DefaultValue": "New workspaces have Unity Catalog enabled by default. Existing workspaces may require manual enablement."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.6",
+ "Description": "Ensure that Usage is Restricted and Expiry is Enforced for Databricks Personal Access Tokens",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Usage is Restricted and Expiry is Enforced for Databricks Personal Access Tokens",
+ "RationaleStatement": "Restricting usage and enforcing expiry for personal access tokens reduces exposure to long-lived tokens, minimizes the risk of API abuse if compromised, and aligns with security best practices through controlled issuance and enforced expiry.",
+ "ImpactStatement": "If revoked improperly, applications relying on these tokens may fail, requiring a remediation plan for token rotation. Increased administrative effort is required to track and manage API tokens effectively.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Disable personal access tokens: If your workspace does not require PATs, you can disable them entirely to prevent their use.",
+ "AuditProcedure": "Azure Databricks administrators can monitor and revoke personal access tokens within their workspace. Detailed instructions are available in the Monitor and Revoke Personal Access Tokens section of the Microsoft documentation: https://learn.microsoft.com/en-us/azure/databricks/admin/access-control/tokens. To evaluate the usage of personal access tokens in your Azure Databricks account, you can utilize the provided notebook that lists all PATs not rotated or updated in the last 90 days, allowing you to identify tokens that may require revocation. This process is detailed here: https://docs.azure.cn/en-us/databricks/security/auth/oauth-pat-usage. Implementing diagnostic logging provides a comprehensive reference of audit log services and events, enabling you to track activities related to personal access tokens. More information can be found in the diagnostic log reference section: https://docs.azure.cn/en-us/databricks/security/auth/oauth-pat-usage.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/administration-guide/access-control/tokens:https://learn.microsoft.com/en-us/azure/databricks/dev-tools/auth/",
+ "DefaultValue": "By default, personal access tokens are enabled and users can create the Personal access token and their expiry time."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.7",
+ "Description": "Ensure that Diagnostic Log Delivery is Configured for Azure Databricks",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Diagnostic Log Delivery is Configured for Azure Databricks",
+ "RationaleStatement": "Diagnostic logging provides visibility into security and operational activities within Databricks workspaces while maintaining an audit trail for forensic investigations, and it supports compliance with regulatory standards that require logging and monitoring.",
+ "ImpactStatement": "Logs consume storage and may require additional monitoring tools, leading to increased operational overhead and costs. Incomplete log configurations may result in missing critical events, reducing monitoring effectiveness.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Enable diagnostic logging for Azure Databricks: 1. Navigate to your Azure Databricks workspace. 1. In the left-hand menu, select `Monitoring` > `Diagnostic settings`. 1. Click `+ Add diagnostic setting`. 1. Under `Category details`, select the log categories you wish to capture, such as AuditLogs, Clusters, Notebooks, and Jobs. 1. Choose a destination for the logs: - `Log Analytics workspace`: For advanced querying and monitoring. - `Storage account`: For long-term retention. - `Event Hub`: For integration with third-party systems. 1. Provide a `Name` for the diagnostic setting. 1. Click `Save`. Implement log retention policies: 1. Navigate to your Log Analytics workspace. 1. Under `General`, select `Usage and estimated costs`. 1. Click `Data Retention`. 1. Adjust the retention period slider to the desired number of days (up to 730 days). 1. Click `OK`. Monitor logs for anomalies: 1. Navigate to `Azure Monitor`. 1. Select `Alerts` > `+ New alert rule`. 1. Under `Scope`, specify the Databricks resource. 1. Define `Condition` based on log queries that identify anomalies (e.g. unauthorized access attempts). 1. Configure `Actions` to notify stakeholders or trigger automated responses. 1. Provide an Alert rule `name` and `description`. 1. Click `Create alert rule`. **Remediate from Azure CLI** Enable diagnostic logging for Azure Databricks: ``` az monitor diagnostic-settings create --name DatabricksLogging --resource <databricks-resource-id> --logs '[{category: AuditLogs, enabled: true}, {category: Clusters, enabled: true}, {category: Notebooks, enabled: true}, {category: Jobs, enabled: true}]' --workspace <log-analytics-id> ``` Implement log retention policies: ``` az monitor log-analytics workspace update --resource-group <resource-group> --name <log-analytics-name> --retention-time 365 ``` Monitor logs for anomalies: ``` az monitor activity-log alert create --name DatabricksAnomalyAlert --resource-group <resource-group> --scopes <databricks-resource-id> --condition contains 'UnauthorizedAccess' ```",
+ "AuditProcedure": "**Audit from Azure Portal** Check if diagnostic logging is enabled for the Databricks workspace: 1. Go to `Azure Databricks`. 1. Select a workspace. 1. In the left-hand menu, select `Monitoring` > `Diagnostic settings`. 1. Verify if a diagnostic setting is configured. If not, diagnostic logging is not enabled. Ensure that logging is enabled for the following categories:",
+ "AdditionalInformation": "* Ensure that the Azure Databricks workspace is on the Premium plan to utilize diagnostic logging features. * Regularly review and update alert rules to adapt to evolving security threats and operational requirements.",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/admin/account-settings/audit-log-delivery:https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/log-analytics/billing/configure-data-retention",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.8",
+ "Description": "Ensure Critical Data in Azure Databricks is Encrypted with Customer-managed Keys (CMK)",
+ "Checks": [
+ "databricks_workspace_cmk_encryption_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Critical Data in Azure Databricks is Encrypted with Customer-managed Keys (CMK)",
+ "RationaleStatement": "By default in Azure, data at rest tends to be encrypted using Microsoft Managed Keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, Customer Managed Keys can be established. While it is possible to automate the assessment of this recommendation, the assessment status for this recommendation remains 'Manual' due to ideally limited scope. The scope of application - which workloads CMK is applied to - should be carefully considered to account for organizational capacity and targeted to workloads with specific need for CMK.",
+ "ImpactStatement": "If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually. Using Customer Managed Keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.",
+ "RemediationProcedure": "NOTE: These remediations assume that an Azure KeyVault already exists in the subscription. Remediate from Azure CLI 1. Create a dedicated key: az keyvault key create --vault-name <keyvault-name> --name <key-name> -protection <software or hsm> 2. Assign permissions to Databricks: az keyvault set-policy --name <keyvault-name> --resource-group <resourcegroup-name> --spn <databricks-spn> --key-permissions get wrapKey unwrapKey 3. Enable encryption with CMK: az databricks workspace update --name <databricks-workspace-name> --resourcegroup <resource-group-name> --key-source Microsoft.KeyVault --key-name <key-name> --keyvault-uri <keyvault-uri> Remediate from PowerShell $Key = Add-AzKeyVaultKey -VaultName <keyvault-name> -Name <key-name> Destination <software or hsm> Set-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> WorkspaceName <databricks-workspace-name> -EncryptionKeySource Microsoft.KeyVault -KeyVaultUri $Key.Id",
+ "AuditProcedure": "Audit: Audit from Azure Portal 1. Go to Azure Portal → Databricks Workspaces. 2. Select a Databricks Workspace and go to Encryption settings. 3. Check if customer-managed keys (CMK) are enabled under Managed Disk Encryption .4. If CMK is not enabled, the workspace is non-compliant. Audit from Azure CLI Run the following command to check encryption settings for Databricks workspace: az databricks workspace show --name <databricks-workspace-name> --resourcegroup <resource-group-name> --query encryption Ensure that keySource is set to Microsoft.KeyVault. Audit from PowerShell Get-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> | Select-Object Encryption Verify that encryption is set to Customer-Managed Keys (CMK). Audit from Databricks CLI databricks workspace get-metadata --workspace-id <workspace-id> Ensure that encryption settings reflect a CMK setup.",
+ "AdditionalInformation": "This recommendation is based on the Common Reference Recommendation Ensure critical data is encrypted with customer-managed keys (CMK).",
+ "References": "https://docs.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices#protect-data-at-rest:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required",
+ "DefaultValue": "By default, Encryption type is set to Microsoft Managed Keys."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.9",
+ "Description": "Ensure 'No Public IP' is Set to 'Enabled'",
+ "Checks": [
+ "databricks_workspace_no_public_ip_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'No Public IP' is Set to 'Enabled'",
+ "RationaleStatement": "Enabling secure cluster connectivity limits exposure to the public internet, improving security and reducing the risk of external attacks.",
+ "ImpactStatement": "Enabling secure cluster connectivity requires careful network configuration. Before secure cluster connectivity can be enabled, Azure Databricks workspaces must be deployed in a customer-managed virtual network (VNet injection).",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings`, click `Networking`. 4. Under `Network access`, next to `Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP)`, click the radio button next to `Enabled`. 5. Click `Save`. 6. Repeat steps 1-5 for each workspace requiring remediation. **Remediate from Azure CLI** For each workspace requiring remediation, run the following command to set enableNoPublicIp to true: ``` az databricks workspace update --resource-group <resource-group> --name <workspace> --enable-no-public-ip true ``` **Remediate from PowerShell** For each workspace requiring remediation, run the following command to set EnableNoPublicIP to True: ``` Update-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> -EnableNoPublicIP ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings`, click `Networking`. 4. Under `Network access`, ensure that `Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP)` is set to `Enabled`. 5. Repeat steps 1-4 for each workspace. **Audit from Azure CLI** Run the following command to list workspaces: ``` az databricks workspace list ``` For each workspace, run the following command to get the enableNoPublicIp setting: ``` az databricks workspace show --resource-group <resource-group> --name <workspace> --query parameters.enableNoPublicIp.value ``` Ensure that `true` is returned. **Audit from PowerShell** Run the following command to list workspaces: ``` Get-AzDatabricksWorkspace ``` Run the following command to get the workspace in a resource group with a given name: ``` $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> ``` Run the following command to get the EnableNoPublicIp setting: ``` $workspace.EnableNoPublicIP ``` Ensure that `True` is returned. **Audit from Azure Policy** - **Policy ID:** [51c1490f-3319-459c-bbbc-7f391bbed753] **- Name:** 'Azure Databricks Clusters should disable public IP'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/secure-cluster-connectivity:https://learn.microsoft.com/en-us/cli/azure/databricks/workspace:https://learn.microsoft.com/en-us/powershell/module/az.databricks",
+ "DefaultValue": "No Public IP is set to Enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.10",
+ "Description": "Ensure 'Allow Public Network Access' is set to 'Disabled'",
+ "Checks": [
+ "databricks_workspace_public_network_access_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Allow Public Network Access' is set to 'Disabled'",
+ "RationaleStatement": "Disabling public network access improves security by ensuring that Azure Databricks workspaces are not exposed on the public internet.",
+ "ImpactStatement": "Prior to disabling public network access, it is strongly recommended that virtual network integration is completed or private endpoints/links are set up. Disabling public network access restricts access to the service and will require the configuration of a virtual network and/or private endpoints for any services or users needing access within trusted networks.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings` click `Networking`. 4. Under `Network access`, next to `Allow Public Network Access`, click the radio button next to `Disabled`. 5. Click `Save`. 6. Repeat steps 1-5 for each workspace requiring remediation. **Remediate from Azure CLI** For each workspace requiring remediation, run the following command to set publicNetworkAccess to Disabled: ``` az databricks workspace update --resource-group <resource-group> --name <workspace> --public-network-access Disabled ``` **Remediate from PowerShell** For each workspace requiring remediation, run the following command to set PublicNetworkAccess to Disabled: ``` Update-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> -PublicNetworkAccess Disabled ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings` click `Networking`. 4. Under `Network access`, ensure `Allow Public Network Access` is set to `Disabled`. 5. Repeat steps 1-4 for each workspace. **Audit from Azure CLI** Run the following command to list workspaces: ``` az databricks workspace list ``` For each workspace, run the following command to get the publicNetworkAccess setting: ``` az databricks workspace show --resource-group <resource-group> --name <workspace> --query publicNetworkAccess ``` Ensure that `Disabled` is returned. **Audit from PowerShell** Run the following command to list workspaces: ``` Get-AzDatabricksWorkspace ``` Run the following command to get the PublicNetworkAccess setting: ``` $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> $workspace.PublicNetworkAccess ``` Ensure that `Disabled` is returned. **Audit from Azure Policy** - **Policy ID:** [0e7849de-b939-4c50-ab48-fc6b0f5eeba2] **- Name:** 'Azure Databricks Workspaces should disable public network access'",
+ "AdditionalInformation": "This recommendation is based on the Common Reference Recommendation Ensure public network access is Disabled.",
+ "References": "https://learn.microsoft.com/en-us/cli/azure/databricks/workspace:https://learn.microsoft.com/en-us/powershell/module/az.databricks",
+ "DefaultValue": "Allow Public Network Access is set to Enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.11",
+ "Description": "Ensure Private Endpoints are used to access Azure Databricks workspaces",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Private Endpoints are used to access Azure Databricks workspaces",
+ "RationaleStatement": "Using private endpoints for Azure Databricks workspaces ensures that all communication between clients, services, and data sources occurs over a secure, private IP space within an Azure Virtual Network (VNet). This approach eliminates exposure to the public internet, significantly reducing the attack surface and aligning with Zero Trust principles.",
+ "ImpactStatement": "If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic. Private endpoints are charged per hour of use. Before a private endpoint can be configured, Azure Databricks workspaces must be deployed in a customer-managed virtual network, must have secure cluster connectivity enabled, and must be on the Premium pricing tier.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings`, click `Networking`. 4. Click `Private endpoint connections`. 5. Click `+ Private endpoint`. 6. Under `Project details`, select a Subscription and a Resource group. 7. Under `Instance details`, provide a Name, Network Interface Name, and select a Region. 8. Click `Next : Resource >`. 9. Select a Target sub-resource. 10. Click `Next : Virtual Network >`. 11. Under `Networking`, select a Virtual network and a Subnet. 12. Optionally, configure Private IP configuration and Application security group. 13. Click `Next : DNS >`. 14. Optionally, configure Private DNS integration. 15. Click `Next : Tags >`. 16. Optionally, configure tags. 17. Click `Next : Review + create >`. 18. Click `Create`. 19. Repeat steps 1-18 for each workspace requiring remediation. **Remediate from Azure CLI** For each workspace requiring remediation, run the following command to create a private endpoint connection: ``` az network private-endpoint create --resource-group <resource-group> --name <private-endpoint> --location <location> --vnet-name <virtual-network> --subnet <subnet> --private-connection-resource-id <workspace> --connection-name <private-endpoint-connection> --group-id <browser_authentication|databricks_ui_api> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Azure Databricks`. 2. Click the name of a workspace. 3. Under `Settings`, click `Networking`. 4. Click `Private endpoint connections`. 5. Ensure a private endpoint connection exists with a connection state of `Approved`. 6. Repeat steps 1-5 for each workspace. **Audit from Azure CLI** Run the following command to list workspaces: ``` az databricks workspace list ``` For each workspace, run the following command to get the privateEndpointConnections configuration: ``` az databricks workspace show --resource-group <resource-group> --name <workspace> --query privateEndpointConnections ``` Ensure a private endpoint connection is returned with a privateLinkServiceConnectionState status of `Approved`. **Audit from PowerShell** Run the following command to list workspaces: ``` Get-AzDatabricksWorkspace ``` Run the following command to get the PrivateEndpointConnection configuration: ``` $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> $workspace.PrivateEndpointConnection | Select-Object -Property Id,PrivateLinkServiceConnectionStateStatus ``` Ensure a private endpoint connection is returned with a PrivateLinkServiceConnectionStateStatus of `Approved`. **Audit from Azure Policy** - **Policy ID:** [258823f2-4595-4b52-b333-cc96192710d8] **- Name:** 'Azure Databricks Workspaces should use private link'",
+ "AdditionalInformation": "This recommendation is based on the Common Reference Recommendation Ensure Private Endpoints are used to access {service}.",
+ "References": "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link:https://learn.microsoft.com/en-us/cli/azure/databricks/workspace:https://learn.microsoft.com/en-us/powershell/module/az.databricks",
+ "DefaultValue": "Private endpoints are not configured for Azure Databricks workspaces by default."
+ }
+ ]
+ },
+ {
+ "Id": "2.1.12",
+ "Description": "Ensure Azure Databricks groups are reviewed periodically",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Analytics Services",
+ "SubSection": "2.1 Azure Databricks",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Azure Databricks groups are reviewed periodically",
+ "RationaleStatement": "To ensure accurate privileges for your Azure Databricks implementation, your organization should review all users and permission assignments on a regular interval.",
+ "ImpactStatement": "Administrative overhead of user management.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select `Azure Databricks`. 1. Select the Databricks implementation you wish to audit. 1. Select `Access control (IAM)`. 1. Scroll down and select `Add role assignment`. 1. Search for the role you wish to add. Then select `Next`. 1. Select the group members you wish to add. Then select `Next`. 1. Review the info you have chosen, then select `Review + assign`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select `Azure Databricks`. 1. Select the Databricks implementation you wish to audit. 1. Select `Access control (IAM)`. 1. In the horizontal menu select `Role assignments`. 1. Audit the list for each role and its assignment to each user.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-databricks-security-baseline:https://learn.microsoft.com/en-us/azure/databricks/security/auth/",
+ "DefaultValue": "By default Azure Databricks only has the Owner user and role assigned."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.1",
+ "Description": "Ensure only MFA Enabled Identities can Access Privileged Virtual Machine",
+ "Checks": [
+ "entra_user_with_vm_access_has_mfa"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Compute Services",
+ "SubSection": "3.1 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure only MFA Enabled Identities can Access Privileged Virtual Machine",
+ "RationaleStatement": "Integrating multi-factor authentication (MFA) as part of the organizational policy can greatly reduce the risk of an identity gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. An Adversary may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized to move laterally and perform actions with the virtual machine's managed identity. The adversary may then perform management actions or access cloud-hosted resources as the logged-on managed identity.",
+ "ImpactStatement": "This recommendation requires the Entra ID P2 license to implement. Ensure that identities provisioned to a virtual machine utilize an RBAC/ABAC group and are allocated a role using Azure PIM, and that the role settings require MFA or use another third-party PAM solution for accessing virtual machines.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Log in to the Azure portal. 2. This can be remediated by enabling MFA for user, Removing user access or Reducing access of managed identities attached to virtual machines. - Case I : Enable MFA for users having access on virtual machines. 1. Go to `Microsoft Entra ID`. 1. For `Per-user MFA`: 1. Under `Manage`, click `Users`. 1. Click `Per-user MFA`. 1. For each user requiring remediation, check the box next to their name. 1. Click `Enable MFA`. 1. Click `Enable`. 1. For `Conditional Access`: 1. Under `Manage`, click `Security`. 1. Under `Protect`, click `Conditional Access`. 1. Update the Conditional Access policy requiring MFA for all users, removing each user requiring remediation from the `Exclude` list. - Case II : Removing user access on a virtual machine. 1. Select the `Subscription`, then click on `Access control (IAM)`. 2. Select `Role assignments` and search for `Virtual Machine Administrator Login` or `Virtual Machine User Login` or any role that provides access to log into virtual machines. 3. Click on `Role Name`, Select `Assignments`, and remove identities with no MFA configured. - Case III : Reducing access of managed identities attached to virtual machines. 1. Select the `Subscription`, then click on `Access control (IAM)`. 2. Select `Role Assignments` from the top menu and apply filters on `Assignment type` as `Privileged administrator roles` and `Type` as `Virtual Machines`. 3. Click on `Role Name`, Select `Assignments`, and remove identities access make sure this follows the least privileges principal.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Log in to the Azure portal. 1. Select the `Subscription`, then click on `Access control (IAM)`. 1. Click `Role : All` and click `All` to display the drop-down menu. 1. Type `Virtual Machine Administrator Login` and select `Virtual Machine Administrator Login`. 1. Review the list of identities that have been assigned the `Virtual Machine Administrator Login` role. 1. Go to `Microsoft Entra ID`. 1. For `Per-user MFA`: 1. Under `Manage`, click `Users`. 1. Click `Per-user MFA`. 1. Ensure that none of the identities assigned the `Virtual Machine Administrator Login` role from step 4 have `Status` set to `disabled`. 1. For `Conditional Access`: 1. Under `Manage`, click `Security`. 1. Under `Protect`, click `Conditional Access`. 1. Ensure that none of the identities assigned the `Virtual Machine Administrator Login` role from step 4 are exempt from a Conditional Access policy requiring MFA for all users.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.1",
+ "Description": "Ensure that 'security defaults' is Enabled in Microsoft Entra ID",
+ "Checks": [
+ "entra_security_defaults_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.1 Security Defaults (Per-User MFA)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'security defaults' is Enabled in Microsoft Entra ID",
+ "RationaleStatement": "Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings. For example, doing the following: - Requiring all users and admins to register for MFA. - Challenging users with MFA - when necessary, based on factors such as location, device, role, and task. - Disabling authentication from legacy authentication clients, which cant do MFA.",
+ "ImpactStatement": "This recommendation should be implemented initially and then may be overridden by other service/product specific CIS Benchmarks. Administrators should also be aware that certain configurations in Microsoft Entra ID may impact other Microsoft services such as Microsoft 365.",
+ "RemediationProcedure": "**Remediate from Azure Portal** To enable security defaults in your directory: 1. From Azure Home select the Portal Menu. 1. Browse to `Microsoft Entra ID` > `Properties`. 1. Select `Manage security defaults`. 1. Under `Security defaults`, select `Enabled (recommended)`. 1. Select `Save`.",
+ "AuditProcedure": "**Audit from Azure Portal** To ensure security defaults is enabled in your directory: 1. From Azure Home select the Portal Menu. 2. Browse to `Microsoft Entra ID` > `Properties`. 3. Select `Manage security defaults`. 4. Under `Security defaults`, verify that `Enabled (recommended)` is selected.",
+ "AdditionalInformation": "This recommendation differs from the [Microsoft 365 Benchmark](https://workbench.cisecurity.org/benchmarks/5741). This is because the potential impact associated with disabling Security Defaults is dependent upon the security settings implemented in the environment. It is recommended that organizations disabling Security Defaults implement appropriate security settings to replace the settings configured by Security Defaults.",
+ "References": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults:https://techcommunity.microsoft.com/t5/azure-active-directory-identity/introducing-security-defaults/ba-p/1061414:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-2-protect-identity-and-authentication-systems",
+ "DefaultValue": "If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2",
+ "Description": "Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.1 Security Defaults (Per-User MFA)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'",
+ "RationaleStatement": "Multi-factor authentication is recommended when adding devices to Microsoft Entra ID. When set to `Yes`, users who are adding devices from the internet must first use the second method of authentication before their device is successfully added to the directory. This ensures that rogue devices are not added to the domain using a compromised user account.",
+ "ImpactStatement": "A slight impact of additional overhead, as Administrators will now have to approve every access to the domain.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, select `Devices` 1. Under `Manage`, select `Device settings` 1. Under `Microsoft Entra join and registration settings`, set `Require Multifactor Authentication to register or join devices with Microsoft Entra` to `Yes` 1. Click `Save`",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, select `Devices` 1. Under `Manage`, select `Device settings` 1. Under `Microsoft Entra join and registration settings`, ensure that `Require Multifactor Authentication to register or join devices with Microsoft Entra` is set to `Yes`",
+ "AdditionalInformation": "If Conditional Access is available, this recommendation should be bypassed in favor of the Conditional Access implementation of requiring Multifactor Authentication to register or join devices with Microsoft Entra. https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-device-register-join",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-device-register-join:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-6-use-strong-authentication-controls",
+ "DefaultValue": "By default, `Require Multifactor Authentication to register or join devices with Microsoft Entra` is set to `No`."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3",
+ "Description": "Ensure that 'multifactor authentication' is 'enabled' For All Users",
+ "Checks": [
+ "entra_privileged_user_has_mfa",
+ "entra_non_privileged_user_has_mfa"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.1 Security Defaults (Per-User MFA)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'multifactor authentication' is 'enabled' For All Users",
+ "RationaleStatement": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.",
+ "ImpactStatement": "Users would require two forms of authentication before any access is granted. Additional administrative time will be required for managing dual forms of authentication when enabling multifactor authentication.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Manage`, click `Users`. 1. Click `Per-user MFA` from the top menu. 1. Click the box next to a user with `Status` `disabled`. 1. Click `Enable MFA`. 1. Click `Enable`. 1. Repeat steps 1-6 for each user requiring remediation. **Other options within Azure Portal** - [https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa](https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa) - [https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings) - [https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa) - [https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted#enable-multi-factor-authentication-with-conditional-access](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted#enable-multi-factor-authentication-with-conditional-access)",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Manage`, click `Users`. 1. Click `Per-user MFA` from the top menu. 1. Ensure that `Status` is `enabled` for all users. **Audit from REST API** Run the following Graph PowerShell command: ``` get-mguser -All | where {$_.StrongAuthenticationMethods.Count -eq 0} | Select-Object -Property UserPrincipalName ``` If the output contains any `UserPrincipalName`, then this recommendation is non-compliant.",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication:https://azure.microsoft.com/en-us/blog/announcing-mandatory-multi-factor-authentication-for-azure-sign-in/:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-4-authenticate-server-and-services",
+ "DefaultValue": "Multifactor authentication is not enabled for all users by default. Starting in 2024, multifactor authentication is enabled for administrative accounts by default."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4",
+ "Description": "Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.1 Security Defaults (Per-User MFA)",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled",
+ "RationaleStatement": "Remembering Multi-Factor Authentication (MFA) for devices and browsers allows users to have the option to bypass MFA for a set number of days after performing a successful sign-in using MFA. This can enhance usability by minimizing the number of times a user may need to perform two-step verification on the same device. However, if an account or device is compromised, remembering MFA for trusted devices may affect security. Hence, it is recommended that users not be allowed to bypass MFA.",
+ "ImpactStatement": "For every login attempt, the user will be required to perform multi-factor authentication.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, click `Users` 1. Click the `Per-user MFA` button on the top bar 1. Click on `Service settings` 1. Uncheck the box next to `Allow users to remember multi-factor authentication on devices they trust` 1. Click `Save`",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, click `Users` 1. Click the `Per-user MFA` button on the top bar 1. Click on `Service settings` 1. Ensure that `Allow users to remember multi-factor authentication on devices they trust` is not enabled",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings#remember-multi-factor-authentication-for-devices-that-users-trust:https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-6-use-strong-authentication-controls",
+ "DefaultValue": "By default, `Allow users to remember multi-factor authentication on devices they trust` is disabled."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.1",
+ "Description": "Ensure that Azure Admin Accounts Are Not Used for Daily Operations",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Azure Admin Accounts Are Not Used for Daily Operations",
+ "RationaleStatement": "Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.",
+ "ImpactStatement": "Minor administrative overhead includes managing separate accounts, enforcing stricter access controls, and potential licensing costs for advanced security features.",
+ "RemediationProcedure": "If admin accounts are being used for daily operations, consider the following: - Monitor and alert on unusual activity. - Enforce the principle of least privilege. - Revoke any unnecessary administrative access. - Use Conditional Access to limit access to resources. - Ensure that administrators have separate admin and user accounts. - Use Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks. - Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access.",
+ "AuditProcedure": "**Audit from Azure Portal** Monitor: 1. Go to `Monitor`. 1. Click `Activity log`. 1. Review the activity log and ensure that admin accounts are not being used for daily operations. Microsoft Entra ID: 1. Go to `Microsoft Entra ID`. 1. Under `Monitoring`, click `Sign-in logs`. 1. Review the sign-in logs and ensure that admin accounts are not being accessed more frequently than necessary.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/security/privileged-access-workstations/critical-impact-accounts",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.3.2",
+ "Description": "Ensure that Guest Users are Reviewed on a Regular Basis",
+ "Checks": [
+ "entra_policy_guest_users_access_restrictions"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Guest Users are Reviewed on a Regular Basis",
+ "RationaleStatement": "Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely. To prevent this, guest users should be reviewed on a regular basis. During this audit, guest users should also be determined to not have administrative privileges.",
+ "ImpactStatement": "Before removing guest users, determine their use and scope. Like removing any user, there may be unforeseen consequences to systems if an account is removed without careful consideration.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, select `Users` 1. Click on `Add filter` 1. Select `User type` 1. Select `Guest` from the Value dropdown 1. Click `Apply` 1. Check the box next to all `Guest` users that are no longer required or are inactive 1. Click `Delete` 1. Click `OK` **Remediate from Azure CLI** Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems. ``` az ad user update --id <exampleaccountid@domain.com> --account-enabled {false} ``` After determining that there are no dependent systems, delete the user. ``` Remove-AzureADUser -ObjectId <exampleaccountid@domain.com> ``` **Remediate from Azure PowerShell** Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems. ``` Set-AzureADUser -ObjectId <exampleaccountid@domain.com> -AccountEnabled false ``` After determining that there are no dependent systems, delete the user. ``` PS C:\\>Remove-AzureADUser -ObjectId <exampleaccountid@domain.com> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Entra ID` 1. Under `Manage`, select `Users` 1. Click on `Add filter` 1. Select `User type` 1. Select `Guest` from the Value dropdown 1. Click `Apply` 1. Audit the listed guest users **Audit from Azure CLI** ``` az ad user list --query [?userType=='Guest'] ``` Ensure all users listed are still required and not inactive. **Audit from Azure PowerShell** ``` Get-AzureADUser |Where-Object {$_.UserType -like Guest} |Select-Object DisplayName, UserPrincipalName, UserType -Unique ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [e9ac8f8e-ce22-4355-8f04-99b911d6be52](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fe9ac8f8e-ce22-4355-8f04-99b911d6be52) **- Name:** 'Guest accounts with read permissions on Azure resources should be removed' - **Policy ID:** [94e1c2ac-cbbe-4cac-a2b5-389c812dee87](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F94e1c2ac-cbbe-4cac-a2b5-389c812dee87) **- Name:** 'Guest accounts with write permissions on Azure resources should be removed' - **Policy ID:** [339353f6-2387-4a45-abe4-7f529d121046](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F339353f6-2387-4a45-abe4-7f529d121046) **- Name:** 'Guest accounts with owner permissions on Azure resources should be removed'",
+ "AdditionalInformation": "It is good practice to use a dynamic security group to manage guest users. To create the dynamic security group: 1. Navigate to the 'Microsoft Entra ID' blade in the Azure Portal 2. Select the 'Groups' item 3. Create new 4. Type of 'dynamic' 5. Use the following dynamic selection rule. (user.userType -eq Guest) 6. Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.",
+ "References": "https://learn.microsoft.com/en-us/entra/external-id/user-properties:https://learn.microsoft.com/en-us/entra/fundamentals/how-to-create-delete-users#delete-a-user:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-4-review-and-reconcile-user-access-regularly:https://www.microsoft.com/en-us/security/business/identity-access-management/azure-ad-pricing:https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-manage-inactive-user-accounts:https://learn.microsoft.com/en-us/entra/fundamentals/users-restore",
+ "DefaultValue": "By default no guest users are created."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.3",
+ "Description": "Ensure That Use of the 'User Access Administrator' Role is Restricted",
+ "Checks": [
+ "iam_role_user_access_admin_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Use of the 'User Access Administrator' Role is Restricted",
+ "RationaleStatement": "The User Access Administrator role provides extensive access control privileges. Unnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.",
+ "ImpactStatement": "Increased administrative effort to manage and remove role assignments appropriately.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Subscriptions`. 1. Select a subscription. 1. Select `Access control (IAM)`. 1. Look for the following banner at the top of the page: `Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access.` 1. Click `View role assignments`. 1. Click `Remove`. **Remediate from Azure CLI** Run the following command: ``` az role assignment delete --role User Access Administrator --scope / ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Subscriptions`. 1. Select a subscription. 1. Select `Access control (IAM)`. 1. Look for the following banner at the top of the page: `Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access.` If the banner is displayed, the `User Access Administrator` is assigned. **Audit from Azure CLI** Run the following command: ``` az role assignment list --role User Access Administrator --scope / ``` Ensure that the command does not return any `User Access Administrator` role assignment information.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles:https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.3.4",
+ "Description": "Ensure that All 'Privileged' Role Assignments are Periodically Reviewed",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that All 'Privileged' Role Assignments are Periodically Reviewed",
+ "RationaleStatement": "Privileged roles are crown jewel assets that can be used by malicious insiders, threat actors, and even through mistake to significantly damage an organization. These roles should be periodically reviewed to identify lingering permissions assignment and detect lateral movement through privilege escalation.",
+ "ImpactStatement": "Increased administrative effort to manage and remove role assignments appropriately.",
+ "RemediationProcedure": "Review privileged role assignments and remove any that are no longer necessary or appropriate. Use Azure PIM (Privileged Identity Management) to implement just-in-time access for privileged roles.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 2. Select `Subscriptions`. 3. Select a subscription. 4. Select `Access control (IAM)`. 5. Look for the number under the word `Privileged` accompanied by a link titled `View Assignments`. Click the `View assignments` link. 6. For each privileged role listed, evaluate whether the assignment is appropriate and current for each User, Group, or App assigned to each privileged role. NOTE: Determining 'appropriate' assignments requires a clear understanding of your organization's personnel, systems, policy, and security requirements.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.3.5",
+ "Description": "Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions",
+ "RationaleStatement": "Disabled accounts should not retain access to resources, as this poses a security risk. Removing role assignments mitigates potential unauthorized access and enforces the principle of least privilege.",
+ "ImpactStatement": "Ensure disabled accounts are not relied on for break glass or automated processes before removing roles to avoid service disruption.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Entra ID`. 2. Under `Manage`, click `Users`. 3. Click `Add filter`. 4. Click `Account enabled`. 5. Click the toggle switch to set the value to `No`. 6. Click `Apply`. 7. Click the `Display name` of a disabled user account with read, write, or owner roles assigned. 8. Click `Azure role assignments`. 9. Click the name of a read, write, or owner role. 10. Click `Assignments`. 11. Click `Remove` in the row for the disabled user account. 12. Click `Yes`. 13. Repeat steps 7-12 for disabled user accounts requiring remediation. **Remediate from PowerShell** ``` Remove-AzRoleAssignment -ObjectId $user.ObjectId -RoleDefinitionName <role-definition-name> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Entra ID`. 2. Under `Manage`, click `Users`. 3. Click `Add filter`. 4. Click `Account enabled`. 5. Click the toggle switch to set the value to `No`. 6. Click `Apply`. 7. Click the `Display name` of a disabled user account. 8. Click `Azure role assignments`. 9. Ensure that no read, write, or owner roles are assigned to the user account. 10. Repeat steps 7-9 for each disabled user account. **Audit from PowerShell** ``` Connect-AzureAD Get-AzureADUser $user = Get-AzureADUser -ObjectId <object-id> $user.AccountEnabled ``` If AccountEnabled is False, run: ``` Get-AzRoleAssignment -ObjectId $user.ObjectId ``` **Audit from Azure Policy** - **Policy ID:** [0cfea604-3201-4e14-88fc-fae4c427a6c5] - Name: 'Blocked accounts with owner permissions on Azure resources should be removed' - **Policy ID:** [8d7e1fde-fe26-4b5f-8108-f8e432cbc2be] - Name: 'Blocked accounts with read and write permissions on Azure resources should be removed'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azaduser:https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azroleassignment:https://learn.microsoft.com/en-us/powershell/module/az.resources/remove-azroleassignment",
+ "DefaultValue": "Disabled user accounts retain their prior role assignments."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.6",
+ "Description": "Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed",
+ "RationaleStatement": "Unnecessary assignments increase the risk of privilege escalation and unauthorized access. This recommendation should be applied alongside the recommendation 'Ensure that Restrict non-admin users from creating tenants is set to Yes'.",
+ "ImpactStatement": "Verify that the Tenant Creator role is no longer required by any assignments before removal to avoid disruption of critical functions.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Entra ID`. 2. Under `Manage`, click `Roles and administrators`. 3. In the search bar, type `Tenant Creator`. 4. Click the role. 5. Click the name of an assignment. 6. Check the box next to the `Tenant Creator` role. 7. Click `X Remove assignments`. 8. Click `Yes`. 9. Repeat steps 1-8 for each assignment requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Entra ID`. 2. Under `Manage`, click `Roles and administrators`. 3. In the search bar, type `Tenant Creator`. 4. Click the role. 5. Review the assignments and ensure that they are appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-check-tenant-creation-permission:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#tenant-creator",
+ "DefaultValue": "The Tenant Creator role is not assigned by default."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.7",
+ "Description": "Ensure All Non-privileged Role Assignments are Periodically Reviewed",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "SubSection": "5.3 Periodic Identity Reviews",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure All Non-privileged Role Assignments are Periodically Reviewed",
+ "RationaleStatement": "To ensure the principle of least privilege is followed, non-privileged role assignments should be reviewed periodically to confirm that users are granted only the minimum level of permissions they need to perform their tasks.",
+ "ImpactStatement": "Increased administrative effort to manage and remove role assignments appropriately.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Subscriptions`. 2. Click the name of a subscription. 3. Click `Access control (IAM)`. 4. Click `Role assignments`. 5. Click `Job function roles`. 6. Check the box next to any inappropriate assignments. 7. Click `Delete`. 8. Click `Yes`. 9. Repeat steps 1-8 for each subscription.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Subscriptions`. 2. Click the name of a subscription. 3. Click `Access control (IAM)`. 4. Click `Role assignments`. 5. Click `Job function roles`. 6. For each role, ensure the assignments are appropriate. 7. Repeat steps 1-6 for each subscription.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments",
+ "DefaultValue": "Users do not have non-privileged roles assigned to them by default."
+ }
+ ]
+ },
+ {
+ "Id": "5.4",
+ "Description": "Ensure that No Custom Subscription Administrator Roles Exist",
+ "Checks": [
+ "iam_subscription_roles_owner_custom_not_created"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that No Custom Subscription Administrator Roles Exist",
+ "RationaleStatement": "Custom roles in Azure with administrative access can obfuscate the permissions granted and introduce complexity and blind spots to the management of privileged identities. For less mature security programs without regular identity audits, the creation of Custom roles should be avoided entirely. For more mature security programs with regular identity audits, Custom Roles should be audited for use and assignment, used minimally, and the principle of least privilege should be observed when granting permissions",
+ "ImpactStatement": "Subscriptions will need to be handled by Administrators with permissions.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Subscriptions`. 1. Select a subscription. 1. Select `Access control (IAM)`. 1. Select `Roles`. 1. Click `Type` and select `Custom role` from the drop-down menu. 1. Check the box next to each role which grants subscription administrator privileges. 1. Select `Delete`. 1. Select `Yes`. **Remediate from Azure CLI** List custom roles: ``` az role definition list --custom-role-only True ``` Check for entries with `assignableScope` of the `subscription`, and an action of `*`. To remove a violating role: ``` az role definition delete --name <role name> ``` Note that any role assignments must be removed before a custom role can be deleted. Ensure impact is assessed before deleting a custom role granting subscription administrator privileges.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Subscriptions`. 1. Select a subscription. 1. Select `Access control (IAM)`. 1. Select `Roles`. 1. Click `Type` and select `Custom role` from the drop-down menu. 1. Select `View` next to a role. 1. Select `JSON`. 1. Check for `assignableScopes` set to the subscription, and `actions` set to `*`. 1. Repeat steps 7-9 for each custom role. **Audit from Azure CLI** List custom roles: ``` az role definition list --custom-role-only True ``` Check for entries with `assignableScope` of the `subscription`, and an action of `*` **Audit from PowerShell** ``` Connect-AzAccount Get-AzRoleDefinition |Where-Object {($_.IsCustom -eq $true) -and ($_.Actions.contains('*'))} ``` Check the output for `AssignableScopes` value set to the subscription. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [a451c1ef-c6ca-483d-87ed-f49761e3ffb5](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa451c1ef-c6ca-483d-87ed-f49761e3ffb5) **- Name:** 'Audit usage of custom RBAC roles'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/billing/billing-add-change-azure-subscription-administrator:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-3-manage-lifecycle-of-identities-and-entitlements:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle",
+ "DefaultValue": "By default, no custom owner roles are created."
+ }
+ ]
+ },
+ {
+ "Id": "5.5",
+ "Description": "Ensure that a Custom Role is Assigned Permissions for Administering Resource Locks",
+ "Checks": [
+ "iam_custom_role_has_permissions_to_administer_resource_locks"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that a Custom Role is Assigned Permissions for Administering Resource Locks",
+ "RationaleStatement": "Given that the resource lock functionality is outside of standard Role-Based Access Control (RBAC), it would be prudent to create a resource lock administrator role to prevent inadvertent unlocking of resources.",
+ "ImpactStatement": "By adding this role, specific permissions may be granted for managing only resource locks rather than needing to provide the broad Owner or User Access Administrator role, reducing the risk of the user being able to cause unintentional damage.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. In the Azure portal, navigate to a subscription or resource group. 1. Click `Access control (IAM)`. 1. Click `+ Add`. 1. Click `Add custom role`. 1. In the `Custom role name` field enter `Resource Lock Administrator`. 1. In the `Description` field enter `Can Administer Resource Locks`. 1. For `Baseline permissions` select `Start from scratch`. 1. Click `Next`. 1. Click `Add permissions`. 1. In the `Search for a permission` box, type `Microsoft.Authorization/locks`. 1. Click the result. 1. Check the box next to `Permission`. 1. Click `Add`. 1. Click `Review + create`. 1. Click `Create`. 1. Click `OK`. 1. Click `+ Add`. 1. Click `Add role assignment`. 1. In the `Search by role name, description, permission, or ID` box, type `Resource Lock Administrator`. 1. Select the role. 1. Click `Next`. 1. Click `+ Select members`. 1. Select appropriate members. 1. Click `Select`. 1. Click `Review + assign`. 1. Click `Review + assign` again. 1. Repeat steps 1-26 for each subscription or resource group requiring remediation. **Remediate from PowerShell:** Below is a PowerShell definition for a resource lock administrator role created at an Azure Management group level ``` Import-Module Az.Accounts Connect-AzAccount $role = Get-AzRoleDefinition User Access Administrator $role.Id = $null $role.Name = Resource Lock Administrator $role.Description = Can Administer Resource Locks $role.Actions.Clear() $role.Actions.Add(Microsoft.Authorization/locks/*) $role.AssignableScopes.Clear() * Scope at the Management group level Management group $role.AssignableScopes.Add(/providers/Microsoft.Management/managementGroups/MG-Name) New-AzRoleDefinition -Role $role Get-AzureRmRoleDefinition Resource Lock Administrator ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. In the Azure portal, navigate to a subscription or resource group. 1. Click `Access control (IAM)`. 1. Click `Roles`. 1. Click `Type : All`. 1. Click to view the drop-down menu. 1. Select `Custom role`. 1. Click `View` in the `Details` column of a custom role. 1. Review the role permissions. 1. Click `Assignments` and review the assignments. 1. Click the `X` to exit the custom role details page. 1. Repeat steps 7-10. Ensure that at least one custom role exists that assigns the `Microsoft.Authorization/locks` permission to appropriate members. 1. Repeat steps 1-11 for each subscription or resource group.",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles:https://docs.microsoft.com/en-us/azure/role-based-access-control/check-access:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-3-manage-lifecycle-of-identities-and-entitlements:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy",
+ "DefaultValue": "A role for administering resource locks does not exist by default."
+ }
+ ]
+ },
+ {
+ "Id": "5.6",
+ "Description": "Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'",
+ "RationaleStatement": "Permissions to move subscriptions in and out of a Microsoft Entra tenant must only be given to appropriate administrative personnel. A subscription that is moved into a Microsoft Entra tenant may be within a folder to which other users have elevated permissions. This prevents loss of data or unapproved changes of the objects within by potential bad actors.",
+ "ImpactStatement": "Subscriptions will need to have these settings turned off to be moved.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From the Azure Portal Home select the portal menu 1. Select `Subscriptions` 1. In the `Advanced options` drop-down menu, select `Manage Policies` 1. Set `Subscription leaving Microsoft Entra tenant` and `Subscription entering Microsoft Entra tenant` to `Permit no one` 1. Click `Save changes`",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From the Azure Portal Home select the portal menu 1. Select `Subscriptions` 1. In the `Advanced options` drop-down menu, select `Manage Policies` 1. Ensure `Subscription leaving Microsoft Entra tenant` and `Subscription entering Microsoft Entra tenant` are set to `Permit no one`",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/manage-azure-subscription-policy:https://learn.microsoft.com/en-us/entra/fundamentals/how-subscriptions-associated-directory:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-2-protect-identity-and-authentication-systems",
+ "DefaultValue": "By default `Subscription leaving Microsoft Entra tenant` and `Subscription entering Microsoft Entra tenant` are set to `Allow everyone (default)`"
+ }
+ ]
+ },
+ {
+ "Id": "5.7",
+ "Description": "Ensure there are between 2 and 3 Subscription Owners",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Identity Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure there are between 2 and 3 Subscription Owners",
+ "RationaleStatement": "If groups are used, ensure their membership is tightly controlled and regularly reviewed to avoid privilege sprawl. This includes user accounts, Entra ID groups, service principals, and managed identities.",
+ "ImpactStatement": "Implementation may require changes in administrative workflows or the redistribution of roles and responsibilities.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Subscriptions`. 2. Click the name of a subscription. 3. Click `Access Controls (IAM)`. 4. Click `Role assignments`. 5. Click `Role : All`. 6. Click `Owner`. 7. Check the box next to members from whom the owner role should be removed. 8. Click `Delete`. 9. Click `Yes`. 10. Repeat for each subscription requiring remediation. **Remediate from Azure CLI** ``` az role assignment delete --ids <role-assignment-ids> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Subscriptions`. 2. Click the name of a subscription. 3. Click `Access Controls (IAM)`. 4. Click `Role assignments`. 5. Click `Role : All`. 6. Click the arrow next to `All`. 7. Click `Owner`. 8. Ensure a minimum of 2 and a maximum of 3 members are returned. 9. Repeat steps 1-8 for each subscription. **Audit from Azure CLI** ``` az role assignment list --role Owner --scope /subscriptions/<subscription-id> --query \"[].{PrincipalName:principalName, Type:principalType}\" ``` Ensure a minimum of 2 and a maximum of 3 members are returned. **Audit from PowerShell** ``` Get-AzRoleAssignment -RoleDefinitionName Owner -Scope /subscriptions/<subscription-id> ``` **Audit from Azure Policy** - **Policy ID:** [09024ccc-0c5f-475e-9457-b7c0d9ed487b] - Name: 'There should be more than one owner assigned to your subscription' - **Policy ID:** [4f11b553-d42e-4e3a-89be-32ca364cad4c] - Name: 'A maximum of 3 owners should be designated for your subscription'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/cli/azure/role/assignment:https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azroleassignment:https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner",
+ "DefaultValue": "A subscription has 1 owner by default."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.1",
+ "Description": "Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs",
+ "Checks": [
+ "monitor_diagnostic_settings_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs",
+ "RationaleStatement": "A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.",
+ "ImpactStatement": "Diagnostic settings incur costs based on the amount of data collected and the destination.",
+ "RemediationProcedure": "**Remediate from Azure Portal** To enable Diagnostic Settings on a Subscription: 1. Go to `Monitor` 2. Click on `Activity log` 3. Click on `Export Activity Logs` 4. Click `+ Add diagnostic setting` 5. Enter a `Diagnostic setting name` 6. Select `Categories` for the diagnostic setting 7. Select the appropriate `Destination details` (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 8. Click `Save` To enable Diagnostic Settings on a specific resource: 1. Go to `Monitoring` 1. Click `Diagnostic settings` 1. Select `Add diagnostic setting` 1. Enter a `Diagnostic setting name` 1. Select the appropriate log, metric, and destination (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 1. Click `Save` Repeat these step for all resources as needed. **Remediate from Azure CLI** To configure Diagnostic Settings on a Subscription: ``` az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs <JSON encoded categories> (e.g. [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}]) ``` To configure Diagnostic Settings on a specific resource: ``` az monitor diagnostic-settings create --subscription <subscription ID> --resource <resource ID> --name <diagnostic settings name> <[--event-hub <event hub ID> --event-hub-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs <resource specific JSON encoded log settings> --metrics <metric settings (shorthand|json-file|yaml-file)> ``` **Remediate from PowerShell** To configure Diagnostic Settings on a subscription: ``` $logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ServiceHealth -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Recommendation -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Autoscale -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ResourceHealth -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories ``` To configure Diagnostic Settings on a specific resource: ``` $logCategories = @() $logCategories += New-AzDiagnosticSettingLogSettingsObject -Category <resource specific log category> -Enabled $true Repeat command and variable assignment for each Log category specific to the resource where this Diagnostic Setting will get configured. $metricCategories = @() $metricCategories += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true [-Category <resource specific metric category | AllMetrics>] [-RetentionPolicyDay <Integer>] [-RetentionPolicyEnabled $true] Repeat command and variable assignment for each Metric category or use the 'AllMetrics' category. New-AzDiagnosticSetting -ResourceId <resource ID> -Name <Diagnostic settings name> -Log $logCategories -Metric $metricCategories [-EventHubAuthorizationRuleId <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkspaceId <log analytics workspace ID>] [-MarketplacePartnerId <full ARM marketplace resource ID>]>",
+ "AuditProcedure": "**Audit from Azure Portal** To identify Diagnostic Settings on a subscription: 1. Go to `Monitor` 2. Click `Activity Log` 3. Click `Export Activity Logs` 4. Select a `Subscription` 5. Ensure a `Diagnostic setting` exists for the selected Subscription To identify Diagnostic Settings on specific resources: 1. Go to `Monitoring` 2. Click `Diagnostic settings` 3. Ensure a `Diagnostic setting` exists for all appropriate resources. **Audit from Azure CLI** To identify Diagnostic Settings on a subscription: ``` az monitor diagnostic-settings subscription list --subscription <subscription ID> ``` To identify Diagnostic Settings on a resource ``` az monitor diagnostic-settings list --resource <resource Id> ``` **Audit from PowerShell** To identify Diagnostic Settings on a Subscription: ``` Get-AzDiagnosticSetting -SubscriptionId <subscription ID> ``` To identify Diagnostic Settings on a specific resource: ``` Get-AzDiagnosticSetting -ResourceId <resource ID> ```",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/monitoring-overview-activity-logs#export-the-activity-log-with-a-log-profile:https://learn.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, diagnostic setting is not set."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.2",
+ "Description": "Ensure Diagnostic Setting Captures Appropriate Categories",
+ "Checks": [
+ "monitor_diagnostic_setting_with_appropriate_categories"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Diagnostic Setting Captures Appropriate Categories",
+ "RationaleStatement": "A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.",
+ "ImpactStatement": "Enabling additional categories may increase storage costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Monitor`. 1. Click `Activity log`. 1. Click on `Export Activity Logs`. 1. Select the `Subscription` from the drop down menu. 1. Click `Edit setting` next to a diagnostic setting. 1. Check the following categories: `Administrative, Alert, Policy, and Security`. 1. Choose the destination details according to your organization's needs. 1. Click `Save`. **Remediate from Azure CLI** ``` az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}] ``` **Remediate from PowerShell** ``` $logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Monitor`. 1. Click `Activity log`. 1. Click on `Export Activity Logs`. 1. Select the appropriate `Subscription`. 1. Click `Edit setting` next to a diagnostic setting. 1. Ensure that the following categories are checked: `Administrative, Alert, Policy, and Security`. **Audit from Azure CLI** Ensure the categories `'Administrative', 'Alert', 'Policy', and 'Security'` set to: 'enabled: true' ``` az monitor diagnostic-settings subscription list --subscription <subscription ID> ``` **Audit from PowerShell** Ensure the categories Administrative, Alert, Policy, and Security are set to Enabled:True ``` Get-AzSubscriptionDiagnosticSetting -Subscription <subscriptionID> ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [3b980d31-7904-4bb7-8575-5665739a8052](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F3b980d31-7904-4bb7-8575-5665739a8052) **- Name:** 'An activity log alert should exist for specific Security operations' - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations' - **Policy ID:** [c5447c04-a4d7-4ba8-a263-c9ee321a6858](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc5447c04-a4d7-4ba8-a263-c9ee321a6858) **- Name:** 'An activity log alert should exist for specific Policy operations'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings:https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-diagnostic-settings:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation:https://learn.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest:https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azsubscriptiondiagnosticsetting?view=azps-9.2.0",
+ "DefaultValue": "When the diagnostic setting is created using Azure Portal, by default no categories are selected."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.3",
+ "Description": "Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK)",
+ "Checks": [
+ "monitor_storage_account_with_activity_logs_cmk_encrypted"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK)",
+ "RationaleStatement": "Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.",
+ "ImpactStatement": "**NOTE:** You must have your key vault setup to utilize this. All Audit Logs will be encrypted with a key you provide. You will need to set up customer managed keys separately, and you will select which key to use via the instructions here. You will be responsible for the lifecycle of the keys, and will need to manually replace them at your own determined intervals to keep the data secure.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Monitor`. 1. Select `Activity log`. 1. Select `Export Activity Logs`. 1. Select a `Subscription`. 1. Note the name of the `Storage Account` for the diagnostic setting. 1. Navigate to `Storage accounts`. 1. Click on the storage account. 1. Under `Security + networking`, click `Encryption`. 1. Next to `Encryption type`, select `Customer-managed keys`. 1. Complete the steps to configure a customer-managed key for encryption of the storage account. **Remediate from Azure CLI** ``` az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version> ``` **Remediate from PowerShell** ``` Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <key name> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Monitor`. 1. Select `Activity log`. 1. Select `Export Activity Logs`. 1. Select a `Subscription`. 1. Note the name of the `Storage Account` for the diagnostic setting. 1. Navigate to `Storage accounts`. 1. Click on the storage account name noted in Step 5. 1. Under `Security + networking`, click `Encryption`. 1. Ensure `Customer-managed keys` is selected and a key is set. **Audit from Azure CLI** 1. Get storage account id configured with log profile: ``` az monitor diagnostic-settings subscription list --subscription <subscription id> --query 'value[*].storageAccountId' ``` 2. Ensure the storage account is encrypted with CMK: ``` az storage account list --query [?name=='<Storage Account Name>'] ``` In command output ensure `keySource` is set to `Microsoft.Keyvault` and `keyVaultProperties` is not set to `null` **Audit from PowerShell** ``` Get-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name>|select-object -ExpandProperty encryption|format-list ``` Ensure the value of `KeyVaultProperties` is not `null` or empty, and ensure `KeySource` is not set to `Microsoft.Storage`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [fbb99e8e-e444-4da0-9ff1-75c92f5a85b2](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffbb99e8e-e444-4da0-9ff1-75c92f5a85b2) **- Name:** 'Storage account containing the container with activity logs must be encrypted with BYOK'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required:https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=cli#managing-legacy-log-profiles",
+ "DefaultValue": "By default, for a storage account `keySource` is set to `Microsoft.Storage` allowing encryption with vendor Managed key and not a Customer Managed Key."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.4",
+ "Description": "Ensure that Logging for Azure Key Vault is 'Enabled'",
+ "Checks": [
+ "keyvault_logging_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Logging for Azure Key Vault is 'Enabled'",
+ "RationaleStatement": "Monitoring how and when key vaults are accessed, and by whom, enables an audit trail of interactions with confidential information, keys, and certificates managed by Azure Key Vault. Enabling logging for Key Vault saves information in a user provided destination of either an Azure storage account or Log Analytics workspace. The same destination can be used for collecting logs for multiple Key Vaults.",
+ "ImpactStatement": "Enabling logging incurs costs based on the volume of logs generated.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. Select a Key vault. 3. Under `Monitoring`, select `Diagnostic settings`. 4. Click `Edit setting` to update an existing diagnostic setting, or `Add diagnostic setting` to create a new one. 5. If creating a new diagnostic setting, provide a name. 6. Configure an appropriate destination. 7. Under `Category groups`, check `audit` and `allLogs`. 8. Click `Save`. **Remediate from Azure CLI** To update an existing `Diagnostic Settings` ``` az monitor diagnostic-settings update --name <diagnostic_setting_name> --resource <key_vault_id> ``` To create a new `Diagnostic Settings` ``` az monitor diagnostic-settings create --name <diagnostic_setting_name> --resource <key_vault_id> --logs [{category:audit,enabled:true},{category:allLogs,enabled:true}] --metrics [{category:AllMetrics,enabled:true}] <[--event-hub <event_hub_ID> --event-hub-rule <event_hub_auth_rule_ID> | --storage-account <storage_account_ID> |--workspace <log_analytics_workspace_ID> | --marketplace-partner-id <solution_resource_ID>]> ``` **Remediate from PowerShell** Create the `Log` settings object ``` $logSettings = @() $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category audit $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category allLogs ``` Create the `Metric` settings object ``` $metricSettings = @() $metricSettings += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category AllMetrics ``` Create the `Diagnostic Settings` for each `Key Vault` ``` New-AzDiagnosticSetting -Name <diagnostic_setting_name> -ResourceId <key_vault_id> -Log $logSettings -Metric $metricSettings [-StorageAccountId <storage_account_ID> | -EventHubName <event_hub_name> -EventHubAuthorizationRuleId <event_hub_auth_rule_ID> | -WorkSpaceId <log analytics workspace ID> | -MarketPlacePartnerId <full resource ID for third-party solution>] ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 1. For each Key vault, under `Monitoring`, go to `Diagnostic settings`. 1. Click `Edit setting` next to a diagnostic setting. 1. Ensure that a destination is configured. 1. Under `Category groups`, ensure that `audit` and `allLogs` are checked. **Audit from Azure CLI** List all key vaults ``` az keyvault list ``` For each keyvault `id` ``` az monitor diagnostic-settings list --resource <id> ``` Ensure that `storageAccountId` reflects your desired destination and that `categoryGroup` and `enabled` are set as follows in the sample outputs below. ``` logs: [ { categoryGroup: audit, enabled: true, }, { categoryGroup: allLogs, enabled: true, } ``` **Audit from PowerShell** List the key vault(s) in the subscription ``` Get-AzKeyVault ``` For each key vault, run the following: ``` Get-AzDiagnosticSetting -ResourceId <key_vault_id> ``` Ensure that `StorageAccountId`, `ServiceBusRuleId`, `MarketplacePartnerId`, or `WorkspaceId` is set as appropriate. Also, ensure that `enabled` is set to `true`, and that `categoryGroup` reflects both `audit` and `allLogs` category groups. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [cf820ca0-f99e-4f3e-84fb-66e913812d21](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fcf820ca0-f99e-4f3e-84fb-66e913812d21) **- Name:** 'Resource logs in Key Vault should be enabled'",
+ "AdditionalInformation": "**DEPRECATION WARNING** Retention rules for Key Vault logging is being migrated to Azure Storage Lifecycle Management. Retention rules should be set based on the needs of your organization and security or compliance frameworks. Please visit [https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/migrate-to-azure-storage-lifecycle-policy?tabs=portal](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/migrate-to-azure-storage-lifecycle-policy?tabs=portal) for detail on migrating your retention rules. Microsoft has provided the following deprecation timeline: March 31, 2023 – The Diagnostic Settings Storage Retention feature will no longer be available to configure new retention rules for log data. This includes using the portal, CLI PowerShell, and ARM and Bicep templates. If you have configured retention settings, you'll still be able to see and change them in the portal. March 31, 2024 – You will no longer be able to use the API (CLI, Powershell, or templates), or Azure portal to configure retention setting unless you're changing them to 0. Existing retention rules will still be respected. September 30, 2025 – All retention functionality for the Diagnostic Settings Storage Retention feature will be disabled across all environments.",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/general/howto-logging:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, Diagnostic AuditEvent logging is not enabled for Key Vault instances."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.5",
+ "Description": "Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics",
+ "Checks": [
+ "network_flow_log_captured_sent"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics",
+ "RationaleStatement": "Network Flow Logs provide valuable insight into the flow of traffic around your network and feed into both Azure Monitor and Azure Sentinel (if in use), permitting the generation of visual flow diagrams to aid with analyzing for lateral movement, etc.",
+ "ImpactStatement": "The impact of configuring NSG Flow logs is primarily one of cost and configuration. If deployed, it will create storage accounts that hold minimal amounts of data on a 5-day lifecycle before feeding to Log Analytics Workspace. This will increase the amount of data stored and used by Azure Monitor.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Existing NSG flow logs can still be reviewed under `Network Watcher` > `Flow logs`. If you already have NSG flow logs configured, ensure they remain enabled and that `Traffic Analytics` sends data to a `Log Analytics Workspace` until migration is complete. Azure no longer allows creation of new NSG flow logs after June 30, 2025. For new or migrated deployments, create `Virtual network` flow logs instead: 1. Navigate to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Select `+ Create`. 1. Select the desired Subscription. 1. For `Flow log type`, select `Virtual network`. 1. Select `+ Select target resource`. 1. Select `Virtual network`. 1. Select a virtual network. 1. Click `Confirm selection`. 1. Select or create a new Storage Account. 1. If using a v2 storage account, input the retention in days to retain the log. 1. Click `Next`. 1. Under `Analytics`, for `Flow log version`, select `Version 2`. 1. Check the box next to `Enable traffic analytics`. 1. Select a processing interval. 1. Select a `Log Analytics Workspace`. 1. Select `Next`. 1. Optionally add Tags. 1. Select `Review + create`. 1. Select `Create`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down, select `Flow log type`. 1. Review existing `Network security group` flow logs, if any remain, to ensure they are enabled and configured to send logs to a `Log Analytics Workspace`. 1. Review `Virtual network` flow logs for new or migrated coverage. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [27960feb-a23c-4577-8d36-ef8b5f35e0be](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F27960feb-a23c-4577-8d36-ef8b5f35e0be) **- Name:** 'All flow log resources should be in enabled state' - **Policy ID:** [c251913d-7d24-4958-af87-478ed3b9ba41](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc251913d-7d24-4958-af87-478ed3b9ba41) **- Name:** 'Flow logs should be configured for every network security group' - **Policy ID:** [4c3c6c5f-0d47-4402-99b8-aa543dd8bcee](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4c3c6c5f-0d47-4402-99b8-aa543dd8bcee) **- Name:** 'Flow logs should be configured for every virtual network'",
+ "AdditionalInformation": "On September 30, 2027, NSG flow logs will be retired, and creating new NSG flow logs has not been possible since June 30, 2025. Azure recommends migrating to virtual network flow logs, which address NSG flow log limitations. After retirement, traffic analytics using NSG flow logs will no longer be supported, and existing NSG flow log resources will be deleted. Previously collected NSG flow log records will remain available per their retention policies. For details, see the official announcement: https://azure.microsoft.com/en-gb/updates?id=Azure-NSG-flow-logs-Retirement.",
+ "References": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-4-enable-network-logging-for-security-investigation",
+ "DefaultValue": "By default Network Security Group logs are not sent to Log Analytics."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.6",
+ "Description": "Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics",
+ "Checks": [
+ "network_flow_log_captured_sent"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics",
+ "RationaleStatement": "Virtual network flow logs provide critical visibility into traffic patterns. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.",
+ "ImpactStatement": "* Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, click `Flow logs`. 1. Click `+ Create`. 1. Select a subscription. 1. Next to `Flow log type`, select `Virtual network`. 1. Click `+ Select target resource`. 1. Select `Virtual network`. 1. Select a virtual network. 1. Click `Confirm selection`. 1. Select a storage account, or create a new storage account. 1. Set the retention in days for the storage account. 1. Click `Next`. 1. Under `Analytics`, for `Flow logs version`, select `Version 2`. 1. Check the box next to `Enable traffic analytics`. 1. Select a processing interval. 1. Select a `Log Analytics Workspace`. 1. Click `Next`. 1. Optionally, add `Tags`. 1. Click `Review + create`. 1. Click `Create`. 1. Repeat steps 1-20 for each subscription or virtual network requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down menu, select `Flow log type`. 1. From the `Value` drop-down menu, check `Virtual network` only. 1. Click `Apply`. 1. Ensure that at least one virtual network flow log is listed and is configured to send logs to a `Log Analytics Workspace`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [2f080164-9f4d-497e-9db6-416dc9f7b48a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F2f080164-9f4d-497e-9db6-416dc9f7b48a) **- Name:** 'Network Watcher flow logs should have traffic analytics enabled' - **Policy ID:** [4c3c6c5f-0d47-4402-99b8-aa543dd8bcee](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4c3c6c5f-0d47-4402-99b8-aa543dd8bcee) **- Name:** 'Audit flow logs configuration for every virtual network'",
+ "AdditionalInformation": "On September 30, 2027, NSG flow logs will be retired, and creating new NSG flow logs will no longer be possible after June 30, 2025. Azure recommends migrating to virtual network flow logs, which address NSG flow log limitations. After retirement, traffic analytics using NSG flow logs will no longer be supported, and existing NSG flow log resources will be deleted. Previously collected NSG flow log records will remain available per their retention policies. For details, see the official announcement: https://azure.microsoft.com/en-gb/updates?id=Azure-NSG-flow-logs-Retirement.",
+ "References": "https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-overview:https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-cli",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.7",
+ "Description": "Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination",
+ "Checks": [
+ "monitor_diagnostic_settings_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination",
+ "RationaleStatement": "Microsoft Graph activity logs provide visibility into HTTP requests made to the Microsoft Graph service, helping detect unauthorized access, suspicious activity, and security threats. Configuring diagnostic settings in Microsoft Entra ensures these logs are collected and sent to an appropriate destination for monitoring, analysis, and retention.",
+ "ImpactStatement": "A Microsoft Entra ID P1 or P2 tenant license is required to access the Microsoft Graph activity logs. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size and the applications in your tenant that interact with the Microsoft Graph APIs. See the following pricing calculations for respective services: - Log Analytics: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model. - Azure Storage: https://azure.microsoft.com/en-gb/pricing/details/storage/blobs/. - Event Hubs: https://azure.microsoft.com/en-gb/pricing/details/event-hubs/",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Monitoring`, click `Diagnostic settings`. 1. Click `+ Add diagnostic setting`. 1. Provide a `Diagnostic setting name`. 1. Under `Logs > Categories`, check the box next to `MicrosoftGraphActivityLogs`. 1. Configure an appropriate destination for the logs. 1. Click `Save`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Monitoring`, click `Diagnostic settings`. 1. Next to each diagnostic setting, click `Edit setting`, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send `MicrosoftGraphActivityLogs` to an appropriate destination.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-configure-diagnostic-settings:https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview:https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model:https://azure.microsoft.com/en-gb/pricing/details/storage/blobs/:https://azure.microsoft.com/en-gb/pricing/details/event-hubs/",
+ "DefaultValue": "By default, Microsoft Entra diagnostic settings do not exist."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.8",
+ "Description": "Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination",
+ "Checks": [
+ "monitor_diagnostic_settings_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination",
+ "RationaleStatement": "Microsoft Entra activity logs enables you to assess many aspects of your Microsoft Entra tenant. Configuring diagnostic settings in Microsoft Entra ensures these logs are collected and sent to an appropriate destination for monitoring, analysis, and retention.",
+ "ImpactStatement": "To export sign-in data, your organization needs an Azure AD P1 or P2 license. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size. See the following pricing calculations for respective services: - Log Analytics: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model. - Azure Storage: https://azure.microsoft.com/en-gb/pricing/details/storage/blobs/. - Event Hubs: https://azure.microsoft.com/en-gb/pricing/details/event-hubs/",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Monitoring`, click `Diagnostic settings`. 1. Click `+ Add diagnostic setting`. 1. Provide a `Diagnostic setting name`. 1. Under `Logs > Categories`, check the box next to each of the following logs: - `AuditLogs` - `SignInLogs` - `NonInteractiveUserSignInLogs` - `ServicePrincipalSignInLogs` - `ManagedIdentitySignInLogs` - `ProvisioningLogs` - `ADFSSignInLogs` - `RiskyUsers` - `UserRiskEvents` - `NetworkAccessTrafficLogs` - `RiskyServicePrincipals` - `ServicePrincipalRiskEvents` - `EnrichedOffice365AuditLogs` - `MicrosoftGraphActivityLogs` - `RemoteNetworkHealthLogs` - `NetworkAccessAlerts` 1. Configure an appropriate destination for the logs. 1. Click `Save`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Entra ID`. 1. Under `Monitoring`, click `Diagnostic settings`. 1. Next to each diagnostic setting, click `Edit setting`, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send the following logs to an appropriate destination: - `AuditLogs` - `SignInLogs` - `NonInteractiveUserSignInLogs` - `ServicePrincipalSignInLogs` - `ManagedIdentitySignInLogs` - `ProvisioningLogs` - `ADFSSignInLogs` - `RiskyUsers` - `UserRiskEvents` - `NetworkAccessTrafficLogs` - `RiskyServicePrincipals` - `ServicePrincipalRiskEvents` - `EnrichedOffice365AuditLogs` - `MicrosoftGraphActivityLogs` - `RemoteNetworkHealthLogs` - `NetworkAccessAlerts`",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-configure-diagnostic-settings:https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-access-activity-logs?tabs=microsoft-entra-activity-logs%2Carchive-activity-logs-to-a-storage-account",
+ "DefaultValue": "By default, Microsoft Entra diagnostic settings do not exist."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1.9",
+ "Description": "Ensure that Intune Logs are Captured and Sent to Log Analytics",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Intune Logs are Captured and Sent to Log Analytics",
+ "RationaleStatement": "Intune includes built-in logs that provide information about your environments. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.",
+ "ImpactStatement": "A Microsoft Intune plan is required to access Intune: https://www.microsoft.com/en-gb/security/business/microsoft-intune-pricing. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size. For information on Log Analytics workspace costs, visit: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Intune`. 1. Click `Reports`. 1. Under `Azure monitor`, click `Diagnostic settings`. 1. Click `+ Add diagnostic setting`. 1. Provide a `Diagnostic setting name`. 1. Under `Logs > Categories`, check the box next to each of the following logs: - `AuditLogs` - `OperationalLogs` - `DeviceComplianceOrg` - `Devices` - `Windows365AuditLogs` 1. Under `Destination details`, check the box next to `Send to Log Analytics workspace`. 1. Select a `Subscription`. 1. Select a `Log Analytics workspace`. 1. Click `Save`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Intune`. 1. Click `Reports`. 1. Under `Azure monitor`, click `Diagnostic settings`. 1. Next to each diagnostic setting, click `Edit setting`, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send the following logs to a Log Analytics workspace: - `AuditLogs` - `OperationalLogs` - `DeviceComplianceOrg` - `Devices` - `Windows365AuditLogs`",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor:https://www.microsoft.com/en-gb/security/business/microsoft-intune-pricing:https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs",
+ "DefaultValue": "By default, Intune diagnostic settings do not exist."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.1",
+ "Description": "Ensure that Activity Log Alert Exists for Create Policy Assignment",
+ "Checks": [
+ "monitor_alert_create_policy_assignment"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Create Policy Assignment",
+ "RationaleStatement": "Monitoring for create policy assignment events gives insight into changes done in Azure policy - assignments and can reduce the time it takes to detect unsolicited changes.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Create policy assignment (Policy assignment)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription ID> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Authorization/policyAssignments/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Get the `Action Group` information and store it in a variable, then create a new `Action` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` variable. ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Authorization/policyAssignments/write` ``` New-AzActivityLogAlert -Name <activity alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Authorization/policyAssignments/write`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Create policy assignment'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Authorization/policyAssignments/write` in the output. If it's missing, generate a finding. **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Authorization/policyAssignments/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` If the output is empty, an `alert rule` for `Create Policy Assignments` is not configured. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [c5447c04-a4d7-4ba8-a263-c9ee321a6858](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc5447c04-a4d7-4ba8-a263-c9ee321a6858) **- Name:** 'An activity log alert should exist for specific Policy operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation:https://docs.microsoft.com/en-in/rest/api/policy/policy-assignments:https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.2",
+ "Description": "Ensure that Activity Log Alert exists for Delete Policy Assignment",
+ "Checks": [
+ "monitor_alert_delete_policy_assignment"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert exists for Delete Policy Assignment",
+ "RationaleStatement": "Monitoring for delete policy assignment events gives insight into changes done in azure policy - assignments and can reduce the time it takes to detect unsolicited changes.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Delete policy assignment (Policy assignment)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the conditions object ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Authorization/policyAssignments/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Action` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` variable. ``` $scope = /subscriptions/<subscription id> ``` Create the `Activity Log Alert Rule` for `Microsoft.Authorization/policyAssignments/delete`. ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Authorization/policyAssignments/delete`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete policy assignment'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Authorization/policyAssignments/delete` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Authorization/policyAssignments/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [c5447c04-a4d7-4ba8-a263-c9ee321a6858](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc5447c04-a4d7-4ba8-a263-c9ee321a6858) **- Name:** 'An activity log alert should exist for specific Policy operations'",
+ "AdditionalInformation": "This log alert also applies for Azure Blueprints.",
+ "References": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation:https://azure.microsoft.com/en-us/services/blueprints/",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.3",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Network Security Group",
+ "Checks": [
+ "monitor_alert_create_update_nsg"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Network Security Group",
+ "RationaleStatement": "Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Create or Update Network Security Group (Network Security Group)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/networkSecurityGroups/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription id> ``` Create the `Activity Log Alert Rule` for `Microsoft.Network/networkSecurityGroups/write` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Network/networkSecurityGroups/write`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Network Security Group'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Network/networkSecurityGroups/write` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/networkSecurityGroups/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.4",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Network Security Group",
+ "Checks": [
+ "monitor_alert_delete_nsg"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Network Security Group",
+ "RationaleStatement": "Monitoring for Delete Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Delete Network Security Group (Network Security Group)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/networkSecurityGroups/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription id> ``` Create the `Activity Log Alert Rule` for `Microsoft.Network/networkSecurityGroups/delete` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Network/networkSecurityGroups/delete`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Network Security Group'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Network/networkSecurityGroups/delete` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/networkSecurityGroups/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.5",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Security Solution",
+ "Checks": [
+ "monitor_alert_create_update_security_solution"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Security Solution",
+ "RationaleStatement": "Monitoring for Create or Update Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Create or Update Security Solutions (Security Solutions)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Security/securitySolutions/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Security/securitySolutions/write` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Security/securitySolutions/write`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Security Solutions'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Security/securitySolutions/write` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Security/securitySolutions/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.6",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Security Solution",
+ "Checks": [
+ "monitor_alert_delete_security_solution"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Security Solution",
+ "RationaleStatement": "Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "Alert rules incur minimal costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Delete Security Solutions (Security Solutions)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Security/securitySolutions/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Security/securitySolutions/delete` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Security/securitySolutions/delete`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Security Solutions'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Security/securitySolutions/delete` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Security/securitySolutions/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.7",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule",
+ "Checks": [
+ "monitor_alert_create_update_sqlserver_fr"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule",
+ "RationaleStatement": "Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "There will be a substantial increase in log size if there are a large number of administrative actions on a server.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Create/Update server firewall rule (Server Firewall Rule)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Sql/servers/firewallRules/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Sql/servers/firewallRules/write` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Sql/servers/firewallRules/write`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Create/Update server firewall rule'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Sql/servers/firewallRules/write` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Sql/servers/firewallRules/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.8",
+ "Description": "Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule",
+ "Checks": [
+ "monitor_alert_delete_sqlserver_fr"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule",
+ "RationaleStatement": "Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "There will be a substantial increase in log size if there are a large number of administrative actions on a server.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Delete server firewall rule (Server Firewall Rule)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Sql/servers/firewallRules/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Sql/servers/firewallRules/delete` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Sql/servers/firewallRules/delete`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete server firewall rule'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Sql/servers/firewallRules/delete` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Sql/servers/firewallRules/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b954148f-4c11-4c38-8221-be76711e194a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb954148f-4c11-4c38-8221-be76711e194a) **- Name:** 'An activity log alert should exist for specific Administrative operations'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.9",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Public IP Address rule",
+ "Checks": [
+ "monitor_alert_create_update_public_ip_address_rule"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Create or Update Public IP Address rule",
+ "RationaleStatement": "Monitoring for Create or Update Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "There will be a substantial increase in log size if there are a large number of administrative actions on a server.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Create or Update Public Ip Address (Public Ip Address)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/publicIPAddresses/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Network/publicIPAddresses/write` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Network/publicIPAddresses/write`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Public Ip Address'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Network/publicIPAddresses/write` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/publicIPAddresses/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [1513498c-3091-461a-b321-e9b433218d28](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F1513498c-3091-461a-b321-e9b433218d28) **- Name:** 'Enable logging by category group for Public IP addresses (microsoft.network/publicipaddresses) to Log Analytics'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.10",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Public IP Address rule",
+ "Checks": [
+ "monitor_alert_delete_public_ip_address_rule"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Activity Log Alert Exists for Delete Public IP Address rule",
+ "RationaleStatement": "Monitoring for Delete Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "There will be a substantial increase in log size if there are a large number of administrative actions on a server.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Select `Alerts`. 1. Select `Create`. 1. Select `Alert rule`. 1. Choose a subscription. 1. Select `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Delete Public Ip Address (Public Ip Address)`. 1. Click `Apply`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. **Remediate from Azure CLI** ``` az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> ``` **Remediate from PowerShell** Create the `Conditions` object. ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/publicIPAddresses/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level ``` Retrieve the `Action Group` information and store in a variable, then create the `Actions` object. ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object ``` $scope = /subscriptions/<subscription ID> ``` Create the `Activity Log Alert Rule` for `Microsoft.Network/publicIPAddresses/delete` ``` New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the `Monitor` blade. 1. Click on `Alerts`. 1. In the Alerts window, click on `Alert rules`. 1. Ensure an alert rule exists where the Condition column contains `Operation name=Microsoft.Network/publicIPAddresses/delete`. 1. Click on the Alert `Name` associated with the previous step. 1. Ensure the `Condition` panel displays the text `Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Public Ip Address'` and does not filter on `Level`, `Status` or `Caller`. 1. Ensure the `Actions` panel displays an Action group is assigned to notify the appropriate personnel in your organization. **Audit from Azure CLI** ``` az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} ``` Look for `Microsoft.Network/publicIPAddresses/delete` in the output **Audit from PowerShell** ``` Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/publicIPAddresses/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [1513498c-3091-461a-b321-e9b433218d28](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F1513498c-3091-461a-b321-e9b433218d28) **- Name:** 'Enable logging by category group for Public IP addresses (microsoft.network/publicipaddresses) to Log Analytics'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement:https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate:https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2.11",
+ "Description": "Ensure that an Activity Log Alert Exists for Service Health",
+ "Checks": [
+ "monitor_alert_service_health_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that an Activity Log Alert Exists for Service Health",
+ "RationaleStatement": "Monitoring for Service Health events provides insight into service issues, planned maintenance, security advisories, and other changes that may affect the Azure services and regions in use.",
+ "ImpactStatement": "There is no charge for creating activity log alert rules.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Monitor`. 1. Click `Alerts`. 1. Click `+ Create`. 1. Select `Alert rule` from the drop-down menu. 1. Choose a subscription. 1. Click `Apply`. 1. Select the `Condition` tab. 1. Click `See all signals`. 1. Select `Service health`. 1. Click `Apply`. 1. Open the drop-down menu next to `Event types`. 1. Check the box next to `Select all`. 1. Select the `Actions` tab. 1. Click `Select action groups` to select an existing action group, or `Create action group` to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the `Details` tab. 1. Select a `Resource group`, provide an `Alert rule name` and an optional `Alert rule description`. 1. Click `Review + create`. 1. Click `Create`. 1. Repeat steps 1-19 for each subscription requiring remediation. **Remediate from Azure CLI** For each subscription requiring remediation, run the following command to create a `ServiceHealth` alert rule for a subscription: ``` az monitor activity-log alert create --subscription <subscription-id> --resource-group <resource-group> --name <alert-rule> --condition category=ServiceHealth and properties.incidentType=Incident --scope /subscriptions/<subscription-id> --action-group <action-group> ``` **Remediate from PowerShell** Create the `Conditions` object: ``` $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Field category -Equal ServiceHealth $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Field properties.incidentType -Equal Incident ``` Retrieve the `Action Group` information and store in a variable: ``` $actionGroup = Get-AzActionGroup -ResourceGroupName <resource-group> -Name <action-group> ``` Create the `Actions` object: ``` $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id ``` Create the `Scope` object: ``` $scope = /subscriptions/<subscription-id> ``` Create the activity log alert rule: ``` New-AzActivityLogAlert -Name <alert-rule> -ResourceGroupName <resource-group> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription-id> -Enabled $true ``` Repeat for each subscription requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Monitor`. 1. Click `Alerts`. 1. Click `Alert rules`. 1. Ensure an alert rule exists for a subscription with `Condition` set to `Service names=All, Event types=All` and `Target resource type` set to `Subscription`. 1. If an alert rule is found for step 4, click the name of the alert rule. 1. Ensure the `Actions` panel displays an action group configured to notify appropriate personnel. 1. Repeat steps 1-6 for each subscription. **Audit from Azure CLI** Run the following command to list activity log alerts: ``` az monitor activity-log alert list --subscription <subscription-id> ``` For each activity log alert, run the following command: ``` az monitor activity-log alert show --subscription <subscription-id> --resource-group <resource-group> --activity-log-alert-name <activity-log-alert> ``` Ensure an alert exists for `ServiceHealth` with `scopes` set to a subscription ID. Repeat for each subscription. **Audit from PowerShell** Run the following command to locate `ServiceHealth` alert rules for a subscription: ``` Get-AzActivityLogAlert -SubscriptionId <subscription-id> | where-object {$_.ConditionAllOf.Equal -match ServiceHealth} | select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf ``` Ensure that at least one `ServiceHealth` alert rule is returned. Repeat for each subscription.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/service-health/overview:https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal:https://azure.microsoft.com/en-gb/pricing/details/monitor/#faq:https://learn.microsoft.com/en-us/cli/azure/monitor/activity-log/alert:https://learn.microsoft.com/en-us/powershell/module/az.monitor/get-azactivitylogalert:https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azactivitylogalert",
+ "DefaultValue": "By default, no monitoring alerts are created."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.3.1",
+ "Description": "Ensure Application Insights are Configured",
+ "Checks": [
+ "appinsights_ensure_is_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Application Insights are Configured",
+ "RationaleStatement": "Configuring Application Insights provides additional data not found elsewhere within Azure as part of a much larger logging and monitoring program within an organization's Information Security practice. The types and contents of these logs will act as both a potential cost saving measure (application performance) and a means to potentially confirm the source of a potential incident (trace logging). Metrics and Telemetry data provide organizations with a proactive approach to cost savings by monitoring an application's performance, while the trace logging data provides necessary details in a reactive incident response scenario by helping organizations identify the potential source of an incident within their application.",
+ "ImpactStatement": "Because Application Insights relies on a Log Analytics Workspace, an organization will incur additional expenses when using this service.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to `Application Insights`. 2. Under the `Basics` tab within the `PROJECT DETAILS` section, select the `Subscription`. 3. Select the `Resource group`. 4. Within the `INSTANCE DETAILS`, enter a `Name`. 5. Select a `Region`. 6. Next to `Resource Mode`, select `Workspace-based`. 7. Within the `WORKSPACE DETAILS`, select the `Subscription` for the log analytics workspace. 8. Select the appropriate `Log Analytics Workspace`. 9. Click `Next:Tags >`. 10. Enter the appropriate `Tags` as `Name`, `Value` pairs. 11. Click `Next:Review+Create`. 12. Click `Create`. **Remediate from Azure CLI** ``` az monitor app-insights component create --app <app name> --resource-group <resource group name> --location <location> --kind web --retention-time <INT days to retain logs> --workspace <log analytics workspace ID> --subscription <subscription ID> ``` **Remediate from PowerShell** ``` New-AzApplicationInsights -Kind web -ResourceGroupName <resource group name> -Name <app insights name> -location <location> -RetentionInDays <INT days to retain logs> -SubscriptionID <subscription ID> -WorkspaceResourceId <log analytics workspace ID> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to `Application Insights`. 2. Ensure an `Application Insights` service is configured and exists. **Audit from Azure CLI** ``` az monitor app-insights component show --query [].{ID:appId, Name:name, Tenant:tenantId, Location:location, Provisioning_State:provisioningState} ``` Ensure the above command produces output, otherwise `Application Insights` has not been configured. **Audit from PowerShell** ``` Get-AzApplicationInsights|select location,name,appid,provisioningState,tenantid ```",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview",
+ "DefaultValue": "Application Insights are not enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.4",
+ "Description": "Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it",
+ "Checks": [
+ "monitor_diagnostic_settings_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it",
+ "RationaleStatement": "A lack of monitoring reduces the visibility into the data plane, and therefore an organization's ability to detect reconnaissance, authorization attempts or other malicious activity. Unlike Activity Logs, Resource Logs are not enabled by default. Specifically, without monitoring it would be impossible to tell which entities had accessed a data store that was breached. In addition, alerts for failed attempts to access APIs for Web Services or Databases are only possible when logging is enabled.",
+ "ImpactStatement": "Costs for monitoring varies with Log Volume. Not every resource needs to have logging enabled. It is important to determine the security classification of the data being processed by the given resource and adjust the logging based on which events need to be tracked. This is typically determined by governance and compliance requirements.",
+ "RemediationProcedure": "Azure Subscriptions should log every access and operation for all resources. Logs should be sent to Storage and a Log Analytics Workspace or equivalent third-party system. Logs should be kept in readily-accessible storage for a minimum of one year, and then moved to inexpensive cold storage for a duration of time as necessary. If retention policies are set but storing logs in a Storage Account is disabled (for example, if only Event Hubs or Log Analytics options are selected), the retention policies have no effect. Enable all monitoring at first, and then be more aggressive moving data to cold storage if the volume of data becomes a cost concern. **Remediate from Azure Portal** The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are: 1. Go to the resource 2. Click on Diagnostic settings 3. In the blade that appears, click Add diagnostic setting 4. Configure the diagnostic settings 5. Click on Save **Remediate from Azure CLI** For each `resource`, run the following making sure to use a `resource` appropriate JSON encoded `category` for the `--logs` option. ``` az monitor diagnostic-settings create --name <diagnostic settings name> --resource <resource ID> --logs [{category:<resource specific category>,enabled:true,rentention-policy:{enabled:true,days:180}}] --metrics [{category:AllMetrics,enabled:true,retention-policy:{enabled:true,days:180}}] <[--event-hub <event hub ID> --event-hub-rule <event hub auth rule ID> | --storage-account <storage account ID> |--workspace <log analytics workspace ID> | --marketplace-partner-id <full resource ID of third-party solution>]> ``` **Remediate from PowerShell** Create the `log` settings object ``` $logSettings = @() $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category <resource specific category> $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category <resource specific category number 2> ``` Create the `metric` settings object ``` $metricSettings = @() $metricSettings += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category AllMetrics ``` Create the diagnostic setting for a specific resource ``` New-AzDiagnosticSetting -Name <diagnostic settings name> -ResourceId <resource ID> -Log $logSettings -Metric $metricSettings ```",
+ "AuditProcedure": "**Audit from Azure Portal** The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are: 1. Go to the resource 2. Click on Diagnostic settings 3. In the blade that appears, click Add diagnostic setting 4. Configure the diagnostic settings 5. Click on Save **Audit from Azure CLI** List all `resources` for a `subscription` ``` az resource list --subscription <subscription id> ``` For each `resource` run the following ``` az monitor diagnostic-settings list --resource <resource ID> ``` An empty result means a `diagnostic settings` is not configured for that resource. An error message means a `diagnostic settings` is not supported for that resource. **Audit from PowerShell** Get a list of `resources` in a `subscription` context and store in a variable ``` $resources = Get-AzResource ``` Loop through each `resource` to determine if a diagnostic setting is configured or not. ``` foreach ($resource in $resources) {$diagnosticSetting = Get-AzDiagnosticSetting -ResourceId $resource.id -ErrorAction SilentlyContinue; if ([string]::IsNullOrEmpty($diagnosticSetting)) {$message = Diagnostic Settings not configured for resource: + $resource.Name;Write-Output $message}else{$diagnosticSetting}} ``` A result of `Diagnostic Settings not configured for resource: <resource name>` means a `diagnostic settings` is not configured for that resource. Otherwise, the output of the above command will show configured `Diagnostic Settings` for a resource. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [cf820ca0-f99e-4f3e-84fb-66e913812d21](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fcf820ca0-f99e-4f3e-84fb-66e913812d21) **- Name:** 'Resource logs in Key Vault should be enabled' - **Policy ID:** [91a78b24-f231-4a8a-8da9-02c35b2b6510](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F91a78b24-f231-4a8a-8da9-02c35b2b6510) **- Name:** 'App Service apps should have resource logs enabled' - **Policy ID:** [428256e6-1fac-4f48-a757-df34c2b3336d](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F428256e6-1fac-4f48-a757-df34c2b3336d) **- Name:** 'Resource logs in Batch accounts should be enabled' - **Policy ID:** [057ef27e-665e-4328-8ea3-04b3122bd9fb](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F057ef27e-665e-4328-8ea3-04b3122bd9fb) **- Name:** 'Resource logs in Azure Data Lake Store should be enabled' - **Policy ID:** [c95c74d9-38fe-4f0d-af86-0c7d626a315c](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc95c74d9-38fe-4f0d-af86-0c7d626a315c) **- Name:** 'Resource logs in Data Lake Analytics should be enabled' - **Policy ID:** [83a214f7-d01a-484b-91a9-ed54470c9a6a](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F83a214f7-d01a-484b-91a9-ed54470c9a6a) **- Name:** 'Resource logs in Event Hub should be enabled' - **Policy ID:** [383856f8-de7f-44a2-81fc-e5135b5c2aa4](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F383856f8-de7f-44a2-81fc-e5135b5c2aa4) **- Name:** 'Resource logs in IoT Hub should be enabled' - **Policy ID:** [34f95f76-5386-4de7-b824-0d8478470c9d](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F34f95f76-5386-4de7-b824-0d8478470c9d) **- Name:** 'Resource logs in Logic Apps should be enabled' - **Policy ID:** [b4330a05-a843-4bc8-bf9a-cacce50c67f4](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb4330a05-a843-4bc8-bf9a-cacce50c67f4) **- Name:** 'Resource logs in Search services should be enabled' - **Policy ID:** [f8d36e2f-389b-4ee4-898d-21aeb69a0f45](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff8d36e2f-389b-4ee4-898d-21aeb69a0f45) **- Name:** 'Resource logs in Service Bus should be enabled' - **Policy ID:** [f9be5368-9bf5-4b84-9e0a-7850da98bb46](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff9be5368-9bf5-4b84-9e0a-7850da98bb46) **- Name:** 'Resource logs in Azure Stream Analytics should be enabled'",
+ "AdditionalInformation": "For an up-to-date list of Azure resources which support Azure Monitor, refer to the Supported Log Categories reference.",
+ "References": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-5-centralize-security-log-management-and-analysis:https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/monitor-azure-resource:Supported Log Categories: https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs-categories:Logs and Audit - Fundamentals: https://docs.microsoft.com/en-us/azure/security/fundamentals/log-audit:Collecting Logs: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/collect-activity-logs:Key Vault Logging: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-logging:Monitor Diagnostic Settings: https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest:Overview of Diagnostic Logs: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-logs-overview:Supported Services for Diagnostic Logs: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-logs-schema:Diagnostic Logs for CDNs: https://docs.microsoft.com/en-us/azure/cdn/cdn-azure-diagnostic-logs",
+ "DefaultValue": "By default, Azure Monitor Resource Logs are 'Disabled' for all resources."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.5",
+ "Description": "Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "SubSection": "6.1 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA",
+ "RationaleStatement": "Typically, production workloads need to be monitored and should have an SLA with Microsoft, using Basic SKUs for any deployed product will mean that that these capabilities do not exist. The following resource types should use standard SKUs as a minimum. - Public IP Addresses - Network Load Balancers - REDIS Cache - SQL PaaS Databases - VPN Gateways",
+ "ImpactStatement": "The impact of enforcing Standard SKU's is twofold 1) There will be a cost increase 2) The monitoring and service level agreements will be available and will support the production service. All resources should be either tagged or in separate Management Groups/Subscriptions",
+ "RemediationProcedure": "Each resource has its own process for upgrading from basic to standard SKUs that should be followed if required. - Public IP Address: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-upgrade. - Basic Load Balancer: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-basic-upgrade-guidance. - Azure Cache for Redis: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-scale. - Azure SQL Database: https://learn.microsoft.com/en-us/azure/azure-sql/database/scale-resources. - VPN Gateway: https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-resize.",
+ "AuditProcedure": "This needs to be audited by Azure Policy (one for each resource type) and denied for each artifact that is production. **Audit from Azure Portal** 1. Open `Azure Resource Graph Explorer` 1. Click `New query` 1. Paste the following into the query window: ``` Resources | where sku contains 'Basic' or sku contains 'consumption' | order by type ``` 4. Click `Run query` then evaluate the results in the results window. 5. Ensure that no production artifacts are returned. **Audit from Azure CLI** ``` az graph query -q Resources | where sku contains 'Basic' or sku contains 'consumption' | order by type ``` Alternatively, to filter on a specific resource group: ``` az graph query -q Resources | where resourceGroup == '<resourceGroupName>' | where sku contains 'Basic' or sku contains 'consumption' | order by type ``` Ensure that no production artifacts are returned. **Audit from PowerShell** ``` Get-AzResource | ?{ $_.Sku -EQ Basic} ``` Ensure that no production artifacts are returned.",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/support/plans:https://azure.microsoft.com/en-us/support/plans/response/:https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-upgrade:https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-basic-upgrade-guidance:https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-scale:https://learn.microsoft.com/en-us/azure/azure-sql/database/scale-resources:https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-resize",
+ "DefaultValue": "Policy should enforce standard SKUs for the following artifacts: - Public IP Addresses - Network Load Balancers - REDIS Cache - SQL PaaS Databases - VPN Gateways"
+ }
+ ]
+ },
+ {
+ "Id": "6.2",
+ "Description": "Ensure that Resource Locks are set for Mission-Critical Azure Resources",
+ "Checks": [
+ "iam_custom_role_has_permissions_to_administer_resource_locks"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Management and Governance Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Resource Locks are set for Mission-Critical Azure Resources",
+ "RationaleStatement": "As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to `CanNotDelete` or `ReadOnly` to achieve this purpose. - `CanNotDelete` means authorized users can still read and modify a resource, but they cannot delete the resource. - `ReadOnly` means authorized users can read a resource, but they cannot delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.",
+ "ImpactStatement": "There can be unintended outcomes of locking a resource. Applying a lock to a parent service will cause it to be inherited by all resources within. Conversely, applying a lock to a resource may not apply to connected storage, leaving it unlocked. Please see the documentation for further information.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the specific Azure Resource or Resource Group. 2. For each mission critical resource, click on `Locks`. 3. Click `Add`. 4. Give the lock a name and a description, then select the type, `Read-only` or `Delete` as appropriate. 5. Click OK. **Remediate from Azure CLI** To lock a resource, provide the name of the resource, its resource type, and its resource group name. ``` az lock create --name <LockName> --lock-type <CanNotDelete/Read-only> --resource-group <resourceGroupName> --resource-name <resourceName> --resource-type <resourceType> ``` **Remediate from PowerShell** ``` Get-AzResourceLock -ResourceName <Resource Name> -ResourceType <Resource Type> -ResourceGroupName <Resource Group Name> -Locktype <CanNotDelete/Read-only> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the specific Azure Resource or Resource Group. 2. Click on `Locks`. 3. Ensure the lock is defined with name and description, with type `Read-only` or `Delete` as appropriate. **Audit from Azure CLI** Review the list of all locks set currently: ``` az lock list --resource-group <resourcegroupname> --resource-name <resourcename> --namespace <Namespace> --resource-type <type> --parent ``` **Audit from PowerShell** Run the following command to list all resources. ``` Get-AzResource ``` For each resource, run the following command to check for Resource Locks. ``` Get-AzResourceLock -ResourceName <Resource Name> -ResourceType <Resource Type> -ResourceGroupName <Resource Group Name> ``` Review the output of the `Properties` setting. Compliant settings will have the `CanNotDelete` or `ReadOnly` value.",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources:https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-subscription-governance#azure-resource-locks:https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-asset-management#am-4-limit-access-to-asset-management",
+ "DefaultValue": "By default, no locks are set."
+ }
+ ]
+ },
+ {
+ "Id": "7.1",
+ "Description": "Ensure that RDP Access from the Internet is Evaluated and Restricted",
+ "Checks": [
+ "network_rdp_internet_access_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that RDP Access from the Internet is Evaluated and Restricted",
+ "RationaleStatement": "The potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on an Azure Virtual Network or even attack networked devices outside of Azure.",
+ "ImpactStatement": "Restricting RDP access may require alternative methods for remote administration such as VPN or Azure Bastion.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Network security groups`. 1. Under `Settings`, click `Inbound security rules`. 1. Check the box next to any inbound security rule matching: - Port: `3389` or range including 3389 - Protocol: `TCP` or `Any` - Source: `0.0.0.0/0`, `Internet`, or `Any` - Action: `Allow` 1. Click `Delete`. 1. Click `Yes`. **Remediate from Azure CLI** For each network security group rule requiring remediation, run the following command to delete a rule: ``` az network nsg rule delete --resource-group <resource-group> --nsg-name <network-security-group> --name <rule> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Network security groups`. 1. Under `Settings`, click `Inbound security rules`. 1. Ensure that no inbound security rule exists that matches the following: - Port: `3389` or range including 3389 - Protocol: `TCP` or `Any` - Source: `0.0.0.0/0`, `Internet`, or `Any` - Action: `Allow` 1. Repeat steps 1-3 for each network security group. To audit from Azure Resource Graph: 1. Go to `Resource Graph Explorer`. 1. Click `New query`. 1. Paste the following into the query window: ``` resources | where type =~ microsoft.network/networksecuritygroups | project id, name, securityRule = properties.securityRules | mv-expand securityRule | extend access = securityRule.properties.access, direction = securityRule.properties.direction, protocol = securityRule.properties.protocol, destinationPort = case(isempty(securityRule.properties.destinationPortRange), securityRule.properties.destinationPortRanges, securityRule.properties.destinationPortRange), sourceAddress = case(isempty(securityRule.properties.sourceAddressPrefix), securityRule.properties.sourceAddressPrefixes, securityRule.properties.sourceAddressPrefix) | where access =~ Allow and direction =~ Inbound and protocol in~ (tcp, ) | mv-expand destinationPort | mv-expand sourceAddress | extend destinationPortMin = toint(split(destinationPort, -)[0]), destinationPortMax = toint(split(destinationPort, -)[-1]) | where (destinationPortMin <= 3389 and destinationPortMax >= 3389) or destinationPort == | where sourceAddress in~ (*, 0.0.0.0, internet, any) or sourceAddress endswith /0 ``` 1. Click `Run query`. 1. Ensure that no results are returned. **Audit from Azure CLI** List network security groups with non-default security rules: ``` az network nsg list --query [*].[name,securityRules] ``` Ensure that no network security group has an inbound security rule that matches the following: ``` access : Allow destinationPortRange : 3389, *, or <range-including-3389> direction : Inbound protocol : TCP or * sourceAddressPrefix : 0.0.0.0/0, Internet, or * ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [22730e10-96f6-4aac-ad84-9383d35b5917](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F22730e10-96f6-4aac-ad84-9383d35b5917) **- Name:** 'Management ports should be closed on your virtual machines'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries:Express Route: https://docs.microsoft.com/en-us/azure/expressroute/:Site-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal:Point-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal",
+ "DefaultValue": "By default, RDP access from internet is not `enabled`."
+ }
+ ]
+ },
+ {
+ "Id": "7.2",
+ "Description": "Ensure that SSH Access from the Internet is Evaluated and Restricted",
+ "Checks": [
+ "network_ssh_internet_access_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that SSH Access from the Internet is Evaluated and Restricted",
+ "RationaleStatement": "The potential security problem with using SSH over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on the Azure Virtual Network or even attack networked devices outside of Azure.",
+ "ImpactStatement": "Restricting SSH access may require alternative methods for remote administration such as VPN or Azure Bastion.",
+ "RemediationProcedure": "Where SSH is not explicitly required and narrowly configured for resources attached to the Network Security Group, Internet-level access to your Azure resources should be restricted or eliminated. For internal access to relevant resources, configure an encrypted network tunnel such as: [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/) [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal) [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Open the `Networking` blade for the specific Virtual machine in Azure portal 2. Verify that the `INBOUND PORT RULES` **does not** have a rule for SSH such as - port = `22`, - protocol = `TCP` OR `ANY`, - Source = `Any` OR `Internet` **Audit from Azure CLI** List Network security groups with corresponding non-default Security rules: ``` az network nsg list --query [*].[name,securityRules] ``` Ensure that none of the NSGs have security rule as below ``` access : Allow destinationPortRange : 22 or * or [port range containing 22] direction : Inbound protocol : TCP or * sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [22730e10-96f6-4aac-ad84-9383d35b5917](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F22730e10-96f6-4aac-ad84-9383d35b5917) **- Name:** 'Management ports should be closed on your virtual machines'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries:Express Route: https://docs.microsoft.com/en-us/azure/expressroute/:Site-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal:Point-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal",
+ "DefaultValue": "By default, SSH access from internet is not `enabled`."
+ }
+ ]
+ },
+ {
+ "Id": "7.3",
+ "Description": "Ensure that UDP Port Access from the Internet is Evaluated and Restricted",
+ "Checks": [
+ "network_udp_internet_access_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that UDP Port Access from the Internet is Evaluated and Restricted",
+ "RationaleStatement": "The potential security problem with broadly exposing UDP services over the Internet is that attackers can use DDoS amplification techniques to reflect spoofed UDP traffic from Azure Virtual Machines. The most common types of these attacks use exposed DNS, NTP, SSDP, SNMP, CLDAP and other UDP-based services as amplification sources for disrupting services of other machines on the Azure Virtual Network or even attack networked devices outside of Azure.",
+ "ImpactStatement": "Restricting UDP access may impact services that legitimately require UDP traffic.",
+ "RemediationProcedure": "Where UDP is not explicitly required and narrowly configured for resources attached to the Network Security Group, Internet-level access to your Azure resources should be restricted or eliminated. For internal access to relevant resources, configure an encrypted network tunnel such as: [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/) [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal) [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Open the `Networking` blade for the specific Virtual machine in Azure portal 2. Verify that the `INBOUND PORT RULES` **does not** have a rule for UDP such as - protocol = `UDP`, - Source = `Any` OR `Internet` **Audit from Azure CLI** List Network security groups with corresponding non-default Security rules: ``` az network nsg list --query [*].[name,securityRules] ``` Ensure that none of the NSGs have security rule as below ``` access : Allow destinationPortRange : * or [port range containing 53, 123, 161, 389, 1900, or other vulnerable UDP-based services] direction : Inbound protocol : UDP sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any ```",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices#secure-your-critical-azure-service-resources-to-only-your-virtual-networks:https://docs.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries:ExpressRoute: https://docs.microsoft.com/en-us/azure/expressroute/:Site-to-site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal:Point-to-site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal",
+ "DefaultValue": "By default, UDP access from internet is not `enabled`."
+ }
+ ]
+ },
+ {
+ "Id": "7.4",
+ "Description": "Ensure that HTTP(S) Access from the Internet is Evaluated and Restricted",
+ "Checks": [
+ "network_http_internet_access_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that HTTP(S) Access from the Internet is Evaluated and Restricted",
+ "RationaleStatement": "The potential security problem with using HTTP(S) over the Internet is that attackers can use various brute force techniques to gain access to Azure resources. Once the attackers gain access, they can use the resource as a launch point for compromising other resources within the Azure tenant.",
+ "ImpactStatement": "Restricting HTTP(S) access may require proper configuration of web application firewalls and load balancers.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Virtual machines`. 2. For each VM, open the `Networking` blade. 3. Click on `Inbound port rules`. 4. Delete the rule with: * Port = 80/443 OR \\[port range containing 80/443\\] * Protocol = TCP OR Any * Source = Any (\\*) OR IP Addresses(0.0.0.0/0) OR Service Tag(Internet) * Action = Allow **Remediate from Azure CLI** 1. Run below command to list network security groups: ``` az network nsg list --subscription <subscription-id> --output table ``` 2. For each network security group, run below command to list the rules associated with the specified port: ``` az network nsg rule list --resource-group <resource-group> --nsg-name <nsg-name> --query [?destinationPortRange=='80 or 443'] ``` 3. Run the below command to delete the rule with: * Port = 80/443 OR \\[port range containing 80/443\\] * Protocol = TCP OR * * Source = Any (\\*) OR IP Addresses(0.0.0.0/0) OR Service Tag(Internet) * Action = Allow ``` az network nsg rule delete --resource-group <resource-group> --nsg-name <nsg-name> --name <rule-name> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. For each VM, open the Networking blade 2. Verify that the INBOUND PORT RULES does not have a rule for HTTP(S) such as - port = `80`/ `443`, - protocol = `TCP`, - Source = `Any` OR `Internet` **Audit from Azure CLI** List Network security groups with corresponding non-default Security rules: ``` az network nsg list --query [*].[name,securityRules] ``` Ensure that none of the NSGs have security rule as below ``` access : Allow destinationPortRange : 80/443 or * or [port range containing 80/443] direction : Inbound protocol : TCP sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any ```",
+ "AdditionalInformation": "",
+ "References": "Express Route: https://docs.microsoft.com/en-us/azure/expressroute/:Site-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal:Point-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "7.5",
+ "Description": "Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90",
+ "Checks": [
+ "network_flow_log_more_than_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90",
+ "RationaleStatement": "Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.",
+ "ImpactStatement": "* Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down menu, select `Flow log type`. 1. From the `Value` drop-down menu, check `Virtual network` only. 1. Click `Apply`. 1. Click the name of a virtual network flow log. 1. Under `Storage Account`, set `Retention days` to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log requiring remediation. **Remediate from Azure CLI** Run the following command update the retention policy for a flow log in a network watcher, setting `retention` to `0`, `90`, or a number greater than 90: ``` az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days> ``` Repeat for each virtual network flow log requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down menu, select `Flow log type`. 1. From the `Value` drop-down menu, check `Virtual network` only. 1. Click `Apply`. 1. Click the name of a virtual network flow log. 1. Under `Storage Account`, ensure that `Retention days` is set to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log. **Audit from Azure CLI** Run the following command to list network watchers: ``` az network watcher list ``` Run the following command to list the name and retention policy of flow logs in a network watcher: ``` az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy] ``` For each flow log, ensure that `days` is set to `0`, `90`, or a number greater than 90. If `days` is set to `0`, the logs are retained indefinitely with no retention policy. Repeat for each network watcher.",
+ "AdditionalInformation": "As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.",
+ "References": "https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-portal:https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log",
+ "DefaultValue": "When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator."
+ }
+ ]
+ },
+ {
+ "Id": "7.6",
+ "Description": "Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use",
+ "Checks": [
+ "network_watcher_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use",
+ "RationaleStatement": "Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.",
+ "ImpactStatement": "There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.",
+ "RemediationProcedure": "Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support. To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below. **Remediate from Azure Portal** 1. Use the Search bar to search for and click on the `Network Watcher` service. 1. Click `Create`. 1. Select a `Region` from the drop-down menu. 1. Click `Add`. **Remediate from Azure CLI** ``` az network watcher configure --locations <region> --enabled true --resource-group <resource_group> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Use the Search bar to search for and click on the `Network Watcher` service. 1. From the Overview menu item, review each Network Watcher listed, and ensure that a network watcher is listed for each region in use by the subscription. **Audit from Azure CLI** ``` az network watcher list --query [].{Location:location,State:provisioningState} -o table ``` This will list all network watchers and their provisioning state. Ensure `provisioningState` is `Succeeded` for each network watcher. ``` az account list-locations --query [?metadata.regionType=='Physical'].{Name:name,DisplayName:regionalDisplayName} -o table ``` This will list all physical regions that exist in the subscription. Compare this list to the previous one to ensure that for each region in use, a network watcher exists with `provisioningState` set to `Succeeded`. **Audit from PowerShell** Get a list of Network Watchers ``` Get-AzNetworkWatcher ``` Make sure each watcher is set with the `ProvisioningState` setting set to `Succeeded` and all `Locations` that are in use by the subscription are using a watcher. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b6e2945c-0b7b-40f5-9233-7a5323b5cdc6](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb6e2945c-0b7b-40f5-9233-7a5323b5cdc6) **- Name:** 'Network Watcher should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview:https://learn.microsoft.com/en-us/cli/azure/network/watcher?view=azure-cli-latest:https://learn.microsoft.com/en-us/cli/azure/network/watcher?view=azure-cli-latest#az-network-watcher-configure:https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-create:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-4-enable-network-logging-for-security-investigation:https://azure.microsoft.com/en-ca/pricing/details/network-watcher/",
+ "DefaultValue": "Network Watcher is automatically enabled. When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for automatically enabling Network Watcher."
+ }
+ ]
+ },
+ {
+ "Id": "7.7",
+ "Description": "Ensure that Public IP Addresses are Evaluated on a Periodic Basis",
+ "Checks": [
+ "network_public_ip_shodan"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Public IP Addresses are Evaluated on a Periodic Basis",
+ "RationaleStatement": "Public IP Addresses allocated to the tenant should be periodically reviewed for necessity. Public IP Addresses that are not intentionally assigned and controlled present a publicly facing vector for threat actors and significant risk to the tenant.",
+ "ImpactStatement": "Regular reviews require administrative effort.",
+ "RemediationProcedure": "Remediation will vary significantly depending on your organization's security requirements for the resources attached to each individual Public IP address.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Open the `All Resources` blade 2. Click on `Add Filter` 3. In the Add Filter window, select the following: Filter: `Type` Operator: `Equals` Value: `Public IP address` 4. Click the `Apply` button 5. For each Public IP address in the list, use Overview (or Properties) to review the `Associated to:` field and determine if the associated resource is still relevant to your tenant environment. If the associated resource is relevant, ensure that additional controls exist to mitigate risk (e.g. Firewalls, VPNs, Traffic Filtering, Virtual Gateway Appliances, Web Application Firewalls, etc.) on all subsequently attached resources. **Audit from Azure CLI** List all Public IP addresses: ``` az network public-ip list ``` For each Public IP address in the output, review the `name` property and determine if the associated resource is still relevant to your tenant environment. If the associated resource is relevant, ensure that additional controls exist to mitigate risk (e.g. Firewalls, VPNs, Traffic Filtering, Virtual Gateway Appliances, Web Application Firewalls, etc.) on all subsequently attached resources.",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/cli/azure/network/public-ip?view=azure-cli-latest:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security",
+ "DefaultValue": "During Virtual Machine and Application creation, a setting may create and attach a public IP."
+ }
+ ]
+ },
+ {
+ "Id": "7.8",
+ "Description": "Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90",
+ "Checks": [
+ "network_flow_log_more_than_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90",
+ "RationaleStatement": "Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.",
+ "ImpactStatement": "* Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down menu, select `Flow log type`. 1. From the `Value` drop-down menu, check `Virtual network` only. 1. Click `Apply`. 1. Click the name of a virtual network flow log. 1. Under `Storage Account`, set `Retention days` to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log requiring remediation. **Remediate from Azure CLI** Run the following command update the retention policy for a flow log in a network watcher, setting `retention` to `0`, `90`, or a number greater than 90: ``` az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days> ``` Repeat for each virtual network flow log requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Network Watcher`. 1. Under `Logs`, select `Flow logs`. 1. Click `Add filter`. 1. From the `Filter` drop-down menu, select `Flow log type`. 1. From the `Value` drop-down menu, check `Virtual network` only. 1. Click `Apply`. 1. Click the name of a virtual network flow log. 1. Under `Storage Account`, ensure that `Retention days` is set to `0`, `90`, or a number greater than 90. If `Retention days` is set to `0`, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log. **Audit from Azure CLI** Run the following command to list network watchers: ``` az network watcher list ``` Run the following command to list the name and retention policy of flow logs in a network watcher: ``` az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy] ``` For each flow log, ensure that `days` is set to `0`, `90`, or a number greater than 90. If `days` is set to `0`, the logs are retained indefinitely with no retention policy. Repeat for each network watcher.",
+ "AdditionalInformation": "As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.",
+ "References": "https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-portal:https://learn.microsoft.com/en-us/cli/azure/network/watcher/flow-log",
+ "DefaultValue": "When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator."
+ }
+ ]
+ },
+ {
+ "Id": "7.9",
+ "Description": "Ensure 'Authentication type' is Set to 'Azure Active Directory' only for Azure VPN Gateway Point-to-Site Configuration",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Authentication type' is Set to 'Azure Active Directory' only for Azure VPN Gateway Point-to-Site Configuration",
+ "RationaleStatement": "Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.",
+ "ImpactStatement": "Azure VPN Gateways incur hourly charges, with additional costs for point-to-site connections and data transfer. Pricing varies by SKU and usage. Refer to https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ for details.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Virtual network gateways`. 2. Under `VPN gateway`, click `VPN gateways`. 3. Click the name of a VPN gateway. 4. Under `Settings`, click `Point-to-site configuration`. 5. Ensure `Authentication type` click to expand the drop-down menu. 6. Check the box next to `Azure Active Directory`, and uncheck the boxes next to `Azure certificate` and `RADIUS authentication`. 7. Provide a `Tenant`, `Audience`, and `Issuer` for the Azure Active Directory configuration. 8. Click `Save`. 9. Repeat steps 1-8 for each VPN gateway requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Virtual network gateways`. 2. Under `VPN gateway`, click `VPN gateways`. 3. Click the name of a VPN gateway. 4. Under `Settings`, click `Point-to-site configuration`. 5. Ensure `Authentication type` is set to `Azure Active Directory` only. 6. Repeat steps 1-5 for each VPN gateway. **Audit from Azure Policy** - **Policy ID:** 21a6bc25-125e-4d13-b82d-2e19b7208ab7 - **Name:** 'VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways:https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway:https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant",
+ "DefaultValue": "'Authentication type' is selected during creation of point-to-site configuration."
+ }
+ ]
+ },
+ {
+ "Id": "7.10",
+ "Description": "Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway",
+ "RationaleStatement": "Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.",
+ "ImpactStatement": "The WAF V2 tier for Azure Application Gateways costs more than the Basic and Standard V2 tiers. Pricing includes a fixed hourly charge plus a charge per capacity-unit hour. Refer to https://azure.microsoft.com/en-gb/pricing/details/application-gateway/ for details.",
+ "RemediationProcedure": "**Note:** Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway. **Remediate from Azure Portal** To remediate a Standard V2 tier application gateway: 1. Go to `Application gateways`. 2. Click `Add filter`. 3. From the `Filter` drop-down menu, select `SKU size`. 4. Check the box next to `Standard_v2` only. 5. Click `Apply`. 6. Click the name of an application gateway. 7. Under `Settings`, click `Web application firewall`. 8. Under `Configure`, next to `Tier`, click `WAF V2`. 9. Select an existing or create a new WAF policy. 10. Click `Save`. 11. Repeat steps 1-10 for each Standard V2 tier application gateway requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. In the `Overview`, under `Essentials`, ensure `Tier` is set to `WAF V2`. 4. Repeat steps 1-3 for each application gateway. **Audit from Azure CLI** Run the following command to list application gateways: ``` az network application-gateway list ``` For each application gateway, run the following command to get the firewall policy id: ``` az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id ``` Ensure a firewall policy id is returned. **Audit from Azure Policy** - **Policy ID:** 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - **Name:** 'Web Application Firewall (WAF) should be enabled for Application Gateway'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/application-gateway/features:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway:https://azure.microsoft.com/en-us/pricing/details/application-gateway",
+ "DefaultValue": "Azure Web Application Firewall is enabled by default for the WAF V2 tier of Azure Application Gateway. It is not available in the Basic tier. Application gateways deployed using the Standard V2 tier can be upgraded to the WAF V2 tier to enable Azure Web Application Firewall."
+ }
+ ]
+ },
+ {
+ "Id": "7.11",
+ "Description": "Ensure Subnets Are Associated with Network Security Groups",
+ "Checks": [
+ "network_subnet_nsg_associated"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Subnets Are Associated with Network Security Groups",
+ "RationaleStatement": "Unprotected subnets can expose resources to unauthorized access.",
+ "ImpactStatement": "Minor administrative effort is required to ensure subnets are associated with network security groups. There is no cost to create or use network security groups.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Virtual networks`. 2. Click the name of a virtual network. 3. Under `Settings`, click `Subnets`. 4. Click the name of a subnet. 5. Under `Security`, next to `Network security group`, click `None` to display the drop-down menu. 6. Select a network security group. 7. Click `Save`. 8. Repeat steps 1-7 for each virtual network and subnet requiring remediation. **Remediate from Azure CLI** For each subnet requiring remediation, run the following command to associate it with a network security group: ``` az network vnet subnet update --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --network-security-group <network-security-group> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Virtual networks`. 2. Click the name of a virtual network. 3. Under `Settings`, click `Subnets`. 4. Click the name of a subnet. 5. Under `Security`, ensure `Network security group` is not set to `None`. 6. Repeat steps 1-5 for each virtual network and subnet. **Audit from Azure CLI** Run the following command to list virtual networks: ``` az network vnet list ``` For each virtual network, run the following command to list subnets: ``` az network vnet show --resource-group <resource-group> --name <virtual-network> --query subnets ``` For each subnet, run the following command to get the network security group id: ``` az network vnet subnet show --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --query networkSecurityGroup.id ``` Ensure a network security group id is returned. **Audit from Azure Policy** - **Policy ID:** e71308d3-144b-4262-b144-efdc3cc90517 - **Name:** 'Subnets should be associated with a Network Security Group'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview:https://learn.microsoft.com/en-us/cli/azure/network/vnet",
+ "DefaultValue": "By default, a subnet is not associated with a network security group."
+ }
+ ]
+ },
+ {
+ "Id": "7.12",
+ "Description": "Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway",
+ "RationaleStatement": "TLS 1.0 and 1.1 are outdated and vulnerable to security risks. Since TLS 1.2 and TLS 1.3 provide enhanced security and improved performance, it is highly recommended to use TLS 1.2 or higher whenever possible.",
+ "ImpactStatement": "Using the latest TLS version may affect compatibility with clients and backend services.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Listeners`. 4. Under `SSL Policy`, next to the Selected SSL Policy name, click `change`. 5. Select an appropriate SSL policy with a `Min protocol version` of `TLSv1_2` or higher. 6. Click `Save`. 7. Repeat steps 1-6 for each application gateway requiring remediation. **Remediate from Azure CLI** Run the following command to list available SSL policy options: ``` az network application-gateway ssl-policy list-options ``` Run the following command to list available predefined SSL policies: ``` az network application-gateway ssl-policy predefined list ``` For each application gateway requiring remediation, run the following command to set a predefined SSL policy: ``` az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --name <ssl-policy> --policy-type Predefined ``` Alternatively, run the following command to set a custom SSL policy: ``` az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --policy-type Custom --min-protocol-version <min-protocol-version> --cipher-suites <cipher-suites> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Listeners`. 4. Under `SSL Policy`, ensure `Min protocol version` is set to `TLSv1_2` or higher. 5. Repeat steps 1-4 for each application gateway. **Audit from Azure CLI** Run the following command to list application gateways: ``` az network application-gateway list ``` For each application gateway, run the following command to get the SSL policy: ``` az network application-gateway ssl-policy show --resource-group <resource-group> --gateway-name <application-gateway> ``` For each SSL policy, run the following command to get the minProtocolVersion: ``` az network application-gateway ssl-policy predefined show --name <ssl-policy> --query minProtocolVersion ``` Ensure `TLSv1_2` or higher is returned.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-ssl-policy-overview:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway",
+ "DefaultValue": "Min protocol version is set to TLSv1_2 by default."
+ }
+ ]
+ },
+ {
+ "Id": "7.13",
+ "Description": "Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway",
+ "RationaleStatement": "Enabling HTTP/2 supports use of modern encrypted connections.",
+ "ImpactStatement": "Clients and backend services that do not support HTTP/2 will fall back to HTTP/1.1.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Configuration`. 4. Under `HTTP2`, click `Enabled`. 5. Click `Save`. 6. Repeat steps 1-5 for each application gateway requiring remediation. **Remediate from Azure CLI** For each application gateway requiring remediation, run the following command to enable HTTP2: ``` az network application-gateway update --resource-group <resource-group> --name <application-gateway> --http2 Enabled ``` **Remediate from PowerShell** Run the following command to get the application gateway in a resource group with a given name: ``` $gateway = Get-AzApplicationGateway -ResourceGroupName <resource-group> -Name <application-gateway> ``` Run the following command to enable HTTP2: ``` $gateway.EnableHttp2 = $true ``` Run the following command to apply the update: ``` Set-AzApplicationGateway -ApplicationGateway $gateway ``` Repeat for each application gateway requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Configuration`. 4. Ensure `HTTP2` is set to `Enabled`. 5. Repeat steps 1-4 for each application gateway. **Audit from Azure CLI** Run the following command to list application gateways: ``` az network application-gateway list ``` For each application gateway, run the following command to get the HTTP2 setting: ``` az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query enableHttp2 ``` Ensure `true` is returned. **Audit from PowerShell** Run the following command to list application gateways: ``` Get-AzApplicationGateway ``` Run the following command to get the application gateway in a resource group with a given name: ``` $gateway = Get-AzApplicationGateway -ResourceGroupName <resource-group> -Name <application-gateway> ``` Run the following command to get the HTTP2 setting: ``` $gateway.EnableHttp2 ``` Ensure that `True` is returned. Repeat for each application gateway.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/application-gateway/features#websocket-and-http2-traffic:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway:https://learn.microsoft.com/en-us/powershell/module/az.network/get-azapplicationgateway:https://learn.microsoft.com/en-us/powershell/module/az.network/set-azapplicationgateway",
+ "DefaultValue": "HTTP2 is enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "7.14",
+ "Description": "Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway",
+ "RationaleStatement": "Enabling request body inspection strengthens security by allowing the Web Application Firewall to detect common attacks, such as SQL injection and cross-site scripting.",
+ "ImpactStatement": "Minor performance impact on the Web Application Firewall. Additional effort may be required to monitor findings.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Web application firewall`. 4. Under `Associated web application firewall policy`, click the policy name. 5. Under `Settings`, click `Policy settings`. 6. Check the box next to `Enforce request body inspection`. 7. Click `Save`. 8. Repeat steps 1-7 for each application gateway and firewall policy requiring remediation. **Remediate from Azure CLI** For each firewall policy requiring remediation, run the following command to enable request body inspection: ``` az network application-gateway waf-policy update --ids <firewall-policy> --policy-settings request-body-check=true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Web application firewall`. 4. Under `Associated web application firewall policy`, click the policy name. 5. Under `Settings`, click `Policy settings`. 6. Ensure the box next to `Enforce request body inspection` is checked. 7. Repeat steps 1-6 for each application gateway. **Audit from Azure CLI** Run the following command to list application gateways: ``` az network application-gateway list ``` For each application gateway, run the following command to get the firewall policy id: ``` az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id ``` For each firewall policy, run the following command to get the request body inspection setting: ``` az network application-gateway waf-policy show --ids <firewall-policy> --query policySettings.requestBodyCheck ``` Ensure `true` is returned. **Audit from Azure Policy** - **Policy ID:** ca85ef9a-741d-461d-8b7a-18c2da82c666 - **Name:** 'Azure Web Application Firewall on Azure Application Gateway should have request body inspection enabled'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-gb/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway/waf-policy",
+ "DefaultValue": "Request body inspection is enabled by default on Azure Application Gateways with Web Application Firewall."
+ }
+ ]
+ },
+ {
+ "Id": "7.15",
+ "Description": "Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway",
+ "RationaleStatement": "Internet traffic from bots can scrape, scan, and search for application vulnerabilities. Enabling bot protection stops requests from known malicious IP addresses and enhances the overall security of your application by reducing exposure to automated attacks.",
+ "ImpactStatement": "May require monitoring to identify false positives.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Web application firewall`. 4. Under `Associated web application firewall policy`, click the policy name. 5. Under `Settings`, click `Managed rules`. 6. Click `Assign`. 7. Under `Bot Management ruleset`, click to display the drop-down menu. 8. Select a `Microsoft_BotManagerRuleSet`. 9. Click `Save`. 10. Click `X` to close the panel. 11. Repeat steps 1-10 for each application gateway and firewall policy requiring remediation. **Remediate from Azure CLI** For each firewall policy requiring remediation, run the following command to enable bot protection: ``` az network application-gateway waf-policy managed-rule rule-set add --resource-group <resource-group> --policy-name <firewall-policy> --type Microsoft_BotManagerRuleSet --version <0.1|1.0|1.1> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Application gateways`. 2. Click the name of an application gateway. 3. Under `Settings`, click `Web application firewall`. 4. Under `Associated web application firewall policy`, click the policy name. 5. Under `Settings`, click `Managed rules`. 6. Ensure a `Rule Id` containing `Microsoft_BotManagerRuleSet` is listed. 7. Click the `>` to expand the row. 8. Ensure the `Status` for `Malicious Bots` is set to `Enabled`. 9. Repeat steps 1-8 for each application gateway. **Audit from Azure CLI** Run the following command to list application gateways: ``` az network application-gateway list ``` For each application gateway, run the following command to get the firewall policy id: ``` az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id ``` For each firewall policy, run the following command to get the managed rule sets: ``` az network application-gateway waf-policy show --ids <firewall-policy> --query managedRules.managedRuleSets ``` Ensure a managed rule set with `ruleSetType` of `Microsoft_BotManagerRuleSet` is returned, and that no `ruleGroupOverrides` for `ruleGroupName` `KnownBadBots` with `state` `Disabled` are returned. **Audit from Azure Policy** - **Policy ID:** ebea0d86-7fbd-42e3-8a46-27e7568c2525 - **Name:** 'Bot Protection should be enabled for Azure Application Gateway WAF'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/bot-protection-overview:https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/bot-protection:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway/waf-policy:https://learn.microsoft.com/en-us/cli/azure/network/application-gateway/waf-policy/managed-rule/rule-set",
+ "DefaultValue": "Bot protection is disabled by default on Azure Application Gateways with Web Application Firewall."
+ }
+ ]
+ },
+ {
+ "Id": "7.16",
+ "Description": "Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 Networking Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources",
+ "RationaleStatement": "Network security perimeter denies public access to PaaS resources, reducing exposure and mitigating data exfiltration risks.",
+ "ImpactStatement": "Implementation requires administrative effort to configure and maintain network security perimeter profiles and resource assignments. Azure does not list any additional charges for using network security perimeters.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Create and associate PaaS resources with a new network security perimeter: 1. Go to `Network Security Perimeters`. 2. Click `+ Create`. 3. Select a `Subscription` and `Resource group`, provide a `Name`, select a `Region`, and provide a `Profile name`. 4. Click `Next`. 5. Click `+ Add`. 6. Check the box next to a PaaS resource to associate it with the network security perimeter. 7. Click `Select`. 8. Click `Next`. 9. Configure appropriate `Inbound access rules` for your organization. 10. Click `Next`. 11. Configure appropriate `Outbound access rules` for your organization. 12. Click `Review + create`. 13. Click `Create`. **Remediate from Azure CLI** Use `az network perimeter profile list` or `az network perimeter profile create` to list existing or create a new network security perimeter profile. For each PaaS resource requiring association with a network security perimeter, run the following command: ``` az network perimeter association create --resource-group <resource-group> --perimeter-name <network-security-perimeter> --association-name <association> --private-link-resource \"{id:<paas-resource-id>}\" --profile \"{<profile-id>}\" ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Resource groups`. 2. Click the name of a resource group. 3. Take note of PaaS resources. 4. Go to `Network Security Perimeters`. 5. Click the name of a network security perimeter. 6. Under `Settings`, click `Associated resources`. 7. Take note of the associated resources. 8. Repeat steps 1-7 and ensure each PaaS resource is associated with a network security perimeter. **Audit from Azure CLI** Run the following command to list resource groups: ``` az group list ``` For each resource group, run the following command to list resources: ``` az resource list --resource-group <resource-group> ``` Take note of PaaS resources. For each resource group, run the following command to list network security perimeters: ``` az network perimeter list --resource-group <resource-group> ``` For each network security perimeter, run the following command to list resources: ``` az network perimeter association list --resource-group <resource-group> --perimeter-name <network-security-perimeter> ``` Ensure each PaaS resource is associated with a network security perimeter.",
+ "AdditionalInformation": "The current list of resources that can be associated with a network security perimeter are as follows: Azure Monitor, Azure AI Search, Cosmos DB, Event Hubs, Key Vault, SQL DB, Storage, Azure OpenAI Service. While network security perimeter is generally available, Cosmos DB, SQL DB, and Azure OpenAI Service are in public preview.",
+ "References": "https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts:https://learn.microsoft.com/en-us/azure/private-link/create-network-security-perimeter-portal:https://learn.microsoft.com/en-us/cli/azure/group:https://learn.microsoft.com/en-us/cli/azure/resource:https://learn.microsoft.com/en-us/cli/azure/network/perimeter",
+ "DefaultValue": "PaaS resources are not associated with a network security perimeter by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.1.1",
+ "Description": "Ensure Microsoft Defender CSPM is Set to 'On'",
+ "Checks": [
+ "defender_ensure_defender_cspm_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Microsoft Defender CSPM is Set to 'On'",
+ "RationaleStatement": "Microsoft Defender CSPM provides detailed visibility into the security state of assets and workloads and offers hardening guidance to help improve security posture.",
+ "ImpactStatement": "Enabling Microsoft Defender CSPM incurs hourly charges for each billable compute, database, and storage resource. This can lead to significant costs in larger environments. Careful planning and cost analysis are recommended before enabling the service. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/#pricing for pricing information.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, click `Environment settings`. 3. Click the name of a subscription. 4. Select the `Defender plans` blade. 5. Under `Cloud Security Posture Management (CSPM)`, in the row for `Defender CSPM`, set the toggle switch for `Status` to `On`. 6. Click `Save`. **Remediate from Azure CLI** Run the following command to enable Defender CSPM: ``` az security pricing create --name CloudPosture --tier Standard --extensions name=ApiPosture isEnabled=true ``` **Remediate from PowerShell** Run the following command to enable Defender CSPM: ``` Set-AzSecurityPricing -Name CloudPosture -PricingTier Standard -Extension '[{\"name\":\"ApiPosture\",\"isEnabled\":\"True\"}]' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, click `Environment settings`. 3. Click the name of a subscription. 4. Select the `Defender plans` blade. 5. Under `Cloud Security Posture Management (CSPM)`, in the row for `Defender CSPM`, ensure `Status` is set to `On`. **Audit from Azure CLI** Run the following command to get the CloudPosture plan pricing tier: ``` az security pricing show --name CloudPosture --query pricingTier ``` Ensure `Standard` is returned. **Audit from PowerShell** Run the following command to get the CloudPosture plan pricing tier: ``` Get-AzSecurityPricing -Name CloudPosture | Select-Object PricingTier ``` Ensure `Standard` is returned. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [1f90fc71-a595-4066-8974-d4d0802e8ef0](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F1f90fc71-a595-4066-8974-d4d0802e8ef0) **- Name:** 'Microsoft Defender CSPM should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management:https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-cspm-plan:https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/#pricing:https://learn.microsoft.com/en-us/cli/azure/security/pricing:https://learn.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritypricing",
+ "DefaultValue": "Defender CSPM is disabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.2.1",
+ "Description": "Ensure Microsoft Defender for APIs is Set to 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_app_services_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Microsoft Defender for APIs is Set to 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Turning on Microsoft Defender for App Service incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud` 2. Under `Management`, select `Environment Settings` 3. Click on the subscription name 4. Select `Defender plans` 5. Set `App Service` Status to `On` 6. Select `Save` **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n Appservices --tier 'standard' ``` **Remediate from PowerShell** Run the following command: ``` Set-AzSecurityPricing -Name AppServices -PricingTier Standard ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud` 2. Under `Management`, select `Environment Settings` 3. Click on the subscription name 4. Select `Defender plans` 5. Ensure Status is `On` for `App Service` **Audit from Azure CLI** Run the following command: ``` az security pricing show -n AppServices ``` Ensure `-PricingTier` is set to `Standard` **Audit from PowerShell** Run the following command: ``` Get-AzSecurityPricing -Name 'AppServices' |Select-Object Name,PricingTier ``` Ensure the `-PricingTier` is set to `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [2913021d-f2fd-4f3d-b958-22354e2bdbcb](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F2913021d-f2fd-4f3d-b958-22354e2bdbcb) **- Name:** 'Azure Defender for App Service should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.3.1",
+ "Description": "Ensure that Defender for Servers is Set to 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_server_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Defender for Servers is Set to 'On'",
+ "RationaleStatement": "Enabling Defender for Servers allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Enabling Defender for Servers in Microsoft Defender for Cloud incurs an additional cost per resource. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs. - Plan 1: Subscription only - Plan 2: Subscription and workspace",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on a subscription name. 1. Click `Defender plans` in the left pane. 1. Under `Cloud Workload Protection (CWP)`, locate `Servers` in the Plan column, set Status to `On`. 1. Select `Save`. 1. Repeat steps 1-6 for each subscription requiring remediation. **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n VirtualMachines --tier 'standard' ``` **Remediate from PowerShell** Run the following command: ``` Set-AzSecurityPricing -Name 'VirtualMachines' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on a subscription name. 1. Select `Defender plans` in the left pane. 1. Under `Cloud Workload Protection (CWP)`, locate `Servers` in the Plan column, ensure Status is set to `On`. 1. Repeat steps 1-5 for each subscription. **Audit from Azure CLI** Run the following command: ``` az security pricing show -n VirtualMachines --query pricingTier ``` If the tenant is licensed and enabled, the output will indicate `Standard`. **Audit from PowerShell** Run the following command: ``` Get-AzSecurityPricing -Name 'VirtualMachines' |Select-Object Name,PricingTier ``` If the tenant is licensed and enabled, the `-PricingTier` parameter will indicate `Standard`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [4da35fc9-c9e7-4960-aec9-797fe7d9051d](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4da35fc9-c9e7-4960-aec9-797fe7d9051d) **- Name:** 'Azure Defender for servers should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview:https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers:https://learn.microsoft.com/en-us/rest/api/defenderforcloud/pricings/list:https://learn.microsoft.com/en-us/rest/api/defenderforcloud/pricings/update:https://learn.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-endpoint-security#es-1-use-endpoint-detection-and-response-edr",
+ "DefaultValue": "By default, the Defender for Servers plan is disabled."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.3.2",
+ "Description": "Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On'",
+ "Checks": [
+ "defender_auto_provisioning_vulnerabilty_assessments_machines_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On'",
+ "RationaleStatement": "Vulnerability assessment for machines scans for various security-related configurations and events such as system updates, OS vulnerabilities, and endpoint protection, then produces alerts on threat and vulnerability findings.",
+ "ImpactStatement": "Microsoft Defender for Servers plan 2 licensing is required, and configuration of Azure Arc introduces complexity beyond this recommendation.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Defender for Cloud` 1. Under `Management`, select `Environment Settings` 1. Select a subscription 1. Click on `Settings & Monitoring` 1. Set the `Status` of `Vulnerability assessment for machines` to `On` 1. Click `Continue` Repeat the above for any additional subscriptions.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Defender for Cloud` 1. Under `Management`, select `Environment Settings` 1. Select a subscription 1. Click on `Settings & monitoring` 1. Ensure that `Vulnerability assessment for machines` is set to `On` Repeat the above for any additional subscriptions.",
+ "AdditionalInformation": "While this feature is generally available as of publication, it is not yet available for Azure Government tenants.",
+ "References": "https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-va:https://msdn.microsoft.com/en-us/library/mt704062.aspx:https://msdn.microsoft.com/en-us/library/mt704063.aspx:https://docs.microsoft.com/en-us/rest/api/securitycenter/autoprovisioningsettings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/autoprovisioningsettings/create:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-posture-vulnerability-management#pv-5-perform-vulnerability-assessments",
+ "DefaultValue": "By default, `Automatic provisioning of monitoring agent` is set to `Off`."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.3.3",
+ "Description": "Ensure that 'Endpoint protection' Component Status is set to 'On'",
+ "Checks": [
+ "defender_assessments_vm_endpoint_protection_installed"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Endpoint protection' Component Status is set to 'On'",
+ "RationaleStatement": "Microsoft Defender for Endpoint integration brings comprehensive Endpoint Detection and Response (EDR) capabilities within Microsoft Defender for Cloud. This integration helps to spot abnormalities, as well as detect and respond to advanced attacks on endpoints monitored by Microsoft Defender for Cloud. MDE works only with Standard Tier subscriptions.",
+ "ImpactStatement": "Endpoint protection requires licensing and is included in these plans: - Defender for Servers plan 1 - Defender for Servers plan 2",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment Settings`. 1. Click on the subscription name. 1. Click `Settings & monitoring`. 1. Set the `Status` for `Endpoint protection` to `On`. 1. Click `Continue`. **Remediate from Azure CLI** Use the below command to enable Standard pricing tier for Storage Accounts ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X PUT -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Security/settings/WDATP?api-version=2021-06-01 -d@input.json' ``` Where input.json contains the Request body json data as mentioned below. ``` { id: /subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/settings/WDATP, kind: DataExportSettings, type: Microsoft.Security/settings, properties: { enabled: true } } ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment Settings`. 1. Click on the subscription name. 1. Click `Settings & monitoring`. 1. Ensure the `Status` for `Endpoint protection` is set to `On`. **Audit from Azure CLI** Ensure the output of the below command is `True` ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Security/settings?api-version=2021-06-01' | jq '.|.value[] | select(.name==WDATP)'|jq '.properties.enabled' ``` **Audit from PowerShell** Run the following commands to login and audit this check ``` Connect-AzAccount Set-AzContext -Subscription <subscriptionID> Get-AzSecuritySetting | Select-Object name,enabled |where-object {$_.name -eq WDATP} ``` **PowerShell Output - Non-Compliant** ``` Name Enabled ---- ------- WDATP False ``` **PowerShell Output - Compliant** ``` Name Enabled ---- ------- WDATP True ```",
+ "AdditionalInformation": "**IMPORTANT:** When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable. 1. For server 2019 & above if defender is installed (default for these server SKUs) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal. 1. If the new unified agent is required for server SKUs of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned. NOTE: Microsoft Defender for Endpoint (MDE) was formerly known as Windows Defender Advanced Threat Protection (WDATP). There are a number of places (e.g. Azure CLI) where the WDATP acronym is still used within Azure.",
+ "References": "https://docs.microsoft.com/en-in/azure/defender-for-cloud/integration-defender-for-endpoint?tabs=windows:https://docs.microsoft.com/en-us/rest/api/securitycenter/settings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/settings/update:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-endpoint-security#es-1-use-endpoint-detection-and-response-edr:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-endpoint-security#es-2-use-modern-anti-malware-software",
+ "DefaultValue": "By default, Endpoint protection is `off`."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.3.4",
+ "Description": "Ensure that 'Agentless scanning for machines' Component Status is Set to 'On'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'Agentless scanning for machines' Component Status is Set to 'On'",
+ "RationaleStatement": "The Microsoft Defender for Cloud agentless machine scanner provides threat detection, vulnerability detection, and discovery of sensitive information.",
+ "ImpactStatement": "Agentless scanning for machines requires licensing and is included in these plans: - Defender CSPM - Defender for Servers plan 2",
+ "RemediationProcedure": "**Audit from Azure Portal** 1. From the Azure Portal `Home` page, select `Microsoft Defender for Cloud` 1. Under `Management` select `Environment Settings` 1. Select a subscription 1. Under `Settings` > `Defender Plans`, click `Settings & monitoring` 1. Under the Component column, locate the row for `Agentless scanning for machines` 1. Select `On` 1. Click `Continue` in the top left Repeat the above for any additional subscriptions.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From the Azure Portal `Home` page, select `Microsoft Defender for Cloud` 1. Under `Management` select `Environment Settings` 1. Select a subscription 1. Under `Settings` > `Defender Plans`, click `Settings & monitoring` 1. Under the Component column, locate the row for `Agentless scanning for machines` 1. Ensure that `On` is selected Repeat the above for any additional subscriptions.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-agentless-data-collection:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification:https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms",
+ "DefaultValue": "By default, Agentless scanning for machines is `off`."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.3.5",
+ "Description": "Ensure that 'File Integrity Monitoring' Component Status is Set to 'On'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that 'File Integrity Monitoring' Component Status is Set to 'On'",
+ "RationaleStatement": "FIM provides a detection mechanism for compromised files. When FIM is enabled, critical system files are monitored for changes that might indicate a threat actor is attempting to modify system files for lateral compromise within a host operating system.",
+ "ImpactStatement": "File Integrity Monitoring requires licensing and is included in these plans: - Defender for Servers plan 2",
+ "RemediationProcedure": "**Audit from Azure Portal** 1. From the Azure Portal `Home` page, select `Microsoft Defender for Cloud` 1. Under `Management` select `Environment Settings` 1. Select a subscription 1. Under `Settings` > `Defender Plans`, click `Settings & monitoring` 1. Under the Component column, locate the row for `File Integrity Monitoring` 1. Select `On` 1. Click `Continue` in the top left Repeat the above for any additional subscriptions.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From the Azure Portal `Home` page, select `Microsoft Defender for Cloud` 1. Under `Management` select `Environment Settings` 1. Select a subscription 1. Under `Settings` > `Defender Plans`, click `Settings & monitoring` 1. Under the Component column, locate the row for `File Integrity Monitoring` 1. Ensure that `On` is selected Repeat the above for any additional subscriptions.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification:https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-enable-defender-endpoint",
+ "DefaultValue": "By default, File Integrity Monitoring is `Off`."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.4.1",
+ "Description": "Ensure That Microsoft Defender for Containers Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_containers_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Containers Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for Containers enhances defense-in-depth by providing advanced threat detection, vulnerability assessment, and security monitoring for containerized environments, leveraging insights from the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Microsoft Defender for Containers incurs a charge per vCore. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, click `Environment settings`. 1. Click the name of a subscription. 1. Under `Settings`, click `Defender plans`. 1. Under `Cloud Workload Protection (CWP)`, in the row for `Containers`, click `On` in the `Status` column. 1. If `Monitoring coverage` displays `Partial`, click `Settings` under `Partial`. 1. Set the status of each of the components to `On`. 1. Click `Continue`. 1. Click `Save`. 1. Repeat steps 1-9 for each subscription. **Remediate from Azure CLI** **Note:** Microsoft Defender for Container Registries ('ContainerRegistry') is deprecated and has been replaced by Microsoft Defender for Containers ('Containers'). Run the below command to enable the Microsoft Defender for Containers plan and its components: ``` az security pricing create -n 'Containers' --tier 'standard' --extensions name=ContainerRegistriesVulnerabilityAssessments isEnabled=True --extensions name=AgentlessDiscoveryForKubernetes isEnabled=True --extensions name=AgentlessVmScanning isEnabled=True --extensions name=ContainerSensor isEnabled=True ``` **Remediate from PowerShell** **Note:** Microsoft Defender for Container Registries ('ContainerRegistry') is deprecated and has been replaced by Microsoft Defender for Containers ('Containers'). Run the below command to enable the Microsoft Defender for Containers plan and its components: ``` Set-AzSecurityPricing -Name 'Containers' -PricingTier 'Standard' -Extension '[{name:ContainerRegistriesVulnerabilityAssessments,isEnabled:True},{name:AgentlessDiscoveryForKubernetes,isEnabled:True},{name:AgentlessVmScanning,isEnabled:True},{name:ContainerSensor,isEnabled:True}]' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, click `Environment settings`. 1. Click the name of a subscription. 1. Under `Settings`, click `Defender plans`. 1. Under `Cloud Workload Protection (CWP)`, in the row for `Containers`, ensure that the `Status` is set to `On` and `Monitoring coverage` displays `Full`. 1. Repeat steps 1-5 for each subscription. **Audit from Azure CLI** For Microsoft Defender for Container Registries (deprecated), run the following command: ``` az security pricing show --name ContainerRegistry --query pricingTier ``` Ensure that the command returns `Standard`. For Microsoft Defender for Containers, run the following command: ``` az security pricing show --name Containers --query [pricingTier,extensions[*].[name,isEnabled]] ``` Ensure that the command returns `Standard`, and that each of the extensions (ContainerRegistriesVulnerabilityAssessments, AgentlessDiscoveryForKubernetes, AgentlessVmScanning, ContainerSensor) returns `True`. Repeat for each subscription. **Audit from PowerShell** For Microsoft Defender for Container Registries (deprecated), run the following command: ``` Get-AzSecurityPricing -Name 'ContainerRegistry' | Select-Object Name,PricingTier ``` Ensure the command returns `PricingTier` `Standard`. For Microsoft Defender for Containers, run the following command: ``` Get-AzSecurityPricing -Name 'Containers' ``` Ensure that `PricingTier` is set to `Standard`, and that each of the extensions (ContainerRegistriesVulnerabilityAssessments, AgentlessDiscoveryForKubernetes, AgentlessVmScanning, ContainerSensor) has `isEnabled` set to `True`. Repeat for each subscription. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [1c988dd6-ade4-430f-a608-2a3e5b0a6d38](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F1c988dd6-ade4-430f-a608-2a3e5b0a6d38) **- Name:** 'Microsoft Defender for Containers should be enabled'",
+ "AdditionalInformation": "The Azure Policy 'Microsoft Defender for Containers should be enabled' checks only that the `pricingTier` for `Containers` is set to `Standard`. It does not check the status of the plan's components.",
+ "References": "https://learn.microsoft.com/en-us/cli/azure/security/pricing:https://learn.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritypricing:https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction:https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-containers-azure:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "The Microsoft Defender for Containers plan is disabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.5.1",
+ "Description": "Ensure That Microsoft Defender for Storage Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_storage_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Storage Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Turning on Microsoft Defender for Storage incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Set `Status` to `On` for `Storage`. 6. Select `Save`. **Remediate from Azure CLI** Ensure the output of the below command is Standard ``` az security pricing create -n StorageAccounts --tier 'standard' ``` **Remediate from PowerShell** ``` Set-AzSecurityPricing -Name 'StorageAccounts' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Ensure `Status` is set to `On` for `Storage`. **Audit from Azure CLI** Ensure the output of the below command is Standard ``` az security pricing show -n StorageAccounts ``` **Audit from PowerShell** ``` Get-AzSecurityPricing -Name 'StorageAccounts' | Select-Object Name,PricingTier ``` Ensure output for `Name PricingTier` is `StorageAccounts Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [640d2586-54d2-465f-877f-9ffc1d2109f4](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F640d2586-54d2-465f-877f-9ffc1d2109f4) **- Name:** 'Microsoft Defender for Storage should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.5.2",
+ "Description": "Ensure Advanced Threat Protection Alerts for Storage Accounts Are Monitored",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Advanced Threat Protection Alerts for Storage Accounts Are Monitored",
+ "RationaleStatement": "Enabling Microsoft Defender for Storage without a monitoring process limits its value. Continuous monitoring and alert triage ensure that detected threats are acted upon quickly, reducing risk exposure.",
+ "ImpactStatement": "Requires integration effort with SIEM or alerting tools and a defined incident response process. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size and the applications in your tenant that interact with the Microsoft Graph APIs. See pricing: Log Analytics (https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model), Azure Storage (https://azure.microsoft.com/en-us/pricing/details/storage/blobs/), Event Hubs (https://azure.microsoft.com/en-us/pricing/details/event-hubs/).",
+ "RemediationProcedure": "Connect Microsoft Defender for Cloud to a SIEM such as Microsoft Sentinel or another log analytics solution. **Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, click `Environment Settings`. 3. Expand the Tenant Root Group(s) to reveal subscriptions. For each subscription listed: 1. Click the subscription name to open the Defender Plans settings 2. In the settings on the left, click `Continuous Export` 3. Select either `Event Hub`, `Log Analytics Workspace`, or both depending on your environment. 4. Set `Export enabled` to `On` 5. Under `Exported data types`, ensure that at least `Security Alerts (Medium and High)` is checked. 6. Under `Export target`, set the target Event Hub or Log Analytics Workspace which is tied to a SIEM that is configured to monitor and alert for security alerts. Ensure security alerts are included in the security operations workflow and incident response plan.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, click `Environment Settings`. 3. Expand the Tenant Root Group(s) to reveal subscriptions. For each subscription listed: 1. Click the subscription name to open the Defender Plans settings 2. In the settings on the left, click `Continuous Export` Ensure that `Export enabled` is set to `On` and delivering at least `Security Alerts (Medium and High)` to an Event Hub or Log Analytics Workspace which is tied to a SIEM that is configured to monitor and alert for security alerts.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/azure/defender-for-cloud/alerts-overview:https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud:https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export",
+ "DefaultValue": "By default, continuous export is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.6.1",
+ "Description": "Ensure That Microsoft Defender for App Services Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_app_services_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for App Services Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Turning on Microsoft Defender for App Service incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud` 2. Under `Management`, select `Environment Settings` 3. Click on the subscription name 4. Select `Defender plans` 5. Set `App Service` Status to `On` 6. Select `Save` **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n Appservices --tier 'standard' ``` **Remediate from PowerShell** Run the following command: ``` Set-AzSecurityPricing -Name AppServices -PricingTier Standard ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud` 2. Under `Management`, select `Environment Settings` 3. Click on the subscription name 4. Select `Defender plans` 5. Ensure Status is `On` for `App Service` **Audit from Azure CLI** Run the following command: ``` az security pricing show -n AppServices ``` Ensure `-PricingTier` is set to `Standard` **Audit from PowerShell** Run the following command: ``` Get-AzSecurityPricing -Name 'AppServices' |Select-Object Name,PricingTier ``` Ensure the `-PricingTier` is set to `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [2913021d-f2fd-4f3d-b958-22354e2bdbcb](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F2913021d-f2fd-4f3d-b958-22354e2bdbcb) **- Name:** 'Azure Defender for App Service should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.7.1",
+ "Description": "Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_cosmosdb_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'",
+ "RationaleStatement": "In scanning Azure Cosmos DB requests within a subscription, requests are compared to a heuristic list of potential security threats. These threats could be a result of a security breach within your services, thus scanning for them could prevent a potential security threat from being introduced.",
+ "ImpactStatement": "Enabling Microsoft Defender for Azure Cosmos DB requires enabling Microsoft Defender for your subscription. Both will incur additional charges.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. On the `Database` row click on `Select types >`. 6. Set the toggle switch next to `Azure Cosmos DB` to `On`. 7. Click `Continue`. 8. Click `Save`. **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n 'CosmosDbs' --tier 'standard' ``` **Remediate from PowerShell** Use the below command to enable Standard pricing tier for Azure Cosmos DB ``` Set-AzSecurityPricing -Name 'CosmosDbs' -PricingTier 'Standard ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. On the `Database` row click on `Select types >`. 6. Ensure the toggle switch next to `Azure Cosmos DB` is set to `On`. **Audit from Azure CLI** Ensure the output of the below command is Standard ``` az security pricing show -n CosmosDbs --query pricingTier ``` **Audit from PowerShell** ``` Get-AzSecurityPricing -Name 'CosmosDbs' | Select-Object Name,PricingTier ``` Ensure output of `-PricingTier` is `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [adbe85b5-83e6-4350-ab58-bf3a4f736e5e](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fadbe85b5-83e6-4350-ab58-bf3a4f736e5e) **- Name:** 'Microsoft Defender for Azure Cosmos DB should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/:https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security:https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview:https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/cosmos-db-security-baseline:https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-enable-database-protections:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender for Azure Cosmos DB is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.7.2",
+ "Description": "Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_os_relational_databases_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for Open-source relational databases allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Turning on Microsoft Defender for Open-source relational databases incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Click `Select types >` in the row for `Databases`. 6. Set the toggle switch next to `Open-source relational databases` to `On`. 7. Select `Continue`. 8. Select `Save`. **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n 'OpenSourceRelationalDatabases' --tier 'standard' ``` **Remediate from PowerShell** Use the below command to enable Standard pricing tier for Open-source relational databases ``` set-azsecuritypricing -name OpenSourceRelationalDatabases -pricingtier Standard ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment Settings`. 1. Click on the subscription name. 1. Select the `Defender plans` blade. 1. Click `Select types >` in the row for `Databases`. 1. Ensure the toggle switch next to `Open-source relational databases` is set to `On`. **Audit from Azure CLI** Run the following command: ``` az security pricing show -n OpenSourceRelationalDatabases --query pricingTier ``` **Audit from PowerShell** ``` Get-AzSecurityPricing | Where-Object {$_.Name -eq 'OpenSourceRelationalDatabases'} | Select-Object Name, PricingTier ``` Ensure output for `Name PricingTier` is `OpenSourceRelationalDatabases Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [0a9fbe0d-c5c4-4da8-87d8-f4fd77338835](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0a9fbe0d-c5c4-4da8-87d8-f4fd77338835) **- Name:** 'Azure Defender for open-source relational databases should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-2-monitor-anomalies-and-threats-targeting-sensitive-data:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.7.3",
+ "Description": "Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_azure_sql_databases_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for Azure SQL Databases allows for greater defense-in-depth, includes functionality for discovering and classifying sensitive data, surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database.",
+ "ImpactStatement": "Turning on Microsoft Defender for Azure SQL Databases incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Click `Select types >` in the row for `Databases`. 6. Set the toggle switch next to `Azure SQL Databases` to `On`. 7. Select `Continue`. 8. Select `Save`. **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n SqlServers --tier 'standard' ``` **Remediate from PowerShell** Run the following command: ``` Set-AzSecurityPricing -Name 'SqlServers' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Click `Select types >` in the row for `Databases`. 6. Ensure the toggle switch next to `Azure SQL Databases` is set to `On`. **Audit from Azure CLI** Run the following command: ``` az security pricing show -n SqlServers ``` Ensure `-PricingTier` is set to `Standard` **Audit from PowerShell** Run the following command: ``` Get-AzSecurityPricing -Name 'SqlServers' | Select-Object Name,PricingTier ``` Ensure the `-PricingTier` is set to `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [7fe3b40f-802b-4cdd-8bd4-fd799c948cc2](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F7fe3b40f-802b-4cdd-8bd4-fd799c948cc2) **- Name:** 'Azure Defender for Azure SQL Database servers should be enabled' - **Policy ID:** [abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb7388-5bf4-4ad7-ba99-2cd2f41cebb9) **- Name:** 'Azure Defender for SQL should be enabled for unprotected SQL Managed Instances'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-2-monitor-anomalies-and-threats-targeting-sensitive-data:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.7.4",
+ "Description": "Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_sql_servers_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for SQL servers on machines allows for greater defense-in-depth, functionality for discovering and classifying sensitive data, surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database.",
+ "ImpactStatement": "Turning on Microsoft Defender for SQL servers on machines incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Click `Select types >` in the row for `Databases`. 6. Set the toggle switch next to `SQL servers on machines` to `On`. 7. Select `Continue`. 8. Select `Save`. **Remediate from Azure CLI** Run the following command: ``` az security pricing create -n SqlServerVirtualMachines --tier 'standard' ``` **Remediate from PowerShell** Run the following command: ``` Set-AzSecurityPricing -Name 'SqlServerVirtualMachines' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Click `Select types >` in the row for `Databases`. 6. Ensure the toggle switch next to `SQL servers on machines` is set to `On`. **Audit from Azure CLI** Ensure Defender for SQL is licensed with the following command: ``` az security pricing show -n SqlServerVirtualMachines ``` Ensure the 'PricingTier' is set to 'Standard' **Audit from PowerShell** Run the following command: ``` Get-AzSecurityPricing -Name 'SqlServerVirtualMachines' | Select-Object Name,PricingTier ``` Ensure the 'PricingTier' is set to 'Standard' **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [6581d072-105e-4418-827f-bd446d56421b](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6581d072-105e-4418-827f-bd446d56421b) **- Name:** 'Azure Defender for SQL servers on machines should be enabled' - **Policy ID:** [abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fabfb4388-5bf4-4ad7-ba82-2cd2f41ceae9) **- Name:** 'Azure Defender for SQL should be enabled for unprotected Azure SQL servers'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/defender-for-sql-usage:https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-2-monitor-anomalies-and-threats-targeting-sensitive-data:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.8.1",
+ "Description": "Ensure That Microsoft Defender for Key Vault Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_keyvault_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Key Vault Is Set To 'On'",
+ "RationaleStatement": "Enabling Microsoft Defender for Key Vault allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
+ "ImpactStatement": "Turning on Microsoft Defender for Key Vault incurs an additional cost per resource.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Select `On` under `Status` for `Key Vault`. 6. Select `Save`. **Remediate from Azure CLI** Enable Standard pricing tier for Key Vault: ``` az security pricing create -n 'KeyVaults' --tier 'Standard' ``` **Remediate from PowerShell** Enable Standard pricing tier for Key Vault: ``` Set-AzSecurityPricing -Name 'KeyVaults' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Ensure `Status` is set to `On` for `Key Vault`. **Audit from Azure CLI** Ensure the output of the below command is Standard ``` az security pricing show -n 'KeyVaults' --query 'pricingTier' ``` **Audit from PowerShell** ``` Get-AzSecurityPricing -Name 'KeyVaults' | Select-Object Name,PricingTier ``` Ensure output for `PricingTier` is `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [0e6763cc-5078-4e64-889d-ff4d9a839047](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0e6763cc-5078-4e64-889d-ff4d9a839047) **- Name:** 'Azure Defender for Key Vault should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update:https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender plan is off."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.9.1",
+ "Description": "Ensure That Microsoft Defender for Resource Manager Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_defender_for_arm_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Microsoft Defender for Resource Manager Is Set To 'On'",
+ "RationaleStatement": "Scanning resource requests lets you be alerted every time there is suspicious activity in order to prevent a security threat from being introduced.",
+ "ImpactStatement": "Enabling Microsoft Defender for Resource Manager requires enabling Microsoft Defender for your subscription. Both will incur additional charges.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Select `On` under `Status` for `Resource Manager`. 6. Select `Save. **Remediate from Azure CLI** Use the below command to enable Standard pricing tier for Defender for Resource Manager ``` az security pricing create -n 'Arm' --tier 'Standard' ``` **Remediate from PowerShell** Use the below command to enable Standard pricing tier for Defender for Resource Manager ``` Set-AzSecurityPricing -Name 'Arm' -PricingTier 'Standard' ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender for Cloud`. 2. Under `Management`, select `Environment Settings`. 3. Click on the subscription name. 4. Select the `Defender plans` blade. 5. Ensure `Status` is set to `On` for `Resource Manager`. **Audit from Azure CLI** Ensure the output of the below command is Standard ``` az security pricing show -n 'Arm' --query 'pricingTier' ``` **Audit from PowerShell** ``` Get-AzSecurityPricing -Name 'Arm' | Select-Object Name,PricingTier ``` Ensure the output of `PricingTier` is `Standard` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [c3d20c29-b36d-48fe-808b-99a87530ad99](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc3d20c29-b36d-48fe-808b-99a87530ad99) **- Name:** 'Azure Defender for Resource Manager should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security:https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-introduction:https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/:https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities",
+ "DefaultValue": "By default, Microsoft Defender for Resource Manager is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.10",
+ "Description": "Ensure that Microsoft Defender for Cloud is Configured to Check VM Operating Systems for Updates",
+ "Checks": [
+ "defender_ensure_system_updates_are_applied"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Microsoft Defender for Cloud is Configured to Check VM Operating Systems for Updates",
+ "RationaleStatement": "Windows and Linux virtual machines should be kept updated to: - Address a specific bug or flaw - Improve an OS or applications general stability - Fix a security vulnerability Microsoft Defender for Cloud retrieves a list of available security and critical updates from Windows Update or Windows Server Update Services (WSUS), depending on which service is configured on a Windows VM. The security center also checks for the latest updates in Linux systems. If a VM is missing a system update, the security center will recommend system updates be applied.",
+ "ImpactStatement": "Running Microsoft Defender for Cloud incurs additional charges for each resource monitored. Please see attached reference for exact charges per hour.",
+ "RemediationProcedure": "Follow Microsoft Azure documentation to apply security patches from the security center. Alternatively, you can employ your own patch assessment and management tool to periodically assess, report, and install the required security patches for your OS.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Defender for Cloud` 1. Then the `Recommendations` blade 1. Ensure that there are no recommendations for `System updates should be installed on your machines (powered by Update Center)` Alternatively, you can employ your own patch assessment and management tool to periodically assess, report and install the required security patches for your OS. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [f85bf3e0-d513-442e-89c3-1784ad63382b](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff85bf3e0-d513-442e-89c3-1784ad63382b) **- Name:** 'System updates should be installed on your machines (powered by Update Center)' - **Policy ID:** [bd876905-5b84-4f73-ab2d-2e7a7c4568d9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fbd876905-5b84-4f73-ab2d-2e7a7c4568d9) **- Name:** 'Machines should be configured to periodically check for missing system updates'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-posture-vulnerability-management#pv-6-rapidly-and-automatically-remediate-vulnerabilities:https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/:https://docs.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm",
+ "DefaultValue": "By default, patches are not automatically deployed."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.11",
+ "Description": "Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled'",
+ "Checks": [
+ "policy_ensure_asc_enforcement_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled'",
+ "RationaleStatement": "A security policy defines the desired configuration of resources in your environment and helps ensure compliance with company or regulatory security requirements. The MCSB Policy Initiative a set of security recommendations based on best practices and is associated with every subscription by default. When a policy Effect is set to `Audit`, policies in the MCSB ensure that Defender for Cloud evaluates relevant resources for supported recommendations. To ensure that policies within the MCSB are not being missed when the Policy Initiative is evaluated, none of the policies should have an Effect of `Disabled`.",
+ "ImpactStatement": "Policies within the MCSB default to an effect of `Audit` and will evaluate—but not enforce—policy recommendations. Ensuring these policies are set to `Audit` simply ensures that the evaluation occurs to allow administrators to understand where an improvement may be possible. Administrators will need to determine if the recommendations are relevant and desirable for their environment, then manually take action to resolve the status if desired.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Management Group or Subscription. 1. Click on `Security policies` in the left column. 1. Click on `Microsoft cloud security benchmark` 1. Click `Add Filter` and select `Effect` 1. Check the `Disabled` box to search for all disabled policies 1. Click `Apply` 1. Click the blue ellipsis `...` to the right of a policy name. 1. Click `Manage effect and parameters`. 1. Under `Policy effect`, select the radio button next to `Audit`. 1. Click `Save`. 1. Click `Refresh`. 1. Repeat steps 10-14 until all disabled policies are updated. 1. Repeat steps 1-15 for each Management Group or Subscription requiring remediation.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Management Group or Subscription. 1. Click on `Security policies` in the left column. 1. Click on `Microsoft cloud security benchmark`. 1. Click `Add filter` and select `Effect`. 1. Check the `Disabled` box to search for all disabled policies. 1. Click `Apply`. 1. Ensure that no policies are displayed, signifying that there are no disabled policies. 1. Repeat steps 1-10 for each Management Group or Subscription.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-in/azure/defender-for-cloud/security-policy-concept:https://docs.microsoft.com/en-us/azure/security-center/security-center-policies:https://learn.microsoft.com/en-us/azure/defender-for-cloud/implement-security-recommendations:https://learn.microsoft.com/en-us/rest/api/policy/policy-assignments/get:https://learn.microsoft.com/en-us/rest/api/policy/policy-assignments/create:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy",
+ "DefaultValue": "By default, the MCSB policy initiative is assigned on all subscriptions, and **most** policies will have an effect of `Audit`. Some policies will have a default effect of `Disabled`."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.12",
+ "Description": "Ensure That 'All users with the following roles' is Set to 'Owner'",
+ "Checks": [
+ "defender_ensure_notify_emails_to_owners"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That 'All users with the following roles' is Set to 'Owner'",
+ "RationaleStatement": "Enabling security alert emails to subscription owners ensures that they receive security alert emails from Microsoft. This ensures that they are aware of any potential security issues and can mitigate the risk in a timely fashion.",
+ "ImpactStatement": "Owners will receive email notifications for security alerts.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Defender for Cloud` 1. Under `Management`, select `Environment Settings` 1. Click on the appropriate Management Group, Subscription, or Workspace 1. Click on `Email notifications` 1. In the drop down of the `All users with the following roles` field select `Owner` 1. Click `Save` **Remediate from Azure CLI** Use the below command to set `Send email also to subscription owners` to `On`. ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X PUT -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@input.json' ``` Where `input.json` contains the data below, replacing `validEmailAddress` with a single email address or multiple comma-separated email addresses: ``` { id: /subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContacts/default1, name: default1, type: Microsoft.Security/securityContacts, properties: { email: <validEmailAddress>, alertNotifications: On, alertsToAdmins: On, notificationsByRole: Owner } } ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu 1. Select `Microsoft Defender for Cloud` 1. Under `Management`, select `Environment Settings` 1. Click on the appropriate Management Group, Subscription, or Workspace 1. Click on `Email notifications` 1. Ensure that `All users with the following roles` is set to `Owner` **Audit from Azure CLI** Ensure the command below returns state of `On` and that `Owner` appears in roles. ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview'| jq '.[] | select(.name==default).properties.notificationsByRole' ```",
+ "AdditionalInformation": "Excluding any entries in the input.json properties block disables the specific setting by default.",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details:https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/security-contacts:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification",
+ "DefaultValue": "By default, `Owner` is selected"
+ }
+ ]
+ },
+ {
+ "Id": "8.1.13",
+ "Description": "Ensure 'Additional email addresses' is Configured with a Security Contact Email",
+ "Checks": [
+ "defender_additional_email_configured_with_a_security_contact"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Additional email addresses' is Configured with a Security Contact Email",
+ "RationaleStatement": "Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.",
+ "ImpactStatement": "Security contacts will receive email notifications.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment Settings`. 1. Click on the appropriate Management Group, Subscription, or Workspace. 1. Click on `Email notifications`. 1. Enter a valid security contact email address (or multiple addresses separated by commas) in the `Additional email addresses` field. 1. Click `Save`. **Remediate from Azure CLI** Use the below command to set `Security contact emails` to `On`. ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X PUT -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview -d@input.json' ``` Where `input.json` contains the data below, replacing `validEmailAddress` with a single email address or multiple comma-separated email addresses: ``` { id: /subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContacts/default, name: default, type: Microsoft.Security/securityContacts, properties: { email: <validEmailAddress>, alertNotifications: On, alertsToAdmins: On } } ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment Settings`. 1. Click on the appropriate Management Group, Subscription, or Workspace. 1. Click on `Email notifications`. 1. Ensure that a valid security contact email address is listed in the `Additional email addresses` field. **Audit from Azure CLI** Ensure the output of the below command is not empty and is set with appropriate email ids: ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview' | jq '.|.[] | select(.name==default)'|jq '.properties.emails' ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7) **- Name:** 'Subscriptions should have a contact email address for security issues'",
+ "AdditionalInformation": "Excluding any entries in the input.json properties block disables the specific setting by default.",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details:https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list:https://docs.microsoft.com/en-us/rest/api/securitycenter/security-contacts:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification",
+ "DefaultValue": "By default, there are no additional email addresses entered."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.14",
+ "Description": "Ensure that 'Notify about alerts with the following severity (or higher)' is Enabled",
+ "Checks": [
+ "defender_ensure_notify_alerts_severity_is_high"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Notify about alerts with the following severity (or higher)' is Enabled",
+ "RationaleStatement": "Enabling security alert emails ensures that security alert emails are sent by Microsoft. This ensures that the right people are aware of any potential security issues and can mitigate the risk.",
+ "ImpactStatement": "Enabling security alert emails can cause alert fatigue, increasing the risk of missing important alerts. Select an appropriate severity level to manage notifications. Azure aims to reduce alert fatigue by limiting the daily email volume per severity level. Learn more: https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications#email-frequency.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Subscription. 1. Click on `Email notifications`. 1. Under `Notification types`, check box next to `Notify about alerts with the following severity (or higher)` and select an appropriate severity level from the drop-down menu. 1. Click `Save`. 1. Repeat steps 1-7 for each Subscription requiring remediation. **Remediate from Azure CLI** Use the below command to enable `Send email notification for high severity alerts`: ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X PUT -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/<$0>/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@input.json' ``` Where `input.json` contains the data below, replacing `validEmailAddress` with a single email address or multiple comma-separated email addresses: ``` { id: /subscriptions/<subscriptionId>/providers/Microsoft.Security/securityContacts/default, name: default, type: Microsoft.Security/securityContacts, properties: { email: <validEmailAddress>, alertNotifications: On, alertsToAdmins: On } } ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Subscription. 1. Click on `Email notifications`. 1. Under `Notification types`, ensure that the box next to `Notify about alerts with the following severity (or higher)` is checked, and an appropriate severity level is selected. 1. Repeat steps 1-6 for each Subscription. **Audit from Azure CLI** Including a Subscription ID at the `$0` in `/subscriptions/$0/providers`, ensure the below command returns `state: On`, and that `minimalSeverity` is set to an appropriate severity level: ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview' | jq '.|.[] | select(.name==default)'|jq '.properties.alertNotifications' ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [6e2593d9-add6-4083-9c9b-4b7d2188c899](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6e2593d9-add6-4083-9c9b-4b7d2188c899) **- Name:** 'Email notification for high severity alerts should be enabled'",
+ "AdditionalInformation": "Excluding any entries in the `input.json` properties block disables the specific setting by default. This recommendation has been updated to reflect recent changes to Microsoft REST APIs for getting and updating security contact information.",
+ "References": "https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details:https://docs.microsoft.com/en-us/rest/api/securitycenter/security-contacts:https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification",
+ "DefaultValue": "By default, subscription owners receive email notifications for high-severity alerts."
+ }
+ ]
+ },
+ {
+ "Id": "8.1.15",
+ "Description": "Ensure that 'Notify about attack paths with the following risk level (or higher)' is Enabled",
+ "Checks": [
+ "defender_attack_path_notifications_properly_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Notify about attack paths with the following risk level (or higher)' is Enabled",
+ "RationaleStatement": "Enabling attack path emails ensures that attack path emails are sent by Microsoft. This ensures that the right people are aware of any potential security issues and can mitigate the risk.",
+ "ImpactStatement": "Enabling attack path emails can cause alert fatigue, increasing the risk of missing important alerts. Select an appropriate risk level to manage notifications. Azure aims to reduce alert fatigue by limiting the daily email volume per risk level. Learn more: https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications#email-frequency.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Subscription. 1. Click on `Email notifications`. 1. Under Notification types, check the box next to `Notify about attack paths with the following risk level (or higher)`, and select an appropriate risk level from the drop-down menu. 1. Repeat steps 1-6 for each Subscription.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home select the Portal Menu. 1. Select `Microsoft Defender for Cloud`. 1. Under `Management`, select `Environment settings`. 1. Click on the appropriate Subscription. 1. Click on `Email notifications`. 1. Under Notification types, ensure that the box next to `Notify about attack paths with the following risk level (or higher)` is checked, and an appropriate risk level is selected. 1. Repeat steps 1-6 for each Subscription. **Audit from Azure CLI** Including a Subscription ID at the `$0` in `/subscriptions/$0/providers`, ensure the below command returns `sourceType: AttackPath`, and that `minimalRiskLevel` is set to an appropriate risk level: ``` az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2023-12-01-preview' | jq '.|.[]' ```",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications:https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path:https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path",
+ "DefaultValue": ""
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_attack_path_notifications_properly_configured",
+ "ConfigKey": "defender_attack_path_minimal_risk_level",
+ "Operator": "in",
+ "Value": [
+ "Low",
+ "Medium",
+ "High"
+ ]
+ }
+ ]
+ },
+ {
+ "Id": "8.1.16",
+ "Description": "Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is Enabled",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.1 Microsoft Defender for Cloud",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is Enabled",
+ "RationaleStatement": "This tool can monitor the externally exposed resources of an organization, provide valuable insights, and export these findings in a variety of formats (including CSV) for use in vulnerability management operations and red/purple team exercises.",
+ "ImpactStatement": "Microsoft Defender EASM workspaces are currently available as Azure Resources with a 30-day free trial period but can quickly accrue significant charges. The costs are calculated daily as (Number of billable inventory items) x (item cost per day; approximately: $0.017). Estimated cost is not provided within the tool, and users are strongly advised to contact their Microsoft sales representative for pricing and set a calendar reminder for the end of the trial period. For an EASM workspace having an Inventory of 5k-10k billable items (IP addresses, hostnames, SSL certificates, etc) a typical cost might be approximately $85-170 per day or $2500-5000 USD/month at the time of publication. If the workspace is deleted by the last day of a free trial period, no charges are billed.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Microsoft Defender EASM`. 1. Click `+ Create`. 1. Under `Project details`, select a subscription. 1. Select or create a resource group. 1. Under `Instance details`, enter a name for the workspace. 1. Select a region. 1. Click `Review + create`. 1. Click `Create`. 1. Once the deployment has completed, go to `Microsoft Defender EASM`. 1. Click the workspace name. 1. Configure the workspace appropriately for your environment and organization.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Microsoft Defender EASM`. 1. Ensure that at least one Microsoft Defender EASM workspace is listed. 1. Click the name of a workspace. 1. Ensure the workspace is configured appropriately for your environment and organization. 1. Repeat steps 3-4 for each workspace.",
+ "AdditionalInformation": "Microsoft added its Defender for External Attack Surface management (EASM) offering to Azure following its 2022 acquisition of EASM SaaS tool company RiskIQ.",
+ "References": "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/:https://learn.microsoft.com/en-us/azure/external-attack-surface-management/deploying-the-defender-easm-azure-resource:https://www.microsoft.com/en-us/security/blog/2022/08/02/microsoft-announces-new-solutions-for-threat-intelligence-and-attack-surface-management/",
+ "DefaultValue": "Microsoft Defender EASM is an optional, paid Azure Resource that must be created and configured inside a Subscription and Resource Group."
+ }
+ ]
+ },
+ {
+ "Id": "8.2.1",
+ "Description": "Ensure That Microsoft Defender for IoT Hub Is Set To 'On'",
+ "Checks": [
+ "defender_ensure_iot_hub_defender_is_on"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.2 Microsoft Defender for IoT",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure That Microsoft Defender for IoT Hub Is Set To 'On'",
+ "RationaleStatement": "IoT devices are very rarely patched and can be potential attack vectors for enterprise networks. Updating their network configuration to use a central security hub allows for detection of these breaches.",
+ "ImpactStatement": "Enabling Microsoft Defender for IoT will incur additional charges dependent on the level of usage.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `IoT Hub`. 2. Select an `IoT Hub` to validate. 3. Select `Overview` in `Defender for IoT`. 4. Click on `Secure your IoT solution`, and complete the onboarding.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `IoT Hub`. 2. Select an `IoT Hub` to validate. 3. Select `Overview` in `Defender for IoT`. 4. The Threat prevention and Threat detection screen will appear, if `Defender for IoT` is Enabled.",
+ "AdditionalInformation": "There are additional configurations for Microsoft Defender for IoT that allow for types of deployments called hybrid or local. Both run on your physical infrastructure. These are complicated setups and are primarily outside of the scope of a purely Azure benchmark. Please see the references to consider these options for your organization.",
+ "References": "https://azure.microsoft.com/en-us/services/iot-defender/#overview:https://docs.microsoft.com/en-us/azure/defender-for-iot/:https://azure.microsoft.com/en-us/pricing/details/iot-defender/:https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-iot-security-baseline:https://docs.microsoft.com/en-us/cli/azure/iot?view=azure-cli-latest:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-1-enable-threat-detection-capabilities:https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-onboard-iot-hub",
+ "DefaultValue": "By default, Microsoft Defender for IoT is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.1",
+ "Description": "Ensure that the Expiration Date is Set for all Keys in Key Vaults using RBAC",
+ "Checks": [
+ "keyvault_rbac_key_expiration_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the Expiration Date is Set for all Keys in Key Vaults using RBAC",
+ "RationaleStatement": "Azure Key Vault enables users to store and use cryptographic keys within the Microsoft Azure environment. The `exp` (expiration date) attribute identifies the expiration date on or after which the key MUST NOT be used for encryption of new data, wrapping of new keys, and signing. By default, keys never expire. It is thus recommended that keys be rotated in the key vault and set an explicit expiration date for all keys to help enforce the key rotation. This ensures that the keys cannot be used beyond their assigned lifetimes.",
+ "ImpactStatement": "Keys cannot be used beyond their assigned expiration dates respectively. Keys need to be rotated periodically wherever they are used.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Keys`. 3. In the main pane, ensure that an appropriate `Expiration date` is set for any keys that are `Enabled`. **Remediate from Azure CLI** Update the `Expiration date` for the key using the below command: ``` az keyvault key set-attributes --name <keyName> --vault-name <vaultName> --expires Y-m-d'T'H:M:S'Z' ``` **Note:** To view the expiration date on all keys in a Key Vault using Microsoft API, the List Key permission is required. To update the expiration date for the keys: 1. Go to the Key vault, click on Access Control (IAM). 2. Click on Add role assignment and assign the role of Key Vault Crypto Officer to the appropriate user. **Remediate from PowerShell** ``` Set-AzKeyVaultKeyAttribute -VaultName <VaultName> -Name <KeyName> -Expires <DateTime> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Keys`. 3. In the main pane, ensure that an appropriate `Expiration date` is set for any keys that are `Enabled`. **Audit from Azure CLI** Get a list of all the key vaults in your Azure environment by running the following command: ``` az keyvault list ``` Then for each key vault listed ensure that the output of the below command contains Key ID (kid), enabled status as `true` and Expiration date (expires) is not empty or null: ``` az keyvault key list --vault-name <VaultName> --query '[*].{kid:kid,enabled:attributes.enabled,expires:attributes.expires}' ``` **Audit from PowerShell** Retrieve a list of Azure Key vaults: ``` Get-AzKeyVault ``` For each Key vault run the following command to determine which vaults are configured to use RBAC. ``` Get-AzKeyVault -VaultName <VaultName> ``` For each Key vault with the `EnableRbacAuthorizatoin` setting set to `True`, run the following command. ``` Get-AzKeyVaultKey -VaultName <VaultName> ``` Make sure the `Expires` setting is configured with a value as appropriate wherever the `Enabled` setting is set to `True`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0) **- Name:** 'Key Vault keys should have an expiration date'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis:https://docs.microsoft.com/en-us/rest/api/keyvault/about-keys--secrets-and-certificates#key-vault-keys:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-6-use-a-secure-key-management-process:https://docs.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultkeyattribute?view=azps-0.10.0",
+ "DefaultValue": "By default, keys do not expire."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.2",
+ "Description": "Ensure that the Expiration Date is set for All Keys in Key Vaults using access policies (legacy)",
+ "Checks": [
+ "keyvault_key_expiration_set_in_non_rbac"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the Expiration Date is set for All Keys in Key Vaults using access policies (legacy)",
+ "RationaleStatement": "Azure Key Vault enables users to store and use cryptographic keys within the Microsoft Azure environment. The `exp` (expiration date) attribute identifies the expiration date on or after which the key MUST NOT be used for a cryptographic operation. By default, keys never expire. It is thus recommended that keys be rotated in the key vault and set an explicit expiration date for all keys. This ensures that the keys cannot be used beyond their assigned lifetimes.",
+ "ImpactStatement": "Keys cannot be used beyond their assigned expiration dates respectively. Keys need to be rotated periodically wherever they are used.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Keys`. 3. In the main pane, ensure that the status of the key is `Enabled`. 4. For each enabled key, ensure that an appropriate `Expiration date` is set. **Remediate from Azure CLI** Update the `Expiration date` for the key using the below command: ``` az keyvault key set-attributes --name <keyName> --vault-name <vaultName> --expires Y-m-d'T'H:M:S'Z' ``` **Note:** To view the expiration date on all keys in a Key Vault using Microsoft API, the List Key permission is required. To update the expiration date for the keys: 1. Go to Key vault, click on `Access policies`. 2. Click on `Create` and add an access policy with the `Update` permission (in the Key Permissions - Key Management Operations section). **Remediate from PowerShell** ``` Set-AzKeyVaultKeyAttribute -VaultName <Vault Name> -Name <Key Name> -Expires <DateTime> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Keys`. 3. In the main pane, ensure that the status of the key is `Enabled`. 4. For each enabled key, ensure that an appropriate `Expiration date` is set. **Audit from Azure CLI** Get a list of all the key vaults in your Azure environment by running the following command: ``` az keyvault list ``` For each key vault, ensure that the output of the below command contains Key ID (kid), enabled status as `true` and Expiration date (expires) is not empty or null: ``` az keyvault key list --vault-name <KEYVAULTNAME> --query '[*].{kid:kid,enabled:attributes.enabled,expires:attributes.expires}' ``` **Audit from PowerShell** Retrieve a list of Azure Key vaults: ``` Get-AzKeyVault ``` For each Key vault, run the following command to determine which vaults are configured to not use RBAC: ``` Get-AzKeyVault -VaultName <Vault Name> ``` For each Key vault with the `EnableRbacAuthorizatoin` setting set to `False` or empty, run the following command. ``` Get-AzKeyVaultKey -VaultName <Vault Name> ``` Make sure the `Expires` setting is configured with a value as appropriate wherever the `Enabled` setting is set to `True`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0) **- Name:** 'Key Vault keys should have an expiration date'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis:https://docs.microsoft.com/en-us/rest/api/keyvault/about-keys--secrets-and-certificates#key-vault-keys:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-6-use-a-secure-key-management-process:https://docs.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultkeyattribute?view=azps-0.10.0",
+ "DefaultValue": "By default, keys do not expire."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.3",
+ "Description": "Ensure that the Expiration Date is set for All Secrets in Key Vaults using RBAC",
+ "Checks": [
+ "keyvault_rbac_secret_expiration_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the Expiration Date is set for All Secrets in Key Vaults using RBAC",
+ "RationaleStatement": "The Azure Key Vault enables users to store and keep secrets within the Microsoft Azure environment. Secrets in the Azure Key Vault are octet sequences with a maximum size of 25k bytes each. The `exp` (expiration date) attribute identifies the expiration date on or after which the secret MUST NOT be used. By default, secrets never expire. It is thus recommended to rotate secrets in the key vault and set an explicit expiration date for all secrets. This ensures that the secrets cannot be used beyond their assigned lifetimes.",
+ "ImpactStatement": "Secrets cannot be used beyond their assigned expiry date respectively. Secrets need to be rotated periodically wherever they are used.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Secrets`. 3. In the main pane, ensure that the status of the secret is `Enabled`. 4. For each enabled secret, ensure that an appropriate `Expiration date` is set. **Remediate from Azure CLI** Update the Expiration date for the secret using the below command: ``` az keyvault secret set-attributes --name <secret_name> --vault-name <vault_name> --expires Y-m-d'T'H:M:S'Z' ``` Note: To view the expiration date on all secrets in a Key Vault using Microsoft API, the `List Secret` permission is required. To update the expiration date for the secrets: 1. Go to the Key vault, click on `Access Control (IAM)`. 2. Click on `Add role assignment` and assign the role of `Key Vault Secrets Officer` to the appropriate user. **Remediate from PowerShell** ``` Set-AzKeyVaultSecretAttribute -VaultName <vault_name> -Name <secret_name> -Expires <date_time> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Secrets`. 3. In the main pane, ensure that the status of the secret is `Enabled`. 4. For each enabled secret, ensure that an appropriate `Expiration date` is set. **Audit from Azure CLI** Ensure that the output of the below command contains ID (id), enabled status as `true` and Expiration date (expires) is not empty or null: ``` az keyvault secret list --vault-name <KEYVAULTNAME> --query '[*].{kid:kid,enabled:attributes.enabled,expires:attributes.expires}' ``` **Audit from PowerShell** Retrieve a list of Key vaults: ``` Get-AzKeyVault ``` For each Key vault, run the following command to determine which vaults are configured to use RBAC: ``` Get-AzKeyVault -VaultName <Vault Name> ``` For each Key vault with the `EnableRbacAuthorization` setting set to `True`, run the following command: ``` Get-AzKeyVaultSecret -VaultName <Vault Name> ``` Make sure the `Expires` setting is configured with a value as appropriate wherever the `Enabled` setting is set to `True`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [98728c90-32c7-4049-8429-847dc0f4fe37](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F98728c90-32c7-4049-8429-847dc0f4fe37) **- Name:** 'Key Vault secrets should have an expiration date'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis:https://docs.microsoft.com/en-us/rest/api/keyvault/about-keys--secrets-and-certificates#key-vault-secrets:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-6-use-a-secure-key-management-process:https://docs.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultsecretattribute?view=azps-0.10.0",
+ "DefaultValue": "By default, secrets do not expire."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.4",
+ "Description": "Ensure that the Expiration Date is set for All Secrets in Key Vaults using access policies (legacy)",
+ "Checks": [
+ "keyvault_non_rbac_secret_expiration_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the Expiration Date is set for All Secrets in Key Vaults using access policies (legacy)",
+ "RationaleStatement": "The Azure Key Vault enables users to store and keep secrets within the Microsoft Azure environment. Secrets in the Azure Key Vault are octet sequences with a maximum size of 25k bytes each. The `exp` (expiration date) attribute identifies the expiration date on or after which the secret MUST NOT be used. By default, secrets never expire. It is thus recommended to rotate secrets in the key vault and set an explicit expiration date for all secrets. This ensures that the secrets cannot be used beyond their assigned lifetimes.",
+ "ImpactStatement": "Secrets cannot be used beyond their assigned expiry date respectively. Secrets need to be rotated periodically wherever they are used.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Secrets`. 3. In the main pane, ensure that the status of the secret is `Enabled`. 4. Set an appropriate `Expiration date` on all secrets. **Remediate from Azure CLI** Update the `Expiration date` for the secret using the below command: ``` az keyvault secret set-attributes --name <secret_name> --vault-name <vault_name> --expires Y-m-d'T'H:M:S'Z' ``` Note: To view the expiration date on all secrets in a Key Vault using Microsoft API, the `List` Secret permission is required. To update the expiration date for the secrets: 1. Go to Key vault, click on `Access policies`. 2. Click on `Create` and add an access policy with the `Update` permission (in the Secret Permissions - Secret Management Operations section). **Remediate from PowerShell** For each Key vault with the `EnableRbacAuthorization` setting set to `False` or empty, run the following command. ``` Set-AzKeyVaultSecret -VaultName <vault_name> -Name <secret_name> -Expires <date_time> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. For each Key vault, click on `Secrets`. 3. In the main pane, ensure that the status of the secret is `Enabled`. 4. Set an appropriate `Expiration date` on all secrets. **Audit from Azure CLI** Get a list of all the key vaults in your Azure environment by running the following command: ``` az keyvault list ``` For each key vault, ensure that the output of the below command contains ID (id), enabled status as `true` and Expiration date (expires) is not empty or null: ``` az keyvault secret list --vault-name <KEYVALUTNAME> --query '[*].{kid:kid,enabled:attributes.enabled,expires:attributes.expires}' ``` **Audit from PowerShell** Retrieve a list of Key vaults: ``` Get-AzKeyVault ``` For each Key vault run the following command to determine which vaults are configured to use RBAC: ``` Get-AzKeyVault -VaultName <Vault Name> ``` For each Key Vault with the `EnableRbacAuthorization` setting set to `False` or empty, run the following command. ``` Get-AzKeyVaultSecret -VaultName <Vault Name> ``` Make sure the `Expires` setting is configured with a value as appropriate wherever the `Enabled` setting is set to `True`. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [98728c90-32c7-4049-8429-847dc0f4fe37](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F98728c90-32c7-4049-8429-847dc0f4fe37) **- Name:** 'Key Vault secrets should have an expiration date'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/key-vault-whatis:https://docs.microsoft.com/en-us/rest/api/keyvault/about-keys--secrets-and-certificates#key-vault-secrets:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-6-use-a-secure-key-management-process:https://docs.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultsecret?view=azps-7.4.0",
+ "DefaultValue": "By default, secrets do not expire."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.5",
+ "Description": "Ensure 'Purge protection' is Set to 'Enabled'",
+ "Checks": [
+ "keyvault_recoverable"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Purge protection' is Set to 'Enabled'",
+ "RationaleStatement": "Users may accidentally run delete/purge commands on a key vault, or an attacker or malicious user may do so deliberately in order to cause disruption. Deleting or purging a key vault leads to immediate data loss, as keys encrypting data and secrets/certificates allowing access/services will become inaccessible. Enabling purge protection ensures that even if a key vault is deleted, the key vault and its objects remain recoverable during the configurable retention period. If no action is taken, the key vault and its objects will be purged once the retention period elapses.",
+ "ImpactStatement": "Once purge protection is enabled for a key vault, it cannot be disabled.",
+ "RemediationProcedure": "**Note:** Once enabled, purge protection cannot be disabled. **Remediate from Azure Portal** 1. Go to `Key Vaults`. 2. Click the name of a key vault. 3. Under `Settings`, click `Properties`. 4. Select the radio button next to `Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects)`. 5. Click `Save`. 6. Repeat steps 1-5 for each key vault requiring remediation. **Remediate from Azure CLI** For each key vault requiring remediation, run the following command to enable purge protection: ``` az resource update --resource-group <resource-group> --name <key-vault> --resource-type \"Microsoft.KeyVault/vaults\" --set properties.enablePurgeProtection=true ``` **Remediate from PowerShell** For each key vault requiring remediation, run the following command to enable purge protection: ``` Update-AzKeyVault -ResourceGroupName <resource-group> -VaultName <key-vault> -EnablePurgeProtection ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key Vaults`. 2. Click the name of a key vault. 3. Under `Settings`, click `Properties`. 4. Next to `Purge protection`, ensure that `Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects)` is selected. 5. Repeat steps 1-4 for each key vault. **Audit from Azure CLI** Run the following command to list key vaults: ``` az resource list --query \"[?type=='Microsoft.KeyVault/vaults']\" ``` For each key vault, run the following command to get the purge protection setting: ``` az resource show --resource-group <resource-group> --name <key-vault> --resource-type \"Microsoft.KeyVault/vaults\" --query properties.enablePurgeProtection ``` Ensure that `true` is returned. **Audit from PowerShell** Run the following command to list key vaults: ``` Get-AzKeyVault ``` For each key vault, run the following command to get the key vault details: ``` Get-AzKeyVault -ResourceGroupName <resource-group> -VaultName <key-vault> ``` Ensure `Purge Protection Enabled?` is set to `True`. **Audit from Azure Policy** - **Policy ID:** 0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 - **Name:** 'Key vaults should have deletion protection enabled'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-recovery:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository",
+ "DefaultValue": "Purge protection is disabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.6",
+ "Description": "Ensure that Role Based Access Control for Azure Key Vault is Enabled",
+ "Checks": [
+ "keyvault_rbac_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Role Based Access Control for Azure Key Vault is Enabled",
+ "RationaleStatement": "The new RBAC permissions model for Key Vaults enables a much finer grained access control for key vault secrets, keys, certificates, etc., than the vault access policy. This in turn will permit the use of privileged identity management over these roles, thus securing the key vaults with JIT Access management.",
+ "ImpactStatement": "Implementation needs to be properly designed from the ground up, as this is a fundamental change to the way key vaults are accessed/managed. Changing permissions to key vaults will result in loss of service as permissions are re-applied. For the least amount of downtime, map your current groups and users to their corresponding permission needs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** Key Vaults can be configured to use `Azure role-based access control` on creation. For existing Key Vaults: 1. From Azure Home open the Portal Menu in the top left corner 2. Select `Key Vaults` 3. Select a Key Vault to audit 4. Select `Access configuration` 5. Set the Permission model radio button to `Azure role-based access control`, taking note of the warning message 6. Click `Save` 7. Select `Access Control (IAM)` 8. Select the `Role Assignments` tab 9. Reapply permissions as needed to groups or users **Remediate from Azure CLI** To enable RBAC Authorization for each Key Vault, run the following Azure CLI command: ``` az keyvault update --resource-group <resource_group> --name <vault_name> --enable-rbac-authorization true ``` **Remediate from PowerShell** To enable RBAC authorization on each Key Vault, run the following PowerShell command: ``` Update-AzKeyVault -ResourceGroupName <resource_group> -VaultName <vault_name> -EnableRbacAuthorization $True ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home open the Portal Menu in the top left corner 2. Select Key Vaults 3. Select a Key Vault to audit 4. Select Access configuration 5. Ensure the Permission Model radio button is set to `Azure role-based access control` **Audit from Azure CLI** Run the following command for each Key Vault in each Resource Group: ``` az keyvault show --resource-group <resource_group> --name <vault_name> ``` Ensure the `enableRbacAuthorization` setting is set to `true` within the output of the above command. **Audit from PowerShell** Run the following PowerShell command: ``` Get-AzKeyVault -Vaultname <vault_name> -ResourceGroupName <resource_group> ``` Ensure the `Enabled For RBAC Authorization` setting is set to `True` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5) **- Name:** 'Azure Key Vault should use RBAC permission model'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-gb/azure/key-vault/general/rbac-migration#vault-access-policy-to-azure-rbac-migration-steps:https://docs.microsoft.com/en-gb/azure/role-based-access-control/role-assignments-portal?tabs=current:https://docs.microsoft.com/en-gb/azure/role-based-access-control/overview:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository",
+ "DefaultValue": "The default value for Access control in Key Vaults is Vault Policy."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.7",
+ "Description": "Ensure Public Network Access is Disabled",
+ "Checks": [
+ "keyvault_private_endpoints"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Public Network Access is Disabled",
+ "RationaleStatement": "Disabling public network access improves security by ensuring that a service is not exposed on the public internet. Removing a point of interconnection from the internet edge to your key vault can strengthen the network security boundary of your system and reduce the risk of exposing the control plane or vault objects to untrusted clients. Although Azure resources are never truly isolated from the public internet, disabling the public endpoint removes a line of sight from the public internet and increases the effort required for an attack.",
+ "ImpactStatement": "NOTE: Prior to disabling public network access, it is strongly recommended that, for each key vault, either: virtual network integration is completed OR private endpoints/links are set up as described in 'Ensure Private Endpoints are used to access Azure Key Vault.' Disabling public network access restricts access to the service. This enhances security but will require the configuration of a virtual network and/or private endpoints for any services or users needing access within trusted networks.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. Click the name of a key vault. 3. Under `Settings`, click `Networking`. 4. Under `Firewalls and virtual networks`, next to `Allow access from:`, click the radio button next to `Disable public access`. 5. Click `Apply`. 6. Repeat steps 1-5 for each key vault requiring remediation. **Remediate from Azure CLI** For each key vault requiring remediation, run the following command to disable public network access: ``` az keyvault update --resource-group <resource-group> --name <key-vault> --public-network-access Disabled ``` **Remediate from PowerShell** For each key vault requiring remediation, run the following command to disable public network access: ``` Update-AzKeyVault -ResourceGroupName <resource-group> -VaultName <vault-name> -PublicNetworkAccess \"Disabled\" ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. Click the name of a key vault. 3. Under `Settings`, click `Networking`. 4. Under `Firewalls and virtual networks`, ensure that `Allow access from:` is set to `Disable public access`. 5. Repeat steps 1-4 for each key vault. **Audit from Azure CLI** Run the following command to list key vaults: ``` az keyvault list ``` For each key vault, run the following command to get the public network access setting: ``` az keyvault show --resource-group <resource-group> --name <key-vault> --query properties.publicNetworkAccess ``` Ensure that `Disabled` is returned. **Audit from PowerShell** Run the following command to list key vaults: ``` Get-AzKeyVault ``` Run the following command to get the key vault in a resource group with a given name: ``` $vault = Get-AzKeyVault -ResourceGroupName <resource-group> -Name <key-vault> ``` Run the following command to get the public network access setting for the key vault: ``` $vault.PublicNetworkAccess ``` Ensure that `Disabled` is returned. Repeat for each key vault. **Audit from Azure Policy** - **Policy ID:** 405c5871-3e91-4644-8a63-58e19d68ff5b - **Name:** 'Azure Key Vault should disable public network access'",
+ "AdditionalInformation": "This Common Reference Recommendation is referenced in the following Service Recommendations: - Storage Services > Storage Accounts > Networking > **Ensure that 'Public Network Access' is 'Disabled' for storage accounts**",
+ "References": "https://learn.microsoft.com/en-us/azure/key-vault/general/network-security:https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service",
+ "DefaultValue": "Public network access is enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.8",
+ "Description": "Ensure Private Endpoints are Used to Access Azure Key Vault",
+ "Checks": [
+ "keyvault_private_endpoints"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Private Endpoints are Used to Access Azure Key Vault",
+ "RationaleStatement": "Private endpoints will keep network requests to Azure Key Vault limited to the endpoints attached to the resources that are whitelisted to communicate with each other. Assigning the Key Vault to a network without an endpoint will allow other resources on that network to view all traffic from the Key Vault to its destination. In spite of the complexity in configuration, this is recommended for high security secrets.",
+ "ImpactStatement": "Incorrect or poorly-timed changing of network configuration could result in service interruption. There are also additional costs tiers for running a private endpoint per petabyte or more of networking traffic.",
+ "RemediationProcedure": "**Please see the additional information about the requirements needed before starting this remediation procedure.** **Remediate from Azure Portal** 1. From Azure Home open the Portal Menu in the top left. 2. Select Key Vaults. 3. Select a Key Vault to audit. 4. Select `Networking` in the left column. 5. Select `Private endpoint connections` from the top row. 6. Select `+ Create`. 7. Select the subscription the Key Vault is within, and other desired configuration. 8. Select `Next`. 9. For resource type select `Microsoft.KeyVault/vaults`. 10. Select the Key Vault to associate the Private Endpoint with. 11. Select `Next`. 12. In the `Virtual Networking` field, select the network to assign the Endpoint. 13. Select other configuration options as desired, including an existing or new application security group. 14. Select `Next`. 15. Select the private DNS the Private Endpoints will use. 16. Select `Next`. 17. Optionally add `Tags`. 18. Select `Next : Review + Create`. 19. Review the information and select `Create`. Follow the Audit Procedure to determine if it has successfully applied. 20. Repeat steps 3-19 for each Key Vault. **Remediate from Azure CLI** 1. To create an endpoint, run the following command: ``` az network private-endpoint create --resource-group <resourceGroup --vnet-name <vnetName> --subnet <subnetName> --name <PrivateEndpointName> --private-connection-resource-id /subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<resourceGroup>/providers/Microsoft.KeyVault/vaults/<keyVaultName> --group-ids vault --connection-name <privateLinkConnectionName> --location <azureRegion> --manual-request ``` 2. To manually approve the endpoint request, run the following command: ``` az keyvault private-endpoint-connection approve --resource-group <resourceGroup> --vault-name <keyVaultName> –name <privateLinkName> ``` 3. Determine the Private Endpoint's IP address to connect the Key Vault to the Private DNS you have previously created: 4. Look for the property networkInterfaces then id; the value must be placed in the variable <privateEndpointNIC> within step 7. ``` az network private-endpoint show -g <resourceGroupName> -n <privateEndpointName> ``` 5. Look for the property networkInterfaces then id; the value must be placed on <privateEndpointNIC> in step 7. ``` az network nic show --ids <privateEndpointName> ``` 6. Create a Private DNS record within the DNS Zone you created for the Private Endpoint: ``` az network private-dns record-set a add-record -g <resourcecGroupName> -z privatelink.vaultcore.azure.net -n <keyVaultName> -a <privateEndpointNIC> ``` 7. nslookup the private endpoint to determine if the DNS record is correct: ``` nslookup <keyVaultName>.vault.azure.net nslookup <keyVaultName>.privatelink.vaultcore.azure.n ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. From Azure Home open the Portal Menu in the top left. 2. Select Key Vaults. 3. Select a Key Vault to audit. 4. Select `Networking` in the left column. 5. Select `Private endpoint connections` from the top row. 6. View if there is an endpoint attached. **Audit from Azure CLI** Run the following command within a subscription for each Key Vault you wish to audit. ``` az keyvault show --name <keyVaultName> ``` Ensure that `privateEndpointConnections` is not `null`. **Audit from PowerShell** Run the following command within a subscription for each Key Vault you wish to audit. ``` Get-AzPrivateEndpointConnection -PrivateLinkResourceId '/subscriptions/<subscriptionNumber>/resourceGroups/<resourceGroup>/providers/Microsoft.KeyVault/vaults/<keyVaultName>/' ``` Ensure that the response contains details of a private endpoint. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [a6abeaec-4d90-4a02-805f-6b26c4d3fbe9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa6abeaec-4d90-4a02-805f-6b26c4d3fbe9) **- Name:** 'Azure Key Vaults should use private link'",
+ "AdditionalInformation": "This recommendation assumes that you have created a Resource Group containing a Virtual Network that the services are already associated with and configured private DNS. A Bastion on the virtual network is also required, and the service to which you are connecting must already have a Private Endpoint. For information concerning the installation of these services, please see the attached documentation. Microsoft's own documentation lists the requirements as: A Key Vault. An Azure virtual network. A subnet in the virtual network. Owner or contributor permissions for both the Key Vault and the virtual network.",
+ "References": "https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview:https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints:https://azure.microsoft.com/en-us/pricing/details/private-link/:https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal:https://docs.microsoft.com/en-us/azure/virtual-network/quick-create-portal:https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal:https://docs.microsoft.com/en-us/azure/bastion/bastion-overview:https://docs.microsoft.com/azure/dns/private-dns-getstarted-cli#create-an-additional-dns-record:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository",
+ "DefaultValue": "By default, Private Endpoints are not enabled for any services within Azure."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.9",
+ "Description": "Ensure Automatic Key Rotation is Enabled within Azure Key Vault",
+ "Checks": [
+ "keyvault_key_rotation_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Automatic Key Rotation is Enabled within Azure Key Vault",
+ "RationaleStatement": "Automatic key rotation reduces risk by ensuring that keys are rotated without manual intervention. Azure and NIST recommend that keys be rotated every two years or less. Refer to 'Table 1: Suggested cryptoperiods for key types' on page 46 of the following document for more information: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf.",
+ "ImpactStatement": "There is an additional cost for each scheduled key rotation.",
+ "RemediationProcedure": "**Note:** Azure CLI and PowerShell use the ISO8601 duration format for time spans. The format is `P<timespanInISO8601Format>(Y,M,D)`. The leading P is required and is referred to as `period`. The `(Y,M,D)` are for the duration of Year, Month, and Day, respectively. A time frame of 2 years, 2 months, 2 days would be `P2Y2M2D`. For Azure CLI and PowerShell, it is easiest to supply the policy flags in a `.json file`, for example: ``` { lifetimeActions: [ { trigger: { timeAfterCreate: P<timespanInISO8601Format>(Y,M,D), timeBeforeExpiry : null }, action: { type: Rotate } }, { trigger: { timeBeforeExpiry : P<timespanInISO8601Format>(Y,M,D) }, action: { type: Notify } } ], attributes: { expiryTime: P<timespanInISO8601Format>(Y,M,D) } } ``` **Remediate from Azure Portal** 1. Go to `Key Vaults`. 1. Select a Key Vault. 1. Under `Objects`, select `Keys`. 1. Select a key. 1. From the top row, select `Rotation policy`. 1. Select an appropriate `Expiry time`. 1. Set `Enable auto rotation` to `Enabled`. 1. Set an appropriate `Rotation option` and `Rotation time`. 1. Optionally, set a `Notification time`. 1. Click `Save`. 1. Repeat steps 1-10 for each Key Vault and Key. **Remediate from Azure CLI** Run the following command for each key to enable automatic rotation: ``` az keyvault key rotation-policy update --vault-name <vault-name> --name <key-name> --value <path/to/policy.json> ``` **Remediate from PowerShell** Run the following command for each key to enable automatic rotation: ``` Set-AzKeyVaultKeyRotationPolicy -VaultName <vault-name> -Name <key-name> -PolicyPath <path/to/policy.json> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key Vaults`. 1. Select a Key Vault. 1. Under `Objects`, select `Keys`. 1. Select a key. 1. From the top row, select `Rotation policy`. 1. Ensure `Enable auto rotation` is set to `Enabled`. 1. Ensure the `Rotation time` is set to an appropriate value. 1. Repeat steps 1-7 for each Key Vault and Key. **Audit from Azure CLI** Run the following command: ``` az keyvault key rotation-policy show --vault-name <vault-name> --name <key-name> ``` Ensure that the response contains a `lifetimeAction` of `Rotate` and that `timeAfterCreate` is set to an appropriate value. **Audit from PowerShell** Run the following command: ``` Get-AzKeyVaultKeyRotationPolicy -VaultName <vault-name> -Name <key-name> ``` Ensure that the response contains a `LifetimeAction` of `Rotate` and that `TimeAfterCreate` is set to an appropriate value. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [d8cf8476-a2ec-4916-896e-992351803c44](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fd8cf8476-a2ec-4916-896e-992351803c44) **- Name:** 'Keys should have a rotation policy ensuring that their rotation is scheduled within the specified number of days after creation.'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation:https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#update-the-key-version:https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-enable-customer-managed-keys-powershell#set-up-an-azure-key-vault-and-diskencryptionset-optionally-with-automatic-key-rotation:https://azure.microsoft.com/en-us/updates/public-preview-automatic-key-rotation-of-customermanaged-keys-for-encrypting-azure-managed-disks/:https://docs.microsoft.com/en-us/cli/azure/keyvault/key/rotation-policy?view=azure-cli-latest#az-keyvault-key-rotation-policy-update:https://docs.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultkeyrotationpolicy?view=azps-8.1.0:https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/timespan:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-6-use-a-secure-key-management-process:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf",
+ "DefaultValue": "By default, automatic key rotation is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "8.3.10",
+ "Description": "Ensure that Azure Key Vault Managed HSM is Used when Required",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Azure Key Vault Managed HSM is Used when Required",
+ "RationaleStatement": "Managed HSM is a fully managed, highly available, single-tenant service that ensures FIPS 140-2 Level 3 compliance. It provides centralized key management, isolated access control, and private endpoints for secure access. Integrated with Azure services, it supports migration from Key Vault, ensures data residency, and offers monitoring and auditing for enhanced security.",
+ "ImpactStatement": "Managed HSM incurs a cost of $0.40 to $5 per month for each actively used HSM-protected key, depending on the key type and quantity. Each key version is billed separately. Additionally, there is an hourly usage fee of $3.20 per Managed HSM pool.",
+ "RemediationProcedure": "**Remediate from Azure CLI** Run the following command to set `oid` to be the `OID` of the signed-in user: ``` $oid = az ad signed-in-user show --query id -o tsv ``` Alternatively, prepare a space-separated list of OIDs to be provided as the `administrators` of the HSM. Run the following command to create a Managed HSM: ``` az keyvault create --resource-group <resource-group> --hsm-name <hsm-name> --retention-days <retention-days> --administrators $oid ``` The command can take several minutes to complete. After the HSM has been created, it must be activated before it can be used. Activation requires providing a minimum of three and a maximum of ten RSA key pairs, as well as the minimum number of keys required to decrypt the security domain (called a quorum). OpenSSL can be used to generate the self-signed certificates, for example: ``` openssl req -newkey rsa:2048 -nodes -keyout cert_1.key -x509 -days 365 -out cert_1.cer ``` Run the following command to download the security domain and activate the Managed HSM: ``` az keyvault security-domain download --hsm-name <managed-hsm> --sd-wrapping-keys <key-1> <key-2> <key-3> --sd-quorum <quorum> --security-domain-file <managed-hsm-security-domain>.json ``` Store the security domain file and the RSA key pairs securely. They will be required for disaster recovery or for creating another Managed HSM that shares the same security domain so that the two can share keys. The Managed HSM will now be in an active state and ready for use.",
+ "AuditProcedure": "**Audit from Azure CLI** Run the following command to list key vaults: ``` az keyvault list --query [*].[name,type] ``` Ensure that at least one key vault with type `Microsoft.KeyVault/managedHSMs` exists.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose:https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview:https://azure.microsoft.com/en-gb/pricing/details/key-vault/:https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/quick-create-cli:https://learn.microsoft.com/en-us/cli/azure/keyvault",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "8.3.11",
+ "Description": "Ensure Certificate 'Validity Period (in months)' is Less Than or Equal to '12'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.3 Key Vault",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Certificate 'Validity Period (in months)' is Less Than or Equal to '12'",
+ "RationaleStatement": "Limiting certificate validity reduces the risk of misuse if compromised and helps ensure timely renewal, improving security and reliability.",
+ "ImpactStatement": "Minor administrative effort required to ensure certificate renewal and lifecycle management.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Key vaults`. 2. Click the name of a key vault. 3. Under `Objects`, click `Certificates`. 4. Click the name of a certificate. 5. Click `Issuance Policy`. 6. Set `Validity Period (in months)` to an integer between 1 and 12, inclusive. 7. Click `Save`. 8. Repeat steps 1-7 for each key vault and certificate requiring remediation. **Remediate from PowerShell** For each certificate requiring remediation, run the following command to set ValidityInMonths to an integer between 1 and 12, inclusive: ``` Set-AzKeyVaultCertificatePolicy -VaultName $vault.VaultName -Name <certificate-name> -ValidityInMonths <validity-in-months> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Key vaults`. 2. Click the name of a key vault. 3. Under `Objects`, click `Certificates`. 4. Click the name of a certificate. 5. Click `Issuance Policy`. 6. Ensure that `Validity Period (in months)` is set to 12 or less. 7. Repeat steps 1-6 for each key vault and certificate. **Audit from Azure CLI** Run the following command to list key vaults: ``` az keyvault list ``` For each key vault, run the following command to list certificates: ``` az keyvault certificate list --vault-name <key-vault-name> ``` For each certificate, run the following command to get the certificate policy's validityInMonths setting: ``` az keyvault certificate show --id <certificate-id> --query policy.x509CertificateProperties.validityInMonths ``` Ensure that 12 or less is returned. **Audit from PowerShell** Run the following command to list key vaults: ``` Get-AzKeyVault ``` Run the following command to get the key vault with a given name: ``` $vault = Get-AzKeyVault -Name <key-vault-name> ``` Run the following command to list certificates in the key vault: ``` Get-AzKeyVaultCertificate -VaultName $vault.VaultName ``` Run the following command to get the policy of a certificate with a given name: ``` $certificate = Get-AzKeyVaultCertificatePolicy -VaultName $vault.VaultName -Name <certificate-name> ``` Run the following command to get the certificate policy's ValidityInMonths setting: ``` $certificate.ValidityInMonths ``` Ensure that 12 or less is returned. Repeat for each key vault and certificate. **Audit from Azure Policy** - **Policy ID:** 0a075868-4c26-42ef-914c-5bc007359560 - **Name:** 'Certificates should have the specified maximum validity period'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates:https://learn.microsoft.com/en-us/cli/azure/keyvault:https://learn.microsoft.com/en-us/powershell/module/az.keyvault",
+ "DefaultValue": "Validity Period (in months) is set to 12 by default."
+ }
+ ]
+ },
+ {
+ "Id": "8.4.1",
+ "Description": "Ensure an Azure Bastion Host Exists",
+ "Checks": [
+ "network_bastion_host_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "SubSection": "8.4 Azure Bastion",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure an Azure Bastion Host Exists",
+ "RationaleStatement": "The Azure Bastion service allows organizations a more secure means of accessing Azure Virtual Machines over the Internet without assigning public IP addresses to those Virtual Machines. The Azure Bastion service provides Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to Virtual Machines using TLS within a web browser, thus preventing organizations from opening up 3389/TCP and 22/TCP to the Internet on Azure Virtual Machines. Additional benefits of the Bastion service includes Multi-Factor Authentication, Conditional Access Policies, and any other hardening measures configured within Azure Active Directory using a central point of access.",
+ "ImpactStatement": "The Azure Bastion service incurs additional costs and requires a specific virtual network configuration. The `Standard` tier offers additional configuration options compared to the `Basic` tier and may incur additional costs for those added features.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Click on `Bastions` 2. Select the `Subscription` 3. Select the `Resource group` 4. Type a `Name` for the new Bastion host 5. Select a `Region` 6. Choose `Standard` next to `Tier` 7. Use the slider to set the `Instance count` 8. Select the `Virtual network` or `Create new` 9. Select the `Subnet` named `AzureBastionSubnet`. Create a `Subnet` named `AzureBastionSubnet` using a `/26` CIDR range if it doesn't already exist. 10. Select the appropriate `Public IP address` option. 11. If `Create new` is selected for the `Public IP address` option, provide a `Public IP address name`. 12. If `Use existing` is selected for `Public IP address` option, select an IP address from `Choose public IP address` 13. Click `Next: Tags >` 14. Configure the appropriate `Tags` 15. Click `Next: Advanced >` 16. Select the appropriate `Advanced` options 17. Click `Next: Review + create >` 18. Click `Create` **Remediate from Azure CLI** ``` az network bastion create --location <location> --name <name of bastion host> --public-ip-address <public IP address name or ID> --resource-group <resource group name or ID> --vnet-name <virtual network containing subnet called AzureBastionSubnet> --scale-units <integer> --sku Standard [--disable-copy-paste true|false] [--enable-ip-connect true|false] [--enable-tunneling true|false] ``` **Remediate from PowerShell** Create the appropriate `Virtual network` settings and `Public IP Address` settings. ``` $subnetName = AzureBastionSubnet $subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix <IP address range in CIDR notation making sure to use a /26> $virtualNet = New-AzVirtualNetwork -Name <virtual network name> -ResourceGroupName <resource group name> -Location <location> -AddressPrefix <IP address range in CIDR notation> -Subnet $subnet $publicip = New-AzPublicIpAddress -ResourceGroupName <resource group name> -Name <public IP address name> -Location <location> -AllocationMethod Dynamic -Sku Standard ``` Create the `Azure Bastion` service using the information within the created variables from above. ``` New-AzBastion -ResourceGroupName <resource group name> -Name <bastion name> -PublicIpAddress $publicip -VirtualNetwork $virtualNet -Sku Standard -ScaleUnit <integer> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Click on `Bastions` 2. Ensure there is at least one `Bastion` host listed under the `Name` column **Audit from Azure CLI** **Note:** The Azure CLI `network bastion` module is in `Preview` as of this writing ``` az network bastion list --subscription <subscription ID> ``` Ensure the output of the above command is not empty. **Audit from PowerShell** Retrieve the `Bastion` host(s) information for a specific `Resource Group` ``` Get-AzBastion -ResourceGroupName <resource group name> ``` Ensure the output of the above command is not empty.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku:https://learn.microsoft.com/en-us/powershell/module/az.network/get-azbastion?view=azps-9.2.0:https://learn.microsoft.com/en-us/cli/azure/network/bastion?view=azure-cli-latest",
+ "DefaultValue": "By default, the Azure Bastion service is not configured."
+ }
+ ]
+ },
+ {
+ "Id": "8.5",
+ "Description": "Ensure Azure DDoS Network Protection is Enabled on Virtual Networks",
+ "Checks": [
+ "network_vnet_ddos_protection_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Security Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Azure DDoS Network Protection is Enabled on Virtual Networks",
+ "RationaleStatement": "Virtual networks and resources are protected against attacks, helping to ensure reliability and availability for critical workloads.",
+ "ImpactStatement": "Azure DDoS Network Protection incurs a significant fixed monthly charge, with additional charges if more than 100 public IP resources are protected. Careful consideration and analysis should be applied before enabling DDoS protection. Refer to https://azure.microsoft.com/en-us/pricing/details/ddos-protection for detailed pricing information.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Virtual networks`. 2. Click the name of a virtual network. 3. Under `Settings`, click `DDoS protection`. 4. Next to `DDoS Network Protection`, click `Enable`. 5. Provide a DDoS protection plan resource ID, or select a DDoS protection plan from the drop-down menu. 6. Click `Save`. 7. Repeat steps 1-6 for each virtual network requiring remediation. **Remediate from Azure CLI** For each virtual network requiring remediation, run the following command to enable DDoS protection: ``` az network vnet update --resource-group <resource-group> --name <virtual-network> --ddos-protection true --ddos-protection-plan <ddos-protection-plan> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Virtual networks`. 2. Click the name of a virtual network. 3. Under `Settings`, click `DDoS protection`. 4. Ensure `DDoS Network Protection` is set to `Enable`. 5. Repeat steps 1-4 for each virtual network. **Audit from Azure CLI** Run the following command to list virtual networks: ``` az network vnet list ``` For each virtual network, run the following command to get the DDoS protection setting: ``` az network vnet show --resource-group <resource-group> --name <virtual-network> --query enableDdosProtection ``` Ensure `true` is returned. **Audit from Azure Policy** - **Policy ID:** a7aca53f-2ed4-4466-a25e-0b45ade68efd - **Name:** 'Azure DDoS Protection should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview:https://learn.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection:https://azure.microsoft.com/en-us/pricing/details/ddos-protection:https://learn.microsoft.com/en-us/cli/azure/network/vnet",
+ "DefaultValue": "DDoS protection is disabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "9.1.1",
+ "Description": "Ensure Soft Delete for Azure File Shares is Enabled",
+ "Checks": [
+ "storage_ensure_file_shares_soft_delete_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.1 Azure Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Soft Delete for Azure File Shares is Enabled",
+ "RationaleStatement": "Important data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, the data is retained for the defined retention period before permanent deletion, allowing for recovery of the data.",
+ "ImpactStatement": "When a file share is soft-deleted, the used portion of the storage is charged for the indicated soft-deleted period. All other meters are not charged unless the share is restored.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account with file shares, under `Data storage`, click `File shares`. 1. Under `File share settings`, click the value next to `Soft delete`. 1. Under `Soft delete for all file shares`, click the toggle to set it to `Enabled`. 1. Under `Retention policies`, set an appropriate number of days to retain soft deleted data between 1 and 365, inclusive. 1. Click `Save`. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable soft delete for file shares and set an appropriate number of days for deleted data to be retained, between 1 and 365, inclusive: ``` az storage account file-service-properties update --account-name <storage-account> --enable-delete-retention true --delete-retention-days <retention-days> ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to enable soft delete for file shares and set an appropriate number of days for deleted data to be retained, between 1 and 365, inclusive: ``` Update-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> -EnableShareDeleteRetentionPolicy $true -ShareRetentionDays <retention-days> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account with file shares, under `Data storage`, click on `File shares`. 1. Under `File share settings`, ensure the value for `Soft delete` shows a number of days between 1 and 365, inclusive. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` Run the following command to determine if a storage account has file shares: ``` az storage share list --account-name <storage-account> ``` For each storage account with file shares, run the following command: ``` az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account> ``` Ensure that under `shareDeleteRetentionPolicy`, `enabled` is set to `true`, and `days` is set to an appropriate value between 1 and 365, inclusive. **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount -ResourceGroupName <resource-group> ``` With a storage account context set, run the following command to determine if a storage account has file shares: ``` Get-AzStorageShare ``` For each storage account with file shares, run the following command: ``` Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> ``` Ensure that `ShareDeleteRetentionPolicy.Enabled` is set to `True` and `ShareDeleteRetentionPolicy.Days` is set to an appropriate value between 1 and 365, inclusive.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-enable-soft-delete:https://learn.microsoft.com/en-us/cli/azure/storage/account/file-service-properties:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstoragefileserviceproperty:https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstoragefileserviceproperty:https://learn.microsoft.com/en-us/azure/storage/files/storage-files-prevent-file-share-deletion",
+ "DefaultValue": "Soft delete is enabled by default at the storage account file share setting level."
+ }
+ ]
+ },
+ {
+ "Id": "9.1.2",
+ "Description": "Ensure 'SMB protocol version' is Set to 'SMB 3.1.1' or Higher for SMB file shares",
+ "Checks": [
+ "storage_smb_protocol_version_is_latest"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.1 Azure Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'SMB protocol version' is Set to 'SMB 3.1.1' or Higher for SMB file shares",
+ "RationaleStatement": "Using the latest supported SMB protocol version enhances the security of SMB file shares by preventing the exploitation of known vulnerabilities in outdated SMB versions.",
+ "ImpactStatement": "Using the latest SMB protocol version may impact client compatibility.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Data storage`, click `File shares`. 1. Under `File share settings`, click the link next to `Security`. 1. If `Profile` is set to `Maximum compatibility`, click the drop-down menu and select `Maximum security` or `Custom`. 1. If selecting `Custom`, under `SMB protocol versions`, uncheck the boxes next to `SMB 2.1` and `SMB 3.0`. 1. Click `Save`. 1. Repeat steps 1-7 for each storage account requiring remediation. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to set the SMB protocol version: ``` az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account> --versions SMB3.1.1 ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to set the SMB protocol version: ``` Update-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -SmbProtocolVersion SMB3.1.1 ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Data storage`, click `File shares`. 1. Under `File share settings`, click the link next to `Security`. 1. Under `SMB protocol versions`, ensure that `SMB3.1.1` is the only checked protocol version. 1. Repeat steps 1-5 for each storage account. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` For each storage account, run the following command: ``` az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account> ``` Ensure that under `protocolSettings` > `smb`, `versions` is set to `SMB3.1.1;` only. **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount ``` Run the following command to get the file service properties for a storage account in a resource group with a given name: ``` $storageaccountfileservice = Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> ``` Run the following command to get the SMB protocol version setting: ``` $storageaccountfileservice.ProtocolSettings.Smb.Versions ``` Ensure that the command returns `SMB3.1.1` only. Repeat for each storage account.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-files#recommendations-for-smb-file-shares:https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol#smb-security-settings:https://learn.microsoft.com/en-us/cli/azure/storage/account/file-service-properties:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstoragefileserviceproperty:https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstoragefileserviceproperty",
+ "DefaultValue": "By default, all SMB versions are allowed."
+ }
+ ]
+ },
+ {
+ "Id": "9.1.3",
+ "Description": "Ensure 'SMB channel encryption' is Set to 'AES-256-GCM' or Higher for SMB file shares",
+ "Checks": [
+ "storage_smb_channel_encryption_with_secure_algorithm"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.1 Azure Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'SMB channel encryption' is Set to 'AES-256-GCM' or Higher for SMB file shares",
+ "RationaleStatement": "AES-256-GCM encryption enhances the security of data transmitted over SMB channels by safeguarding it from unauthorized interception and tampering.",
+ "ImpactStatement": "Using the AES-256-GCM SMB channel encryption may impact client compatibility.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Data storage`, click `File shares`. 1. Under `File share settings`, click the link next to `Security`. 1. If `Profile` is set to `Maximum compatibility`, click the drop-down menu and select `Maximum security` or `Custom`. 1. If selecting `Custom`, under `SMB channel encryption`, uncheck the boxes next to `AES-128-CCM` and `AES-128-GCM`. 1. Click `Save`. 1. Repeat steps 1-7 for each storage account requiring remediation. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to set the SMB channel encryption: ``` az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account> --channel-encryption AES-256-GCM ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to set the SMB channel encryption: ``` Update-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -SmbChannelEncryption AES-256-GCM ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Data storage`, click `File shares`. 1. Under `File share settings`, click the link next to `Security`. 1. Under `SMB channel encryption`, ensure that `AES-256-GCM`, or higher, is the only checked SMB channel encryption setting. 1. Repeat steps 1-5 for each storage account. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` For each storage account, run the following command: ``` az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account> ``` Ensure that under `protocolSettings` > `smb`, `channelEncryption` is set to `AES-256-GCM;`, or higher, only. **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount ``` Run the following command to get the file service properties for a storage account in a resource group with a given name: ``` $storageaccountfileservice = Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> ``` Run the following command to get the SMB channel encryption setting: ``` $storageaccountfileservice.ProtocolSettings.Smb.ChannelEncryption ``` Ensure that the command returns `AES-256-GCM`, or higher, only. Repeat for each storage account.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-files#recommendations-for-smb-file-shares:https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol?tabs=azure-portal#smb-security-settings:https://learn.microsoft.com/en-us/cli/azure/storage/account/file-service-properties:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstoragefileserviceproperty:https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstoragefileserviceproperty",
+ "DefaultValue": "By default, the following SMB channel encryption algorithms are allowed: - AES-128-CCM - AES-128-GCM - AES-256-GCM"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
+ ]
+ },
+ {
+ "Id": "9.2.1",
+ "Description": "Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled",
+ "Checks": [
+ "storage_ensure_soft_delete_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.2 Azure Blob Storage",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled",
+ "RationaleStatement": "Blobs can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting an Azure storage blob results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if blobs are deleted from the storage account, the blobs are recoverable for a specific period of time, which is defined in the Retention policies, ranging from 7 to 365 days.",
+ "ImpactStatement": "All soft-deleted data is billed at the same rate as active data. Additional costs may be incurred for deleted blobs until the soft delete period ends and the data is permanently removed.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each Storage Account with blob storage, under `Data management`, go to `Data protection`. 1. Check the box next to `Enable soft delete for blobs`. 1. Set the retention period to a sufficient length for your organization. 1. Click `Save`. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable soft delete for blobs: ``` az storage blob service-properties delete-policy update --days-retained <retention-days> --account-name <storage-account> --enable true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each Storage Account with blob storage, under `Data management`, go to `Data protection`. 1. Ensure that `Enable soft delete for blobs` is checked. 1. Ensure that the retention period is a sufficient length for your organization. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` Run the following command to determine if a storage account has containers: ``` az storage container list --account-name <storage-account> ``` For each storage account with containers, ensure that the output of the below command contains `enabled: true` and `days` is not `null`: ``` az storage blob service-properties delete-policy show --account-name <storage-account> ```",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview",
+ "DefaultValue": "Soft delete for blob storage is **enabled** by default on storage accounts created via the Azure Portal, and **disabled** by default on storage accounts created via Azure CLI or PowerShell."
+ }
+ ]
+ },
+ {
+ "Id": "9.2.2",
+ "Description": "Ensure that Soft Delete for Containers on Azure Blob Storage Storage Accounts is Enabled",
+ "Checks": [
+ "storage_ensure_soft_delete_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.2 Azure Blob Storage",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that Soft Delete for Containers on Azure Blob Storage Storage Accounts is Enabled",
+ "RationaleStatement": "Blobs can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting an Azure storage blob results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if blobs are deleted from the storage account, the blobs are recoverable for a specific period of time, which is defined in the Retention policies, ranging from 7 to 365 days.",
+ "ImpactStatement": "All soft-deleted data is billed at the same rate as active data. Additional costs may be incurred for deleted blobs until the soft delete period ends and the data is permanently removed.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each Storage Account with blob storage, under `Data management`, go to `Data protection`. 1. Check the box next to `Enable soft delete for blobs`. 1. Set the retention period to a sufficient length for your organization. 1. Click `Save`. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable soft delete for blobs: ``` az storage blob service-properties delete-policy update --days-retained <retention-days> --account-name <storage-account> --enable true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each Storage Account with blob storage, under `Data management`, go to `Data protection`. 1. Ensure that `Enable soft delete for blobs` is checked. 1. Ensure that the retention period is a sufficient length for your organization. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` Run the following command to determine if a storage account has containers: ``` az storage container list --account-name <storage-account> ``` For each storage account with containers, ensure that the output of the below command contains `enabled: true` and `days` is not `null`: ``` az storage blob service-properties delete-policy show --account-name <storage-account> ```",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview",
+ "DefaultValue": "Soft delete for blob storage is **enabled** by default on storage accounts created via the Azure Portal, and **disabled** by default on storage accounts created via Azure CLI or PowerShell."
+ }
+ ]
+ },
+ {
+ "Id": "9.2.3",
+ "Description": "Ensure 'Versioning' is Set to 'Enabled' on Azure Blob Storage Storage Accounts",
+ "Checks": [
+ "storage_blob_versioning_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.2 Azure Blob Storage",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Versioning' is Set to 'Enabled' on Azure Blob Storage Storage Accounts",
+ "RationaleStatement": "Blob versioning safeguards data integrity and enables recovery by retaining previous versions of stored objects, facilitating quick restoration from accidental deletion, modification, or malicious activity.",
+ "ImpactStatement": "Enabling blob versioning for a storage account creates a new version with each write operation to a blob, which can increase storage costs. To control these costs, a lifecycle management policy can be applied to automatically delete older versions.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account with blob storage. 1. In the `Overview` page, on the `Properties` tab, under `Blob service`, click `Disabled` next to `Versioning`. 1. Under `Tracking`, check the box next to `Enable versioning for blobs`. 1. Select the radio button next to `Keep all versions` or `Delete versions after (in days)`. 1. If selecting to delete versions, enter a number of in the box after which to delete blob versions. 1. Click `Save`. 1. Repeat steps 1-7 for each storage account with blob storage. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable blob versioning: ``` az storage account blob-service-properties update --account-name <storage-account> --enable-versioning true ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to enable blob versioning: ``` Update-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -IsVersioningEnabled $true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account with blob storage. 1. In the `Overview` page, on the `Properties` tab, under `Blob service`, ensure `Versioning` is set to `Enabled`. 1. Repeat steps 1-3 for each storage account with blob storage. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` Run the following command to determine if a storage account has containers: ``` az storage container list --account-name <storage-account> ``` For each storage account with containers, ensure that the output of the below command contains `isVersioningEnabled: true`: ``` az storage account blob-service-properties show --account-name <storage-account> ``` **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount ``` Run the following command to create an Azure Storage context for a storage account: ``` $context = New-AzStorageContext -StorageAccountName <storage-account> ``` Run the following command to list containers for the storage account: ``` Get-AzStorageContainer -Context $context ``` If the storage account has containers, run the following command to get the blob service properties of the storage account: ``` $account = Get-AzStorageBlobServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> ``` Run the following command to get the blob versioning setting for the storage account: ``` $account.IsVersioningEnabled ``` Ensure that the command returns `True`. Repeat for each storage account. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [c36a325b-ae04-4863-ad4f-19c6678f8e08](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc36a325b-ae04-4863-ad4f-19c6678f8e08) **- Name:** 'Configure your Storage account to enable blob versioning'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/cli/azure/storage/account:https://learn.microsoft.com/en-us/cli/azure/storage/account/blob-service-properties:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstorageaccount:https://learn.microsoft.com/en-us/powershell/module/az.storage/new-azstoragecontext:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstoragecontainer:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstorageblobserviceproperty:https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstorageblobserviceproperty:https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview:https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",
+ "DefaultValue": "Blob versioning is disabled by default on storage accounts."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.1.1",
+ "Description": "Ensure That 'Enable key rotation reminders' is Enabled for Each Storage Account",
+ "Checks": [
+ "storage_infrastructure_encryption_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That 'Enable key rotation reminders' is Enabled for Each Storage Account",
+ "RationaleStatement": "Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities which improve the overall efficacy of a security program. Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly,' and advises that keys for static data stores be rotated every 'few months.' For the purposes of this recommendation, 90 days will be prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.",
+ "ImpactStatement": "This recommendation only creates a periodic reminder to regenerate access keys. Regenerating access keys can affect services in Azure as well as the organization's applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts` 1. For each Storage Account that is not compliant, under `Security + networking`, go to `Access keys` 1. Click `Set rotation reminder` 1. Check `Enable key rotation reminders` 1. In the `Send reminders` field select `Custom`, then set the `Remind me every` field to `90` and the period drop down to `Days` 1. Click `Save` **Remediate from Powershell** ``` $rgName = <resource group name for the storage> $accountName = <storage account name> $account = Get-AzStorageAccount -ResourceGroupName $rgName -Name $accountName if ($account.KeyCreationTime.Key1 -eq $null -or $account.KeyCreationTime.Key2 -eq $null){ Write-output (You must regenerate both keys at least once before setting expiration policy) } else { $account = Set-AzStorageAccount -ResourceGroupName $rgName -Name $accountName -KeyExpirationPeriodInDay 90 } $account.KeyPolicy.KeyExpirationPeriodInDays ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts` 2. For each Storage Account, under `Security + networking`, go to `Access keys` 3. If the button `Edit rotation reminder` is displayed, the Storage Account is compliant. Click `Edit rotation reminder` and review the `Remind me every` field for a desirable periodic setting that fits your security program's needs. If the button `Set rotation reminder` is displayed, the Storage Account is not compliant. **Audit from Powershell** ``` $rgName = <resource group name for the storage> $accountName = <storage account name> $account = Get-AzStorageAccount -ResourceGroupName $rgName -Name $accountName Write-Output $accountName -> Write-Output Expiration Reminder set to: $($account.KeyPolicy.KeyExpirationPeriodInDays) Days Write-Output Key1 Last Rotated: $($account.KeyCreationTime.Key1.ToShortDateString()) Write-Output Key2 Last Rotated: $($account.KeyCreationTime.Key2.ToShortDateString()) ``` Key rotation is recommended if the creation date for any key is empty. If the reminder is set, the period in days will be returned. The recommended period is 90 days. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [044985bb-afe1-42cd-8a36-9d5d42424537](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F044985bb-afe1-42cd-8a36-9d5d42424537) **- Name:** 'Storage account keys should not be expired'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#regenerate-storage-access-keys:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-3-manage-application-identities-securely-and-automatically:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-8-restrict-the-exposure-of-credentials-and-secrets:https://www.pcidssguide.com/pci-dss-key-rotation-requirements/:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf",
+ "DefaultValue": "By default, Key rotation reminders are not configured."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.1.2",
+ "Description": "Ensure That Storage Account Access keys are Periodically Regenerated",
+ "Checks": [
+ "storage_key_rotation_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure That Storage Account Access keys are Periodically Regenerated",
+ "RationaleStatement": "When a storage account is created, Azure generates two 512-bit storage access keys which are used for authentication when the storage account is accessed. Rotating these keys periodically ensures that any inadvertent access or exposure does not result from the compromise of these keys. Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly,' and advises that keys for static data stores be rotated every 'few months.' For the purposes of this recommendation, 90 days will be prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.",
+ "ImpactStatement": "Regenerating access keys can affect services in Azure as well as the organization's applications that are dependent on the storage account. All clients who use the access key to access the storage account must be updated to use the new key.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 2. For each Storage Account with outdated keys, under `Security + networking`, go to `Access keys`. 3. Click `Rotate key` next to the outdated key, then click `Yes` to the prompt confirming that you want to regenerate the access key. After Azure regenerates the Access Key, you can confirm that `Access keys` reflects a `Last rotated` date of `(0 days ago)`.",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 2. For each Storage Account, under `Security + networking`, go to `Access keys`. 3. Review the date and days in the `Last rotated` field for **each** key. If the `Last rotated` field indicates a number or days greater than 90 [or greater than your organization's period of validity], the key should be rotated. **Audit from Azure CLI** 1. Get a list of storage accounts ``` az storage account list --subscription <subscription-id> ``` Make a note of `id`, `name` and `resourceGroup`. 2. For every storage account make sure that key is regenerated in the past 90 days. ``` az monitor activity-log list --namespace Microsoft.Storage --offset 90d --query [?contains(authorization.action, 'regenerateKey')] --resource-id <resource id> ``` The output should contain ``` authorization/scope: <your_storage_account> AND authorization/action: Microsoft.Storage/storageAccounts/regeneratekey/action AND status/localizedValue: Succeeded status/Value: Succeeded ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [044985bb-afe1-42cd-8a36-9d5d42424537](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F044985bb-afe1-42cd-8a36-9d5d42424537) **- Name:** 'Storage account keys should not be expired'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#regenerate-storage-access-keys:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-2-protect-identity-and-authentication-systems:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy:https://www.pcidssguide.com/pci-dss-key-rotation-requirements/:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf",
+ "DefaultValue": "By default, access keys are not regenerated periodically."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.1.3",
+ "Description": "Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'",
+ "Checks": [
+ "storage_account_key_access_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'",
+ "RationaleStatement": "Microsoft Entra ID provides superior security and ease of use compared to Shared Key and is recommended by Microsoft. To require clients to use Microsoft Entra ID for authorizing requests, you can disallow requests to the storage account that are authorized with Shared Key.",
+ "ImpactStatement": "When you disallow Shared Key authorization for a storage account, any requests to the account that are authorized with Shared Key, including shared access signatures (SAS), will be denied. Client applications that currently access the storage account using the Shared Key will no longer function.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click on a storage account. 1. Under `Settings`, click `Configuration`. 1. Under `Allow storage account key access`, click the radio button next to `Disabled`. 1. Click `Save`. 1. Repeat steps 1-5 for each storage account requiring remediation. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to disallow shared key authorization: ``` az storage account update --resource-group <resource-group> --name <storage-account> --allow-shared-key-access false ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to disallow shared key authorization: ``` Set-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> -AllowSharedKeyAccess $false ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click on a storage account. 1. Under `Settings`, click `Configuration`. 1. Under `Allow storage account key access`, ensure that the radio button next to `Disabled` is selected. 1. Repeat steps 1-4 for each storage account. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` For each storage account, run the following command: ``` az storage account show --resource-group <resource-group> --name <storage-account> ``` Ensure that `allowSharedKeyAccess` is set to `false`. **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount ``` Run the following command to get the storage account in a resource group with a given name: ``` $storageAccount = Get-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> ``` Run the following command to get the shared key access setting for the storage account: ``` $storageAccount.allowSharedKeyAccess ``` Ensure that the command returns `False`. Repeat for each storage account. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54) **- Name:** 'Storage accounts should prevent shared key access'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent:https://learn.microsoft.com/en-us/cli/azure/storage/account:https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstorageaccount:https://learn.microsoft.com/en-us/powershell/module/az.storage/set-azstorageaccount",
+ "DefaultValue": "The AllowSharedKeyAccess property of a storage account is not set by default and does not return a value until you explicitly set it. The storage account permits requests that are authorized with the Shared Key when the property value is **null** or when it is **true**."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.2.1",
+ "Description": "Ensure Private Endpoints are Used to Access Storage Accounts",
+ "Checks": [
+ "storage_ensure_private_endpoints_in_storage_accounts"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Private Endpoints are Used to Access Storage Accounts",
+ "RationaleStatement": "Securing traffic between services through encryption protects the data from easy interception and reading.",
+ "ImpactStatement": "If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic. Private endpoints are charged per hour of use. Refer to https://azure.microsoft.com/en-us/pricing/details/private-link/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Open the `Storage Accounts` blade 1. For each listed Storage Account, perform the following: 1. Under the `Security + networking` heading, click on `Networking` 1. Click on the `Private endpoint connections` tab at the top of the networking window 1. Click the `+ Private endpoint` button 1. In the `1 - Basics` tab/step: - `Enter a name` that will be easily recognizable as associated with the Storage Account (*Note*: The Network Interface Name will be automatically completed, but you can customize it if needed.) - Ensure that the `Region` matches the region of the Storage Account - Click `Next` 1. In the `2 - Resource` tab/step: - Select the `target sub-resource` based on what type of storage resource is being made available - Click `Next` 1. In the `3 - Virtual Network` tab/step: - Select the `Virtual network` that your Storage Account will be connecting to - Select the `Subnet` that your Storage Account will be connecting to - (Optional) Select other network settings as appropriate for your environment - Click `Next` 1. In the `4 - DNS` tab/step: - (Optional) Select other DNS settings as appropriate for your environment - Click `Next` 1. In the `5 - Tags` tab/step: - (Optional) Set any tags that are relevant to your organization - Click `Next` 1. In the `6 - Review + create` tab/step: - A validation attempt will be made and after a few moments it should indicate `Validation Passed` - if it does not pass, double-check your settings before beginning more in depth troubleshooting. - If validation has passed, click `Create` then wait for a few minutes for the scripted deployment to complete. Repeat the above procedure for each Private Endpoint required within every Storage Account. **Remediate from PowerShell** ``` $storageAccount = Get-AzStorageAccount -ResourceGroupName '<ResourceGroupName>' -Name '<storageaccountname>' $privateEndpointConnection = @{ Name = 'connectionName' PrivateLinkServiceId = $storageAccount.Id GroupID = blob|blob_secondary|file|file_secondary|table|table_secondary|queue|queue_secondary|web|web_secondary|dfs|dfs_secondary } $privateLinkServiceConnection = New-AzPrivateLinkServiceConnection @privateEndpointConnection $virtualNetDetails = Get-AzVirtualNetwork -ResourceGroupName '<ResourceGroupName>' -Name '<name>' $privateEndpoint = @{ ResourceGroupName = '<ResourceGroupName>' Name = '<PrivateEndpointName>' Location = '<location>' Subnet = $virtualNetDetails.Subnets[0] PrivateLinkServiceConnection = $privateLinkServiceConnection } New-AzPrivateEndpoint @privateEndpoint ``` **Remediate from Azure CLI** ``` az network private-endpoint create --resource-group <ResourceGroupName --location <location> --name <private endpoint name> --vnet-name <VNET Name> --subnet <subnet name> --private-connection-resource-id <storage account ID> --connection-name <private link service connection name> --group-id <blob|blob_secondary|file|file_secondary|table|table_secondary|queue|queue_secondary|web|web_secondary|dfs|dfs_secondary> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Open the `Storage Accounts` blade. 1. For each listed Storage Account, perform the following check: 1. Under the `Security + networking` heading, click on `Networking`. 1. Click on the `Private endpoint connections` tab at the top of the networking window. 1. Ensure that for each VNet that the Storage Account must be accessed from, a unique Private Endpoint is deployed and the `Connection state` for each Private Endpoint is `Approved`. Repeat the procedure for each Storage Account. **Audit from PowerShell** ``` $storageAccount = Get-AzStorageAccount -ResourceGroup '<ResourceGroupName>' -Name '<storageaccountname>' Get-AzPrivateEndpoint -ResourceGroup '<ResourceGroupName>'|Where-Object {$_.PrivateLinkServiceConnectionsText -match $storageAccount.id} ``` If the results of the second command returns information, the Storage Account is using a Private Endpoint and complies with this Benchmark, otherwise if the results of the second command are empty, the Storage Account generates a finding. **Audit from Azure CLI** ``` az storage account show --name '<storage account name>' --query privateEndpointConnections[0].id ``` If the above command returns data, the Storage Account complies with this Benchmark, otherwise if the results are empty, the Storage Account generates a finding. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [6edd7eda-6dd8-40f7-810d-67160c639cd9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F6edd7eda-6dd8-40f7-810d-67160c639cd9) **- Name:** 'Storage accounts should use private link'",
+ "AdditionalInformation": "A NAT gateway is the recommended solution for outbound internet access. This recommendation is based on the Common Reference Recommendation `Ensure Private Endpoints are used to access {service}`, from the `Common Reference Recommendations > Networking > Private Endpoints` section.",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints:https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview:https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal:https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-cli?tabs=dynamic-ip:https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-powershell?tabs=dynamic-ip:https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls",
+ "DefaultValue": "By default, Private Endpoints are not created for Storage Accounts."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.2.2",
+ "Description": "Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts",
+ "Checks": [
+ "storage_account_public_network_access_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts",
+ "RationaleStatement": "The default network configuration for a storage account permits a user with appropriate permissions to configure public network access to containers and blobs in a storage account. Keep in mind that public access to a container is always turned off by default and must be explicitly configured to permit anonymous requests. It grants read-only access to these resources without sharing the account key, and without requiring a shared access signature. It is recommended not to provide public network access to storage accounts until, and unless, it is strongly desired. A shared access signature token or Azure AD RBAC should be used for providing controlled and timed access to blob containers.",
+ "ImpactStatement": "Access will have to be managed using shared access signatures or via Azure AD RBAC. For classic storage accounts (to be retired on August 31, 2024), each container in the account must be configured to block anonymous access. Either configure all containers or to configure at the storage account level, migrate to the Azure Resource Manager deployment model.",
+ "RemediationProcedure": "**Remediate from Azure Portal** First, follow Microsoft documentation and create shared access signature tokens for your blob containers. Then, 1. Go to `Storage Accounts`. 1. For each storage account, under the `Security + networking` section, click `Networking`. 1. Set `Public network access` to `Disabled`. 1. Click `Save`. **Remediate from Azure CLI** Set 'Public Network Access' to `Disabled` on the storage account ``` az storage account update --name <storage-account> --resource-group <resource-group> --public-network-access Disabled ``` **Remediate from PowerShell** For each Storage Account, run the following to set the `PublicNetworkAccess` setting to `Disabled` ``` Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -PublicNetworkAccess Disabled ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 2. For each storage account, under the `Security + networking` section, click `Networking`. 3. Ensure the `Public network access` setting is set to `Disabled`. **Audit from Azure CLI** Ensure `publicNetworkAccess` is `Disabled` ``` az storage account show --name <storage-account> --resource-group <resource-group> --query {publicNetworkAccess:publicNetworkAccess} ``` **Audit from PowerShell** For each Storage Account, ensure `PublicNetworkAccess` is `Disabled` ``` Get-AzStorageAccount -Name <storage account name> -ResourceGroupName <resource group name> |select PublicNetworkAccess ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [b2982f36-99f2-4db5-8eff-283140c09693](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fb2982f36-99f2-4db5-8eff-283140c09693) **- Name:** 'Storage accounts should disable public network access'",
+ "AdditionalInformation": "This recommendation is based on the Common Reference Recommendation `Ensure public network access is Disabled`, from the `Common Reference Recommendations > Networking > Virtual Networks (VNets)` section.",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-manage-access-to-resources:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls:https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access:https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal",
+ "DefaultValue": "By default, `Public Network Access` is set to `Enabled from all networks` for the Storage Account."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.2.3",
+ "Description": "Ensure Default Network Access Rule for Storage Accounts is Set to Deny",
+ "Checks": [
+ "storage_default_network_access_rule_is_denied"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Default Network Access Rule for Storage Accounts is Set to Deny",
+ "RationaleStatement": "Storage accounts should be configured to deny access to traffic from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.",
+ "ImpactStatement": "All allowed networks will need to be whitelisted on each specific network, creating administrative overhead. This may result in loss of network connectivity, so do not turn on for critical resources during business hours.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Security + networking`, click `Networking`. 1. Click the `Firewalls and virtual networks` heading. 1. Set `Public network access` to `Enabled from selected virtual networks and IP addresses`. 1. Add rules to allow traffic from specific networks and IP addresses. 1. Click `Save`. **Remediate from Azure CLI** Use the below command to update `default-action` to `Deny`. ``` az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --default-action Deny ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to Storage Accounts. 2. For each storage account, under `Security + networking`, click `Networking`. 4. Click the `Firewalls and virtual networks` heading. 3. Ensure that `Public network access` is not set to `Enabled from all networks`. **Audit from Azure CLI** Ensure `defaultAction` is not set to ` Allow`. ``` az storage account list --query '[*].networkRuleSet' ``` **Audit from PowerShell** ``` Connect-AzAccount Set-AzContext -Subscription <subscription ID> Get-AzStorageAccountNetworkRuleset -ResourceGroupName <resource group> -Name <storage account name> |Select-Object DefaultAction ``` PowerShell Result - Non-Compliant ``` DefaultAction : Allow ``` PowerShell Result - Compliant ``` DefaultAction : Deny ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [34c877ad-507e-4c82-993e-3452a6e0ad3c](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F34c877ad-507e-4c82-993e-3452a6e0ad3c) **- Name:** 'Storage accounts should restrict network access' - **Policy ID:** [2a1a9cdf-e04d-429a-8416-3bfb72a1b26f](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F2a1a9cdf-e04d-429a-8416-3bfb72a1b26f) **- Name:** 'Storage accounts should restrict network access using virtual network rules'",
+ "AdditionalInformation": "This recommendation is based on the Common Reference Recommendation `Ensure Network Access Rules are set to Deny-by-default`, from the `Common Reference Recommendations > Networking > Virtual Networks (VNets)` section.",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls",
+ "DefaultValue": "By default, Storage Accounts will accept connections from clients on any network."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.3.1",
+ "Description": "Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is Set to 'Enabled'",
+ "Checks": [
+ "storage_default_to_entra_authorization_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is Set to 'Enabled'",
+ "RationaleStatement": "Microsoft Entra ID provides superior security and ease of use over Shared Key.",
+ "ImpactStatement": "Users will need appropriate RBAC permissions to access storage data.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Settings`, click `Configuration`. 1. Under `Default to Microsoft Entra authorization in the Azure portal`, click the radio button next to `Enabled`. 1. Click `Save`. 1. Repeat steps 1-5 for each storage account requiring remediation. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable `defaultToOAuthAuthentication`: ``` az storage account update --resource-group <resource-group> --name <storage-account> --set defaultToOAuthAuthentication=true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click the name of a storage account. 1. Under `Settings`, click `Configuration`. 1. Ensure that `Default to Microsoft Entra authorization in the Azure portal` is set to `Enabled`. 1. Repeat steps 1-4 for each storage account. **Audit from Azure CLI** Run the following command to get the `name` and `defaultToOAuthAuthentication` setting for each storage account: ``` az storage account list --query [*].[name,defaultToOAuthAuthentication] ``` Ensure that `true` is returned for each storage account.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal#default-to-microsoft-entra-authorization-in-the-azure-portal:https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest",
+ "DefaultValue": "By default, `defaultToOAuthAuthentication` is disabled."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.4",
+ "Description": "Ensure that 'Secure transfer required' is Set to 'Enabled'",
+ "Checks": [
+ "storage_secure_transfer_required_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Secure transfer required' is Set to 'Enabled'",
+ "RationaleStatement": "The secure transfer option enhances the security of a storage account by only allowing requests to the storage account by a secure connection. For example, when calling REST APIs to access storage accounts, the connection must use HTTPS. Any requests using HTTP will be rejected when 'secure transfer required' is enabled. When using the Azure files service, connection without encryption will fail, including scenarios using SMB 2.1, SMB 3.0 without encryption, and some flavors of the Linux SMB client. Because Azure storage doesnt support HTTPS for custom domain names, this option is not applied when using a custom domain name.",
+ "ImpactStatement": "Applications using HTTP will need to be updated to use HTTPS.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Set `Secure transfer required` to `Enabled`. 1. Click `Save`. **Remediate from Azure CLI** Use the below command to enable `Secure transfer required` for a `Storage Account` ``` az storage account update --name <storageAccountName> --resource-group <resourceGroupName> --https-only true ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Ensure that `Secure transfer required` is set to `Enabled`. **Audit from Azure CLI** Use the below command to ensure the `Secure transfer required` is enabled for all the `Storage Accounts` by ensuring the output contains `true` for each of the `Storage Accounts`. ``` az storage account list --query [*].[name,enableHttpsTrafficOnly] ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [404c3081-a854-4457-ae30-26a93ef643f9](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F404c3081-a854-4457-ae30-26a93ef643f9) **- Name:** 'Secure transfer to storage accounts should be enabled'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/blobs/security-recommendations#encryption-in-transit:https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_list:https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_update:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-3-encrypt-sensitive-data-in-transit",
+ "DefaultValue": "By default, `Secure transfer required` is set to `Disabled`."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.5",
+ "Description": "Ensure 'Allow trusted Microsoft services to access this resource' is Enabled for Storage Account Access",
+ "Checks": [
+ "storage_ensure_azure_services_are_trusted_to_access_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Allow trusted Microsoft services to access this resource' is Enabled for Storage Account Access",
+ "RationaleStatement": "Turning on firewall rules for a storage account will block access to incoming requests for data, including from other Azure services. We can re-enable this functionality by allowing access to `trusted Azure services` through networking exceptions.",
+ "ImpactStatement": "This creates authentication credentials for services that need access to storage resources so that services will no longer need to communicate via network request. There may be a temporary loss of communication as you set each Storage Account. It is recommended to not do this on mission-critical resources during business hours.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Security + networking`, click `Networking`. 1. Click on the `Firewalls and virtual networks` heading. 1. Under `Exceptions`, check the box next to `Allow Azure services on the trusted services list to access this storage account`. 1. Click `Save`. **Remediate from Azure CLI** Use the below command to update `bypass` to `Azure services`. ``` az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --bypass AzureServices ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Security + networking`, click `Networking`. 1. Click on the `Firewalls and virtual networks` heading. 1. Under `Exceptions`, ensure that `Allow Azure services on the trusted services list to access this storage account` is checked. **Audit from Azure CLI** Ensure `bypass` contains `AzureServices` ``` az storage account list --query '[*].networkRuleSet' ``` **Audit from PowerShell** ``` Connect-AzAccount Set-AzContext -Subscription <subscription ID> Get-AzStorageAccountNetworkRuleset -ResourceGroupName <resource group> -Name <storage account name> |Select-Object Bypass ``` If the response from the above command is `None`, the storage account configuration is out of compliance with this check. If the response is `AzureServices`, the storage account configuration is in compliance with this check. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [c9d007d0-c057-4772-b18c-01e546713bcd](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc9d007d0-c057-4772-b18c-01e546713bcd) **- Name:** 'Storage accounts should allow access from trusted Microsoft services'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls",
+ "DefaultValue": "By default, Storage Accounts will accept connections from clients on any network."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.6",
+ "Description": "Ensure the 'Minimum TLS version' for Storage Accounts is Set to 'Version 1.2'",
+ "Checks": [
+ "storage_ensure_minimum_tls_version_12"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure the 'Minimum TLS version' for Storage Accounts is Set to 'Version 1.2'",
+ "RationaleStatement": "TLS 1.0 has known vulnerabilities and has been replaced by later versions of the TLS protocol. Continued use of this legacy protocol affects the security of data in transit.",
+ "ImpactStatement": "When set to TLS 1.2 all requests must leverage this version of the protocol. Applications leveraging legacy versions of the protocol will fail.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Set the `Minimum TLS version` to `Version 1.2`. 1. Click `Save`. **Remediate from Azure CLI** ``` az storage account update \\ --name <storage-account> \\ --resource-group <resource-group> \\ --min-tls-version TLS1_2 ``` **Remediate from PowerShell** To set the minimum TLS version, run the following command: ``` Set-AzStorageAccount -AccountName <STORAGEACCOUNTNAME> ` -ResourceGroupName <RESOURCEGROUPNAME> ` -MinimumTlsVersion TLS1_2 ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Ensure that the `Minimum TLS version` is set to `Version 1.2`. **Audit from Azure CLI** Get a list of all storage accounts and their resource groups ``` az storage account list | jq '.[] | {name, resourceGroup}' ``` Then query the minimumTLSVersion field ``` az storage account show \\ --name <storage-account> \\ --resource-group <resource-group> \\ --query minimumTlsVersion \\ --output tsv ``` **Audit from PowerShell** To get the minimum TLS version, run the following command: ``` (Get-AzStorageAccount -Name <STORAGEACCOUNTNAME> -ResourceGroupName <RESOURCEGROUPNAME>).MinimumTlsVersion ``` **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [fe83a0eb-a853-422d-aac2-1bffd182c5d0](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffe83a0eb-a853-422d-aac2-1bffd182c5d0) **- Name:** 'Storage accounts should have the specified minimum TLS version'",
+ "AdditionalInformation": "",
+ "References": "https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-3-encrypt-sensitive-data-in-transit",
+ "DefaultValue": "If a storage account is created through the portal, the MinimumTlsVersion property for that storage account will be set to TLS 1.2. If a storage account is created through PowerShell or CLI, the MinimumTlsVersion property for that storage account will not be set, and defaults to TLS 1.0."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.7",
+ "Description": "Ensure 'Cross Tenant Replication' is Not Enabled",
+ "Checks": [
+ "storage_cross_tenant_replication_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure 'Cross Tenant Replication' is Not Enabled",
+ "RationaleStatement": "Disabling Cross Tenant Replication minimizes the risk of unauthorized data access and ensures that data governance policies are strictly adhered to. This control is especially critical for organizations with stringent data security and privacy requirements, as it prevents the accidental sharing of sensitive information.",
+ "ImpactStatement": "Disabling Cross Tenant Replication may affect data availability and sharing across different Azure tenants. Ensure that this change aligns with your organizational data sharing and availability requirements.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Data management`, click `Object replication`. 1. Click `Advanced settings`. 1. Uncheck `Allow cross-tenant replication`. 1. Click `OK`. **Remediate from Azure CLI** Replace the information within <> with appropriate values: ``` az storage account update --name <storageAccountName> --resource-group <resourceGroupName> --allow-cross-tenant-replication false ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Data management`, click `Object replication`. 1. Click `Advanced settings`. 1. Ensure `Allow cross-tenant replication` is not checked. **Audit from Azure CLI** ``` az storage account list --query [*].[name,allowCrossTenantReplication] ``` The value of `false` should be returned for each storage account listed. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [92a89a79-6c52-4a7e-a03f-61306fc49312](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F92a89a79-6c52-4a7e-a03f-61306fc49312) **- Name:** 'Storage accounts should prevent cross tenant object replication'",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-prevent-cross-tenant-policies?tabs=portal",
+ "DefaultValue": "For new storage accounts created after Dec 15, 2023 cross tenant replication is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.8",
+ "Description": "Ensure that 'Allow Blob Anonymous Access' is Set to 'Disabled'",
+ "Checks": [
+ "storage_blob_public_access_level_is_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that 'Allow Blob Anonymous Access' is Set to 'Disabled'",
+ "RationaleStatement": "If Allow Blob Anonymous Access is enabled, blobs can be accessed by adding the blob name to the URL to see the contents. An attacker can enumerate a blob using methods, such as brute force, and access them. Exfiltration of data by brute force enumeration of items from a storage account may occur if this setting is set to 'Enabled'.",
+ "ImpactStatement": "Additional consideration may be required for exceptional circumstances where elements of a storage account require public accessibility. In these circumstances, it is highly recommended that all data stored in the public facing storage account be reviewed for sensitive or potentially compromising data, and that sensitive or compromising data is never stored in these storage accounts.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Set `Allow Blob Anonymous Access` to `Disabled`. 1. Click `Save`. **Remediate from Powershell** For every storage account in scope, run the following: ``` $storageAccount = Get-AzStorageAccount -ResourceGroupName <yourResourceGroup> -Name <yourStorageAccountName> $storageAccount.AllowBlobPublicAccess = $false Set-AzStorageAccount -InputObject $storageAccount ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage Accounts`. 1. For each storage account, under `Settings`, click `Configuration`. 1. Ensure `Allow Blob Anonymous Access` is set to `Disabled`. **Audit from Azure CLI** For every storage account in scope: ``` az storage account show --name <yourStorageAccountName> --query allowBlobPublicAccess ``` Ensure that every storage account in scope returns `false` for the allowBlobPublicAccess setting. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [4fa4b6c0-31ca-4c0d-b10d-24b96f62a751](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F4fa4b6c0-31ca-4c0d-b10d-24b96f62a751) **- Name:** 'Storage account public access should be disallowed'",
+ "AdditionalInformation": "Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent?tabs=portal:https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent?source=recommendations&tabs=portal:Classic Storage Accounts: https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent-classic?tabs=portal",
+ "DefaultValue": "Disabled"
+ }
+ ]
+ },
+ {
+ "Id": "9.3.9",
+ "Description": "Ensure Azure Resource Manager Delete Locks are Applied to Azure Storage Accounts",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Azure Resource Manager Delete Locks are Applied to Azure Storage Accounts",
+ "RationaleStatement": "Applying a _Delete_ lock on storage accounts protects the availability of data by preventing the accidental or unauthorized deletion of the entire storage account. It is a fundamental protective control that can prevent data loss",
+ "ImpactStatement": "- Prevents the deletion of the Storage account Resource entirely. - Prevents the deletion of the parent Resource Group containing the locked Storage account resource. - Does not prevent other control plane operations, including modification of configurations, network settings, containers, and access. - Does not prevent deletion of containers or other objects within the storage account.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the storage account in the Azure portal. 1. Under the `Settings` section, select `Locks`. 1. Select `Add`. 1. Provide a Name, and choose `Delete` for the type of lock. 1. Add a note about the lock if desired. **Remediate from Azure CLI** Replace the information within <> with appropriate values: ``` az lock create --name <lock> \\ --resource-group <resource-group> \\ --resource <storage-account> \\ --lock-type CanNotDelete \\ --resource-type Microsoft.Storage/storageAccounts ``` **Remediate from PowerShell** Replace the information within <> with appropriate values: ``` New-AzResourceLock -LockLevel CanNotDelete ` -LockName <lock> ` -ResourceName <storage-account> ` -ResourceType Microsoft.Storage/storageAccounts ` -ResourceGroupName <resource-group> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the storage account in the Azure portal. 1. For each storage account, under `Settings`, click `Locks`. 1. Ensure that a `Delete` lock exists on the storage account. **Audit from Azure CLI** ``` az lock list --resource-group <resource-group> \\ --resource-name <storage-account> \\ --resource-type Microsoft.Storage/storageAccounts ``` **Audit from PowerShell** ``` Get-AzResourceLock -ResourceGroupName <RESOURCEGROUPNAME> ` -ResourceName <STORAGEACCOUNTNAME> ` -ResourceType Microsoft.Storage/storageAccounts ``` **Audit from Azure Policy** There is currently no built-in Microsoft policy to audit resource locks on storage accounts. Custom and community policy definitions can check for the existence of a “Microsoft.Authorization/locks” resource with an AuditIfNotExists effect.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/common/lock-account-resource:https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources",
+ "DefaultValue": "By default, no locks are applied to Azure resources, including storage accounts. Locks must be manually configured after resource creation."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.10",
+ "Description": "Ensure Azure Resource Manager ReadOnly Locks are Considered for Azure Storage Accounts",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure Azure Resource Manager ReadOnly Locks are Considered for Azure Storage Accounts",
+ "RationaleStatement": "Applying a `ReadOnly` lock on storage accounts protects the confidentiality and availability of data by preventing the accidental or unauthorized deletion of the entire storage account and modification of the account, container properties, or access permissions. It can offer enhanced protection for blob and queue workloads with tradeoffs in usability and compatibility for clients using account shared access keys.",
+ "ImpactStatement": "- Prevents the deletion of the Storage account Resource entirely. - Prevents the deletion of the parent Resource Group containing the locked Storage account resource. - Prevents clients from obtaining the storage account shared access keys using a `listKeys` operation. - Requires Entra credentials to access blob and queue data in the Portal. - Data in Azure Files or the Table service may be inaccessible to clients using the account shared access keys. - Prevents modification of account properties, network settings, containers, and RBAC assignments. - Does not prevent access using existing account shared access keys issued to clients. - Does not prevent deletion of containers or other objects within the storage account.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Navigate to the storage account in the Azure portal. 1. Under the `Settings` section, select `Locks`. 1. Select `Add`. 1. Provide a Name, and choose `ReadOnly` for the type of lock. 1. Add a note about the lock if desired. **Remediate from Azure CLI** Replace the information within <> with appropriate values: ``` az lock create --name <lock> \\ --resource-group <resource-group> \\ --resource <storage-account> \\ --lock-type ReadOnly \\ --resource-type Microsoft.Storage/storageAccounts ``` **Remediate from PowerShell** Replace the information within <> with appropriate values: ``` New-AzResourceLock -LockLevel ReadOnly ` -LockName <lock> ` -ResourceName <storage-account> ` -ResourceType Microsoft.Storage/storageAccounts ` -ResourceGroupName <resource-group> ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Navigate to the storage account in the Azure portal. 1. For each storage account, under `Settings`, click `Locks`. 1. Ensure that a `ReadOnly` lock exists on the storage account. **Audit from Azure CLI** ``` az lock list --resource-group <resource-group> \\ --resource-name <storage-account> \\ --resource-type Microsoft.Storage/storageAccounts ``` **Audit from PowerShell** ``` Get-AzResourceLock -ResourceGroupName <RESOURCEGROUPNAME> ` -ResourceName <STORAGEACCOUNTNAME> ` -ResourceType Microsoft.Storage/storageAccounts ``` **Audit from Azure Policy** There is currently no built-in Microsoft policy to audit resource locks on storage accounts. Custom and community policy definitions can check for the existence of a “Microsoft.Authorization/locks” resource with an AuditIfNotExists effect.",
+ "AdditionalInformation": "",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/common/lock-account-resource:https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources:https://github.com/Azure/azure-rest-api-specs/tree/main/specification/storage",
+ "DefaultValue": "By default, no locks are applied to Azure resources, including storage accounts. Locks must be manually configured after resource creation."
+ }
+ ]
+ },
+ {
+ "Id": "9.3.11",
+ "Description": "Ensure Redundancy is Set to 'geo-redundant storage (GRS)' on Critical Azure Storage Accounts",
+ "Checks": [
+ "storage_geo_redundant_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "9 Storage Services",
+ "SubSection": "9.3 Storage Accounts",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure Redundancy is Set to 'geo-redundant storage (GRS)' on Critical Azure Storage Accounts",
+ "RationaleStatement": "Enabling GRS protects critical data from regional failures by maintaining a copy in a geographically separate location. This significantly reduces the risk of data loss, supports business continuity, and meets high availability requirements for disaster recovery.",
+ "ImpactStatement": "Enabling geo-redundant storage on Azure storage accounts increases costs due to cross-region data replication.",
+ "RemediationProcedure": "**Remediate from Azure Portal** 1. Go to `Storage accounts`. 1. Click on a storage account. 1. Under `Data management`, click `Redundancy`. 1. From the `Redundancy` drop-down menu, select `Geo-redundant storage (GRS)`. 1. Click `Save`. 1. Repeat steps 1-5 for each storage account requiring remediation. **Remediate from Azure CLI** For each storage account requiring remediation, run the following command to enable geo-redundant storage: ``` az storage account update --resource-group <resource-group> --name <storage-account> --sku Standard_GRS ``` **Remediate from PowerShell** For each storage account requiring remediation, run the following command to enable geo-redundant storage: ``` Set-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> -SkuName Standard_GRS ```",
+ "AuditProcedure": "**Audit from Azure Portal** 1. Go to `Storage accounts`. 1. Click on a storage account. 1. Under `Data management`, click `Redundancy`. 1. Ensure that `Redundancy` is set to `Geo-redundant storage (GRS)`. 1. Repeat steps 1-4 for each storage account. **Audit from Azure CLI** Run the following command to list storage accounts: ``` az storage account list ``` For each storage account, run the following command: ``` az storage account show --resource-group <resource-group> --name <storage-account> ``` Under `sku`, ensure that `name` is set to `Standard_GRS`. **Audit from PowerShell** Run the following command to list storage accounts: ``` Get-AzStorageAccount ``` Run the following command to get the storage account in a resource group with a given name: ``` $storageAccount = Get-AzStorageAccount -ResourceGroupName <resource-group> -Name <storage-account> ``` Run the following command to get the redundancy setting for the storage account: ``` $storageAccount.SKU.Name ``` Ensure that the command returns `Standard_GRS`. Repeat for each storage account. **Audit from Azure Policy** If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - **Policy ID:** [bf045164-79ba-4215-8f95-f8048dc1780b](https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fbf045164-79ba-4215-8f95-f8048dc1780b) **- Name:** 'Geo-redundant storage should be enabled for Storage Accounts'",
+ "AdditionalInformation": "When choosing the best redundancy option, weigh the trade-offs between lower costs and higher availability. Key factors to consider include: - The method of data replication within the primary region. - The replication of data from a primary to a geographically distant secondary region for protection against regional disasters (geo-replication). - The necessity for read access to replicated data in the secondary region during an outage in the primary region (geo-replication with read access).",
+ "References": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy:https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration:https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az-storage-account-update:https://learn.microsoft.com/en-us/powershell/module/az.storage/set-azstorageaccount?view=azps-12.4.0:https://learn.microsoft.com/en-us/azure/storage/common/storage-disaster-recovery-guidance",
+ "DefaultValue": "When creating a storage account in the Azure Portal, the default redundancy setting is geo-redundant storage (GRS). Using the Azure CLI, the default is read-access geo-redundant storage (RA-GRS). In PowerShell, a redundancy level must be explicitly specified during account creation."
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/azure/hipaa_azure.json b/prowler/compliance/azure/hipaa_azure.json
index 3672218f3b..62ffe2fdad 100644
--- a/prowler/compliance/azure/hipaa_azure.json
+++ b/prowler/compliance/azure/hipaa_azure.json
@@ -767,6 +767,17 @@
"mysql_flexible_server_minimum_tls_version_12",
"mysql_flexible_server_ssl_connection_enabled",
"postgresql_flexible_server_enforce_ssl_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -819,6 +830,17 @@
"mysql_flexible_server_ssl_connection_enabled",
"postgresql_flexible_server_enforce_ssl_enabled",
"databricks_workspace_cmk_encryption_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
}
]
diff --git a/prowler/compliance/azure/nis2_azure.json b/prowler/compliance/azure/nis2_azure.json
index 5c48c22f6b..0ae814fad7 100644
--- a/prowler/compliance/azure/nis2_azure.json
+++ b/prowler/compliance/azure/nis2_azure.json
@@ -1133,6 +1133,17 @@
"defender_ensure_defender_for_dns_is_on",
"sqlserver_tde_encryption_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)",
@@ -1164,6 +1175,17 @@
"network_udp_internet_access_restricted",
"network_watcher_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)",
@@ -1887,6 +1909,17 @@
"sqlserver_tde_encrypted_with_cmk",
"sqlserver_tde_encryption_enabled"
],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
+ ],
"Attributes": [
{
"Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)",
diff --git a/prowler/compliance/azure/secnumcloud_3.2_azure.json b/prowler/compliance/azure/secnumcloud_3.2_azure.json
index aedf2133d4..3f2e8c7603 100644
--- a/prowler/compliance/azure/secnumcloud_3.2_azure.json
+++ b/prowler/compliance/azure/secnumcloud_3.2_azure.json
@@ -440,6 +440,25 @@
"postgresql_flexible_server_enforce_ssl_enabled",
"mysql_flexible_server_ssl_connection_enabled",
"mysql_flexible_server_minimum_tls_version_12"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ },
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/azure/soc2_azure.json b/prowler/compliance/azure/soc2_azure.json
index e0839cedaa..c3b4db6e39 100644
--- a/prowler/compliance/azure/soc2_azure.json
+++ b/prowler/compliance/azure/soc2_azure.json
@@ -266,6 +266,17 @@
"sqlserver_tde_encryption_enabled",
"sqlserver_unrestricted_inbound_access",
"storage_secure_transfer_required_is_enabled"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
@@ -310,6 +321,17 @@
"sqlserver_recommended_minimal_tls_version",
"storage_ensure_minimum_tls_version_12",
"network_subnet_nsg_associated"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/cis_controls_8.1.json b/prowler/compliance/cis_controls_8.1.json
new file mode 100644
index 0000000000..c03d9e806b
--- /dev/null
+++ b/prowler/compliance/cis_controls_8.1.json
@@ -0,0 +1,4554 @@
+{
+ "framework": "CIS-Controls",
+ "name": "CIS Controls v8.1",
+ "version": "8.1",
+ "description": "The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.",
+ "icon": "cisecurity",
+ "attributes_metadata": [
+ {
+ "key": "Section",
+ "label": "CIS Control",
+ "type": "str",
+ "required": true,
+ "enum": [
+ "1. Inventory and Control of Enterprise Assets",
+ "2. Inventory and Control of Software Assets",
+ "3. Data Protection",
+ "4. Secure Configuration of Enterprise Assets and Software",
+ "5. Account Management",
+ "6. Access Control Management",
+ "7. Continuous Vulnerability Management",
+ "8. Audit Log Management",
+ "9. Email and Web Browser Protections",
+ "10. Malware Defenses",
+ "11. Data Recovery",
+ "12. Network Infrastructure Management",
+ "13. Network Monitoring and Defense",
+ "14. Security Awareness and Skills Training",
+ "15. Service Provider Management",
+ "16. Application Software Security",
+ "17. Incident Response Management",
+ "18. Penetration Testing"
+ ],
+ "output_formats": {
+ "csv": true,
+ "ocsf": true
+ }
+ },
+ {
+ "key": "Function",
+ "label": "Security Function",
+ "type": "str",
+ "required": false,
+ "enum": [
+ "Identify",
+ "Protect",
+ "Detect",
+ "Respond",
+ "Recover",
+ "Govern"
+ ],
+ "output_formats": {
+ "csv": true,
+ "ocsf": true
+ }
+ },
+ {
+ "key": "AssetType",
+ "label": "Asset Type",
+ "type": "str",
+ "required": false,
+ "enum": [
+ "Data",
+ "Devices",
+ "Documentation",
+ "Network",
+ "Software",
+ "Users"
+ ],
+ "output_formats": {
+ "csv": true,
+ "ocsf": true
+ }
+ },
+ {
+ "key": "ImplementationGroups",
+ "label": "Implementation Groups",
+ "type": "list_str",
+ "required": false,
+ "output_formats": {
+ "csv": true,
+ "ocsf": true
+ }
+ }
+ ],
+ "outputs": {
+ "table_config": {
+ "group_by": "Section"
+ },
+ "pdf_config": {
+ "language": "en",
+ "primary_color": "#cc0000",
+ "secondary_color": "#7a1f1f",
+ "bg_color": "#FAF0F0",
+ "group_by_field": "Section",
+ "sections": [
+ "1. Inventory and Control of Enterprise Assets",
+ "2. Inventory and Control of Software Assets",
+ "3. Data Protection",
+ "4. Secure Configuration of Enterprise Assets and Software",
+ "5. Account Management",
+ "6. Access Control Management",
+ "7. Continuous Vulnerability Management",
+ "8. Audit Log Management",
+ "9. Email and Web Browser Protections",
+ "10. Malware Defenses",
+ "11. Data Recovery",
+ "12. Network Infrastructure Management",
+ "13. Network Monitoring and Defense",
+ "14. Security Awareness and Skills Training",
+ "15. Service Provider Management",
+ "16. Application Software Security",
+ "17. Incident Response Management",
+ "18. Penetration Testing"
+ ],
+ "section_short_names": {
+ "1. Inventory and Control of Enterprise Assets": "CIS 1",
+ "2. Inventory and Control of Software Assets": "CIS 2",
+ "3. Data Protection": "CIS 3",
+ "4. Secure Configuration of Enterprise Assets and Software": "CIS 4",
+ "5. Account Management": "CIS 5",
+ "6. Access Control Management": "CIS 6",
+ "7. Continuous Vulnerability Management": "CIS 7",
+ "8. Audit Log Management": "CIS 8",
+ "9. Email and Web Browser Protections": "CIS 9",
+ "10. Malware Defenses": "CIS 10",
+ "11. Data Recovery": "CIS 11",
+ "12. Network Infrastructure Management": "CIS 12",
+ "13. Network Monitoring and Defense": "CIS 13",
+ "14. Security Awareness and Skills Training": "CIS 14",
+ "15. Service Provider Management": "CIS 15",
+ "16. Application Software Security": "CIS 16",
+ "17. Incident Response Management": "CIS 17",
+ "18. Penetration Testing": "CIS 18"
+ },
+ "charts": [
+ {
+ "id": "section_compliance",
+ "type": "horizontal_bar",
+ "group_by": "Section",
+ "title": "Compliance Score by CIS Control",
+ "y_label": "CIS Control",
+ "x_label": "Compliance %",
+ "value_source": "compliance_percent",
+ "color_mode": "by_value"
+ }
+ ],
+ "filter": {
+ "only_failed": true,
+ "include_manual": false
+ }
+ }
+ },
+ "requirements": [
+ {
+ "id": "1.1",
+ "name": "Establish and Maintain Detailed Enterprise Asset Inventory",
+ "description": "Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. For mobile end-user devices, MDM type tools can support this process, where appropriate. This inventory includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud environments. Additionally, it includes assets that are regularly connected to the enterprise's network infrastructure, even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets bi-annually, or more frequently.",
+ "attributes": {
+ "Section": "1. Inventory and Control of Enterprise Assets",
+ "Function": "Identify",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "config_recorder_all_regions_enabled",
+ "resourceexplorer2_indexes_found"
+ ],
+ "gcp": [
+ "iam_cloud_asset_inventory_enabled"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "1.2",
+ "name": "Address Unauthorized Assets",
+ "description": "Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset.",
+ "attributes": {
+ "Section": "1. Inventory and Control of Enterprise Assets",
+ "Function": "Respond",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "1.3",
+ "name": "Utilize an Active Discovery Tool",
+ "description": "Utilize an active discovery tool to identify assets connected to the enterprise's network. Configure the active discovery tool to execute daily, or more frequently.",
+ "attributes": {
+ "Section": "1. Inventory and Control of Enterprise Assets",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "1.4",
+ "name": "Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory",
+ "description": "Use DHCP logging on all DHCP servers or Internet Protocol (IP) address management tools to update the enterprise's asset inventory. Review and use logs to update the enterprise's asset inventory weekly, or more frequently.",
+ "attributes": {
+ "Section": "1. Inventory and Control of Enterprise Assets",
+ "Function": "Identify",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "1.5",
+ "name": "Use a Passive Asset Discovery Tool",
+ "description": "Use a passive discovery tool to identify assets connected to the enterprise's network. Review and use scans to update the enterprise's asset inventory at least weekly, or more frequently.",
+ "attributes": {
+ "Section": "1. Inventory and Control of Enterprise Assets",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "2.1",
+ "name": "Establish and Maintain a Software Inventory",
+ "description": "Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business purpose for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, decommission date, and number of licenses. Review and update the software inventory bi-annually, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "2.2",
+ "name": "Ensure Authorized Software is Currently Supported",
+ "description": "Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterprise's mission, document an exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an exception documentation, designate as unauthorized. Review the software list to verify software support at least monthly, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "awslambda_function_using_supported_runtimes",
+ "ec2_instance_with_outdated_ami",
+ "eks_cluster_uses_a_supported_version",
+ "kafka_cluster_uses_latest_version",
+ "rds_instance_deprecated_engine_version"
+ ]
+ }
+ },
+ {
+ "id": "2.3",
+ "name": "Address Unauthorized Software",
+ "description": "Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Respond",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "2.4",
+ "name": "Utilize Automated Software Inventory Tools",
+ "description": "Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery and documentation of installed software.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Detect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "2.5",
+ "name": "Allowlist Authorized Software",
+ "description": "Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "googleworkspace": [
+ "chat_apps_installation_disabled",
+ "marketplace_apps_access_restricted",
+ "security_app_access_restricted"
+ ],
+ "m365": [
+ "entra_admin_consent_workflow_enabled",
+ "entra_policy_restricts_user_consent_for_apps",
+ "entra_thirdparty_integrated_apps_not_allowed"
+ ]
+ }
+ },
+ {
+ "id": "2.6",
+ "name": "Allowlist Authorized Libraries",
+ "description": "Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, and .so files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "2.7",
+ "name": "Allowlist Authorized Scripts",
+ "description": "Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, and .py files are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.",
+ "attributes": {
+ "Section": "2. Inventory and Control of Software Assets",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.1",
+ "name": "Establish and Maintain a Data Management Process",
+ "description": "Establish and maintain a documented data management process. In the process, address data sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on sensitivity and retention standards for the enterprise. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Govern",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.2",
+ "name": "Establish and Maintain a Data Inventory",
+ "description": "Establish and maintain a data inventory based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Identify",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "macie_automated_sensitive_data_discovery_enabled",
+ "macie_is_enabled"
+ ]
+ }
+ },
+ {
+ "id": "3.3",
+ "name": "Configure Data Access Control Lists",
+ "description": "Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "actiontrail_oss_bucket_not_publicly_accessible",
+ "oss_bucket_not_publicly_accessible",
+ "rds_instance_no_public_access_whitelist"
+ ],
+ "aws": [
+ "awslambda_function_not_publicly_accessible",
+ "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
+ "cloudwatch_log_group_not_publicly_accessible",
+ "codebuild_project_not_publicly_accessible",
+ "dynamodb_table_cross_account_access",
+ "ec2_ami_public",
+ "ecr_repositories_not_publicly_accessible",
+ "efs_access_point_enforce_root_directory",
+ "efs_access_point_enforce_user_identity",
+ "efs_mount_target_not_publicly_accessible",
+ "efs_not_publicly_accessible",
+ "eventbridge_bus_cross_account_access",
+ "eventbridge_bus_exposed",
+ "glacier_vaults_policy_public_access",
+ "glue_data_catalogs_not_publicly_accessible",
+ "kms_key_not_publicly_accessible",
+ "s3_access_point_public_access_block",
+ "s3_account_level_public_access_blocks",
+ "s3_bucket_acl_prohibited",
+ "s3_bucket_cross_account_access",
+ "s3_bucket_level_public_access_block",
+ "s3_bucket_policy_public_write_access",
+ "s3_bucket_public_access",
+ "s3_bucket_public_list_acl",
+ "s3_bucket_public_write_acl",
+ "s3_multi_region_access_point_public_access_block",
+ "secretsmanager_has_restrictive_resource_policy",
+ "secretsmanager_not_publicly_accessible",
+ "ses_identity_not_publicly_accessible",
+ "sns_topics_not_publicly_accessible",
+ "sqs_queues_not_publicly_accessible",
+ "ssm_documents_set_as_public"
+ ],
+ "azure": [
+ "cosmosdb_account_firewall_use_selected_networks",
+ "cosmosdb_account_use_aad_and_rbac",
+ "keyvault_rbac_enabled",
+ "sqlserver_unrestricted_inbound_access",
+ "storage_account_key_access_disabled",
+ "storage_account_public_network_access_disabled",
+ "storage_blob_public_access_level_is_disabled",
+ "storage_default_network_access_rule_is_denied"
+ ],
+ "gcp": [
+ "bigquery_dataset_public_access",
+ "cloudfunction_function_not_publicly_accessible",
+ "cloudsql_instance_public_access",
+ "cloudstorage_bucket_public_access",
+ "cloudstorage_bucket_uniform_bucket_level_access",
+ "compute_image_not_publicly_shared",
+ "kms_key_not_publicly_accessible",
+ "secretmanager_secret_not_publicly_accessible"
+ ],
+ "github": [
+ "organization_default_repository_permission_strict"
+ ],
+ "googleworkspace": [
+ "calendar_external_sharing_primary_calendar",
+ "calendar_external_sharing_secondary_calendar",
+ "chat_external_file_sharing_disabled",
+ "chat_external_messaging_restricted",
+ "chat_external_spaces_restricted",
+ "chat_internal_file_sharing_disabled",
+ "drive_access_checker_recipients_only",
+ "drive_internal_users_distribute_content",
+ "drive_publishing_files_disabled",
+ "drive_shared_drive_disable_download_print_copy",
+ "drive_shared_drive_managers_cannot_override",
+ "drive_shared_drive_members_only_access",
+ "drive_sharing_allowlisted_domains",
+ "gmail_auto_forwarding_disabled",
+ "gmail_mail_delegation_disabled",
+ "groups_external_access_restricted",
+ "groups_view_conversations_restricted"
+ ],
+ "kubernetes": [
+ "core_no_secrets_envs",
+ "rbac_minimize_secret_access"
+ ],
+ "m365": [
+ "admincenter_external_calendar_sharing_disabled",
+ "admincenter_groups_not_public_visibility",
+ "admincenter_organization_customer_lockbox_enabled",
+ "sharepoint_external_sharing_managed",
+ "sharepoint_external_sharing_restricted",
+ "sharepoint_guest_sharing_restricted",
+ "teams_external_domains_restricted",
+ "teams_external_file_sharing_restricted",
+ "teams_external_users_cannot_start_conversations",
+ "teams_unmanaged_communication_disabled"
+ ],
+ "mongodbatlas": [
+ "clusters_authentication_enabled"
+ ],
+ "openstack": [
+ "image_not_publicly_visible",
+ "image_not_shared_with_multiple_projects",
+ "objectstorage_container_acl_not_globally_shared",
+ "objectstorage_container_listing_disabled",
+ "objectstorage_container_public_read_acl_disabled",
+ "objectstorage_container_write_acl_restricted"
+ ],
+ "oraclecloud": [
+ "analytics_instance_access_restricted",
+ "database_autonomous_database_access_restricted",
+ "integration_instance_access_restricted",
+ "objectstorage_bucket_not_publicly_accessible"
+ ],
+ "vercel": [
+ "project_deployment_protection_enabled",
+ "project_password_protection_enabled",
+ "project_production_deployment_protection_enabled",
+ "team_member_role_least_privilege"
+ ]
+ }
+ },
+ {
+ "id": "3.4",
+ "name": "Enforce Data Retention",
+ "description": "Retain data according to the enterprise's documented data management process. Data retention must include both minimum and maximum timelines.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ecr_repositories_lifecycle_policy_enabled",
+ "kinesis_stream_data_retention_period",
+ "s3_bucket_lifecycle_enabled"
+ ],
+ "gcp": [
+ "cloudstorage_bucket_lifecycle_management_enabled",
+ "cloudstorage_bucket_sufficient_retention_period"
+ ],
+ "stackit": [
+ "objectstorage_bucket_object_lock_enabled",
+ "objectstorage_bucket_retention_policy"
+ ]
+ }
+ },
+ {
+ "id": "3.5",
+ "name": "Securely Dispose of Data",
+ "description": "Securely dispose of data as outlined in the enterprise's documented data management process. Ensure the disposal process and method are commensurate with the data sensitivity.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.6",
+ "name": "Encrypt Data on End-User Devices",
+ "description": "Encrypt data on end-user devices containing sensitive data. Example implementations can include: Windows BitLocker®, Apple FileVault®, Linux® dm-crypt.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.7",
+ "name": "Establish and Maintain a Data Classification Scheme",
+ "description": "Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use labels, such as \"Sensitive,\" \"Confidential,\" and \"Public,\" and classify their data according to those labels. Review and update the classification scheme annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Identify",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.8",
+ "name": "Document Data Flows",
+ "description": "Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise's data management process. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Identify",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.9",
+ "name": "Encrypt Data on Removable Media",
+ "description": "Encrypt data on removable media.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.10",
+ "name": "Encrypt Sensitive Data in Transit",
+ "description": "Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "oss_bucket_secure_transport_enabled",
+ "rds_instance_ssl_enabled"
+ ],
+ "aws": [
+ "cloudfront_distributions_https_enabled",
+ "cloudfront_distributions_origin_traffic_encrypted",
+ "cloudfront_distributions_using_deprecated_ssl_protocols",
+ "dms_endpoint_redis_in_transit_encryption_enabled",
+ "dms_endpoint_ssl_enabled",
+ "dynamodb_accelerator_cluster_in_transit_encryption_enabled",
+ "elasticache_redis_cluster_in_transit_encryption_enabled",
+ "elb_insecure_ssl_ciphers",
+ "elb_ssl_listeners",
+ "elb_ssl_listeners_use_acm_certificate",
+ "elbv2_insecure_ssl_ciphers",
+ "elbv2_nlb_tls_termination_enabled",
+ "elbv2_ssl_listeners",
+ "glue_database_connections_ssl_enabled",
+ "kafka_cluster_in_transit_encryption_enabled",
+ "kafka_connector_in_transit_encryption_enabled",
+ "opensearch_service_domains_https_communications_enforced",
+ "opensearch_service_domains_node_to_node_encryption_enabled",
+ "rds_instance_transport_encrypted",
+ "redshift_cluster_in_transit_encryption_enabled",
+ "s3_bucket_secure_transport_policy",
+ "sagemaker_training_jobs_intercontainer_encryption_enabled",
+ "sns_subscription_not_using_http_endpoints",
+ "transfer_server_in_transit_encryption_enabled"
+ ],
+ "azure": [
+ "app_ensure_http_is_redirected_to_https",
+ "app_minimum_tls_version_12",
+ "cosmosdb_account_minimum_tls_version",
+ "mysql_flexible_server_minimum_tls_version_12",
+ "mysql_flexible_server_ssl_connection_enabled",
+ "postgresql_flexible_server_enforce_ssl_enabled",
+ "sqlserver_recommended_minimal_tls_version",
+ "storage_ensure_minimum_tls_version_12",
+ "storage_secure_transfer_required_is_enabled",
+ "storage_smb_channel_encryption_with_secure_algorithm"
+ ],
+ "cloudflare": [
+ "zone_automatic_https_rewrites_enabled",
+ "zone_hsts_enabled",
+ "zone_https_redirect_enabled",
+ "zone_min_tls_version_secure",
+ "zone_ssl_strict",
+ "zone_tls_1_3_enabled",
+ "zone_universal_ssl_enabled"
+ ],
+ "gcp": [
+ "cloudsql_instance_ssl_connections"
+ ],
+ "kubernetes": [
+ "apiserver_etcd_cafile_set",
+ "apiserver_etcd_tls_config",
+ "apiserver_kubelet_cert_auth",
+ "apiserver_kubelet_tls_auth",
+ "apiserver_strong_ciphers_only",
+ "apiserver_tls_config",
+ "etcd_no_auto_tls",
+ "etcd_no_peer_auto_tls",
+ "etcd_peer_tls_config",
+ "etcd_tls_encryption",
+ "kubelet_strong_ciphers_only",
+ "kubelet_tls_cert_and_key"
+ ],
+ "mongodbatlas": [
+ "clusters_tls_enabled"
+ ],
+ "oraclecloud": [
+ "compute_instance_in_transit_encryption_enabled"
+ ],
+ "vercel": [
+ "domain_ssl_certificate_valid"
+ ]
+ }
+ },
+ {
+ "id": "3.11",
+ "name": "Encrypt Sensitive Data at Rest",
+ "description": "Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ecs_attached_disk_encrypted",
+ "ecs_unattached_disk_encrypted",
+ "rds_instance_tde_enabled",
+ "rds_instance_tde_key_custom"
+ ],
+ "aws": [
+ "apigateway_restapi_cache_encrypted",
+ "athena_workgroup_encryption",
+ "awslambda_function_env_vars_not_encrypted_with_cmk",
+ "backup_recovery_point_encrypted",
+ "backup_vaults_encrypted",
+ "bedrock_model_invocation_logs_encryption_enabled",
+ "bedrock_prompt_encrypted_with_cmk",
+ "cloudtrail_kms_encryption_enabled",
+ "cloudwatch_log_group_kms_encryption_enabled",
+ "codebuild_project_s3_logs_encrypted",
+ "codebuild_report_group_export_encrypted",
+ "documentdb_cluster_storage_encrypted",
+ "dynamodb_accelerator_cluster_encryption_enabled",
+ "dynamodb_tables_kms_cmk_encryption_enabled",
+ "ec2_ebs_default_encryption",
+ "ec2_ebs_snapshots_encrypted",
+ "ec2_ebs_volume_encryption",
+ "efs_encryption_at_rest_enabled",
+ "eks_cluster_kms_cmk_encryption_in_secrets_enabled",
+ "elasticache_redis_cluster_rest_encryption_enabled",
+ "firehose_stream_encrypted_at_rest",
+ "glue_data_catalogs_connection_passwords_encryption_enabled",
+ "glue_data_catalogs_metadata_encryption_enabled",
+ "glue_development_endpoints_s3_encryption_enabled",
+ "glue_etl_jobs_amazon_s3_encryption_enabled",
+ "glue_etl_jobs_cloudwatch_logs_encryption_enabled",
+ "glue_ml_transform_encrypted_at_rest",
+ "kafka_cluster_encryption_at_rest_uses_cmk",
+ "kinesis_stream_encrypted_at_rest",
+ "neptune_cluster_snapshot_encrypted",
+ "neptune_cluster_storage_encrypted",
+ "opensearch_service_domains_encryption_at_rest_enabled",
+ "rds_cluster_storage_encrypted",
+ "rds_instance_storage_encrypted",
+ "rds_snapshots_encrypted",
+ "redshift_cluster_encrypted_at_rest",
+ "s3_bucket_default_encryption",
+ "s3_bucket_kms_encryption",
+ "sagemaker_notebook_instance_encryption_enabled",
+ "sagemaker_training_jobs_volume_and_output_encryption_enabled",
+ "sns_topics_kms_encryption_at_rest_enabled",
+ "sqs_queues_server_side_encryption_enabled",
+ "stepfunctions_statemachine_encrypted_with_cmk",
+ "storagegateway_fileshare_encryption_enabled",
+ "workspaces_volume_encryption_enabled"
+ ],
+ "azure": [
+ "databricks_workspace_cmk_encryption_enabled",
+ "monitor_storage_account_with_activity_logs_cmk_encrypted",
+ "sqlserver_tde_encrypted_with_cmk",
+ "sqlserver_tde_encryption_enabled",
+ "storage_ensure_encryption_with_customer_managed_keys",
+ "storage_infrastructure_encryption_is_enabled",
+ "vm_ensure_attached_disks_encrypted_with_cmk",
+ "vm_ensure_unattached_disks_encrypted_with_cmk"
+ ],
+ "gcp": [
+ "bigquery_dataset_cmk_encryption",
+ "bigquery_table_cmk_encryption",
+ "cloudsql_instance_cmek_encryption_enabled",
+ "compute_instance_encryption_with_csek_enabled",
+ "dataproc_encrypted_with_cmks_disabled"
+ ],
+ "kubernetes": [
+ "apiserver_encryption_provider_config_set"
+ ],
+ "linode": [
+ "compute_instance_disk_encryption_enabled"
+ ],
+ "mongodbatlas": [
+ "clusters_encryption_at_rest_enabled"
+ ],
+ "openstack": [
+ "blockstorage_volume_encryption_enabled"
+ ],
+ "oraclecloud": [
+ "blockstorage_block_volume_encrypted_with_cmk",
+ "blockstorage_boot_volume_encrypted_with_cmk",
+ "filestorage_file_system_encrypted_with_cmk",
+ "objectstorage_bucket_encrypted_with_cmk"
+ ],
+ "vercel": [
+ "project_environment_no_secrets_in_plain_type"
+ ]
+ }
+ },
+ {
+ "id": "3.12",
+ "name": "Segment Data Processing and Storage Based on Sensitivity",
+ "description": "Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "3.13",
+ "name": "Deploy a Data Loss Prevention Solution",
+ "description": "Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider, and update the enterprise's data inventory.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "macie_automated_sensitive_data_discovery_enabled",
+ "macie_is_enabled"
+ ],
+ "googleworkspace": [
+ "security_dlp_drive_rules_configured"
+ ],
+ "openstack": [
+ "blockstorage_snapshot_metadata_sensitive_data",
+ "blockstorage_volume_metadata_sensitive_data",
+ "compute_instance_metadata_sensitive_data",
+ "objectstorage_container_metadata_sensitive_data"
+ ]
+ }
+ },
+ {
+ "id": "3.14",
+ "name": "Log Sensitive Data Access",
+ "description": "Log sensitive data access, including modification and disposal.",
+ "attributes": {
+ "Section": "3. Data Protection",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "oss_bucket_logging_enabled",
+ "rds_instance_sql_audit_enabled"
+ ],
+ "aws": [
+ "cloudtrail_s3_dataevents_read_enabled",
+ "cloudtrail_s3_dataevents_write_enabled",
+ "opensearch_service_domains_audit_logging_enabled"
+ ],
+ "azure": [
+ "keyvault_logging_enabled",
+ "mysql_flexible_server_audit_log_enabled",
+ "sqlserver_auditing_enabled"
+ ],
+ "gcp": [
+ "cloudstorage_audit_logs_enabled"
+ ],
+ "m365": [
+ "exchange_organization_mailbox_auditing_enabled",
+ "exchange_user_mailbox_auditing_enabled",
+ "purview_audit_log_search_enabled"
+ ],
+ "mongodbatlas": [
+ "projects_auditing_enabled"
+ ],
+ "oraclecloud": [
+ "objectstorage_bucket_logging_enabled"
+ ]
+ }
+ },
+ {
+ "id": "4.1",
+ "name": "Establish and Maintain a Secure Configuration Process",
+ "description": "Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "policy_ensure_asc_enforcement_enabled"
+ ],
+ "kubernetes": [
+ "apiserver_request_timeout_set",
+ "controllermanager_garbage_collection",
+ "kubelet_conf_file_ownership",
+ "kubelet_conf_file_permissions",
+ "kubelet_config_yaml_ownership",
+ "kubelet_config_yaml_permissions",
+ "kubelet_event_record_qps",
+ "kubelet_service_file_ownership_root",
+ "kubelet_service_file_permissions",
+ "kubelet_streaming_connection_timeout"
+ ],
+ "openstack": [
+ "compute_instance_config_drive_enabled",
+ "compute_instance_locked_status_enabled",
+ "compute_instance_trusted_image_certificates",
+ "image_secure_boot_enabled",
+ "image_signature_verification_enabled"
+ ]
+ }
+ },
+ {
+ "id": "4.2",
+ "name": "Establish and Maintain a Secure Configuration Process for Network Infrastructure",
+ "description": "Establish and maintain a documented secure configuration process for network devices. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "4.3",
+ "name": "Configure Automatic Session Locking on Enterprise Assets",
+ "description": "Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "appstream_fleet_maximum_session_duration",
+ "appstream_fleet_session_disconnect_timeout",
+ "appstream_fleet_session_idle_disconnect_timeout"
+ ],
+ "googleworkspace": [
+ "security_session_duration_limited"
+ ],
+ "m365": [
+ "entra_admin_users_sign_in_frequency_enabled",
+ "entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced",
+ "entra_intune_enrollment_sign_in_frequency_every_time"
+ ],
+ "okta": [
+ "application_admin_console_session_idle_timeout_15min",
+ "signon_global_session_cookies_not_persistent",
+ "signon_global_session_idle_timeout_15min",
+ "signon_global_session_lifetime_18h"
+ ]
+ }
+ },
+ {
+ "id": "4.4",
+ "name": "Implement and Manage a Firewall on Servers",
+ "description": "Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ecs_securitygroup_restrict_rdp_internet",
+ "ecs_securitygroup_restrict_ssh_internet"
+ ],
+ "aws": [
+ "ec2_instance_port_cassandra_exposed_to_internet",
+ "ec2_instance_port_cifs_exposed_to_internet",
+ "ec2_instance_port_elasticsearch_kibana_exposed_to_internet",
+ "ec2_instance_port_ftp_exposed_to_internet",
+ "ec2_instance_port_kafka_exposed_to_internet",
+ "ec2_instance_port_kerberos_exposed_to_internet",
+ "ec2_instance_port_ldap_exposed_to_internet",
+ "ec2_instance_port_memcached_exposed_to_internet",
+ "ec2_instance_port_mongodb_exposed_to_internet",
+ "ec2_instance_port_mysql_exposed_to_internet",
+ "ec2_instance_port_oracle_exposed_to_internet",
+ "ec2_instance_port_postgresql_exposed_to_internet",
+ "ec2_instance_port_rdp_exposed_to_internet",
+ "ec2_instance_port_redis_exposed_to_internet",
+ "ec2_instance_port_sqlserver_exposed_to_internet",
+ "ec2_instance_port_ssh_exposed_to_internet",
+ "ec2_instance_port_telnet_exposed_to_internet",
+ "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+ "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
+ "ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip",
+ "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
+ "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
+ "ec2_securitygroup_allow_wide_open_public_ipv4",
+ "ec2_securitygroup_default_restrict_traffic",
+ "ec2_securitygroup_with_many_ingress_egress_rules"
+ ],
+ "azure": [
+ "network_subnet_nsg_associated",
+ "network_rdp_internet_access_restricted",
+ "network_ssh_internet_access_restricted"
+ ],
+ "gcp": [
+ "compute_firewall_rdp_access_from_the_internet_allowed",
+ "compute_firewall_ssh_access_from_the_internet_allowed"
+ ],
+ "kubernetes": [
+ "kubelet_manage_iptables"
+ ],
+ "linode": [
+ "networking_firewall_assigned_to_devices",
+ "networking_firewall_default_inbound_policy_drop",
+ "networking_firewall_default_outbound_policy_drop",
+ "networking_firewall_inbound_rules_configured",
+ "networking_firewall_outbound_rules_configured",
+ "networking_firewall_status_enabled"
+ ],
+ "mongodbatlas": [
+ "organizations_api_access_list_required",
+ "projects_network_access_list_exposed_to_internet"
+ ],
+ "nhn": [
+ "compute_instance_security_groups"
+ ],
+ "openstack": [
+ "compute_instance_security_groups_attached",
+ "networking_port_security_disabled",
+ "networking_security_group_allows_all_ingress_from_internet",
+ "networking_security_group_allows_rdp_from_internet",
+ "networking_security_group_allows_ssh_from_internet"
+ ],
+ "oraclecloud": [
+ "network_default_security_list_restricts_traffic",
+ "network_security_group_ingress_from_internet_to_rdp_port",
+ "network_security_group_ingress_from_internet_to_ssh_port",
+ "network_security_list_ingress_from_internet_to_rdp_port",
+ "network_security_list_ingress_from_internet_to_ssh_port"
+ ],
+ "stackit": [
+ "iaas_security_group_all_traffic_unrestricted",
+ "iaas_security_group_database_unrestricted",
+ "iaas_security_group_rdp_unrestricted",
+ "iaas_security_group_ssh_unrestricted"
+ ],
+ "vercel": [
+ "security_custom_rules_configured",
+ "security_ip_blocking_rules_configured",
+ "security_waf_enabled"
+ ]
+ }
+ },
+ {
+ "id": "4.5",
+ "name": "Implement and Manage a Firewall on End-User Devices",
+ "description": "Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "4.6",
+ "name": "Securely Manage Enterprise Assets and Software",
+ "description": "Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "oss_bucket_secure_transport_enabled",
+ "rds_instance_ssl_enabled"
+ ],
+ "aws": [
+ "autoscaling_group_launch_configuration_requires_imdsv2",
+ "ec2_instance_account_imdsv2_enabled",
+ "ec2_instance_imdsv2_enabled",
+ "ec2_instance_managed_by_ssm",
+ "ec2_launch_template_imdsv2_required"
+ ],
+ "azure": [
+ "app_client_certificates_on",
+ "app_ensure_http_is_redirected_to_https",
+ "storage_secure_transfer_required_is_enabled",
+ "vm_linux_enforce_ssh_authentication"
+ ],
+ "cloudflare": [
+ "zone_automatic_https_rewrites_enabled",
+ "zone_https_redirect_enabled",
+ "zone_min_tls_version_secure",
+ "zone_ssl_strict"
+ ],
+ "gcp": [
+ "compute_instance_block_project_wide_ssh_keys_disabled",
+ "compute_project_os_login_enabled"
+ ],
+ "kubernetes": [
+ "controllermanager_bind_address",
+ "scheduler_bind_address"
+ ],
+ "mongodbatlas": [
+ "clusters_tls_enabled"
+ ],
+ "openstack": [
+ "compute_instance_key_based_authentication"
+ ],
+ "oraclecloud": [
+ "compute_instance_legacy_metadata_endpoint_disabled"
+ ]
+ }
+ },
+ {
+ "id": "4.7",
+ "name": "Manage Default Accounts on Enterprise Assets and Software",
+ "description": "Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_no_root_access_key"
+ ],
+ "aws": [
+ "iam_avoid_root_usage",
+ "iam_no_root_access_key",
+ "iam_root_credentials_management_enabled",
+ "rds_cluster_default_admin",
+ "rds_instance_default_admin",
+ "redshift_cluster_non_default_username"
+ ],
+ "azure": [
+ "aks_cluster_local_accounts_disabled",
+ "containerregistry_admin_user_disabled",
+ "cosmosdb_account_use_aad_and_rbac",
+ "storage_account_key_access_disabled"
+ ],
+ "gcp": [
+ "compute_instance_default_service_account_in_use",
+ "compute_instance_default_service_account_in_use_with_full_api_access",
+ "gke_cluster_no_default_service_account"
+ ],
+ "kubernetes": [
+ "apiserver_anonymous_requests",
+ "kubelet_disable_anonymous_auth"
+ ],
+ "m365": [
+ "exchange_shared_mailbox_sign_in_disabled"
+ ],
+ "nhn": [
+ "compute_instance_login_user"
+ ],
+ "oraclecloud": [
+ "identity_tenancy_admin_users_no_api_keys"
+ ],
+ "scaleway": [
+ "iam_api_keys_no_root_owned"
+ ]
+ }
+ },
+ {
+ "id": "4.8",
+ "name": "Uninstall or Disable Unnecessary Services on Enterprise Assets and Software",
+ "description": "Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "cs_kubernetes_dashboard_disabled"
+ ],
+ "azure": [
+ "app_ftp_deployment_disabled",
+ "app_function_ftps_deployment_disabled"
+ ],
+ "gcp": [
+ "compute_instance_ip_forwarding_is_enabled",
+ "compute_instance_serial_ports_in_use"
+ ],
+ "googleworkspace": [
+ "chat_incoming_webhooks_disabled",
+ "drive_desktop_access_disabled",
+ "gmail_per_user_outbound_gateway_disabled",
+ "gmail_pop_imap_access_disabled",
+ "security_less_secure_apps_disabled",
+ "sites_service_disabled"
+ ],
+ "kubernetes": [
+ "apiserver_disable_profiling",
+ "controllermanager_disable_profiling",
+ "kubelet_disable_read_only_port",
+ "scheduler_profiling"
+ ],
+ "m365": [
+ "exchange_transport_config_smtp_auth_disabled",
+ "teams_email_sending_to_channel_disabled"
+ ],
+ "oraclecloud": [
+ "compute_instance_legacy_metadata_endpoint_disabled"
+ ],
+ "vercel": [
+ "project_auto_expose_system_env_disabled",
+ "project_directory_listing_disabled"
+ ]
+ }
+ },
+ {
+ "id": "4.9",
+ "name": "Configure Trusted DNS Servers on Enterprise Assets",
+ "description": "Configure trusted DNS servers on network infrastructure. Example implementations include configuring network devices to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "cloudflare": [
+ "zone_dnssec_enabled"
+ ]
+ }
+ },
+ {
+ "id": "4.10",
+ "name": "Enforce Automatic Device Lockout on Portable End-User Devices",
+ "description": "Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "4.11",
+ "name": "Enforce Remote Wipe Capability on Portable End-User Devices",
+ "description": "Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "4.12",
+ "name": "Separate Enterprise Workspaces on Mobile End-User Devices",
+ "description": "Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data.",
+ "attributes": {
+ "Section": "4. Secure Configuration of Enterprise Assets and Software",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "5.1",
+ "name": "Establish and Maintain an Inventory of Accounts",
+ "description": "Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must at a minimum include user, administrator, and service accounts. The inventory, at a minimum, should contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Identify",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "5.2",
+ "name": "Use Unique Passwords",
+ "description": "Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_password_policy_lowercase",
+ "ram_password_policy_minimum_length",
+ "ram_password_policy_number",
+ "ram_password_policy_password_reuse_prevention",
+ "ram_password_policy_symbol",
+ "ram_password_policy_uppercase"
+ ],
+ "aws": [
+ "cognito_user_pool_password_policy_lowercase",
+ "cognito_user_pool_password_policy_minimum_length_14",
+ "cognito_user_pool_password_policy_number",
+ "cognito_user_pool_password_policy_symbol",
+ "cognito_user_pool_password_policy_uppercase",
+ "iam_password_policy_lowercase",
+ "iam_password_policy_minimum_length_14",
+ "iam_password_policy_number",
+ "iam_password_policy_reuse_24",
+ "iam_password_policy_symbol",
+ "iam_password_policy_uppercase"
+ ],
+ "googleworkspace": [
+ "security_password_policy_strong"
+ ],
+ "okta": [
+ "authenticator_password_common_password_check",
+ "authenticator_password_complexity_lowercase",
+ "authenticator_password_complexity_number",
+ "authenticator_password_complexity_symbol",
+ "authenticator_password_complexity_uppercase",
+ "authenticator_password_history_5",
+ "authenticator_password_minimum_length_15"
+ ],
+ "oraclecloud": [
+ "identity_password_policy_minimum_length_14",
+ "identity_password_policy_prevents_reuse"
+ ]
+ }
+ },
+ {
+ "id": "5.3",
+ "name": "Disable Dormant Accounts",
+ "description": "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_user_console_access_unused"
+ ],
+ "aws": [
+ "iam_user_accesskey_unused",
+ "iam_user_console_access_unused"
+ ],
+ "azure": [
+ "entra_user_with_recent_sign_in"
+ ],
+ "gcp": [
+ "iam_sa_user_managed_key_unused",
+ "iam_service_account_unused"
+ ],
+ "okta": [
+ "user_inactivity_automation_35d_enabled"
+ ],
+ "vercel": [
+ "authentication_no_stale_tokens"
+ ]
+ }
+ },
+ {
+ "id": "5.4",
+ "name": "Restrict Administrator Privileges to Dedicated Administrator Accounts",
+ "description": "Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_policy_no_administrative_privileges"
+ ],
+ "aws": [
+ "iam_aws_attached_policy_no_administrative_privileges",
+ "iam_customer_attached_policy_no_administrative_privileges",
+ "iam_group_administrator_access_policy",
+ "iam_inline_policy_no_administrative_privileges",
+ "iam_role_administratoraccess_policy",
+ "iam_user_administrator_access_policy"
+ ],
+ "azure": [
+ "app_function_identity_without_admin_privileges",
+ "entra_global_admin_in_less_than_five_users",
+ "iam_role_user_access_admin_restricted",
+ "iam_subscription_roles_owner_custom_not_created"
+ ],
+ "gcp": [
+ "iam_sa_no_administrative_privileges"
+ ],
+ "googleworkspace": [
+ "directory_super_admin_count",
+ "directory_super_admin_only_admin_roles"
+ ],
+ "kubernetes": [
+ "rbac_cluster_admin_usage"
+ ],
+ "m365": [
+ "admincenter_users_admins_reduced_license_footprint",
+ "admincenter_users_between_two_and_four_global_admins",
+ "entra_admin_portals_access_restriction",
+ "entra_admin_users_cloud_only"
+ ],
+ "okta": [
+ "apitoken_not_super_admin"
+ ],
+ "oraclecloud": [
+ "identity_iam_admins_cannot_update_tenancy_admins",
+ "identity_service_level_admins_exist",
+ "identity_tenancy_admin_permissions_limited",
+ "identity_tenancy_admin_users_no_api_keys"
+ ],
+ "scaleway": [
+ "iam_api_keys_no_root_owned"
+ ],
+ "vercel": [
+ "team_member_role_least_privilege"
+ ]
+ }
+ },
+ {
+ "id": "5.5",
+ "name": "Establish and Maintain an Inventory of Service Accounts",
+ "description": "Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Identify",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "5.6",
+ "name": "Centralize Account Management",
+ "description": "Centralize account management through a directory or identity service.",
+ "attributes": {
+ "Section": "5. Account Management",
+ "Function": "Govern",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "iam_check_saml_providers_sts"
+ ],
+ "azure": [
+ "cosmosdb_account_use_aad_and_rbac",
+ "postgresql_flexible_server_entra_id_authentication_enabled",
+ "sqlserver_azuread_administrator_enabled",
+ "storage_default_to_entra_authorization_enabled"
+ ],
+ "vercel": [
+ "team_directory_sync_enabled",
+ "team_saml_sso_enabled"
+ ]
+ }
+ },
+ {
+ "id": "6.1",
+ "name": "Establish an Access Granting Process",
+ "description": "Establish and follow a documented process, preferably automated, for granting access to enterprise assets upon new hire or role change of a user.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "vercel": [
+ "team_directory_sync_enabled"
+ ]
+ }
+ },
+ {
+ "id": "6.2",
+ "name": "Establish an Access Revoking Process",
+ "description": "Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "vercel": [
+ "team_directory_sync_enabled"
+ ]
+ }
+ },
+ {
+ "id": "6.3",
+ "name": "Require MFA for Externally-Exposed Applications",
+ "description": "Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_user_mfa_enabled_console_access"
+ ],
+ "aws": [
+ "cognito_user_pool_mfa_enabled",
+ "iam_user_hardware_mfa_enabled",
+ "iam_user_mfa_enabled_console_access"
+ ],
+ "azure": [
+ "entra_authentication_methods_policy_strong_auth_enforced",
+ "entra_non_privileged_user_has_mfa",
+ "entra_security_defaults_enabled"
+ ],
+ "github": [
+ "organization_members_mfa_required"
+ ],
+ "googleworkspace": [
+ "security_2sv_enforced",
+ "security_advanced_protection_configured"
+ ],
+ "linode": [
+ "administration_user_2fa_enabled"
+ ],
+ "m365": [
+ "entra_conditional_access_policy_mfa_enforced_for_guest_users",
+ "entra_users_mfa_capable",
+ "entra_users_mfa_enabled"
+ ],
+ "mongodbatlas": [
+ "organizations_mfa_required"
+ ],
+ "okta": [
+ "application_dashboard_mfa_required",
+ "application_dashboard_phishing_resistant_authentication"
+ ],
+ "oraclecloud": [
+ "identity_user_mfa_enabled_console_access"
+ ]
+ }
+ },
+ {
+ "id": "6.4",
+ "name": "Require MFA for Remote Network Access",
+ "description": "Require MFA for remote network access.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "directoryservice_radius_server_security_protocol",
+ "directoryservice_supported_mfa_radius_enabled"
+ ],
+ "azure": [
+ "entra_user_with_vm_access_has_mfa",
+ "entra_security_defaults_enabled",
+ "entra_non_privileged_user_has_mfa"
+ ],
+ "gcp": [
+ "compute_project_os_login_2fa_enabled"
+ ],
+ "github": [
+ "organization_members_mfa_required"
+ ],
+ "linode": [
+ "administration_user_2fa_enabled"
+ ],
+ "m365": [
+ "entra_users_mfa_enabled",
+ "entra_legacy_authentication_blocked"
+ ],
+ "mongodbatlas": [
+ "organizations_mfa_required"
+ ]
+ }
+ },
+ {
+ "id": "6.5",
+ "name": "Require MFA for Administrative Access",
+ "description": "Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ram_user_mfa_enabled_console_access"
+ ],
+ "aws": [
+ "iam_administrator_access_with_mfa",
+ "iam_root_hardware_mfa_enabled",
+ "iam_root_mfa_enabled"
+ ],
+ "azure": [
+ "entra_conditional_access_policy_require_mfa_for_admin_portals",
+ "entra_conditional_access_policy_require_mfa_for_management_api",
+ "entra_privileged_user_has_mfa",
+ "entra_user_with_vm_access_has_mfa"
+ ],
+ "github": [
+ "organization_members_mfa_required"
+ ],
+ "googleworkspace": [
+ "security_2sv_hardware_keys_admins"
+ ],
+ "linode": [
+ "administration_user_2fa_enabled"
+ ],
+ "m365": [
+ "entra_admin_users_mfa_enabled",
+ "entra_admin_users_phishing_resistant_mfa_enabled",
+ "entra_break_glass_account_fido2_security_key_registered"
+ ],
+ "mongodbatlas": [
+ "organizations_mfa_required"
+ ],
+ "okta": [
+ "application_admin_console_mfa_required",
+ "application_admin_console_phishing_resistant_authentication"
+ ],
+ "vercel": [
+ "team_saml_sso_enforced",
+ "team_saml_sso_enabled"
+ ]
+ }
+ },
+ {
+ "id": "6.6",
+ "name": "Establish and Maintain an Inventory of Authentication and Authorization Systems",
+ "description": "Establish and maintain an inventory of the enterprise's authentication and authorization systems, including those hosted on-site or at a remote service provider. Review and update the inventory, at a minimum, annually, or more frequently.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "6.7",
+ "name": "Centralize Access Control",
+ "description": "Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "dms_endpoint_neptune_iam_authorization_enabled",
+ "iam_check_saml_providers_sts",
+ "neptune_cluster_iam_authentication_enabled",
+ "opensearch_service_domains_use_cognito_authentication_for_kibana",
+ "rds_cluster_iam_authentication_enabled",
+ "rds_instance_iam_authentication_enabled",
+ "sagemaker_domain_sso_configured"
+ ],
+ "azure": [
+ "aks_cluster_local_accounts_disabled",
+ "cosmosdb_account_use_aad_and_rbac",
+ "postgresql_flexible_server_entra_id_authentication_enabled",
+ "sqlserver_azuread_administrator_enabled"
+ ],
+ "m365": [
+ "entra_all_apps_conditional_access_coverage",
+ "entra_conditional_access_policy_all_apps_all_users",
+ "entra_password_hash_sync_enabled"
+ ],
+ "vercel": [
+ "team_directory_sync_enabled",
+ "team_saml_sso_enabled",
+ "team_saml_sso_enforced"
+ ]
+ }
+ },
+ {
+ "id": "6.8",
+ "name": "Define and Maintain Role-Based Access Control",
+ "description": "Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.",
+ "attributes": {
+ "Section": "6. Access Control Management",
+ "Function": "Govern",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "cs_kubernetes_rbac_enabled",
+ "ram_policy_attached_only_to_group_or_roles",
+ "ram_policy_no_administrative_privileges"
+ ],
+ "aws": [
+ "accessanalyzer_enabled",
+ "accessanalyzer_enabled_without_findings",
+ "bedrock_agent_role_least_privilege",
+ "bedrock_api_key_no_administrative_privileges",
+ "ec2_instance_profile_attached",
+ "iam_inline_policy_allows_privilege_escalation",
+ "iam_inline_policy_no_full_access_to_cloudtrail",
+ "iam_inline_policy_no_full_access_to_kms",
+ "iam_inline_policy_no_wildcard_marketplace_subscribe",
+ "iam_no_custom_policy_permissive_role_assumption",
+ "iam_policy_allows_privilege_escalation",
+ "iam_policy_no_full_access_to_cloudtrail",
+ "iam_policy_no_full_access_to_kms",
+ "iam_policy_no_wildcard_marketplace_subscribe",
+ "iam_role_cross_account_readonlyaccess_policy",
+ "iam_role_cross_service_confused_deputy_prevention",
+ "iam_user_with_temporary_credentials"
+ ],
+ "azure": [
+ "aks_cluster_rbac_enabled",
+ "cosmosdb_account_use_aad_and_rbac",
+ "entra_policy_default_users_cannot_create_security_groups",
+ "entra_policy_ensure_default_user_cannot_create_apps",
+ "iam_role_user_access_admin_restricted",
+ "iam_subscription_roles_owner_custom_not_created",
+ "keyvault_rbac_enabled"
+ ],
+ "gcp": [
+ "iam_account_access_approval_enabled",
+ "iam_no_service_roles_at_project_level",
+ "iam_role_kms_enforce_separation_of_duties",
+ "iam_role_sa_enforce_separation_of_duties",
+ "iam_sa_no_administrative_privileges"
+ ],
+ "github": [
+ "organization_default_repository_permission_strict",
+ "organization_repository_creation_limited",
+ "organization_repository_deletion_limited"
+ ],
+ "kubernetes": [
+ "apiserver_auth_mode_include_node",
+ "apiserver_auth_mode_include_rbac",
+ "apiserver_auth_mode_not_always_allow",
+ "controllermanager_service_account_credentials",
+ "kubelet_authorization_mode",
+ "rbac_minimize_csr_approval_access",
+ "rbac_minimize_node_proxy_subresource_access",
+ "rbac_minimize_pod_creation_access",
+ "rbac_minimize_pv_creation_access",
+ "rbac_minimize_service_account_token_creation",
+ "rbac_minimize_webhook_config_access",
+ "rbac_minimize_wildcard_use_roles"
+ ],
+ "m365": [
+ "entra_admin_portals_access_restriction",
+ "entra_app_registration_no_unused_privileged_permissions",
+ "entra_policy_guest_users_access_restrictions",
+ "entra_service_principal_privileged_role_no_owners"
+ ],
+ "oraclecloud": [
+ "identity_no_resources_in_root_compartment",
+ "identity_non_root_compartment_exists",
+ "identity_service_level_admins_exist",
+ "identity_storage_service_level_admins_scoped",
+ "identity_tenancy_admin_permissions_limited"
+ ],
+ "vercel": [
+ "team_member_role_least_privilege"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "7.1",
+ "name": "Establish and Maintain a Vulnerability Management Process",
+ "description": "Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "7.2",
+ "name": "Establish and Maintain a Remediation Process",
+ "description": "Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "7.3",
+ "name": "Perform Automated Operating System Patch Management",
+ "description": "Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ecs_instance_latest_os_patches_applied"
+ ],
+ "aws": [
+ "ssm_managed_compliant_patching"
+ ],
+ "azure": [
+ "aks_cluster_auto_upgrade_enabled",
+ "defender_ensure_system_updates_are_applied"
+ ]
+ }
+ },
+ {
+ "id": "7.4",
+ "name": "Perform Automated Application Patch Management",
+ "description": "Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "dms_instance_minor_version_upgrade_enabled",
+ "elasticache_redis_cluster_auto_minor_version_upgrades",
+ "elasticbeanstalk_environment_managed_updates_enabled",
+ "memorydb_cluster_auto_minor_version_upgrades",
+ "mq_broker_auto_minor_version_upgrades",
+ "rds_cluster_minor_version_upgrade_enabled",
+ "rds_instance_minor_version_upgrade_enabled",
+ "redshift_cluster_automatic_upgrades"
+ ],
+ "azure": [
+ "app_ensure_java_version_is_latest",
+ "app_ensure_php_version_is_latest",
+ "app_ensure_python_version_is_latest",
+ "app_function_latest_runtime_version"
+ ]
+ }
+ },
+ {
+ "id": "7.5",
+ "name": "Perform Automated Vulnerability Scans of Internal Enterprise Assets",
+ "description": "Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "securitycenter_vulnerability_scan_enabled"
+ ],
+ "aws": [
+ "ecr_registry_scan_images_on_push_enabled",
+ "ecr_repositories_scan_images_on_push_enabled",
+ "ecr_repositories_scan_vulnerabilities_in_latest_image",
+ "inspector2_is_enabled"
+ ],
+ "azure": [
+ "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+ "defender_container_images_scan_enabled",
+ "sqlserver_va_emails_notifications_admins_enabled",
+ "sqlserver_va_periodic_recurring_scans_enabled",
+ "sqlserver_va_scan_reports_configured",
+ "sqlserver_vulnerability_assessment_enabled"
+ ],
+ "gcp": [
+ "artifacts_container_analysis_enabled",
+ "gcr_container_scanning_enabled"
+ ],
+ "github": [
+ "repository_dependency_scanning_enabled"
+ ]
+ }
+ },
+ {
+ "id": "7.6",
+ "name": "Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets",
+ "description": "Perform automated vulnerability scans of externally-exposed enterprise assets. Perform scans on a monthly, or more frequent, basis.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "inspector2_is_enabled"
+ ],
+ "azure": [
+ "network_public_ip_shodan"
+ ]
+ }
+ },
+ {
+ "id": "7.7",
+ "name": "Remediate Detected Vulnerabilities",
+ "description": "Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.",
+ "attributes": {
+ "Section": "7. Continuous Vulnerability Management",
+ "Function": "Respond",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "inspector2_active_findings_exist"
+ ],
+ "azure": [
+ "defender_container_images_resolved_vulnerabilities"
+ ]
+ }
+ },
+ {
+ "id": "8.1",
+ "name": "Establish and Maintain an Audit Log Management Process",
+ "description": "Establish and maintain a documented audit log management process that defines the enterprise's logging requirements. At a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "8.2",
+ "name": "Collect Audit Logs",
+ "description": "Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "actiontrail_multi_region_enabled",
+ "cs_kubernetes_log_service_enabled",
+ "oss_bucket_logging_enabled",
+ "rds_instance_sql_audit_enabled",
+ "vpc_flow_logs_enabled"
+ ],
+ "aws": [
+ "apigateway_restapi_logging_enabled",
+ "apigatewayv2_api_access_logging_enabled",
+ "appsync_field_level_logging_enabled",
+ "athena_workgroup_logging_enabled",
+ "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",
+ "bedrock_model_invocation_logging_enabled",
+ "cloudfront_distributions_logging_enabled",
+ "cloudtrail_bedrock_logging_enabled",
+ "cloudtrail_cloudwatch_logging_enabled",
+ "cloudtrail_logs_s3_bucket_access_logging_enabled",
+ "cloudtrail_multi_region_enabled",
+ "cloudtrail_multi_region_enabled_logging_management_events",
+ "codebuild_project_logging_enabled",
+ "config_recorder_all_regions_enabled",
+ "datasync_task_logging_enabled",
+ "directoryservice_directory_log_forwarding_enabled",
+ "dms_replication_task_source_logging_enabled",
+ "dms_replication_task_target_logging_enabled",
+ "documentdb_cluster_cloudwatch_log_export",
+ "ec2_client_vpn_endpoint_connection_logging_enabled",
+ "ecs_task_definitions_logging_enabled",
+ "eks_control_plane_logging_all_types_enabled",
+ "elasticbeanstalk_environment_cloudwatch_logging_enabled",
+ "elb_logging_enabled",
+ "elbv2_logging_enabled",
+ "mq_broker_logging_enabled",
+ "neptune_cluster_integration_cloudwatch_logs",
+ "networkfirewall_logging_enabled",
+ "opensearch_service_domains_cloudwatch_logging_enabled",
+ "rds_cluster_integration_cloudwatch_logs",
+ "rds_instance_integration_cloudwatch_logs",
+ "redshift_cluster_audit_logging",
+ "s3_bucket_server_access_logging_enabled",
+ "stepfunctions_statemachine_logging_enabled",
+ "vpc_flow_logs_enabled",
+ "waf_global_webacl_logging_enabled",
+ "wafv2_webacl_logging_enabled"
+ ],
+ "azure": [
+ "app_function_application_insights_enabled",
+ "app_http_logs_enabled",
+ "appinsights_ensure_is_configured",
+ "defender_auto_provisioning_log_analytics_agent_vms_on",
+ "keyvault_logging_enabled",
+ "monitor_diagnostic_settings_exists",
+ "mysql_flexible_server_audit_log_enabled",
+ "network_flow_log_captured_sent",
+ "postgresql_flexible_server_log_checkpoints_on",
+ "postgresql_flexible_server_log_connections_on",
+ "sqlserver_auditing_enabled"
+ ],
+ "gcp": [
+ "cloudstorage_audit_logs_enabled",
+ "cloudstorage_bucket_logging_enabled",
+ "compute_loadbalancer_logging_enabled",
+ "iam_audit_logs_enabled",
+ "logging_sink_created"
+ ],
+ "googleworkspace": [
+ "gmail_comprehensive_mail_storage_enabled"
+ ],
+ "kubernetes": [
+ "apiserver_audit_log_path_set"
+ ],
+ "m365": [
+ "exchange_mailbox_audit_bypass_disabled",
+ "exchange_organization_mailbox_auditing_enabled",
+ "exchange_user_mailbox_auditing_enabled",
+ "purview_audit_log_search_enabled"
+ ],
+ "mongodbatlas": [
+ "projects_auditing_enabled"
+ ],
+ "okta": [
+ "systemlog_streaming_enabled"
+ ],
+ "oraclecloud": [
+ "network_vcn_subnet_flow_logs_enabled",
+ "objectstorage_bucket_logging_enabled"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "8.3",
+ "name": "Ensure Adequate Audit Log Storage",
+ "description": "Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "kubernetes": [
+ "apiserver_audit_log_maxbackup_set",
+ "apiserver_audit_log_maxsize_set"
+ ]
+ }
+ },
+ {
+ "id": "8.4",
+ "name": "Standardize Time Synchronization",
+ "description": "Standardize time synchronization. Configure at least two synchronized time sources across enterprise assets, where supported.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "8.5",
+ "name": "Collect Detailed Audit Logs",
+ "description": "Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "rds_instance_postgresql_log_connections_enabled",
+ "rds_instance_postgresql_log_disconnections_enabled",
+ "rds_instance_postgresql_log_duration_enabled"
+ ],
+ "aws": [
+ "cloudtrail_s3_dataevents_read_enabled",
+ "cloudtrail_s3_dataevents_write_enabled",
+ "opensearch_service_domains_audit_logging_enabled"
+ ],
+ "azure": [
+ "monitor_diagnostic_setting_with_appropriate_categories",
+ "mysql_flexible_server_audit_log_connection_activated",
+ "postgresql_flexible_server_log_connections_on",
+ "postgresql_flexible_server_log_disconnections_on"
+ ],
+ "gcp": [
+ "cloudsql_instance_postgres_enable_pgaudit_flag",
+ "cloudsql_instance_postgres_log_connections_flag",
+ "cloudsql_instance_postgres_log_disconnections_flag",
+ "cloudsql_instance_postgres_log_error_verbosity_flag",
+ "cloudsql_instance_postgres_log_min_duration_statement_flag",
+ "cloudsql_instance_postgres_log_min_error_statement_flag",
+ "cloudsql_instance_postgres_log_min_messages_flag",
+ "cloudsql_instance_postgres_log_statement_flag"
+ ],
+ "m365": [
+ "exchange_user_mailbox_auditing_enabled"
+ ],
+ "mongodbatlas": [
+ "projects_auditing_enabled"
+ ]
+ }
+ },
+ {
+ "id": "8.6",
+ "name": "Collect DNS Query Audit Logs",
+ "description": "Collect DNS query audit logs on enterprise assets, where appropriate and supported.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "route53_public_hosted_zones_cloudwatch_logging_enabled"
+ ],
+ "gcp": [
+ "compute_network_dns_logging_enabled"
+ ]
+ }
+ },
+ {
+ "id": "8.7",
+ "name": "Collect URL Request Audit Logs",
+ "description": "Collect URL request audit logs on enterprise assets, where appropriate and supported.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "app_http_logs_enabled"
+ ],
+ "gcp": [
+ "compute_loadbalancer_logging_enabled"
+ ]
+ }
+ },
+ {
+ "id": "8.8",
+ "name": "Collect Command-Line Audit Logs",
+ "description": "Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell®, BASH™, and remote administrative terminals.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "8.9",
+ "name": "Centralize Audit Logs",
+ "description": "Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "cloudtrail_cloudwatch_logging_enabled",
+ "config_delegated_admin_and_org_aggregator_all_regions"
+ ],
+ "azure": [
+ "defender_auto_provisioning_log_analytics_agent_vms_on",
+ "network_flow_log_captured_sent"
+ ],
+ "gcp": [
+ "logging_sink_created"
+ ],
+ "m365": [
+ "purview_audit_log_search_enabled"
+ ],
+ "okta": [
+ "systemlog_streaming_enabled"
+ ]
+ }
+ },
+ {
+ "id": "8.10",
+ "name": "Retain Audit Logs",
+ "description": "Retain audit logs across enterprise assets for a minimum of 90 days.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "rds_instance_sql_audit_retention",
+ "sls_logstore_retention_period"
+ ],
+ "aws": [
+ "cloudwatch_log_group_retention_policy_specific_days_enabled"
+ ],
+ "azure": [
+ "network_flow_log_more_than_90_days",
+ "postgresql_flexible_server_log_retention_days_greater_3",
+ "sqlserver_auditing_retention_90_days"
+ ],
+ "gcp": [
+ "cloudstorage_bucket_log_retention_policy_lock"
+ ],
+ "kubernetes": [
+ "apiserver_audit_log_maxage_set"
+ ],
+ "m365": [
+ "exchange_user_mailbox_auditing_enabled"
+ ],
+ "oraclecloud": [
+ "audit_log_retention_period_365_days"
+ ]
+ }
+ },
+ {
+ "id": "8.11",
+ "name": "Conduct Audit Log Reviews",
+ "description": "Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "sls_cloud_firewall_changes_alert_enabled",
+ "sls_customer_created_cmk_changes_alert_enabled",
+ "sls_management_console_authentication_failures_alert_enabled",
+ "sls_management_console_signin_without_mfa_alert_enabled",
+ "sls_oss_bucket_policy_changes_alert_enabled",
+ "sls_oss_permission_changes_alert_enabled",
+ "sls_ram_role_changes_alert_enabled",
+ "sls_rds_instance_configuration_changes_alert_enabled",
+ "sls_root_account_usage_alert_enabled",
+ "sls_security_group_changes_alert_enabled",
+ "sls_unauthorized_api_calls_alert_enabled",
+ "sls_vpc_changes_alert_enabled",
+ "sls_vpc_network_route_changes_alert_enabled"
+ ],
+ "aws": [
+ "cloudtrail_insights_exist",
+ "cloudwatch_changes_to_network_acls_alarm_configured",
+ "cloudwatch_changes_to_network_gateways_alarm_configured",
+ "cloudwatch_changes_to_network_route_tables_alarm_configured",
+ "cloudwatch_changes_to_vpcs_alarm_configured",
+ "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
+ "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
+ "cloudwatch_log_metric_filter_authentication_failures",
+ "cloudwatch_log_metric_filter_aws_organizations_changes",
+ "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
+ "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
+ "cloudwatch_log_metric_filter_policy_changes",
+ "cloudwatch_log_metric_filter_root_usage",
+ "cloudwatch_log_metric_filter_security_group_changes",
+ "cloudwatch_log_metric_filter_sign_in_without_mfa",
+ "cloudwatch_log_metric_filter_unauthorized_api_calls"
+ ],
+ "azure": [
+ "monitor_alert_create_policy_assignment",
+ "monitor_alert_create_update_nsg",
+ "monitor_alert_create_update_public_ip_address_rule",
+ "monitor_alert_create_update_security_solution",
+ "monitor_alert_create_update_sqlserver_fr",
+ "monitor_alert_delete_nsg",
+ "monitor_alert_delete_policy_assignment",
+ "monitor_alert_delete_public_ip_address_rule",
+ "monitor_alert_delete_security_solution",
+ "monitor_alert_delete_sqlserver_fr",
+ "monitor_alert_service_health_exists"
+ ],
+ "gcp": [
+ "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
+ "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
+ ],
+ "googleworkspace": [
+ "rules_admin_privilege_granted_alert_configured",
+ "rules_gmail_employee_spoofing_alert_configured",
+ "rules_government_backed_attacks_alert_configured",
+ "rules_leaked_password_alert_configured",
+ "rules_password_changed_alert_configured",
+ "rules_suspicious_activity_suspension_alert_configured",
+ "rules_suspicious_login_alert_configured",
+ "rules_suspicious_programmatic_login_alert_configured"
+ ],
+ "oraclecloud": [
+ "events_rule_cloudguard_problems",
+ "events_rule_iam_group_changes",
+ "events_rule_iam_policy_changes",
+ "events_rule_identity_provider_changes",
+ "events_rule_idp_group_mapping_changes",
+ "events_rule_local_user_authentication",
+ "events_rule_network_gateway_changes",
+ "events_rule_network_security_group_changes",
+ "events_rule_route_table_changes",
+ "events_rule_security_list_changes",
+ "events_rule_user_changes",
+ "events_rule_vcn_changes"
+ ]
+ }
+ },
+ {
+ "id": "8.12",
+ "name": "Collect Service Provider Logs",
+ "description": "Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.",
+ "attributes": {
+ "Section": "8. Audit Log Management",
+ "Function": "Detect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "actiontrail_multi_region_enabled"
+ ],
+ "aws": [
+ "cloudtrail_multi_region_enabled",
+ "cloudtrail_multi_region_enabled_logging_management_events"
+ ],
+ "azure": [
+ "monitor_diagnostic_settings_exists"
+ ],
+ "gcp": [
+ "iam_audit_logs_enabled"
+ ],
+ "m365": [
+ "purview_audit_log_search_enabled"
+ ],
+ "okta": [
+ "systemlog_streaming_enabled"
+ ]
+ }
+ },
+ {
+ "id": "9.1",
+ "name": "Ensure Use of Only Fully Supported Browsers and Email Clients",
+ "description": "Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "9.2",
+ "name": "Use DNS Filtering Services",
+ "description": "Use DNS filtering services on all end-user devices, including remote and on-premises assets, to block access to known malicious domains.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "9.3",
+ "name": "Maintain and Enforce Network-Based URL Filters",
+ "description": "Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "googleworkspace": [
+ "gmail_shortener_scanning_enabled",
+ "gmail_untrusted_link_warnings_enabled"
+ ],
+ "m365": [
+ "defender_safelinks_policy_enabled"
+ ]
+ }
+ },
+ {
+ "id": "9.4",
+ "name": "Restrict Unnecessary or Unauthorized Browser and Email Client Extensions",
+ "description": "Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and add-on applications.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "m365": [
+ "exchange_mailbox_policy_additional_storage_restricted",
+ "exchange_roles_assignment_policy_addins_disabled"
+ ]
+ }
+ },
+ {
+ "id": "9.5",
+ "name": "Implement DMARC",
+ "description": "To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting with implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM) standards.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "ses_identity_dkim_enabled"
+ ],
+ "cloudflare": [
+ "zone_record_dkim_exists",
+ "zone_record_dmarc_exists",
+ "zone_record_spf_exists"
+ ],
+ "googleworkspace": [
+ "gmail_groups_spoofing_protection_enabled",
+ "gmail_inbound_domain_spoofing_protection_enabled",
+ "gmail_unauthenticated_email_protection_enabled"
+ ],
+ "m365": [
+ "defender_antiphishing_policy_configured",
+ "defender_domain_dkim_enabled"
+ ]
+ }
+ },
+ {
+ "id": "9.6",
+ "name": "Block Unnecessary File Types",
+ "description": "Block unnecessary file types attempting to enter the enterprise's email gateway.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "googleworkspace": [
+ "gmail_anomalous_attachment_protection_enabled",
+ "gmail_script_attachment_protection_enabled"
+ ],
+ "m365": [
+ "defender_malware_policy_common_attachments_filter_enabled",
+ "defender_malware_policy_comprehensive_attachments_filter_applied"
+ ]
+ }
+ },
+ {
+ "id": "9.7",
+ "name": "Deploy and Maintain Email Server Anti-Malware Protections",
+ "description": "Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.",
+ "attributes": {
+ "Section": "9. Email and Web Browser Protections",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "googleworkspace": [
+ "gmail_encrypted_attachment_protection_enabled",
+ "gmail_enhanced_pre_delivery_scanning_enabled",
+ "gmail_external_image_scanning_enabled"
+ ],
+ "m365": [
+ "defender_atp_safe_attachments_and_docs_configured",
+ "defender_malware_policy_notifications_internal_users_malware_enabled",
+ "defender_safe_attachments_policy_enabled"
+ ]
+ }
+ },
+ {
+ "id": "10.1",
+ "name": "Deploy and Maintain Anti-Malware Software",
+ "description": "Deploy and maintain anti-malware software on all enterprise assets.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "ecs_instance_endpoint_protection_installed",
+ "securitycenter_all_assets_agent_installed"
+ ],
+ "aws": [
+ "guardduty_ec2_malware_protection_enabled"
+ ],
+ "azure": [
+ "defender_assessments_vm_endpoint_protection_installed",
+ "defender_ensure_defender_for_server_is_on"
+ ],
+ "m365": [
+ "defender_atp_safe_attachments_and_docs_configured",
+ "defender_malware_policy_common_attachments_filter_enabled",
+ "defender_safe_attachments_policy_enabled",
+ "defender_zap_for_teams_enabled"
+ ]
+ }
+ },
+ {
+ "id": "10.2",
+ "name": "Configure Automatic Anti-Malware Signature Updates",
+ "description": "Configure automatic updates for anti-malware signature files on all enterprise assets.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "10.3",
+ "name": "Disable Autorun and Autoplay for Removable Media",
+ "description": "Disable autorun and autoplay auto-execute functionality for removable media.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "10.4",
+ "name": "Configure Automatic Anti-Malware Scanning of Removable Media",
+ "description": "Configure anti-malware software to automatically scan removable media.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "10.5",
+ "name": "Enable Anti-Exploitation Features",
+ "description": "Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "vm_trusted_launch_enabled"
+ ],
+ "openstack": [
+ "image_secure_boot_enabled"
+ ],
+ "oraclecloud": [
+ "compute_instance_secure_boot_enabled"
+ ]
+ }
+ },
+ {
+ "id": "10.6",
+ "name": "Centrally Manage Anti-Malware Software",
+ "description": "Centrally manage anti-malware software.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "securitycenter_advanced_or_enterprise_edition",
+ "securitycenter_all_assets_agent_installed"
+ ],
+ "aws": [
+ "guardduty_centrally_managed",
+ "guardduty_delegated_admin_enabled_all_regions"
+ ],
+ "azure": [
+ "aks_cluster_defender_enabled",
+ "defender_ensure_defender_for_containers_is_on",
+ "defender_ensure_defender_for_storage_is_on"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_delegated_admin_enabled_all_regions",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "10.7",
+ "name": "Use Behavior-Based Anti-Malware Software",
+ "description": "Use behavior-based anti-malware software.",
+ "attributes": {
+ "Section": "10. Malware Defenses",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "cloudtrail_threat_detection_enumeration",
+ "cloudtrail_threat_detection_llm_jacking",
+ "cloudtrail_threat_detection_privilege_escalation",
+ "guardduty_eks_runtime_monitoring_enabled",
+ "guardduty_is_enabled",
+ "guardduty_lambda_protection_enabled",
+ "guardduty_rds_protection_enabled",
+ "guardduty_s3_protection_enabled"
+ ],
+ "azure": [
+ "defender_ensure_mcas_is_enabled",
+ "defender_ensure_wdatp_is_enabled"
+ ],
+ "m365": [
+ "defender_atp_safe_attachments_and_docs_configured",
+ "defender_safe_attachments_policy_enabled",
+ "defender_zap_for_teams_enabled"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "11.1",
+ "name": "Establish and Maintain a Data Recovery Process",
+ "description": "Establish and maintain a documented data recovery process that includes detailed backup procedures. In the process, address the scope of data recovery activities, recovery prioritization, and the security of backup data. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "11. Data Recovery",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "11.2",
+ "name": "Perform Automated Backups",
+ "description": "Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.",
+ "attributes": {
+ "Section": "11. Data Recovery",
+ "Function": "Recover",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "backup_plans_exist",
+ "backup_vaults_exist",
+ "dlm_ebs_snapshot_lifecycle_policy_exists",
+ "documentdb_cluster_backup_enabled",
+ "drs_job_exist",
+ "dynamodb_table_protected_by_backup_plan",
+ "dynamodb_tables_pitr_enabled",
+ "ec2_ebs_volume_protected_by_backup_plan",
+ "ec2_ebs_volume_snapshots_exists",
+ "efs_have_backup_enabled",
+ "elasticache_redis_cluster_backup_enabled",
+ "lightsail_instance_automated_snapshots",
+ "neptune_cluster_backup_enabled",
+ "rds_cluster_backtrack_enabled",
+ "rds_cluster_protected_by_backup_plan",
+ "rds_instance_backup_enabled",
+ "rds_instance_protected_by_backup_plan",
+ "redshift_cluster_automated_snapshot",
+ "s3_bucket_object_versioning"
+ ],
+ "azure": [
+ "cosmosdb_account_backup_policy_continuous",
+ "mysql_flexible_server_geo_redundant_backup_enabled",
+ "postgresql_flexible_server_geo_redundant_backup_enabled",
+ "recovery_vault_has_protected_items",
+ "vm_backup_enabled",
+ "vm_sufficient_daily_backup_retention_period"
+ ],
+ "gcp": [
+ "cloudsql_instance_automated_backups",
+ "cloudstorage_bucket_soft_delete_enabled",
+ "cloudstorage_bucket_versioning_enabled"
+ ],
+ "linode": [
+ "compute_instance_backups_enabled"
+ ],
+ "mongodbatlas": [
+ "clusters_backup_enabled"
+ ],
+ "openstack": [
+ "blockstorage_volume_backup_exists",
+ "objectstorage_container_versioning_enabled"
+ ],
+ "oraclecloud": [
+ "objectstorage_bucket_versioning_enabled"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "drs_job_exist",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "11.3",
+ "name": "Protect Recovery Data",
+ "description": "Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements.",
+ "attributes": {
+ "Section": "11. Data Recovery",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "backup_recovery_point_encrypted",
+ "backup_vaults_encrypted",
+ "documentdb_cluster_public_snapshot",
+ "ec2_ebs_public_snapshot",
+ "ec2_ebs_snapshot_account_block_public_access",
+ "ec2_ebs_snapshots_encrypted",
+ "neptune_cluster_public_snapshot",
+ "neptune_cluster_snapshot_encrypted",
+ "rds_snapshots_encrypted",
+ "rds_snapshots_public_access",
+ "s3_bucket_no_mfa_delete",
+ "s3_bucket_object_lock"
+ ],
+ "azure": [
+ "storage_ensure_file_shares_soft_delete_is_enabled",
+ "storage_ensure_soft_delete_is_enabled"
+ ],
+ "stackit": [
+ "objectstorage_bucket_object_lock_enabled"
+ ]
+ }
+ },
+ {
+ "id": "11.4",
+ "name": "Establish and Maintain an Isolated Instance of Recovery Data",
+ "description": "Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling backup destinations through offline, cloud, or off-site systems or services.",
+ "attributes": {
+ "Section": "11. Data Recovery",
+ "Function": "Recover",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "s3_bucket_cross_region_replication"
+ ],
+ "azure": [
+ "mysql_flexible_server_geo_redundant_backup_enabled",
+ "postgresql_flexible_server_geo_redundant_backup_enabled",
+ "storage_geo_redundant_enabled"
+ ]
+ }
+ },
+ {
+ "id": "11.5",
+ "name": "Test Data Recovery",
+ "description": "Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.",
+ "attributes": {
+ "Section": "11. Data Recovery",
+ "Function": "Recover",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "12.1",
+ "name": "Ensure Network Infrastructure is Up-to-Date",
+ "description": "Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of software and/or using currently supported network as a service (Naas) offerings. Review software versions monthly, or more frequently, to verify software support.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "12.2",
+ "name": "Establish and Maintain a Secure Network Architecture",
+ "description": "Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "cs_kubernetes_private_cluster_enabled",
+ "ecs_instance_no_legacy_network"
+ ],
+ "aws": [
+ "appstream_fleet_default_internet_access_disabled",
+ "autoscaling_group_launch_configuration_no_public_ip",
+ "awslambda_function_inside_vpc",
+ "dms_instance_no_public_access",
+ "ec2_instance_public_ip",
+ "ec2_launch_template_no_public_ip",
+ "ec2_transitgateway_auto_accept_vpc_attachments",
+ "ecs_service_no_assign_public_ip",
+ "ecs_task_set_no_assign_public_ip",
+ "eks_cluster_not_publicly_accessible",
+ "eks_cluster_private_nodes_enabled",
+ "elasticache_cluster_uses_public_subnet",
+ "elb_internet_facing",
+ "elbv2_internet_facing",
+ "emr_cluster_account_public_block_enabled",
+ "emr_cluster_master_nodes_no_public_ip",
+ "emr_cluster_publicly_accesible",
+ "kafka_cluster_is_public",
+ "lightsail_database_public",
+ "lightsail_instance_public",
+ "mq_broker_not_publicly_accessible",
+ "neptune_cluster_uses_public_subnet",
+ "opensearch_service_domains_not_publicly_accessible",
+ "rds_instance_inside_vpc",
+ "rds_instance_no_public_access",
+ "redshift_cluster_public_access",
+ "sagemaker_models_vpc_settings_configured",
+ "sagemaker_notebook_instance_vpc_settings_configured",
+ "sagemaker_notebook_instance_without_direct_internet_access_configured",
+ "sagemaker_training_jobs_vpc_settings_configured",
+ "vpc_endpoint_connections_trust_boundaries",
+ "vpc_endpoint_services_allowed_principals_trust_boundaries",
+ "vpc_peering_routing_tables_with_least_privilege",
+ "vpc_subnet_no_public_ip_by_default",
+ "vpc_subnet_separate_private_public"
+ ],
+ "azure": [
+ "aisearch_service_not_publicly_accessible",
+ "aks_clusters_public_access_disabled",
+ "app_function_not_publicly_accessible",
+ "containerregistry_not_publicly_accessible",
+ "containerregistry_uses_private_link",
+ "cosmosdb_account_public_network_access_disabled",
+ "cosmosdb_account_use_private_endpoints",
+ "databricks_workspace_public_network_access_disabled",
+ "keyvault_access_only_through_private_endpoints",
+ "keyvault_private_endpoints",
+ "storage_account_public_network_access_disabled",
+ "storage_ensure_private_endpoints_in_storage_accounts"
+ ],
+ "gcp": [
+ "cloudfunction_function_inside_vpc",
+ "cloudsql_instance_private_ip_assignment",
+ "cloudsql_instance_public_ip",
+ "cloudstorage_uses_vpc_service_controls",
+ "compute_instance_public_ip",
+ "compute_instance_single_network_interface",
+ "compute_network_default_in_use",
+ "compute_network_not_legacy"
+ ],
+ "mongodbatlas": [
+ "projects_network_access_list_exposed_to_internet"
+ ],
+ "nhn": [
+ "compute_instance_public_ip",
+ "network_vpc_subnet_has_external_router"
+ ],
+ "openstack": [
+ "compute_instance_isolated_private_network"
+ ],
+ "oraclecloud": [
+ "analytics_instance_access_restricted",
+ "database_autonomous_database_access_restricted",
+ "integration_instance_access_restricted",
+ "objectstorage_bucket_not_publicly_accessible"
+ ]
+ }
+ },
+ {
+ "id": "12.3",
+ "name": "Securely Manage Network Infrastructure",
+ "description": "Securely manage network infrastructure. Example implementations include version-controlled Infrastructure-as-Code (IaC), and the use of secure network protocols, such as SSH and HTTPS.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "gcp": [
+ "dns_dnssec_disabled",
+ "dns_rsasha1_in_use_to_key_sign_in_dnssec",
+ "dns_rsasha1_in_use_to_zone_sign_in_dnssec"
+ ]
+ }
+ },
+ {
+ "id": "12.4",
+ "name": "Establish and Maintain Architecture Diagram(s)",
+ "description": "Establish and maintain architecture diagram(s) and/or other network system documentation. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "12.5",
+ "name": "Centralize Network Authentication, Authorization, and Auditing (AAA)",
+ "description": "Centralize network AAA.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "12.6",
+ "name": "Use of Secure Network Management and Communication Protocols",
+ "description": "Adopt secure network management protocols (e.g., 802.1X) and secure communication protocols (e.g., Wi-Fi Protected Access 2 (WPA2) Enterprise or more secure alternatives).",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "app_minimum_tls_version_12",
+ "cosmosdb_account_minimum_tls_version",
+ "mysql_flexible_server_minimum_tls_version_12",
+ "sqlserver_recommended_minimal_tls_version",
+ "storage_ensure_minimum_tls_version_12",
+ "storage_smb_protocol_version_is_latest"
+ ],
+ "cloudflare": [
+ "zone_automatic_https_rewrites_enabled",
+ "zone_hsts_enabled",
+ "zone_https_redirect_enabled",
+ "zone_min_tls_version_secure",
+ "zone_ssl_strict",
+ "zone_tls_1_3_enabled",
+ "zone_universal_ssl_enabled"
+ ],
+ "kubernetes": [
+ "apiserver_client_ca_file_set",
+ "controllermanager_root_ca_file_set",
+ "controllermanager_rotate_kubelet_server_cert",
+ "etcd_client_cert_auth",
+ "etcd_peer_client_cert_auth",
+ "etcd_unique_ca",
+ "kubelet_client_ca_file_set",
+ "kubelet_rotate_certificates"
+ ]
+ }
+ },
+ {
+ "id": "12.7",
+ "name": "Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure",
+ "description": "Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "ec2_client_vpn_endpoint_connection_logging_enabled"
+ ]
+ }
+ },
+ {
+ "id": "12.8",
+ "name": "Establish and Maintain Dedicated Computing Resources for All Administrative Work",
+ "description": "Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative tasks or tasks requiring administrative access. The computing resources should be segmented from the enterprise's primary network and not be allowed internet access.",
+ "attributes": {
+ "Section": "12. Network Infrastructure Management",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "network_bastion_host_exists",
+ "vm_jit_access_enabled"
+ ]
+ }
+ },
+ {
+ "id": "13.1",
+ "name": "Centralize Security Event Alerting",
+ "description": "Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "securitycenter_notification_enabled_high_risk",
+ "sls_cloud_firewall_changes_alert_enabled",
+ "sls_customer_created_cmk_changes_alert_enabled",
+ "sls_management_console_authentication_failures_alert_enabled",
+ "sls_management_console_signin_without_mfa_alert_enabled",
+ "sls_oss_bucket_policy_changes_alert_enabled",
+ "sls_oss_permission_changes_alert_enabled",
+ "sls_ram_role_changes_alert_enabled",
+ "sls_rds_instance_configuration_changes_alert_enabled",
+ "sls_root_account_usage_alert_enabled",
+ "sls_security_group_changes_alert_enabled",
+ "sls_unauthorized_api_calls_alert_enabled",
+ "sls_vpc_changes_alert_enabled",
+ "sls_vpc_network_route_changes_alert_enabled"
+ ],
+ "aws": [
+ "cloudwatch_alarm_actions_alarm_state_configured",
+ "cloudwatch_alarm_actions_enabled",
+ "securityhub_delegated_admin_enabled_all_regions",
+ "securityhub_enabled"
+ ],
+ "azure": [
+ "defender_additional_email_configured_with_a_security_contact",
+ "defender_attack_path_notifications_properly_configured",
+ "defender_ensure_notify_alerts_severity_is_high",
+ "defender_ensure_notify_emails_to_owners",
+ "monitor_alert_create_update_security_solution"
+ ],
+ "googleworkspace": [
+ "rules_admin_privilege_granted_alert_configured",
+ "rules_gmail_employee_spoofing_alert_configured",
+ "rules_government_backed_attacks_alert_configured",
+ "rules_leaked_password_alert_configured",
+ "rules_password_changed_alert_configured",
+ "rules_suspicious_activity_suspension_alert_configured",
+ "rules_suspicious_login_alert_configured",
+ "rules_suspicious_programmatic_login_alert_configured"
+ ],
+ "oraclecloud": [
+ "events_notification_topic_and_subscription_exists",
+ "events_rule_cloudguard_problems",
+ "events_rule_iam_group_changes",
+ "events_rule_iam_policy_changes",
+ "events_rule_identity_provider_changes",
+ "events_rule_idp_group_mapping_changes",
+ "events_rule_local_user_authentication",
+ "events_rule_network_gateway_changes",
+ "events_rule_network_security_group_changes",
+ "events_rule_route_table_changes",
+ "events_rule_security_list_changes",
+ "events_rule_user_changes",
+ "events_rule_vcn_changes"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "13.2",
+ "name": "Deploy a Host-Based Intrusion Detection Solution",
+ "description": "Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Detect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "securitycenter_all_assets_agent_installed",
+ "ecs_instance_endpoint_protection_installed"
+ ],
+ "azure": [
+ "defender_ensure_defender_for_server_is_on",
+ "defender_ensure_wdatp_is_enabled"
+ ]
+ }
+ },
+ {
+ "id": "13.3",
+ "name": "Deploy a Network Intrusion Detection Solution",
+ "description": "Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "guardduty_eks_audit_log_enabled",
+ "guardduty_eks_runtime_monitoring_enabled",
+ "guardduty_is_enabled"
+ ],
+ "azure": [
+ "defender_ensure_defender_for_dns_is_on"
+ ],
+ "oraclecloud": [
+ "cloudguard_enabled"
+ ]
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
+ },
+ {
+ "id": "13.4",
+ "name": "Perform Traffic Filtering Between Network Segments",
+ "description": "Perform traffic filtering between network segments, where appropriate.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "cs_kubernetes_network_policy_enabled"
+ ],
+ "aws": [
+ "ec2_networkacl_allow_ingress_any_port",
+ "ec2_networkacl_allow_ingress_tcp_port_22",
+ "ec2_networkacl_allow_ingress_tcp_port_3389",
+ "networkfirewall_in_all_vpc",
+ "vpc_peering_routing_tables_with_least_privilege"
+ ],
+ "azure": [
+ "network_http_internet_access_restricted",
+ "network_rdp_internet_access_restricted",
+ "network_ssh_internet_access_restricted",
+ "network_subnet_nsg_associated",
+ "network_udp_internet_access_restricted"
+ ],
+ "gcp": [
+ "compute_firewall_rdp_access_from_the_internet_allowed",
+ "compute_firewall_ssh_access_from_the_internet_allowed"
+ ],
+ "linode": [
+ "networking_firewall_default_inbound_policy_drop",
+ "networking_firewall_default_outbound_policy_drop",
+ "networking_firewall_inbound_rules_configured",
+ "networking_firewall_outbound_rules_configured"
+ ],
+ "mongodbatlas": [
+ "projects_network_access_list_exposed_to_internet"
+ ],
+ "openstack": [
+ "networking_security_group_allows_all_ingress_from_internet",
+ "networking_security_group_allows_rdp_from_internet",
+ "networking_security_group_allows_ssh_from_internet"
+ ],
+ "oraclecloud": [
+ "network_default_security_list_restricts_traffic",
+ "network_security_group_ingress_from_internet_to_rdp_port",
+ "network_security_group_ingress_from_internet_to_ssh_port",
+ "network_security_list_ingress_from_internet_to_rdp_port",
+ "network_security_list_ingress_from_internet_to_ssh_port"
+ ],
+ "stackit": [
+ "iaas_security_group_all_traffic_unrestricted",
+ "iaas_security_group_database_unrestricted",
+ "iaas_security_group_rdp_unrestricted",
+ "iaas_security_group_ssh_unrestricted"
+ ]
+ }
+ },
+ {
+ "id": "13.5",
+ "name": "Manage Access Control for Remote Assets",
+ "description": "Manage access control for assets remotely connecting to enterprise resources. Determine amount of access to enterprise resources based on: up-to-date anti-malware software installed, configuration compliance with the enterprise's secure configuration process, and ensuring the operating system and applications are up-to-date.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "m365": [
+ "entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required",
+ "entra_conditional_access_policy_mdm_compliant_device_required",
+ "entra_managed_device_required_for_authentication",
+ "intune_device_compliance_policy_unassigned_devices_not_compliant_by_default",
+ "sharepoint_onedrive_sync_restricted_unmanaged_devices"
+ ]
+ }
+ },
+ {
+ "id": "13.6",
+ "name": "Collect Network Traffic Flow Logs",
+ "description": "Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "alibabacloud": [
+ "vpc_flow_logs_enabled"
+ ],
+ "aws": [
+ "vpc_flow_logs_enabled"
+ ],
+ "azure": [
+ "network_flow_log_captured_sent",
+ "network_flow_log_more_than_90_days",
+ "network_watcher_enabled"
+ ],
+ "gcp": [
+ "compute_subnet_flow_logs_enabled"
+ ],
+ "oraclecloud": [
+ "network_vcn_subnet_flow_logs_enabled"
+ ]
+ }
+ },
+ {
+ "id": "13.7",
+ "name": "Deploy a Host-Based Intrusion Prevention Solution",
+ "description": "Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Devices",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "defender_ensure_wdatp_is_enabled",
+ "defender_ensure_defender_for_server_is_on"
+ ]
+ }
+ },
+ {
+ "id": "13.8",
+ "name": "Deploy a Network Intrusion Prevention Solution",
+ "description": "Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "networkfirewall_in_all_vpc",
+ "networkfirewall_policy_default_action_fragmented_packets",
+ "networkfirewall_policy_default_action_full_packets",
+ "networkfirewall_policy_rule_group_associated",
+ "shield_advanced_protection_in_associated_elastic_ips",
+ "shield_advanced_protection_in_classic_load_balancers",
+ "shield_advanced_protection_in_cloudfront_distributions",
+ "shield_advanced_protection_in_global_accelerators",
+ "shield_advanced_protection_in_internet_facing_load_balancers",
+ "shield_advanced_protection_in_route53_hosted_zones"
+ ],
+ "azure": [
+ "network_vnet_ddos_protection_enabled"
+ ],
+ "cloudflare": [
+ "zone_bot_fight_mode_enabled",
+ "zone_firewall_blocking_rules_configured",
+ "zone_rate_limiting_enabled",
+ "zone_waf_enabled",
+ "zone_waf_owasp_ruleset_enabled"
+ ],
+ "vercel": [
+ "security_managed_rulesets_enabled",
+ "security_rate_limiting_configured",
+ "security_waf_enabled"
+ ]
+ }
+ },
+ {
+ "id": "13.9",
+ "name": "Deploy Port-Level Access Control",
+ "description": "Deploy port-level access control. Port-level access control utilizes 802.1x, or similar network access control protocols, such as certificates, and may incorporate user and/or device authentication.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "13.10",
+ "name": "Perform Application Layer Filtering",
+ "description": "Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "apigateway_restapi_waf_acl_attached",
+ "cloudfront_distributions_using_waf",
+ "cognito_user_pool_waf_acl_attached",
+ "elbv2_waf_acl_attached",
+ "waf_global_rule_with_conditions",
+ "waf_global_rulegroup_not_empty",
+ "waf_global_webacl_with_rules",
+ "waf_regional_rule_with_conditions",
+ "waf_regional_rulegroup_not_empty",
+ "waf_regional_webacl_with_rules",
+ "wafv2_webacl_with_rules"
+ ],
+ "cloudflare": [
+ "dns_record_proxied",
+ "zone_bot_fight_mode_enabled",
+ "zone_browser_integrity_check_enabled",
+ "zone_firewall_blocking_rules_configured",
+ "zone_rate_limiting_enabled",
+ "zone_waf_enabled",
+ "zone_waf_owasp_ruleset_enabled"
+ ],
+ "vercel": [
+ "security_custom_rules_configured",
+ "security_ip_blocking_rules_configured",
+ "security_managed_rulesets_enabled",
+ "security_rate_limiting_configured",
+ "security_waf_enabled"
+ ]
+ }
+ },
+ {
+ "id": "13.11",
+ "name": "Tune Security Event Alerting Thresholds",
+ "description": "Tune security event alerting thresholds monthly, or more frequently.",
+ "attributes": {
+ "Section": "13. Network Monitoring and Defense",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.1",
+ "name": "Establish and Maintain a Security Awareness Program",
+ "description": "Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.2",
+ "name": "Train Workforce Members to Recognize Social Engineering Attacks",
+ "description": "Train workforce members to recognize social engineering attacks, such as phishing, business email compromise (BEC), pretexting, and tailgating.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.3",
+ "name": "Train Workforce Members on Authentication Best Practices",
+ "description": "Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.4",
+ "name": "Train Workforce on Data Handling Best Practices",
+ "description": "Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.5",
+ "name": "Train Workforce Members on Causes of Unintentional Data Exposure",
+ "description": "Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.6",
+ "name": "Train Workforce Members on Recognizing and Reporting Security Incidents",
+ "description": "Train workforce members to be able to recognize a potential incident and be able to report such an incident.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.7",
+ "name": "Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates",
+ "description": "Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.8",
+ "name": "Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks",
+ "description": "Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "14.9",
+ "name": "Conduct Role-Specific Security Awareness and Skills Training",
+ "description": "Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles.",
+ "attributes": {
+ "Section": "14. Security Awareness and Skills Training",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.1",
+ "name": "Establish and Maintain an Inventory of Service Providers",
+ "description": "Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include classification(s), and designate an enterprise contact for each service provider. Review and update the inventory annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Identify",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.2",
+ "name": "Establish and Maintain a Service Provider Management Policy",
+ "description": "Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.3",
+ "name": "Classify Service Providers",
+ "description": "Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Govern",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.4",
+ "name": "Ensure Service Provider Contracts Include Security Requirements",
+ "description": "Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal commitments. These security requirements must be consistent with the enterprise's service provider management policy. Review service provider contracts annually to ensure contracts are not missing security requirements.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.5",
+ "name": "Assess Service Providers",
+ "description": "Assess service providers consistent with the enterprise's service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Govern",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.6",
+ "name": "Monitor Service Providers",
+ "description": "Monitor service providers consistent with the enterprise's service provider management policy. Monitoring may include periodic reassessment of service provider compliance, monitoring service provider release notes, and dark web monitoring.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Govern",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "15.7",
+ "name": "Securely Decommission Service Providers",
+ "description": "Securely decommission service providers. Example considerations include user and service account deactivation, termination of data flows, and secure disposal of enterprise data within service provider systems.",
+ "attributes": {
+ "Section": "15. Service Provider Management",
+ "Function": "Protect",
+ "AssetType": "Data",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "16.1",
+ "name": "Establish and Maintain a Secure Application Development Process",
+ "description": "Establish and maintain a secure application development process. In the process, address such items as: secure application design standards, secure coding practices, developer training, vulnerability management, security of third-party code, and application security testing procedures. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "github": [
+ "repository_default_branch_deletion_disabled",
+ "repository_default_branch_disallows_force_push",
+ "repository_default_branch_dismisses_stale_reviews",
+ "repository_default_branch_protection_applies_to_admins",
+ "repository_default_branch_protection_enabled",
+ "repository_default_branch_requires_codeowners_review",
+ "repository_default_branch_requires_conversation_resolution",
+ "repository_default_branch_requires_linear_history",
+ "repository_default_branch_requires_multiple_approvals",
+ "repository_default_branch_requires_signed_commits",
+ "repository_default_branch_status_checks_required",
+ "repository_has_codeowners_file"
+ ]
+ }
+ },
+ {
+ "id": "16.2",
+ "name": "Establish and Maintain a Process to Accept and Address Software Vulnerabilities",
+ "description": "Establish and maintain a process to accept and address reports of software vulnerabilities, including providing a means for external entities to report. The process is to include such items as: a vulnerability handling policy that identifies reporting process, responsible party for handling vulnerability reports, and a process for intake, assignment, remediation, and remediation testing. As part of the process, use a vulnerability tracking system that includes severity ratings and metrics for measuring timing for identification, analysis, and remediation of vulnerabilities. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. Third-party application developers need to consider this an externally-facing policy that helps to set expectations for outside stakeholders.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "github": [
+ "repository_public_has_securitymd_file"
+ ]
+ }
+ },
+ {
+ "id": "16.3",
+ "name": "Perform Root Cause Analysis on Security Vulnerabilities",
+ "description": "Perform root cause analysis on security vulnerabilities. When reviewing vulnerabilities, root cause analysis is the task of evaluating underlying issues that create vulnerabilities in code, and allows development teams to move beyond just fixing individual vulnerabilities as they arise.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Detect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "16.4",
+ "name": "Establish and Manage an Inventory of Third-Party Software Components",
+ "description": "Establish and manage an updated inventory of third-party components used in development, often referred to as a \"bill of materials,\" as well as components slated for future use. This inventory is to include any risks that each third-party component could pose. Evaluate the list at least monthly to identify any changes or updates to these components, and validate that the component is still supported.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Identify",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "github": [
+ "repository_dependency_scanning_enabled"
+ ]
+ }
+ },
+ {
+ "id": "16.5",
+ "name": "Use Up-to-Date and Trusted Third-Party Software Components",
+ "description": "Use up-to-date and trusted third-party software components. When possible, choose established and proven frameworks and libraries that provide adequate security. Acquire these components from trusted sources or evaluate the software for vulnerabilities before use.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "codeartifact_packages_external_public_publishing_disabled"
+ ],
+ "github": [
+ "repository_dependency_scanning_enabled"
+ ]
+ }
+ },
+ {
+ "id": "16.6",
+ "name": "Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities",
+ "description": "Establish and maintain a severity rating system and process for application vulnerabilities that facilitates prioritizing the order in which discovered vulnerabilities are fixed. This process includes setting a minimum level of security acceptability for releasing code or applications. Severity ratings bring a systematic way of triaging vulnerabilities that improves risk management and helps ensure the most severe bugs are fixed first. Review and update the system and process annually.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "16.7",
+ "name": "Use Standard Hardening Configuration Templates for Application Infrastructure",
+ "description": "Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "azure": [
+ "app_ensure_using_http20",
+ "app_ftp_deployment_disabled",
+ "app_minimum_tls_version_12"
+ ],
+ "gcp": [
+ "cloudsql_instance_mysql_local_infile_flag",
+ "cloudsql_instance_mysql_skip_show_database_flag",
+ "cloudsql_instance_sqlserver_contained_database_authentication_flag",
+ "cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
+ "cloudsql_instance_sqlserver_external_scripts_enabled_flag",
+ "cloudsql_instance_sqlserver_remote_access_flag",
+ "compute_instance_shielded_vm_enabled",
+ "gke_cluster_no_default_service_account"
+ ],
+ "kubernetes": [
+ "apiserver_always_pull_images_plugin",
+ "apiserver_deny_service_external_ips",
+ "apiserver_event_rate_limit",
+ "apiserver_namespace_lifecycle_plugin",
+ "apiserver_no_always_admit_plugin",
+ "apiserver_node_restriction_plugin",
+ "apiserver_security_context_deny_plugin",
+ "core_image_tag_fixed",
+ "core_minimize_admission_hostport_containers",
+ "core_minimize_admission_windows_hostprocess_containers",
+ "core_minimize_allowPrivilegeEscalation_containers",
+ "core_minimize_containers_added_capabilities",
+ "core_minimize_containers_capabilities_assigned",
+ "core_minimize_hostIPC_containers",
+ "core_minimize_hostNetwork_containers",
+ "core_minimize_hostPID_containers",
+ "core_minimize_net_raw_capability_admission",
+ "core_minimize_privileged_containers",
+ "core_minimize_root_containers_admission",
+ "core_seccomp_profile_docker_default"
+ ],
+ "vercel": [
+ "project_auto_expose_system_env_disabled",
+ "project_directory_listing_disabled",
+ "project_git_fork_protection_enabled"
+ ]
+ }
+ },
+ {
+ "id": "16.8",
+ "name": "Separate Production and Non-Production Systems",
+ "description": "Maintain separate environments for production and non-production systems.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "vercel": [
+ "deployment_production_uses_stable_target",
+ "project_deployment_protection_enabled",
+ "project_environment_no_overly_broad_target",
+ "project_environment_production_vars_not_in_preview"
+ ]
+ }
+ },
+ {
+ "id": "16.9",
+ "name": "Train Developers in Application Security Concepts and Secure Coding",
+ "description": "Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities. Training can include general security principles and application security standard practices. Conduct training at least annually and design in a way to promote security within the development team, and build a culture of security among the developers.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "16.10",
+ "name": "Apply Secure Design Principles in Application Architectures",
+ "description": "Apply secure design principles in application architectures. Secure design principles include the concept of least privilege and enforcing mediation to validate every operation that the user makes, promoting the concept of \"never trust user input.\" Examples include ensuring that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats. Secure design also means minimizing the application infrastructure attack surface, such as turning off unprotected ports and services, removing unnecessary programs and files, and renaming or removing default accounts.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "apigateway_restapi_authorizers_enabled",
+ "apigateway_restapi_public_with_authorizer",
+ "apigatewayv2_api_authorizers_enabled",
+ "appsync_graphql_api_no_api_key_authentication",
+ "cognito_user_pool_client_prevent_user_existence_errors",
+ "ecs_task_definitions_containers_readonly_access",
+ "ecs_task_definitions_host_namespace_not_shared",
+ "ecs_task_definitions_host_networking_mode_users",
+ "ecs_task_definitions_no_privileged_containers",
+ "elb_desync_mitigation_mode",
+ "elbv2_alb_drop_invalid_header_fields_enabled",
+ "elbv2_desync_mitigation_mode",
+ "sagemaker_notebook_instance_root_access_disabled"
+ ]
+ }
+ },
+ {
+ "id": "16.11",
+ "name": "Leverage Vetted Modules or Services for Application Security Components",
+ "description": "Leverage vetted modules or services for application security components, such as identity management, encryption, auditing, and logging. Using platform features in critical security functions will reduce developers' workload and minimize the likelihood of design or implementation errors. Modern operating systems provide effective mechanisms for identification, authentication, and authorization and make those mechanisms available to applications. Use only standardized, currently accepted, and extensively reviewed encryption algorithms. Operating systems also provide mechanisms to create and maintain secure audit logs.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "secretsmanager_automatic_rotation_enabled",
+ "secretsmanager_secret_rotated_periodically"
+ ],
+ "azure": [
+ "app_ensure_auth_is_set_up",
+ "app_function_access_keys_configured",
+ "app_function_identity_is_configured",
+ "app_register_with_identity"
+ ],
+ "vercel": [
+ "team_directory_sync_enabled",
+ "team_saml_sso_enabled"
+ ]
+ }
+ },
+ {
+ "id": "16.12",
+ "name": "Implement Code-Level Security Checks",
+ "description": "Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "awslambda_function_no_secrets_in_code",
+ "inspector2_is_enabled"
+ ],
+ "github": [
+ "githubactions_workflow_security_scan",
+ "repository_secret_scanning_enabled"
+ ]
+ }
+ },
+ {
+ "id": "16.13",
+ "name": "Conduct Application Penetration Testing",
+ "description": "Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Detect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "16.14",
+ "name": "Conduct Threat Modeling",
+ "description": "Conduct threat modeling. Threat modeling is the process of identifying and addressing application security design flaws within a design, before code is created. It is conducted through specially trained individuals who evaluate the application design and gauge security risks for each entry point and access level. The goal is to map out the application, architecture, and infrastructure in a structured way to understand its weaknesses.",
+ "attributes": {
+ "Section": "16. Application Software Security",
+ "Function": "Protect",
+ "AssetType": "Software",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.1",
+ "name": "Designate Personnel to Manage Incident Handling",
+ "description": "Designate one key person, and at least one backup, who will manage the enterprise's incident handling process. Management personnel are responsible for the coordination and documentation of incident response and recovery efforts and can consist of employees internal to the enterprise, service providers, or a hybrid approach. If using a service provider, designate at least one person internal to the enterprise to oversee any third-party work. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Respond",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.2",
+ "name": "Establish and Maintain Contact Information for Reporting Security Incidents",
+ "description": "Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, service providers, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis Center (ISAC) partners, or other stakeholders. Verify contacts annually to ensure that information is up-to-date.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "account_maintain_current_contact_details",
+ "account_maintain_different_contact_details_to_security_billing_and_operations",
+ "account_security_contact_information_is_registered"
+ ],
+ "gcp": [
+ "iam_organization_essential_contacts_configured"
+ ],
+ "mongodbatlas": [
+ "organizations_security_contact_defined"
+ ]
+ }
+ },
+ {
+ "id": "17.3",
+ "name": "Establish and Maintain an Enterprise Process for Reporting Incidents",
+ "description": "Establish and maintain an documented enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG1",
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.4",
+ "name": "Establish and Maintain an Incident Response Process",
+ "description": "Establish and maintain a documented incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {
+ "aws": [
+ "ssmincidents_enabled_with_plans"
+ ]
+ }
+ },
+ {
+ "id": "17.5",
+ "name": "Assign Key Roles and Responsibilities",
+ "description": "Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, analysts, and relevant third parties. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Respond",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.6",
+ "name": "Define Mechanisms for Communicating During Incident Response",
+ "description": "Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms can include phone calls, emails, secure chat, or notification letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security incident. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Respond",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.7",
+ "name": "Conduct Routine Incident Response Exercises",
+ "description": "Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process to prepare for responding to real-world incidents. Exercises need to test communication channels, decision making, and workflows. Conduct testing on an annual basis, at a minimum.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Recover",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.8",
+ "name": "Conduct Post-Incident Reviews",
+ "description": "Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Recover",
+ "AssetType": "Users",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "17.9",
+ "name": "Establish and Maintain Security Incident Thresholds",
+ "description": "Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this Safeguard.",
+ "attributes": {
+ "Section": "17. Incident Response Management",
+ "Function": "Recover",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "18.1",
+ "name": "Establish and Maintain a Penetration Testing Program",
+ "description": "Establish and maintain a penetration testing program appropriate to the size, complexity, industry, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.",
+ "attributes": {
+ "Section": "18. Penetration Testing",
+ "Function": "Govern",
+ "AssetType": "Documentation",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "18.2",
+ "name": "Perform Periodic External Penetration Tests",
+ "description": "Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.",
+ "attributes": {
+ "Section": "18. Penetration Testing",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "18.3",
+ "name": "Remediate Penetration Test Findings",
+ "description": "Remediate penetration test findings based on the enterprise's documented vulnerability remediation process. This should include determining a timeline and level of effort based on the impact and prioritization of each identified finding.",
+ "attributes": {
+ "Section": "18. Penetration Testing",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG2",
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "18.4",
+ "name": "Validate Security Measures",
+ "description": "Validate security measures after each penetration test. If deemed necessary, modify rulesets and capabilities to detect the techniques used during testing.",
+ "attributes": {
+ "Section": "18. Penetration Testing",
+ "Function": "Protect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ },
+ {
+ "id": "18.5",
+ "name": "Perform Periodic Internal Penetration Tests",
+ "description": "Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be clear box or opaque box.",
+ "attributes": {
+ "Section": "18. Penetration Testing",
+ "Function": "Detect",
+ "AssetType": "Network",
+ "ImplementationGroups": [
+ "IG3"
+ ]
+ },
+ "checks": {}
+ }
+ ]
+}
diff --git a/prowler/compliance/csa_ccm_4.0.json b/prowler/compliance/csa_ccm_4.0.json
index b6bb382cda..1cb7428e51 100644
--- a/prowler/compliance/csa_ccm_4.0.json
+++ b/prowler/compliance/csa_ccm_4.0.json
@@ -229,7 +229,16 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "A&A-04",
@@ -334,7 +343,23 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "AIS-04",
@@ -978,7 +1003,16 @@
"defender_ensure_defender_for_server_is_on",
"vm_backup_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "drs_job_exist",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "BCR-11",
@@ -1416,7 +1450,30 @@
"events_rule_security_list_changes",
"events_rule_vcn_changes"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "CEK-03",
@@ -1659,7 +1716,18 @@
"filestorage_file_system_encrypted_with_cmk",
"objectstorage_bucket_encrypted_with_cmk"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "Provider": "azure",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
+ ]
},
{
"id": "CEK-04",
@@ -1802,7 +1870,29 @@
"dns_rsasha1_in_use_to_key_sign_in_dnssec",
"dns_rsasha1_in_use_to_zone_sign_in_dnssec"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "Provider": "aws",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ },
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "Provider": "azure",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
+ ]
},
{
"id": "CEK-08",
@@ -2345,7 +2435,16 @@
"alibabacloud": [
"securitycenter_all_assets_agent_installed"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DSP-02",
@@ -2583,7 +2682,16 @@
"alibabacloud": [
"securitycenter_all_assets_agent_installed"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DSP-04",
@@ -2997,7 +3105,19 @@
"oraclecloud": [
"compute_instance_in_transit_encryption_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "Provider": "azure",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ }
+ ]
},
{
"id": "DSP-16",
@@ -3403,7 +3523,23 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "IAM-02",
@@ -6255,7 +6391,16 @@
"cloudguard_enabled",
"events_rule_cloudguard_problems"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "LOG-02",
@@ -6558,7 +6703,23 @@
"events_notification_topic_and_subscription_exists",
"events_rule_local_user_authentication"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "LOG-04",
@@ -7602,7 +7763,16 @@
"events_rule_cloudguard_problems",
"events_notification_topic_and_subscription_exists"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "SEF-03",
@@ -7880,7 +8050,23 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "SEF-08",
@@ -8461,7 +8647,16 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "TVM-05",
@@ -8729,7 +8924,16 @@
"oraclecloud": [
"cloudguard_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "UEM-08",
diff --git a/prowler/compliance/dora_2022_2554.json b/prowler/compliance/dora_2022_2554.json
index e4b5fd69df..3b828059da 100644
--- a/prowler/compliance/dora_2022_2554.json
+++ b/prowler/compliance/dora_2022_2554.json
@@ -215,7 +215,37 @@
"securitycenter_vulnerability_scan_enabled",
"actiontrail_multi_region_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_delegated_admin_enabled_all_regions",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art7",
@@ -299,7 +329,38 @@
"ecs_unattached_disk_encrypted",
"ecs_instance_no_legacy_network"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "Provider": "aws",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": [
+ "RSA-1024",
+ "P-192"
+ ]
+ },
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "Provider": "azure",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": [
+ "1.2",
+ "1.3"
+ ]
+ },
+ {
+ "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+ "Provider": "azure",
+ "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+ "Operator": "subset",
+ "Value": [
+ "AES-256-GCM"
+ ]
+ }
+ ]
},
{
"id": "DORA-Art8",
@@ -344,7 +405,16 @@
"securitycenter_all_assets_agent_installed",
"ram_user_console_access_unused"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art9",
@@ -580,7 +650,23 @@
"ecs_instance_endpoint_protection_installed",
"cs_kubernetes_cloudmonitor_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art11",
@@ -732,7 +818,16 @@
"securitycenter_all_assets_agent_installed",
"ecs_instance_latest_os_patches_applied"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art14",
@@ -901,7 +996,23 @@
"securitycenter_notification_enabled_high_risk",
"securitycenter_vulnerability_scan_enabled"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_delegated_admin_enabled_all_regions",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art19",
@@ -1017,7 +1128,16 @@
"cs_kubernetes_cluster_check_recent",
"cs_kubernetes_cluster_check_weekly"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art25",
@@ -1079,7 +1199,23 @@
"ecs_instance_latest_os_patches_applied",
"ecs_instance_no_legacy_network"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "config_recorder_all_regions_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art28",
@@ -1144,7 +1280,16 @@
"oss_bucket_not_publicly_accessible",
"actiontrail_oss_bucket_not_publicly_accessible"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art30",
@@ -1200,7 +1345,16 @@
"ram_policy_attached_only_to_group_or_roles",
"ram_no_root_access_key"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "accessanalyzer_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
},
{
"id": "DORA-Art45",
@@ -1245,7 +1399,23 @@
"actiontrail_multi_region_enabled",
"sls_logstore_retention_period"
]
- }
+ },
+ "config_requirements": [
+ {
+ "Check": "guardduty_is_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ },
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": false
+ }
+ ]
}
]
}
diff --git a/prowler/compliance/gcp/ccc_gcp.json b/prowler/compliance/gcp/ccc_gcp.json
index 67a75841ef..520b6b534a 100644
--- a/prowler/compliance/gcp/ccc_gcp.json
+++ b/prowler/compliance/gcp/ccc_gcp.json
@@ -924,6 +924,14 @@
"cloudsql_instance_automated_backups",
"cloudstorage_bucket_log_retention_policy_lock",
"cloudstorage_bucket_sufficient_retention_period"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "cloudstorage_bucket_sufficient_retention_period",
+ "ConfigKey": "storage_min_retention_days",
+ "Operator": "gte",
+ "Value": 30
+ }
]
},
{
@@ -5841,6 +5849,20 @@
"Checks": [
"iam_sa_user_managed_key_unused",
"iam_service_account_unused"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "iam_sa_user_managed_key_unused",
+ "ConfigKey": "max_unused_account_days",
+ "Operator": "lte",
+ "Value": 90
+ },
+ {
+ "Check": "iam_service_account_unused",
+ "ConfigKey": "max_unused_account_days",
+ "Operator": "lte",
+ "Value": 90
+ }
]
},
{
diff --git a/prowler/compliance/gcp/cis_5.0_gcp.json b/prowler/compliance/gcp/cis_5.0_gcp.json
new file mode 100644
index 0000000000..edc962ff0c
--- /dev/null
+++ b/prowler/compliance/gcp/cis_5.0_gcp.json
@@ -0,0 +1,2097 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS Google Cloud Platform Foundation Benchmark v5.0.0",
+ "Version": "5.0",
+ "Provider": "GCP",
+ "Description": "The CIS Google Cloud Platform Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of GCP with an emphasis on foundational, testable, and architecture agnostic settings.",
+ "Requirements": [
+ {
+ "Id": "1.1.1",
+ "Description": "Ensure Super Admin Email Address Is Not Tied To A Single User",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "It is recommended that the super admin role is assigned to a dedicated email address (e.g., gcp-superadmin@company.com) rather than to individual user email addresses (e.g., john.doe@company.com). The dedicated super admin email should be a separate user account used exclusively for super admin level administrative tasks. When the GCP organization resource is created, existing super administrator accounts from Google Workspace or Cloud Identity automatically gain access to manage the organization. The super admin role has unrestricted access to all GCP organization resources and settings. Using individual user email addresses for super admin access creates security and operational risks.",
+ "RationaleStatement": "Using a dedicated email address for super admin accounts rather than individual user emails significantly reduces the risk of phishing attacks, as individual user accounts receive daily business emails and are high-value phishing targets, while a dedicated super admin email address not used for daily communications has minimal exposure to credential compromise. Dedicated super admin accounts can enforce stronger authentication requirements such as hardware security keys and shorter session timeouts without impacting day-to-day productivity. When employees leave the organization or change roles, super admin access remains continuous through the dedicated account rather than being tied to departing personnel. Separating super admin access from daily user activities prevents accidental misuse of elevated privileges and provides clear audit separation, supporting segregation of duties.",
+ "ImpactStatement": "Creating a new dedicated super admin account requires coordination with Google Workspace or Cloud Identity administrators. Existing super admin accounts tied to individual users should be replaced with the dedicated account, and individual user accounts should be removed from the super admin role once migration is complete.",
+ "AuditProcedure": "**From Google Cloud Admin Console**\n\n1. Navigate to the Google Admin console at https://admin.google.com\n2. Go to `Account` --> `Admin roles` in the left navigation menu\n3. Click on `Super Admin` role\n4. Review the list of users assigned the Super Admin role\n5. Verify that the super admin role is assigned to a dedicated email address (e.g., gcp-superadmin@company.com) and that individual user email addresses are NOT assigned the Super Admin role directly.",
+ "RemediationProcedure": "**From Google Cloud Admin Console**\n\n1. Create a dedicated super admin user account: in the Google Admin console go to `Directory` -> `Users`, click `Add new user` and configure a dedicated address (e.g., gcp-superadmin@company.com). Enforce 2-Step Verification with a hardware security key.\n2. Assign the Super Admin role to the dedicated account: go to `Account` --> `Admin roles`, click `Super Admin` role, `Assigned Admins` --> `Assign users`, select the dedicated account and click `Assign role`.\n3. Remove individual user accounts from the Super Admin role: for each individual user email address, select the user, click `Unassign role` and confirm the removal. Verify that only the dedicated super admin account remains assigned.",
+ "AdditionalInformation": "",
+ "References": "",
+ "SubSection": "1.1 Organization Resource",
+ "DefaultValue": "When you first sign up for Google Workspace or Cloud Identity, the person who completes the signup process automatically becomes the first super administrator, typically resulting in an individual user's email address being assigned the super admin role by default."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.2",
+ "Description": "Ensure Super Admin Account Is Not Used For Google Cloud Administration",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "It is recommended that super admin accounts are not granted any IAM roles in Google Cloud Platform and are used exclusively for identity management in Google Workspace or Cloud Identity. Google Cloud administration should be performed using separate regular user accounts that are granted appropriate GCP IAM roles such as Organization Administrator. The Super Admin role and GCP resource management are two separate privilege domains that should not be combined in a single account.",
+ "RationaleStatement": "Separating super admin accounts from GCP administration is critical because Super Admin privileges are irrevocable and can override almost any setting in both Workspace and GCP. If a super admin account is granted GCP permissions and compromised through phishing, an attacker gains full control over both the email domain and the entire cloud infrastructure. Super admin accounts not granted GCP IAM permissions cannot be used to directly manipulate cloud resources even if compromised, limiting blast radius to identity management functions only. This separation enforces least privilege and reduces the attack surface by ensuring the most powerful account type is isolated from daily cloud operations.",
+ "ImpactStatement": "Organizations must create separate regular user accounts in Workspace/Cloud Identity for GCP administration. These accounts will be granted appropriate GCP IAM roles for cloud resource management. Existing super admin accounts that have been granted GCP IAM roles must have those permissions removed.",
+ "AuditProcedure": "**From Google Cloud Admin Console**\n\n1. In the Google Admin console (https://admin.google.com), go to `Account` -> `Admin roles`, click `Super Admin` role and note all user accounts assigned the Super Admin role.\n2. In the Google Cloud Console (https://console.cloud.google.com), go to `IAM & Admin` -> `IAM` at the organization level and review all IAM policy bindings.\n3. Verify that none of the super admin accounts appear in the IAM permissions list and that they have NO IAM roles granted at organization, folder, or project levels.",
+ "RemediationProcedure": "**From Google Cloud Admin Console**\n\n1. Create a separate regular user account for GCP administration in `Directory` -> `Users` (do NOT assign it the Super Admin role).\n2. Grant GCP IAM roles to that cloud admin account in the Cloud Console under `IAM & Admin` -> `IAM` (e.g., Organization Administrator).\n3. Delete all GCP IAM bindings for super admin users: in `IAM & Admin` -> `IAM` at the organization level, edit each super admin principal and remove all assigned roles. Repeat for all folders and projects.",
+ "AdditionalInformation": "",
+ "References": "",
+ "SubSection": "1.1 Organization Resource",
+ "DefaultValue": "By default, super administrator accounts from Google Workspace or Cloud Identity gain access to manage the GCP organization resource when it is created."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.3",
+ "Description": "Ensure Folders Are Structured By Environment And Sensitivity",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that GCP Resource Manager folders are structured primarily by environment (for example, production, non-production, sandbox) and sensitivity (for example, security, logging, shared services, regulated workloads), rather than mirroring the corporate org chart. Folders should group projects that share similar security requirements and controls so that appropriate Organization Policies, IAM policies, and other guardrails can be applied consistently at the folder level.",
+ "RationaleStatement": "A clear folder structure based on environment and sensitivity makes it easier to apply consistent guardrails and centralized security controls to projects that have similar risk profiles and compliance needs. Folders enable hierarchical policy inheritance where stricter controls can be applied to production folders while development folders can have more relaxed policies. Poorly defined or ad-hoc folder structures complicate policy management, increase the chance of misapplied controls, and can lead to mixing workloads with different data sensitivities. Without proper folder segregation, a compromised development project can be used to pivot into production resources and compliance auditing becomes significantly more complex.",
+ "ImpactStatement": "Restructuring folders by environment and sensitivity can require moving projects, changing inherited Organization Policies and IAM policies, and updating automation that assumes existing folder paths. This may introduce short-term operational overhead, including policy revalidation, testing of workloads under new guardrails, and coordination with application and platform teams.",
+ "AuditProcedure": "**From Google Cloud Admin Console**\n\n1. In the Cloud Console (https://console.cloud.google.com), select your organization and go to `IAM & Admin` -> `Manage resources` to view the organization hierarchy.\n2. Review and document the folder hierarchy (organization -> folders -> sub-folders -> projects).\n3. Evaluate whether top-level and key folders are clearly aligned to environment (production, non-production, sandbox) and sensitivity/function (security, logging, shared services, regulated).\n4. For each environment/sensitivity folder, sample projects and verify their primary workloads match the folder's stated purpose. Note any folders organized mainly by department/owner or that mix production and non-production workloads.",
+ "RemediationProcedure": "**From Google Cloud Admin Console**\n\n1. Work with security, platform, and application teams to agree on a small set of top-level folders (e.g., Security/Management, Shared Services/Infrastructure, Prod, Non-Prod). Define dedicated folders for highly regulated workloads.\n2. Create the folder structure under `IAM & Admin` -> `Manage resources` using `CREATE FOLDER`.\n3. Map each project to its target folder based on environment and sensitivity.\n4. Move projects to the environment/sensitivity-based folders (start with low-risk sandbox/non-production projects, test workloads, then proceed with production).\n5. Remove old folders that no longer reflect the target structure and update architecture docs and onboarding runbooks.",
+ "AdditionalInformation": "",
+ "References": "",
+ "SubSection": "1.1 Organization Resource"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.4",
+ "Description": "Ensure Organization Policies Are Configured For Centralized Constraints",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that one or more baseline Organization Policies are configured at the organization or folder level in accordance with enterprise security requirements. Organization Policies act as preventive guardrails that set centralized constraints on how resources can be configured across all projects within the organization hierarchy. These policies can enforce security invariants such as preventing public IP addresses on compute instances, requiring OS Login for SSH access, restricting resource locations to approved regions, enforcing uniform bucket-level access on Cloud Storage, or limiting IAM policy member domains to prevent external sharing.",
+ "RationaleStatement": "Organization Policies do not grant permissions but instead set organization-wide limits on resource configurations and service usage, regardless of local project-level IAM policies. Without baseline guardrail Organization Policies, each project can configure resources inconsistently, disable security features, use unapproved regions, allow public access to resources, or share data with external domains. Configuring standard Organization Policies at the organization or folder level enforces preventive, centralized control over high-risk configurations and supports consistent security posture at scale. Organization Policies are inherited down the resource hierarchy (organization -> folder -> project), making them an effective mechanism for enforcing security controls across large numbers of projects.",
+ "ImpactStatement": "Enforcing baseline Organization Policies can initially block some existing resource configurations, such as use of unapproved regions, creation of resources with public IPs, or external domain sharing. Teams may need to adjust deployment pipelines, Terraform configurations, and exception processes. Organizations should test policies in non-production folders before applying them broadly.",
+ "AuditProcedure": "**From Google Cloud Admin Console**\n\nPre-requisite: Document your organization's baseline guardrail requirements (e.g., constraints/gcp.resourceLocations, constraints/compute.requireOsLogin, constraints/compute.vmExternalIpAccess, constraints/storage.uniformBucketLevelAccess, constraints/iam.allowedPolicyMemberDomains).\n\n1. In the Cloud Console (https://console.cloud.google.com), select your organization and go to `IAM & Admin` -> `Organization Policies`. Review the policies set at the organization level and verify baseline security constraints are configured (enforced, exceptions, configured values).\n2. Verify policies are not overridden or disabled at folder or project levels (look for policies marked as `Customized`).\n3. Compare your documented baseline requirements against the configured Organization Policies and identify gaps.",
+ "RemediationProcedure": "IMPORTANT: Before enforcing Organization Policies, use dry run mode to preview which resources would be blocked and review violations in Cloud Asset Inventory before actual enforcement.\n\n**From Google Cloud Admin Console**\n\n1. In `IAM & Admin` -> `Organization Policies`, review existing policies and identify gaps based on your security requirements.\n2. For each baseline constraint, search for the constraint, click `Manage policy`, select `Override parent's policy` and configure it (boolean: `Enforcement On`; list: choose Deny all/Allow all or Custom values). Click `Set policy` and verify it shows as `Enforced`.\n3. Configure folder-level policies if different constraints are needed per environment, ensuring folder-level policies do not weaken organization-level security controls unless explicitly approved.",
+ "AdditionalInformation": "",
+ "References": "",
+ "SubSection": "1.1 Organization Resource"
+ }
+ ]
+ },
+ {
+ "Id": "1.2",
+ "Description": "Ensure that Corporate Login Credentials are Used",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use corporate login credentials instead of consumer accounts, such as Gmail accounts.",
+ "RationaleStatement": "It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as consumer accounts, should not be used for business purposes.",
+ "ImpactStatement": "There will be increased overhead as maintaining accounts will now be required. For smaller organizations, this will not be an issue, but will balloon with size.",
+ "RemediationProcedure": "Remove all consumer Google accounts from IAM policies. Follow the documentation and setup corporate login accounts. **Prevention:** To ensure that no email addresses outside the organization can be granted IAM permissions to its Google Cloud projects, folders or organization, turn on the Organization Policy for `Domain Restricted Sharing`. Learn more at: [https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains)",
+ "AuditProcedure": "For each Google Cloud Platform project, list the accounts that have been granted access to that project: **From Google Cloud CLI** gcloud projects get-iam-policy PROJECT_ID Also list the accounts added on each folder: gcloud resource-manager folders get-iam-policy FOLDER_ID And list your organization's IAM policy: gcloud organizations get-iam-policy ORGANIZATION_ID No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.",
+ "AdditionalInformation": "",
+ "References": "https://support.google.com/work/android/answer/6371476:https://cloud.google.com/sdk/gcloud/reference/projects/get-iam-policy:https://cloud.google.com/sdk/gcloud/reference/resource-manager/folders/get-iam-policy:https://cloud.google.com/sdk/gcloud/reference/organizations/get-iam-policy:https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints",
+ "DefaultValue": "By default, no email addresses outside the organization's domain have access to its Google Cloud deployments, but any user email account can be added to the IAM policy for Google Cloud Platform projects, folders, or organizations.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.3",
+ "Description": "Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Setup multi-factor authentication for Google Cloud Platform accounts.",
+ "RationaleStatement": "Multi-factor authentication requires more than one mechanism to authenticate a user. This secures user logins from attackers exploiting stolen or weak credentials.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** For each Google Cloud Platform project: 1. Identify non-service accounts. 1. Setup multi-factor authentication for each account.",
+ "AuditProcedure": "**From Google Cloud Console** For each Google Cloud Platform project, folder, or organization: 1. Identify non-service accounts. 1. Manually verify that multi-factor authentication for each account is set.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/solutions/securing-gcp-account-u2f:https://support.google.com/accounts/answer/185839",
+ "DefaultValue": "By default, multi-factor authentication is not set.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.4",
+ "Description": "Ensure that Security Key Enforcement is Enabled for All Admin Accounts",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.",
+ "RationaleStatement": "Google Cloud Platform users with Organization Administrator roles have the highest level of privilege in the organization. These accounts should be protected with the strongest form of two-factor authentication: Security Key Enforcement. Ensure that admins use Security Keys to log in instead of weaker second factors like SMS or one-time passwords (OTP). Security Keys are actual physical keys used to access Google Organization Administrator Accounts. They send an encrypted signature rather than a code, ensuring that logins cannot be phished.",
+ "ImpactStatement": "If an organization administrator loses access to their security key, the user could lose access to their account. For this reason, it is important to set up backup security keys.",
+ "RemediationProcedure": "1. Identify users with the Organization Administrator role. 2. Setup Security Key Enforcement for each account. Learn more at: [https://cloud.google.com/security-key/](https://cloud.google.com/security-key/)",
+ "AuditProcedure": "1. Identify users with Organization Administrator privileges: gcloud organizations get-iam-policy ORGANIZATION_ID Look for members granted the role roles/resourcemanager.organizationAdmin. 2. Manually verify that Security Key Enforcement has been enabled for each account.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/security-key/:https://gsuite.google.com/learn-more/key_for_working_smarter_faster_and_more_securely.html",
+ "DefaultValue": "By default, Security Key Enforcement is not enabled for Organization Administrators.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.5",
+ "Description": "Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account",
+ "Checks": [
+ "iam_sa_no_user_managed_keys"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "User-managed service accounts should not have user-managed keys.",
+ "RationaleStatement": "Anyone who has access to the keys will be able to access resources through the service account. GCP-managed keys are used by Cloud Platform services such as App Engine and Compute Engine. These keys cannot be downloaded. Google will keep the keys and automatically rotate them on an approximately weekly basis. User-managed keys are created, downloadable, and managed by users. They expire 10 years from creation. For user-managed keys, the user has to take ownership of key management activities which include: - Key storage - Key distribution - Key revocation - Key rotation - Protecting the keys from unauthorized users - Key recovery Even with key owner precautions, keys can be easily leaked by common development malpractices like checking keys into the source code or leaving them in the Downloads directory, or accidentally leaving them on support blogs/channels. It is recommended to prevent user-managed service account keys.",
+ "ImpactStatement": "Deleting user-managed service account keys may break communication with the applications using the corresponding keys.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the IAM page in the GCP Console using `https://console.cloud.google.com/iam-admin/iam` 2. In the left navigation pane, click `Service accounts`. All service accounts and their corresponding keys are listed. 3. Click the service account. 4. Click the `edit` and delete the keys. **From Google Cloud CLI** To delete a user managed Service Account Key, gcloud iam service-accounts keys delete --iam-account=<user-managed-service-account-EMAIL> <KEY-ID> **Prevention:** You can disable service account key creation through the `Disable service account key creation` Organization policy by visiting [https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountKeyCreation](https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountKeyCreation). Learn more at: [https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts) In addition, if you do not need to have service accounts in your project, you can also prevent the creation of service accounts through the `Disable service account creation` Organization policy: [https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountCreation](https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountCreation).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the IAM page in the GCP Console using `https://console.cloud.google.com/iam-admin/iam` 2. In the left navigation pane, click `Service accounts`. All service accounts and their corresponding keys are listed. 3. Click the service accounts and check if keys exist. **From Google Cloud CLI** List All the service accounts: gcloud iam service-accounts list Identify user-managed service accounts which have an account `EMAIL` ending with `iam.gserviceaccount.com` For each user-managed service account, list the keys managed by the user: gcloud iam service-accounts keys list --iam-account=<Service Account> --managed-by=user No keys should be listed.",
+ "AdditionalInformation": "A user-managed key cannot be created on GCP-Managed Service Accounts.",
+ "References": "https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys:https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts",
+ "DefaultValue": "By default, there are no user-managed keys created for user-managed service accounts.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.6",
+ "Description": "Ensure That Service Account Has No Admin Privileges",
+ "Checks": [
+ "iam_sa_no_administrative_privileges"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.",
+ "RationaleStatement": "Service accounts represent service-level security of the Resources (application or a VM) which can be determined by the roles assigned to it. Enrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM. A ServiceAccount Access holder can perform critical actions like delete, update change settings, etc. without user intervention. For this reason, it's recommended that service accounts not have Admin rights.",
+ "ImpactStatement": "Removing `*Admin` or `*admin` or `Editor` or `Owner` role assignments from service accounts may break functionality that uses impacted service accounts. Required role(s) should be assigned to impacted service accounts in order to restore broken functionalities.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam` 2. Under the `IAM` Tab look for `VIEW BY PRINCIPALS` 3. Filter `PRINCIPALS` using `type : Service account` 4. Look for the Service Account with the Principal nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com` 5. Identify `User-Managed user created` service account with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner` under `Role` Column. 6. Click on `Edit (Pencil Icon)` for the Service Account, it will open all the roles which are assigned to the Service Account. 7. Click the `Delete bin` icon to remove the role from the Principal (service account in this case) **From Google Cloud CLI** gcloud projects get-iam-policy PROJECT_ID --format json > iam.json 1. Using a text editor, Remove `Role` which contains `roles/*Admin` or `roles/*admin` or matched `roles/editor` or matches 'roles/owner`. Add a role to the bindings array that defines the group members and the role for those members. For example, to grant the role roles/appengine.appViewer to the `ServiceAccount` which is roles/editor, you would change the example shown below as follows: { bindings: [ { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, ], role: roles/appengine.appViewer }, { members: [ user:email1@gmail.com ], role: roles/owner }, { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, serviceAccount:123456789012-compute@developer.gserviceaccount.com ], role: roles/editor } ], etag: BwUjMhCsNvY= } 2. Update the project's IAM policy: gcloud projects set-iam-policy PROJECT_ID iam.json ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam` 2. Under the `IAM` Tab look for `VIEW BY PRINCIPALS` 3. Filter `PRINCIPALS` using `type : Service account` 4. Look for the Service Account with the nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com` 5. Ensure that there are no such Service Accounts with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner` under `Role` column. **From Google Cloud CLI** 1. Get the policy that you want to modify, and write it to a JSON file: gcloud projects get-iam-policy PROJECT_ID --format json > iam.json 2. The contents of the JSON file will look similar to the following. Note that `role` of members group associated with each `serviceaccount` does not contain `*Admin` or `*admin` or does not match `roles/editor` or does not match `roles/owner`. This recommendation is only applicable to `User-Managed user-created` service accounts. These accounts have the nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com`. Note that some Google-managed, Google-created service accounts have the same naming format, and should be excluded (e.g., `appsdev-apps-dev-script-auth@system.gserviceaccount.com` which needs the Owner role). **Sample Json output:** { bindings: [ { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, ], role: roles/appengine.appAdmin }, { members: [ user:email1@gmail.com ], role: roles/owner }, { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, serviceAccount:123456789012-compute@developer.gserviceaccount.com ], role: roles/editor } ], etag: BwUjMhCsNvY=, version: 1 }",
+ "AdditionalInformation": "Default (user-managed but not user-created) service accounts have the `Editor (roles/editor)` role assigned to them to support GCP services they offer. Such Service accounts are: `PROJECT_NUMBER-compute@developer.gserviceaccount.com`, `PROJECT_ID@appspot.gserviceaccount.com`.",
+ "References": "https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/:https://cloud.google.com/iam/docs/understanding-roles:https://cloud.google.com/iam/docs/understanding-service-accounts",
+ "DefaultValue": "User Managed (and not user-created) default service accounts have the `Editor (roles/editor)` role assigned to them to support GCP services they offer. By default, there are no roles assigned to `User Managed User created` service accounts.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.7",
+ "Description": "Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level",
+ "Checks": [
+ "iam_no_service_roles_at_project_level"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.",
+ "RationaleStatement": "A service account is a special Google account that belongs to an application or a virtual machine (VM), instead of to an individual end-user. Application/VM-Instance uses the service account to call the service's Google API so that users aren't directly involved. In addition to being an identity, a service account is a resource that has IAM policies attached to it. These policies determine who can use the service account. Users with IAM roles to update the App Engine and Compute Engine instances (such as App Engine Deployer or Compute Instance Admin) can effectively run code as the service accounts used to run these instances, and indirectly gain access to all the resources for which the service accounts have access. Similarly, SSH access to a Compute Engine instance may also provide the ability to execute code as that instance/Service account. Based on business needs, there could be multiple user-managed service accounts configured for a project. Granting the `iam.serviceAccountUser` or `iam.serviceAccountTokenCreator` roles to a user for a project gives the user access to all service accounts in the project, including service accounts that may be created in the future. This can result in elevation of privileges by using service accounts and corresponding `Compute Engine instances`. In order to implement `least privileges` best practices, IAM users should not be assigned the `Service Account User` or `Service Account Token Creator` roles at the project level. Instead, these roles should be assigned to a user for a specific service account, giving that user access to the service account. The `Service Account User` allows a user to bind a service account to a long-running job service, whereas the `Service Account Token Creator` role allows a user to directly impersonate (or assert) the identity of a service account.",
+ "ImpactStatement": "After revoking `Service Account User` or `Service Account Token Creator` roles at the project level from all impacted user account(s), these roles should be assigned to a user(s) for specific service account(s) according to business needs.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the IAM page in the GCP Console by visiting: [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam). 2. Click on the filter table text bar. Type `Role: Service Account User` 3. Click the `Delete Bin` icon in front of the role `Service Account User` for every user listed as a result of a filter. 4. Click on the filter table text bar. Type `Role: Service Account Token Creator` 5. Click the `Delete Bin` icon in front of the role `Service Account Token Creator` for every user listed as a result of a filter. **From Google Cloud CLI** 1. Using a text editor, remove the bindings with the `roles/iam.serviceAccountUser` or `roles/iam.serviceAccountTokenCreator`. For example, you can use the iam.json file shown below as follows: { bindings: [ { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, ], role: roles/appengine.appViewer }, { members: [ user:email1@gmail.com ], role: roles/owner }, { members: [ serviceAccount:our-project-123@appspot.gserviceaccount.com, serviceAccount:123456789012-compute@developer.gserviceaccount.com ], role: roles/editor } ], etag: BwUjMhCsNvY= } 2. Update the project's IAM policy: gcloud projects set-iam-policy PROJECT_ID iam.json ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the IAM page in the GCP Console by visiting [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam) 2. Click on the filter table text bar, Type `Role: Service Account User`. 3. Ensure no user is listed as a result of the filter. 4. Click on the filter table text bar, Type `Role: Service Account Token Creator`. 3. Ensure no user is listed as a result of the filter. **From Google Cloud CLI** To ensure IAM users are not assigned Service Account User role at the project level: gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep roles/iam.serviceAccountUser gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep roles/iam.serviceAccountTokenCreator These commands should not return any output.",
+ "AdditionalInformation": "To assign the role `roles/iam.serviceAccountUser` or `roles/iam.serviceAccountTokenCreator` to a user role on a service account instead of a project: 1. Go to [https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts) 2. Select ` Target Project` 3. Select `target service account`. Click `Permissions` on the top bar. It will open permission pane on right side of the page 4. Add desired members with `Service Account User` or `Service Account Token Creator` role.",
+ "References": "https://cloud.google.com/iam/docs/service-accounts:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts:https://cloud.google.com/iam/docs/understanding-roles:https://cloud.google.com/iam/docs/granting-changing-revoking-access:https://console.cloud.google.com/iam-admin/iam",
+ "DefaultValue": "By default, users do not have the Service Account User or Service Account Token Creator role assigned at project level.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.8",
+ "Description": "Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer",
+ "Checks": [
+ "iam_sa_user_managed_key_rotate_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.",
+ "RationaleStatement": "Rotating Service Account keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. Service Account keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen. Each service account is associated with a key pair managed by Google Cloud Platform (GCP). It is used for service-to-service authentication within GCP. Google rotates the keys daily. GCP provides the option to create one or more user-managed (also called external key pairs) key pairs for use from outside GCP (for example, for use with Application Default Credentials). When a new key pair is created, the user is required to download the private key (which is not retained by Google). With external keys, users are responsible for keeping the private key secure and other management operations such as key rotation. External keys can be managed by the IAM API, gcloud command-line tool, or the Service Accounts page in the Google Cloud Platform Console. GCP facilitates up to 10 external service account keys per service account to facilitate key rotation.",
+ "ImpactStatement": "Rotating service account keys will break communication for dependent applications. Dependent applications need to be configured manually with the new key `ID` displayed in the `Service account keys` section and the `private key` downloaded by the user.",
+ "RemediationProcedure": "**From Google Cloud Console** **Delete any external (user-managed) Service Account Key older than 90 days:** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the Section `Service Account Keys`, for every external (user-managed) service account key where `creation date` is greater than or equal to the past 90 days, click `Delete Bin Icon` to `Delete Service Account key` **Create a new external (user-managed) Service Account Key for a Service Account:** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. Click `Create Credentials` and Select `Service Account Key`. 3. Choose the service account in the drop-down list for which an External (user-managed) Service Account key needs to be created. 4. Select the desired key type format among `JSON` or `P12`. 5. Click `Create`. It will download the `private key`. Keep it safe. 6. Click `Close` if prompted. 7. The site will redirect to the `APIs & ServicesCredentials` page. Make a note of the new `ID` displayed in the `Service account keys` section.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `Service Account Keys`, for every External (user-managed) service account key listed ensure the `creation date` is within the past 90 days. **From Google Cloud CLI** 1. List all Service accounts from a project. gcloud iam service-accounts list 2. For every service account list service account keys. gcloud iam service-accounts keys list --iam-account [Service_Account_Email_Id] --format=json 3. Ensure every service account key for a service account has a `validAfterTime` value within the past 90 days.",
+ "AdditionalInformation": "For user-managed Service Account key(s), key management is entirely the user's responsibility.",
+ "References": "https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys:https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/list:https://cloud.google.com/iam/docs/service-accounts",
+ "DefaultValue": "GCP does not provide an automation option for External (user-managed) Service key rotation.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.9",
+ "Description": "Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users",
+ "Checks": [
+ "iam_role_kms_enforce_separation_of_duties"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.",
+ "RationaleStatement": "The built-in/predefined IAM role `Service Account admin` allows the user/identity to create, delete, and manage service account(s). The built-in/predefined IAM role `Service Account User` allows the user/identity (with adequate privileges on Compute and App Engine) to assign service account(s) to Apps/Compute Instances. Separation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action. In Cloud IAM - service accounts, this could be an action such as using a service account to access resources that user should not normally have access to. Separation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors. It is considered best practice. No user should have `Service Account Admin` and `Service Account User` roles assigned at the same time.",
+ "ImpactStatement": "The removed role should be assigned to a different user based on business needs.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`. 2. For any member having both `Service Account Admin` and `Service account User` roles granted/assigned, click the `Delete Bin` icon to remove either role from the member. Removal of a role should be done based on the business requirements.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`. 2. Ensure no member has the roles `Service Account Admin` and `Service account User` assigned together. **From Google Cloud CLI** 1. List all users and role assignments: gcloud projects get-iam-policy [Project_ID] --format json | jq -r '[ ([Service_Account_Admin_and_User] | (., map(length*-))), ( [ .bindings[] | select(.role == roles/iam.serviceAccountAdmin or .role == roles/iam.serviceAccountUser).members[] ] | group_by(.) | map({User: ., Count: length}) | .[] | select(.Count == 2).User | unique ) ] | .[] | @tsv' 2. All common users listed under `Service_Account_Admin_and_User` are assigned both the `roles/iam.serviceAccountAdmin` and `roles/iam.serviceAccountUser` roles.",
+ "AdditionalInformation": "Users granted with Owner (roles/owner) and Editor (roles/editor) have privileges equivalent to `Service Account Admin` and `Service Account User`. To avoid the misuse, Owner and Editor roles should be granted to very limited users and Use of these primitive privileges should be minimal. These requirements are addressed in separate recommendations.",
+ "References": "https://cloud.google.com/iam/docs/service-accounts:https://cloud.google.com/iam/docs/understanding-roles:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.10",
+ "Description": "Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible",
+ "Checks": [
+ "kms_key_not_publicly_accessible"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.",
+ "RationaleStatement": "Granting permissions to `allUsers` or `allAuthenticatedUsers` allows anyone to access the dataset. Such access might not be desirable if sensitive data is stored at the location. In this case, ensure that anonymous and/or public access to a Cloud KMS `cryptokey` is not allowed.",
+ "ImpactStatement": "Removing the binding for `allUsers` and `allAuthenticatedUsers` members denies accessing `cryptokeys` to anonymous or public users.",
+ "RemediationProcedure": "**From Google Cloud CLI** 1. List all Cloud KMS `Cryptokeys`. gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name' 2. Remove IAM policy binding for a KMS key to remove access to `allUsers` and `allAuthenticatedUsers` using the below command. gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allAuthenticatedUsers' --role='[role]' gcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allUsers' --role='[role]' ",
+ "AuditProcedure": "**From Google Cloud CLI** 1. List all Cloud KMS `Cryptokeys`. gcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name' 2. Ensure the below command's output does not contain `allUsers` or `allAuthenticatedUsers`. gcloud kms keys get-iam-policy [key_name] --keyring=[key_ring_name] --location=global --format=json | jq '.bindings[].members[]' ",
+ "AdditionalInformation": "[key_ring_name] : Is the resource ID of the key ring, which is the fully-qualified Key ring name. This value is case-sensitive and in the form: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING You can retrieve the key ring resource ID using the Cloud Console: 1. Open the `Cryptographic Keys` page in the Cloud Console. 2. For the key ring whose resource ID you are retrieving, click the `More icon (3 vertical dots)`. 3. Click `Copy Resource ID`. The resource ID for the key ring is copied to your clipboard. [key_name] : Is the resource ID of the key, which is the fully-qualified CryptoKey name. This value is case-sensitive and in the form: projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY You can retrieve the key resource ID using the Cloud Console: 1. Open the `Cryptographic Keys` page in the Cloud Console. 2. Click the name of the key ring that contains the key. 3. For the key whose resource ID you are retrieving, click the `More icon (3 vertical dots)`. 4. Click `Copy Resource ID`. The resource ID for the key is copied to your clipboard. [role] : The role to remove the member from.",
+ "References": "https://cloud.google.com/sdk/gcloud/reference/kms/keys/remove-iam-policy-binding:https://cloud.google.com/sdk/gcloud/reference/kms/keys/set-iam-policy:https://cloud.google.com/sdk/gcloud/reference/kms/keys/get-iam-policy:https://cloud.google.com/kms/docs/object-hierarchy#key_resource_id",
+ "DefaultValue": "By default Cloud KMS does not allow access to `allUsers` or `allAuthenticatedUsers`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.11",
+ "Description": "Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days",
+ "Checks": [
+ "kms_key_rotation_max_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGER[UNIT]`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
+ "RationaleStatement": "Set a key rotation period and starting time. A key can be created with a specified `rotation period`, which is the time between when new key versions are generated automatically. A key can also be created with a specified next rotation time. A key is a named object representing a `cryptographic key` used for a specific purpose. The key material, the actual bits used for `encryption`, can change over time as new key versions are created. A key is used to protect some `corpus of data`. A collection of files could be encrypted with the same key and people with `decrypt` permissions on that key would be able to decrypt those files. Therefore, it's necessary to make sure the `rotation period` is set to a specific time.",
+ "ImpactStatement": "After a successful key rotation, the older key version is required in order to decrypt the data encrypted by that previous key version.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Cryptographic Keys` by visiting: [https://console.cloud.google.com/security/kms](https://console.cloud.google.com/security/kms). 2. Click on the specific key ring 3. From the list of keys, choose the specific key and Click on `Right side pop up the blade (3 dots)`. 4. Click on `Edit rotation period`. 5. On the pop-up window, `Select a new rotation period` in days which should be less than 90 and then choose `Starting on` date (date from which the rotation period begins). **From Google Cloud CLI** 1. Update and schedule rotation by `ROTATION_PERIOD` and `NEXT_ROTATION_TIME` for each key: gcloud kms keys update new --keyring=KEY_RING --location=LOCATION --next-rotation-time=NEXT_ROTATION_TIME --rotation-period=ROTATION_PERIOD ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Cryptographic Keys` by visiting: [https://console.cloud.google.com/security/kms](https://console.cloud.google.com/security/kms). 2. Click on each key ring, then ensure each key in the keyring has `Next Rotation` set for less than 90 days from the current date. **From Google Cloud CLI** 1. Ensure rotation is scheduled by `ROTATION_PERIOD` and `NEXT_ROTATION_TIME` for each key : gcloud kms keys list --keyring=<KEY_RING> --location=<LOCATION> --format=json'(rotationPeriod)' Ensure outcome values for `rotationPeriod` and `nextRotationTime` satisfy the below criteria: `rotationPeriod is <= 129600m` `rotationPeriod is <= 7776000s` `rotationPeriod is <= 2160h` `rotationPeriod is <= 90d` `nextRotationTime is <= 90days` from current DATE",
+ "AdditionalInformation": "- Key rotation does NOT re-encrypt already encrypted data with the newly generated key version. If you suspect unauthorized use of a key, you should re-encrypt the data protected by that key and then disable or schedule destruction of the prior key version. - It is not recommended to rely solely on irregular rotation, but rather to use irregular rotation if needed in conjunction with a regular rotation schedule.",
+ "References": "https://cloud.google.com/kms/docs/key-rotation#frequency_of_key_rotation:https://cloud.google.com/kms/docs/re-encrypt-data",
+ "DefaultValue": "By default, KMS encryption keys are rotated every 90 days.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.12",
+ "Description": "Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users",
+ "Checks": [
+ "iam_role_kms_enforce_separation_of_duties"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.",
+ "RationaleStatement": "The built-in/predefined IAM role `Cloud KMS Admin` allows the user/identity to create, delete, and manage service account(s). The built-in/predefined IAM role `Cloud KMS CryptoKey Encrypter/Decrypter` allows the user/identity (with adequate privileges on concerned resources) to encrypt and decrypt data at rest using an encryption key(s). The built-in/predefined IAM role `Cloud KMS CryptoKey Encrypter` allows the user/identity (with adequate privileges on concerned resources) to encrypt data at rest using an encryption key(s). The built-in/predefined IAM role `Cloud KMS CryptoKey Decrypter` allows the user/identity (with adequate privileges on concerned resources) to decrypt data at rest using an encryption key(s). Separation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action. In Cloud KMS, this could be an action such as using a key to access and decrypt data a user should not normally have access to. Separation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors. It is considered best practice. No user(s) should have `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` roles assigned at the same time.",
+ "ImpactStatement": "Removed roles should be assigned to another user based on business needs.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam` 2. For any member having `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` roles granted/assigned, click the `Delete Bin` icon to remove the role from the member. Note: Removing a role should be done based on the business requirement.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `IAM & Admin/IAM` by visiting: [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam) 2. Ensure no member has the roles `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` assigned. **From Google Cloud CLI** 1. List all users and role assignments: gcloud projects get-iam-policy PROJECT_ID 2. Ensure that there are no common users found in the member section for roles `cloudkms.admin` and any one of `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter`",
+ "AdditionalInformation": "Users granted with Owner (roles/owner) and Editor (roles/editor) have privileges equivalent to `Cloud KMS Admin` and `Cloud KMS CryptoKey Encrypter/Decrypter`. To avoid misuse, Owner and Editor roles should be granted to a very limited group of users. Use of these primitive privileges should be minimal.",
+ "References": "https://cloud.google.com/kms/docs/separation-of-duties",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.13",
+ "Description": "Ensure API Keys Only Exist for Active Services",
+ "Checks": [
+ "apikeys_key_exists"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.",
+ "RationaleStatement": "To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead. Security risks involved in using API-Keys appear below: - API keys are simple encrypted strings - API keys do not identify the user or the application making the API request - API keys are typically accessible to clients, making it easy to discover and steal an API key",
+ "ImpactStatement": "Deleting an API key will break dependent applications (if any).",
+ "RemediationProcedure": "**From Console:** 1. Go to `APIs & ServicesCredentials` using https://console.cloud.google.com/apis/credentials. 1. In the section `API Keys`, to delete API Keys: Click the `Delete Bin Icon` in front of every `API Key Name`. **From Google Cloud Command Line** 1. Run the following from within the project you wish to audit gcloud services api-keys list --filter 1. Run the following command, providing the ID of the key or fully qualified identifier for the key for <key_id>: gcloud services api-keys delete <key_id> ",
+ "AuditProcedure": "**From Console:** 1. From within the Project you wish to audit Go to `APIs & ServicesCredentials`. 1. In the section `API Keys`, no API key should be listed. **From Google Cloud Command Line** 1. Run the following from within the project you wish to audit gcloud services api-keys list --filter 1. There should be no keys listed at the project level.",
+ "AdditionalInformation": "Google recommends using the standard authentication flow instead of using API keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API. If a business requires API keys to be used, then the API keys should be secured properly.",
+ "References": "https://cloud.google.com/docs/authentication/api-keys:https://cloud.google.com/sdk/gcloud/reference/services/api-keys/list:https://cloud.google.com/docs/authentication:https://cloud.google.com/sdk/gcloud/reference/services/api-keys/delete",
+ "DefaultValue": "By default, API keys are not created for a project.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.14",
+ "Description": "Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.",
+ "RationaleStatement": "Security risks involved in using API-Keys appear below: - API keys are simple encrypted strings - API keys do not identify the user or the application making the API request - API keys are typically accessible to clients, making it easy to discover and steal an API key In light of these potential risks, Google recommends using the standard authentication flow instead of API keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API. In order to reduce attack vectors, API-Keys can be restricted only to trusted hosts, HTTP referrers and applications.",
+ "ImpactStatement": "Setting `Application Restrictions` may break existing application functioning, if not done carefully.",
+ "RemediationProcedure": "**From Google Cloud Console** ***Leaving Keys in Place*** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page. 3. In the `Key restrictions` section, set the application restrictions to any of `HTTP referrers, IP addresses, Android apps, iOS apps`. 4. Click `Save`. 1. Repeat steps 2,3,4 for every unrestricted API key. **Note:** Do not set `HTTP referrers` to wild-cards (* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s) Do not set `IP addresses` and referrer to `any host (0.0.0.0 or 0.0.0.0/0 or ::0)` ***Removing Keys*** Another option is to remove the keys entirely. 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, select the checkbox next to each key you wish to remove 3. Select `Delete` and confirm.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 1. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page. 1. For every API Key, ensure the section `Key restrictions` parameter `Application restrictions` is not set to `None`. Or, 1. Ensure `Application restrictions` is set to `HTTP referrers` and the referrer is not set to wild-cards `(* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s)` Or, 1. Ensure `Application restrictions` is set to `IP addresses` and referrer is not set to `any host (0.0.0.0 or 0.0.0.0/0 or ::0)` **From Google Cloud Command Line** 1. Run the following from within the project you wish to audit gcloud services api-keys list --filter=-restrictions:* --format=table[box](displayName:label='Key With No Restrictions') ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/docs/authentication/api-keys:https://cloud.google.com/sdk/gcloud/reference/services/api-keys/list:https://cloud.google.com/sdk/gcloud/reference/services/api-keys/update",
+ "DefaultValue": "By default, `Application Restrictions` are set to `None`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.15",
+ "Description": "Ensure API Keys Are Restricted to Only APIs That Application Needs Access",
+ "Checks": [
+ "apikeys_api_restrictions_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.",
+ "RationaleStatement": "Security risks involved in using API-Keys are below: - API keys are simple encrypted strings - API keys do not identify the user or the application making the API request - API keys are typically accessible to clients, making it easy to discover and steal an API key In light of these potential risks, Google recommends using the standard authentication flow instead of API-Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API. In order to reduce attack surfaces by providing `least privileges`, API-Keys can be restricted to use (call) only APIs required by an application.",
+ "ImpactStatement": "Setting `API restrictions` may break existing application functioning, if not done carefully.",
+ "RemediationProcedure": "**From Console:** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page. 3. In the `Key restrictions` section go to `API restrictions`. 4. Click the `Select API` drop-down to choose an API. 5. Click `Save`. 6. Repeat steps 2,3,4,5 for every unrestricted API key **Note:** Do not set `API restrictions` to `Google Cloud APIs`, as this option allows access to all services offered by Google cloud. **From Google Cloud CLI** 1. List all API keys. gcloud services api-keys list 2. Note the `UID` of the key to add restrictions to. 3. Run the update command with the appropriate API target service or flags file with API target services and methods to add the required restrictions. Command with appropriate API target service: gcloud services api-keys update <UID> --api-target=service=<service> Command with flags file: gcloud services api-keys update <UID> --flags-file=<flags_file>.yaml Content of flags file: - --api-target: service: foo.service.com - --api-target: service: bar.service.com methods: - foomethod - barmethod Note: Flags can be found by running: gcloud services api-keys update --help Note: Services can be found by running: gcloud services list or in this documentation https://cloud.google.com/sdk/gcloud/reference/services/api-keys/update",
+ "AuditProcedure": "**From Console:** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page. 3. For every API Key, ensure the section `Key restrictions` parameter `API restrictions` is not set to `None`. Or, Ensure `API restrictions` is not set to `Google Cloud APIs` **Note:** `Google Cloud APIs` represents the API collection of all cloud services/APIs offered by Google cloud. **From Google Cloud CLI** 1. List all API Keys. gcloud services api-keys list Each key should have a line that says `restrictions:` followed by varying parameters and NOT have a line saying `- service: cloudapis.googleapis.com` as shown here restrictions: apiTargets: - service: cloudapis.googleapis.com ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/docs/authentication/api-keys:https://cloud.google.com/apis/docs/overview",
+ "DefaultValue": "By default, `API restrictions` are set to `None`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.16",
+ "Description": "Ensure API Keys Are Rotated Every 90 Days",
+ "Checks": [
+ "apikeys_key_rotated_in_90_days"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.",
+ "RationaleStatement": "Security risks involved in using API-Keys are listed below: - API keys are simple encrypted strings - API keys do not identify the user or the application making the API request - API keys are typically accessible to clients, making it easy to discover and steal an API key Because of these potential risks, Google recommends using the standard authentication flow instead of API Keys. However, there are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API. Once a key is stolen, it has no expiration, meaning it may be used indefinitely unless the project owner revokes or regenerates the key. Rotating API keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. API keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen.",
+ "ImpactStatement": "`Regenerating Key` may break existing client connectivity as the client will try to connect with older API keys they have stored on devices.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page. 3. Click `REGENERATE KEY` to rotate API key. 4. Click `Save`. 5. Repeat steps 2,3,4 for every API key that has not been rotated in the last 90 days. **Note:** Do not set `HTTP referrers` to wild-cards (* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s) Do not set `IP addresses` and referrer to `any host (0.0.0.0 or 0.0.0.0/0 or ::0)` **From Google Cloud CLI** There is not currently a way to regenerate and API key using gcloud commands. To 'regenerate' a key you will need to create a new one, duplicate the restrictions from the key being rotated, and delete the old key. 1. List existing keys. gcloud services api-keys list 2. Note the `UID` and restrictions of the key to regenerate. 3. Run this command to create a new API key. <key_name> is the display name of the new key. ` gcloud services api-keys create --display-name=<key_name> ` Note the `UID` of the newly created key 4. Run the update command to add required restrictions. Note - the restriction may vary for each key. Refer to this documentation for the appropriate flags. https://cloud.google.com/sdk/gcloud/reference/services/api-keys/update gcloud services api-keys update <UID of new key> 5. Delete the old key. gcloud services api-keys delete <UID of old key> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `APIs & ServicesCredentials` using `https://console.cloud.google.com/apis/credentials` 2. In the section `API Keys`, for every key ensure the `creation date` is less than 90 days. **From Google Cloud CLI** To list keys, use the command gcloud services api-keys list Ensure the date in `createTime` is within 90 days.",
+ "AdditionalInformation": "There is no option to automatically regenerate (rotate) API keys periodically.",
+ "References": "https://developers.google.com/maps/api-security-best-practices#regenerate-apikey:https://cloud.google.com/sdk/gcloud/reference/services/api-keys/update",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.17",
+ "Description": "Ensure Essential Contacts is Configured for Organization",
+ "Checks": [
+ "iam_organization_essential_contacts_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.",
+ "RationaleStatement": "Many Google Cloud services, such as Cloud Billing, send out notifications to share important information with Google Cloud users. By default, these notifications are sent to members with certain Identity and Access Management (IAM) roles. With Essential Contacts, you can customize who receives notifications by providing your own list of contacts.",
+ "ImpactStatement": "There is no charge for Essential Contacts except for the 'Technical Incidents' category that is only available to premium support customers.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Essential Contacts` by visiting https://console.cloud.google.com/iam-admin/essential-contacts 2. Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for. 3. Click `+Add contact` 4. In the `Email` and `Confirm Email` fields, enter the email address of the contact. 5. From the `Notification categories` drop-down menu, select the notification categories that you want the contact to receive communications for. 6. Click `Save` **From Google Cloud CLI** 1. To add an organization Essential Contacts run a command: gcloud essential-contacts create --email=<EMAIL> --notification-categories=<NOTIFICATION_CATEGORIES> --organization=<ORGANIZATION_ID> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Essential Contacts` by visiting https://console.cloud.google.com/iam-admin/essential-contacts 2. Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for. 3. Ensure that appropriate email addresses are configured for each of the following notification categories: - `Legal` - `Security` - `Suspension` - `Technical` Alternatively, appropriate email addresses can be configured for the `All` notification category to receive all possible important notifications. **From Google Cloud CLI** 1. To list all configured organization Essential Contacts run a command: gcloud essential-contacts list --organization=<ORGANIZATION_ID> 2. Ensure at least one appropriate email address is configured for each of the following notification categories: - `LEGAL` - `SECURITY` - `SUSPENSION` - `TECHNICAL` Alternatively, appropriate email addresses can be configured for the `ALL` notification category to receive all possible important notifications.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/resource-manager/docs/managing-notification-contacts",
+ "DefaultValue": "By default, there are no Essential Contacts configured. In the absence of an Essential Contact, the following IAM roles are used to identify users to notify for the following categories: - **Legal**: `roles/billing.admin` - **Security**: `roles/resourcemanager.organizationAdmin` - **Suspension**: `roles/owner` - **Technical**: `roles/owner` - **Technical Incidents**: `roles/owner`",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "1.18",
+ "Description": "Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Identity and Access Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.",
+ "RationaleStatement": "It is recommended to use the Secret Manager, because environment variables are stored unencrypted, and accessible for all users who have access to the code.",
+ "ImpactStatement": "There should be no impact on the Cloud Function. There are minor costs after 10,000 requests a month to the Secret Manager API as well for a high use of other functions. Modifying the Cloud Function to use the Secret Manager may prevent it running to completion.",
+ "RemediationProcedure": "Enable Secret Manager API for your Project **From Google Cloud Console** 1. Within the project you wish to enable, select the Navigation hamburger menu in the top left. Hover over 'APIs & Services' to under the heading 'Serverless', then select 'Enabled APIs & Services' in the menu that opens up. 2. Click the button '+ Enable APIS and Services' 3. In the Search bar, search for 'Secret Manager API' and select it. 4. Click the blue box that says 'Enable'. **From Google Cloud CLI** 1. Within the project you wish to enable the API in, run the following command. gcloud services enable Secret Manager API Reviewing Environment Variables That Should Be Migrated to Secret Manager **From Google Cloud Console** 1. Log in to the Google Cloud Web Portal (https://console.cloud.google.com/) 1. Go to Cloud Functions 1. Click on a function name from the list 1. Click on Edit and review the Runtime environment for variables that should be secrets. Leave this list open for the next step. **From Google Cloud CLI** 1. To view a list of your cloud functions run gcloud functions list 2. For each cloud function run the following command. gcloud functions describe <function_name> 3. Review the settings of the buildEnvironmentVariables and environmentVariables. Keep this information for the next step. Migrating Environment Variables to Secrets within the Secret Manager **From Google Cloud Console** 1. Go to the Secret Manager page in the Cloud Console. 1. On the Secret Manager page, click Create Secret. 1. On the Create secret page, under Name, enter the name of the Environment Variable you are replacing. This will then be the Secret Variable you will reference in your code. 1. You will also need to add a version. This is the actual value of the variable that will be referenced from the code. To add a secret version when creating the initial secret, in the Secret value field, enter the value from the Environment Variable you are replacing. 1. Leave the Regions section unchanged. 1. Click the Create secret button. 1. Repeat for all Environment Variables **From Google Cloud CLI** 1. Run the following command with the Environment Variable name you are replacing in the `<secret-id>`. It is most secure to point this command to a file with the Environment Variable value located in it, as if you entered it via command line it would show up in your shell’s command history. gcloud secrets create <secret-id> --data-file=/path/to/file.txt Granting your Runtime's Service Account Access to Secrets **From Google Cloud Console** 1. Within the project containing your runtime login with account that has the 'roles/secretmanager.secretAccessor' permission. 2. Select the Navigation hamburger menu in the top left. Hover over 'Security' to under the then select 'Secret Manager' in the menu that opens up. 3. Click the name of a secret listed in this screen. 4. If it is not already open, click Show Info Panel in this screen to open the panel. 5.In the info panel, click Add principal. 6.In the New principals field, enter the service account your function uses for its identity. (If you need help locating or updating your runtime's service account, please see the 'docs/securing/function-identity#runtime_service_account' reference.) 7. In the Select a role dropdown, choose Secret Manager and then Secret Manager Secret Accessor. **From Google Cloud CLI** As of the time of writing, using Google CLI to list Runtime variables is only in beta. Because this is likely to change we are not including it here. Modifying the Code to use the Secrets in Secret Manager **From Google Cloud Console** This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the '/docs/creating-and-accessing-secrets#access' reference for language specific instructions. **From Google Cloud CLI** This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the' /docs/creating-and-accessing-secrets#access' reference for language specific instructions. Deleting the Insecure Environment Variables **Be certain to do this step last.** Removing variables from code actively referencing them will prevent it from completing successfully. **From Google Cloud Console** 1. Select the Navigation hamburger menu in the top left. Hover over 'Security' then select 'Secret Manager' in the menu that opens up. 1. Click the name of a function. Click Edit. 1. Click Runtime, build and connections settings to expand the advanced configuration options. 1. Click 'Security’. Hover over the secret you want to remove, then click 'Delete'. 1. Click Next. Click Deploy. The latest version of the runtime will now reference the secrets in Secret Manager. **From Google Cloud CLI** gcloud functions deploy <Function name>--remove-env-vars <env vars> If you need to find the env vars to remove, they are from the step where ‘gcloud functions describe `<function_name>`’ was run.",
+ "AuditProcedure": "Determine if Confidential Information is Stored in your Functions in Cleartext **From Google Cloud Console** 1. Within the project you wish to audit, select the Navigation hamburger menu in the top left. Scroll down to under the heading 'Serverless', then select 'Cloud Functions' 1. Click on a function name from the list 1. Open the Variables tab and you will see both buildEnvironmentVariables and environmentVariables 1. Review the variables whether they are secrets 1. Repeat step 3-5 until all functions are reviewed **From Google Cloud CLI** 1. To view a list of your cloud functions run gcloud functions list 2. For each cloud function in the list run the following command. gcloud functions describe <function_name> 3. Review the settings of the buildEnvironmentVariables and environmentVariables. Determine if this is data that should not be publicly accessible. Determine if Secret Manager API is 'Enabled' for your Project **From Google Cloud Console** 1. Within the project you wish to audit, select the Navigation hamburger menu in the top left. Hover over 'APIs & Services' to under the heading 'Serverless', then select 'Enabled APIs & Services' in the menu that opens up. 1. Click the button '+ Enable APIS and Services' 1. In the Search bar, search for 'Secret Manager API' and select it. 1. If it is enabled, the blue box that normally says 'Enable' will instead say 'Manage'. **From Google Cloud CLI** 1. Within the project you wish to audit, run the following command. gcloud services list 2. If 'Secret Manager API' is in the list, it is enabled.",
+ "AdditionalInformation": "There are slight additional costs to using the Secret Manager API. Review the documentation to determine your organizations' needs.",
+ "References": "https://cloud.google.com/functions/docs/configuring/env-var#managing_secrets:https://cloud.google.com/secret-manager/docs/overview",
+ "DefaultValue": "By default Secret Manager is not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.1",
+ "Description": "Ensure That Cloud Audit Logging Is Configured Properly",
+ "Checks": [
+ "iam_audit_logs_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.",
+ "RationaleStatement": "Cloud Audit Logging maintains two audit logs for each project, folder, and organization: Admin Activity and Data Access. 1. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity audit logs are enabled for all services and cannot be configured. 2. Data Access audit logs record API calls that create, modify, or read user-provided data. These are disabled by default and should be enabled. There are three kinds of Data Access audit log information: - Admin read: Records operations that read metadata or configuration information. Admin Activity audit logs record writes of metadata and configuration information that cannot be disabled. - Data read: Records operations that read user-provided data. - Data write: Records operations that write user-provided data. It is recommended to have an effective default audit config configured in such a way that: 1. logtype is set to DATA_READ (to log user activity tracking) and DATA_WRITES (to log changes/tampering to user data). 2. audit config is enabled for all the services supported by the Data Access audit logs feature. 3. Logs should be captured for all users, i.e., there are no exempted users in any of the audit config sections. This will ensure overriding the audit config will not contradict the requirement.",
+ "ImpactStatement": "There is no charge for Admin Activity audit logs. Enabling the Data Access audit logs might result in your project being charged for the additional logs usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Audit Logs` by visiting [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit). 2. Follow the steps at [https://cloud.google.com/logging/docs/audit/configure-data-access](https://cloud.google.com/logging/docs/audit/configure-data-access) to enable audit logs for all Google Cloud services. Ensure that no exemptions are allowed. **From Google Cloud CLI** 1. To read the project's IAM policy and store it in a file run a command: gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml Alternatively, the policy can be set at the organization or folder level. If setting the policy at the organization level, it is not necessary to also set it for each folder or project. gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml 2. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to: **Note: Admin Activity Logs are enabled by default, and cannot be disabled. So they are not listed in these configuration changes.** auditConfigs: - auditLogConfigs: - logType: DATA_WRITE - logType: DATA_READ service: allServices **Note:** `exemptedMembers:` is not set as audit logging should be enabled for all the users 3. To write new IAM policy run command: gcloud organizations set-iam-policy ORGANIZATION_ID /tmp/org_policy.yaml gcloud resource-manager folders set-iam-policy FOLDER_ID /tmp/folder_policy.yaml gcloud projects set-iam-policy PROJECT_ID /tmp/project_policy.yaml If the preceding command reports a conflict with another change, then repeat these steps, starting with the first step.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Audit Logs` by visiting [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit). 2. Ensure that Admin Read, Data Write, and Data Read are enabled for all Google Cloud services and that no exemptions are allowed. **From Google Cloud CLI** 1. List the Identity and Access Management (IAM) policies for the project, folder, or organization: gcloud organizations get-iam-policy ORGANIZATION_ID gcloud resource-manager folders get-iam-policy FOLDER_ID gcloud projects get-iam-policy PROJECT_ID 2. Policy should have a default auditConfigs section which has the logtype set to DATA_WRITES and DATA_READ for all services. Note that projects inherit settings from folders, which in turn inherit settings from the organization. When called, projects get-iam-policy, the result shows only the policies set in the project, not the policies inherited from the parent folder or organization. Nevertheless, if the parent folder has Cloud Audit Logging enabled, the project does as well. Sample output for default audit configs may look like this: auditConfigs: - auditLogConfigs: - logType: ADMIN_READ - logType: DATA_WRITE - logType: DATA_READ service: allServices 3. Any of the auditConfigs sections should not have parameter exemptedMembers: set, which will ensure that Logging is enabled for all users and no user is exempted.",
+ "AdditionalInformation": "- Log type `DATA_READ` is equally important to that of `DATA_WRITE` to track detailed user activities. - BigQuery Data Access logs are handled differently from other data access logs. BigQuery logs are enabled by default and cannot be disabled. They do not count against logs allotment and cannot result in extra logs charges.",
+ "References": "https://cloud.google.com/logging/docs/audit/:https://cloud.google.com/logging/docs/audit/configure-data-access",
+ "DefaultValue": "Admin Activity logs are always enabled. They cannot be disabled. Data Access audit logs are disabled by default because they can be quite large.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.2",
+ "Description": "Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console. Enabling the \"Sharing of data with Google Cloud Services\" setting allows these logs to flow into the Google Cloud (GCP) Organization's Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation.",
+ "RationaleStatement": "Without centralized logging of identity provider events, security teams cannot easily correlate Workspace/Identity administrative changes with GCP resource changes. If a Super Admin account is compromised, the audit trail must be preserved in a secure, centralized location to prevent an attacker from deleting evidence within the Workspace console.",
+ "ImpactStatement": "",
+ "AuditProcedure": "**From Google Admin Console**\n\n1. Log in to the Google Admin Console as a Super Admin.\n2. From the Home page, go to `Account` > `Account settings`.\n3. Click on the `Legal and compliance` section.\n4. Locate the setting titled `Sharing options - Google Cloud Platform Sharing Options` and verify that the status is set to `Enabled`.",
+ "RemediationProcedure": "**From Google Admin Console**\n\n1. Log in to the Google Admin Console as a Super Admin.\n2. From the Home page, go to `Account` > `Account settings`.\n3. Click on the `Legal and compliance` section.\n4. Locate the setting titled `Sharing options - Google Cloud Platform Sharing Options`, click on `Enabled` and click `Save`.\n5. (Optional but Recommended) Navigate to the GCP Console > `Logging` > `Logs Explorer` and verify that the logs are arriving from the admin portal.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, Google Workspace/Cloud Identity admin audit logs are only available within the Google Admin Console and are not shared with Google Cloud."
+ }
+ ]
+ },
+ {
+ "Id": "2.3",
+ "Description": "Ensure That Sinks Are Configured for All Log Entries",
+ "Checks": [
+ "cloudstorage_bucket_log_retention_policy_lock"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).",
+ "RationaleStatement": "Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.",
+ "ImpactStatement": "There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Logs Router` by visiting [https://console.cloud.google.com/logs/router](https://console.cloud.google.com/logs/router). 2. Click on the arrow symbol with `CREATE SINK` text. 3. Fill out the fields for `Sink details`. 4. Choose Cloud Logging bucket in the Select sink destination drop down menu. 5. Choose a log bucket in the next drop down menu. 6. If an inclusion filter is not provided for this sink, all ingested logs will be routed to the destination provided above. This may result in higher than expected resource usage. 7. Click `Create Sink`. For more information, see [https://cloud.google.com/logging/docs/export/configure_export_v2#dest-create](https://cloud.google.com/logging/docs/export/configure_export_v2#dest-create). **From Google Cloud CLI** To create a sink to export all log entries in a Google Cloud Storage bucket: gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME Sinks can be created for a folder or organization, which will include all projects. gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME --include-children --folder=FOLDER_ID | --organization=ORGANIZATION_ID **Note:** 1. A sink created by the command-line above will export logs in storage buckets. However, sinks can be configured to export logs into BigQuery, or Cloud Pub/Sub, or `Custom Destination`. 2. While creating a sink, the sink option `--log-filter` is not used to ensure the sink exports all log entries. 3. A sink can be created at a folder or organization level that collects the logs of all the projects underneath bypassing the option `--include-children` in the gcloud command.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Logs Router` by visiting [https://console.cloud.google.com/logs/router](https://console.cloud.google.com/logs/router). 2. For every sink, click the 3-dot button for Menu options and select `View sink details`. 3. Ensure there is at least one sink with an `empty` Inclusion filter. 4. Additionally, ensure that the resource configured as `Destination` exists. **From Google Cloud CLI** 1. Ensure that a sink with an `empty filter` exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project: gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID The output should list at least one sink with an `empty filter`. 2. Additionally, ensure that the resource configured as `Destination` exists. See [https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list](https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list) for more information.",
+ "AdditionalInformation": "For Command-Line Audit and Remediation, the sink destination of type `Cloud Storage Bucket` is considered. However, the destination could be configured to `Cloud Storage Bucket` or `BigQuery` or `Cloud PubSub` or `Custom Destination`. Command Line Interface commands would change accordingly.",
+ "References": "https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/logging/quotas:https://cloud.google.com/logging/docs/routing/overview:https://cloud.google.com/logging/docs/export/using_exported_logs:https://cloud.google.com/logging/docs/export/configure_export_v2:https://cloud.google.com/logging/docs/export/aggregated_exports:https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list",
+ "DefaultValue": "By default, there are no sinks configured.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.4",
+ "Description": "Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock",
+ "Checks": [
+ "cloudstorage_bucket_log_retention_policy_lock"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.",
+ "RationaleStatement": "Logs can be exported by creating one or more sinks that include a log filter and a destination. As Cloud Logging receives new log entries, they are compared against each sink. If a log entry matches a sink's filter, then a copy of the log entry is written to the destination. Sinks can be configured to export logs in storage buckets. It is recommended to configure a data retention policy for these cloud storage buckets and to lock the data retention policy; thus permanently preventing the policy from being reduced or removed. This way, if the system is ever compromised by an attacker or a malicious insider who wants to cover their tracks, the activity logs are definitely preserved for forensics and security investigations.",
+ "ImpactStatement": "Locking a bucket is an irreversible action. Once you lock a bucket, you cannot remove the retention policy from the bucket or decrease the retention period for the policy. You will then have to wait for the retention period for all items within the bucket before you can delete them, and then the bucket.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. If sinks are **not** configured, first follow the instructions in the recommendation: `Ensure that sinks are configured for all Log entries`. 2. For each storage bucket configured as a sink, go to the Cloud Storage browser at `https://console.cloud.google.com/storage/browser/<BUCKET_NAME>`. 3. Select the Bucket Lock tab near the top of the page. 4. In the Retention policy entry, click the Add Duration link. The `Set a retention policy` dialog box appears. 5. Enter the desired length of time for the retention period and click `Save policy`. 6. Set the `Lock status` for this retention policy to `Locked`. **From Google Cloud CLI** 1. To list all sinks destined to storage buckets: gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID 2. For each storage bucket listed above, set a retention policy and lock it: gsutil retention set [TIME_DURATION] gs://[BUCKET_NAME] gsutil retention lock gs://[BUCKET_NAME] For more information, visit [https://cloud.google.com/storage/docs/using-bucket-lock#set-policy](https://cloud.google.com/storage/docs/using-bucket-lock#set-policy).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Open the Cloud Storage browser in the Google Cloud Console by visiting [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser). 2. In the Column display options menu, make sure `Retention policy` is checked. 3. In the list of buckets, the retention period of each bucket is found in the `Retention policy` column. If the retention policy is locked, an image of a lock appears directly to the left of the retention period. **From Google Cloud CLI** 1. To list all sinks destined to storage buckets: gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID 2. For every storage bucket listed above, verify that retention policies and Bucket Lock are enabled: gsutil retention get gs://BUCKET_NAME For more information, see [https://cloud.google.com/storage/docs/using-bucket-lock#view-policy](https://cloud.google.com/storage/docs/using-bucket-lock#view-policy).",
+ "AdditionalInformation": "Caution: Locking a retention policy is an irreversible action. Once locked, you must delete the entire bucket in order to remove the bucket's retention policy. However, before you can delete the bucket, you must be able to delete all the objects in the bucket, which itself is only possible if all the objects have reached the retention period set by the retention policy.",
+ "References": "https://cloud.google.com/storage/docs/bucket-lock:https://cloud.google.com/storage/docs/using-bucket-lock:https://cloud.google.com/storage/docs/bucket-lock",
+ "DefaultValue": "By default, storage buckets used as log sinks do not have retention policies and Bucket Lock configured.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.5",
+ "Description": "Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored. Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners. The project owner has all the privileges on the project the role belongs to. These are summarized below: - All viewer permissions on all GCP Services within the project - Permissions for actions that modify the state of all GCP services within the project - Manage roles and permissions for a project and all resources within the project - Set up billing for a project Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.",
+ "RationaleStatement": "Project ownership has the highest level of privileges on a project. To avoid misuse of project resources, the project ownership assignment/change actions mentioned above should be monitored and alerted to concerned recipients. - Sending project ownership invites - Acceptance/Rejection of project ownership invite by user - Adding `roleOwner` to a user/service-account - Removing a user/Service account from `roleOwner`",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: (protoPayload.serviceName=cloudresourcemanager.googleapis.com) AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=REMOVE AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=ADD AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) 4. Click `Submit Filter`. The logs display based on the filter text entered by the user. 5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and the `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query. 6. Click `Create Metric`. **Create the display prescribed Alert Policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the desired metric and select `Create alert from Metric`. A new page opens. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notifications channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create a prescribed Log Metric: - Use the command: gcloud beta logging metrics create - Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create Create prescribed Alert Policy - Use the command: gcloud alpha monitoring policies create - Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure that the prescribed log metric is present:** 1. Go to `Logging/Log-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure that at least one metric `<Log_Metric_Name>` is present with filter text: (protoPayload.serviceName=cloudresourcemanager.googleapis.com) AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=REMOVE AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=ADD AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) **Ensure that the prescribed Alerting Policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for your organization. 5. Ensure that the appropriate notifications channels have been set up. **From Google Cloud CLI** **Ensure that the prescribed log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with filter set to: (protoPayload.serviceName=cloudresourcemanager.googleapis.com) AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=REMOVE AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action=ADD AND protoPayload.serviceData.policyDelta.bindingDeltas.role=roles/owner) 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains an least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "1. Project ownership assignments for a user cannot be done using the gcloud utility as assigning project ownership to a user requires sending, and the user accepting, an invitation. 2. Project Ownership assignment to a service account does not send any invites. SetIAMPolicy to `role/owner`is directly performed on service accounts.",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.6",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, who did what, where, and when? within GCP projects. Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.",
+ "RationaleStatement": "Admin activity and data access logs produced by cloud audit logging enable security analysis, resource change tracking, and compliance auditing. Configuring the metric filter and alerts for audit configuration changes ensures the recommended state of audit configuration is maintained so that all activities in the project are audit-able at any point in time.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: protoPayload.methodName=SetIamPolicy AND protoPayload.serviceData.policyDelta.auditConfigDeltas:* 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This will ensure that the log metric counts the number of log entries matching the user's advanced logs query. 6. Click `Create Metric`. **Create a prescribed Alert Policy:** 1. Identify the new metric the user just created, under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page opens. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notifications channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create a prescribed Log Metric: - Use the command: gcloud beta logging metrics create - Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create ](https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create) Create prescribed Alert Policy - Use the command: gcloud alpha monitoring policies create - Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create](https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create)",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure the prescribed log metric is present:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure that at least one metric `<Log_Metric_Name>` is present with the filter text: protoPayload.methodName=SetIamPolicy AND protoPayload.serviceData.policyDelta.auditConfigDeltas:* **Ensure that the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of 0 for greater than zero(0) seconds`, means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that appropriate notifications channels have been set up. **From Google Cloud CLI** **Ensure that the prescribed log metric is present:** 1. List the log metrics: gcloud beta logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to: protoPayload.methodName=SetIamPolicy AND protoPayload.serviceData.policyDelta.auditConfigDeltas:* 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains at least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/logging/docs/audit/configure-data-access#getiampolicy-setiampolicy",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.7",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.",
+ "RationaleStatement": "Google Cloud IAM provides predefined roles that give granular access to specific Google Cloud Platform resources and prevent unwanted access to other resources. However, to cater to organization-specific needs, Cloud IAM also provides the ability to create custom roles. Project owners and administrators with the Organization Role Administrator role or the IAM Role Administrator role can create custom roles. Monitoring role creation, deletion and updating activities will help in identifying any over-privileged role at early stages.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage.",
+ "RemediationProcedure": "**From Console:** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 1. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 1. Clear any text and add: resource.type=iam_role AND (protoPayload.methodName = google.iam.admin.v1.CreateRole OR protoPayload.methodName=google.iam.admin.v1.DeleteRole OR protoPayload.methodName=google.iam.admin.v1.UpdateRole OR protoPayload.methodName=google.iam.admin.v1.UndeleteRole) 1. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 1. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query. 1. Click `Create Metric`. **Create a prescribed Alert Policy:** 1. Identify the new metric that was just created under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the metric and select `Create alert from Metric`. A new page displays. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 1. Configure the desired notification channels in the section `Notifications`. 1. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed Log Metric: - Use the command: gcloud logging metrics create Create the prescribed Alert Policy: - Use the command: gcloud alpha monitoring policies create <policy name>",
+ "AuditProcedure": "**From Console:** **Ensure that the prescribed log metric is present:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure that at least one metric `<Log_Metric_Name>` is present with filter text: resource.type=iam_role AND (protoPayload.methodName=google.iam.admin.v1.CreateRole OR protoPayload.methodName=google.iam.admin.v1.DeleteRole OR protoPayload.methodName=google.iam.admin.v1.UpdateRole OR protoPayload.methodName=google.iam.admin.v1.UndeleteRole) **Ensure that the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that the appropriate notifications channels have been set up. **From Google Cloud CLI** Ensure that the prescribed log metric is present: 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to: resource.type=iam_role AND (protoPayload.methodName = google.iam.admin.v1.CreateRole OR protoPayload.methodName=google.iam.admin.v1.DeleteRole OR protoPayload.methodName=google.iam.admin.v1.UpdateRole OR protoPayload.methodName=google.iam.admin.v1.UndeleteRole) 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains an least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/iam/docs/understanding-custom-roles",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.8",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.",
+ "RationaleStatement": "Monitoring for Create or Update Firewall rule events gives insight to network access changes and may reduce the time it takes to detect suspicious activity.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: resource.type=gce_firewall_rule AND (protoPayload.methodName:compute.firewalls.patch OR protoPayload.methodName:compute.firewalls.insert OR protoPayload.methodName:compute.firewalls.delete) 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query. 6. Click `Create Metric`. **Create the prescribed Alert Policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page displays. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notifications channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed Log Metric - Use the command: gcloud logging metrics create Create the prescribed alert policy: - Use the command: gcloud alpha monitoring policies create",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure that the prescribed log metric is present:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure at least one metric `<Log_Metric_Name>` is present with this filter text: resource.type=gce_firewall_rule AND (protoPayload.methodName:compute.firewalls.patch OR protoPayload.methodName:compute.firewalls.insert OR protoPayload.methodName:compute.firewalls.delete) **Ensure that the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that appropriate notification channels have been set up. **From Google Cloud CLI** **Ensure that the prescribed log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to: resource.type=gce_firewall_rule AND (protoPayload.methodName:compute.firewalls.patch OR protoPayload.methodName:compute.firewalls.insert OR protoPayload.methodName:compute.firewalls.delete) 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains an least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/vpc/docs/firewalls",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.9",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.",
+ "RationaleStatement": "Google Cloud Platform (GCP) routes define the paths network traffic takes from a VM instance to another destination. The other destination can be inside the organization VPC network (such as another VM) or outside of it. Every route consists of a destination and a next hop. Traffic whose destination IP is within the destination range is sent to the next hop for delivery. Monitoring changes to route tables will help ensure that all VPC traffic flows through an expected path.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed Log Metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter` 3. Clear any text and add: resource.type=gce_route AND (protoPayload.methodName:compute.routes.delete OR protoPayload.methodName:compute.routes.insert) 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query. 6. Click `Create Metric`. **Create the prescribed alert policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page displays. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notification channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed Log Metric: - Use the command: gcloud logging metrics create Create the prescribed the alert policy: - Use the command: gcloud alpha monitoring policies create",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure that the prescribed Log metric is present:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure that at least one metric `<Log_Metric_Name>` is present with the filter text: resource.type=gce_route AND (protoPayload.methodName:compute.routes.delete OR protoPayload.methodName:compute.routes.insert) **Ensure the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting: [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of 0 for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alert thresholds make sense for the user's organization. 5. Ensure that the appropriate notification channels have been set up. **From Google Cloud CLI** **Ensure the prescribed log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to: resource.type=gce_route AND (protoPayload.methodName:compute.routes.delete OR protoPayload.methodName:compute.routes.insert) 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains an least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/storage/docs/access-control/iam:https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create:https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.10",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.",
+ "RationaleStatement": "It is possible to have more than one VPC within a project. In addition, it is also possible to create a peer connection between two VPCs enabling network traffic to route between VPCs. Monitoring changes to a VPC will help ensure VPC traffic flow is not getting impacted.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: resource.type=gce_network AND (protoPayload.methodName:compute.networks.insert OR protoPayload.methodName:compute.networks.patch OR protoPayload.methodName:compute.networks.delete OR protoPayload.methodName:compute.networks.removePeering OR protoPayload.methodName:compute.networks.addPeering) 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query. 6. Click `Create Metric`. **Create the prescribed alert policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of 0 for the most recent value will ensure that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notification channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed Log Metric: - Use the command: gcloud logging metrics create Create the prescribed alert policy: - Use the command: gcloud alpha monitoring policies create",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure the prescribed log metric is present:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure at least one metric `<Log_Metric_Name>` is present with filter text: resource.type=gce_network AND (protoPayload.methodName:compute.networks.insert OR protoPayload.methodName:compute.networks.patch OR protoPayload.methodName:compute.networks.delete OR protoPayload.methodName:compute.networks.removePeering OR protoPayload.methodName:compute.networks.addPeering) **Ensure the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of 0 for greater than 0 seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that appropriate notification channels have been set up. **From Google Cloud CLI** **Ensure the log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with filter set to: resource.type=gce_network AND protoPayload.methodName=beta.compute.networks.insert OR protoPayload.methodName=beta.compute.networks.patch OR protoPayload.methodName=v1.compute.networks.delete OR protoPayload.methodName=v1.compute.networks.removePeering OR protoPayload.methodName=v1.compute.networks.addPeering 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains at least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/vpc/docs/overview",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.11",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.",
+ "RationaleStatement": "Monitoring changes to cloud storage bucket permissions may reduce the time needed to detect and correct permissions on sensitive cloud storage buckets and objects inside the bucket.",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed log metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: resource.type=gcs_bucket AND protoPayload.methodName=storage.setIamPermissions 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query. 6. Click `Create Metric`. **Create the prescribed Alert Policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notifications channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed Log Metric: - Use the command: gcloud beta logging metrics create Create the prescribed alert policy: - Use the command: gcloud alpha monitoring policies create",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure the prescribed log metric is present:** 1. For each project that contains cloud storage buckets, go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure at least one metric `<Log_Metric_Name>` is present with the filter text: resource.type=gcs_bucket AND protoPayload.methodName=storage.setIamPermissions **Ensure that the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of 0 for greater than 0 seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that the appropriate notifications channels have been set up. **From Google Cloud CLI** **Ensure that the prescribed log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to: resource.type=gcs_bucket AND protoPayload.methodName=storage.setIamPermissions 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains an least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/storage/docs/overview:https://cloud.google.com/storage/docs/access-control/iam-roles",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.12",
+ "Description": "Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes",
+ "Checks": [
+ "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.",
+ "RationaleStatement": "Monitoring changes to SQL instance configuration changes may reduce the time needed to detect and correct misconfigurations done on the SQL server. Below are a few of the configurable options which may the impact security posture of an SQL instance: - Enable auto backups and high availability: Misconfiguration may adversely impact business continuity, disaster recovery, and high availability - Authorize networks: Misconfiguration may increase exposure to untrusted networks",
+ "ImpactStatement": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.",
+ "RemediationProcedure": "**From Google Cloud Console** **Create the prescribed Log Metric:** 1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click CREATE METRIC. 2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`. 3. Clear any text and add: protoPayload.methodName=cloudsql.instances.update 4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user. 5. In the `Metric Editor` menu on right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query. 6. Click `Create Metric`. **Create the prescribed alert policy:** 1. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears. 3. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the user's project: Set `Aggregator` to `Count` Set `Configuration`: - Condition: above - Threshold: 0 - For: most recent value 4. Configure the desired notification channels in the section `Notifications`. 5. Name the policy and click `Save`. **From Google Cloud CLI** Create the prescribed log metric: - Use the command: gcloud logging metrics create Create the prescribed alert policy: - Use the command: gcloud alpha monitoring policies create - Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create](https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create)",
+ "AuditProcedure": "**From Google Cloud Console** **Ensure the prescribed log metric is present:** 1. For each project that contains Cloud SQL instances, go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics). 2. In the `User-defined Metrics` section, ensure that at least one metric `<Log_Metric_Name>` is present with the filter text: protoPayload.methodName=cloudsql.instances.update **Ensure that the prescribed alerting policy is present:** 3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting). 4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization. 5. Ensure that the appropriate notifications channels have been set up. **From Google Cloud CLI** **Ensure that the prescribed log metric is present:** 1. List the log metrics: gcloud logging metrics list --format json 2. Ensure that the output contains at least one metric with the filter set to protoPayload.methodName=cloudsql.instances.update 3. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/<Log Metric Name>`. **Ensure that the prescribed alerting policy is present:** 4. List the alerting policies: gcloud alpha monitoring policies list --format json 5. Ensure that the output contains at least one alert policy where: - `conditions.conditionThreshold.filter` is set to `metric.type=logging.googleapis.com/user/<Log Metric Name>` - AND `enabled` is set to `true`",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/logging/docs/logs-based-metrics/:https://cloud.google.com/monitoring/custom-metrics/:https://cloud.google.com/monitoring/alerts/:https://cloud.google.com/logging/docs/reference/tools/gcloud-logging:https://cloud.google.com/storage/docs/overview:https://cloud.google.com/sql/docs/:https://cloud.google.com/sql/docs/mysql/:https://cloud.google.com/sql/docs/postgres/",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.13",
+ "Description": "Ensure That Cloud DNS Logging Is Enabled for All VPC Networks",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.",
+ "RationaleStatement": "Security monitoring and forensics cannot depend solely on IP addresses from VPC flow logs, especially when considering the dynamic IP usage of cloud resources, HTTP virtual host routing, and other technology that can obscure the DNS name used by a client from the IP address. Monitoring of Cloud DNS logs provides visibility to DNS names requested by the clients within the VPC. These logs can be monitored for anomalous domain names, evaluated against threat intelligence, and Note: For full capture of DNS, firewall must block egress UDP/53 (DNS) and TCP/443 (DNS over HTTPS) to prevent client from using external DNS name server for resolution.",
+ "ImpactStatement": "Enabling of Cloud DNS logging might result in your project being charged for the additional logs usage.",
+ "RemediationProcedure": "**From Google Cloud CLI** **Add New DNS Policy With Logging Enabled** For each VPC network that needs a DNS policy with logging enabled: gcloud dns policies create enable-dns-logging --enable-logging --description=Enable DNS Logging --networks=VPC_NETWORK_NAME The VPC_NETWORK_NAME can be one or more networks in comma-separated list **Enable Logging for Existing DNS Policy** For each VPC network that has an existing DNS policy that needs logging enabled: gcloud dns policies update POLICY_NAME --enable-logging --networks=VPC_NETWORK_NAME The VPC_NETWORK_NAME can be one or more networks in comma-separated list",
+ "AuditProcedure": "**From Google Cloud CLI** 1. List all VPCs networks in a project: gcloud compute networks list --format=table[box,title='All VPC Networks'](name:label='VPC Network Name') 2. List all DNS policies, logging enablement, and associated VPC networks: gcloud dns policies list --flatten=networks[] --format=table[box,title='All DNS Policies By VPC Network'](name:label='Policy Name',enableLogging:label='Logging Enabled':align=center,networks.networkUrl.basename():label='VPC Network Name') Each VPC Network should be associated with a DNS policy with logging enabled.",
+ "AdditionalInformation": "Additional Info - Only queries that reach a name server are logged. Cloud DNS resolvers cache responses, queries answered from caches, or direct queries to an external DNS resolver outside the VPC are not logged.",
+ "References": "https://cloud.google.com/dns/docs/monitoring",
+ "DefaultValue": "Cloud DNS logging is disabled by default on each network.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.14",
+ "Description": "Ensure Cloud Asset Inventory Is Enabled",
+ "Checks": [
+ "iam_cloud_asset_inventory_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource. Cloud Asset Inventory Service (CAIS) API enablement is not required for operation of the service, but rather enables the mechanism for searching/exporting CAIS asset data directly.",
+ "RationaleStatement": "The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing. It is recommended GCP Cloud Asset Inventory be enabled for all GCP projects.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** Enable the Cloud Asset API: 1. Go to `API & Services/Library` by visiting [https://console.cloud.google.com/apis/library](https://console.cloud.google.com/apis/library) 2. Search for `Cloud Asset API` and select the result for _Cloud Asset API_ 3. Click the `ENABLE` button. **From Google Cloud CLI** Enable the Cloud Asset API: 1. Enable the Cloud Asset API through the services interface: gcloud services enable cloudasset.googleapis.com ",
+ "AuditProcedure": "**From Google Cloud Console** Ensure that the Cloud Asset API is enabled: 1. Go to `API & Services/Library` by visiting [https://console.cloud.google.com/apis/library](https://console.cloud.google.com/apis/library) 2. Search for `Cloud Asset API` and select the result for _Cloud Asset API_ 3. Ensure that `API Enabled` is displayed. **From Google Cloud CLI** Ensure that the Cloud Asset API is enabled: 1. Query enabled services: gcloud services list --enabled --filter=name:cloudasset.googleapis.com If the API is listed, then it is enabled. If the response is `Listed 0 items` the API is not enabled.",
+ "AdditionalInformation": "Additional info - Cloud Asset Inventory only keeps a five-week history of Google Cloud asset metadata. If a longer history is desired, automation to export the history to Cloud Storage or BigQuery should be evaluated. Users need not enable CAI API if they don't have any plans to export.",
+ "References": "https://cloud.google.com/asset-inventory/docs",
+ "DefaultValue": "The Cloud Asset Inventory API is disabled by default in each project.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.15",
+ "Description": "Ensure 'Access Transparency' is 'Enabled'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.",
+ "RationaleStatement": "Controlling access to your information is one of the foundations of information security. Given that Google Employees do have access to your organizations' projects for support reasons, you should have logging in place to view who, when, and why your information is being accessed.",
+ "ImpactStatement": "To use Access Transparency your organization will need to have at one of the following support level: Premium, Enterprise, Platinum, or Gold. There will be subscription costs associated with support, as well as increased storage costs for storing the logs. You will also not be able to turn Access Transparency off yourself, and you will need to submit a service request to Google Cloud Support.",
+ "RemediationProcedure": "**From Google Cloud Console** **Add privileges to enable Access Transparency** 1. From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the 'IAM and Admin'. Select `IAM` in the top of the column that opens. 2. Click the blue button the says `+add` at the top of the screen. 3. In the `principals` field, select a user or group by typing in their associated email address. 4. Click on the `role` field to expand it. In the filter field enter `Access Transparency Admin` and select it. 5. Click `save`. **Verify that the Google Cloud project is associated with a billing account** 1. From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Select `Billing`. 2. If you see `This project is not associated with a billing account` you will need to enter billing information or switch to a project with a billing account. **Enable Access Transparency** 1. From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM & Admin Menu. Select `settings` in the middle of the column that opens. 2. Click the blue button labeled Enable `Access Transparency for Organization`",
+ "AuditProcedure": "**From Google Cloud Console** **Determine if Access Transparency is Enabled** 1. From the Google Cloud Home, click on the Navigation hamburger menu in the top left. Hover over the IAM & Admin Menu. Select `settings` in the middle of the column that opens. 2. The status will be under the heading `Access Transparency`. Status should be `Enabled`",
+ "AdditionalInformation": "To enable Access Transparency for your Google Cloud organization, your Google Cloud organization must have one of the following customer support levels: Premium, Enterprise, Platinum, or Gold.",
+ "References": "https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/overview:https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/enable:https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/reading-logs:https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/reading-logs#justification_reason_codes:https://cloud.google.com/cloud-provider-access-management/access-transparency/docs/supported-services",
+ "DefaultValue": "By default Access Transparency is not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.16",
+ "Description": "Ensure 'Access Approval' is 'Enabled'",
+ "Checks": [
+ "iam_account_access_approval_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.",
+ "RationaleStatement": "Controlling access to your information is one of the foundations of information security. Google Employees do have access to your organizations' projects for support reasons. With Access Approval, organizations can then be certain that their information is accessed by only approved Google Personnel.",
+ "ImpactStatement": "To use Access Approval your organization will need have enabled Access Transparency and have at one of the following support level: Enhanced or Premium. There will be subscription costs associated with these support levels, as well as increased storage costs for storing the logs. You will also not be able to turn the Access Transparency which Access Approval depends on, off yourself. To do so you will need to submit a service request to Google Cloud Support. There will also be additional overhead in managing user permissions. There may also be a potential delay in support times as Google Personnel will have to wait for their access to be approved.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the `Security` Menu. Select `Access Approval` in the middle of the column that opens. 2. The status will be displayed here. On this screen, there is an option to click `Enroll`. If it is greyed out and you see an error bar at the top of the screen that says `Access Transparency is not enabled` please view the corresponding reference within this section to enable it. 3. In the second screen click `Enroll`. **Grant an IAM Group or User the role with permissions to Add Users to be Access Approval message Recipients** 1. From the Google Cloud Home, within the project you wish to enable, click on the Navigation hamburger menu in the top left. Hover over the `IAM and Admin`. Select `IAM` in the middle of the column that opens. 2. Click the blue button the says `+ ADD` at the top of the screen. 3. In the `principals` field, select a user or group by typing in their associated email address. 4. Click on the role field to expand it. In the filter field enter `Access Approval Approver` and select it. 5. Click `save`. **Add a Group or User as an Approver for Access Approval Requests** 1. As a user with the `Access Approval Approver` permission, within the project where you wish to add an email address to which request will be sent, click on the Navigation hamburger menu in the top left. Hover over the `Security` Menu. Select `Access Approval` in the middle of the column that opens. 2. Click `Manage Settings` 3. Under `Set up approval notifications`, enter the email address associated with a Google Cloud User or Group you wish to send Access Approval requests to. All future access approvals will be sent as emails to this address. **From Google Cloud CLI** 1. To update all services in an entire project, run the following command from an account that has permissions as an 'Approver for Access Approval Requests' gcloud access-approval settings update --project=<project name> --enrolled_services=all --notification_emails='<email recipient for access approval requests>@<domain name>' ",
+ "AuditProcedure": "**From Google Cloud Console** **Determine if Access Transparency is Enabled as it is a Dependency** 1. From the Google Cloud Home inside the project you wish to audit, click on the Navigation hamburger menu in the top left. Hover over the `IAM & Admin` Menu. Select `settings` in the middle of the column that opens. 2. The status should be Enabled' under the heading `Access Transparency` **Determine if Access Approval is Enabled** 1. From the Google Cloud Home, within the project you wish to check, click on the Navigation hamburger menu in the top left. Hover over the `Security` Menu. Select `Access Approval` in the middle of the column that opens. 2. The status will be displayed here. If you see a screen saying you need to enroll in Access Approval, it is not enabled. **From Google Cloud CLI** **Determine if Access Approval is Enabled** 1. From within the project you wish to audit, run the following command. gcloud access-approval settings get 2. The status will be displayed in the output. IF Access Approval is not enabled you should get this output: API [accessapproval.googleapis.com] not enabled on project [-----]. Would you like to enable and retry (this will take a few minutes)? (y/N)? After entering `Y` if you get the following output, it means that `Access Transparency` is not enabled: ERROR: (gcloud.access-approval.settings.get) FAILED_PRECONDITION: Precondition check failed. ",
+ "AdditionalInformation": "The recipients of Access Requests will also need to be logged into a Google Cloud account associated with an email address in this list. To approve requests they can click approve within the email. Or they can view requests at the the Access Approval page within the Security submenu.",
+ "References": "https://cloud.google.com/cloud-provider-access-management/access-approval/docs:https://cloud.google.com/cloud-provider-access-management/access-approval/docs/overview:https://cloud.google.com/cloud-provider-access-management/access-approval/docs/quickstart-custom-key:https://cloud.google.com/cloud-provider-access-management/access-approval/docs/supported-services:https://cloud.google.com/cloud-provider-access-management/access-approval/docs/view-historical-requests",
+ "DefaultValue": "By default Access Approval and its dependency of Access Transparency are not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "2.17",
+ "Description": "Ensure Logging is enabled for HTTP(S) Load Balancer",
+ "Checks": [
+ "compute_loadbalancer_logging_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Logging and Monitoring",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.",
+ "RationaleStatement": "Logging will allow you to view HTTPS network traffic to your web applications.",
+ "ImpactStatement": "On high use systems with a high percentage sample rate, the logging file may grow to high capacity in a short amount of time. Ensure that the sample rate is set appropriately so that storage costs are not exorbitant.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. From Google Cloud home open the Navigation Menu in the top left. 1. Under the `Networking` heading select `Network services`. 1. Select the HTTPS load-balancer you wish to audit. 1. Select `Edit` then `Backend Configuration`. 1. Select `Edit` on the corresponding backend service. 1. Click `Enable Logging`. 1. Set `Sample Rate` to a desired value. This is a percentage as a decimal point. 1.0 is 100%. **From Google Cloud CLI** 1. Run the following command gcloud compute backend-services update <serviceName> --region=REGION --enable-logging --logging-sample-rate=<percentageAsADecimal> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. From Google Cloud home open the Navigation Menu in the top left. 1. Under the `Networking` heading select `Network services`. 1. Select the HTTPS load-balancer you wish to audit. 1. Select `Edit` then `Backend Configuration`. 1. Select `Edit` on the corresponding backend service. 1. Ensure that `Enable Logging` is selected. Also ensure that `Sample Rate` is set to an appropriate level for your needs. **From Google Cloud CLI** 1. Run the following command gcloud compute backend-services describe <serviceName> 1. Ensure that enable-logging is enabled and sample rate is set to your desired level.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/load-balancing/:https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring#gcloud:-global-mode:https://cloud.google.com/sdk/gcloud/reference/compute/backend-services/",
+ "DefaultValue": "By default logging for https load balancing is disabled. When logging is enabled it sets the default sample rate as 1.0 or 100%. Ensure this value fits the need of your organization to avoid high storage costs.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.1",
+ "Description": "Ensure That the Default Network Does Not Exist in a Project",
+ "Checks": [
+ "compute_network_default_in_use"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "To prevent use of `default` network, a project should not have a `default` network.",
+ "RationaleStatement": "The `default` network has a preconfigured network configuration and automatically generates the following insecure firewall rules: - default-allow-internal: Allows ingress connections for all protocols and ports among instances in the network. - default-allow-ssh: Allows ingress connections on TCP port 22(SSH) from any source to any instance in the network. - default-allow-rdp: Allows ingress connections on TCP port 3389(RDP) from any source to any instance in the network. - default-allow-icmp: Allows ingress ICMP traffic from any source to any instance in the network. These automatically created firewall rules do not get audit logged by default. Furthermore, the default network is an auto mode network, which means that its subnets use the same predefined range of IP addresses, and as a result, it's not possible to use Cloud VPN or VPC Network Peering with the default network. Based on organization security and networking requirements, the organization should create a new network and delete the `default` network.",
+ "ImpactStatement": "When an organization deletes the default network, it will need to remove all asests from that network and migrate them to a new network.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the `VPC networks` page by visiting: [https://console.cloud.google.com/networking/networks/list](https://console.cloud.google.com/networking/networks/list). 2. Click the network named `default`. 2. On the network detail page, click `EDIT`. 3. Click `DELETE VPC NETWORK`. 4. If needed, create a new network to replace the default network. **From Google Cloud CLI** For each Google Cloud Platform project, 1. Delete the default network: gcloud compute networks delete default 2. If needed, create a new network to replace it: gcloud compute networks create NETWORK_NAME **Prevention:** The user can prevent the default network and its insecure default firewall rules from being created by setting up an Organization Policy to `Skip default network creation` at [https://console.cloud.google.com/iam-admin/orgpolicies/compute-skipDefaultNetworkCreation](https://console.cloud.google.com/iam-admin/orgpolicies/compute-skipDefaultNetworkCreation).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VPC networks` page by visiting: [https://console.cloud.google.com/networking/networks/list](https://console.cloud.google.com/networking/networks/list). 2. Ensure that a network with the name `default` is not present. **From Google Cloud CLI** 1. Set the project name in the Google Cloud Shell: gcloud config set project PROJECT_ID 2. List the networks configured in that project: gcloud compute networks list It should not list `default` as one of the available networks in that project.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/compute/docs/networking#firewall_rules:https://cloud.google.com/compute/docs/reference/latest/networks/insert:https://cloud.google.com/compute/docs/reference/latest/networks/delete:https://cloud.google.com/vpc/docs/firewall-rules-logging:https://cloud.google.com/vpc/docs/vpc#default-network:https://cloud.google.com/sdk/gcloud/reference/compute/networks/delete",
+ "DefaultValue": "By default, for each project, a `default` network is created.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.2",
+ "Description": "Ensure Legacy Networks Do Not Exist for Older Projects",
+ "Checks": [
+ "compute_network_not_legacy"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.",
+ "RationaleStatement": "Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. The network is global in scope and spans all cloud regions. Subnetworks cannot be created in a legacy network and are unable to switch from legacy to auto or custom subnet networks. Legacy networks can have an impact for high network traffic projects and are subject to a single point of contention or failure.",
+ "ImpactStatement": "None.",
+ "RemediationProcedure": "**From Google Cloud CLI** For each Google Cloud Platform project, 1. Follow the documentation and create a non-legacy network suitable for the organization's requirements. 2. Follow the documentation and delete the networks in the `legacy` mode.",
+ "AuditProcedure": "**From Google Cloud CLI** For each Google Cloud Platform project, 1. Set the project name in the Google Cloud Shell: gcloud config set project <Project-ID> 2. List the networks configured in that project: gcloud compute networks list None of the listed networks should be in the `legacy` mode.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/vpc/docs/using-legacy#creating_a_legacy_network:https://cloud.google.com/vpc/docs/using-legacy#deleting_a_legacy_network",
+ "DefaultValue": "By default, networks are not created in the `legacy` mode.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.3",
+ "Description": "Ensure That DNSSEC Is Enabled for Cloud DNS",
+ "Checks": [
+ "dns_dnssec_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.",
+ "RationaleStatement": "Domain Name System Security Extensions (DNSSEC) adds security to the DNS protocol by enabling DNS responses to be validated. Having a trustworthy DNS that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today’s web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Cloud DNS` by visiting [https://console.cloud.google.com/net-services/dns/zones](https://console.cloud.google.com/net-services/dns/zones). 2. For each zone of `Type` `Public`, set `DNSSEC` to `On`. **From Google Cloud CLI** Use the below command to enable `DNSSEC` for Cloud DNS Zone Name. gcloud dns managed-zones update ZONE_NAME --dnssec-state on ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Cloud DNS` by visiting [https://console.cloud.google.com/net-services/dns/zones](https://console.cloud.google.com/net-services/dns/zones). 2. For each zone of `Type` `Public`, ensure that `DNSSEC` is set to `On`. **From Google Cloud CLI** 1. List all the Managed Zones in a project: gcloud dns managed-zones list 2. For each zone of `VISIBILITY` `public`, get its metadata: gcloud dns managed-zones describe ZONE_NAME 3. Ensure that `dnssecConfig.state` property is `on`.",
+ "AdditionalInformation": "",
+ "References": "https://cloudplatform.googleblog.com/2017/11/DNSSEC-now-available-in-Cloud-DNS.html:https://cloud.google.com/dns/dnssec-config#enabling:https://cloud.google.com/dns/dnssec",
+ "DefaultValue": "By default DNSSEC is not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.4",
+ "Description": "Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC",
+ "Checks": [
+ "dns_rsasha1_in_use_to_key_sign_in_dnssec"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
+ "RationaleStatement": "Domain Name System Security Extensions (DNSSEC) algorithm numbers in this registry may be used in CERT RRs. Zonesigning (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong. When enabling DNSSEC for a managed zone, or creating a managed zone with DNSSEC, the user can select the DNSSEC signing algorithms and the denial-of-existence type. Changing the DNSSEC settings is only effective for a managed zone if DNSSEC is not already enabled. If there is a need to change the settings for a managed zone where it has been enabled, turn DNSSEC off and then re-enable it with different settings.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud CLI** 1. If it is necessary to change the settings for a managed zone where it has been enabled, DNSSEC must be turned off and re-enabled with different settings. To turn off DNSSEC, run the following command: gcloud dns managed-zones update ZONE_NAME --dnssec-state off 2. To update key-signing for a reported managed DNS Zone, run the following command: gcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE Supported algorithm options and key lengths are as follows. Algorithm KSK Length ZSK Length --------- ---------- ---------- RSASHA1 1024,2048 1024,2048 RSASHA256 1024,2048 1024,2048 RSASHA512 1024,2048 1024,2048 ECDSAP256SHA256 256 256 ECDSAP384SHA384 384 384",
+ "AuditProcedure": "**From Google Cloud CLI** Ensure the property algorithm for keyType keySigning is not using `RSASHA1`. gcloud dns managed-zones describe ZONENAME --format=json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs)",
+ "AdditionalInformation": "1. RSASHA1 key-signing support may be required for compatibility reasons. 2. Remediation CLI works well with gcloud-cli version 221.0.0 and later.",
+ "References": "https://cloud.google.com/dns/dnssec-advanced#advanced_signing_options",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.5",
+ "Description": "Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC",
+ "Checks": [
+ "dns_rsasha1_in_use_to_zone_sign_in_dnssec"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.",
+ "RationaleStatement": "DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong. When enabling DNSSEC for a managed zone, or creating a managed zone with DNSSEC, the DNSSEC signing algorithms and the denial-of-existence type can be selected. Changing the DNSSEC settings is only effective for a managed zone if DNSSEC is not already enabled. If the need exists to change the settings for a managed zone where it has been enabled, turn DNSSEC off and then re-enable it with different settings.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud CLI** 1. If the need exists to change the settings for a managed zone where it has been enabled, DNSSEC must be turned off and then re-enabled with different settings. To turn off DNSSEC, run following command: gcloud dns managed-zones update ZONE_NAME --dnssec-state off 2. To update zone-signing for a reported managed DNS Zone, run the following command: gcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE Supported algorithm options and key lengths are as follows. Algorithm KSK Length ZSK Length --------- ---------- ---------- RSASHA1 1024,2048 1024,2048 RSASHA256 1024,2048 1024,2048 RSASHA512 1024,2048 1024,2048 ECDSAP256SHA256 256 384 ECDSAP384SHA384 384 384",
+ "AuditProcedure": "**From Google Cloud CLI** Ensure the property algorithm for keyType zone signing is not using RSASHA1. gcloud dns managed-zones describe --format=json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs) ",
+ "AdditionalInformation": "1. RSASHA1 zone-signing support may be required for compatibility reasons. 2. The remediation CLI works well with gcloud-cli version 221.0.0 and later.",
+ "References": "https://cloud.google.com/dns/dnssec-advanced#advanced_signing_options",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.6",
+ "Description": "Ensure That SSH Access Is Restricted From the Internet",
+ "Checks": [
+ "compute_firewall_ssh_access_from_the_internet_allowed"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.",
+ "RationaleStatement": "GCP `Firewall Rules` within a `VPC Network` apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general `(0.0.0.0/0)` destination `IP Range` specified from the Internet through `SSH` with the default `Port 22`. Generic access from the Internet to a specific IP Range needs to be restricted.",
+ "ImpactStatement": "All Secure Shell (SSH) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH port for the concerned VPC(s).",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `VPC Network`. 2. Go to the `Firewall Rules`. 3. Click the `Firewall Rule` you want to modify. 4. Click `Edit`. 5. Modify `Source IP ranges` to specific `IP`. 6. Click `Save`. **From Google Cloud CLI** 1.Update the Firewall rule with the new `SOURCE_RANGE` from the below command: gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `VPC network`. 2. Go to the `Firewall Rules`. 3. Ensure that `Port` is not equal to `22` and `Action` is not set to `Allow`. 4. Ensure `IP Ranges` is not equal to `0.0.0.0/0` under `Source filters`. **From Google Cloud CLI** gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed)' Ensure that there is no rule matching the below criteria: - `SOURCE_RANGES` is `0.0.0.0/0` - AND `DIRECTION` is `INGRESS` - AND IPProtocol is `tcp` or `ALL` - AND `PORTS` is set to `22` or `range containing 22` or `Null (not set)` Note: - When ALL TCP ports are allowed in a rule, PORT does not have any value set (`NULL`) - When ALL Protocols are allowed in a rule, PORT does not have any value set (`NULL`)",
+ "AdditionalInformation": "Currently, GCP VPC only supports IPV4; however, Google is already working on adding IPV6 support for VPC. In that case along with source IP range `0.0.0.0`, the rule should be checked for IPv6 equivalent `::/0` as well.",
+ "References": "https://cloud.google.com/vpc/docs/firewalls#blockedtraffic:https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.7",
+ "Description": "Ensure That RDP Access Is Restricted From the Internet",
+ "Checks": [
+ "compute_firewall_rdp_access_from_the_internet_allowed"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.",
+ "RationaleStatement": "GCP `Firewall Rules` within a `VPC Network`. These rules apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network. Egress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication). For an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified. This route simply defines the path to the Internet, to avoid the most general `(0.0.0.0/0)` destination `IP Range` specified from the Internet through `RDP` with the default `Port 3389`. Generic access from the Internet to a specific IP Range should be restricted.",
+ "ImpactStatement": "All Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where secure shell access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to RDP port for the concerned VPC(s).",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `VPC Network`. 2. Go to the `Firewall Rules`. 3. Click the `Firewall Rule` to be modified. 4. Click `Edit`. 5. Modify `Source IP ranges` to specific `IP`. 6. Click `Save`. **From Google Cloud CLI** 1.Update RDP Firewall rule with new `SOURCE_RANGE` from the below command: gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `VPC network`. 2. Go to the `Firewall Rules`. 3. Ensure `Port` is not equal to `3389` and `Action` is not `Allow`. 4. Ensure `IP Ranges` is not equal to `0.0.0.0/0` under `Source filters`. **From Google Cloud CLI** gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed)' Ensure that there is no rule matching the below criteria: - `SOURCE_RANGES` is `0.0.0.0/0` - AND `DIRECTION` is `INGRESS` - AND IPProtocol is `TCP` or `ALL` - AND `PORTS` is set to `3389` or `range containing 3389` or `Null (not set)` Note: - When ALL TCP ports are allowed in a rule, PORT does not have any value set (`NULL`) - When ALL Protocols are allowed in a rule, PORT does not have any value set (`NULL`)",
+ "AdditionalInformation": "Currently, GCP VPC only supports IPV4; however, Google is already working on adding IPV6 support for VPC. In that case along with source IP range `0.0.0.0`, the rule should be checked for IPv6 equivalent `::/0` as well.",
+ "References": "https://cloud.google.com/vpc/docs/firewalls#blockedtraffic:https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.8",
+ "Description": "Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that VPC Service Controls are configured to create security perimeters around sensitive Google Cloud resources, preventing unauthorized data exfiltration and limiting access to resources from approved networks and identities. VPC Service Controls provide an additional layer of defense-in-depth by allowing organizations to define trust boundaries around GCP services and control data movement across those boundaries.",
+ "RationaleStatement": "VPC Service Controls provide critical protection against data exfiltration attacks by creating security perimeters that restrict data access based on client identity, device state, and network origin. Without VPC Service Controls, an attacker who compromises credentials or exploits misconfigurations can freely move data between projects, organizations, or external systems. VPC Service Controls enforce defense-in-depth by adding network-level access controls that complement IAM policies. This control is essential for organizations handling regulated data or implementing zero-trust security architectures, and it also protects against supply chain attacks by restricting which services and APIs can interact with protected resources.",
+ "ImpactStatement": "Implementing VPC Service Controls requires careful planning as it restricts network access to protected resources. Services outside the perimeter will be denied access to resources inside the perimeter by default, which may impact application connectivity, cross-project data pipelines, third-party integrations, and administrative access from non-corporate networks. Organizations should use VPC Service Controls dry-run mode to test policies before enforcement. There is no direct performance impact on services within the perimeter.",
+ "AuditProcedure": "Note: The following audit instructions use Cloud Storage (GCS) as an example. Similar steps should be followed for other supported services (BigQuery, Cloud SQL, Bigtable, etc.).\n\n**From Google Cloud CLI**\n\n1. Check if the Access Context Manager API is enabled:\n`gcloud services list --enabled --filter=\"name:accesscontextmanager.googleapis.com\" --format=\"value(name)\"`\n2. List Access Context Manager policies and perimeters in the organization:\n`gcloud access-context-manager policies list --organization=<ORG_ID>`\n`gcloud access-context-manager perimeters list --policy=<POLICY_ID>`\n3. Check if a project's resources are protected by a perimeter and verify perimeter configuration with `gcloud access-context-manager perimeters describe <PERIMETER_NAME> --policy=<POLICY_ID>`.\n4. Check whether perimeters have access levels configured for conditional access.",
+ "RemediationProcedure": "Note: The following remediation instructions use Cloud Storage (GCS) as an example. Similar steps should be followed for other supported services.\n\n**From Google Cloud CLI**\n\n1. Create an Access Context Manager policy if none exists: `gcloud access-context-manager policies create --organization=<ORG_ID> --title=\"VPC Service Controls Policy\"`.\n2. Create a service perimeter to protect resources: `gcloud access-context-manager perimeters create <PERIMETER_NAME> --resources=projects/<PROJECT_NUMBER> --restricted-services=storage.googleapis.com --policy=<POLICY_ID> --perimeter-type=regular`.\n3. Add additional projects and restricted services to the perimeter as needed.\n4. Test with dry-run mode before enforcement and monitor dry-run logs for blocked requests, then enforce the perimeter with `gcloud access-context-manager perimeters dry-run enforce`.\n5. Optionally create access levels for conditional access and add them to the perimeter.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, VPC Service Controls are not configured and no service perimeters protect Google Cloud resources."
+ }
+ ]
+ },
+ {
+ "Id": "3.9",
+ "Description": "Ensure Private Service Connect is Used for Access to Google APIs",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that VPCs use Private Service Connect endpoints for access to Google APIs such as Cloud Storage, BigQuery, Pub/Sub, Artifact Registry, and other googleapis.com services, so that traffic from workloads to these APIs stays on the Google private network instead of traversing the public internet. Private Service Connect for Google APIs creates a dedicated endpoint in your VPC with firewall rule enforcement, providing more granular control than Private Google Access.",
+ "RationaleStatement": "Accessing Google APIs over the public internet exposes traffic to network-level threats, requires managing NAT gateways or external IPs, and makes it harder to enforce egress controls. Private Service Connect for Google APIs allows workloads to reach googleapis.com services over Google's private network using a dedicated endpoint in your VPC. Combined with VPC firewall rules, PSC ensures only authorized workloads can access Google APIs, preventing unauthorized API usage and enforcing least-privilege network access. This control eliminates reliance on internet connectivity for API access, enables granular network segmentation per API consumer, supports VPC Service Controls integration, and is essential for zero-trust architectures.",
+ "ImpactStatement": "Implementing Private Service Connect for Google APIs requires creating PSC endpoints in each VPC and configuring DNS to resolve googleapis.com domains to the private endpoint IP addresses. This introduces per-endpoint charges and operational overhead for DNS management. Migrating from public API access requires updating DNS configurations and may require changes to firewall rules. Workloads without proper firewall rules or DNS configuration will be unable to reach Google APIs after migration.",
+ "AuditProcedure": "**From Google Cloud CLI**\n\n1. Identify in-scope VPCs that host production or sensitive workloads accessing Google APIs: `gcloud compute networks list --format=\"table(name)\"`.\n2. For each in-scope VPC, check for a Private Service Connect endpoint for Google APIs: `gcloud compute addresses list --filter=\"purpose=PRIVATE_SERVICE_CONNECT\"`. At least one PSC endpoint should exist per VPC that needs Google API access.\n3. Verify the PSC endpoint targets Google's service attachment by listing global forwarding rules and looking for targets containing `all-apis` or `vpc-sc`.\n4. Check Cloud DNS for a private zone for googleapis.com with a wildcard A record pointing to the PSC endpoint IP.\n5. Verify firewall rules restrict access to the PSC endpoint using specific sourceRanges/sourceTags and do not allow 0.0.0.0/0.",
+ "RemediationProcedure": "**From Google Cloud CLI**\n\n1. Reserve an internal IP for the PSC endpoint: `gcloud compute addresses create psc-apis-endpoint --global --purpose=PRIVATE_SERVICE_CONNECT --addresses=<RFC1918_IP> --network=projects/<PROJECT_ID>/global/networks/<VPC_NAME>`.\n2. Create the PSC endpoint forwarding rule targeting Google's all-apis bundle: `gcloud compute forwarding-rules create pscapis --global --network=<VPC_NAME> --address=psc-apis-endpoint --target-google-apis-bundle=all-apis`.\n3. Configure DNS by creating a private zone for googleapis.com and a wildcard A record pointing to the PSC endpoint IP.\n4. Configure VPC firewall rules to restrict PSC endpoint access to specific subnets only.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, workloads access Google APIs over public Google API endpoints rather than through Private Service Connect endpoints."
+ }
+ ]
+ },
+ {
+ "Id": "3.10",
+ "Description": "Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network",
+ "Checks": [
+ "compute_subnet_flow_logs_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.",
+ "RationaleStatement": "VPC networks and subnetworks not reserved for internal HTTP(S) load balancing provide logically isolated and secure network partitions where GCP resources can be launched. When Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows. Each VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet. If two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows. Flow Logs supports the following use cases: - Network monitoring - Understanding network usage and optimizing network traffic expenses - Network forensics - Real-time security analysis Flow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows. The Flow Logs must be configured such that all network traffic is logged, the interval of logging is granular to provide detailed information on the connections, no logs are filtered, and metadata to facilitate investigations are included. **Note**: Subnets reserved for use by internal HTTP(S) load balancers do not support VPC flow logs.",
+ "ImpactStatement": "Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference: https://cloud.google.com/vpc/",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the VPC network GCP Console visiting `https://console.cloud.google.com/networking/networks/list` 2. Click the name of a subnet, The `Subnet details` page displays. 3. Click the `EDIT` button. 4. Set `Flow Logs` to `On`. 5. Expand the `Configure Logs` section. 6. Set `Aggregation Interval` to `5 SEC`. 7. Check the box beside `Include metadata`. 8. Set `Sample rate` to `100`. 9. Click Save. **Note**: It is not possible to configure a Log filter from the console. **From Google Cloud CLI** To enable VPC Flow Logs for a network subnet, run the following command: gcloud compute networks subnets update [SUBNET_NAME] --region [REGION] --enable-flow-logs --logging-aggregation-interval=interval-5-sec --logging-flow-sampling=1 --logging-metadata=include-all ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the VPC network GCP Console visiting `https://console.cloud.google.com/networking/networks/list` 2. From the list of network subnets, make sure for each subnet: - `Flow Logs` is set to `On` - `Aggregation Interval` is set to `5 sec` - `Include metadata` checkbox is checked - `Sample rate` is set to `100%` **Note**: It is not possible to determine if a Log filter has been defined from the console. **From Google Cloud CLI** gcloud compute networks subnets list --format json | jq -r '([Subnet,Purpose,Flow_Logs,Aggregation_Interval,Flow_Sampling,Metadata,Logs_Filtered] | (., map(length*-))), (.[] | [ .name, .purpose, (if has(enableFlowLogs) and .enableFlowLogs == true then Enabled else Disabled end), (if has(logConfig) then .logConfig.aggregationInterval else N/A end), (if has(logConfig) then .logConfig.flowSampling else N/A end), (if has(logConfig) then .logConfig.metadata else N/A end), (if has(logConfig) then (.logConfig | has(filterExpr)) else N/A end) ] ) | @tsv' | column -t The output of the above command will list: - each subnet - the subnet's purpose - a `Enabled` or `Disabled` value if `Flow Logs` are enabled - the value for `Aggregation Interval` or `N/A` if disabled, the value for `Flow Sampling` or `N/A` if disabled - the value for `Metadata` or `N/A` if disabled - 'true' or 'false' if a Logging Filter is configured or 'N/A' if disabled. If the subnet's purpose is `PRIVATE` then `Flow Logs` should be `Enabled`. If `Flow Logs` is enabled then: - `Aggregation_Interval` should be `INTERVAL_5_SEC` - `Flow_Sampling` should be 1 - `Metadata` should be `INCLUDE_ALL_METADATA` - `Logs_Filtered` should be `false`.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/vpc/docs/using-flow-logs#enabling_vpc_flow_logging:https://cloud.google.com/vpc/",
+ "DefaultValue": "By default, Flow Logs is set to Off when a new VPC network subnet is created.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.11",
+ "Description": "Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA ",
+ "RationaleStatement": "Load balancers are used to efficiently distribute traffic across multiple servers. Both SSL proxy and HTTPS load balancers are external load balancers, meaning they distribute traffic from the Internet to a GCP network. GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible cipher suites. To comply with users using outdated protocols, GCP load balancers can be configured to permit insecure cipher suites. In fact, the GCP default SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites. As a result, it is easy for customers to configure a load balancer without even knowing that they are permitting outdated cipher suites.",
+ "ImpactStatement": "Creating more secure SSL policies can prevent clients using older TLS versions from establishing a connection.",
+ "RemediationProcedure": "**From Google Cloud Console** If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy. 1. Navigate to the `SSL Policies` page by visiting: [https://console.cloud.google.com/net-security/sslpolicies](https://console.cloud.google.com/net-security/sslpolicies) 2. Click on the name of the insecure policy to go to its `SSL policy details` page. 3. Click `EDIT`. 4. Set `Minimum TLS version` to `TLS 1.2`. 5. Set `Profile` to `Modern` or `Restricted`. 6. Alternatively, if teh user selects the profile `Custom`, make sure that the following features are disabled: TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA **From Google Cloud CLI** 1. For each insecure SSL policy, update it to use secure cyphers: gcloud compute ssl-policies update NAME [--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] --min-tls-version 1.2 [--custom-features FEATURES] 2. If the target proxy has a GCP default SSL policy, use the following command corresponding to the proxy type to update it. gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME --ssl-policy SSL_POLICY_NAME gcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME --ssl-policy SSL_POLICY_NAME ",
+ "AuditProcedure": "**From Google Cloud Console** 1. See all load balancers by visiting [https://console.cloud.google.com/net-services/loadbalancing/loadBalancers/list](https://console.cloud.google.com/net-services/loadbalancing/loadBalancers/list). 2. For each load balancer for `SSL (Proxy)` or `HTTPS`, click on its name to go the `Load balancer details` page. 3. Ensure that each target proxy entry in the `Frontend` table has an `SSL Policy` configured. 4. Click on each SSL policy to go to its `SSL policy details` page. 5. Ensure that the SSL policy satisfies one of the following conditions: - has a `Min TLS` set to `TLS 1.2` and `Profile` set to `Modern` profile, or - has `Profile` set to `Restricted`. Note that a Restricted profile effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version, or - has `Profile` set to `Custom` and the following features are all disabled: TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA **From Google Cloud CLI** 1. List all TargetHttpsProxies and TargetSslProxies. gcloud compute target-https-proxies list gcloud compute target-ssl-proxies list 2. For each target proxy, list its properties: gcloud compute target-https-proxies describe TARGET_HTTPS_PROXY_NAME gcloud compute target-ssl-proxies describe TARGET_SSL_PROXY_NAME 3. Ensure that the `sslPolicy` field is present and identifies the name of the SSL policy: sslPolicy: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/sslPolicies/SSL_POLICY_NAME If the `sslPolicy` field is missing from the configuration, it means that the GCP default policy is used, which is insecure. 4. Describe the SSL policy: gcloud compute ssl-policies describe SSL_POLICY_NAME 5. Ensure that the policy satisfies one of the following conditions: - has `Profile` set to `Modern` and `minTlsVersion` set to `TLS_1_2`, or - has `Profile` set to `Restricted`, or - has `Profile` set to `Custom` and `enabledFeatures` does not contain any of the following values: TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/load-balancing/docs/use-ssl-policies:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf",
+ "DefaultValue": "The GCP default SSL policy is the least secure setting: Min TLS 1.0 and Compatible profile",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "3.12",
+ "Description": "Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Networking",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.",
+ "RationaleStatement": "IAP ensure that access to VMs is controlled by authenticating incoming requests. Access to your apps and the VMs should be restricted by firewall rules that allow only the proxy IAP IP addresses contained in the 35.235.240.0/20 subnet. Otherwise, unauthenticated requests can be made to your apps. To ensure that load balancing works correctly health checks should also be allowed.",
+ "ImpactStatement": "If firewall rules are not configured correctly, legitimate business services could be negatively impacted. It is recommended to make these changes during a time of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud Console [VPC network > Firewall rules](https://console.cloud.google.com/networking/firewalls/list?_ga=2.72166934.480049361.1580860862-1336643914.1580248695). 2. Select the checkbox next to the following rules: - default-allow-http - default-allow-https - default-allow-internal 3. Click `Delete`. 4. Click `Create firewall rule` and set the following values: - Name: allow-iap-traffic - Targets: All instances in the network - Source IP ranges (press Enter after you paste each value in the box, copy each full CIDR IP address): - IAP Proxy Addresses `35.235.240.0/20` - Google Health Check `130.211.0.0/22` - Google Health Check `35.191.0.0/16` - Protocols and ports: - Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by; - tcp:80 (Default HTTP Health Check port) - tcp:443 (Default HTTPS Health Check port) **Note: if you have custom ports used by your load balancers, you will need to list them here** 5. When you're finished updating values, click `Create`.",
+ "AuditProcedure": "**From Google Cloud Console** 1. For each of your apps that have IAP enabled go to the Cloud Console VPC network > Firewall rules. 2. Verify that the only rules correspond to the following values: - Targets: All instances in the network - Source IP ranges: - IAP Proxy Addresses `35.235.240.0/20` - Google Health Check `130.211.0.0/22` - Google Health Check `35.191.0.0/16` - Protocols and ports: - Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by; - tcp:80 (Default HTTP Health Check port) - tcp:443 (Default HTTPS Health Check port) **Note: if you have custom ports used by your load balancers, you will need to list them here**",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/iap/docs/concepts-overview:https://cloud.google.com/iap/docs/load-balancer-howto:https://cloud.google.com/load-balancing/docs/health-checks:https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts",
+ "DefaultValue": "By default all traffic is allowed.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.1",
+ "Description": "Ensure That Instances Are Not Configured To Use the Default Service Account",
+ "Checks": [
+ "compute_instance_default_service_account_in_use"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.",
+ "RationaleStatement": "When a default Compute Engine service account is created, it is automatically granted the Editor role (roles/editor) on your project which allows read and write access to most Google Cloud Services. This role includes a very large number of permissions. To defend against privilege escalations if your VM is compromised and prevent an attacker from gaining access to all of your project, you should either revoke the Editor role from the default Compute Engine service account or create a new service account and assign only the permissions needed by your instance. To mitigate this at scale, we strongly recommend that you disable the automatic role grant by adding a constraint to your organization policy. The default Compute Engine service account is named `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the instance name to go to its `VM instance details` page. 3. Click `STOP` and then click `EDIT`. 4. Under the section `API and identity management`, select a service account other than the default Compute Engine service account. You may first need to create a new service account. 5. Click `Save` and then click `START`. **From Google Cloud CLI** 1. Stop the instance: gcloud compute instances stop <INSTANCE_NAME> 2. Update the instance: gcloud compute instances set-service-account <INSTANCE_NAME> --service-account=<SERVICE_ACCOUNT> 3. Restart the instance: gcloud compute instances start <INSTANCE_NAME> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on each instance name to go to its `VM instance details` page. 3. Under the section `API and identity management`, ensure that the default Compute Engine service account is not used. This account is named `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`. **From Google Cloud CLI** 1. List the instances in your project and get details on each instance: gcloud compute instances list --format=json | jq -r '. | SA: (.[].serviceAccounts[].email) Name: (.[].name)' 2. Ensure that the service account section has an email that does not match the pattern `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`. **Exception:** VMs created by GKE should be excluded. These VMs have names that start with `gke-` and are labeled `goog-gke-node`.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/compute/docs/access/service-accounts:https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances:https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-service-account",
+ "DefaultValue": "By default, Compute instances are configured to use the default Compute Engine service account.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.2",
+ "Description": "Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs",
+ "Checks": [
+ "compute_instance_default_service_account_in_use_with_full_api_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.",
+ "RationaleStatement": "Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account `Compute Engine default service account` for an instances to access necessary cloud services. `Project Editor` role is assigned to `Compute Engine default service account` hence, This service account has almost all capabilities over all cloud services except billing. However, when `Compute Engine default service account` assigned to an instance it can operate in 3 scopes. 1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges) 2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access) 3. Set access for each API: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionality expected by instance When an instance is configured with `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`, based on IAM roles assigned to the user(s) accessing Instance, it may allow user to perform cloud operations/API calls that user is not supposed to perform leading to successful privilege escalation.",
+ "ImpactStatement": "In order to change service account or scope for an instance, it needs to be stopped.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the impacted VM instance. 3. If the instance is not stopped, click the `Stop` button. Wait for the instance to be stopped. 4. Next, click the `Edit` button. 5. Scroll down to the `Service Account` section. 6. Select a different service account or ensure that `Allow full access to all Cloud APIs` is not selected. 7. Click the `Save` button to save your changes and then click `START`. **From Google Cloud CLI** 1. Stop the instance: gcloud compute instances stop <INSTANCE_NAME> 2. Update the instance: gcloud compute instances set-service-account <INSTANCE_NAME> --service-account=<SERVICE_ACCOUNT> --scopes [SCOPE1, SCOPE2...] 3. Restart the instance: gcloud compute instances start <INSTANCE_NAME> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on each instance name to go to its `VM instance details` page. 3. Under the `API and identity management`, ensure that `Cloud API access scopes` is not set to `Allow full access to all Cloud APIs`. **From Google Cloud CLI** 1. List the instances in your project and get details on each instance: gcloud compute instances list --format=json | jq -r '. | SA Scopes: (.[].serviceAccounts[].scopes) Name: (.[].name) Email: (.[].serviceAccounts[].email)' 2. Ensure that the service account section has an email that does not match the pattern `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`. **Exception:** VMs created by GKE should be excluded. These VMs have names that start with `gke-` and are labeled `goog-gke-node",
+ "AdditionalInformation": "- User IAM roles will override service account scope but configuring minimal scope ensures defense in depth - Non-default service accounts do not offer selection of access scopes like default service account. IAM roles with non-default service accounts should be used to control VM access.",
+ "References": "https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances:https://cloud.google.com/compute/docs/access/service-accounts",
+ "DefaultValue": "While creating an VM instance, default service account is used with scope `Allow default access`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.3",
+ "Description": "Ensure “Block Project-Wide SSH Keys” Is Enabled for VM Instances",
+ "Checks": [
+ "compute_instance_block_project_wide_ssh_keys_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.",
+ "RationaleStatement": "Project-wide SSH keys are stored in Compute/Project-meta-data. Project wide SSH keys can be used to login into all the instances within project. Using project-wide SSH keys eases the SSH key management but if compromised, poses the security risk which can impact all the instances within project. It is recommended to use Instance specific SSH keys which can limit the attack surface if the SSH keys are compromised.",
+ "ImpactStatement": "Users already having Project-wide ssh key pairs and using third party SSH clients will lose access to the impacted Instances. For Project users using gcloud or GCP Console based SSH option, no manual key creation and distribution is required and will be handled by GCE (Google Compute Engine) itself. To access Instance using third party SSH clients Instance specific SSH key pairs need to be created and distributed to the required users.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). It will list all the instances in your project. 2. Click on the name of the Impacted instance 3. Click `Edit` in the toolbar 4. Under SSH Keys, go to the `Block project-wide SSH keys` checkbox 5. To block users with project-wide SSH keys from connecting to this instance, select `Block project-wide SSH keys` 6. Click `Save` at the bottom of the page 7. Repeat steps for every impacted Instance **From Google Cloud CLI** To block project-wide public SSH keys, set the metadata value to `TRUE`: gcloud compute instances add-metadata <INSTANCE_NAME> --metadata block-project-ssh-keys=TRUE ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). It will list all the instances in your project. 2. For every instance, click on the name of the instance. 3. Under `SSH Keys`, ensure `Block project-wide SSH keys` is selected. **From Google Cloud CLI** 1. List the instances in your project and get details on each instance: gcloud compute instances list --format=json 2. Ensure `key: block-project-ssh-keys` is set to `value: 'true'`.",
+ "AdditionalInformation": "If OS Login is enabled, SSH keys in instance metadata are ignored, and therefore blocking project-wide SSH keys is not necessary.",
+ "References": "https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys:https://cloud.google.com/sdk/gcloud/reference/topic/formats",
+ "DefaultValue": "By Default `Block Project-wide SSH keys` is not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.4",
+ "Description": "Ensure Oslogin Is Enabled for a Project",
+ "Checks": [
+ "compute_project_os_login_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.",
+ "RationaleStatement": "Enabling osLogin ensures that SSH keys used to connect to instances are mapped with IAM users. Revoking access to IAM user will revoke all the SSH keys associated with that particular user. It facilitates centralized and automated SSH key pair management which is useful in handling cases like response to compromised SSH key pairs and/or revocation of external/third-party/Vendor users.",
+ "ImpactStatement": "Enabling OS Login on project disables metadata-based SSH key configurations on all instances from a project. Disabling OS Login restores SSH keys that you have configured in project or instance meta-data.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the VM compute metadata page by visiting: [https://console.cloud.google.com/compute/metadata](https://console.cloud.google.com/compute/metadata). 2. Click `Edit`. 3. Add a metadata entry where the key is `enable-oslogin` and the value is `TRUE`. 4. Click `Save` to apply the changes. 5. For every instance that overrides the project setting, go to the `VM Instances` page at [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 6. Click the name of the instance on which you want to remove the metadata value. 7. At the top of the instance details page, click `Edit` to edit the instance settings. 8. Under `Custom metadata`, remove any entry with key `enable-oslogin` and the value is `FALSE` 9. At the bottom of the instance details page, click `Save` to apply your changes to the instance. **From Google Cloud CLI** 1. Configure oslogin on the project: gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE 2. Remove instance metadata that overrides the project setting. gcloud compute instances remove-metadata <INSTANCE_NAME> --keys=enable-oslogin Optionally, you can enable two factor authentication for OS login. For more information, see: [https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication](https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the VM compute metadata page by visiting [https://console.cloud.google.com/compute/metadata](https://console.cloud.google.com/compute/metadata). 2. Ensure that key `enable-oslogin` is present with value set to `TRUE`. 3. Because instances can override project settings, ensure that no instance has custom metadata with key `enable-oslogin` and value `FALSE`. **From Google Cloud CLI** 1. List the instances in your project and get details on each instance: gcloud compute instances list --format=json 2. Verify that the section `commonInstanceMetadata` has a key `enable-oslogin` set to value `TRUE`. **Exception:** VMs created by GKE should be excluded. These VMs have names that start with `gke-` and are labeled `goog-gke-node`",
+ "AdditionalInformation": "1. In order to use osLogin, instance using Custom Images must have the latest version of the Linux Guest Environment installed. The following image families do not yet support OS Login: Project cos-cloud (Container-Optimized OS) image family cos-stable. All project coreos-cloud (CoreOS) image families Project suse-cloud (SLES) image family sles-11 All Windows Server and SQL Server image families 2. Project enable-oslogin can be over-ridden by setting enable-oslogin parameter to an instance metadata individually.",
+ "References": "https://cloud.google.com/compute/docs/instances/managing-instance-access:https://cloud.google.com/compute/docs/instances/managing-instance-access#enable_oslogin:https://cloud.google.com/sdk/gcloud/reference/compute/instances/remove-metadata:https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication",
+ "DefaultValue": "By default, parameter `enable-oslogin` is not set, which is equivalent to setting it to `FALSE`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.5",
+ "Description": "Ensure ‘Enable Connecting to Serial Ports’ Is Not Enabled for VM Instance",
+ "Checks": [
+ "compute_instance_serial_ports_in_use"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.",
+ "RationaleStatement": "A virtual machine instance has four virtual serial ports. Interacting with a serial port is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. The instance's operating system, BIOS, and other system-level entities often write output to the serial ports, and can accept input such as commands or answers to prompts. Typically, these system-level entities use the first serial port (port 1) and serial port 1 is often referred to as the serial console. The interactive serial console does not support IP-based access restrictions such as IP whitelists. If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. This allows anybody to connect to that instance if they know the correct SSH key, username, project ID, zone, and instance name. Therefore interactive serial console support should be disabled.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Login to Google Cloud console 2. Go to Computer Engine 3. Go to VM instances 4. Click on the Specific VM 5. Click `EDIT` 6. Unselect `Enable connecting to serial ports` below `Remote access` block. 7. Click `Save` **From Google Cloud CLI** Use the below command to disable gcloud compute instances add-metadata <INSTANCE_NAME> --zone=<ZONE> --metadata=serial-port-enable=false or gcloud compute instances add-metadata <INSTANCE_NAME> --zone=<ZONE> --metadata=serial-port-enable=0 **Prevention:** You can prevent VMs from having serial port access enable by `Disable VM serial port access` organization policy: [https://console.cloud.google.com/iam-admin/orgpolicies/compute-disableSerialPortAccess](https://console.cloud.google.com/iam-admin/orgpolicies/compute-disableSerialPortAccess).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Login to Google Cloud console 2. Go to Compute Engine 3. Go to VM instances 4. Click on the Specific VM 5. Ensure the statement `Connecting to serial serial ports is disabled` is displayed at the top of the details tab, just below the `Connect to serial console` drop-down.. **From Google Cloud CLI** Ensure the below command's output shows `null`: gcloud compute instances describe <vmName> --zone=<region> --format=json(metadata.items[].key,metadata.items[].value) or `key` and `value` properties from below command's json response are equal to `serial-port-enable` and `0` or `false` respectively. { metadata: { items: [ { key: serial-port-enable, value: 0 } ] } } ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/compute/docs/instances/interacting-with-serial-console",
+ "DefaultValue": "By default, connecting to serial ports is not enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.6",
+ "Description": "Ensure That IP Forwarding Is Not Enabled on Instances",
+ "Checks": [
+ "compute_instance_ip_forwarding_is_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. Forwarding of data packets should be disabled to prevent data loss or information disclosure.",
+ "RationaleStatement": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To enable this source and destination IP check, disable the `canIpForward` field, which allows an instance to send and receive packets with non-matching destination or source IPs.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "You only edit the `canIpForward` setting at instance creation or using CLI. **From Google Cloud CLI** 1. Use the instances export command to export the existing instance properties: gcloud compute instances export <INSTANCE_NAME> --project <PROJECT_ID> --zone <ZONE> --destination=<FILE_PATH> **Note**Replace the following: INSTANCE_NAME the name for the instance that you want to export. PROJECT_ID: the project ID for this request. ZONE: the zone for this instance. FILE_PATH: the output path where you want to save the instance configuration file on your local workstation. 2. Use a text editor to modify this file Replace `canIpForward: true` with `canIpForward: false` 3. Run this command to import the file you just modified gcloud compute instances update-from-file INSTANCE_NAME --project PROJECT_ID --zone ZONE --source=FILE_PATH --most-disruptive-allowed-action=REFRESH If the update request is valid and the required resources are available, the instance update process begins. You can monitor the status of this operation by viewing the audit logs. This update requires only a REFRESH not a full restart.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM Instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. For every instance, click on its name to go to the `VM instance details` page. 3. Under the `Network interfaces` section, ensure that `IP forwarding` is set to `Off` for every network interface. **From Google Cloud CLI** 1. List all instances: gcloud compute instances list --format='table(name,canIpForward)' 2. Ensure that `CAN_IP_FORWARD` column in the output of above command does not contain `True` for any VM instance. **Exception:** Instances created by GKE should be excluded because they need to have IP forwarding enabled and cannot be changed. Instances created by GKE have names that start with gke-.",
+ "AdditionalInformation": "You can only set the `canIpForward` field at instance creation time or using CLI.",
+ "References": "https://cloud.google.com/vpc/docs/using-routes#canipforward:https://cloud.google.com/compute/docs/instances/update-instance-properties",
+ "DefaultValue": "By default, instances are not configured to allow IP forwarding.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.7",
+ "Description": "Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)",
+ "Checks": [
+ "compute_instance_encryption_with_csek_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.",
+ "RationaleStatement": "By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys. If you provide your own encryption keys, Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data. Only users who can provide the correct key can use resources protected by a customer-supplied encryption key. Google does not store your keys on its servers and cannot access your protected data unless you provide the key. This also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key. At least business critical VMs should have VM disks encrypted with CSEK.",
+ "ImpactStatement": "If you lose your encryption key, you will not be able to recover the data.",
+ "RemediationProcedure": "Currently there is no way to update the encryption of an existing disk. Therefore you should create a new disk with `Encryption` set to `Customer supplied`. **From Google Cloud Console** 1. Go to Compute Engine `Disks` by visiting: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks). 2. Click `CREATE DISK`. 3. Set `Encryption type` to `Customer supplied`, 4. Provide the `Key` in the box. 5. Select `Wrapped key`. 6. Click `Create`. **From Google Cloud CLI** In the gcloud compute tool, encrypt a disk using the --csek-key-file flag during instance creation. If you are using an RSA-wrapped key, use the gcloud beta component: gcloud compute instances create <INSTANCE_NAME> --csek-key-file <example-file.json> To encrypt a standalone persistent disk: gcloud compute disks create <DISK_NAME> --csek-key-file <example-file.json> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to Compute Engine `Disks` by visiting: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks). 2. Click on the disk for your critical VMs to see its configuration details. 4. Ensure that `Encryption type` is set to `Customer supplied`. **From Google Cloud CLI** Ensure `diskEncryptionKey` property in the below command's response is not null, and contains key `sha256` with corresponding value gcloud compute disks describe <DISK_NAME> --zone <ZONE> --format=json(diskEncryptionKey,name) ",
+ "AdditionalInformation": "`Note 1:` When you delete a persistent disk, Google discards the cipher keys, rendering the data irretrievable. This process is irreversible. `Note 2:` It is up to you to generate and manage your key. You must provide a key that is a 256-bit string encoded in RFC 4648 standard base64 to Compute Engine. `Note 3:` An example key file looks like this. [ { uri: https://www.googleapis.com/compute/v1/projects/myproject/zones/us-central1-a/disks/example-disk, key: acXTX3rxrKAFTF0tYVLvydU1riRZTvUNC4g5I11NY-c=, key-type: raw }, { uri: https://www.googleapis.com/compute/v1/projects/myproject/global/snapshots/my-private-snapshot, key: ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFHz0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoDD6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oeQ5lAbtt7bYAAHf5l+gJWw3sUfs0/Glw5fpdjT8Uggrr+RMZezGrltJEF293rvTIjWOEB3z5OHyHwQkvdrPDFcTqsLfh+8Hr8g+mf+7zVPEC8nEbqpdl3GPv3A7AwpFp7MA== key-type: rsa-encrypted } ]",
+ "References": "https://cloud.google.com/compute/docs/disks/customer-supplied-encryption#encrypt_a_new_persistent_disk_with_your_own_keys:https://cloud.google.com/compute/docs/reference/rest/v1/disks/get:https://cloud.google.com/compute/docs/disks/customer-supplied-encryption#key_file",
+ "DefaultValue": "By default, VM disks are encrypted with Google-managed keys. They are not encrypted with Customer-Supplied Encryption Keys.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.8",
+ "Description": "Ensure Compute Instances Are Launched With Shielded VM Enabled",
+ "Checks": [
+ "compute_instance_shielded_vm_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.",
+ "RationaleStatement": "Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits. Shielded VM offers verifiable integrity of your Compute Engine VM instances, so you can be confident your instances haven't been compromised by boot- or kernel-level malware or rootkits. Shielded VM's verifiable integrity is achieved through the use of Secure Boot, virtual trusted platform module (vTPM)-enabled Measured Boot, and integrity monitoring. Shielded VM instances run firmware which is signed and verified using Google's Certificate Authority, ensuring that the instance's firmware is unmodified and establishing the root of trust for Secure Boot. Integrity monitoring helps you understand and make decisions about the state of your VM instances and the Shielded VM vTPM enables Measured Boot by performing the measurements needed to create a known good boot baseline, called the integrity policy baseline. The integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "To be able turn on `Shielded VM` on an instance, your instance must use an image with Shielded VM support. **From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the instance name to see its `VM instance details` page. 3. Click `STOP` to stop the instance. 4. When the instance has stopped, click `EDIT`. 5. In the Shielded VM section, select `Turn on vTPM` and `Turn on Integrity Monitoring`. 6. Optionally, if you do not use any custom or unsigned drivers on the instance, also select `Turn on Secure Boot`. 7. Click the `Save` button to modify the instance and then click `START` to restart it. **From Google Cloud CLI** You can only enable Shielded VM options on instances that have Shielded VM support. For a list of Shielded VM public images, run the gcloud compute images list command with the following flags: gcloud compute images list --project gce-uefi-images --no-standard-images 1. Stop the instance: gcloud compute instances stop <INSTANCE_NAME> 2. Update the instance: gcloud compute instances update <INSTANCE_NAME> --shielded-vtpm --shielded-vm-integrity-monitoring 3. Optionally, if you do not use any custom or unsigned drivers on the instance, also turn on secure boot. gcloud compute instances update <INSTANCE_NAME> --shielded-vm-secure-boot 4. Restart the instance: gcloud compute instances start <INSTANCE_NAME> **Prevention:** You can ensure that all new VMs will be created with Shielded VM enabled by setting up an Organization Policy to for `Shielded VM` at [https://console.cloud.google.com/iam-admin/orgpolicies/compute-requireShieldedVm](https://console.cloud.google.com/iam-admin/orgpolicies/compute-requireShieldedVm). Learn more at: [https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint](https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the instance name to see its `VM instance details` page. 3. Under the section `Shielded VM`, ensure that `vTPM` and `Integrity Monitoring` are `on`. **From Google Cloud CLI** 1. For each instance in your project, get its metadata: gcloud compute instances list --format=json | jq -r '. | vTPM: (.[].shieldedInstanceConfig.enableVtpm) IntegrityMonitoring: (.[].shieldedInstanceConfig.enableIntegrityMonitoring) Name: (.[].name)' 2. Ensure that there is a `shieldedInstanceConfig` configuration and that configuration has the `enableIntegrityMonitoring` and `enableVtpm` set to `true`. If the VM is not a Shield VM image, you will not see a shieldedInstanceConfig` in the output.",
+ "AdditionalInformation": "If you do use custom or unsigned drivers on the instance, enabling Secure Boot will cause the machine to no longer boot. Turn on Secure Boot only on instances that have been verified to not have any custom drivers installed.",
+ "References": "https://cloud.google.com/compute/docs/instances/modifying-shielded-vm:https://cloud.google.com/shielded-vm:https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint",
+ "DefaultValue": "By default, Compute Instances do not have Shielded VM enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.9",
+ "Description": "Ensure That Compute Instances Do Not Have Public IP Addresses",
+ "Checks": [
+ "compute_instance_public_ip"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Compute instances should not be configured to have external IP addresses.",
+ "RationaleStatement": "To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.",
+ "ImpactStatement": "Removing the external IP address from your Compute instance may cause some applications to stop working.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the instance name to go the the `Instance detail page`. 3. Click `Edit`. 4. For each Network interface, ensure that `External IP` is set to `None`. 5. Click `Done` and then click `Save`. **From Google Cloud CLI** 1. Describe the instance properties: gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE> 2. Identify the access config name that contains the external IP address. This access config appears in the following format: networkInterfaces: - accessConfigs: - kind: compute#accessConfig name: External NAT natIP: 130.211.181.55 type: ONE_TO_ONE_NAT 3. Delete the access config. gcloud compute instances delete-access-config <INSTANCE_NAME> --zone=<ZONE> --access-config-name <ACCESS_CONFIG_NAME> In the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different. **Prevention:** You can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: [https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess](https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess)",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. For every VM, ensure that there is no `External IP` configured. **From Google Cloud CLI** gcloud compute instances list --format=json 1. The output should not contain an `accessConfigs` section under `networkInterfaces`. Note that the `natIP` value is present only for instances that are running or for instances that are stopped but have a static IP address. For instances that are stopped and are configured to have an ephemeral public IP address, the `natIP` field will not be present. Example output: networkInterfaces: - accessConfigs: - kind: compute#accessConfig name: External NAT networkTier: STANDARD type: ONE_TO_ONE_NAT **Exception:** Instances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with gke- and are labeled goog-gke-node.",
+ "AdditionalInformation": "You can connect to Linux VMs that do not have public IP addresses by using Identity-Aware Proxy for TCP forwarding. Learn more at [https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances](https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances) For Windows VMs, see [https://cloud.google.com/compute/docs/instances/connecting-to-instance](https://cloud.google.com/compute/docs/instances/connecting-to-instance).",
+ "References": "https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses:https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances:https://cloud.google.com/compute/docs/instances/connecting-to-instance:https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints",
+ "DefaultValue": "By default, Compute instances have a public IP address.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.10",
+ "Description": "Ensure That App Engine Applications Enforce HTTPS Connections",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "In order to maintain the highest level of security all connections to an application should be secure by default.",
+ "RationaleStatement": "Insecure HTTP connections maybe subject to eavesdropping which can expose sensitive data.",
+ "ImpactStatement": "All connections to appengine will automatically be redirected to the HTTPS endpoint ensuring that all connections are secured by TLS.",
+ "RemediationProcedure": "Add a line to the app.yaml file controlling the application which enforces secure connections. For example handlers: - url: /.* **secure: always** redirect_http_response_code: 301 script: auto [https://cloud.google.com/appengine/docs/standard/python3/config/appref]",
+ "AuditProcedure": "Verify that the app.yaml file controlling the application contains a line which enforces secure connections. For example handlers: - url: /.* secure: always redirect_http_response_code: 301 script: auto [https://cloud.google.com/appengine/docs/standard/python3/config/appref](https://cloud.google.com/appengine/docs/standard/python3/config/appref)",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/appengine/docs/standard/python3/config/appref:https://cloud.google.com/appengine/docs/flexible/nodejs/configuring-your-app-with-app-yaml",
+ "DefaultValue": "By default both HTTP and HTTP are supported",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.11",
+ "Description": "Ensure That Compute Instances Have Confidential Computing Enabled",
+ "Checks": [
+ "compute_instance_confidential_computing_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology that encrypts data in-use while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage hardware-based memory encryption technologies, such as AMD Secure Encrypted Virtualization (SEV), AMD SEV-SNP, and Intel Trust Domain Extensions (TDX), depending on the chosen machine type and CPU platform. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated by and reside solely in dedicated hardware and are not exportable, enhancing isolation and security. Built-in hardware optimizations ensure Confidential Computing workloads experience minimal to no significant performance penalties.",
+ "RationaleStatement": "Confidential Computing enables customers' sensitive code and other data encrypted in memory during processing. Google does not have access to the encryption keys. Confidential VM can help alleviate concerns about risk related to either dependency on Google infrastructure or Google insiders' access to customer data in the clear.",
+ "ImpactStatement": "- Confidential Computing for Compute instances does not support live migration. Unlike regular Compute instances, Confidential VMs experience disruptions during maintenance events like a software or hardware update. - Additional charges may be incurred when enabling this security feature. See [https://cloud.google.com/compute/confidential-vm/pricing](https://cloud.google.com/compute/confidential-vm/pricing) for more info.",
+ "RemediationProcedure": "Confidential Computing can only be enabled when an instance is created. You must delete the current instance and create a new one. **From Google Cloud Console** 1. Go to the VM instances page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click `CREATE INSTANCE`. 3. Fill out the desired configuration for your instance. 4. Under the `Confidential VM service` section, check the option `Enable the Confidential Computing service on this VM instance`. 5. Click `Create`. **From Google Cloud CLI** Create a new instance with Confidential Compute enabled. gcloud compute instances create <INSTANCE_NAME> --zone <ZONE> --confidential-compute --maintenance-policy=TERMINATE ",
+ "AuditProcedure": "Note: Confidential Computing is currently only supported on limited VM configurations. To learn more about VM configurations supported by Confidential Computing, visit [https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations](https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations) **From Google Cloud Console** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on the instance name to see its VM instance details page. 3. Ensure that `Confidential VM service` is `Enabled`. **From Google Cloud CLI** 1. List the instances in your project and get details on each instance: gcloud compute instances list --format=json 2. Ensure that `enableConfidentialCompute` is set to `true` for all instances with machine type starting with n2d-. confidentialInstanceConfig: enableConfidentialCompute: true ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/compute/confidential-vm/docs/creating-cvm-instance:https://cloud.google.com/compute/confidential-vm/docs/about-cvm:https://cloud.google.com/confidential-computing:https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-confidential-computing-with-confidential-vms",
+ "DefaultValue": "By default, Confidential Computing is disabled for Compute instances.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "4.12",
+ "Description": "Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Virtual Machines",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed. This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.",
+ "RationaleStatement": "Keeping virtual machine operating systems up to date is a security best practice. Using this service will simplify this process.",
+ "ImpactStatement": "Most Operating Systems require a restart or changing critical resources to apply the updates. Using the Google Cloud VM manager for its OS Patch management will incur additional costs for each VM managed by it. Please view the VM manager pricing reference for further information.",
+ "RemediationProcedure": "**From Google Cloud Console** **Enabling OS Patch Management on a Project by Project Basis** **Install OS Config API for the Project** 1. Navigate into a project. In the expanded portal menu located at the top left of the screen hover over APIs & Services. Then in the menu right of that select API Libraries 2. Search for VM Manager (OS Config API) or scroll down in the left hand column and select the filter labeled Compute where it is the last listed. Open this API. 3. Click the blue 'Enable' button. **Add MetaData Tags for OSConfig Parsing** 1. From the main Google Cloud console, open the portal menu in the top left. Mouse over Computer Engine to expand the menu next to it. 2. Under the Settings heading, select Metadata. 3. In this view there will be a list of the project wide metadata tags for VMs. Click edit and 'add item' in the key column type 'enable-osconfig' and in the value column set it to 'true'. From Command Line 1. For project wide tagging, run the following command gcloud compute project-info add-metadata --project <PROJECT_ID> --metadata=enable-osconfig=TRUE Please see the reference /compute/docs/troubleshooting/vm-manager/verify-setup#metadata-enabled at the bottom for more options like instance specific tagging. Note: Adding a new tag via commandline may overwrite existing tags. You will need to do this at a time of low usage for the least impact. **Install and Start the Local OSConfig for Data Parsing** There is no way to centrally manage or start the Local OSConfig agent. Please view the reference of manage-os#agent-install to view specific operating system commands. **Setup a project wide Service Account** Please view Recommendation 4.1 to view how to setup a service account. Rerun the audit procedure to test if it has taken effect. **Enable NAT or Configure Private Google Access to allow Access to Public Update Hosting** For the sake of brevity, please see the attached resources to enable NAT or Private Google Access. Rerun the audit procedure to test if it has taken effect. From Command Line: **Install OS Config API for the Project** 1. In each project you wish to audit run gcloud services enable osconfig.googleapis.com **Install and Start the Local OSConfig for Data Parsing** Please view the reference of manage-os#agent-install to view specific operating system commands. **Setup a project wide Service Account** Please view Recommendation 4.1 to view how to setup a service account. Rerun the audit procedure to test if it has taken effect. **Enable NAT or Configure Private Google Access to allow Access to Public Update Hosting** For the sake of brevity, please see the attached resources to enable NAT or Private Google Access. Rerun the audit procedure to test if it has taken effect. Determine if Instances can connect to public update hosting Linux Debian Based Operating Systems sudo apt update The output should have a numbered list of lines with Hit: URL of updates. Redhat Based Operating Systems yum check-update The output should show a list of packages that have updates available. Windows ping http://windowsupdate.microsoft.com/ The ping should successfully be delivered and received.",
+ "AuditProcedure": "**From Google Cloud Console** **Determine if OS Config API is Enabled for the Project** 1. Navigate into a project. In the expanded navigation menu located at the top left of the screen hover over `APIs & Services`. Then in the menu right of that select `API Libraries` 2. Search for VM Manager (OS Config API) or scroll down in the left hand column and select the filter labeled Compute where it is the last listed. Open this API. 3. Verify the blue button at the top is enabled. **Determine if VM Instances have correct metadata tags for OSConfig parsing** 1. From the main Google Cloud console, open the hamburger menu in the top left. Mouse over Computer Engine to expand the menu next to it. 1. Under the Settings heading, select Metadata. 1. In this view there will be a list of the project wide metadata tags for VMs. Determine if the tag enable-osconfig is set to true. **Determine if the Operating System of VM Instances have the local OS-Config Agent running** There is no way to determine this from the Google Cloud console. The only way is to run operating specific commands locally inside the operating system via remote connection. For the sake of brevity of this recommendation please view the docs/troubleshooting/vm-manager/verify-setup reference at the bottom of the page. If you initialized your VM instance with a Google Supplied OS Image with a build date of later than v20200114 it will have the service installed. You should still determine its status for proper operation. **Verify the service account you have setup for the project in Recommendation 4.1 is running** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on each instance name to go to its `VM instance details` page. 3. Under the section `Service Account`, take note of the service account 4. Run the commands locally for your operating system that are located at the docs/troubleshooting/vm-manager/verify-setup#service-account-enabled reference located at the bottom of this page. They should return the name of your service account. **Determine if Instances can connect to public update hosting** Each type of operating system has its own update process. You will need to determine on each operating system that it can reach the update servers via its network connection. The VM Manager doesn't host the updates, it will only allow you to centrally issue a command to each VM to update. **Determine if OS Config API is Enabled for the Project** 1. In each project you wish to enable run the following command gcloud services list 2. If osconfig.googleapis.com is in the left hand column it is enabled for this project. **Determine if VM Manager is Enabled for the Project** 1. Within the project run the following command: gcloud compute instances os-inventory describe VM-NAME --zone=ZONE The output will look like INSTANCE_ID INSTANCE_NAME OS OSCONFIG_AGENT_VERSION UPDATE_TIME 29255009728795105 centos7 CentOS Linux 7 (Core) 20210217.00-g1.el7 2021-04-12T22:19:36.559Z 5138980234596718741 rhel-8 Red Hat Enterprise Linux 8.3 (Ootpa) 20210316.00-g1.el8 2021-09-16T17:19:24Z 7127836223366142250 windows Microsoft Windows Server 2019 Datacenter 20210316.00.0+win@1 2021-09-16T17:13:18Z **Determine if VM Instances have correct metadata tags for OSConfig parsing** 1. Select the project you want to view tagging in. **From Google Cloud Console** 1. From the main Google Cloud console, open the hamburger menu in the top left. Mouse over Computer Engine to expand the menu next to it. 2. Under the Settings heading, select Metadata. 3. In this view there will be a list of the project wide metadata tags for Vms. Verify a tag of ‘enable-osconfig’ is in this list and it is set to ‘true’. **From Command Line** Run the following command to view instance data gcloud compute instances list --format=table(name,status,tags.list()) On each instance it should have a tag of ‘enable-osconfig’ set to ‘true’ **Determine if the Operating System of VM Instances have the local OS-Config Agent running** There is no way to determine this from the Google Cloud CLI. The best way is to run the the commands inside the operating system located at 'Check OS-Config agent is installed and running' at the /docs/troubleshooting/vm-manager/verify-setup reference at the bottom of the page. If you initialized your VM instance with a Google Supplied OS Image with a build date of later than v20200114 it will have the service installed. You should still determine its status. **Verify the service account you have setup for the project in Recommendation 4.1 is running** 1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). 2. Click on each instance name to go to its `VM instance details` page. 3. Under the section `Service Account`, take note of the service account 4. View the compute/docs/troubleshooting/vm-manager/verify-setup#service-account-enabled resource at the bottom of the page for operating system specific commands to run locally. **Determine if Instances can connect to public update hosting** Linux Debian Based Operating Systems sudo apt update The output should have a numbered list of lines with Hit: URL of updates. Redhat Based Operating Systems yum check-update The output should show a list of packages that have updates available. Windows ping http://windowsupdate.microsoft.com/ The ping should successfully be delivered and received.",
+ "AdditionalInformation": "This is not your only solution to handle updates. This is a Google Cloud specific recommendation to leverage a resource to solve the need for comprehensive update procedures and policy. If you have a solution already in place you do not need to make the switch. There are also further resources that would be out of the scope of this recommendation. If you need to allow your VMs to access public hosted updates, please see the reference to setup NAT or Private Google Access.",
+ "References": "https://cloud.google.com/compute/docs/manage-os:https://cloud.google.com/compute/docs/os-patch-management:https://cloud.google.com/compute/docs/vm-manager:https://cloud.google.com/compute/docs/images/os-details#vm-manager:https://cloud.google.com/compute/docs/vm-manager#pricing:https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup:https://cloud.google.com/compute/docs/instances/view-os-details#view-data-tools:https://cloud.google.com/compute/docs/os-patch-management/create-patch-job:https://cloud.google.com/nat/docs/set-up-network-address-translation:https://cloud.google.com/vpc/docs/configure-private-google-access:https://workbench.cisecurity.org/sections/811638/recommendations/1334335:https://cloud.google.com/compute/docs/manage-os#agent-install:https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup#service-account-enabled:https://cloud.google.com/compute/docs/os-patch-management#use-dashboard:https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup#metadata-enabled",
+ "DefaultValue": "By default most operating systems and programs do not update themselves. The Google Cloud VM Manager which is a dependency of the OS Patch management feature is installed on Google Built OS images with a build date of v20200114 or later. The VM manager is not enabled in a project by default and will need to be setup.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "5.1",
+ "Description": "Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible",
+ "Checks": [
+ "cloudstorage_bucket_public_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Storage",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.",
+ "RationaleStatement": "Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.",
+ "ImpactStatement": "No storage buckets would be publicly accessible. You would have to explicitly administer bucket access.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `Storage browser` by visiting [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser). 2. Click on the bucket name to go to its `Bucket details` page. 3. Click on the `Permissions` tab. 4. Click `Delete` button in front of `allUsers` and `allAuthenticatedUsers` to remove that particular role assignment. **From Google Cloud CLI** Remove `allUsers` and `allAuthenticatedUsers` access. gsutil iam ch -d allUsers gs://BUCKET_NAME gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME **Prevention:** You can prevent Storage buckets from becoming publicly accessible by setting up the `Domain restricted sharing` organization policy at:[ https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains ](https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Storage browser` by visiting [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser). 2. Click on each bucket name to go to its `Bucket details` page. 3. Click on the `Permissions` tab. 4. Ensure that `allUsers` and `allAuthenticatedUsers` are not in the `Members` list. **From Google Cloud CLI** 1. List all buckets in a project gsutil ls 2. Check the IAM Policy for each bucket: gsutil iam get gs://BUCKET_NAME No role should contain `allUsers` and/or `allAuthenticatedUsers` as a member. **Using Rest API** 1. List all buckets in a project Get https://www.googleapis.com/storage/v1/b?project=<ProjectName> 2. Check the IAM Policy for each bucket GET https://www.googleapis.com/storage/v1/b/<bucketName>/iam No role should contain `allUsers` and/or `allAuthenticatedUsers` as a member.",
+ "AdditionalInformation": "To implement Access restrictions on buckets, configuring Bucket IAM is preferred way than configuring Bucket ACL. On GCP console, Edit Permissions for bucket exposes IAM configurations only. Bucket ACLs are configured automatically as per need in order to implement/support User enforced Bucket IAM policy. In-case administrator changes bucket ACL using command-line(gsutils)/API bucket IAM also gets updated automatically.",
+ "References": "https://cloud.google.com/storage/docs/access-control/iam-reference:https://cloud.google.com/storage/docs/access-control/making-data-public:https://cloud.google.com/storage/docs/gsutil/commands/iam",
+ "DefaultValue": "By Default, Storage buckets are not publicly shared.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "5.2",
+ "Description": "Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled",
+ "Checks": [
+ "cloudstorage_bucket_uniform_bucket_level_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Storage",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.",
+ "RationaleStatement": "It is recommended to use uniform bucket-level access to unify and simplify how you grant access to your Cloud Storage resources. Cloud Storage offers two systems for granting users permission to access your buckets and objects: Cloud Identity and Access Management (Cloud IAM) and Access Control Lists (ACLs). These systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission. Cloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels. ACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis. In order to support a uniform permissioning system, Cloud Storage has uniform bucket-level access. Using this feature disables ACLs for all Cloud Storage resources: access to Cloud Storage resources then is granted exclusively through Cloud IAM. Enabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible either.",
+ "ImpactStatement": "If you enable uniform bucket-level access, you revoke access from users who gain their access solely through object ACLs. Certain Google Cloud services, such as Stackdriver, Cloud Audit Logs, and Datastore, cannot export to Cloud Storage buckets that have uniform bucket-level access enabled.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Open the Cloud Storage browser in the Google Cloud Console by visiting: [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser) 2. In the list of buckets, click on the name of the desired bucket. 3. Select the `Permissions` tab near the top of the page. 4. In the text box that starts with `This bucket uses fine-grained access control...`, click `Edit`. 5. In the pop-up menu that appears, select `Uniform`. 6. Click `Save`. **From Google Cloud CLI** Use the on option in a uniformbucketlevelaccess set command: gsutil uniformbucketlevelaccess set on gs://BUCKET_NAME/ **Prevention** You can set up an Organization Policy to enforce that any new bucket has uniform bucket level access enabled. Learn more at: [https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket](https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket)",
+ "AuditProcedure": "**From Google Cloud Console** 1. Open the Cloud Storage browser in the Google Cloud Console by visiting: [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser) 2. For each bucket, make sure that `Access control` column has the value `Uniform`. **From Google Cloud CLI** 1. List all buckets in a project gsutil ls 2. For each bucket, verify that uniform bucket-level access is enabled. gsutil uniformbucketlevelaccess get gs://BUCKET_NAME/ If uniform bucket-level access is enabled, the response looks like: Uniform bucket-level access setting for gs://BUCKET_NAME/: Enabled: True LockedTime: LOCK_DATE ",
+ "AdditionalInformation": "Uniform bucket-level access can no longer be disabled if it has been active on a bucket for 90 consecutive days.",
+ "References": "https://cloud.google.com/storage/docs/uniform-bucket-level-access:https://cloud.google.com/storage/docs/using-uniform-bucket-level-access:https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket",
+ "DefaultValue": "By default, Cloud Storage buckets do not have uniform bucket-level access enabled.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1",
+ "Description": "Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.1 MySQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances. This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
+ "RationaleStatement": "At the time of MySQL Instance creation, not providing an administrative password allows anyone to connect to the SQL database instance with administrative privileges. The root password should be set to ensure only authorized users have these privileges.",
+ "ImpactStatement": "Connection strings for administrative clients need to be reconfigured to use a password.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console using `https://console.cloud.google.com/sql/` 2. Select the instance to open its Overview page. 3. Select `Access Control > Users`. 4. Click the `More actions icon` for the user to be updated. 5. Select `Change password`, specify a `New password`, and click `OK`. **From Google Cloud CLI** 1. Set a password to a MySql instance: gcloud sql users set-password root --host=<host> --instance=<instance_name> --prompt-for-password 2. A prompt will appear, requiring the user to enter a password: Instance Password: 3. With a successful password configured, the following message should be seen: Updating Cloud SQL user...done. ",
+ "AuditProcedure": "**From Google Cloud CLI** 1. List All SQL database instances of type MySQL: gcloud sql instances list --filter='DATABASE_VERSION:MYSQL*' --project <project_id> --format=(NAME,PRIMARY_ADDRESS) 2. For every MySQL instance try to connect using the `PRIMARY_ADDRESS`, if available: mysql -u root -h <mysql_instance_ip_address> The command should return either an error message or a password prompt. Sample Error message: ERROR 1045 (28000): Access denied for user 'root'@'<Instance_IP>' (using password: NO) If a command produces the `mysql>` prompt, the MySQL instance allows anyone to connect with administrative privileges without needing a password. **Note:** The `No Password` setting is exposed only at the time of MySQL instance creation. Once the instance is created, the Google Cloud Platform Console does not expose the set to confirm whether a password for an administrative user is set to a MySQL instance.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/sql/docs/mysql/create-manage-users:https://cloud.google.com/sql/docs/mysql/create-instance",
+ "DefaultValue": "From the Google Cloud Platform Console, the `Create Instance` workflow enforces the rule to enter the root password unless the option `No Password` is selected explicitly."
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2",
+ "Description": "Ensure ‘Skip_show_database’ Database Flag for Cloud SQL MySQL Instance Is Set to ‘On’",
+ "Checks": [
+ "cloudsql_instance_mysql_skip_show_database_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.1 MySQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
+ "RationaleStatement": "`skip_show_database` database flag prevents people from using the SHOW DATABASES statement if they do not have the SHOW DATABASES privilege. This can improve security if you have concerns about users being able to see databases belonging to other users. Its effect depends on the SHOW DATABASES privilege: If the variable value is ON, the SHOW DATABASES statement is permitted only to users who have the SHOW DATABASES privilege, and the statement displays all database names. If the value is OFF, SHOW DATABASES is permitted to all users, but displays the names of only those databases for which the user has the SHOW DATABASES or other privilege. This recommendation is applicable to Mysql database instances.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the Mysql instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `skip_show_database` from the drop-down menu, and set its value to `on`. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. List all Cloud SQL database Instances gcloud sql instances list 2. Configure the `skip_show_database` database flag for every Cloud SQL Mysql database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags skip_show_database=on **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `skip_show_database` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. List all Cloud SQL database Instances gcloud sql instances list 2. Ensure the below command returns `on` for every Cloud SQL Mysql database instance gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==skip_show_database)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/mysql/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag restarts the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/mysql/flags:https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_skip_show_database",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "6.1.3",
+ "Description": "Ensure That the ‘Local_infile’ Database Flag for a Cloud SQL MySQL Instance Is Set to ‘Off’",
+ "Checks": [
+ "cloudsql_instance_mysql_local_infile_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.1 MySQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
+ "RationaleStatement": "The `local_infile` flag controls the server-side LOCAL capability for LOAD DATA statements. Depending on the `local_infile` setting, the server refuses or permits local data loading by clients that have LOCAL enabled on the client side. To explicitly cause the server to refuse LOAD DATA LOCAL statements (regardless of how client programs and libraries are configured at build time or runtime), start mysqld with local_infile disabled. local_infile can also be set at runtime. Due to security issues associated with the `local_infile` flag, it is recommended to disable it. This recommendation is applicable to MySQL database instances.",
+ "ImpactStatement": "Disabling `local_infile` makes the server refuse local data loading by clients that have LOCAL enabled on the client side.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the MySQL instance where the database flag needs to be enabled. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `local_infile` from the drop-down menu, and set its value to `off`. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. List all Cloud SQL database instances using the following command: gcloud sql instances list 2. Configure the `local_infile` database flag for every Cloud SQL Mysql database instance using the below command: gcloud sql instances patch <INSTANCE_NAME> --database-flags local_infile=off **Note**: This command will overwrite all database flags that were previously set. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `local_infile` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. List all Cloud SQL database instances: gcloud sql instances list 2. Ensure the below command returns `off` for every Cloud SQL MySQL database instance. gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==local_infile)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require the instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/mysql/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines.",
+ "References": "https://cloud.google.com/sql/docs/mysql/flags:https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile:https://dev.mysql.com/doc/refman/5.7/en/load-data-local.html",
+ "DefaultValue": "By default `local_infile` is `on`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.1",
+ "Description": "Ensure ‘Log_error_verbosity’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘DEFAULT’ or Stricter",
+ "Checks": [
+ "cloudsql_instance_postgres_log_error_verbosity_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE` `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information. `VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error. Ensure an appropriate value is set to 'DEFAULT' or stricter.",
+ "RationaleStatement": "Auditing helps in troubleshooting operational problems and also permits forensic analysis. If `log_error_verbosity` is not set to the correct value, too many details or too few details may be logged. This flag should be configured with a value of 'DEFAULT' or stricter. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances. 2. Select the PostgreSQL instance for which you want to enable the database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `log_error_verbosity` from the drop-down menu and set appropriate value. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the log_error_verbosity database flag for every Cloud SQL PosgreSQL database instance using the below command. gcloud sql instances patch INSTANCE_NAME --database-flags log_error_verbosity=<TERSE|DEFAULT|VERBOSE> **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Go to `Configuration` card 4. Under `Database flags`, check the value of `log_error_verbosity` flag is set to 'DEFAULT' or stricter. **From Google Cloud CLI** 1. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_error_verbosity` gcloud sql instances describe [INSTANCE_NAME] --format=json | jq '.settings.databaseFlags[] | select(.name==log_error_verbosity)|.value' In the output, database flags are listed under the settings as the collection databaseFlags.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-ERROR-VERBOSITY",
+ "DefaultValue": "By default `log_error_verbosity` is `DEFAULT`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.2",
+ "Description": "Ensure That the ‘Log_connections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’",
+ "Checks": [
+ "cloudsql_instance_postgres_log_connections_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
+ "RationaleStatement": "PostgreSQL does not log attempted connections by default. Enabling the `log_connections` setting will create log entries for each attempted connection as well as successful completion of client authentication which can be useful in troubleshooting issues and to determine any unusual connection attempts to the server. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances. 2. Select the PostgreSQL instance for which you want to enable the database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `log_connections` from the drop-down menu and set the value as `on`. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `log_connections` database flag for every Cloud SQL PosgreSQL database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags log_connections=on **Note**: This command will overwrite all previously set database flags. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page. 3. Go to the `Configuration` card. 4. Under `Database flags`, check the value of `log_connections` flag to determine if it is configured as expected. **From Google Cloud CLI** 1. Ensure the below command returns `on` for every Cloud SQL PostgreSQL database instance: gcloud sql instances describe [INSTANCE_NAME] --format=json | jq '.settings.databaseFlags[] | select(.name==log_connections)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see the Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-CONNECTIONS",
+ "DefaultValue": "By default `log_connections` is `off`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.3",
+ "Description": "Ensure That the ‘Log_disconnections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’",
+ "Checks": [
+ "cloudsql_instance_postgres_log_disconnections_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
+ "RationaleStatement": "PostgreSQL does not log session details such as duration and session end by default. Enabling the `log_disconnections` setting will create log entries at the end of each session which can be useful in troubleshooting issues and determine any unusual activity across a time period. The `log_disconnections` and `log_connections` work hand in hand and generally, the pair would be enabled/disabled together. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the PostgreSQL instance where the database flag needs to be enabled. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `log_disconnections` from the drop-down menu and set the value as `on`. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `log_disconnections` database flag for every Cloud SQL PosgreSQL database instance using the below command: gcloud sql instances patch <INSTANCE_NAME> --database-flags log_disconnections=on **Note**: This command will overwrite all previously set database flags. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Go to the `Configuration` card. 4. Under `Database flags`, check the value of `log_disconnections` flag is configured as expected. **From Google Cloud CLI** 1. Ensure the below command returns `on` for every Cloud SQL PostgreSQL database instance: gcloud sql instances list --format=json | jq '.[].settings.databaseFlags[] | select(.name==log_disconnections)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-DISCONNECTIONS",
+ "DefaultValue": "By default `log_disconnections` is off."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.4",
+ "Description": "Ensure ‘Log_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately",
+ "Checks": [
+ "cloudsql_instance_postgres_log_statement_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all` The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements. The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included. A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
+ "RationaleStatement": "Auditing helps in forensic analysis. If `log_statement` is not set to the correct value, too many statements may be logged leading to issues in finding the relevant information from the logs, or too few statements may be logged with relevant information missing from the logs. Setting log_statement to align with your organization's security and logging policies facilitates later auditing and review of database activities. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the PostgreSQL instance for which you want to enable the database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `log_statement` from the drop-down menu and set appropriate value. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `log_statement` database flag for every Cloud SQL PosgreSQL database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags log_statement=<ddl|mod|all|none> **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Go to `Configuration` card 4. Under `Database flags`, check the value of `log_statement` flag is set to appropriately. **From Google Cloud CLI** 1. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_statement` gcloud sql instances list --format=json | jq '.[].settings.databaseFlags[] | select(.name==log_statement)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-STATEMENT",
+ "DefaultValue": "`none`"
+ }
+ ]
+ },
+ {
+ "Id": "6.2.5",
+ "Description": "Ensure that the ‘Log_min_messages’ Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'",
+ "Checks": [
+ "cloudsql_instance_postgres_log_min_messages_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
+ "RationaleStatement": "Auditing helps in troubleshooting operational problems and also permits forensic analysis. If `log_min_messages` is not set to the correct value, messages may not be classified as error messages appropriately. Setting the threshold to 'Warning' will log messages for the most needed error messages. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Setting the threshold too low will might result in increased log storage size and length, making it difficult to find actual errors. Higher severity levels may cause errors needed to troubleshoot to not be logged. An organization will need to decide their own threshold for logging `log_min_messages` flag. **Note**: To effectively turn off logging failing statements, set this parameter to PANIC.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances) 2. Select the PostgreSQL instance for which you want to enable the database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add a Database Flag`, choose the flag `log_min_messages` from the drop-down menu and set appropriate value. 6. Click `Save` to save the changes. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `log_min_messages` database flag for every Cloud SQL PosgreSQL database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags log_min_messages=<DEBUG5|DEBUG4|DEBUG3|DEBUG2|DEBUG1|INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC> **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page. 3. Go to the `Configuration` card. 4. Under `Database flags`, check the value of `log_min_messages` flag is set to `warning` or higher (WARNING|ERROR|LOG|FATAL|PANIC). **From Google Cloud CLI** 1. Use the below command for every Cloud SQL PostgreSQL database instance to verify that the value of `log_min_messages` is set to `warning` or higher . gcloud sql instances describe [INSTANCE_NAME] --format=json | jq '.settings.databaseFlags[] | select(.name==log_min_messages)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: Some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-MIN-MESSAGES",
+ "DefaultValue": "By default `log_min_messages` is `ERROR`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.6",
+ "Description": "Ensure ‘Log_min_error_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘Error’ or Stricter",
+ "Checks": [
+ "cloudsql_instance_postgres_log_min_error_statement_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
+ "RationaleStatement": "Auditing helps in troubleshooting operational problems and also permits forensic analysis. If `log_min_error_statement` is not set to the correct value, messages may not be classified as error messages appropriately. Considering general log messages as error messages would make is difficult to find actual errors and considering only stricter severity levels as error messages may skip actual errors to log their SQL statements. The `log_min_error_statement` flag should be set to `ERROR` or stricter. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the PostgreSQL instance for which you want to enable the database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_min_error_statement` from the drop-down menu and set appropriate value. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `log_min_error_statement` database flag for every Cloud SQL PosgreSQL database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags log_min_error_statement=<DEBUG5|DEBUG4|DEBUG3|DEBUG2|DEBUG1|INFO|NOTICE|WARNING|ERROR> **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Go to `Configuration` card 4. Under `Database flags`, check the value of `log_min_error_statement` flag is configured as to `ERROR` or stricter. **From Google Cloud CLI** 1. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_min_error_statement` is set to `ERROR` or stricter. gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.[].settings.databaseFlags[] | select(.name==log_min_error_statement)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-MIN-ERROR-STATEMENT",
+ "DefaultValue": "By default `log_min_error_statement` is `ERROR`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.7",
+ "Description": "Ensure That the ‘Log_min_duration_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)",
+ "Checks": [
+ "cloudsql_instance_postgres_log_min_duration_statement_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
+ "RationaleStatement": "Logging SQL statements may include sensitive information that should not be recorded in logs. This recommendation is applicable to PostgreSQL database instances.",
+ "ImpactStatement": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the PostgreSQL instance where the database flag needs to be enabled. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_min_duration_statement` from the drop-down menu and set a value of `-1`. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. List all Cloud SQL database instances using the following command: gcloud sql instances list 2. Configure the `log_min_duration_statement` flag for every Cloud SQL PosgreSQL database instance using the below command: gcloud sql instances patch <INSTANCE_NAME> --database-flags log_min_duration_statement=-1 **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page. 3. Go to the `Configuration` card. 4. Under `Database flags`, check that the value of `log_min_duration_statement` flag is set to `-1`. **From Google Cloud CLI** 1. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_min_duration_statement` is set to `-1`. gcloud sql instances describe <INSTANCE_NAME> --format=json| jq '.settings.databaseFlags[] | select(.name==log_min_duration_statement)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. **Note**: Some database flag settings can affect instance availability or stability and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not require restarting the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags:https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-MIN-DURATION-STATEMENT",
+ "DefaultValue": "By default `log_min_duration_statement` is `-1`."
+ }
+ ]
+ },
+ {
+ "Id": "6.2.8",
+ "Description": "Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging",
+ "Checks": [
+ "cloudsql_instance_postgres_enable_pgaudit_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.2 PostgreSQL Database",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
+ "RationaleStatement": "As numerous other recommendations in this section consist of turning on flags for logging purposes, your organization will need a way to manage these logs. You may have a solution already in place. If you do not, consider installing and enabling the open source pgaudit extension within PostgreSQL and enabling its corresponding flag of `cloudsql.enable_pgaudit`. This flag and installing the extension enables database auditing in PostgreSQL through the open-source pgAudit extension. This extension provides detailed session and object logging to comply with government, financial, & ISO standards and provides auditing capabilities to mitigate threats by monitoring security events on the instance. Enabling the flag and settings later in this recommendation will send these logs to Google Logs Explorer so that you can access them in a central location. to This recommendation is applicable only to PostgreSQL database instances.",
+ "ImpactStatement": "Enabling the pgAudit extension can lead to increased data storage requirements and to ensure durability of pgAudit log records in the event of unexpected storage issues, it is recommended to enable the `Enable automatic storage increases` setting on the instance. Enabling flags via the command line will also overwrite all existing flags, so you should apply all needed flags in the CLI command. Also flags may require a restart of the server to be implemented or will break existing functionality so update your servers at a time of low usage.",
+ "RemediationProcedure": "**Initialize the pgAudit flag** **From Google Cloud Console** 1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Overview` page. 3. Click `Edit`. 4. Scroll down and expand `Flags`. 5. To set a flag that has not been set on the instance before, click `Add item`. 6. Enter `cloudsql.enable_pgaudit` for the flag name and set the flag to `on`. 7. Click `Done`. 8. Click `Save` to update the configuration. 9. Confirm your changes under `Flags` on the `Overview` page. **From Google Cloud CLI** Run the below command by providing `<INSTANCE_NAME>` to enable `cloudsql.enable_pgaudit` flag. gcloud sql instances patch <INSTANCE_NAME> --database-flags cloudsql.enable_pgaudit=on Note: `RESTART` is required to get this configuration in effect. **Creating the extension** 1. Connect to the the server running PostgreSQL or through a SQL client of your choice. 2. Run the following command as a superuser. CREATE EXTENSION pgaudit; **Updating the previously created pgaudit.log flag for your Logging Needs** **From Console:** Note: there are multiple options here. This command will enable logging for all databases on a server. Please see the customizing database audit logging reference for more flag options. 1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Overview` page. 3. Click `Edit`. 4. Scroll down and expand `Flags`. 5. To set a flag that has not been set on the instance before, click `Add item`. 6. Enter `pgaudit.log=all` for the flag name and set the flag to `on`. 7. Click `Done`. 8. Click `Save` to update the configuration. 9. Confirm your changes under `Flags` on the `Overview` page. **From Command Line:** Run the command gcloud sql instances patch <INSTANCE_NAME> --database-flags cloudsql.enable_pgaudit=on,pgaudit.log=all **Determine if logs are being sent to Logs Explorer** 1. From the Google Console home page, open the hamburger menu in the top left. 2. In the menu that pops open, scroll down to Logs Explorer under Operations. 3. In the query box, paste the following and search resource.type=cloudsql_database logName=projects/<your-project-name>/logs/cloudaudit.googleapis.com%2Fdata_access protoPayload.request.@type=type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry If it returns any log sources, they are correctly setup.",
+ "AuditProcedure": "**Determining if the pgAudit Flag is set to 'on'** **From Google Cloud Console** 1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Overview` page. 3. Click `Edit`. 4. Scroll down and expand `Flags`. 5. Ensure that `cloudsql.enable_pgaudit` flag is set to `on`. **From Google Cloud CLI** Run the command by providing `<INSTANCE_NAME>`. Ensure the value of the flag is `on`. gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings|.|.databaseFlags[]|select(.name==cloudsql.enable_pgaudit)|.value' **Determine if the pgAudit extension is installed** 1. Connect to the the server running PostgreSQL or through a SQL client of your choice. 2. Run the following command SELECT * FROM pg_extension; 3. If pgAudit is in this list. If so, it is installed. **Determine if Data Access Audit logs are enabled for your project and have sufficient privileges** 1. From the homepage open the hamburger menu in the top left. 2. Scroll down to `IAM & Admin`and hover over it. 3. In the menu that opens up, select `Audit Logs` 4. In the middle of the page, in the search box next to `filter` search for `Cloud Composer API` 5. Select it, and ensure that both 'Admin Read' and 'Data Read' are checked. **Determine if logs are being sent to Logs Explorer** 1. From the Google Console home page, open the hamburger menu in the top left. 2. In the menu that pops open, scroll down to Logs Explorer under Operations. 3. In the query box, paste the following and search resource.type=cloudsql_database logName=projects/<your-project-name>/logs/cloudaudit.googleapis.com%2Fdata_access protoPayload.request.@type=type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry 4. If it returns any log sources, they are correctly setup.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/postgres/flags - to see if your instance will be restarted when this patch is submitted. Note: Configuring the 'cloudsql.enable_pgaudit' database flag requires restarting the Cloud SQL PostgreSQL instance.",
+ "References": "https://cloud.google.com/sql/docs/postgres/flags#list-flags-postgres:https://cloud.google.com/sql/docs/postgres/pg-audit#enable-auditing-flag:https://cloud.google.com/sql/docs/postgres/pg-audit#customizing-database-audit-logging:https://cloud.google.com/logging/docs/audit/configure-data-access#config-console-enable",
+ "DefaultValue": "By default `cloudsql.enable_pgaudit` database flag is set to `off` and the extension is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "6.3.1",
+ "Description": "Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'",
+ "Checks": [
+ "cloudsql_instance_sqlserver_external_scripts_enabled_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.3 SQL Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
+ "RationaleStatement": "`external scripts enabled` enable the execution of scripts with certain remote language extensions. This property is OFF by default. When Advanced Analytics Services is installed, setup can optionally set this property to true. As the External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed, which could adversely affect the security of the system, hence this should be disabled. This recommendation is applicable to SQL Server database instances.",
+ "ImpactStatement": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `external scripts enabled` from the drop-down menu, and set its value to `off`. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `external scripts enabled` database flag for every Cloud SQL SQL Server database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags external scripts enabled=off **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `external scripts enabled` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==external scripts enabled)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag restarts the Cloud SQL instance.",
+ "References": "https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/external-scripts-enabled-server-configuration-option?view=sql-server-ver15:https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/advanced-analytics/concepts/security?view=sql-server-ver15:https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79347",
+ "DefaultValue": "By default `external scripts enabled` is `off`"
+ }
+ ]
+ },
+ {
+ "Id": "6.3.2",
+ "Description": "Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'",
+ "Checks": [
+ "cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.3 SQL Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`. This flag is deprecated for all SQL Server versions in CGP. Going forward, you can't set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to off. For cross-database access, use the [Microsoft tutorial for signing stored procedures with a certificate](https://learn.microsoft.com/en-us/sql/relational-databases/tutorial-signing-stored-procedures-with-a-certificate?view=sql-server-ver16).",
+ "RationaleStatement": "Use the `cross db ownership` for chaining option to configure cross-database ownership chaining for an instance of Microsoft SQL Server. This server option allows you to control cross-database ownership chaining at the database level or to allow cross-database ownership chaining for all databases. Enabling `cross db ownership` is not recommended unless all of the databases hosted by the instance of SQL Server must participate in cross-database ownership chaining and you are aware of the security implications of this setting. This recommendation is applicable to SQL Server database instances.",
+ "ImpactStatement": "Updating flags may cause the database to restart. This may cause it to unavailable for a short amount of time, so this is best done at a time of low usage. You should also determine if the tables in your databases reference another table without using credentials for that database, as turning off cross database ownership will break this relationship.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `cross db ownership chaining` from the drop-down menu, and set its value to `off`. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `cross db ownership chaining` database flag for every Cloud SQL SQL Server database instance using the below command: gcloud sql instances patch <INSTANCE_NAME> --database-flags cross db ownership chaining=off **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**NOTE:** This flag is deprecated for all SQL Server versions. Going forward, you can't set its value to on. However, if you have this flag enabled it should be removed from your database or set to off. **From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console. 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `cross db ownership chaining` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance: gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==cross db ownership chaining)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: Some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not restart the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option?view=sql-server-ver15",
+ "DefaultValue": "This flag is deprecated for all SQL Server versions. Going forward, you can't set its value to on."
+ }
+ ]
+ },
+ {
+ "Id": "6.3.3",
+ "Description": "Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value",
+ "Checks": [
+ "cloudsql_instance_sqlserver_user_connections_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.3 SQL Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
+ "RationaleStatement": "The `user connections` option specifies the maximum number of simultaneous user connections that are allowed on an instance of SQL Server. The actual number of user connections allowed also depends on the version of SQL Server that you are using, and also the limits of your application or applications and hardware. SQL Server allows a maximum of 32,767 user connections. Because user connections is by default a self-configuring value, with SQL Server adjusting the maximum number of user connections automatically as needed, up to the maximum value allowable. For example, if only 10 users are logged in, 10 user connection objects are allocated. In most cases, you do not have to change the value for this option. The default is 0, which means that the maximum (32,767) user connections are allowed. However if there is a number defined here that limits connections, SQL Server will not allow anymore above this limit. If the connections are at the limit, any new requests will be dropped, potentially causing lost data or outages for those using the database.",
+ "ImpactStatement": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `user connections` from the drop-down menu, and set its value to your organization recommended value. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `user connections` database flag for every Cloud SQL SQL Server database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags user connections=[0-32,767] **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `user connections` listed under the `Database flags` section is 0. **From Google Cloud CLI** 1. Ensure the below command returns a value of 0, for every Cloud SQL SQL Server database instance. gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==user connections)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag restarts the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option?view=sql-server-ver15:https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79119",
+ "DefaultValue": "By default `user connections` is set to '0' which does not limit the number of connections, giving the server free reign to facilitate a max of 32,767 connections."
+ }
+ ]
+ },
+ {
+ "Id": "6.3.4",
+ "Description": "Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured",
+ "Checks": [
+ "cloudsql_instance_sqlserver_user_options_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.3 SQL Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The `user options` option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate). A user can override these defaults by using the SET statement. You can configure user options dynamically for new logins. After you change the setting of user options, new login sessions use the new setting; current login sessions are not affected. This recommendation is applicable to SQL Server database instances.",
+ "RationaleStatement": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured. A user can override these defaults set with `user options` by using the SET statement. Some of these features/options could adversely affect the security of the system if enabled.",
+ "ImpactStatement": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. Click the X next `user options` flag shown 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. List all Cloud SQL database Instances gcloud sql instances list 2. Clear the `user options` database flag for every Cloud SQL SQL Server database instance using either of the below commands. Clearing all flags to their default value gcloud sql instances patch <INSTANCE_NAME> --clear-database-flags OR To clear only `user options` database flag, configure the database flag by overriding the `user options`. Exclude `user options` flag and its value, and keep all other flags you want to configure. gcloud sql instances patch <INSTANCE_NAME> --database-flags [FLAG1=VALUE1,FLAG2=VALUE2] **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `user options` that has been set is not listed under the `Database flags` section. **From Google Cloud CLI** 1. Ensure the below command returns empty result for every Cloud SQL SQL Server database instance gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==user options)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not restart the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-options-server-configuration-option?view=sql-server-ver15:https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79335",
+ "DefaultValue": "By default 'user options' is not configured."
+ }
+ ]
+ },
+ {
+ "Id": "6.3.5",
+ "Description": "Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'",
+ "Checks": [
+ "cloudsql_instance_sqlserver_remote_access_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "SubSection": "6.3 SQL Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
+ "RationaleStatement": "The `remote access` option controls the execution of stored procedures from local or remote servers on which instances of SQL Server are running. This default value for this option is 1. This grants permission to run local stored procedures from remote servers or remote stored procedures from the local server. To prevent local stored procedures from being run from a remote server or remote stored procedures from being run on the local server, this must be disabled. The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server. 'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target, hence this should be disabled. This recommendation is applicable to SQL Server database instances.",
+ "ImpactStatement": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `remote access` from the drop-down menu, and set its value to `off`. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `remote access` database flag for every Cloud SQL SQL Server database instance using the below command gcloud sql instances patch <INSTANCE_NAME> --database-flags remote access=off **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `remote access` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==remote access)|.value' In the output, database flags are listed under the `settings` as the collection `databaseFlags`.",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag restarts the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-remote-access-server-configuration-option?view=sql-server-ver15:https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79337",
+ "DefaultValue": "By default 'remote access' is 'on'."
+ }
+ ]
+ },
+ {
+ "Id": "6.3.6",
+ "Description": "Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'",
+ "Checks": [
+ "cloudsql_instance_sqlserver_trace_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
+ "RationaleStatement": "Microsoft SQL Trace Flags are frequently used to diagnose performance issues or to debug stored procedures or complex computer systems, but they may also be recommended by Microsoft Support to address behavior that is negatively impacting a specific workload. All documented trace flags and those recommended by Microsoft Support are fully supported in a production environment when used as directed. `3625(trace log)` Limits the amount of information returned to users who are not members of the sysadmin fixed server role, by masking the parameters of some error messages using '******'. Setting this in a Google Cloud flag for the instance allows for security through obscurity and prevents the disclosure of sensitive information, hence this is recommended to set this flag globally to on to prevent the flag having been left off, or changed by bad actors. This recommendation is applicable to SQL Server database instances.",
+ "ImpactStatement": "Changing flags on a database may cause it to be restarted. The best time to do this is at a time where there is low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `3625` from the drop-down menu, and set its value to `on`. 6. Click `Save` to save your changes. 7. Confirm your changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. Configure the `3625` database flag for every Cloud SQL SQL Server database instance using the below command. gcloud sql instances patch <INSTANCE_NAME> --database-flags 3625=on **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Ensure the database flag `3625` that has been set is listed under the `Database flags` section. **From Google Cloud CLI** 1. Ensure the below command returns `on` for every Cloud SQL SQL Server database instance gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==3625)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag restarts the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql?view=sql-server-ver15#trace-flags:https://github.com/ktaranov/sqlserver-kit/blob/master/SQL%20Server%20Trace%20Flag.md",
+ "DefaultValue": "MS SQL Server implementations by default have trace flags, including the '3625' flag, turned off, as they are used for logging purposes.",
+ "SubSection": "6.3 SQL Server"
+ }
+ ]
+ },
+ {
+ "Id": "6.3.7",
+ "Description": "Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'",
+ "Checks": [
+ "cloudsql_instance_sqlserver_contained_database_authentication_flag"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "A contained database includes all database settings and metadata required to define the database and has no configuration dependencies on the instance of the Database Engine where the database is installed. Users can connect to the database without authenticating a login at the Database Engine level. Isolating the database from the Database Engine makes it possible to easily move the database to another instance of SQL Server. Contained databases have some unique threats that should be understood and mitigated by SQL Server Database Engine administrators. Most of the threats are related to the USER WITH PASSWORD authentication process, which moves the authentication boundary from the Database Engine level to the database level, hence this is recommended not to enable this flag. This recommendation is applicable to SQL Server database instances.",
+ "RationaleStatement": "When contained databases are enabled, database users with the ALTER ANY USER permission, such as members of the db_owner and db_accessadmin database roles, can grant access to databases and by doing so, grant access to the instance of SQL Server. This means that control over access to the server is no longer limited to members of the sysadmin and securityadmin fixed server role, and logins with the server level CONTROL SERVER and ALTER ANY LOGIN permission. It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.",
+ "ImpactStatement": "When `contained database authentication` is off (0) for the instance, contained databases cannot be created, or attached to the Database Engine. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the SQL Server instance for which you want to enable to database flag. 3. Click `Edit`. 4. Scroll down to the `Flags` section. 5. If the flag `contained database authentication` is present and its value is set to 'on', then change it to 'off'. 6. Click `Save`. 7. Confirm the changes under `Flags` on the Overview page. **From Google Cloud CLI** 1. If any Cloud SQL for SQL Server instance has the database flag `contained database authentication` set to 'on', then change it to 'off' using the below command: gcloud sql instances patch <INSTANCE_NAME> --database-flags contained database authentication=off **Note**: This command will overwrite all database flags previously set. To keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value. For flags that do not take a value, specify the flag name followed by an equals sign (=).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance to open its `Instance Overview` page 3. Under the 'Database flags' section, if the database flag `contained database authentication` is present, then ensure that it is set to 'off'. **From Google Cloud CLI** 1. Ensure the below command returns `off` for any Cloud SQL for SQL Server database instance. gcloud sql instances describe <INSTANCE_NAME> --format=json | jq '.settings.databaseFlags[] | select(.name==contained database authentication)|.value' ",
+ "AdditionalInformation": "WARNING: This patch modifies database flag values, which may require your instance to be restarted. Check the list of supported flags - https://cloud.google.com/sql/docs/sqlserver/flags - to see if your instance will be restarted when this patch is submitted. **Note**: Some database flag settings can affect instance availability or stability, and remove the instance from the Cloud SQL SLA. For information about these flags, see Operational Guidelines. **Note**: Configuring the above flag does not restart the Cloud SQL instance.",
+ "References": "https://cloud.google.com/sql/docs/sqlserver/flags:https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/contained-database-authentication-server-configuration-option?view=sql-server-ver15:https://docs.microsoft.com/en-us/sql/relational-databases/databases/security-best-practices-with-contained-databases?view=sql-server-ver15",
+ "DefaultValue": "",
+ "SubSection": "6.3 SQL Server"
+ }
+ ]
+ },
+ {
+ "Id": "6.4",
+ "Description": "Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL",
+ "Checks": [
+ "cloudsql_instance_ssl_connections"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.",
+ "RationaleStatement": "SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc. For security, it is recommended to always use SSL encryption when connecting to your instance. This recommendation is applicable for Postgresql, MySql generation 1, MySql generation 2 and SQL Server 2017 instances.",
+ "ImpactStatement": "After enforcing SSL requirement for connections, existing client will not be able to communicate with Cloud SQL database instance unless they use SSL encrypted connections to communicate to Cloud SQL database instance.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Click on an instance name to see its configuration overview. 3. In the left-side panel, select `Connections`. 3. In the `security` section, select SSL mode as `Allow only SSL connections`. 4. Under `Configure SSL server certificates` click `Create new certificate` and save the setting **From Google Cloud CLI** To enforce SSL encryption for an instance run the command: gcloud sql instances patch INSTANCE_NAME --ssl-mode= ENCRYPTED_ONLY Note: `RESTART` is required for type MySQL Generation 1 Instances (`backendType: FIRST_GEN`) to get this configuration in effect.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Click on an instance name to see its configuration overview. 3. In the left-side panel, select `Connections`. 3. In the `Security` section, ensure that `Allow only SSL connections` option is selected. **From Google Cloud CLI** 1. Get the detailed configuration for every SQL database instance using the following command: gcloud sql instances list --format=json Ensure that section `settings: ipConfiguration` has the parameter `sslMode` set to `ENCRYPTED_ONLY `.",
+ "AdditionalInformation": "By default `Settings: ipConfiguration` has no `authorizedNetworks` set/configured. In that case even if by default `sslMode` is not set, which is equivalent to `sslMode:ALLOW_UNENCRYPTED_AND_ENCRYPTED ` there is no risk as instance cannot be accessed outside of the network unless `authorizedNetworks` are configured. However, If default for `sslMode` is not updated to `ENCRYPTED_ONLY ` any `authorizedNetworks` created later on will not enforce SSL only connection.",
+ "References": "https://cloud.google.com/sql/docs/postgres/configure-ssl-instance/",
+ "DefaultValue": "By default parameter `settings: ipConfiguration: sslMode` is not set which is equivalent to `sslMode:ALLOW_UNENCRYPTED_AND_ENCRYPTED`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "6.5",
+ "Description": "Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses",
+ "Checks": [
+ "cloudsql_instance_public_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.",
+ "RationaleStatement": "To minimize attack surface on a Database server instance, only trusted/known and required IP(s) should be white-listed to connect to it. An authorized network should not have IPs/networks configured to `0.0.0.0/0` which will allow access to the instance from anywhere in the world. Note that authorized networks apply only to instances with public IPs.",
+ "ImpactStatement": "The Cloud SQL database instance would not be available to public IP addresses.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Click the instance name to open its `Instance details` page. 3. Under the `Configuration` section click `Edit configurations` 4. Under `Configuration options` expand the `Connectivity` section. 5. Click the `delete` icon for the authorized network `0.0.0.0/0`. 6. Click `Save` to update the instance. **From Google Cloud CLI** Update the authorized network list by dropping off any addresses. gcloud sql instances patch <INSTANCE_NAME> --authorized-networks=IP_ADDR1,IP_ADDR2... **Prevention:** To prevent new SQL instances from being configured to accept incoming connections from any IP addresses, set up a `Restrict Authorized Networks on Cloud SQL instances` Organization Policy at: [https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks](https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Click the instance name to open its `Instance details` page. 3. Under the `Configuration` section click `Edit configurations` 4. Under `Configuration options` expand the `Connectivity` section. 5. Ensure that no authorized network is configured to allow `0.0.0.0/0`. **From Google Cloud CLI** 1. Get detailed configuration for every Cloud SQL database instance. gcloud sql instances list --format=json Ensure that the section `settings: ipConfiguration : authorizedNetworks` does not have any parameter `value` containing `0.0.0.0/0`.",
+ "AdditionalInformation": "There is no IPv6 configuration found for Google cloud SQL server services.",
+ "References": "https://cloud.google.com/sql/docs/mysql/configure-ip:https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints:https://cloud.google.com/sql/docs/mysql/connection-org-policy",
+ "DefaultValue": "By default, authorized networks are not configured. Remote connection to Cloud SQL database instance is not possible unless authorized networks are configured.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "6.6",
+ "Description": "Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "It is recommended to enable IAM database authentication for Cloud SQL instances (PostgreSQL and MySQL) to eliminate static password-based authentication and instead use short-lived IAM tokens for database access. When enabled, database users can be created that authenticate via IAM, and connections use automatically-generated, short-lived tokens instead of static passwords. This recommendation is applicable to Cloud SQL for PostgreSQL and Cloud SQL for MySQL instances. Cloud SQL for SQL Server does not support IAM database authentication.",
+ "RationaleStatement": "IAM database authentication eliminates static database passwords by using short-lived IAM tokens for database access. This provides automatic credential rotation, centralized access control through Cloud IAM, and immediate revocation capabilities without password distribution across applications. Database access is correlated with GCP IAM principals in Cloud Logging, enabling better audit trails and attribution of database queries to specific service accounts or users. This recommendation is applicable to Cloud SQL for PostgreSQL and MySQL instances.",
+ "ImpactStatement": "Enabling IAM database authentication may require application changes, including updating connection methods and replacing password-based database users with IAM principals. Existing users and scripts that depend on static credentials may need to be reworked, and rollout should be coordinated carefully to avoid service disruption.",
+ "AuditProcedure": "**From Google Cloud CLI**\n\n1. List all Cloud SQL instances: `gcloud sql instances list`.\n2. For every PostgreSQL instance, verify the IAM authentication flag is enabled: `gcloud sql instances describe <INSTANCE_NAME> --format=\"json\" | jq '.settings.databaseFlags[] | select(.name==\"cloudsql.iam_authentication\")'`. It should return value `on`.\n3. For every MySQL instance, verify the flag `cloudsql_iam_authentication` is set to `on`. If the command returns no output, the flag is not set.",
+ "RemediationProcedure": "**From Google Cloud CLI**\n\n1. For PostgreSQL instances, enable IAM authentication: `gcloud sql instances patch <INSTANCE_NAME> --database-flags=cloudsql.iam_authentication=on`. For MySQL instances, use `cloudsql_iam_authentication=on`. Note: patching database flags overwrites previously set flags, so include all required flags.\n2. Create database users configured for IAM authentication using `gcloud sql users create ... --type=CLOUD_IAM_USER` (or `CLOUD_IAM_SERVICE_ACCOUNT`).\n3. Grant the necessary privileges to the database users via SQL GRANT commands.\n4. Ensure IAM principals have the roles `roles/cloudsql.client` and `roles/cloudsql.instanceUser`.\n5. Test the configuration by connecting using IAM authentication via the Cloud SQL Proxy.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, IAM database authentication is not enabled on Cloud SQL instances."
+ }
+ ]
+ },
+ {
+ "Id": "6.7",
+ "Description": "Ensure That Cloud SQL Database Instances Do Not Have Public IPs",
+ "Checks": [
+ "cloudsql_instance_public_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.",
+ "RationaleStatement": "To lower the organization's attack surface, Cloud SQL databases should not have public IPs. Private IPs provide improved network security and lower latency for your application.",
+ "ImpactStatement": "Removing the public IP address on SQL instances may break some applications that relied on it for database connectivity.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console: [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances) 2. Click the instance name to open its Instance details page. 3. Select the `Connections` tab. 4. Deselect the `Public IP` checkbox. 5. Click `Save` to update the instance. **From Google Cloud CLI** 1. For every instance remove its public IP and assign a private IP instead: gcloud sql instances patch <INSTANCE_NAME> --network=<VPC_NETWORK_NAME> --no-assign-ip 2. Confirm the changes using the following command:: gcloud sql instances describe <INSTANCE_NAME> **Prevention:** To prevent new SQL instances from getting configured with public IP addresses, set up a `Restrict Public IP access on Cloud SQL instances` Organization policy at: [https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp](https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp).",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console: [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances) 2. Ensure that every instance has a private IP address and no public IP address configured. **From Google Cloud CLI** 1. List all Cloud SQL database instances using the following command: gcloud sql instances list 2. For every instance of type `instanceType: CLOUD_SQL_INSTANCE` with `backendType: SECOND_GEN`, get detailed configuration. Ignore instances of type `READ_REPLICA_INSTANCE` because these instances inherit their settings from the primary instance. Also, note that first generation instances cannot be configured to have a private IP address. gcloud sql instances describe <INSTANCE_NAME> 3. Ensure that the setting `ipAddresses` has an IP address configured of `type: PRIVATE` and has no IP address of `type: PRIMARY`. `PRIMARY` IP addresses are public addresses. An instance can have both a private and public address at the same time. Note also that you cannot use private IP with First Generation instances.",
+ "AdditionalInformation": "Replicas inherit their private IP status from their primary instance. You cannot configure a private IP directly on a replica.",
+ "References": "https://cloud.google.com/sql/docs/mysql/configure-private-ip:https://cloud.google.com/sql/docs/mysql/private-ip:https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints:https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp",
+ "DefaultValue": "By default, Cloud Sql instances have a public IP.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "6.8",
+ "Description": "Ensure That Cloud SQL Database Instances Are Configured With Automated Backups",
+ "Checks": [
+ "cloudsql_instance_automated_backups"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended to have all SQL database instances set to enable automated backups.",
+ "RationaleStatement": "Backups provide a way to restore a Cloud SQL instance to recover lost data or recover from a problem with that instance. Automated backups need to be set for any instance that contains data that should be protected from loss or damage. This recommendation is applicable for SQL Server, PostgreSql, MySql generation 1 and MySql generation 2 instances.",
+ "ImpactStatement": "Automated Backups will increase required size of storage and costs associated with it.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Select the instance where the backups need to be configured. 3. Click `Edit`. 4. In the `Backups` section, check `Enable automated backups', and choose a backup window. 5. Click `Save`. **From Google Cloud CLI** 1. List all Cloud SQL database instances using the following command: gcloud sql instances list --format=json | jq '. | map(select(.instanceType != READ_REPLICA_INSTANCE)) | .[].name' NOTE: gcloud command has been added with the filter to exclude read-replicas instances, as GCP do not provide Automated Backups for read-replica instances. 2. Enable `Automated backups` for every Cloud SQL database instance using the below command: gcloud sql instances patch <INSTANCE_NAME> --backup-start-time <[HH:MM]> The `backup-start-time` parameter is specified in 24-hour time, in the UTC±00 time zone, and specifies the start of a 4-hour backup window. Backups can start any time during the backup window.",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances). 2. Click the instance name to open its instance details page. 3. Go to the `Backups` menu. 4. Ensure that `Automated backups` is set to `Enabled` and `Backup time` is mentioned. **From Google Cloud CLI** 1. List all Cloud SQL database instances using the following command: gcloud sql instances list --format=json | jq '. | map(select(.instanceType != READ_REPLICA_INSTANCE)) | .[].name' NOTE: gcloud command has been added with the filter to exclude read-replicas instances, as GCP do not provide Automated Backups for read-replica instances. 2. Ensure that the below command returns `True` for every Cloud SQL database instance. gcloud sql instances describe <INSTANCE_NAME> --format=value('Enabled':settings.backupConfiguration.enabled) ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/sql/docs/mysql/backup-recovery/backups:https://cloud.google.com/sql/docs/postgres/backup-recovery/backups:https://cloud.google.com/sql/docs/sqlserver/backup-recovery/backups:https://cloud.google.com/sql/docs/mysql/backup-recovery/backing-up:https://cloud.google.com/sql/docs/postgres/backup-recovery/backing-up:https://cloud.google.com/sql/docs/sqlserver/backup-recovery/backing-up",
+ "DefaultValue": "By default, automated backups are not configured for Cloud SQL instances.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "6.9",
+ "Description": "Ensure Cloud SQL Database Instances Have Deletion Protection Enabled",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Cloud SQL Database Services",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that deletion protection is enabled on all Cloud SQL database instances to prevent accidental or unauthorized deletion. This setting safeguards critical databases by requiring explicit disabling of deletion protection before deletion, reducing the risk of data loss through human error or malicious activity.",
+ "RationaleStatement": "Cloud SQL instances without deletion protection can be permanently deleted with a single API call or console action, allowing compromised credentials, operational errors, or malicious insiders to cause catastrophic data loss. Deletion protection provides a critical safeguard against inadvertent or malicious deletion of production databases. By requiring deliberate action to disable deletion protection before an instance can be deleted, organizations mitigate risks associated with accidental data deletion and enhance the overall resilience of their data storage platform. This control is particularly important for production workloads where data loss could result in significant business disruption, regulatory compliance violations, and reputational damage.",
+ "ImpactStatement": "There is no performance impact to enabling deletion protection on Cloud SQL instances. The setting only affects delete operations. Administrators will need to explicitly disable deletion protection before deleting an instance, adding an additional step to the deletion workflow.",
+ "AuditProcedure": "**From Google Cloud CLI**\n\n1. List all Cloud SQL database instances to identify those without deletion protection: `gcloud sql instances list --format=\"table(name,settings.deletionProtectionEnabled)\"`.\n2. For each instance, verify deletion protection is enabled: `gcloud sql instances describe <INSTANCE_NAME> --format=\"value(settings.deletionProtectionEnabled)\"`. The command should return `True`. If it returns `False` or empty, deletion protection is not enabled.",
+ "RemediationProcedure": "**From Google Cloud CLI**\n\n1. To enable deletion protection on an existing Cloud SQL instance: `gcloud sql instances patch <INSTANCE_NAME> --deletion-protection`.\n2. To enable deletion protection when creating a new Cloud SQL instance, include the `--deletion-protection` flag in the `gcloud sql instances create` command.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, deletion protection is not enabled on Cloud SQL database instances."
+ }
+ ]
+ },
+ {
+ "Id": "7.1",
+ "Description": "Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible",
+ "Checks": [
+ "bigquery_dataset_public_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 BigQuery",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.",
+ "RationaleStatement": "Granting permissions to `allUsers` or `allAuthenticatedUsers` allows anyone to access the dataset. Such access might not be desirable if sensitive data is being stored in the dataset. Therefore, ensure that anonymous and/or public access to a dataset is not allowed.",
+ "ImpactStatement": "The dataset is not publicly accessible. Explicit modification of IAM privileges would be necessary to make them publicly accessible.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Go to `BigQuery` by visiting: [https://console.cloud.google.com/bigquery](https://console.cloud.google.com/bigquery). 2. Select the dataset from 'Resources'. 3. Click `SHARING` near the right side of the window and select `Permissions`. 4. Review each attached role. 5. Click the delete icon for each member `allUsers` or `allAuthenticatedUsers`. On the popup click `Remove`. **From Google Cloud CLI** List the name of all datasets. bq ls Retrieve the data set details: bq show --format=prettyjson PROJECT_ID:DATASET_NAME > PATH_TO_FILE In the access section of the JSON file, update the dataset information to remove all roles containing `allUsers` or `allAuthenticatedUsers`. Update the dataset: bq update --source PATH_TO_FILE PROJECT_ID:DATASET_NAME **Prevention:** You can prevent Bigquery dataset from becoming publicly accessible by setting up the `Domain restricted sharing` organization policy at: https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains .",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `BigQuery` by visiting: [https://console.cloud.google.com/bigquery](https://console.cloud.google.com/bigquery). 2. Select a dataset from `Resources`. 3. Click `SHARING` near the right side of the window and select `Permissions`. 4. Validate that none of the attached roles contain `allUsers` or `allAuthenticatedUsers`. **From Google Cloud CLI** List the name of all datasets. bq ls Retrieve each dataset details using the following command: bq show PROJECT_ID:DATASET_NAME Ensure that `allUsers` and `allAuthenticatedUsers` have not been granted access to the dataset.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/bigquery/docs/dataset-access-controls",
+ "DefaultValue": "By default, BigQuery datasets are not publicly accessible.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "7.2",
+ "Description": "Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)",
+ "Checks": [
+ "bigquery_table_cmk_encryption"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 BigQuery",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.",
+ "RationaleStatement": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. This is seamless and does not require any additional input from the user. For greater control over the encryption, customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery tables. The CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys. BigQuery stores the table and CMEK association and the encryption/decryption is done automatically. Applying the Default Customer-managed keys on BigQuery data sets ensures that all the new tables created in the future will be encrypted using CMEK but existing tables need to be updated to use CMEK individually. Note: Google does not store your keys on its servers and cannot access your protected data unless you provide the key. This also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key. ",
+ "ImpactStatement": "Using Customer-managed encryption keys (CMEK) will incur additional labor-hour investment to create, protect, and manage the keys.",
+ "RemediationProcedure": "**From Google Cloud CLI** Use the following command to copy the data. The source and the destination needs to be same in case copying to the original table. bq cp --destination_kms_key <customer_managed_key> source_dataset.source_table destination_dataset.destination_table ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Analytics` 2. Go to `BigQuery` 3. Under `SQL Workspace`, select the project 4. Select Data Set, select the table 5. Go to `Details` tab 6. Under `Table info`, verify `Customer-managed key` is present. 7. Repeat for each table in all data sets for all projects. **From Google Cloud CLI** List all dataset names bq ls Use the following command to view the table details. Verify the `kmsKeyName` is present. bq show <table_object> ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/bigquery/docs/customer-managed-encryption",
+ "DefaultValue": "Google Managed keys are used as `key encryption keys`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "7.3",
+ "Description": "Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets",
+ "Checks": [
+ "bigquery_dataset_cmk_encryption"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 BigQuery",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.",
+ "RationaleStatement": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. This is seamless and does not require any additional input from the user. For greater control over the encryption, customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. Setting a Default Customer-managed encryption key (CMEK) for a data set ensure any tables created in future will use the specified CMEK if none other is provided. Note: Google does not store your keys on its servers and cannot access your protected data unless you provide the key. This also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key. ",
+ "ImpactStatement": "Using Customer-managed encryption keys (CMEK) will incur additional labor-hour investment to create, protect, and manage the keys.",
+ "RemediationProcedure": "**From Google Cloud CLI** The default CMEK for existing data sets can be updated by specifying the default key in the `EncryptionConfiguration.kmsKeyName` field when calling the `datasets.insert` or `datasets.patch` methods",
+ "AuditProcedure": "**From Google Cloud Console** 1. Go to `Analytics` 2. Go to `BigQuery` 3. Under `Analysis` click on `SQL Workspaces`, select the project 4. Select Data Set 5. Ensure `Customer-managed key` is present under `Dataset info` section. 6. Repeat for each data set in all projects. **From Google Cloud CLI** List all dataset names bq ls Use the following command to view each dataset details. bq show <data_set_object> Verify the `kmsKeyName` is present.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/bigquery/docs/customer-managed-encryption",
+ "DefaultValue": "Google Managed keys are used as `key encryption keys`.",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "7.4",
+ "Description": "Ensure all data in BigQuery has been classified",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 BigQuery",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "BigQuery tables can contain sensitive data that for security purposes should be discovered, monitored, classified, and protected. Google Cloud's Sensitive Data Protection tools can automatically provide data classification of all BigQuery data across an organization.",
+ "RationaleStatement": "Using a cloud service or 3rd party software to continuously monitor and automate the process of data discovery and classification for BigQuery tables is an important part of protecting the data. Sensitive Data Protection is a fully managed data protection and data privacy platform that uses machine learning and pattern matching to discover and classify sensitive data in Google Cloud.",
+ "ImpactStatement": "There is a cost associated with using Sensitive Data Protection. There is also typically a cost associated with 3rd party tools that perform similar processes and protection.",
+ "RemediationProcedure": "**Enable profiling:** 1. Go to Cloud DLP by visiting https://console.cloud.google.com/dlp/landing/dataProfiles/configurations 1. Click Create Configuration 1. For projects follow https://cloud.google.com/dlp/docs/profile-project. For organizations or folders follow https://cloud.google.com/dlp/docs/profile-org-folder **Review findings:** - Columns or tables with high data risk have evidence of sensitive information without additional protections. To lower the data risk score, consider doing the following: - For columns containing sensitive data, apply a BigQuery policy tag to restrict access to accounts with specific access rights. - De-identify the raw sensitive data using de-identification techniques like masking and tokenization. **Incorporate findings into your security and governance operations:** - Enable sending findings into your security and posture services. You can publish data profiles to Security Command Center and Chronicle. - Automate remediation or enable alerting of new or changed data risk with Pub/Sub.",
+ "AuditProcedure": "1. Go to Cloud DLP by visiting https://console.cloud.google.com/dlp/landing/dataProfiles/configurations. 2. Verify there is a discovery scan configuration either for the organization or project.",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/dlp/docs/data-profiles:https://cloud.google.com/dlp/docs/analyze-data-profiles:https://cloud.google.com/dlp/docs/data-profiles-remediation:https://cloud.google.com/dlp/docs/send-profiles-to-scc:https://cloud.google.com/dlp/docs/profile-org-folder#chronicle:https://cloud.google.com/dlp/docs/profile-org-folder#publish-pubsub",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ },
+ {
+ "Id": "8.1",
+ "Description": "Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key",
+ "Checks": [
+ "dataproc_encrypted_with_cmks_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Dataproc",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
+ "RationaleStatement": "Cloud services offer the ability to protect data related to those services using encryption keys managed by the customer within Cloud KMS. These encryption keys are called customer-managed encryption keys (CMEK). When you protect data in Google Cloud services with CMEK, the CMEK key is within your control.",
+ "ImpactStatement": "Using Customer Managed Keys involves additional overhead in maintenance by administrators.",
+ "RemediationProcedure": "**From Google Cloud Console** 1. Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters. 1. Select the project from the projects dropdown list. 1. On the `Dataproc Cluster` page, click on the `Create Cluster` to create a new cluster with Customer managed encryption keys. 1. On `Create a cluster` page, perform below steps: - Inside `Set up cluster` section perform below steps: -In the `Name` textbox, provide a name for your cluster. - From `Location` select the location in which you want to deploy a cluster. - Configure other configurations as per your requirements. - Inside `Configure Nodes` and `Customize cluster` section configure the settings as per your requirements. - Inside `Manage security` section, perform below steps: - From `Encryption`, select `Customer-managed key`. - Select a customer-managed key from dropdown list. - Ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account (serviceAccount:service-<project_number>@compute-system.iam.gserviceaccount.com). - Click on `Create` to create a cluster. - Once the cluster is created migrate all your workloads from the older cluster to the new cluster and delete the old cluster by performing the below steps: - On the `Clusters` page, select the old cluster and click on `Delete cluster`. - On the `Confirm deletion` window, click on `Confirm` to delete the cluster. - Repeat step above for other Dataproc clusters available in the selected project. - Change the project from the project dropdown list and repeat the remediation procedure for other Dataproc clusters available in other projects. **From Google Cloud CLI** Before creating cluster ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account (serviceAccount:service-<project_number>@compute-system.iam.gserviceaccount.com). Run clusters create command to create new cluster with customer-managed key: gcloud dataproc clusters create <cluster_name> --region=us-central1 --gce-pd-kms-key=<key_resource_name> The above command will create a new cluster in the selected region. Once the cluster is created migrate all your workloads from the older cluster to the new cluster and Run clusters delete command to delete cluster: gcloud dataproc clusters delete <cluster_name> --region=us-central1 Repeat step no. 1 to create a new Dataproc cluster. Change the project by running the below command and repeat the remediation procedure for other projects: gcloud config set project <project_ID> ",
+ "AuditProcedure": "**From Google Cloud Console** 1. Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters. 1. Select the project from the project dropdown list. 1. On the `Dataproc Clusters` page, select the cluster and click on the Name attribute value that you want to examine. 1. On the `details` page, select the `Configurations` tab. 1. On the `Configurations` tab, check the `Encryption type` configuration attribute value. If the value is set to `Google-managed key`, then Dataproc Cluster is not encrypted with Customer managed encryption keys. Repeat step no. 3 - 5 for other Dataproc Clusters available in the selected project. 6. Change the project from the project dropdown list and repeat the audit procedure for other projects. **From Google Cloud CLI** 1. Run clusters list command to list all the Dataproc Clusters available in the region: gcloud dataproc clusters list --region='us-central1' 2. Run clusters describe command to get the key details of the selected cluster: gcloud dataproc clusters describe <cluster_name> --region=us-central1 --flatten=config.encryptionConfig.gcePdKmsKeyName 3. If the above command output return null, then the selected cluster is not encrypted with Customer managed encryption keys. 4. Repeat step no. 2 and 3 for other Dataproc Clusters available in the selected region. Change the region by updating --region and repeat step no. 2 for other clusters available in the project. Change the project by running the below command and repeat the audit procedure for other Dataproc clusters available in other projects: gcloud config set project <project_ID> ",
+ "AdditionalInformation": "",
+ "References": "https://cloud.google.com/docs/security/encryption/default-encryption",
+ "DefaultValue": "",
+ "SubSection": null
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/github/cis_1.2.0_github.json b/prowler/compliance/github/cis_1.2.0_github.json
new file mode 100644
index 0000000000..840b5aa3d8
--- /dev/null
+++ b/prowler/compliance/github/cis_1.2.0_github.json
@@ -0,0 +1,2574 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS GitHub Benchmark v1.2.0",
+ "Version": "1.2.0",
+ "Provider": "GitHub",
+ "Description": "This document provides prescriptive guidance for establishing a secure configuration posture for securing GitHub.",
+ "Requirements": [
+ {
+ "Id": "1.1.1",
+ "Description": "Manage all code projects in a version control platform.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Manage all code projects in a version control platform.",
+ "RationaleStatement": "Version control platforms keep track of every modification to code. They represent the cornerstone of code security, as well as allowing for better code collaboration within engineering teams. With granular access management, change tracking, and key signing of code edits, version control platforms are the first step in securing the software supply chain.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Upload existing code projects to a dedicated Github organization and repositories and create an identity for each active team member who might contribute or need access to it.",
+ "AuditProcedure": "Ensure that all code activity is managed through Github repository for every micro-service or application developed by an organization.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.2",
+ "Description": "Use a task management system to trace any code back to its associated task.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use a task management system to trace any code back to its associated task.",
+ "RationaleStatement": "The ability to trace each piece of code back to its associated task simplifies the Agile and DevOps process by enabling transparency of any code changes. This allows faster remediation of bugs and security issues, while also making it harder to push unauthorized code changes to sensitive projects. Additionally, using a task management system simplifies achieving compliance, as it is easier to track each regulation.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Use a task management system to manage tasks as the starting point for each code change. Whether it is a new feature, bug fix, or security fix - all should originate from a dedicated task (ticket) in your organization's task management system. These tasks should also be linked to the code changes themselves in a way that is easy to follow: from code to task, and from task back to code.",
+ "AuditProcedure": "Ensure every code change can be traced back to its origin task in a task management system.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.3",
+ "Description": "Ensure that every code change is reviewed and approved by two authorized contributors who are both strongly authenticated - using Multi-Factor Authentication (MFA), from the team relevant to the code change.",
+ "Checks": [
+ "repository_default_branch_requires_multiple_approvals"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that every code change is reviewed and approved by two authorized contributors who are both strongly authenticated - using Multi-Factor Authentication (MFA), from the team relevant to the code change.",
+ "RationaleStatement": "To prevent malicious or unauthorized code changes, the first layer of protection is the process of code review. This process involves engineer teammates reviewing each other's code for errors, optimizations, and general knowledge-sharing. With proper peer reviews in place, an organization can detect unwanted code changes very early in the process of release. In order to help facilitate code review, companies should employ automation to verify that every code change has been reviewed and approved by at least two team members before it is pushed into the code base. These team members should be from the team that is related to the code change, so it will be a meaningful review.",
+ "ImpactStatement": "To enforce a code review requirement, verification for a minimum of two reviewers must be put into place. This will ensure new code will not be able to be pushed to the code base before it has received two independent approvals.",
+ "RemediationProcedure": "For every code repository in use, perform the next steps to require two approvals from the specific code repository team in order to push new code to the code base:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Check **Require a pull request before merging** and **Require approvals**, and set **Required number of approvals before merging** to 2.\n5. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, perform the next steps to verify that two approvals from the specific code repository team are required to push new code to the code base:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require a pull request before merging** and **Require approvals** are checked, and verify that **Required number of approvals before merging** is set to 2.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "0"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.4",
+ "Description": "Ensure that when a proposed code change is updated, previous approvals are declined, and new approvals are required.",
+ "Checks": [
+ "repository_default_branch_dismisses_stale_reviews"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that when a proposed code change is updated, previous approvals are declined, and new approvals are required.",
+ "RationaleStatement": "An approval process is necessary when code changes are suggested. Through this approval process, however, changes can still be made to the original proposal even after some approvals have already been given. This means malicious code can find its way into the code base even if the organization has enforced a review policy. To ensure this is not possible, outdated approvals must be declined when changes to the suggestion are introduced.",
+ "ImpactStatement": "If new code changes are pushed to a specific proposal, all previously accepted code change proposals must be declined.",
+ "RemediationProcedure": "For each code repository in use, perform the next steps to enforce dismissal of given approvals to code change suggestions if those suggestions were updated:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require pull request reviews before merging** and then **Dismiss stale pull request approvals when new commits are pushed**.\n5. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For each code repository in use, perform the next steps to verify that each updated code suggestion declines the previously received approvals:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require a pull request before merging** is checked, and verify that **Dismiss stale pull request approvals when new commits are pushed** is checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.5",
+ "Description": "Only trusted users should be allowed to dismiss code change reviews.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Only trusted users should be allowed to dismiss code change reviews.",
+ "RationaleStatement": "Dismissing a code change review permits users to merge new suggested code changes without going through the standard process of approvals. Controlling who can perform this action will prevent malicious actors from simply dismissing the required reviews to code changes and merging malicious or dysfunctional code into the code base.",
+ "ImpactStatement": "In cases where a code change proposal has been updated since it was last reviewed and the person who reviewed it isn't available for approval, a general collaborator would not be able to merge their code changes until a user with \"dismiss review\" abilities could dismiss the open review.\n\nUsers who are not allowed to dismiss code change reviews will not be permitted to do so, and thus are unable to waive the standard flow of approvals.",
+ "RemediationProcedure": "For each code repository in use, perform the next steps to restrict dismissal of code changes reviews unless it is necessary:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you added the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n4. Select **Require pull request reviews before merging** and **Restrict who can dismiss pull request reviews**.\n5. Do not add any user or team unless it is obligatory. If it is obligatory, carefully select the users or teams whom you trust with the ability to dismiss code change reviews.\n6. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For each code repository in use, perform the next steps to verify that only trusted users are allowed to dismiss code change reviews: \n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n4. Verify that **Require a pull request before merging** and **Restrict who can dismiss pull request reviews** is checked.\n5. Verify that no users and teams are specified except for organization and repository admins. If it is obligatory, verify that the users or teams specified were carefully selected to be trusted with the ability to dismiss code change reviews.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, all users who have write access to the code repository are able to dismiss code change reviews."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.6",
+ "Description": "Code owners are trusted users that are responsible for reviewing and managing an important piece of code or configuration. An organization is advised to set code owners for every extremely sensitive code or configuration.",
+ "Checks": [
+ "repository_has_codeowners_file"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Code owners are trusted users that are responsible for reviewing and managing an important piece of code or configuration. An organization is advised to set code owners for every extremely sensitive code or configuration.",
+ "RationaleStatement": "Configuring code owners protects data by verifying that trusted users will notice and review every edit, thus preventing unwanted or malicious changes from potentially compromising sensitive code or configurations.",
+ "ImpactStatement": "Code owner users will receive notifications for every change that occurs to the code and subsequently added as reviewers of pull requests automatically.",
+ "RemediationProcedure": "In every code repository create a CODEOWNERS file in the root, docs/, or .github/ directory of the repository.\nIn the file, specify codeowners for the .github/workflows/ directory atleast. Specify organization members you trust. For example:\n```\n.github/workflows/ @user1 @user2\n```",
+ "AuditProcedure": "In every code repository, verify that a file named CODEOWNERS exists in the root, docs/, or .github/ directory of the repository.\nIn the CODEOWNERS file, verify that the users specified are users you trust.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners",
+ "DefaultValue": "None"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.7",
+ "Description": "Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base.",
+ "Checks": [
+ "repository_default_branch_requires_codeowners_review"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure trusted code owners are required to review and approve any code change proposal made to their respective owned areas in the code base.",
+ "RationaleStatement": "Configuring code owners ensures that no code, especially code which could prove malicious, will slip into the source code or configuration files of a repository. This allows an organization to mark areas in the code base that are especially sensitive or more prone to an attack. It can also enforce review by specific individuals who are designated as owners to those areas so that they may filter out unauthorized or unwanted changes beforehand.",
+ "ImpactStatement": "If an organization enforces code owner-based reviews, some code change proposals would not be able to be merged to the codebase before specific, trusted individuals approve them.",
+ "RemediationProcedure": "For every code repository in use, perform the following steps to require code owners' approvals for each change proposal related to code they own:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require pull request reviews before merging** and **Require review from Code Owners**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, perform the following steps to verify that code owners are required to review all code change proposals relevant to areas they own before code merge:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n4. Ensure that **Require a pull request before merging** and **Require review from Code Owners** are checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Code owners are not required to review changes by default."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.8",
+ "Description": "Keep track of code branches that are inactive for a lengthy period of time and periodically remove them.",
+ "Checks": [
+ "repository_inactive_not_archived",
+ "repository_branch_delete_on_merge_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Keep track of code branches that are inactive for a lengthy period of time and periodically remove them.",
+ "RationaleStatement": "Git branches that have been inactive (i.e., no new changes introduced) for a long period of time are enlarging the surface of attack for malicious code injection, sensitive data leaks, and CI pipeline exploitation. They potentially contain outdated dependencies which may leave them highly vulnerable. They are more likely to be improperly managed, and could possibly be accessed by a large number of members of the organization.",
+ "ImpactStatement": "Removing inactive Git branches means that any code changes they contain would be removed along with them, thus work done in the past might not be accessible after auditing for inactivity.",
+ "RemediationProcedure": "For each code repository in use, review existing Git branches and remove those which have not been active for a period of time by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Above the list of files, click **Branches**.\n3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first.\n4. For each branch listed, either delete it by clicking the trash bin icon, or find the valid reason it still exists.\n\nYou can perform the next steps to prevent pull request branches from becoming stale branches:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click Settings.\n3. Under \"Pull Requests\", select **Automatically delete head branches**.",
+ "AuditProcedure": "For each code repository in use, verify that all existing Git branches are active or have yet to be checked for inactivity by performing the next steps:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Above the list of files, click **Branches**.\n3. Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first.\n4. If the list is empty, you are compliant. If the list is not empty, but there is a valid reason the branches listed are not deleted, you are compliant.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, newly opened Git branches would never be removed, regardless of activity or inactivity."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.9",
+ "Description": "Before a code change request can be merged to the code base, all predefined checks must successfully pass.",
+ "Checks": [
+ "repository_default_branch_status_checks_required"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Before a code change request can be merged to the code base, all predefined checks must successfully pass.",
+ "RationaleStatement": "On top of manual reviews of code changes, a code protect should contain a set of prescriptive checks which validate each change. Organizations should enforce those status checks so that changes can only be introduced if all checks have successfully passed. This set of checks should serve as the absolute quality, stability, and security conditions which must be met in order to merge new code to a project.",
+ "ImpactStatement": "Code changes in which all checks do not pass successfully would not be able to be pushed into the code base of the specific code repository.",
+ "RemediationProcedure": "For each code repository in use, require all status checks to pass before permitting a merge of new code by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", check if there is a rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require status checks to pass before merging**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For each code repository in use, verify that status checks are required to pass before allowing any code change proposal merge by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require status checks to pass before merging** is checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, no checks are defined per project, and thus no enforcement of checks is made."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.10",
+ "Description": "Organizations should make sure each suggested code change is in full sync with the existing state of its origin code repository before allowing merging.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Organizations should make sure each suggested code change is in full sync with the existing state of its origin code repository before allowing merging.",
+ "RationaleStatement": "Git branches can easily become outdated since the origin code repository is constantly being edited. This means engineers working on separate code branches can accidentally include outdated code with potential security issues which might have already been fixed, overriding the potential solutions for those security issues when merging their own changes.",
+ "ImpactStatement": "If enforced, outdated branches would not be able to be merged into their origin repository without first being updated to contain any recent changes.",
+ "RemediationProcedure": "For each code repository in use, enforce a policy to only allow merging open branches if they are current with the latest change from their original repository by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require status checks to pass before merging** and **Require branches to be up to date before merging**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For each code repository in use, verify that open branches must be updated before merging is permitted by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require status checks to pass before merging** and **Require branches to be up to date before merging** are checked.",
+ "AdditionalInformation": "",
+ "References": "https://github.blog/changelog/2022-02-03-more-ways-to-keep-your-pull-request-branch-up-to-date/",
+ "DefaultValue": "By default, there is no requirement to update a branch before merging it."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.11",
+ "Description": "Organizations should enforce a \"no open comments\" policy before allowing code change merging.",
+ "Checks": [
+ "repository_default_branch_requires_conversation_resolution"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Organizations should enforce a \"no open comments\" policy before allowing code change merging.",
+ "RationaleStatement": "In an open code change proposal, reviewers can leave comments containing their questions and suggestions. These comments can also include potential bugs and security issues. Requiring all comments on a code change proposal to be resolved before it can be merged ensures that every concern is properly addressed or acknowledged before the new code changes are introduced to the code base.",
+ "ImpactStatement": "Code change proposals containing open comments would not be able to be merged into the code base.",
+ "RemediationProcedure": "For each code repository in use, require open comments to be resolved before the relevant code change can be merged by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require conversation resolution before merging**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, verify that each merged code change does not contain open, unattended comments by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require conversation resolution before merging** is checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, code changes with open comments on them are able to be merged into the code \nbase."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.12",
+ "Description": "Ensure every commit in a pull request is signed and verified before merging.",
+ "Checks": [
+ "repository_default_branch_requires_signed_commits"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure every commit in a pull request is signed and verified before merging.",
+ "RationaleStatement": "Signing commits, or requiring to sign commits, gives other users confidence about the origin of a specific code change. It ensures that the author of the change is not hidden and is verified by the version control system, thus the change comes from a trusted source.",
+ "ImpactStatement": "Pull requests with unsigned commits cannot be merged.",
+ "RemediationProcedure": "For each repository in use, enforce the branch protection rule of requiring signed commits, and make sure only signed commits are capable of merging by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require signed commits**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "Ensure only signed commits can be merged for every branch, especially the main branch, via branch protection rules by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require signed commits** is checked.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.13",
+ "Description": "Linear history is the name for Git history where all commits are listed in chronological order, one after another. Such history exists if a pull request is merged either by rebase merge (re-order the commits history) or squash merge (squashes all commits to one). Ensure that linear history is required by requiring the use of rebase or squash merge when merging a pull request.",
+ "Checks": [
+ "repository_default_branch_requires_linear_history"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Linear history is the name for Git history where all commits are listed in chronological order, one after another. Such history exists if a pull request is merged either by rebase merge (re-order the commits history) or squash merge (squashes all commits to one). Ensure that linear history is required by requiring the use of rebase or squash merge when merging a pull request.",
+ "RationaleStatement": "Enforcing linear history produces a clear record of activity, and as such it offers specific advantages: it is easier to follow, easier to revert a change, and bugs can be found more easily.",
+ "ImpactStatement": "Pull request cannot be merged except squash or rebase merge.",
+ "RemediationProcedure": "For every code repository in use, perform the following steps to require linear history and/or allow only rebase merge and squash merge:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Require linear history**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, perform the following steps to verify that linear history is required and/or that only squash merge and rebase merge are allowed:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Require linear history** is checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.14",
+ "Description": "Ensure administrators are subject to branch protection rules.",
+ "Checks": [
+ "repository_default_branch_protection_applies_to_admins"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure administrators are subject to branch protection rules.",
+ "RationaleStatement": "Administrators by default are excluded from any branch protection rules. This means these privileged users (both on the repository and organization levels) are not subject to protections meant to prevent untrusted code insertion, including malicious code. This is extremely important since administrator accounts are often targeted for account hijacking due to their privileged role.",
+ "ImpactStatement": "Administrator users won't be able to push code directly to the protected branch without being compliant with listed branch protection rules.",
+ "RemediationProcedure": "For every code repository in use, enforce branch protection rules on administrators as well, by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Do not allow bypassing the above settings**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, validate branch protection rules also apply to administrator accounts by performing the next steps:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Do not allow bypassing the above settings** is checked.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule",
+ "DefaultValue": "Administrator accounts are not subject to branch protection rules by default."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.15",
+ "Description": "Ensure that only trusted users can push or merge new code to protected branches.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that only trusted users can push or merge new code to protected branches.",
+ "RationaleStatement": "Requiring that only trusted users may push or merge new changes reduces the risk of unverified code, especially malicious code, to a protected branch by reducing the number of trusted users who are capable of doing such.",
+ "ImpactStatement": "Only administrators and trusted users can push or merge to the protected branch.",
+ "RemediationProcedure": "For every code repository in use, allow only trusted and responsible users to push or merge new code by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4.Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Select **Restrict who can push to matching branches** and choose trusted and responsible users and teams who will have the permission to do so. \n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, ensure only trusted and responsible users can push or merge new code by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Restrict who can push to matching branches** is checked and that only trusted and responsible users and teams are selected.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.16",
+ "Description": "The \"Force Push\" option allows users with \"Push\" permissions to force their changes directly to the branch without a pull request, and thus should be disabled.",
+ "Checks": [
+ "repository_default_branch_disallows_force_push"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The \"Force Push\" option allows users with \"Push\" permissions to force their changes directly to the branch without a pull request, and thus should be disabled.",
+ "RationaleStatement": "The \"Force Push\" option allows users to override the existing code with their own code. This can lead to both intentional and unintentional data loss, as well as data infection with malicious code. Disabling the \"Force Push\" option prohibits users from forcing their changes to the master branch, which ultimately prevents malicious code from entering source code.",
+ "ImpactStatement": "Users cannot force push to protected branches.",
+ "RemediationProcedure": "For each repository in use, block the option to \"Force Push\" code by performing the following:\n\nEnsure that Trunk / Long-standing branches are protected by Policies and submitted to PR while applying the 4-eyes approach.\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Uncheck **Allow force pushes**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For every code repository in use, validate that no one can force push code by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Allow force pushes** is not checked.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.17",
+ "Description": "Ensure that users with only push access are incapable of deleting a protected branch.",
+ "Checks": [
+ "repository_default_branch_deletion_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that users with only push access are incapable of deleting a protected branch.",
+ "RationaleStatement": "When enabling deletion of a protected branch, any user with at least push access to the repository can delete a branch. This can be potentially dangerous, as a simple human mistake or a hacked account can lead to data loss if a branch is deleted. It is therefore crucial to prevent such incidents by denying protected branch deletion.",
+ "ImpactStatement": "Protected branches cannot be deleted.",
+ "RemediationProcedure": "For each repository that is being used, block the option to delete protected branches by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, click **Add rule**.\n5. If you add the rule, under \"Branch name pattern\", type the branch name or pattern you want to protect.\n6. Uncheck **Allow deletions**.\n7. Click **Create** or **Save changes**.",
+ "AuditProcedure": "For each repository that is being used, verify that protected branches cannot be deleted by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", verify that there is at least one rule for your main branch. If there is, click **Edit** to its right. If there isn't, you are not compliant.\n5. Ensure that **Allow deletions** is not checked.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.18",
+ "Description": "Ensure that every pull request is required to be scanned for risks.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that every pull request is required to be scanned for risks.",
+ "RationaleStatement": "Scanning pull requests to detect risks allows for early detection of vulnerable code and/or dependencies and helps mitigate potentially malicious code.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every repository in use, enforce risk scanning on every pull request by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Actions**.\n3. If the repository already has at least one workflow set up and running, click **New workflow** and go to step 5. If there are currently no workflows configured for the repository, go to the next step.\n4. Scroll down to the \"Security\" category and click **Configure** under the workflow you want to configure or click **View all** to see all available security workflows.\n5. On the right pane of the workflow page, click **Documentation** and follow the on-screen instructions to tailor the workflow to your needs.",
+ "AuditProcedure": "For each repository in use, ensure that every pull request must be scanned for risks by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Actions**.\n3. Ensure that at least one workflow is configured to run like that: \n```\non:\n push:\n branches: [ \"main\" ]\n pull_request:\n branches: [ \"main\" ]\n```\nand that it has a step that runs code scanning on the code.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.19",
+ "Description": "Ensure that changes in the branch protection rules are audited.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that changes in the branch protection rules are audited.",
+ "RationaleStatement": "Branch protection rules should be configured on every repository. The only users who may change such rules are administrators. In a case of an attack on an administrator account or of human error on the part of an administrator, protection rules could be disabled, and thus decrease source code confidentiality as a result. It is important to track and audit such changes to prevent potential incidents as soon as possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Use the audit log to audit changes in branch protection rules by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n4. Use the action qualifier in your query and look for **protected_branch** category. Ensure every action is reasonable and secure and investigate if not.",
+ "AuditProcedure": "Ensure changes in branch protection rules are audited by performing the following regularly:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n4. Use the action qualifier in your query and look for **protected_branch** category. Ensure every action is reasonable and secure and is investigated if not.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.1.20",
+ "Description": "Enforce branch protection on the default and main branch.",
+ "Checks": [
+ "repository_default_branch_protection_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.1 Code Changes",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Enforce branch protection on the default and main branch.",
+ "RationaleStatement": "The default or main branch of repositories is considered very important, as it is eventually gets deployed to the production. Therefore it needs protection. By enforcing branch protection rules on this branch, it is secured from unwanted or unauthorized changes. It can also be protected from untested and unreviewed changes and more.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Perform the following to enforce branch protection on the main branch:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Next to \"Branch protection rules\", click **Add rule**.\n5. Under \"Branch name pattern\", type the branch name or pattern you want to protect. Ensure it applies to the main branch name.\n6. Configure policies you want.\n7. Click Create.",
+ "AuditProcedure": "Perform the following to ensure branch protection is enforced on the main branch:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Code and automation\" section of the sidebar, click **Branches**.\n4. Under **Branch protection rules**, verify that there is a rule applied to the \"main\" or default branch.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.2.1",
+ "Description": "A SECURITY.md file is a security policy file that offers instruction on reporting security vulnerabilities in a project. When someone creates an issue within a specific project, a link to the SECURITY.md file will subsequently be shown.",
+ "Checks": [
+ "repository_public_has_securitymd_file"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "A SECURITY.md file is a security policy file that offers instruction on reporting security vulnerabilities in a project. When someone creates an issue within a specific project, a link to the SECURITY.md file will subsequently be shown.",
+ "RationaleStatement": "A SECURITY.md file provides users with crucial security information. It can also serve an important role in project maintenance, encouraging users to think ahead about how to properly handle potential security issues, updates, and general security practices.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Enforce that each public repository has a SECURITY.md file by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under the repository name, click **Security**.\n3. In the left sidebar, click **Security policy**.\n4. Click **Start setup**.\n5. In the new SECURITY.md file, add information about supported versions of your project and how to report a vulnerability.\n6. At the bottom of the page, type a commit message.\n7. Below the commit message fields, choose to create a new branch for your commit and then create a pull request.\n8. Click **Propose file change**.",
+ "AuditProcedure": "Verify that each public repository has a SECURITY.md file by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under the repository name, click **Security**.\n3. Verify that **Security policy** is enabled.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.2.2",
+ "Description": "Limit the ability to create repositories to trusted users and teams.",
+ "Checks": [
+ "organization_repository_creation_limited"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Limit the ability to create repositories to trusted users and teams.",
+ "RationaleStatement": "Restricting repository creation to trusted users and teams is recommended in order to keep the organization properly structured, track fewer items, prevent impersonation, and to not overload the version-control system. It will allow administrators easier source code tracking and management capabilities, as they will have fewer repositories to track. The process of detecting potential attacks also becomes far more straightforward, as well, since the easier it is to track the source code, the easier it is to detect malicious acts within it. Additionally, the possibility of a member creating a public repository and sharing the organization's data externally is significantly decreased.",
+ "ImpactStatement": "Specific users will not be permitted to create repositories.",
+ "RemediationProcedure": "Restrict repository creation to trusted users and teams only by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Repository creation\", unselect both options - **Public** and **Private**.\n5. Click **Save**.",
+ "AuditProcedure": "Verify that only trusted users and teams can create repositories by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Repository creation\", ensure that **Public** and **Private** are not checked. This means only owners are able to create repositories.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.2.3",
+ "Description": "Ensure only a limited number of trusted users can delete repositories.",
+ "Checks": [
+ "organization_repository_deletion_limited"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure only a limited number of trusted users can delete repositories.",
+ "RationaleStatement": "Restricting the ability to delete repositories protects the organization from intentional and unintentional data loss. This ensures that users cannot delete repositories or cause other potential damage — whether by accident or due to their account being hacked — unless they have the correct privileges.",
+ "ImpactStatement": "Certain users will not be permitted to delete repositories.",
+ "RemediationProcedure": "Enforce repository deletion by a few trusted and responsible users only by performing either of the following steps:\n\nIf Your organizations > Settings > Access > Member privileges > Allow members to delete or transfer repositories for this organization is selected, allow only trusted members to have admin privileges:\n1. In every repository, on GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Change their role by clicking the **Role** dropdown next to the username until there are only two trusted and qualified users with admin privileges. \n\nIf it is not selected, allow only trusted users to become an organization owner:\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click the name of your organization and under your organization name, click **People**.\n3. You will see a list of the people in your organization. Click Role and select Owners. Check every member you want to change permissions to. Above the list of members, use the drop-down menu and click Change role and choose Member > change role. Do that until there are only a few trusted and qualified users with organization owner privileges. \n\nIn any case, only members with administrator or organization owner privileges can delete repositories, regardless of your setting.",
+ "AuditProcedure": "Verify that only a limited number of trusted users can delete repositories by performing either of the following steps:\n\nIf Your organizations > Settings > Access > Member privileges > Allow members to delete or transfer repositories for this organization is selected, verify that every admin member is trusted by you:\n1. In every repository, on GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Verify that there are only two of them and that they are trusted and qualified. \n\nIf it is not selected, verify that every organization owner is trusted by you:\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click the name of your organization and under your organization name, click **People**.\n3. You will see a list of the people in your organization. Click Role and select Owners. Verify that there are only a few of them and that they are trusted and qualified. \n\nIn any case, only members with administrator or organization owner privileges can delete repositories, regardless of your setting.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Only organization owners or members with admin privileges can delete repositories."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.4",
+ "Description": "Ensure only trusted and responsible users can delete issues.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure only trusted and responsible users can delete issues.",
+ "RationaleStatement": "Issues are a way to keep track of things happening in repositories, such as setting new milestones or requesting urgent fixes. Deleting an issue is not a benign activity, as it might harm the development workflow or attempt to hide malicious behavior. Because of this, it should be restricted and allowed only by trusted and responsible users.",
+ "ImpactStatement": "Certain users will not be permitted to delete issues.",
+ "RemediationProcedure": "Restrict issue deletion to a few trusted and responsible users only by performing either of the following steps:\n\nIf Your organizations > Settings > Access > Member privileges > Allow members to delete issues for this organization is selected, allow only trusted members to have admin privileges:\n1. In every repository, on GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Change their role by clicking the **Role** dropdown next to the username until there are only two trusted and qualified users with admin privileges.\n\nIf it is not selected, allow only trusted users to become an organization owner:\n1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations.\n2. Click the name of your organization and under your organization name, click **People**.\n3. You will see a list of the people in your organization. Click **Role** and select **Owners**. Check every member you want to change permissions to. Above the list of members, use the drop-down menu and click **Change role** and choose Member > change role. Do that until there are only a few trusted and qualified users with organization owner privileges.\n\nIn any case, only members with administrator or organization owner privileges can delete issues, regardless of your setting.",
+ "AuditProcedure": "Verify that only a limited number of trusted users can delete issues by performing either of the following steps:\n\nIf Your organizations > Settings > Access > Member privileges > Allow members to delete issues for this organization is selected, verify that every admin member is trusted by you:\n1. In every repository, on GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings** and then in the \"Access\" section of the sidebar, click **Collaborators & teams**.\n3. Under \"Manage access\" use the dropdown **Role** menu to filter and search for admin members. Verify that there are only two of them and that they are trusted and qualified.\n\nIf it is not selected, verify that every organization owner is trusted by you:\n1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations.\n2. Click the name of your organization and under your organization name, click **People**.\n3. You will see a list of the people in your organization. Click **Role** and select **Owners**. Verify that there are only a few of them and that they are trusted and qualified.\n\nIn any case, only members with administrator or organization owner privileges can delete issues, regardless of your setting.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Only organization owners or members with admin privileges can delete issues."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.5",
+ "Description": "Track every fork of code and ensure it is accounted for.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Track every fork of code and ensure it is accounted for.",
+ "RationaleStatement": "A fork is a copy of a repository. On top of being a plain copy, any updates to the original repository itself can be pulled and reflected by the fork under certain conditions. A large number of repository copies (forks) become difficult to manage and properly secure. New and sensitive changes can often be pushed into a critical repository without developer knowledge of an updated copy of the very same repository. If there is no limit on doing this, then it is recommended to track and delete copies of organization repositories as needed.",
+ "ImpactStatement": "Disabling forks completely may slow down the development process as more actions will be necessary to take in order to fork a repository.",
+ "RemediationProcedure": "Track forks and examine them by performing the following on a regular basis:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Insights**.\n3. In the left sidebar, click **Forks**.\n4. Examine the forks listed there.",
+ "AuditProcedure": "Verify that the following steps are done regularly to track and examine forks:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Insights**.\n3. In the left sidebar, click **Forks**.\n4. Examine the forks listed there.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.2.6",
+ "Description": "Ensure every change in visibility of projects is tracked.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure every change in visibility of projects is tracked.",
+ "RationaleStatement": "Visibility of projects determines who can access a project and/or fork it: anyone, designated users, or only members of the organization. If a private project becomes public, this may point to a potential attack, which can ultimately lead to data loss, the leaking of sensitive information, and finally to a supply chain attack. It is crucial to track these changes in order to prevent such incidents.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Track every change in project visibility and investigate if suspicious behavior occurs, by performing the following regularly:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n4. Use the **repo** qualifier in your query and look for **access** category. Ensure every change is reasonable and secure and investigate if it is not.",
+ "AuditProcedure": "Ensure that every change in project visibility is tracked and investigated, by performing the following regularly:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Archives\" section of the sidebar, click **Logs**, then click **Audit log**.\n4. Use the **repo** qualifier in your query and look for **access** category. Ensure every change is reasonable and secure and is investigated if it is not.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.2.7",
+ "Description": "Track inactive repositories and remove them periodically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.2 Repository Management",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Track inactive repositories and remove them periodically.",
+ "RationaleStatement": "Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. These repositories are more likely to be improperly managed, and thus could possibly be accessed by a large number of users in an organization.",
+ "ImpactStatement": "Bug fixes and deployment of necessary changes could prove complicated for archived repositories.",
+ "RemediationProcedure": "Perform the following to review all inactive repositories and archive them periodically:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click on your organization name and then on **repositories**.\n3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps:\n 1. On GitHub.com, navigate to the main page of the repository.\n 2. Under your repository name, click **Settings**.\n 3. Under \"Danger Zone\", click **Archive this repository**.\n 4. Read the warnings.\n 5. Type the name of the repository you want to archive.\n 6. Click **I understand the consequences, archive this repository**.",
+ "AuditProcedure": "Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click on your organization name and then on **repositories**.\n3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.1",
+ "Description": "Track inactive user accounts and periodically remove them.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Track inactive user accounts and periodically remove them.",
+ "RationaleStatement": "User accounts that have been inactive for a long period of time are enlarging the surface of attack. Inactive users with high-level privileges are of particular concern, as these accounts are more likely to be targets for attackers. This could potentially allow access to large portions of an organization should such an attack prove successful. It is recommended to remove them as soon as possible in order to prevent this.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If you have GitHub Enterprise Cloud, perform the following:\n\n1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n2. In the list of enterprises, click the enterprise you want to view.\n3. In the enterprise account sidebar, click **Compliance**.\n4. To download your Dormant Users (beta) report as a CSV file, under \"Other\", click **Download**.\n5. Find the users listed in the file under **Your organizations** > your organization > **People** and select them.\n6. Click **Remove from organization** and **Remove members**.",
+ "AuditProcedure": "If you have GitHub Enterprise Cloud, perform the following:\n\n1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n2. In the list of enterprises, click the enterprise you want to view.\n3. In the enterprise account sidebar, click **Compliance**.\n4. To download your Dormant Users (beta) report as a CSV file, under \"Other\", click **Download**.\n5. Verify that there are no users listed.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.2",
+ "Description": "Limit ability to create teams to trusted and specific users.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Limit ability to create teams to trusted and specific users.",
+ "RationaleStatement": "The ability to create new teams should be restricted to specific members in order to keep the organization orderly and ensure users have access to only the lowest privilege level necessary. Teams typically inherit permissions from their parent team, thus if base permissions are less restricted and any user has the ability to create a team, a permission leverage could occur in which certain data is made available to users who should not have access to it. Such a situation could potentially lead to the creation of shadow teams by an attacker. Restricting team creation will also reduce additional clutter in the organizational structure, and as a result will make it easier to track changes and anomalies.",
+ "ImpactStatement": "Only specific users will be able to create new teams.",
+ "RemediationProcedure": "For every organization, limit team creation to specific, trusted users by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Team creation rules\", deselect **Allow members to create teams**.\n5. Click **Save**.",
+ "AuditProcedure": "For every organization, ensure that team creation is limited to specific, trusted users by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Team creation rules\", verify that **Allow members to create teams** is not selected.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.3",
+ "Description": "Ensure the organization has a minimum number of administrators.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure the organization has a minimum number of administrators.",
+ "RationaleStatement": "Organization administrators have the highest level of permissions, including the ability to add/remove collaborators, create or delete repositories, change branch protection policy, and convert to a publicly-accessible repository. Due to the permissive access granted to an organization administrator, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set the minimum number of administrators in your organization by performing the following:\n\n1. In the top right corner of GitHub, click your profile photo, then click **Your profile**.\n2. On the left side of your profile page, under \"Organizations\", click the icon for your organization.\n3. Under your organization name, click **People**. \n4. In the Role drop-down, choose **Owners**.\n5. Select the person or people you'd like to remove from owner role.\n6. Above the list of members, use the drop-down menu and click Change role.\n7. Select **Member**, then click **Change role**.",
+ "AuditProcedure": "Verify the minimum number of administrators in your organization by performing the following:\n\n1. In the top right corner of GitHub, click your profile photo, then click **Your profile**.\n2. On the left side of your profile page, under \"Organizations\", click the icon for your organization.\n3. Under your organization name, click **People**. \n4. In the Role drop-down, choose **Owners**.\n5. If there are minimum number of members in the list, you are compliant.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.4",
+ "Description": "Require collaborators from outside the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+ "Checks": [
+ "organization_members_mfa_required"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Require collaborators from outside the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+ "RationaleStatement": "By default every user authenticates within the system by password only. If the password of a user is compromised, however, the user account and every repository to which they have access are in danger of data loss, malicious code commits, and data theft. It is therefore recommended that each user has Multi-Factor Authentication enabled. This adds an additional layer of protection to ensure the account remains secure even if the user's password is compromised.",
+ "ImpactStatement": "A member without enabled Multi-Factor Authentication cannot contribute to the project. They must enable Multi-Factor Authentication a before they can contribute any code.",
+ "RemediationProcedure": "For each repository in use, enforce Multi-Factor Authentication is the only way to authenticate for contributors, by doing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Under \"Authentication\", select **Require two-factor authentication for everyone in your organization**, then click **Save**.",
+ "AuditProcedure": "For each repository in use, verify that Multi-Factor Authentication is enforced for contributors and is the only way to authenticate, by doing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Under \"Authentication\", check if **Require two-factor authentication for everyone in your organization** is checked. If so, you are compliant.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.5",
+ "Description": "Require members of the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+ "Checks": [
+ "organization_members_mfa_required"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Require members of the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform.",
+ "RationaleStatement": "By default every user authenticates within the system by password only. If the password of a user is compromised, however, the user account and every repository to which they have access are in danger of data loss, malicious code commits, and data theft. It is therefore recommended that each user has Multi-Factor Authentication enabled. This adds an additional layer of protection to ensure the account remains secure even if the user's password is compromised.",
+ "ImpactStatement": "Members will be removed from the organization if they don't have Multi-Factor Authentication already enabled. If this is the case, it is recommended that an invitation be sent to reinstate the user's access and former privileges. They must enable Multi-Factor Authentication to accept the invitation.",
+ "RemediationProcedure": "For every organization that exists in your GitHub platform, enforce Multi-Factor Authentication and define it as the only way to authenticate, by doing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Under \"Authentication\", select **Require two-factor authentication for everyone in your organization**, then click **Save**.\n5. If prompted, read the information about members and outside collaborators who will be removed from the organization. Type your organization's name to confirm the change, then click **Remove members & require two-factor authentication**.",
+ "AuditProcedure": "For every organization that exists in your GitHub platform, verify that Multi-Factor Authentication is enforced and is the only way to authenticate, by doing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Under \"Authentication\", check if **Require two-factor authentication for everyone in your organization** is checked. If so, you are compliant.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.6",
+ "Description": "Existing members of an organization can invite new members to join, however new members must only be invited with their company-approved email.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Existing members of an organization can invite new members to join, however new members must only be invited with their company-approved email.",
+ "RationaleStatement": "Ensuring new members of an organization have company-approved email prevents existing members of the organization from inviting arbitrary new users to join. Without this verification, they can invite anyone who is using the organization's version control system or has an active email account, thus allowing outside users (and potential threat actors) to easily gain access to company private code and resources. This practice will subsequently reduce the chance of human error or typos when inviting a new member.",
+ "ImpactStatement": "Existing members would not be able to invite new users who do not have a company-approved email address.",
+ "RemediationProcedure": "For each organization, allow only users with company-approved email to be invited. If a user was invited without company-approved email, perform the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click the name of your organization and under your organization name, click **People**.\n3. On the People tab, click **Invitations**. Next to the username or email address of the person whose invitation you'd like to cancel, click **Edit invitation**.\n4. To cancel the user's invitation to join your organization, click **Cancel invitation**.",
+ "AuditProcedure": "For each organization in use, verify for every invitation that the invited email address is company-approved by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Click the name of your organization and under your organization name, click **People**.\n3. On the People tab, click **Invitations**. Verify that each invitation email is company approved by your company.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.7",
+ "Description": "Ensure every repository has two users with administrative permissions.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure every repository has two users with administrative permissions.",
+ "RationaleStatement": "Repository administrators have the highest permissions to said repository. These include the ability to add/remove collaborators, change branch protection policy, and convert to a publicly-accessible repository. Due to the liberal access granted to a repository administrator, it is highly recommended that only two contributors occupy this role.",
+ "ImpactStatement": "Removing administrative users from a repository would result in them losing high-level access to that repository.",
+ "RemediationProcedure": "For every repository in use, set two administrators by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Collaborators & teams**.\n4. Under **Manage access**, find the team or person whose you'd like to revoke admin permissions, then select the Role drop-down and click a new role.",
+ "AuditProcedure": "For every repository in use, verify there are two administrators by performing the following:\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Collaborators & teams**.\n4. Under **Manage access**, verify that there are only 2 members with Admin permission.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.8",
+ "Description": "Base permissions define the permission level automatically granted to all organization members. Define strict base access permissions for all of the repositories in the organization, including new ones.",
+ "Checks": [
+ "organization_default_repository_permission_strict"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Base permissions define the permission level automatically granted to all organization members. Define strict base access permissions for all of the repositories in the organization, including new ones.",
+ "RationaleStatement": "Defining strict base permissions is the best practice in every role-based access control (RBAC) system. If the base permission is high — for example, \"write\" permission — every member of the organization will have \"write\" permission to every repository in the organization. This will apply regardless of the specific permissions a user might need, which generally differ between organization repositories. The higher the permission, the higher the risk for incidents such as bad code commit or data breach. It is therefore recommended to set the base permissions to the strictest level possible.",
+ "ImpactStatement": "Users might not be able to access organization repositories or perform some acts as commits. These specific permissions should be granted individually for each user or team, as needed.",
+ "RemediationProcedure": "Set strict base permissions for the organization repositories with the next steps:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Base permissions\", use the drop-down to select new base permissions - \"Read\" or \"None\".\n5. Review the changes. To confirm, click **Change default permission to PERMISSION**.",
+ "AuditProcedure": "Verify that strict base permissions are set for the organization repositories by doing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Access\" section of the sidebar, click **Member privileges**.\n4. Under \"Base permissions\", verify that it is set to \"Read\" or \"None\". If it does, you are compliant.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Read permission"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.9",
+ "Description": "Confirm the domains an organization owns with a \"Verified\" badge.",
+ "Checks": [
+ "organization_verified_badge"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Confirm the domains an organization owns with a \"Verified\" badge.",
+ "RationaleStatement": "Verifying the organization's domain gives developers assurance that a given domain is truly the official home for a public organization. Attackers can pretend to be an organization and steal information via a faked/spoof domain, therefore the use of a \"Verified\" badge instills more confidence and trust between developers and the open-source community.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Only if you have an enterprise account, verify the organization's domains and secure a \"Verified\" badge next to its name by performing the following:\n\n1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n3. Under \"Settings\", click **Verified & approved domains**.\n4. Click **Add a domain**.\n5. In the domain field, type the domain you'd like to verify, then click **Add domain**.\n6. Follow the instructions under **Add a DNS TXT record** to create a DNS TXT record with your domain hosting service. Wait for your DNS configuration to change, which may take up to 72 hours. You can confirm your DNS configuration has changed by running the `dig` command on the command line, replacing ENTERPRISE-ACCOUNT with the name of your enterprise account, and example.com with the domain you'd like to verify. You should see your new TXT record listed in the command output.\n```\ndig _github-challenge-ENTERPRISE-ACCOUNT.DOMAIN-NAME +nostats +nocomments +nocmd TXT\n```\n7. After confirming your TXT record is added to your DNS, follow steps one through three above to navigate to your enterprise account's approved and verified domains.\n8. To the right of the domain that's pending verification, click the 3-dots, then click **Continue verifying**. Click **Verify**.\n9. Optionally, after the \"Verified\" badge is visible on your organizations' profiles, delete the TXT entry from the DNS record at your domain hosting service.",
+ "AuditProcedure": "Only if you have an enterprise account, view the enterprise organization profile page and ensure it has a \"Verified\" badge in it.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.10",
+ "Description": "Restrict the Source Code Management (SCM) organization's email notifications to approved domains only.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Restrict the Source Code Management (SCM) organization's email notifications to approved domains only.",
+ "RationaleStatement": "Restricting Source Code Management email notifications to verified domains only prevents data leaks, as personal emails and custom domains are more prone to account takeover via DNS hijacking or password breach.",
+ "ImpactStatement": "Only members with approved email would be able to receive Source Code Management notifications.",
+ "RemediationProcedure": "Only if you have an enterprise account, restrict Source Code Management email notifications to approved domains only by performing the following:\n\n1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n3. Under \"Settings\", click **Verified & approved domains**.\n4. Under \"Notification preferences\", select **Restrict email notifications to only approved or verified domains**.\n5. Click **Save**.",
+ "AuditProcedure": "Only if you have an enterprise account, ensure Source Code Management email notifications are restricted to approved domains only by performing the following:\n\n1. In the top-right corner of GitHub.com, click your profile photo, then click **Your enterprises**.\n2. In the list of enterprises, click the enterprise you want to view. Then in the enterprise account sidebar, click **Settings**.\n3. Under \"Settings\", click **Verified & approved domains**.\n4. Under \"Notification preferences\", verify that **Restrict email notifications to only approved or verified domains** is selected.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.11",
+ "Description": "As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "As an organization, become an SSH Certificate Authority and provide SSH keys for accessing repositories.",
+ "RationaleStatement": "There are two ways for remotely working with Source Code Management: via HTTPS, which requires authentication by user/password, or via SSH, which requires the use of SSH keys. SSH authentication is better in terms of security; key creation and distribution, however, must be done in a secure manner. This can be accomplished by implementing SSH certificates, which are used to validate the server's identity. A developer will not be able to connect to a Git server if its key cannot be verified by the SSH Certificate Authority (CA) server.\nAs an organization, one can verify the SSH certificate signature used to authenticate if a CA is defined and used. This ensures that only verified developers can access organization repositories, as their SSH key will be the only one signed by the CA certificate. This reduces the risk of misuse and malicious code commits.",
+ "ImpactStatement": "Members with unverified keys will not be able to clone organization repositories. Signing, certification, and verification might also slow down the development process.",
+ "RemediationProcedure": "Only if you have an enterprise account, deploy an SSH Certificate Authority server and configure it to provide an SSH certificate with which to sign keys by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. To the right of \"SSH Certificate Authorities\", click **New CA**.\n5. Under \"Key,\" paste your public SSH key.\n6. Click **Add CA**.\n7. Click **Save**.",
+ "AuditProcedure": "Only if you have an enterprise account, verify that the enterprise organization has an SSH Certificate Authority server and provides an SSH certificate with which to sign keys by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Verify that there's an SSH certificate authority listed there.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.12",
+ "Description": "Limit Git access based on IP addresses by having a allowlist of IP addresses from which connection is possible.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Limit Git access based on IP addresses by having a allowlist of IP addresses from which connection is possible.",
+ "RationaleStatement": "Allowing access to Git repositories (source code) only from specific IP addresses adds yet another layer of restriction and reduces the risk of unauthorized connection to the organization's assets. This will prevent attackers from accessing Source Code Management (SCM), as they would first need to know the allowed IP addresses to gain access to them.",
+ "ImpactStatement": "Only members with allowlisted IP addresses will be able to access the organization's Git repositories.",
+ "RemediationProcedure": "Only if you have an enterprise account, create an IP allowlist and forbid all other IPs from accessing the source code by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. At the bottom of the \"IP allow list\" section, enter an IP address, or a range of addresses in CIDR notation. Optionally, enter a description of the allowed IP address or range.\n5. Click **Add**.\n6. After that, under \"IP allow list\", select **Enable IP allow list**.\n7. Click **Save**.",
+ "AuditProcedure": "Only if you have an enterprise account, in every organization of yours, ensure access is allowed only by IP allowlist, and that access is forbidden for all other IPs by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Authentication security**.\n4. Verify that there's an IP address, or a range of addresses in CIDR notation listed. Also verify that **Enable IP allow list** is selected.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.3.13",
+ "Description": "Track code anomalies.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.3 Contribution Access",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Track code anomalies.",
+ "RationaleStatement": "Carefully analyze any code anomalies within the organization. For example, a code anomaly could be a push made outside of working hours. Such a code push has a higher likelihood of being the result of an attack, as most if not all members of the organization would likely be outside the office. Another example is an activity that exceeds the average activity of a particular user.\nTracking and auditing such behaviors creates additional layers of security and can aid in early detection of potential attacks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every repository in use, track and investigate anomalous code behavior and activity.",
+ "AuditProcedure": "For every repository in use, ensure code anomalies relevant to the organization are promptly investigated.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.4.1",
+ "Description": "Ensure an administrator approval is required when installing applications.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.4 Third-Party",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure an administrator approval is required when installing applications.",
+ "RationaleStatement": "Applications are typically automated integrations that improve the workflow of an organization. They are written by third-party developers, and therefore should be validated before using in case they're malicious or not trustable. Because administrators are expected to be the most qualified and trusted members of the organization, they should review the applications being installed and decide whether they are both trusted and necessary.",
+ "ImpactStatement": "Applications will not be installed without administrator approval.",
+ "RemediationProcedure": "Require an administrator approval for every installed application:\n\na. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them.\n\nb. For OAuth Apps, perform the following:\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Third-party Access\" section of the sidebar, click **OAuth application policy**.\n4. Under \"Third-party application access policy\", click **Setup application access restrictions**.\n5. After you review the information about third-party access restrictions, click **Restrict third-party application access**.",
+ "AuditProcedure": "Verify that applications are installed only after receiving administrator approval:\n\na. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them.\n\nb. For OAuth Apps, perform the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Third-party Access\" section of the sidebar, click **OAuth application policy**.\n4. Under \"Third-party application access policy\" verify that the policy status is **Access restricted**.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Maintainers are organization owners."
+ }
+ ]
+ },
+ {
+ "Id": "1.4.2",
+ "Description": "Ensure stale (inactive) applications are reviewed and removed if no longer in use.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.4 Third-Party",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure stale (inactive) applications are reviewed and removed if no longer in use.",
+ "RationaleStatement": "Applications that have been inactive for a long period of time are enlarging the surface of attack for data leaks. They are more likely to be improperly managed, and could possibly be accessed by third-party developers as a tool for collecting internal data of the organization or repository in which they are installed. It is important to remove these inactive applications as soon as possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Review all stale applications and periodically remove them.",
+ "AuditProcedure": "Verify that all the applications in the organization are actively used, and remove those that are no longer in use.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.4.3",
+ "Description": "Ensure installed application permissions are limited to the lowest privilege level required.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.4 Third-Party",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure installed application permissions are limited to the lowest privilege level required.",
+ "RationaleStatement": "Applications are typically automated integrations that can improve the workflow of an organization. They are written by third-party developers, and therefore should be reviewed carefully before use. It is recommended to use the \"least privilege\" principle, granting applications the lowest level of permissions required. This may prevent harm from a potentially malicious application with unnecessarily high-level permissions leaking data or modifying source code.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Grant permissions to applications by the \"least privilege\" principle, meaning the lowest possible permission necessary:\n\na. For GitHub Apps, perform the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Integrations\" section of the sidebar, click **GitHub Apps**.\n4. Next to every GitHub App, click **Configure**.\n5. Review the GitHub App's permissions and repository access. Edit the permissions granted to the least possible. For example, restrict the number of repositories the App can access.\n6. Click **Save**.",
+ "AuditProcedure": "Verify that each installed application has the least privilege needed:\n\na. For GitHub Apps, perform the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the \"Integrations\" section of the sidebar, click **GitHub Apps**.\n4. Next to every GitHub App, click **Configure**.\n5. Review the GitHub App's permissions and repository access. Verify that the App permissions are the least possible and that it can access only necessary repositories.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.4.4",
+ "Description": "Use only secured webhooks in the source code management platform.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.4 Third-Party",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use only secured webhooks in the source code management platform.",
+ "RationaleStatement": "A webhook is an event listener, attached to critical and sensitive parts of the software delivery process. It is triggered by a list of events (such as a new code being committed), and when triggered, the webhook sends out a notification with some payload to specific internet endpoints. Since the payload of the webhook contains sensitive organization data, it's important all webhooks are directed to an endpoint (URL) protected by SSL verification (HTTPS). This helps ensure that the data sent is delivered to securely without any man-in-the-middle, who could easily access and even alter the payload of the request.",
+ "ImpactStatement": "Perform the following to ensure all webhooks used are secured (HTTPS):\n\n1. Navigate to your organization or repository and select **Settings**.\n2. Select **Webhooks** on the side menu.\n3. Verify that each webhook URL starts with 'https'.",
+ "RemediationProcedure": "Perform the following to secure all webhooks used(over HTTPS):\n\n1. Navigate to your organization or repository and select **Settings**.\n2. Select **Webhooks** on the side menu.\n3. Find the webhooks that starts with 'http' and not 'https'.\n4. Ensure the endpoint (URL) of the webhook listens to secured port (443) and uses certificate.\n5. Click **Edit**.\n6. Change the payload URL to https and ensure **Enable SSL verification** is checked.\n7. Click **Update webhook**.",
+ "AuditProcedure": "Perform the following to secure all webhooks used(over HTTPS):\n\n1. Navigate to your organization or repository and select **Settings**.\n2. Select **Webhooks** on the side menu.\n3. Ensure all webhooks starts with 'https'.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.1",
+ "Description": "Detect and prevent sensitive data in code, such as confidential ID numbers, passwords, etc.",
+ "Checks": [
+ "repository_secret_scanning_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent sensitive data in code, such as confidential ID numbers, passwords, etc.",
+ "RationaleStatement": "Having sensitive data in the source code makes it easier for attackers to maliciously use such information. In order to avoid this, designate scanners to identify and prevent the existence of sensitive data in the code.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every repository in use, designate scanners to identify and prevent sensitive data in code by performing the following (enterprise only):\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n4. Scroll down to the bottom of the page and click **Enable** for secret scanning.",
+ "AuditProcedure": "For every repository in use, verify that scanners are set to identify and prevent the existence of sensitive data in code by performing the following (enterprise only):\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n4. Scroll down to the bottom of the page. If you see a **Disable** button, it means that secret scanning is already enabled for the repository.",
+ "AdditionalInformation": "By January 2023, this feature is supposed to be open to all plans. Until then it is only for enterprise users.",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.2",
+ "Description": "Detect and prevent misconfigurations and insecure instructions in CI pipelines",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent misconfigurations and insecure instructions in CI pipelines",
+ "RationaleStatement": "Detecting and fixing misconfigurations or insecure instructions in CI pipelines decreases the risk for a successful attack through or on the CI pipeline. The more secure the pipeline, the less risk there is for potential exposure of sensitive data, a deployment being compromised, or external access mistakenly being granted to the CI infrastructure or the source code.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set a CI instructions scanning tool to identify and prevent misconfigurations and insecure instructions and scans all CI pipelines.",
+ "AuditProcedure": "Verify that a CI instructions scanning tool is set to identify and prevent misconfigurations and insecure instructions and that it scans all CI pipelines.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.3",
+ "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+ "RationaleStatement": "Detecting and fixing misconfigurations and/or insecure instructions in IaC (Infrastructure as Code) files decreases the risk for data leak or data theft. It is important to secure IaC instructions in order to prevent further problems of deployment, exposed assets, or improper configurations, which can ultimately lead to easier ways to attack and steal organization data.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every repository that holds IaC instructions files, set a scanning tool to identify and prevent misconfigurations and insecure instructions.",
+ "AuditProcedure": "For every repository that holds IaC instructions files, verify that a scanning tool is set to identify and prevent misconfigurations and insecure instructions.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.4",
+ "Description": "Detect and prevent known open source vulnerabilities in the code.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent known open source vulnerabilities in the code.",
+ "RationaleStatement": "Open source code blocks are used a lot in developed software. This has its own advantages, but it also has risks. Because the code is open for everyone, it means that attackers can publish or add malicious code to these open-source code blocks, or use their knowledge to find vulnerabilities in an existing code. Detecting and fixing such code vulnerabilities, by SCA (Software Composition Analysis) prevents insecure flaws from reaching production. It gives another opportunity for developers to secure the source code before it is deployed in production, where it is far more exposed and vulnerable to attacks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every repository that is in use, set a scanning tool to identify and prevent code vulnerabilities by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under the repository name, click **Security**.\n3. To the right of \"Code scanning alerts\", click **Set up code scanning**.\n4. Under \"Get started with code scanning\", click Set up this workflow on a workflow of your choice.\n5. To customize how code scanning scans your code, edit the workflow.\n6. Use the **Start commit** drop-down and type a commit message.\n7. Choose whether you'd like to commit directly to the default branch or create a new branch and start a pull request.\n8. Click **Commit new file** or **Propose new file**.",
+ "AuditProcedure": "For every repository that is in use, verify that a scanning tool is set to identify and prevent code vulnerabilities by performing the following:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under the repository name, click **Security**.\n3. Verify that \"Code scanning alerts\" is **Enabled** or that there is a workflow that scans your code.",
+ "AdditionalInformation": "All public repositories in all plans can use code scanning in GitHub. In private repositories, only GitHub Enterprise can use code scanning.",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.5",
+ "Description": "Detect, prevent and monitor known open-source vulnerabilities in packages that are being used.",
+ "Checks": [
+ "repository_dependency_scanning_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect, prevent and monitor known open-source vulnerabilities in packages that are being used.",
+ "RationaleStatement": "Open-source vulnerabilities might exist before one starts to use a package, but they are also discovered over time. New attacks and vulnerabilities are announced every now and then. It is important to keep track of these and to monitor whether the dependencies used are affected by the recent vulnerability. Detecting and fixing those packages' vulnerabilities decreases the attack surface within deployed and running applications that use such packages. It prevents security flaws from reaching the production environment which could eventually lead to a security breach.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set scanners that will monitor, identify, and prevent open-source vulnerabilities in packages by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n3. Under \"Code security and analysis\", to the right of Dependabot alerts, click **Disable all** or **Enable all**.\n4. Check the **Enable by default for new repositories** option and then click **Enable Dependabot alerts**.\n\nIt is also recommended to use another additional solution for package scanning because GitHub doesn't always recognize the vulnerabilities.",
+ "AuditProcedure": "Verify that scanners are set to monitor, identify, and prevent open-source vulnerabilities in packages by performing the following:\n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**. In the \"Security\" section of the sidebar, click **Code security and analysis**.\n3. Verify that the Dependabot alerts is enabled and that **Enable by default for new repositories** is checked.\n\nIt is also recommended to verify that you're using another additional solution for package scanning because GitHub doesn't always recognize the vulnerabilities.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "1.5.6",
+ "Description": "Detect open-source license problems in used dependencies and fix them.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Source Code",
+ "Subsection": "1.5 Code Risks",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect open-source license problems in used dependencies and fix them.",
+ "RationaleStatement": "A software license is a legal document that establishes several key conditions between a software company or developer and a user in order to allow the use of software. Software licenses have the potential to create code dependencies. Not following the conditions in the software license can also lead to lawsuits. When using packages with a software license, especially commercial ones (which are the most permissive), it is important to verify what is allowed by that license in order to be protected against lawsuits.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Designate a license scanning tool to identify open-source license problems and fix them and scan every package you use.",
+ "AuditProcedure": "Ensure a license scanning tool is set up to identify open-source license problems and that every package you use is scanned by it.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.1",
+ "Description": "Ensure each pipeline has a single responsibility in the build process.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure each pipeline has a single responsibility in the build process.",
+ "RationaleStatement": "Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase, etc. Limiting access to these credentials/secrets is therefore recommended by dividing pipeline responsibilities, as well as having a dedicated pipeline for each phase with the lowest privilege instead of a single pipeline for all. This will ensure that any potential damage caused by attacks on a workflow will be limited.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.",
+ "AuditProcedure": "For each pipeline, ensure it has only one responsibility in the build process.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.2",
+ "Description": "Ensure the pipeline orchestrator and its configuration are immutable.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure the pipeline orchestrator and its configuration are immutable.",
+ "RationaleStatement": "An immutable infrastructure is one that cannot be changed during execution of the pipeline. This can be done, for example, by using Infrastructure as Code for configuring the pipeline and the pipeline environment. Utilizing such infrastructure creates a more predictable environment because updates will require re-deployment to prevent any previous configuration from interfering. Because it is dependent on automation, it is easier to revert changes. Testing code is also simpler because it is based on virtualization. Most importantly, an immutable pipeline infrastructure ensures that a potential attacker seeking to compromise the build environment itself would not be able to do so if the orchestrator, its configuration, and any other component cannot be changed. Verifying that all aspects of the pipeline infrastructure and configuration are immutable therefore keeps them safe from malicious tampering attempts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Use an immutable pipeline orchestrator and ensure that its configuration and all other aspects of the built environment are immutable, as well.",
+ "AuditProcedure": "Verify that the pipeline orchestrator, its configuration, and all other aspects of the build environment are immutable.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.3",
+ "Description": "Keep build logs of the build environment detailing configuration and all activity within it. Also, consider to store them in a centralized organizational log store.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Keep build logs of the build environment detailing configuration and all activity within it. Also, consider to store them in a centralized organizational log store.",
+ "RationaleStatement": "Logging the environment is important for two primary reasons: one, for debugging and investigating the environment in case of a bug or security incident; and two, for reproducing the environment easily when needed. Storing these logs in a centralized organizational log store allows the organization to generate useful insights and identify anomalies in the build process faster.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Keep logs of the build environment. For example, use the .buildinfo file for Debian build workers. Also, store the logs in a centralized organizational log store.",
+ "AuditProcedure": "Verify that the build environment is logged and stored in a centralized organizational log store.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.4",
+ "Description": "Automate the creation of the build environment.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Automate the creation of the build environment.",
+ "RationaleStatement": "Automating the deployment of the build environment reduces the risk for human mistakes — such as a wrong configuration or exposure of sensitive data — because it requires less human interaction and intervention. It also eases re-deployment of the environment. It is best to automate with Infrastructure as Code because it offers more control over changes made to the environment creation configuration and stores to a version control platform.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Automate the deployment of the build environment.",
+ "AuditProcedure": "Verify that the deployment of the build environment is automated and can be easily redeployed.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.5",
+ "Description": "Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Restrict access to the build environment (orchestrator, pipeline executor, their environment, etc.) to trusted and qualified users only.",
+ "RationaleStatement": "A build environment contains sensitive data such as environment variables, secrets, and the source code itself. Any user that has access to this environment can make changes to the build process, including changes to the code within it. Restricting access to the build environment to trusted and qualified users only will reduce the risk for mistakes such as exposure of secrets or misconfiguration. Limiting access also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the build environment.",
+ "ImpactStatement": "Reducing the number of users who have access to the build process means those users would lose their ability to make direct changes to that process.",
+ "RemediationProcedure": "Restrict access to the build environment to trusted and qualified users.",
+ "AuditProcedure": "Verify each build environment is accessible only to known and authorized users.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.6",
+ "Description": "Require users to login in to access the build environment - where the orchestrator, the pipeline executer, where the build workers are running, etc.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Require users to login in to access the build environment - where the orchestrator, the pipeline executer, where the build workers are running, etc.",
+ "RationaleStatement": "Requiring users to authenticate and disabling anonymous access to the build environment allows organization to track every action on that environment, good or bad, to its actor. This will help recognizing attack and its attacker because the authentication is required.",
+ "ImpactStatement": "Anonymous users won't be able to access the build environment.",
+ "RemediationProcedure": "Require authentication to access the build environment and disable anonymous access.",
+ "AuditProcedure": "Ensure authentication is required to access the build environment.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.7",
+ "Description": "Build tools providers offer a secure way to store secrets that should be used during the build process.\nThese secrets will often be credentials used to access other tools, for example for pulling code or for uploading artifacts.\nAccess to these secrets can be defined on various scopes, for example in github it could be on an organization level or a repository level and there is also control on whether these secrets are passed to forked pull request.\nTo protect these critical assets it is important to choose the most restrictive scope necessary.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Build tools providers offer a secure way to store secrets that should be used during the build process.\nThese secrets will often be credentials used to access other tools, for example for pulling code or for uploading artifacts.\nAccess to these secrets can be defined on various scopes, for example in github it could be on an organization level or a repository level and there is also control on whether these secrets are passed to forked pull request.\nTo protect these critical assets it is important to choose the most restrictive scope necessary.",
+ "RationaleStatement": "Allowing over permissive access to these secrets may affect on their exposure.\nFor example if a secret is defined in an organization level, and users can create new repositories, there is a scenario where a user can create a new repo and run a controlled build just to exfiltrate these secrets.",
+ "ImpactStatement": "Increased risk of exposure of build related secrets.",
+ "RemediationProcedure": "For each build tool, review the secrets defined and their permissions scope and change over permissive scopes to more restrictive ones based on the required access.",
+ "AuditProcedure": "For each build tool in use, review the secrets defined and the permission scopes they are assigned.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.8",
+ "Description": "Scan the build infrastructure and its dependencies for vulnerabilities. It is recommended that this be done automatically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Scan the build infrastructure and its dependencies for vulnerabilities. It is recommended that this be done automatically.",
+ "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in the tooling used by the build infrastructure and its dependencies. These vulnerabilities can lead\nto a potentially massive breach if not handled as fast as possible, as attackers might also be\naware of such vulnerabilities.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set an automated vulnerability scanning for your build infrastructure.",
+ "AuditProcedure": "Verify that your build infrastructure is automatically scanned for vulnerabilities.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.9",
+ "Description": "Do not use default passwords of build tools and components.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not use default passwords of build tools and components.",
+ "RationaleStatement": "Sometimes build tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is especially important to ensure that default passwords are not used in build tools and components.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each build tool, change the default password.",
+ "AuditProcedure": "For each build tool, ensure the password used is not the default one.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.10",
+ "Description": "Use secured webhooks of the build environment.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use secured webhooks of the build environment.",
+ "RationaleStatement": "Webhooks are used for triggering an HTTP request based on an action made in the platform. Typically, build environment feature webhooks for a pipeline trigger based on source code event. Since webhooks are an HTTP POST request, they can be malformed if not secured over SSL. To prevent a potential hack and compromise of the webhook or to the environment or web server excepting the request, use only secured webhooks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each webhook in use, change it to secured (over HTTPS).",
+ "AuditProcedure": "For each webhook in use, ensure it is secured (HTTPS).",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.1.11",
+ "Description": "Ensure the build environment has a minimum number of administrators.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.1 Build Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure the build environment has a minimum number of administrators.",
+ "RationaleStatement": "Build environment administrators have the highest level of permissions, including the ability to add/remove users, create or delete pipelines, control build workers, change build trigger permissions and more. Due to the permissive access granted to a build environment administrator, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set the minimum number of administrators in the build environment.",
+ "AuditProcedure": "Verify that the build environment has only the minimum number of administrators.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.1",
+ "Description": "Use a clean instance of build worker for every pipeline run.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use a clean instance of build worker for every pipeline run.",
+ "RationaleStatement": "Using a clean instance of build worker for every pipeline run eliminates the risks of data theft, data integrity breaches, and unavailability. It limits the pipeline's access to data stored on the file system from previous runs, and the cache is volatile. This prevents malicious changes from affecting other pipelines or the Continuous Integration/Continuous Delivery system itself.",
+ "ImpactStatement": "Data and cache will not be saved in different pipeline runs.",
+ "RemediationProcedure": "Create a clean build worker for every pipeline that is being run, or use build platform-hosted runners, as they typically offer a clean instance for every run.",
+ "AuditProcedure": "Ensure that every pipeline that is being run has its own clean, new runner.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.2",
+ "Description": "A worker’s environment can be passed (for example, a pod in a Kubernetes cluster in which an environment variable is passed to it). It also can be pulled, like a virtual machine that is installing a package. Ensure that the environment and commands are passed to the workers and not pulled from it.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "A worker’s environment can be passed (for example, a pod in a Kubernetes cluster in which an environment variable is passed to it). It also can be pulled, like a virtual machine that is installing a package. Ensure that the environment and commands are passed to the workers and not pulled from it.",
+ "RationaleStatement": "Passing an environment means additional configuration happens in the build time phase and not in run time. It will also pass locally and not remotely. Passing a worker environment, instead of pulling it from an outer source, reduces the possibility for an attacker to gain access and potentially pull malicious code into it. By passing locally and not pulling from remote, there is also less chance of an attack based on the remote connection, such as a man-in-the-middle or malicious scripts that can run from remote. This therefore prevents possible infection of the build worker.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each build worker, pass its environment and commands to it instead of pulling it.",
+ "AuditProcedure": "For each build worker, ensure its environment and commands are passed and not pulled.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.3",
+ "Description": "Separate responsibilities in the build workflow, such as testing, compiling, pushing artifacts, etc., to different build workers so that each worker will have a single duty.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Separate responsibilities in the build workflow, such as testing, compiling, pushing artifacts, etc., to different build workers so that each worker will have a single duty.",
+ "RationaleStatement": "Separating duties and allocating them to many workers makes it easier to verify each step in the build process and ensure there is no corruption. It also limits the effect of an attack on a build worker, as such an attack would be less critical if the worker has less access and duties that are subject to harm.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each build worker, limit its responsibility to one duty.",
+ "AuditProcedure": "For each build worker, ensure it has the least responsibility possible, preferably only one duty.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.4",
+ "Description": "Ensure that build workers have minimal network connectivity.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that build workers have minimal network connectivity.",
+ "RationaleStatement": "Restricting the network connectivity of build workers decreases the possibility that an attacker would be capable of entering the organization from the outside. If the build workers are connected to the public internet without any restriction, it is far simpler for attackers to compromise them. Limiting network connectivity between build workers also protects the organization in case an attacker was successful and subsequently attempts to spread the attack to other components of the environment.",
+ "ImpactStatement": "Developers will not have connectivity to every resource they might need from the outside. Workers will also only be able to exchange data through shareable storage.",
+ "RemediationProcedure": "Limit the network connectivity of build workers, environment, and any other components to the necessary minimum.",
+ "AuditProcedure": "Verify that build workers, environment, and any other components have only the required minimum of network connectivity.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.5",
+ "Description": "Add traces to build workers' operating systems and installed applications so that in run time, collected events can be analyzed to detect suspicious behavior patterns and malware.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Add traces to build workers' operating systems and installed applications so that in run time, collected events can be analyzed to detect suspicious behavior patterns and malware.",
+ "RationaleStatement": "Build workers are exposed to data exfiltration attacks, code injection attacks, and more while running. It is important to secure them from such attacks by enforcing run-time security on the build worker itself. This will identify attempted attacks in real time and prevent them.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Deploy and enforce a run-time security solution on build workers.",
+ "AuditProcedure": "Verify that a run-time security solution is enforced on every active build worker.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.6",
+ "Description": "Scan build workers for vulnerabilities. It is recommended that this be done automatically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Scan build workers for vulnerabilities. It is recommended that this be done automatically.",
+ "RationaleStatement": "Automatic scanning for vulnerabilities detects known weaknesses in environmental sources in use, such as docker images or kernel versions. Such vulnerabilities can lead to a massive breach if these environments are not replaced as fast as possible, since attackers also know about these vulnerabilities and often try to take advantage of them. Setting automatic scanning which scans environmental sources ensures that if any new vulnerability is revealed, it can be replaced quickly and easily. This protects the worker from being exposed to attacks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each build worker, automatically scan its environmental sources, such as docker image, for vulnerabilities.",
+ "AuditProcedure": "For each build worker, ensure the environmental sources it uses are scanned for vulnerabilities.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.7",
+ "Description": "Store the deployment configuration of build workers in a version control platform, such as Github.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Store the deployment configuration of build workers in a version control platform, such as Github.",
+ "RationaleStatement": "Build workers are a sensitive part of the build phase. They generally have access to the code repository, the Continuous Integration platform, the deployment platform, etc. This means that an attacker gaining access to a build worker may compromise other platforms in the organization and cause a major incident. One thing that can protect workers is to ensure that their deployment configuration is safe and well-configured. Storing the deployment configuration in version control enables more observability of these configurations because everything is catalogued in a single place. It adds another layer of security, as every change will be reviewed and noticed, and thus malicious changes will theoretically occur less. In the case of a mistake, bug, or security incident, it also offers an easier way to \"revert\" back to a safe version or add a \"hot fix\" quickly.",
+ "ImpactStatement": "Changes in deployment configuration may only be applied by declaration in the version control platform. This could potentially slow down the development process.",
+ "RemediationProcedure": "Document and store every deployment configuration of build workers in a version control platform.",
+ "AuditProcedure": "Verify that the deployment configuration of build workers is stored in a version control platform.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.2.8",
+ "Description": "Monitor the resource consumption of build workers and set alerts for high consumption that can lead to resource exhaustion.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.2 Build Worker",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Monitor the resource consumption of build workers and set alerts for high consumption that can lead to resource exhaustion.",
+ "RationaleStatement": "Resource exhaustion is when machine resources or services are highly consumed until exhausted. Resource exhaustion may lead to DOS (Denial of Service). When such a situation happens to build workers, it slows down and even stops the build process, which harms the production of artifacts and the organization's ability to deliver software on schedule. To prevent that, it is recommended to monitor resources consumption in the build workers and set alerts to notify when they are highly consumed. That way resource exhaustion can be acknowledged and prevented at an early stage.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set reources consumption monitoring for each build worker.",
+ "AuditProcedure": "Verify that there is monitoring of resources consumption for each build worker.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.1",
+ "Description": "Use pipeline as code for build pipelines and their defined steps.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use pipeline as code for build pipelines and their defined steps.",
+ "RationaleStatement": "Storing pipeline instructions as code in a version control system means automation of the build steps and less room for human error, which could potentially lead to a security breach. Additionally, It creates the ability to revert back to a previous pipeline configuration in order to pinpoint the affected change should a malicious incident occur.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Convert pipeline instructions into code-based syntax and upload them to the organization's version control platform.",
+ "AuditProcedure": "Verify that all build steps are defined as code and stored in a version control system.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.2",
+ "Description": "Define clear expected input and output for each build stage.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Define clear expected input and output for each build stage.",
+ "RationaleStatement": "In order to have more control over data flow in the build pipeline, clearly define the input and output of the pipeline steps. If anything malicious happens during the build stage, it will be recognized more easily and stand out as an anomaly.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each build stage, clearly define what is expected for input and output.",
+ "AuditProcedure": "For each build stage, verify that the expected input and output are clearly defined.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.3",
+ "Description": "Write pipeline output artifacts to a secured storage repository.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Write pipeline output artifacts to a secured storage repository.",
+ "RationaleStatement": "To maintain output artifacts securely and reduce the potential surface for attack, store such artifacts separately in secure storage. This separation enforces the Single Responsibility Principle by ensuring the orchestration platform will not be the same as the artifact storage, which reduces the potential harm of an attack. Using the same security considerations as the input (for example, the source code) will protect artifacts stored and will make it harder for a malicious actor to successfully execute an attack.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline that produces output artifacts, write them to a secured storage repository.",
+ "AuditProcedure": "For each pipeline that produces output artifacts, ensure that they're written to a secured storage repository.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.4",
+ "Description": "Track and review changes to pipeline files.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Track and review changes to pipeline files.",
+ "RationaleStatement": "Pipeline files are sensitive files. They have the ability to access sensitive data and control the build process, thus it is just as important to review changes to pipeline files as it is to verify source code. Malicious actors can potentially add harmful code to these files, which may lead to sensitive data exposure and hijacking of the build environment or artifacts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline file, track changes to it and review them.",
+ "AuditProcedure": "For each pipeline file, ensure changes to it are being tracked and reviewed.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.5",
+ "Description": "Restrict access to pipeline triggers.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Restrict access to pipeline triggers.",
+ "RationaleStatement": "Build pipelines are used for multiple reasons. Some are very sensitive, such as pipelines which deploy to production. In order to protect the environment from malicious acts or human mistakes, such as a developer deploying a bug to production, it is important to apply the Least Privilege principle to pipeline triggering. This principle requires restrictions placed on which users can run which pipeline. It allows for sensitive pipelines to only be run by administrators, who are generally the most trusted and skilled members of the organization.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every pipeline in use, grant only the necessary users permission to trigger it.",
+ "AuditProcedure": "For every pipeline in use, verify only the necessary users have permission to trigger it.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.6",
+ "Description": "Scan the pipeline for misconfigurations. It is recommended that this be performed automatically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Scan the pipeline for misconfigurations. It is recommended that this be performed automatically.",
+ "RationaleStatement": "Automatic scans for misconfigurations detect human mistakes and misconfigured tasks. This protects the environment from backdoors caused by such mistakes, which create easier access for attackers. For example, a task that mistakenly configures credentials to persist on the disk makes it easier for an attacker to steal them. This type of incident can be prevented by auto-scanning.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline, set automated misconfiguration scanning.",
+ "AuditProcedure": "For each pipeline, verify that it is automatically scanned for misconfigurations.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.7",
+ "Description": "Scan pipelines for vulnerabilities. It is recommended that this be implemented automatically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Scan pipelines for vulnerabilities. It is recommended that this be implemented automatically.",
+ "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in pipeline instructions and components, allowing faster patching in case one is found. These vulnerabilities can lead to a potentially massive breach if not handled as fast as possible, as attackers might also be aware of such vulnerabilities.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline, set automated vulnerability scanning.",
+ "AuditProcedure": "For each pipeline, verify that it is automatically scanned for vulnerabilities.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.3.8",
+ "Description": "Detect and prevent sensitive data, such as confidential ID numbers, passwords, etc., in pipelines.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.3 Pipeline Instructions",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Detect and prevent sensitive data, such as confidential ID numbers, passwords, etc., in pipelines.",
+ "RationaleStatement": "Sensitive data in pipeline configuration, such as cloud provider credentials or repository credentials, create vulnerabilities with which malicious actors could steal such information if they gain access to a pipeline. In order to mitigate this, set scanners that will identify and prevent the existence of sensitive data in the pipeline.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every pipeline that is in use, set scanners that will identify and prevent sensitive data within it.",
+ "AuditProcedure": "For every pipeline that is in use, verify that scanners are set to identify and prevent the existence of sensitive data within it.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.1",
+ "Description": "Sign all artifacts in all releases with user or organization keys.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Sign all artifacts in all releases with user or organization keys.",
+ "RationaleStatement": "Signing artifacts is used to validate both their integrity and security. Organizations signal that artifacts may be trusted and they themselves produced them by ensuring that every artifact is properly signed. The presence of this signature also makes potentially malicious activity far more difficult.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every artifact in every release, verify that all are properly signed.",
+ "AuditProcedure": "Ensure every artifact in every release is signed.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.2",
+ "Description": "External dependencies may be public packages needed in the pipeline, or perhaps the public image being used for the build worker. Lock these external dependencies in every build pipeline.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "External dependencies may be public packages needed in the pipeline, or perhaps the public image being used for the build worker. Lock these external dependencies in every build pipeline.",
+ "RationaleStatement": "External dependencies are sources of code that aren't under organizational control. They might be intentionally or unintentionally infected with malicious code or have known vulnerabilities, which could result in sensitive data exposure, data harvesting, or the erosion of trust in an organization. Locking each external dependency to a specific, safe version gives more control and less chance for risk.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For all external dependencies being used in pipelines, verify they are locked.",
+ "AuditProcedure": "Ensure every external dependency being used in pipelines is locked.",
+ "AdditionalInformation": "",
+ "References": "https://argon.io/blog/pipeline-composition-analysis-how-your-ci-pipeline-presents-new-opportunities-for-attackers/",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.3",
+ "Description": "Validate every dependency of the pipeline before use.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Validate every dependency of the pipeline before use.",
+ "RationaleStatement": "To ensure that a dependency used in a pipeline is trusted and has not been infected by malicious actor (for example, the codecov incident), validate dependencies before using them. This can be accomplished by comparing the checksum of the dependency to its checksum in a trusted source. If a difference arises, this is a sign that an unknown actor has interfered and may have added malevolent code. If this dependency is used, it will infect the environment, which could end in a massive breach and leave the organization exposed to data leaks, etc.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every dependency used in every pipeline, validate each one.",
+ "AuditProcedure": "For every dependency used in every pipeline, ensure it has been validated.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.4",
+ "Description": "Verify that the build pipeline creates reproducible artifacts, meaning that an artifact of the build pipeline is the same in every run when given the same input.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Verify that the build pipeline creates reproducible artifacts, meaning that an artifact of the build pipeline is the same in every run when given the same input.",
+ "RationaleStatement": "A reproducible build is a build that produces the same artifact when given the same input data. Ensuring that the build pipeline produces the same artifact when given the same input helps verify that no change has been made to the artifact. This action allows an organization to trust that its artifacts are built only from safe code that has been reviewed and tested and has not been tainted or changed abruptly.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Create build pipelines that produce the same artifact given the same input (for example, artifacts that do not rely on timestamps).",
+ "AuditProcedure": "Ensure that build pipelines create reproducible artifacts.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.5",
+ "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. Generate an SBOM after each run of a pipeline.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. Generate an SBOM after each run of a pipeline.",
+ "RationaleStatement": "Generating a Software Bill of Materials after each run of a pipeline will validate the integrity and security of that pipeline. Recording every step or component role in the pipeline ensures that no malicious acts have been committed during the pipeline's run.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline, configure it to produce a Software Bill of Materials on every run.",
+ "AuditProcedure": "For each pipeline, ensure it produces a Software Bill of Materials on every run.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "2.4.6",
+ "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. It should be generated after every pipeline run. After it is generated, it must then be signed.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Build Pipelines",
+ "Subsection": "2.4 Pipeline Integrity",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "SBOM (Software Bill of Materials) is a file that specifies each component of software or a build process. It should be generated after every pipeline run. After it is generated, it must then be signed.",
+ "RationaleStatement": "Software Bill of Materials (SBOM) is a file used to validate the integrity and security of a build pipeline. Signing it ensures that no one tampered with the file when it was delivered. Such interference can happen if someone tries to hide unusual activity. Validating the SBOM signature can detect this activity and prevent much greater incident.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each pipeline, configure it to sign its produced Software Bill of Materials on every run.",
+ "AuditProcedure": "For each pipeline, ensure it signs the Software Bill of Materials it produces on every run.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.1",
+ "Description": "Ensure third-party artifacts and open-source libraries in use are trusted and verified.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure third-party artifacts and open-source libraries in use are trusted and verified.",
+ "RationaleStatement": "Verify third-party artifacts used in code are trusted and have not been infected by a malicious actor before use. This can be accomplished, for example, by comparing the checksum of the dependency to its checksum in a trusted source. If a difference arises, this may be a sign that someone interfered and added malicious code. If this dependency is used, it will infect the environment and could end in a massive breach, leaving the organization exposed to data leaks and more.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Verify every GitHub action (building block of a GitHub workflow) in use by performing the following: \n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the left sidebar, click **Actions**, then click **General**.\n4. Under \"Policies\", check **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and then **Allow actions created by GitHub**.\n5. Click **Save**.\n\nAlternatively, perform the following for each repository where GitHub actions are used:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the left sidebar, click **Actions**, then click **General**.\n4. Under \"Actions permissions\", check **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and then **Allow actions created by GitHub**.\n5. Click **Save**.",
+ "AuditProcedure": "For every GitHub action (building block of a GitHub workflow), ensure verification before use by performing the following: \n\n1. In the top right corner of GitHub.com, click your profile photo, then click **Your organizations**.\n2. Next to the organization, click **Settings**.\n3. In the left sidebar, click **Actions**, then click **General**.\n4. Under \"Policies\", ensure **Allow OWNER, and select non-OWNER, actions and reusable workflows**, and **Allow actions created by GitHub** are checked.\n\nAlternatively, perform the following for each repository where GitHub actions are used:\n\n1. On GitHub.com, navigate to the main page of the repository.\n2. Under your repository name, click **Settings**.\n3. In the left sidebar, click **Actions**, then click **General**.\n4. Under \"Actions permissions\", ensure **Allow OWNER, and select non-OWNER, actions and reusable workflows** and **Allow actions created by GitHub** are checked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.2",
+ "Description": "A Software Bill Of Materials (SBOM) is a file that specifies each component of software or a build process. Require an SBOM from every third-party provider.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "A Software Bill Of Materials (SBOM) is a file that specifies each component of software or a build process. Require an SBOM from every third-party provider.",
+ "RationaleStatement": "A Software Bill of Materials (SBOM) for every third-party artifact helps to ensure an artifact is safe to use and fully compliant. This file lists all important metadata, especially all the dependencies of an artifact, and allows for verification of each dependency. If one of the dependencies/artifacts are attacked or has a new vulnerability (for example, the \"SolarWinds\" or even \"log4j\" attacks), it is easier to detect what has been affected by this incident because dependencies in use are listed in the SBOM file.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every third-party dependency in use, require a Software Bill of Materials from its supplier.",
+ "AuditProcedure": "For every third-party dependency in use, ensure it has a Software Bill of Materials.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.3",
+ "Description": "Require and verify signed metadata of the build process for all dependencies in use.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Require and verify signed metadata of the build process for all dependencies in use.",
+ "RationaleStatement": "The metadata of a build process lists every action that took place during an artifact build. It is used to ensure that an artifact has not been compromised during the build, that no malicious code was injected into it, and that no nefarious dependencies were added during the build phase. This creates trust between user and vendor that the software supplied is exactly the software that was promised. Signing this metadata adds a checksum to ensure there have been no revisions since its creation, as this checksum changes when the metadata is altered. Verification of proper metadata signature with Certificate Authority confirms that the signature was produced by a trusted entity.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each artifact in use, require and verify signed metadata of the build process.",
+ "AuditProcedure": "For each artifact used, ensure it was supplied with verified and signed metadata of its build process. The signature should be the organizational signature and should be verifiable by common Certificate Authority servers.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.4",
+ "Description": "Monitor, or ask software suppliers to monitor, dependencies between open-source components in use.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Monitor, or ask software suppliers to monitor, dependencies between open-source components in use.",
+ "RationaleStatement": "Monitoring dependencies between open-source components helps to detect if software has fallen victim to attack on a common open-source component. Swift detection can aid in quick application of a fix. It also helps find potential compliance problems with components usage. Some dependencies might not be compatible with the organization's policies, and other dependencies might have a license that is not compatible with how the organization uses this specific dependency. If dependencies are monitored, such situations can be detected and mitigated sooner, potentially deterring malicious attacks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each open-source component, monitor its dependencies.",
+ "AuditProcedure": "For each open-source component, ensure its dependencies are monitored.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.5",
+ "Description": "Prioritize trusted package registries over others when pulling a package.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Prioritize trusted package registries over others when pulling a package.",
+ "RationaleStatement": "When pulling a package by name, the package manager might look for it in several package registries, some of which may be untrusted or badly configured. If the package is pulled from such a registry, there is a higher likelihood that it could prove malicious. In order to avoid this, configure packages to be pulled from trusted package registries.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each package to be downloaded, configure it to be downloaded from a trusted source.",
+ "AuditProcedure": "For each package registry in use, ensure it is trusted.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.6",
+ "Description": "A Software Bill of Materials (SBOM) is a file that specifies each component of software or a build process. When using a dependency, demand its SBOM and ensure it is signed for validation purposes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "A Software Bill of Materials (SBOM) is a file that specifies each component of software or a build process. When using a dependency, demand its SBOM and ensure it is signed for validation purposes.",
+ "RationaleStatement": "A Software Bill of Materials (SBOM) creates trust between its provider and its users by ensuring that the software supplied is the software described, without any potential interference in between. Signing an SBOM creates a checksum for it, which will change if the SBOM's content was changed. With that checksum, a software user can be certain nothing had happened to it during the supply chain, engendering trust in the software. When there is no such trust in the software, the risk surface is increased because one cannot know if the software is potentially vulnerable. Demanding a signed SBOM and validating it decreases that risk.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every artifact supplied, require and verify a signed Software Bill of Materials from its supplier.",
+ "AuditProcedure": "For every artifact supplied, ensure it has a validated, signed Software Bill of Materials.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.7",
+ "Description": "Pin dependencies to a specific version. Avoid using the \"latest\" tag or broad version.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Pin dependencies to a specific version. Avoid using the \"latest\" tag or broad version.",
+ "RationaleStatement": "When using a wildcard version of a package, or the \"latest\" tag, the risk of encountering a new, potentially malicious package increases. The \"latest\" tag pulls the last package pushed to the registry. This means that if an attacker pushes a new, malicious package successfully to the registry, the next user who pulls the \"latest\" will pull it and risk attack. This same rule applies to a wildcard version - assuming one is using version v1.*, it will install the latest version of the major version 1, meaning that if an attacker can push a malicious package with that same version, those using it will be subject to possible attack. By using a secure, verified version, use is restricted to this version only and no other may be pulled, decreasing the risk for any malicious package.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every dependency in use, pin to a specific version.",
+ "AuditProcedure": "For every dependency in use, ensure it is pinned to a specific version.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.1.8",
+ "Description": "Use packages that are more than 60 days old.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.1 Third-Party Packages",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Use packages that are more than 60 days old.",
+ "RationaleStatement": "Third-party packages are a major risk since an organization cannot control their source code, and there is always the possibility these packages could be malicious. It is therefore good practice to remain cautious with any third-party or open-source package, especially new ones, until they can be verified that they are safe to use. Avoiding a new package allows the organization to fully examine it, its maintainer, and its behavior, and gives enough time to determine whether or not to use it.",
+ "ImpactStatement": "Developers may not use packages that are less than 60 days old.",
+ "RemediationProcedure": "If a package used is less than 60 days old, stop using it and find another solution.",
+ "AuditProcedure": "For every package used, ensure it is more than 60 days old.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.1",
+ "Description": "Enforce a policy for dependency usage across the organization. For example, disallow the use of packages less than 60 days old.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.2 Validate Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Enforce a policy for dependency usage across the organization. For example, disallow the use of packages less than 60 days old.",
+ "RationaleStatement": "Enforcing a policy for dependency usage in an organization helps to manage dependencies across the organization and ensure that all usage is compliant with security policy. If, for example, the policy limits the package managers that can be used, enforcing it will make sure that every dependency is installed only from these package managers, and limit the risk of installing from any untrusted source.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Enforce policies for dependency usage across the organization.",
+ "AuditProcedure": "Verify that a policy for dependency usage is enforced across the organization.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.2",
+ "Description": "Automatically scan every package for vulnerabilities.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.2 Validate Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Automatically scan every package for vulnerabilities.",
+ "RationaleStatement": "Automatic scanning for vulnerabilities detects known vulnerabilities in packages and dependencies in use, allowing faster patching when one is found. Such vulnerabilities can lead to a massive breach if not handled as fast as possible, as attackers will also know about those vulnerabilities and swiftly try to take advantage of them. Scanning packages regularly for vulnerabilities can also verify usage compliance with the organization's security policy.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set automatic scanning of packages for vulnerabilities.",
+ "AuditProcedure": "Ensure automatic scanning of packages for vulnerabilities is enabled.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.3",
+ "Description": "A software license is a document that provides legal conditions and guidelines for the use and distribution of software, usually defined by the author. It is recommended to scan for any legal implications automatically.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.2 Validate Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "A software license is a document that provides legal conditions and guidelines for the use and distribution of software, usually defined by the author. It is recommended to scan for any legal implications automatically.",
+ "RationaleStatement": "When using packages with software licenses, especially commercial ones which tend to be the strictest, it is important to verify that the use of the package meets the conditions of the license. If the use of the package violates the licensing agreement, it exposes the organization to possible lawsuits. Scanning used packages for such license implications leads to faster detection and quicker fixes of such violations, and also reduces the risk for a lawsuit.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set automatic package scanning for license implications.",
+ "AuditProcedure": "Ensure license implication rules are configured and are scanned automatically.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "3.2.4",
+ "Description": "Scan every package automatically for ownership change.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Dependencies",
+ "Subsection": "3.2 Validate Packages",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Scan every package automatically for ownership change.",
+ "RationaleStatement": "A change in package ownership is not a regular action. In some cases it can lead to a massive problem (for example, the \"event-stream\" incident). Open-source contributors are not always trusted, since by its very nature everyone can contribute. This means malicious actors can become contributors as well. Package maintainers might transfer their ownership to someone they do not know if maintaining the package is too much for them, in some cases without the other user's knowledge. This has led to known security breaches in the past. It is best to be aware of such activity as soon as it happens and to carefully examine the situation before continuing using the package in order to determine its safety.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Set automatic scanning of packages for ownership change.",
+ "AuditProcedure": "Ensure automatic scanning of packages for ownership change is set.",
+ "AdditionalInformation": "",
+ "References": "https://blog.npmjs.org/post/182828408610/the-security-risks-of-changing-package-owners.html:https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.1.1",
+ "Description": "Configure the build pipeline to sign every artifact it produces and verify that each artifact has the appropriate signature.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.1 Verification",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Configure the build pipeline to sign every artifact it produces and verify that each artifact has the appropriate signature.",
+ "RationaleStatement": "A cryptographic signature can be used to verify artifact authenticity. The signature created with a certain key is unique and not reversible, thus making it unique to the author. This means that an attacker tampering with a signed artifact will be noticed immediately using a simple verification step because the signature will change. Signing artifacts by the build pipeline that produces them ensures the integrity of those artifacts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Sign every artifact produced with the build pipeline that created it. Configure the build pipeline to sign each artifact.\n\nSteps from GitHub Documentation:\n\nYou can follow the steps below to sign artifacts in GitHub actions. The trick involves loading in your private key into GitHub Actions using the gpg command-line commands.\n\nExport your gpg private key from the system that you have created it.\nFind your key-id (using gpg --list-secret-keys --keyid-format=long)\nExport the gpg secret key to an ASCII file using gpg --export-secret-keys -a <key-id> > secret.txt\nEdit secret.txt using a plain text editor, and replace all newlines with a literal \"\\n\" until everything is on a single line\nSet up GitHub Actions secrets\nCreate a secret called OSSRH_GPG_SECRET_KEY using the text from your edited secret.txt file (the whole text should be in a single line)\nCreate a secret called OSSRH_GPG_SECRET_KEY_PASSWORD containing the password for your gpg secret key\nCreate a GitHub Actions step to install the gpg secret key\nAdd an action similar to:\n```\n- id: install-secret-key\n name: Install gpg secret key\n run: |\n cat <(echo -e \"${{ secrets.OSSRH_GPG_SECRET_KEY }}\") | gpg --batch --import\n gpg --list-secret-keys --keyid-format LONG\n```\nVerify that the secret key is shown in the GitHub Actions logs\nYou can remove the output from list secret keys if you are confident that this action will work, but it is better to leave it in there\nBring it all together, and create a GitHub Actions step to publish\nAdd an action similar to:\n```\n- id: publish-to-central\n name: Publish to Central Repository\n env:\n MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}\n MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}\n run: |\n mvn \\\n --no-transfer-progress \\\n --batch-mode \\\n -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} \\\n clean deploy\n```\nAfter a couple of hours, verify that the artifact got published to The Central Repository",
+ "AuditProcedure": "Verify that the build pipeline signs every new artifact it produces and all artifacts are signed.\n\nThere are many different signing tools or options each have there own method or commands to verify that the code or package created is signed.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/code-security/supply-chain-security/end-to-end-supply-chain/securing-builds:https://gist.github.com/sualeh/ae78dc16123899d7942bc38baba5203c",
+ "DefaultValue": "Artifacts are not signed by Default."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.2",
+ "Description": "Encrypt artifacts before they are distributed and ensure only trusted platforms have decryption capabilities.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.1 Verification",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Encrypt artifacts before they are distributed and ensure only trusted platforms have decryption capabilities.",
+ "RationaleStatement": "Build artifacts might contain sensitive data such as production configurations. In order to protect them and decrease the risk for breach, it is recommended to encrypt them before delivery. Encryption makes data unreadable, so even if attackers gain access to these artifacts, they won't be able to harvest sensitive data from them without the decryption key.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Encrypt every artifact before distribution.",
+ "AuditProcedure": "Ensure every artifact is encrypted before it is delivered.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Artifacts do not get encrypted by default."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.3",
+ "Description": "Grant decryption capabilities of artifacts only to trusted and authorized platforms.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.1 Verification",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Grant decryption capabilities of artifacts only to trusted and authorized platforms.",
+ "RationaleStatement": "Build artifacts might contain sensitive data such as production configuration. To protect them and decrease the risk of a breach, it is recommended to encrypt them before delivery. This will make them unreadable for every unauthorized user who doesn't have the decryption key. By implementing this, the decryption capabilities become overly sensitive in order to prevent a data leak or theft. Ensuring that only trusted and authorized platforms can decrypt the organization's packages decreases the possibility for an attacker to gain access to the critical data in artifacts.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Grant decryption capabilities of the organization's artifacts only for trusted and authorized platforms.",
+ "AuditProcedure": "Ensure only trusted and authorized platforms have decryption capabilities of the organization's artifacts.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.1",
+ "Description": "Software certification is used to verify the safety of certain software usage and to establish trust between the supplier and the consumer. Any artifact can be certified. Limit the authority to certify different artifacts.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Software certification is used to verify the safety of certain software usage and to establish trust between the supplier and the consumer. Any artifact can be certified. Limit the authority to certify different artifacts.",
+ "RationaleStatement": "Artifact certification is a powerful tool in establishing trust. Clients use a software certificate to verify that the artifact is safe to use according to their security policies. Because of this, certifying artifacts is considered sensitive. If an artifact is for debugging or internal use, or if it were compromised, the organization would not want certification. An attacker gaining access to both certificate authority and the artifact registry might also be able to certify its own artifact and cause a major breach. To prevent these issues, limit which artifacts can be certified by which platform so there will be minimal access to certification.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Limit which artifact can be certified by which authority.",
+ "AuditProcedure": "Ensure only certain artifacts can be certified by certain parties.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.2",
+ "Description": "Minimize ability to upload artifacts to the lowest number of trusted users possible.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Minimize ability to upload artifacts to the lowest number of trusted users possible.",
+ "RationaleStatement": "Artifacts might contain sensitive data. Even the simplest mistake can also lead to trust issues with customers and harm the integrity of the product. To decrease these risks, allow only trusted and qualified users to upload new artifacts. Those users are less likely to make mistakes. Having the lowest number of such users possible will also decrease the risk of hacked user accounts, which could lead to a massive breach or artifact compromising.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Allow only trusted and qualified users to upload new artifacts and limit them in number.",
+ "AuditProcedure": "Ensure only trusted and qualified users can upload new artifacts, and that their number is the lowest possible.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.3",
+ "Description": "Enforce Multi-Factor Authentication (MFA) for user access to the package registry.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Enforce Multi-Factor Authentication (MFA) for user access to the package registry.",
+ "RationaleStatement": "By default, every user authenticates to the system by password only. If a user's password is compromised, the user account and all its related packages are in danger of data theft and malicious builds. It is therefore recommended that each user enables Multi-Factor Authentication. This additional step guarantees that the account stays secure even if the user's password is compromised, as it adds another layer of authentication.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each package registry in use, enforce Multi-Factor Authentication as the only way to authenticate.",
+ "AuditProcedure": "For each package registry in use, verify that Multi-Factor Authentication is enforced and is the only way to authenticate.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.4",
+ "Description": "Manage users and their access to the package registry with an external authentication server and not with the package registry itself.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Manage users and their access to the package registry with an external authentication server and not with the package registry itself.",
+ "RationaleStatement": "Some package registries offer a tool for user management, aside from the main Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server of the organization. That tool usually offers simple authentication and role-based permissions, which might not be granular enough. Having multiple user management tools in the organization could result in confusion and privilege escalation, as there will be more to manage. To avoid a situation where users escalate their privileges because someone missed them, manage user access to the package registry via the main authentication server and not locally on the package registry.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each package registry, use the main authentication server of the organization for user management and do not manage locally.",
+ "AuditProcedure": "For each package registry, verify that its user access is not managed locally, but instead with the main authentication server of the organization.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.5",
+ "Description": "For GitHub Private or Internal repositories anonymous access is not available. Verify that all repos that require access controls are Private or Internal.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "For GitHub Private or Internal repositories anonymous access is not available. Verify that all repos that require access controls are Private or Internal.",
+ "RationaleStatement": "Disable the option to view artifacts as an anonymous user in order to protect private artifacts from being exposed.",
+ "ImpactStatement": "Only logged and authorized users will be able to access artifacts.",
+ "RemediationProcedure": "Changing a repository's visibility\n\n1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.\n1. Under your repository name, click Settings\n1. Under \"Danger Zone\", to the right of to \"Change repository visibility\", click Change visibility.\n1. Select a visibility.\n\n1. Choose \n - Mark private\n - Make Internal\n\n6. To verify that you're changing the correct repository's visibility, type the name of the repository you want to change the visibility of.",
+ "AuditProcedure": "To Audit the existing settings:\n\n1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.\n1. Under your repository name, click Settings\n3. Under \"Danger Zone\", to the right of to \"Change repository visibility\", click Change visibility.\n\nReview the current selection.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/enterprise-server@3.3/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.6",
+ "Description": "Ensure the package registry has a minimum number of administrators.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.2 Access to Artifacts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure the package registry has a minimum number of administrators.",
+ "RationaleStatement": "Package registry admins have the ability to add/remove users, repositories, packages. Due to the permissive access granted to an admin, it is highly recommended to keep the number of administrator accounts as minimal as possible.",
+ "ImpactStatement": "Administrator privileges are required to provide and maintain a secure and stable platform but allowing extraneous administrator accounts can create a vulnerability.",
+ "RemediationProcedure": "Set the minimum number of administrators in your package registry.\n\nTo accomplish this:\n\nFor each repository that you administer on GitHub, you can see an overview of every team or person with access to the repository. From the overview, choose Manage access and provide access to the appropriate people or teams.",
+ "AuditProcedure": "Verify that your package registry has only the minimum number of administrators.\n\nFor each repository that you administer on GitHub, you can see an overview of every team or person with access to the repository. From the overview, you can also invite new teams or people, change each team or person's role for the repository, or remove access to the repository.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.3.1",
+ "Description": "Validate artifact signatures before uploading to the package registry.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.3 Package Registries",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Validate artifact signatures before uploading to the package registry.",
+ "RationaleStatement": "Cryptographic signature is a tool to verify artifact authenticity. Every artifact is supposed to be signed by its creator in order to confirm that it was not compromised before reaching the client. Validating an artifact signature before delivering it is another level of protection which ensures the signature has not been changed, meaning no one tried or succeeded in tampering with the artifact. This creates trust between the supplier and the client.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Validate every artifact with its signature before uploading it to the package registry. It is recommended to do so automatically.",
+ "AuditProcedure": "Ensure every artifact in the package registry has been validated with its signature.\n\n1. On GitHub, navigate to a pull request\n2. On the pull request, click <> Commits and view the detailed information regarding the signature.",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification:https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits",
+ "DefaultValue": "Artifacts are not scanned by default."
+ }
+ ]
+ },
+ {
+ "Id": "4.3.2",
+ "Description": "Validate the signature of all versions of an existing artifact.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.3 Package Registries",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Validate the signature of all versions of an existing artifact.",
+ "RationaleStatement": "In order to be certain a version of an existing and trusted artifact is not malicious or delivered by someone looking to interfere with the supply chain, it is a good practice to validate the signatures of each version. Doing so decreases the risk of using a compromised artifact, which might lead to a breach.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each artifact, sign and validate each version before uploading or using the artifact.",
+ "AuditProcedure": "For each artifact, ensure that all of its versions are signed and validated before it is uploaded or used.\n\nEnsure every artifact in the package registry has been validated with its signature.\n\nOn GitHub, navigate to a pull request\nOn the pull request, click <> Commits and view the detailed information regarding the signature.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.3.3",
+ "Description": "Audit changes of the package registry configuration.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.3 Package Registries",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Audit changes of the package registry configuration.",
+ "RationaleStatement": "The package registry is a crucial component in the software supply chain. It stores artifacts with potentially sensitive data that will eventually be deployed and used in production. Every change made to the package registry configuration must be examined carefully to ensure no exposure of the registry's sensitive data. This examination also ensures no malicious actors have performed modifications to a stored artifact. Auditing the configuration and its changes helps in decreasing such risks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Audit the changes to the package registry configuration.",
+ "AuditProcedure": "Verify that all changes to the packages registry configuration are audited.\n\nSearch the audit log with\n\nrepo category actions",
+ "AdditionalInformation": "",
+ "References": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization",
+ "DefaultValue": "GitHub audits this by default."
+ }
+ ]
+ },
+ {
+ "Id": "4.3.4",
+ "Description": "Use secured webhooks to reduce the possibility of malicious payloads.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.3 Package Registries",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use secured webhooks to reduce the possibility of malicious payloads.",
+ "RationaleStatement": "Webhooks are used for triggering an HTTP request based on an action made in the platform. Typically, package registries feature webhooks when a package receives an update. Since webhooks are an HTTP POST request, they can be malformed if not secured over SSL. To prevent a potential hack and compromise of the webhook or to the registry or web server excepting the request, use only secured webhooks.",
+ "ImpactStatement": "Reduces the payloads that the web hook can listen for and receive.",
+ "RemediationProcedure": "For each webhook in use, change it to secured (over HTTPS).",
+ "AuditProcedure": "",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.4.1",
+ "Description": "When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Artifacts",
+ "Subsection": "4.4 Origin Traceability",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "When delivering artifacts, ensure they have information about their origin. This may be done by providing a Software Bill of Manufacture (SBOM) or some metadata files.",
+ "RationaleStatement": "Information about artifact origin can be used for verification purposes. Having this kind of information allows the user to decide if the organization supplying the artifact is trusted. In a case of potential vulnerability or version update, this can be used to verify that the organization issuing it is the actual origin and not someone else. If users need to report problems with the artifact, they will have an address to contact as well.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each artifact supplied, supply information about its origin. For each artifact in use, ask for information about its origin.",
+ "AuditProcedure": "For each artifact, ensure it has information about its origin.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.1",
+ "Description": "Deployment configurations are often stored in a version control system. Separate deployment configuration files from source code repositories.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Deployment configurations are often stored in a version control system. Separate deployment configuration files from source code repositories.",
+ "RationaleStatement": "Deployment configuration manifests are often stored in version control systems. Storing them in dedicated repositories, separately from source code repositories, has several benefits. First, it adds order to both maintenance and version control history. This makes it easier to track code or manifest changes, as well as spot any malicious code or misconfigurations. Second, it helps achieve the Least Privilege principle. Because access can be configured differently for each repository, fewer users will have access to this configuration, which is typically sensitive.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Store each deployment configuration file in a dedicated repository separately from source code.",
+ "AuditProcedure": "Ensure each deployment configuration file is stored separately from source code.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2",
+ "Description": "Audit and track changes made in deployment configuration.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Audit and track changes made in deployment configuration.",
+ "RationaleStatement": "Deployment configuration is sensitive in nature. The tiniest mistake can lead to downtime or bugs in production, which consequently may have a direct effect on both product integrity and customer trust. Misconfigurations might also be used by malicious actors to attack the production platform. Because of this, every change in the configuration needs a review and possible \"revert\" in case of a mistake or malicious change. Auditing every change and tracking them helps detect and fix such incidents more quickly.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each deployment configuration, track and audit changes made to it.",
+ "AuditProcedure": "For each deployment configuration, ensure changes made to it are audited and tracked.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3",
+ "Description": "Detect and prevent sensitive data – such as confidential ID numbers, passwords, etc. – in deployment configurations.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent sensitive data – such as confidential ID numbers, passwords, etc. – in deployment configurations.",
+ "RationaleStatement": "Sensitive data in deployment configurations might create a major incident if an attacker gains access to it, as this can cause data loss and theft. It is important to keep sensitive data safe and to not expose it in the configuration. In order to prevent a possible exposure, set scanners that will identify and prevent such data in deployment configurations.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each deployment configuration file, set scanners to identify and prevent sensitive data within it.",
+ "AuditProcedure": "For each deployment configuration file, verify that scanners are set to identify and prevent the existence of sensitive data within it.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4",
+ "Description": "Restrict access to the deployment configuration to trusted and qualified users only.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Restrict access to the deployment configuration to trusted and qualified users only.",
+ "RationaleStatement": "Deployment configurations are sensitive in nature. The tiniest mistake can lead to downtime or bugs in production, which can have a direct effect on the product's integrity and customer trust. Misconfigurations might also be used by malicious actors to attack the production platform. To avoid such harm as much as possible, ensure only trusted and qualified users have access to such configurations. This will also reduce the number of accounts that might affect the environment in case of an attack.",
+ "ImpactStatement": "Reducing the number of users who have access to the deployment configuration means those users would lose their ability to make direct changes to that configuration.",
+ "RemediationProcedure": "Restrict access to the deployment configuration to trusted and qualified users.",
+ "AuditProcedure": "Verify each deployment configuration is accessible only to known and authorized users.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5",
+ "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Detect and prevent misconfigurations or insecure instructions in Infrastructure as Code (IaC) files, such as Terraform files.",
+ "RationaleStatement": "Infrastructure as Code (IaC) files are used for production environment and application deployment. These are sensitive parts of the software supply chain because they are always in touch with customers, and thus might affect their opinion of or trust in the product. Attackers often target these environments. Detecting and fixing misconfigurations and/or insecure instructions in IaC files decreases the risk for data leak or data theft. It is important to secure IaC instructions in order to prevent further problems of deployment, exposed assets, or improper configurations, which might ultimately lead to easier ways to attack and steal organization data.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For every Infrastructure as Code (IaC) instructions file, set scanners to identify and prevent misconfigurations and insecure instructions.",
+ "AuditProcedure": "For every Infrastructure as Code (IaC) instructions file, verify that scanners are set to identify and prevent misconfigurations and insecure instructions.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.6",
+ "Description": "Verify the deployment configuration manifests.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Verify the deployment configuration manifests.",
+ "RationaleStatement": "To ensure that the configuration manifests used are trusted and have not been infected by malicious actors before arriving at the platform, it is important to verify the manifests. This may be done by comparing the checksum of the manifest file to its checksum in a trusted source. If a difference arises, this is a sign that an unknown actor has interfered and may have added malicious instructions. If this manifest is used, it might harm the environment and application deployment, which could end in a massive breach and leave the organization exposed to data leaks, etc.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Verify each deployment configuration manifest in use.",
+ "AuditProcedure": "For each deployment configuration manifest in use, ensure it has been verified.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.7",
+ "Description": "Deployment configuration is often stored in a version control system and is pulled from there. Pin the configuration used to a specific, verified version or commit Secure Hash Algorithm (SHA). Avoid referring configuration without its version tag specified.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.1 Deployment Configuration",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Deployment configuration is often stored in a version control system and is pulled from there. Pin the configuration used to a specific, verified version or commit Secure Hash Algorithm (SHA). Avoid referring configuration without its version tag specified.",
+ "RationaleStatement": "Deployment configuration manifests are often stored in version control systems and pulled from there either by automation platforms, for example Ansible, or GitOps platforms, such as ArgoCD. When a manifest is pulled from a version control system without tag or commit Secure Hash Algorithm (SHA) specified, it is pulled from the HEAD revision, which is equal to the 'latest' tag, and pulls the last change made. This increases the risk of encountering a new, potentially malicious configuration. If an attacker pushes malicious configuration to the version control system, the next user who pulls the HEAD revision will pull it and risk attack. To avoid that risk, use a version tag of verified version or a commit SHA of a trusted commit, which will ensure this is the only version pulled.",
+ "ImpactStatement": "Changes in deployment configuration will not be pulled unless their version tag or commit Secure Hash Algorithm (SHA) is specified. This might slow down the deployment process.",
+ "RemediationProcedure": "For every deployment configuration manifest in use, pin to a specific version or commit Secure Hash Algorithm (SHA).",
+ "AuditProcedure": "For every deployment configuration manifest in use, ensure it is pinned to a specific version or commit Secure Hash Algorithm (SHA).",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2.1",
+ "Description": "Automate deployments of production environment and application.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.2 Deployment Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Automate deployments of production environment and application.",
+ "RationaleStatement": "Automating the deployments of both production environment and applications reduces the risk for human mistakes — such as a wrong configuration or exposure of sensitive data — because it requires less human interaction or intervention. It also eases redeployment of the environment. It is best to automate with Infrastructure as Code (IaC) because it offers more control over changes made to the environment creation configuration and stores to a version control platform.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Automate each deployment process of the production environment and application.",
+ "AuditProcedure": "For each deployment process, ensure it is automated.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2",
+ "Description": "Verify that the deployment environment – the orchestrator and the production environment where the application is deployed – is reproducible. This means that the environment stays the same in each deployment if the configuration has not changed.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.2 Deployment Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Verify that the deployment environment – the orchestrator and the production environment where the application is deployed – is reproducible. This means that the environment stays the same in each deployment if the configuration has not changed.",
+ "RationaleStatement": "A reproducible build is a build that produces the same artifact when given the same input data, and in this case the same environment. Ensuring that the same environment is produced when given the same input helps verify that no change has been made to it. This action allows an organization to trust that its deployment environment is built only from safe code and configuration that has been reviewed and tested and has not been tainted or changed abruptly.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Adjust the process that deploys the deployment/production environment to build the same environment each time when the configuration has not changed.",
+ "AuditProcedure": "Verify that the deployment/production environment is reproducible.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3",
+ "Description": "Restrict access to the production environment to a few trusted and qualified users only.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.2 Deployment Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Restrict access to the production environment to a few trusted and qualified users only.",
+ "RationaleStatement": "The production environment is an extremely sensitive one. It directly affects the customer experience and trust in a product, which has serious effects on the organization itself. Because of this sensitive nature, it is important to restrict access to the production environment to only a few trusted and qualified users. This will reduce the risk of mistakes such as exposure of secrets or misconfiguration. This restriction also reduces the number of accounts that are vulnerable to hijacking in order to potentially harm the production environment.",
+ "ImpactStatement": "Reducing the number of users who have access to the production environment means those users would lose their ability to make direct changes to that environment.",
+ "RemediationProcedure": "Restrict access to the production environment to trusted and qualified users.",
+ "AuditProcedure": "Verify that the production environment is accessible only to trusted and qualified users.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4",
+ "Description": "Do not use default passwords of deployment tools and components.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Deployment",
+ "Subsection": "5.2 Deployment Environment",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not use default passwords of deployment tools and components.",
+ "RationaleStatement": "Many deployment tools and components are provided with default passwords for the first login. This password is intended to be used only on the first login and should be changed immediately after. Using the default password substantially increases the attack risk. It is very important to ensure that default passwords are not used in deployment tools and components.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "For each deployment tool, change the password.",
+ "AuditProcedure": "For each deployment tool, ensure the password is not the default one.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
index a049efc040..ed0e90d88f 100644
--- a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json
@@ -820,6 +820,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
"Attributes": [
{
"Section": "1 Control Plane Components",
@@ -858,6 +866,14 @@
"DefaultValue": "By default, auditing is not enabled.",
"References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/concepts/cluster-administration/audit/:https://github.com/kubernetes/features/issues/22"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
]
},
{
@@ -881,6 +897,14 @@
"DefaultValue": "By default, auditing is not enabled.",
"References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/concepts/cluster-administration/audit/:https://github.com/kubernetes/features/issues/22"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
]
},
{
@@ -1109,6 +1133,18 @@
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers",
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_strong_ciphers_only",
+ "ConfigKey": "apiserver_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_AES_128_GCM_SHA256",
+ "TLS_AES_256_GCM_SHA384",
+ "TLS_CHACHA20_POLY1305_SHA256"
+ ]
+ }
]
},
{
@@ -2069,6 +2105,23 @@
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers",
"References": ""
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/kubernetes/cis_1.11_kubernetes.json b/prowler/compliance/kubernetes/cis_1.11_kubernetes.json
index 6a19ea4161..25d725683f 100644
--- a/prowler/compliance/kubernetes/cis_1.11_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.11_kubernetes.json
@@ -820,6 +820,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
"Attributes": [
{
"Section": "1 Control Plane Components",
@@ -858,6 +866,14 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
]
},
{
@@ -881,6 +897,14 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
]
},
{
@@ -1109,6 +1133,18 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_strong_ciphers_only",
+ "ConfigKey": "apiserver_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_AES_128_GCM_SHA256",
+ "TLS_AES_256_GCM_SHA384",
+ "TLS_CHACHA20_POLY1305_SHA256"
+ ]
+ }
]
},
{
@@ -2112,6 +2148,23 @@
"References": "",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/kubernetes/cis_1.12_kubernetes.json b/prowler/compliance/kubernetes/cis_1.12_kubernetes.json
index 1ba1e55a88..ded2d6944a 100644
--- a/prowler/compliance/kubernetes/cis_1.12_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.12_kubernetes.json
@@ -820,6 +820,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
"Attributes": [
{
"Section": "1 Control Plane Components",
@@ -858,6 +866,14 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
]
},
{
@@ -881,6 +897,14 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
]
},
{
@@ -1109,6 +1133,18 @@
"References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_strong_ciphers_only",
+ "ConfigKey": "apiserver_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_AES_128_GCM_SHA256",
+ "TLS_AES_256_GCM_SHA384",
+ "TLS_CHACHA20_POLY1305_SHA256"
+ ]
+ }
]
},
{
@@ -2090,6 +2126,23 @@
"References": "",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
index 24a5733a05..a09d753f58 100644
--- a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
+++ b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json
@@ -843,6 +843,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
"Attributes": [
{
"Section": "1 Control Plane Components",
@@ -881,6 +889,14 @@
"References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/concepts/cluster-administration/audit/:https://github.com/kubernetes/features/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
]
},
{
@@ -904,6 +920,14 @@
"References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/concepts/cluster-administration/audit/:https://github.com/kubernetes/features/issues/22",
"DefaultValue": "By default, auditing is not enabled."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
]
},
{
@@ -1132,6 +1156,18 @@
"References": "https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_strong_ciphers_only",
+ "ConfigKey": "apiserver_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_AES_128_GCM_SHA256",
+ "TLS_AES_256_GCM_SHA384",
+ "TLS_CHACHA20_POLY1305_SHA256"
+ ]
+ }
]
},
{
@@ -2092,6 +2128,23 @@
"References": "",
"DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/kubernetes/cis_2.0.1_kubernetes.json b/prowler/compliance/kubernetes/cis_2.0.1_kubernetes.json
new file mode 100644
index 0000000000..2b9e695dd2
--- /dev/null
+++ b/prowler/compliance/kubernetes/cis_2.0.1_kubernetes.json
@@ -0,0 +1,2968 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS Kubernetes Benchmark v2.0.1",
+ "Version": "2.0.1",
+ "Provider": "Kubernetes",
+ "Description": "This CIS Kubernetes Benchmark provides prescriptive guidance for establishing a secure configuration posture for Kubernetes v1.34 - v1.35",
+ "Requirements": [
+ {
+ "Id": "1.1.1",
+ "Description": "Ensure that the API server pod specification file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the API server pod specification file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The API server pod specification file controls various parameters that set the behavior of the API server. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-apiserver.yaml ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the `kube-apiserver.yaml` file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.2",
+ "Description": "Ensure that the API server pod specification file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the API server pod specification file ownership is set to `root:root`.",
+ "RationaleStatement": "The API server pod specification file controls various parameters that set the behavior of the API server. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the `kube-apiserver.yaml` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.3",
+ "Description": "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the `kube-controller-manager.yaml` file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.4",
+ "Description": "Ensure that the controller manager pod specification file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the controller manager pod specification file ownership is set to `root:root`.",
+ "RationaleStatement": "The controller manager pod specification file controls various parameters that set the behavior of various components of the master node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager",
+ "DefaultValue": "By default, `kube-controller-manager.yaml` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.5",
+ "Description": "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the scheduler pod specification file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The scheduler pod specification file controls various parameters that set the behavior of the Scheduler service in the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-scheduler.yaml ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-scheduler/",
+ "DefaultValue": "By default, `kube-scheduler.yaml` file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.6",
+ "Description": "Ensure that the scheduler pod specification file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the scheduler pod specification file ownership is set to `root:root`.",
+ "RationaleStatement": "The scheduler pod specification file controls various parameters that set the behavior of the `kube-scheduler` service in the master node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-scheduler/",
+ "DefaultValue": "By default, `kube-scheduler.yaml` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.7",
+ "Description": "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` controls various parameters that set the behavior of the `etcd` service in the master node. etcd is a highly-available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/etcd.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/etcd.yaml ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "By default, `/etc/kubernetes/manifests/etcd.yaml` file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.8",
+ "Description": "Ensure that the etcd pod specification file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file ownership is set to `root:root`.",
+ "RationaleStatement": "The etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` controls various parameters that set the behavior of the `etcd` service in the master node. etcd is a highly-available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/manifests/etcd.yaml ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/manifests/etcd.yaml ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "By default, `/etc/kubernetes/manifests/etcd.yaml` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.9",
+ "Description": "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the Container Network Interface files have permissions of `600` or more restrictive.",
+ "RationaleStatement": "Container Network Interface provides various networking options for overlay networking. You should consult their documentation and restrict their respective file permissions to maintain the integrity of those files. Those files should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 <path/to/cni/files> ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a <path/to/cni/files> ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/cluster-administration/networking/",
+ "DefaultValue": "NA"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.10",
+ "Description": "Ensure that the Container Network Interface file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the Container Network Interface files have ownership set to `root:root`.",
+ "RationaleStatement": "Container Network Interface provides various networking options for overlay networking. You should consult their documentation and restrict their respective file permissions to maintain the integrity of those files. Those files should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root <path/to/cni/files> ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G <path/to/cni/files> ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/cluster-administration/networking/",
+ "DefaultValue": "NA"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.11",
+ "Description": "Ensure that the etcd data directory permissions are set to 700 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the etcd data directory has permissions of `700` or more restrictive.",
+ "RationaleStatement": "etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes. It should not be readable or writable by any group members or the world.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, from the below command: ``` ps -ef | grep etcd ``` Run the below command (based on the etcd data directory found above). For example, ``` chmod 700 /var/lib/etcd ```",
+ "AuditProcedure": "On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, from the below command: ``` ps -ef | grep etcd ``` Run the below command (based on the etcd data directory found above). For example, ``` stat -c %a /var/lib/etcd ``` Verify that the permissions are `700` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/configuration.html#data-dir:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "By default, etcd data directory has permissions of `755`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.12",
+ "Description": "Ensure that the etcd data directory ownership is set to etcd:etcd",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the etcd data directory ownership is set to `etcd:etcd`.",
+ "RationaleStatement": "etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes. It should be owned by `etcd:etcd`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, from the below command: ``` ps -ef | grep etcd ``` Run the below command (based on the etcd data directory found above). For example, ``` chown etcd:etcd /var/lib/etcd ```",
+ "AuditProcedure": "On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`, from the below command: ``` ps -ef | grep etcd ``` Run the below command (based on the etcd data directory found above). For example, ``` stat -c %U:%G /var/lib/etcd ``` Verify that the ownership is set to `etcd:etcd`.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/configuration.html#data-dir:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "By default, etcd data directory ownership is set to `etcd:etcd`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.13",
+ "Description": "Ensure that the default administrative credential file permissions are set to 600",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `admin.conf` file (and `super-admin.conf` file, where it exists) have permissions of `600`.",
+ "RationaleStatement": "As part of initial cluster setup, default kubeconfig files are created to be used by the administrator of the cluster. These files contain private keys and certificates which allow for privileged access to the cluster. You should restrict their file permissions to maintain the integrity and confidentiality of the file(s). The file(s) should be readable and writable by only the administrators on the system.",
+ "ImpactStatement": "None.",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/admin.conf ``` On Kubernetes 1.29+ the `super-admin.conf` file should also be modified, if present. For example, ``` chmod 600 /etc/kubernetes/super-admin.conf ```",
+ "AuditProcedure": "Run the following command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/admin.conf ``` On Kubernetes version 1.29 and higher run the following command as well :- ``` stat -c %a /etc/kubernetes/super-admin.conf ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/:https://raesene.github.io/blog/2024/01/06/when-is-admin-not-admin/",
+ "DefaultValue": "By default, admin.conf and super-admin.conf have permissions of `600`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.14",
+ "Description": "Ensure that the default administrative credential file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `admin.conf` (and `super-admin.conf` file, where it exists) file ownership is set to `root:root`.",
+ "RationaleStatement": "As part of initial cluster setup, default kubeconfig files are created to be used by the administrator of the cluster. These files contain private keys and certificates which allow for privileged access to the cluster. You should set their file ownership to maintain the integrity and confidentiality of the file. The file(s) should be owned by `root:root`.",
+ "ImpactStatement": "None.",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/admin.conf ``` On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present. For example, ``` chown root:root /etc/kubernetes/super-admin.conf ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/admin.conf ``` On Kubernetes version 1.29 and higher run the following command as well :- ``` stat -c %U:%G /etc/kubernetes/super-admin.conf ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubeadm/:https://raesene.github.io/blog/2024/01/06/when-is-admin-not-admin/",
+ "DefaultValue": "By default, `admin.conf` and `super-admin.conf` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.15",
+ "Description": "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `scheduler.conf` file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The `scheduler.conf` file is the kubeconfig file for the Scheduler. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/scheduler.conf ```",
+ "AuditProcedure": "Run the following command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/scheduler.conf ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/",
+ "DefaultValue": "By default, `scheduler.conf` has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.16",
+ "Description": "Ensure that the scheduler.conf file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `scheduler.conf` file ownership is set to `root:root`.",
+ "RationaleStatement": "The `scheduler.conf` file is the kubeconfig file for the Scheduler. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/scheduler.conf ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/scheduler.conf ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubeadm/",
+ "DefaultValue": "By default, `scheduler.conf` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.17",
+ "Description": "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `controller-manager.conf` file has permissions of 600 or more restrictive.",
+ "RationaleStatement": "The `controller-manager.conf` file is the kubeconfig file for the Controller Manager. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/controller-manager.conf ```",
+ "AuditProcedure": "Run the following command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/controller-manager.conf ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/",
+ "DefaultValue": "By default, `controller-manager.conf` has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.18",
+ "Description": "Ensure that the controller-manager.conf file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `controller-manager.conf` file ownership is set to `root:root`.",
+ "RationaleStatement": "The `controller-manager.conf` file is the kubeconfig file for the Controller Manager. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown root:root /etc/kubernetes/controller-manager.conf ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %U:%G /etc/kubernetes/controller-manager.conf ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/",
+ "DefaultValue": "By default, `controller-manager.conf` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.19",
+ "Description": "Ensure that the Kubernetes PKI directory and file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the Kubernetes PKI directory and file ownership is set to `root:root`.",
+ "RationaleStatement": "Kubernetes makes use of a number of certificates as part of its operation. You should set the ownership of the directory containing the PKI information and all files in that directory to maintain their integrity. The directory and files should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chown -R root:root /etc/kubernetes/pki/ ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` ls -laR /etc/kubernetes/pki/ ``` Verify that the ownership of all files and directories in this hierarchy is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the /etc/kubernetes/pki/ directory and all of the files and directories contained within it, are set to be owned by the root user."
+ }
+ ]
+ },
+ {
+ "Id": "1.1.20",
+ "Description": "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Kubernetes PKI certificate files have permissions of `644` or more restrictive.",
+ "RationaleStatement": "Kubernetes makes use of a number of certificate files as part of the operation of its components. The permissions on these files should be set to `644` or more restrictive to protect their integrity and confidentiality.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod -R 644 /etc/kubernetes/pki/*.crt ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c '%a' /etc/kubernetes/pki/*.crt ``` Verify that the permissions are `644` or more restrictive. or ``` ls -l /etc/kubernetes/pki/*.crt ``` Verify -rw------",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the certificates used by Kubernetes are set to have permissions of `644`"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.21",
+ "Description": "Ensure that the Kubernetes PKI key file permissions are set to 600",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.1 Control Plane Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that Kubernetes PKI key files have permissions of `600`.",
+ "RationaleStatement": "Kubernetes makes use of a number of key files as part of the operation of its components. The permissions on these files should be set to `600` to protect their integrity and confidentiality.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod -R 600 /etc/kubernetes/pki/*.key ```",
+ "AuditProcedure": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c '%a' /etc/kubernetes/pki/*.key ``` Verify that the permissions are `600` or more restrictive. or ``` ls -l /etc/kubernetes/pki/*.key ``` Verify that the permissions are `-rw------`",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, the keys used by Kubernetes are set to have permissions of `600`"
+ }
+ ]
+ },
+ {
+ "Id": "1.2.1",
+ "Description": "Ensure that the --anonymous-auth argument is set to false",
+ "Checks": [
+ "apiserver_anonymous_requests"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Disable anonymous requests to the API server.",
+ "RationaleStatement": "When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the API server. You should rely on authentication to authorize access and disallow anonymous requests. If you are using RBAC authorization, it is generally considered reasonable to allow anonymous access to the API Server for health checks and discovery purposes, and hence this recommendation is not scored. However, you should consider whether anonymous discovery is an acceptable risk for your purposes.",
+ "ImpactStatement": "Anonymous requests will be rejected.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the below parameter. ``` --anonymous-auth=false ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--anonymous-auth` argument is set to `false`. Alternative Audit Method ``` kubectl get pod -nkube-system -lcomponent=kube-apiserver -o=jsonpath='{range .items[*]}{.spec.containers[*].command} {\\}{end}' | grep '--anonymous-auth' | grep -i false ``` If the exit code is '1', then the control isn't present / failed",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/admin/authentication/#anonymous-requests",
+ "DefaultValue": "By default, anonymous access is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.2",
+ "Description": "Ensure that the --token-auth-file parameter is not set",
+ "Checks": [
+ "apiserver_no_token_auth_file"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not use token based authentication.",
+ "RationaleStatement": "The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication.",
+ "ImpactStatement": "You will have to configure and use alternate authentication mechanisms such as certificates. Static token based authentication could not be used.",
+ "RemediationProcedure": "Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and remove the `--token-auth-file=<filename>` parameter.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--token-auth-file` argument does not exist. Alternative Audit Method ``` kubectl get pod -nkube-system -lcomponent=kube-apiserver -o=jsonpath='{range .items[*]}{.spec.containers[*].command} {\\}{end}' | grep '--token-auth-file' | grep -i false ``` If the exit code is '1', then the control isn't present / failed",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/authentication/#static-token-file:https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, `--token-auth-file` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.3",
+ "Description": "Ensure that the DenyServiceExternalIPs is set",
+ "Checks": [
+ "apiserver_deny_service_external_ips"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "This admission controller rejects all net-new usage of the Service field externalIPs.",
+ "RationaleStatement": "Most users do not need the ability to set the `externalIPs` field for a `Service` at all, and cluster admins should consider disabling this functionality by enabling the `DenyServiceExternalIPs` admission controller. Clusters that do need to allow this functionality should consider using some custom policy to manage its usage.",
+ "ImpactStatement": "When enabled, users of the cluster may not create new Services which use externalIPs and may not add new values to externalIPs on existing Service objects.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and append the Kubernetes API server flag --enable-admission-plugins with the DenyServiceExternalIPs plugin. Note, the Kubernetes API server flag --enable-admission-plugins takes a comma-delimited list of admission control plugins to be enabled, even if they are in the list of plugins enabled by default. ``` kube-apiserver --enable-admission-plugins=DenyServiceExternalIPs ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `DenyServiceExternalIPs' argument exist as a string value in --enable-admission-plugins.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/:https://kubernetes.io/docs/admin/kube-apiserver/",
+ "DefaultValue": "By default, --enable-admission-plugins=DenyServiceExternalIP argument is not set, and the use of externalIPs is authorized."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.4",
+ "Description": "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate",
+ "Checks": [
+ "apiserver_kubelet_tls_auth"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable certificate based kubelet authentication.",
+ "RationaleStatement": "The apiserver, by default, does not authenticate itself to the kubelet's HTTPS endpoints. The requests from the apiserver are treated anonymously. You should set up certificate-based kubelet authentication to ensure that the apiserver authenticates itself to kubelets when submitting requests.",
+ "ImpactStatement": "You require TLS to be configured on apiserver as well as kubelets.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the kubelet client certificate and key parameters as below. ``` --kubelet-client-certificate=<path/to/client-certificate-file> --kubelet-client-key=<path/to/client-key-file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments exist and they are set as appropriate. Alternative Audit ``` kubectl get pod -nkube-system -lcomponent=kube-apiserver -o=jsonpath='{range .items[*]}{.spec.containers[*].command} {\\}{end}' | grep '--kubelet-client-certificate' | grep -i false ``` If the exit code is '1', then the control isn't present / failed",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/:https://kubernetes.io/docs/concepts/cluster-administration/master-node-communication/#apiserver---kubelet",
+ "DefaultValue": "By default, certificate-based kubelet authentication is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.5",
+ "Description": "Ensure that the --kubelet-certificate-authority argument is set as appropriate",
+ "Checks": [
+ "apiserver_kubelet_cert_auth"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Verify kubelet's certificate before establishing connection.",
+ "RationaleStatement": "The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet’s port-forwarding functionality. These connections terminate at the kubelet’s HTTPS endpoint. By default, the apiserver does not verify the kubelet’s serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks.",
+ "ImpactStatement": "You require TLS to be configured on apiserver as well as kubelets.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. ``` --kubelet-certificate-authority=<ca-string> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--kubelet-certificate-authority` argument exists and is set as appropriate. Alternative Audit ``` kubectl get pod -nkube-system -lcomponent=kube-apiserver -o=jsonpath='{range .items[]}{.spec.containers[].command} {\\}{end}' | grep '--kubelet-certificate-authority' | grep -i false ``` If the exit code is '1', then the control isn't present / failed",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/:https://kubernetes.io/docs/concepts/cluster-administration/master-node-communication/#apiserver---kubelet",
+ "DefaultValue": "By default, `--kubelet-certificate-authority` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.6",
+ "Description": "Ensure that the --authorization-mode argument is not set to AlwaysAllow",
+ "Checks": [
+ "apiserver_auth_mode_not_always_allow"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not always authorize all requests.",
+ "RationaleStatement": "The API Server, can be configured to allow all requests. This mode should not be used on any production cluster.",
+ "ImpactStatement": "Only authorized requests will be served.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--authorization-mode` parameter to values other than `AlwaysAllow`. One such example could be as below. ``` --authorization-mode=RBAC ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--authorization-mode` argument exists and is not set to `AlwaysAllow`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/admin/authorization/",
+ "DefaultValue": "By default, `AlwaysAllow` is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.7",
+ "Description": "Ensure that the --authorization-mode argument includes Node",
+ "Checks": [
+ "apiserver_auth_mode_include_node"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Restrict kubelet nodes to reading only objects associated with them.",
+ "RationaleStatement": "The `Node` authorization mode only allows kubelets to read `Secret`, `ConfigMap`, `PersistentVolume`, and `PersistentVolumeClaim` objects associated with their nodes.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--authorization-mode` parameter to a value that includes `Node`. ``` --authorization-mode=Node,RBAC ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--authorization-mode` argument exists and is set to a value to include `Node`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-apiserver/:https://kubernetes.io/docs/admin/authorization/node/:https://github.com/kubernetes/kubernetes/pull/46076:https://acotten.com/post/kube17-security",
+ "DefaultValue": "By default, `Node` authorization is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.8",
+ "Description": "Ensure that the --authorization-mode argument includes RBAC",
+ "Checks": [
+ "apiserver_auth_mode_include_rbac"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Turn on Role Based Access Control.",
+ "RationaleStatement": "Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.",
+ "ImpactStatement": "When RBAC is enabled you will need to ensure that appropriate RBAC settings (including Roles, RoleBindings and ClusterRoleBindings) are configured to allow appropriate access.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--authorization-mode` parameter to a value that includes `RBAC`, for example: ``` --authorization-mode=Node,RBAC ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--authorization-mode` argument exists and is set to a value to include `RBAC`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/access-authn-authz/rbac/",
+ "DefaultValue": "By default, `RBAC` authorization is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.9",
+ "Description": "Ensure that the admission control plugin EventRateLimit is set",
+ "Checks": [
+ "apiserver_event_rate_limit"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Limit the rate at which the API server accepts requests.",
+ "RationaleStatement": "Using `EventRateLimit` admission control enforces a limit on the number of events that the API Server will accept in a given time slice. A misbehaving workload could overwhelm and DoS the API Server, making it unavailable. This particularly applies to a multi-tenant cluster, where there might be a small percentage of misbehaving tenants which could have a significant impact on the performance of the cluster overall. Hence, it is recommended to limit the rate of events that the API server will accept.",
+ "ImpactStatement": "You need to carefully tune in limits as per your environment.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set the desired limits in a configuration file. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` and set the below parameters. ``` --enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=<path/to/configuration/file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--enable-admission-plugins` argument is set to a value that includes `EventRateLimit`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#eventratelimit:https://github.com/staebler/community/blob/9873b632f4d99b5d99c38c9b15fe2f8b93d0a746/contributors/design-proposals/admission_control_event_rate_limit.md",
+ "DefaultValue": "By default, `EventRateLimit` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.10",
+ "Description": "Ensure that the admission control plugin AlwaysAdmit is not set",
+ "Checks": [
+ "apiserver_no_always_admit_plugin"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not allow all requests.",
+ "RationaleStatement": "Setting admission control plugin `AlwaysAdmit` allows all requests and do not filter any requests. The `AlwaysAdmit` admission controller was deprecated in Kubernetes v1.13. Its behavior was equivalent to turning off all admission controllers.",
+ "ImpactStatement": "Only requests explicitly allowed by the admissions control plugins would be served.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and either remove the `--enable-admission-plugins` parameter, or set it to a value that does not include `AlwaysAdmit`.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that if the `--enable-admission-plugins` argument is set, its value does not include `AlwaysAdmit`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwaysadmit",
+ "DefaultValue": "`AlwaysAdmit` is not in the list of default admission plugins."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.11",
+ "Description": "Ensure that the admission control plugin AlwaysPullImages is set",
+ "Checks": [
+ "apiserver_always_pull_images_plugin"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Always pull images.",
+ "RationaleStatement": "Setting admission control policy to `AlwaysPullImages` forces every new pod to pull the required images every time. In a multi-tenant cluster users can be assured that their private images can only be used by those who have the credentials to pull them. Without this admission control policy, once an image has been pulled to a node, any pod from any user can use it simply by knowing the image’s name, without any authorization check against the image ownership. When this plug-in is enabled, images are always pulled prior to starting containers, which means valid credentials are required.",
+ "ImpactStatement": "Credentials would be required to pull the private images every time. Also, in trusted environments, this might increases load on network, registry, and decreases speed. This setting could impact offline or isolated clusters, which have images preloaded and do not have access to a registry to pull in-use images. This setting is not appropriate for clusters which use this configuration.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--enable-admission-plugins` parameter to include `AlwaysPullImages`. ``` --enable-admission-plugins=...,AlwaysPullImages,... ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--enable-admission-plugins` argument is set to a value that includes `AlwaysPullImages`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages",
+ "DefaultValue": "By default, `AlwaysPullImages` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.12",
+ "Description": "Ensure that the admission control plugin ServiceAccount is set",
+ "Checks": [
+ "apiserver_service_account_plugin"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Automate service accounts management.",
+ "RationaleStatement": "When you create a pod, if you do not specify a service account, it is automatically assigned the `default` service account in the same namespace. You should create your own service account and let the API server manage its security tokens.",
+ "ImpactStatement": "None.",
+ "RemediationProcedure": "Follow the documentation and create `ServiceAccount` objects as per your environment. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and ensure that the `--disable-admission-plugins` parameter is set to a value that does not include `ServiceAccount`.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--disable-admission-plugins` argument is set to a value that does not includes `ServiceAccount`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#serviceaccount:https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
+ "DefaultValue": "By default, `ServiceAccount` is set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.13",
+ "Description": "Ensure that the admission control plugin NamespaceLifecycle is set",
+ "Checks": [
+ "apiserver_namespace_lifecycle_plugin"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Reject creating objects in a namespace that is undergoing termination.",
+ "RationaleStatement": "Setting admission control policy to `NamespaceLifecycle` ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating the new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of the newer objects.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--disable-admission-plugins` parameter to ensure it does not include `NamespaceLifecycle`.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--disable-admission-plugins` argument is set to a value that does not include `NamespaceLifecycle`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle",
+ "DefaultValue": "By default, `NamespaceLifecycle` is set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.14",
+ "Description": "Ensure that the admission control plugin NodeRestriction is set",
+ "Checks": [
+ "apiserver_node_restriction_plugin"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Limit the `Node` and `Pod` objects that a kubelet could modify.",
+ "RationaleStatement": "Using the `NodeRestriction` plug-in ensures that the kubelet is restricted to the `Node` and `Pod` objects that it could modify as defined. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Follow the Kubernetes documentation and configure `NodeRestriction` plug-in on kubelets. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the `--enable-admission-plugins` parameter to a value that includes `NodeRestriction`. ``` --enable-admission-plugins=...,NodeRestriction,... ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--enable-admission-plugins` argument is set to a value that includes `NodeRestriction`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction:https://kubernetes.io/docs/reference/access-authn-authz/node/",
+ "DefaultValue": "By default, `NodeRestriction` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.15",
+ "Description": "Ensure that the --profiling argument is set to false",
+ "Checks": [
+ "apiserver_disable_profiling"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Disable profiling, if not needed.",
+ "RationaleStatement": "Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface.",
+ "ImpactStatement": "Profiling information would not be available.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the below parameter. ``` --profiling=false ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--profiling` argument is set to `false`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
+ "DefaultValue": "By default, profiling is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.16",
+ "Description": "Ensure that the --audit-log-path argument is set",
+ "Checks": [
+ "apiserver_audit_log_path_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable auditing on the Kubernetes API Server and set the desired audit log path.",
+ "RationaleStatement": "Auditing the Kubernetes API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. Even though currently, Kubernetes provides only basic audit capabilities, it should be enabled. You can enable it by setting an appropriate audit log path.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--audit-log-path` parameter to a suitable path and file where you would like audit logs to be written, for example: ``` --audit-log-path=/var/log/apiserver/audit.log ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--audit-log-path` argument is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
+ "DefaultValue": "By default, auditing is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.17",
+ "Description": "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate",
+ "Checks": [
+ "apiserver_audit_log_maxage_set"
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Retain the logs for at least 30 days or as appropriate.",
+ "RationaleStatement": "Retaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--audit-log-maxage` parameter to 30 or as an appropriate number of days: ``` --audit-log-maxage=30 ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--audit-log-maxage` argument is set to `30` or as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
+ "DefaultValue": "By default, auditing is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.18",
+ "Description": "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate",
+ "Checks": [
+ "apiserver_audit_log_maxbackup_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Retain 10 or an appropriate number of old log files.",
+ "RationaleStatement": "Kubernetes automatically rotates the log files. Retaining old log files ensures that you would have sufficient log data available for carrying out any investigation or correlation. For example, if you have set file size of 100 MB and the number of old log files to keep as 10, you would approximate have 1 GB of log data that you could potentially use for your analysis.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--audit-log-maxbackup` parameter to 10 or to an appropriate value. ``` --audit-log-maxbackup=10 ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--audit-log-maxbackup` argument is set to `10` or as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
+ "DefaultValue": "By default, auditing is not enabled."
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
+ ]
+ },
+ {
+ "Id": "1.2.19",
+ "Description": "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate",
+ "Checks": [
+ "apiserver_audit_log_maxsize_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Rotate log files on reaching 100 MB or as appropriate.",
+ "RationaleStatement": "Kubernetes automatically rotates the log files. Retaining old log files ensures that you would have sufficient log data available for carrying out any investigation or correlation. If you have set file size of 100 MB and the number of old log files to keep as 10, you would approximate have 1 GB of log data that you could potentially use for your analysis.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--audit-log-maxsize` parameter to an appropriate size in MB. For example, to set it as 100 MB: ``` --audit-log-maxsize=100 ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--audit-log-maxsize` argument is set to `100` or as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/:https://github.com/kubernetes/enhancements/issues/22",
+ "DefaultValue": "By default, auditing is not enabled."
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
+ ]
+ },
+ {
+ "Id": "1.2.20",
+ "Description": "Ensure that the --request-timeout argument is set as appropriate",
+ "Checks": [
+ "apiserver_request_timeout_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Set global request timeout for API server requests as appropriate.",
+ "RationaleStatement": "Setting global request timeout allows extending the API server request timeout limit to a duration appropriate to the user's connection speed. By default, it is set to 60 seconds which might be problematic on slower connections making cluster resources inaccessible once the data volume for requests exceeds what can be transmitted in 60 seconds. But, setting this timeout limit to be too large can exhaust the API server resources making it prone to Denial-of-Service attack. Hence, it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` and set the below parameter as appropriate and if needed. For example, ``` --request-timeout=300s ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--request-timeout` argument is either not set or set to an appropriate value.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kubernetes/kubernetes/pull/51415",
+ "DefaultValue": "By default, `--request-timeout` is set to 60 seconds."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.21",
+ "Description": "Ensure that the --service-account-lookup argument is set to true",
+ "Checks": [
+ "apiserver_service_account_lookup_true"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Validate service account before validating token.",
+ "RationaleStatement": "If `--service-account-lookup` is not enabled, the apiserver only verifies that the authentication token is valid, and does not validate that the service account token mentioned in the request is actually present in etcd. This allows using a service account token even after the corresponding service account is deleted. This is an example of time of check to time of use security issue.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the below parameter. ``` --service-account-lookup=true ``` Alternatively, you can delete the `--service-account-lookup` parameter from this file so that the default takes effect.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that if the `--service-account-lookup` argument exists it is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kubernetes/kubernetes/issues/24167:https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use",
+ "DefaultValue": "By default, `--service-account-lookup` argument is set to `true`."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.22",
+ "Description": "Ensure that the --service-account-key-file argument is set as appropriate",
+ "Checks": [
+ "apiserver_service_account_key_file_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Explicitly set a service account public key file for service accounts on the apiserver.",
+ "RationaleStatement": "By default, if no `--service-account-key-file` is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with `--service-account-key-file`.",
+ "ImpactStatement": "The corresponding private key must be provided to the controller manager. You would need to securely maintain the key file and rotate the keys based on your organization's key rotation policy.",
+ "RemediationProcedure": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--service-account-key-file` parameter to the public key file for service accounts: ``` --service-account-key-file=<filename> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--service-account-key-file` argument exists and is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kubernetes/kubernetes/issues/24167",
+ "DefaultValue": "By default, `--service-account-key-file` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.23",
+ "Description": "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate",
+ "Checks": [
+ "apiserver_etcd_tls_config"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "etcd should be configured to make use of TLS encryption for client connections.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a client certificate and key.",
+ "ImpactStatement": "TLS and client certificate authentication must be configured for etcd.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the etcd certificate and key file parameters. ``` --etcd-certfile=<path/to/client-certificate-file> --etcd-keyfile=<path/to/client-key-file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--etcd-certfile` and `--etcd-keyfile` arguments exist and they are set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
+ "DefaultValue": "By default, `--etcd-certfile` and `--etcd-keyfile` arguments are not set"
+ }
+ ]
+ },
+ {
+ "Id": "1.2.24",
+ "Description": "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate",
+ "Checks": [
+ "apiserver_tls_config"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Setup TLS connection on the API server.",
+ "RationaleStatement": "API server communication contains sensitive parameters that should remain encrypted in transit. Configure the API server to serve only HTTPS traffic.",
+ "ImpactStatement": "TLS and client certificate authentication must be configured for your Kubernetes cluster deployment.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the TLS certificate and private key file parameters. ``` --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--tls-cert-file` and `--tls-private-key-file` arguments exist and they are set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kelseyhightower/docker-kubernetes-tls-guide",
+ "DefaultValue": "By default, `--tls-cert-file` and `--tls-private-key-file` are presented and created for use."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.25",
+ "Description": "Ensure that the --client-ca-file argument is set as appropriate",
+ "Checks": [
+ "apiserver_client_ca_file_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Setup TLS connection on the API server.",
+ "RationaleStatement": "API server communication contains sensitive parameters that should remain encrypted in transit. Configure the API server to serve only HTTPS traffic. If `--client-ca-file` argument is set, any request presenting a client certificate signed by one of the authorities in the `client-ca-file` is authenticated with an identity corresponding to the CommonName of the client certificate.",
+ "ImpactStatement": "TLS and client certificate authentication must be configured for your Kubernetes cluster deployment.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the client certificate authority file. ``` --client-ca-file=<path/to/client-ca-file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--client-ca-file` argument exists and it is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kelseyhightower/docker-kubernetes-tls-guide",
+ "DefaultValue": "By default, `--client-ca-file` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.26",
+ "Description": "Ensure that the --etcd-cafile argument is set as appropriate",
+ "Checks": [
+ "apiserver_etcd_cafile_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "etcd should be configured to make use of TLS encryption for client connections.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a SSL Certificate Authority file.",
+ "ImpactStatement": "TLS and client certificate authentication must be configured for etcd.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the etcd certificate authority file parameter. ``` --etcd-cafile=<path/to/ca-file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--etcd-cafile` argument exists and it is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
+ "DefaultValue": "By default, `--etcd-cafile` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.27",
+ "Description": "Ensure that the --encryption-provider-config argument is set as appropriate",
+ "Checks": [
+ "apiserver_encryption_provider_config_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Encrypt etcd key-value store.",
+ "RationaleStatement": "etcd is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted at rest to avoid any disclosures.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Follow the Kubernetes documentation and configure a `EncryptionConfig` file. Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the `--encryption-provider-config` parameter to the path of that file: ``` --encryption-provider-config=</path/to/EncryptionConfig/File> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--encryption-provider-config` argument is set to a `EncryptionConfig` file. Additionally, ensure that the `EncryptionConfig` file has all the desired `resources` covered especially any secrets.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/:https://acotten.com/post/kube17-security:https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kubernetes/enhancements/issues/92",
+ "DefaultValue": "By default, `--encryption-provider-config` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.28",
+ "Description": "Ensure that encryption providers are appropriately configured",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Where `etcd` encryption is used, appropriate providers should be configured.",
+ "RationaleStatement": "Where `etcd` encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, the `aescbc`, `kms`, and `secretbox` are likely to be appropriate options.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Follow the Kubernetes documentation and configure a `EncryptionConfig` file. In this file, choose `aescbc`, `kms`, or `secretbox` as the encryption provider.",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Get the `EncryptionConfig` file set for `--encryption-provider-config` argument. Verify that `aescbc`, `kms`, or `secretbox` is set as the encryption provider for all the desired `resources`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/:https://acotten.com/post/kube17-security:https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/kubernetes/enhancements/issues/92:https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers",
+ "DefaultValue": "By default, no encryption provider is set."
+ }
+ ]
+ },
+ {
+ "Id": "1.2.29",
+ "Description": "Ensure that the API Server only makes use of Strong Cryptographic Ciphers",
+ "Checks": [
+ "apiserver_strong_ciphers_only"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the API server is configured to only use strong cryptographic ciphers.",
+ "RationaleStatement": "TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS cipher suites including some that have security concerns, weakening the protection provided.",
+ "ImpactStatement": "API server clients that cannot support modern cryptographic ciphers will not be able to make connections to the API server.",
+ "RemediationProcedure": "Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the below parameter. ``` --tls-cipher-suites=TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256. ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--tls-cipher-suites` argument returns a value that is in this list `TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`.",
+ "AdditionalInformation": "Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/:https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites",
+ "DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_strong_ciphers_only",
+ "ConfigKey": "apiserver_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_AES_128_GCM_SHA256",
+ "TLS_AES_256_GCM_SHA384",
+ "TLS_CHACHA20_POLY1305_SHA256"
+ ]
+ }
+ ]
+ },
+ {
+ "Id": "1.2.30",
+ "Description": "Ensure that the --service-account-extend-token-expiration parameter is set to false",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.2 API Server",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "By default Kubernetes extends service account token lifetimes to one year to aid in transition from the legacy token settings.",
+ "RationaleStatement": "This default setting is not ideal for security as it ignores other settings related to maximum token lifetime and means that a lost or stolen credential could be valid for an extended period of time.",
+ "ImpactStatement": "Disabling this setting means that the service account token expiry set in the cluster will be enforced, and service account tokens will expire at the end of that time frame.",
+ "RemediationProcedure": "Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the --service-account-extend-token-expiration parameter to false. ``` --service-account-extend-token-expiration=false ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the --service-account-extend-token-expiration argument is set to false.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/",
+ "DefaultValue": "By default, this parameter is set to true"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.1",
+ "Description": "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate",
+ "Checks": [
+ "controllermanager_garbage_collection"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Activate garbage collector on pod termination, as appropriate.",
+ "RationaleStatement": "Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. The current setting for garbage collection is 12,500 terminated pods which might be too high for your system to sustain. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the `--terminated-pod-gc-threshold` to an appropriate threshold, for example: ``` --terminated-pod-gc-threshold=10 ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--terminated-pod-gc-threshold` argument is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/:https://github.com/kubernetes/kubernetes/issues/28484",
+ "DefaultValue": "By default, `--terminated-pod-gc-threshold` is set to `12500`."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.2",
+ "Description": "Ensure that the --profiling argument is set to false",
+ "Checks": [
+ "controllermanager_disable_profiling"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Disable profiling, if not needed.",
+ "RationaleStatement": "Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface.",
+ "ImpactStatement": "Profiling information would not be available.",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the below parameter. ``` --profiling=false ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--profiling` argument is set to `false`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/:https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md",
+ "DefaultValue": "By default, profiling is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.3",
+ "Description": "Ensure that the --use-service-account-credentials argument is set to true",
+ "Checks": [
+ "controllermanager_service_account_credentials"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Use individual service account credentials for each controller.",
+ "RationaleStatement": "The controller manager creates a service account per controller in the `kube-system` namespace, generates a credential for it, and builds a dedicated API client with that service account credential for each controller loop to use. Setting the `--use-service-account-credentials` to `true` runs each control loop within the controller manager using a separate service account credential. When used in combination with RBAC, this ensures that the control loops run with the minimum permissions required to perform their intended tasks.",
+ "ImpactStatement": "Whatever authorizer is configured for the cluster, it must grant sufficient permissions to the service accounts to perform their intended tasks. When using the RBAC authorizer, those roles are created and bound to the appropriate service accounts in the `kube-system` namespace automatically with default roles and rolebindings that are auto-reconciled on startup. If using other authorization methods (ABAC, Webhook, etc), the cluster deployer is responsible for granting appropriate permissions to the service accounts (the required permissions can be seen by inspecting the `controller-roles.yaml` and `controller-role-bindings.yaml` files for the RBAC roles.",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node to set the below parameter. ``` --use-service-account-credentials=true ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--use-service-account-credentials` argument is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/:https://kubernetes.io/docs/admin/service-accounts-admin/:https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml:https://github.com/kubernetes/kubernetes/blob/release-1.6/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-role-bindings.yaml:https://kubernetes.io/docs/admin/authorization/rbac/#controller-roles",
+ "DefaultValue": "By default, `--use-service-account-credentials` is set to false."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.4",
+ "Description": "Ensure that the --service-account-private-key-file argument is set as appropriate",
+ "Checks": [
+ "controllermanager_service_account_private_key_file"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Explicitly set a service account private key file for service accounts on the controller manager.",
+ "RationaleStatement": "To ensure that keys for service account tokens can be rotated as needed, a separate public/private key pair should be used for signing service account tokens. The private key should be specified to the controller manager with `--service-account-private-key-file` as appropriate.",
+ "ImpactStatement": "You would need to securely maintain the key file and rotate the keys based on your organization's key rotation policy.",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the `--service-account-private-key-file` parameter to the private key file for service accounts. ``` --service-account-private-key-file=<filename> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--service-account-private-key-file` argument is set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/",
+ "DefaultValue": "By default, `--service-account-private-key-file` it not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.5",
+ "Description": "Ensure that the --root-ca-file argument is set as appropriate",
+ "Checks": [
+ "controllermanager_root_ca_file_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Allow pods to verify the API server's serving certificate before establishing connections.",
+ "RationaleStatement": "Processes running within pods that need to contact the API server must verify the API server's serving certificate. Failing to do so could be a subject to man-in-the-middle attacks. Providing the root certificate for the API server's serving certificate to the controller manager with the `--root-ca-file` argument allows the controller manager to inject the trusted bundle into pods so that they can verify TLS connections to the API server.",
+ "ImpactStatement": "You need to setup and maintain root certificate authority file.",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the `--root-ca-file` parameter to the certificate bundle file`. ``` --root-ca-file=<path/to/file> ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--root-ca-file` argument exists and is set to a certificate bundle file containing the root certificate for the API server's serving certificate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-controller-manager/:https://github.com/kubernetes/kubernetes/issues/11000",
+ "DefaultValue": "By default, `--root-ca-file` is not set."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.6",
+ "Description": "Ensure that the RotateKubeletServerCertificate argument is set to true",
+ "Checks": [
+ "controllermanager_rotate_kubelet_server_cert"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable kubelet server certificate rotation on controller-manager.",
+ "RationaleStatement": "`RotateKubeletServerCertificate` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the `--feature-gates` parameter to include `RotateKubeletServerCertificate=true`. ``` --feature-gates=RotateKubeletServerCertificate=true ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that `RotateKubeletServerCertificate` argument exists and is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#approval-controller:https://github.com/kubernetes/features/issues/267:https://github.com/kubernetes/kubernetes/pull/45059:https://kubernetes.io/docs/admin/kube-controller-manager/",
+ "DefaultValue": "By default, `RotateKubeletServerCertificate` is set to true this recommendation verifies that it has not been disabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.3.7",
+ "Description": "Ensure that the --bind-address argument is set to 127.0.0.1",
+ "Checks": [
+ "controllermanager_bind_address"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.3 Controller Manager",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not bind the Controller Manager service to non-loopback insecure addresses.",
+ "RationaleStatement": "The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and ensure the correct value for the `--bind-address` parameter",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-controller-manager ``` Verify that the `--bind-address` argument is set to 127.0.0.1",
+ "AdditionalInformation": "Although the current Kubernetes documentation site says that `--address` is deprecated in favour of `--bind-address` Kubeadm 1.11 still makes use of `--address`",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
+ "DefaultValue": "By default, the `--bind-address` parameter is set to 0.0.0.0"
+ }
+ ]
+ },
+ {
+ "Id": "1.4.1",
+ "Description": "Ensure that the --profiling argument is set to false",
+ "Checks": [
+ "scheduler_profiling"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.4 Scheduler",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Disable profiling, if not needed.",
+ "RationaleStatement": "Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface.",
+ "ImpactStatement": "Profiling information would not be available.",
+ "RemediationProcedure": "Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml` file on the Control Plane node and set the below parameter. ``` --profiling=false ```",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-scheduler ``` Verify that the `--profiling` argument is set to `false`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-scheduler/:https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md",
+ "DefaultValue": "By default, profiling is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "1.4.2",
+ "Description": "Ensure that the --bind-address argument is set to 127.0.0.1",
+ "Checks": [
+ "scheduler_bind_address"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Control Plane Components",
+ "SubSection": "1.4 Scheduler",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not bind the scheduler service to non-loopback insecure addresses.",
+ "RationaleStatement": "The Scheduler API service which runs on port 10251/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml` on the Control Plane node and ensure the correct value for the `--bind-address` parameter",
+ "AuditProcedure": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-scheduler ``` Verify that the `--bind-address` argument is set to 127.0.0.1",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/",
+ "DefaultValue": "By default, the `--bind-address` parameter is set to 0.0.0.0"
+ }
+ ]
+ },
+ {
+ "Id": "2.1",
+ "Description": "Ensure that the --cert-file and --key-file arguments are set as appropriate",
+ "Checks": [
+ "etcd_tls_encryption"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Configure TLS encryption for the etcd service.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit.",
+ "ImpactStatement": "Client connections only over TLS would be served.",
+ "RemediationProcedure": "Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameters. ``` --cert-file=</path/to/ca-file> --key-file=</path/to/key-file> ```",
+ "AuditProcedure": "Run the following command on the etcd server node ``` ps -ef | grep etcd ``` Verify that the `--cert-file` and the `--key-file` arguments are set as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "By default, TLS encryption is not set."
+ }
+ ]
+ },
+ {
+ "Id": "2.2",
+ "Description": "Ensure that the --client-cert-auth argument is set to true",
+ "Checks": [
+ "etcd_client_cert_auth"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable client authentication on etcd service.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.",
+ "ImpactStatement": "All clients attempting to access the etcd server will require a valid client certificate.",
+ "RemediationProcedure": "Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameter. ``` --client-cert-auth=true ```",
+ "AuditProcedure": "Run the following command on the etcd server node: ``` ps -ef | grep etcd ``` Verify that the `--client-cert-auth` argument is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/:https://coreos.com/etcd/docs/latest/op-guide/configuration.html#client-cert-auth",
+ "DefaultValue": "By default, the etcd service can be queried by unauthenticated clients."
+ }
+ ]
+ },
+ {
+ "Id": "2.3",
+ "Description": "Ensure that the --auto-tls argument is not set to true",
+ "Checks": [
+ "etcd_no_auto_tls"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not use self-signed certificates for TLS.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.",
+ "ImpactStatement": "Clients will not be able to use self-signed certificates for TLS.",
+ "RemediationProcedure": "Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and either remove the `--auto-tls` parameter or set it to `false`. ``` --auto-tls=false ```",
+ "AuditProcedure": "Run the following command on the etcd server node: ``` ps -ef | grep etcd ``` Verify that if the `--auto-tls` argument exists, it is not set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/:https://coreos.com/etcd/docs/latest/op-guide/configuration.html#auto-tls",
+ "DefaultValue": "By default, `--auto-tls` is set to `false`."
+ }
+ ]
+ },
+ {
+ "Id": "2.4",
+ "Description": "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate",
+ "Checks": [
+ "etcd_peer_tls_config"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "etcd should be configured to make use of TLS encryption for peer connections.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit and also amongst peers in the etcd clusters.",
+ "ImpactStatement": "etcd cluster peers would need to set up TLS for their communication.",
+ "RemediationProcedure": "Follow the etcd service documentation and configure peer TLS encryption as appropriate for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameters. ``` --peer-client-file=</path/to/peer-cert-file> --peer-key-file=</path/to/peer-key-file> ```",
+ "AuditProcedure": "Run the following command on the etcd server node: ``` ps -ef | grep etcd ``` Verify that the `--peer-cert-file` and `--peer-key-file` arguments are set as appropriate. **Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/",
+ "DefaultValue": "**Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable. By default, peer communication over TLS is not configured."
+ }
+ ]
+ },
+ {
+ "Id": "2.5",
+ "Description": "Ensure that the --peer-client-cert-auth argument is set to true",
+ "Checks": [
+ "etcd_peer_client_cert_auth"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "etcd should be configured for peer authentication.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster.",
+ "ImpactStatement": "All peers attempting to communicate with the etcd server will require a valid client certificate for authentication.",
+ "RemediationProcedure": "Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameter. ``` --peer-client-cert-auth=true ```",
+ "AuditProcedure": "Run the following command on the etcd server node: ``` ps -ef | grep etcd ``` Verify that the `--peer-client-cert-auth` argument is set to `true`. **Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/:https://coreos.com/etcd/docs/latest/op-guide/configuration.html#peer-client-cert-auth",
+ "DefaultValue": "**Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable. By default, `--peer-client-cert-auth` argument is set to `false`."
+ }
+ ]
+ },
+ {
+ "Id": "2.6",
+ "Description": "Ensure that the --peer-auto-tls argument is not set to true",
+ "Checks": [
+ "etcd_no_peer_auto_tls"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not use automatically generated self-signed certificates for TLS connections between peers.",
+ "RationaleStatement": "etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster. Hence, do not use self-signed certificates for authentication.",
+ "ImpactStatement": "All peers attempting to communicate with the etcd server will require a valid client certificate for authentication.",
+ "RemediationProcedure": "Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and either remove the `--peer-auto-tls` parameter or set it to `false`. ``` --peer-auto-tls=false ```",
+ "AuditProcedure": "Run the following command on the etcd server node: ``` ps -ef | grep etcd ``` Verify that if the `--peer-auto-tls` argument exists, it is not set to `true`. **Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html:https://kubernetes.io/docs/admin/etcd/:https://coreos.com/etcd/docs/latest/op-guide/configuration.html#peer-auto-tls",
+ "DefaultValue": "**Note:** This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable. By default, `--peer-auto-tls` argument is set to `false`."
+ }
+ ]
+ },
+ {
+ "Id": "2.7",
+ "Description": "Ensure that a unique Certificate Authority is used for etcd",
+ "Checks": [
+ "etcd_unique_ca"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 etcd",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Use a different certificate authority for etcd from the one used for Kubernetes.",
+ "RationaleStatement": "etcd is a highly available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. Its access should be restricted to specifically designated clients and peers only. Authentication to etcd is based on whether the certificate presented was issued by a trusted certificate authority. There is no checking of certificate attributes such as common name or subject alternative name. As such, if any attackers were able to gain access to any certificate issued by the trusted certificate authority, they would be able to gain full access to the etcd database.",
+ "ImpactStatement": "Additional management of the certificates and keys for the dedicated certificate authority will be required.",
+ "RemediationProcedure": "Follow the etcd documentation and create a dedicated certificate authority setup for the etcd service. Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameter. ``` --trusted-ca-file=</path/to/ca-file> ```",
+ "AuditProcedure": "Review the CA used by the etcd environment and ensure that it does not match the CA certificate file used for the management of the overall Kubernetes cluster. Run the following command on the master node: ``` ps -ef | grep etcd ``` Note the file referenced by the `--trusted-ca-file` argument. Run the following command on the master node: ``` ps -ef | grep apiserver ``` Verify that the file referenced by the `--client-ca-file` for apiserver is different from the `--trusted-ca-file` used by etcd.",
+ "AdditionalInformation": "",
+ "References": "https://coreos.com/etcd/docs/latest/op-guide/security.html",
+ "DefaultValue": "By default, no etcd certificate is created and used."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.1",
+ "Description": "Client certificate authentication should not be used for users",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Control Plane Configuration",
+ "SubSection": "3.1 Authentication and Authorization",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose. It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication.",
+ "RationaleStatement": "With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Kubernetes client certificate authentication does not allow for this due to a lack of support for certificate revocation.",
+ "ImpactStatement": "External mechanisms for authentication generally require additional software to be deployed.",
+ "RemediationProcedure": "Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates.",
+ "AuditProcedure": "Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication.",
+ "AdditionalInformation": "The lack of certificate revocation was flagged up as a high risk issue in the recent Kubernetes security audit. Without this feature, client certificate authentication is not suitable for end users.",
+ "References": "",
+ "DefaultValue": "Client certificate authentication is enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.2",
+ "Description": "Service account token authentication should not be used for users",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Control Plane Configuration",
+ "SubSection": "3.1 Authentication and Authorization",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes provides service account tokens which are intended for use by workloads running in the Kubernetes cluster, for authentication to the API server. These tokens are not designed for use by end-users and do not provide for features such as revocation or expiry, making them insecure. A newer version of the feature (Bound service account token volumes) does introduce expiry but still does not allow for specific revocation.",
+ "RationaleStatement": "With any authentication mechanism the ability to revoke credentials if they are compromised or no longer required, is a key control. Service account token authentication does not allow for this due to the use of JWT tokens as an underlying technology.",
+ "ImpactStatement": "External mechanisms for authentication generally require additional software to be deployed.",
+ "RemediationProcedure": "Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of service account tokens.",
+ "AuditProcedure": "Review user access to the cluster and ensure that users are not making use of service account token authentication.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Service account token authentication is enabled by default."
+ }
+ ]
+ },
+ {
+ "Id": "3.1.3",
+ "Description": "Bootstrap token authentication should not be used for users",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Control Plane Configuration",
+ "SubSection": "3.1 Authentication and Authorization",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes provides bootstrap tokens which are intended for use by new nodes joining the cluster These tokens are not designed for use by end-users they are specifically designed for the purpose of bootstrapping new nodes and not for general authentication",
+ "RationaleStatement": "Bootstrap tokens are not intended for use as a general authentication mechanism and impose constraints on user and group naming that do not facilitate good RBAC design. They also cannot be used with MFA resulting in a weak authentication mechanism being available.",
+ "ImpactStatement": "External mechanisms for authentication generally require additional software to be deployed.",
+ "RemediationProcedure": "Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of bootstrap tokens.",
+ "AuditProcedure": "Review user access to the cluster and ensure that users are not making use of bootstrap token authentication.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Bootstrap token authentication is not enabled by default and requires an API server parameter to be set."
+ }
+ ]
+ },
+ {
+ "Id": "3.2.1",
+ "Description": "Ensure that a minimal audit policy is created",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Control Plane Configuration",
+ "SubSection": "3.2 Logging",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes can audit the details of requests made to the API server. The `--audit-policy-file` flag must be set for this logging to be enabled.",
+ "RationaleStatement": "Logging is an important detective control for all systems, to detect potential unauthorised access.",
+ "ImpactStatement": "Audit logs will be created on the master nodes, which will consume disk space. Care should be taken to avoid generating too large volumes of log information as this could impact the available of the cluster nodes.",
+ "RemediationProcedure": "Create an audit policy file for your cluster.",
+ "AuditProcedure": "Run the following command on one of the cluster master nodes: ``` ps -ef | grep kube-apiserver ``` Verify that the `--audit-policy-file` is set. Review the contents of the file specified and ensure that it contains a valid audit policy.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/debug-application-cluster/audit/",
+ "DefaultValue": "Unless the `--audit-policy-file` flag is specified, no auditing will be carried out."
+ }
+ ]
+ },
+ {
+ "Id": "3.2.2",
+ "Description": "Ensure that the audit policy covers key security concerns",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Control Plane Configuration",
+ "SubSection": "3.2 Logging",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the audit policy created for the cluster covers key security concerns.",
+ "RationaleStatement": "Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment.",
+ "ImpactStatement": "Increasing audit logging will consume resources on the nodes or other log destination.",
+ "RemediationProcedure": "Consider modification of the audit policy in use on the cluster to include these items, at a minimum.",
+ "AuditProcedure": "Review the audit policy provided for the cluster and ensure that it covers at least the following areas :- - Access to Secrets managed by the cluster. Care should be taken to only log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in order to avoid the risk of logging sensitive data. - Modification of `pod` and `deployment` objects. - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - Use of the `CertificateSigningRequest` API which allows for creation of new credentials. - Use of the Token sub-resource of `ServiceAccount` objects which allows for creation of new credentials. For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging). Exceptions should be created in the audit logging policy to ensure that system operations (e.g. the Kubelet creating new credentials) are not logged, to reduce operational load and the risk of false positives.",
+ "AdditionalInformation": "",
+ "References": "https://github.com/k8scop/k8s-security-dashboard/blob/master/configs/kubernetes/adv-audit.yaml:https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#audit-policy:https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh#L735",
+ "DefaultValue": "By default Kubernetes clusters do not log audit information."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.1",
+ "Description": "Ensure that the kubelet service file permissions are set to 600 or more restrictive",
+ "Checks": [
+ "kubelet_service_file_permissions"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `kubelet` service file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The `kubelet` service file controls various parameters that set the behavior of the `kubelet` service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet service config file. Please set $kubelet_service_config=<PATH><filename> based on the file location on your system for example: ``` export kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#44-joining-your-nodes:https://kubernetes.io/docs/admin/kubeadm/#kubelet-drop-in",
+ "DefaultValue": "By default, the `kubelet` service file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.2",
+ "Description": "Ensure that the kubelet service file ownership is set to root:root",
+ "Checks": [
+ "kubelet_service_file_ownership_root"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `kubelet` service file ownership is set to `root:root`.",
+ "RationaleStatement": "The `kubelet` service file controls various parameters that set the behavior of the `kubelet` service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chown root:root /etc/systemd/system/kubelet.service.d/kubeadm.conf ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet service config file. Please set $kubelet_service_config=<PATH><filename> based on the file location on your system for example: ``` export kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#44-joining-your-nodes:https://kubernetes.io/docs/admin/kubeadm/#kubelet-drop-in",
+ "DefaultValue": "By default, `kubelet` service file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.3",
+ "Description": "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "If `kube-proxy` is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The `kube-proxy` kubeconfig file controls various parameters of the `kube-proxy` service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system. It is possible to run `kube-proxy` with the kubeconfig parameters configured as a Kubernetes ConfigMap instead of a file. In this case, there is no proxy kubeconfig file.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chmod 600 <proxy kubeconfig file> ```",
+ "AuditProcedure": "Find the kubeconfig file being used by `kube-proxy` by running the following command: ``` ps -ef | grep kube-proxy ``` If `kube-proxy` is running, get the kubeconfig file location from the `--kubeconfig` parameter. To perform the audit: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %a <path><filename> ``` Verify that a file is specified and it exists with permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-proxy/",
+ "DefaultValue": "By default, proxy file has permissions of `640`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.4",
+ "Description": "If proxy kubeconfig file exists ensure ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "If `kube-proxy` is running, ensure that the file ownership of its kubeconfig file is set to `root:root`.",
+ "RationaleStatement": "The kubeconfig file for `kube-proxy` controls various parameters for the `kube-proxy` service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chown root:root <proxy kubeconfig file> ```",
+ "AuditProcedure": "Find the kubeconfig file being used by `kube-proxy` by running the following command: ``` ps -ef | grep kube-proxy ``` If `kube-proxy` is running, get the kubeconfig file location from the `--kubeconfig` parameter. To perform the audit: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %U:%G <path><filename> ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kube-proxy/",
+ "DefaultValue": "By default, `proxy` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.5",
+ "Description": "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive",
+ "Checks": [
+ "kubelet_conf_file_permissions"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `kubelet.conf` file has permissions of `600` or more restrictive.",
+ "RationaleStatement": "The `kubelet.conf` file is the kubeconfig file for the node, and controls various parameters that set the behavior and identity of the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chmod 600 /etc/kubernetes/kubelet.conf ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet config file. Please set $kubelet_config=<PATH><filename> based on the file location on your system for example: ``` export kubelet_config=/etc/kubernetes/kubelet.conf ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %a /etc/kubernetes/kubelet.conf ``` Verify that the ownership is set to `root:root`.Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/",
+ "DefaultValue": "By default, `kubelet.conf` file has permissions of `600`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.6",
+ "Description": "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root",
+ "Checks": [
+ "kubelet_conf_file_ownership"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that the `kubelet.conf` file ownership is set to `root:root`.",
+ "RationaleStatement": "The `kubelet.conf` file is the kubeconfig file for the node, and controls various parameters that set the behavior and identity of the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the below command (based on the file location on your system) on the each worker node. For example, ``` chown root:root /etc/kubernetes/kubelet.conf ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet config file. Please set $kubelet_config=<PATH><filename> based on the file location on your system for example: ``` export kubelet_config=/etc/kubernetes/kubelet.conf ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %U:%G /etc/kubernetes/kubelet.conf ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/",
+ "DefaultValue": "By default, `kubelet.conf` file ownership is set to `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.7",
+ "Description": "Ensure that the certificate authorities file permissions are set to 644 or more restrictive",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the certificate authorities file has permissions of `644` or more restrictive.",
+ "RationaleStatement": "The certificate authorities file controls the authorities used to validate API requests. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the following command to modify the file permissions of the `--client-ca-file` ``` chmod 644 <filename> ```",
+ "AuditProcedure": "Run the following command: ``` ps -ef | grep kubelet ``` Find the file specified by the `--client-ca-file` argument. Run the following command: ``` stat -c %a <filename> ``` Verify that the permissions are `644` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/authentication/#x509-client-certs",
+ "DefaultValue": "By default no `--client-ca-file` is specified."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.8",
+ "Description": "Ensure that the client certificate authorities file ownership is set to root:root",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the certificate authorities file ownership is set to `root:root`.",
+ "RationaleStatement": "The certificate authorities file controls the authorities used to validate API requests. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the following command to modify the ownership of the `--client-ca-file`. ``` chown root:root <filename> ```",
+ "AuditProcedure": "Run the following command: ``` ps -ef | grep kubelet ``` Find the file specified by the `--client-ca-file` argument. Run the following command: ``` stat -c %U:%G <filename> ``` Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/authentication/#x509-client-certs",
+ "DefaultValue": "By default no `--client-ca-file` is specified."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.9",
+ "Description": "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive",
+ "Checks": [
+ "kubelet_config_yaml_permissions"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file has permissions of 600 or more restrictive.",
+ "RationaleStatement": "The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the following command (using the config file location identified in the Audit step) ``` chmod 600 /var/lib/kubelet/config.yaml ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet config yaml file. Please set $kubelet_config_yaml=<PATH><filename> based on the file location on your system for example: ``` export kubelet_config_yaml=/var/lib/kubelet/config.yaml ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %a /var/lib/kubelet/config.yaml ``` Verify that the permissions are `600` or more restrictive.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/",
+ "DefaultValue": "By default, the /var/lib/kubelet/config.yaml file as set up by `kubeadm` has permissions of 600."
+ }
+ ]
+ },
+ {
+ "Id": "4.1.10",
+ "Description": "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root",
+ "Checks": [
+ "kubelet_config_yaml_ownership"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.1 Worker Node Configuration Files",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file is owned by root:root.",
+ "RationaleStatement": "The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by root:root.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Run the following command (using the config file location identied in the Audit step) ``` chown root:root /etc/kubernetes/kubelet.conf ```",
+ "AuditProcedure": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet config yaml file. Please set $kubelet_config_yaml=<PATH><filename> based on the file location on your system for example: ``` export kubelet_config_yaml=/var/lib/kubelet/config.yaml ``` To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example, ``` stat -c %U:%G /var/lib/kubelet/config.yaml ```Verify that the ownership is set to `root:root`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/",
+ "DefaultValue": "By default, `/var/lib/kubelet/config.yaml` file as set up by `kubeadm` is owned by `root:root`."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.1",
+ "Description": "Ensure that the --anonymous-auth argument is set to false",
+ "Checks": [
+ "kubelet_disable_anonymous_auth"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Disable anonymous requests to the Kubelet server.",
+ "RationaleStatement": "When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. You should rely on authentication to authorize access and disallow anonymous requests.",
+ "ImpactStatement": "Anonymous requests will be rejected.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to `false`. If using executable arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. ``` --anonymous-auth=false ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "If using a Kubelet configuration file, check that there is an entry for `authentication: anonymous: enabled` set to `false`. Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the `--anonymous-auth` argument is set to `false`. This executable argument may be omitted, provided there is a corresponding entry set to `false` in the Kubelet config file.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authentication",
+ "DefaultValue": "By default, anonymous access is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.2",
+ "Description": "Ensure that the --authorization-mode argument is not set to AlwaysAllow",
+ "Checks": [
+ "kubelet_authorization_mode"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Do not allow all requests. Enable explicit authorization.",
+ "RationaleStatement": "Kubelets, by default, allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests.",
+ "ImpactStatement": "Unauthorized requests will be denied.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `authorization: mode` to `Webhook`. If using executable arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_AUTHZ_ARGS` variable. ``` --authorization-mode=Webhook ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` If the `--authorization-mode` argument is present check that it is not set to `AlwaysAllow`. If it is not present check that there is a Kubelet config file specified by `--config`, and that file sets `authorization: mode` to something other than `AlwaysAllow`. It is also possible to review the running configuration of a Kubelet via the `/configz` endpoint on the Kubelet API port (typically `10250/TCP`). Accessing these with appropriate credentials will provide details of the Kubelet's configuration.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authentication",
+ "DefaultValue": "By default, `--authorization-mode` argument is set to `AlwaysAllow`."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.3",
+ "Description": "Ensure that the --client-ca-file argument is set as appropriate",
+ "Checks": [
+ "kubelet_client_ca_file_set"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable Kubelet authentication using certificates.",
+ "RationaleStatement": "The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet’s port-forwarding functionality. These connections terminate at the kubelet’s HTTPS endpoint. By default, the apiserver does not verify the kubelet’s serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks. Enabling Kubelet certificate authentication ensures that the apiserver could authenticate the Kubelet before submitting any requests.",
+ "ImpactStatement": "You require TLS to be configured on apiserver as well as kubelets.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `authentication: x509: clientCAFile` to the location of the client CA file. If using command line arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_AUTHZ_ARGS` variable. ``` --client-ca-file=<path/to/client-ca-file> ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the `--client-ca-file` argument exists and is set to the location of the client certificate authority file. If the `--client-ca-file` argument is not present, check that there is a Kubelet config file specified by `--config`, and that the file sets `authentication: x509: clientCAFile` to the location of the client certificate authority file.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/",
+ "DefaultValue": "By default, `--client-ca-file` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.4",
+ "Description": "Verify that if defined, readOnlyPort is set to 0",
+ "Checks": [
+ "kubelet_disable_read_only_port"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Disable the read-only port.",
+ "RationaleStatement": "The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster.",
+ "ImpactStatement": "Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `readOnlyPort` to `0`. If using command line arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. ``` --read-only-port=0 ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the `--read-only-port` argument exists and is set to `0`. If the `--read-only-port` argument is not present, check that there is a Kubelet config file specified by `--config`. Check that if there is a `readOnlyPort` entry in the file, it is set to `0`.",
+ "AdditionalInformation": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://github.com/kubernetes/kubernetes/blob/6cedc0853faa118df0ba3d41b48b993422ad3df6/staging/src/k8s.io/kubelet/config/v1beta1/types.go#L142",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.5",
+ "Description": "Ensure that the --streaming-connection-idle-timeout argument is not set to 0",
+ "Checks": [
+ "kubelet_streaming_connection_timeout"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not disable timeouts on streaming connections.",
+ "RationaleStatement": "Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports. **Note:** By default, `--streaming-connection-idle-timeout` is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.",
+ "ImpactStatement": "Long-lived connections could be interrupted.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a value other than 0. If using command line arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. ``` --streaming-connection-idle-timeout=5m ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the `--streaming-connection-idle-timeout` argument is not set to `0`. If the argument is not present, and there is a Kubelet config file specified by `--config`, check that it does not set `streamingConnectionIdleTimeout` to 0.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://github.com/kubernetes/kubernetes/pull/18552",
+ "DefaultValue": "By default, `--streaming-connection-idle-timeout` is set to 4 hours."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.6",
+ "Description": "Ensure that the --make-iptables-util-chains argument is set to true",
+ "Checks": [
+ "kubelet_manage_iptables"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Allow Kubelet to manage iptables.",
+ "RationaleStatement": "Kubelets can automatically manage the required changes to iptables based on how you choose your networking options for the pods. It is recommended to let kubelets manage the changes to iptables. This ensures that the iptables configuration remains in sync with pods networking configuration. Manually configuring iptables with dynamic pod network configuration changes might hamper the communication between pods/containers and to the outside world. You might have iptables rules too restrictive or too open.",
+ "ImpactStatement": "Kubelet would manage the iptables on the system and keep it in sync. If you are using any other iptables management solution, then there might be some conflicts.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains: true`. If using command line arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and remove the `--make-iptables-util-chains` argument from the `KUBELET_SYSTEM_PODS_ARGS` variable. Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that if the `--make-iptables-util-chains` argument exists then it is set to `true`. If the `--make-iptables-util-chains` argument does not exist, and there is a Kubelet config file specified by `--config`, verify that the file does not set `makeIPTablesUtilChains` to `false`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/",
+ "DefaultValue": "By default, `--make-iptables-util-chains` argument is set to `true`."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.7",
+ "Description": "Ensure that the --hostname-override argument is not set",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not override node hostnames.",
+ "RationaleStatement": "Overriding hostnames could potentially break TLS setup between the kubelet and the apiserver. Additionally, with overridden hostnames, it becomes increasingly difficult to associate logs with a particular node and process them for security analytics. Hence, you should setup your kubelet nodes with resolvable FQDNs and avoid overriding the hostnames with IPs.",
+ "ImpactStatement": "Some cloud providers may require this flag to ensure that hostname matches names issued by the cloud provider. In these environments, this recommendation should not apply.",
+ "RemediationProcedure": "Edit the kubelet service file `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and remove the `--hostname-override` argument from the `KUBELET_SYSTEM_PODS_ARGS` variable. Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that `--hostname-override` argument does not exist. **Note** This setting is not configurable via the Kubelet config file.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://github.com/kubernetes/kubernetes/issues/22063",
+ "DefaultValue": "By default, `--hostname-override` argument is not set."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.8",
+ "Description": "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture",
+ "Checks": [
+ "kubelet_event_record_qps"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Security relevant information should be captured. The eventRecordQPS on the Kubelet configuration can be used to limit the rate at which events are gathered and sets the maximum event creations per second. Setting this too low could result in relevant events not being logged, however the unlimited setting of `0` could result in a denial of service on the kubelet.",
+ "RationaleStatement": "It is important to capture all events and not restrict event creation. Events are an important source of security information and analytics that ensure that your environment is consistently monitored using the event data.",
+ "ImpactStatement": "Setting this parameter to `0` could result in a denial of service condition due to excessive events being created. The cluster's event processing and storage systems should be scaled to handle expected event loads.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `eventRecordQPS:` to an appropriate level. If using command line arguments, edit the kubelet service file `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and set the below parameter in `KUBELET_ARGS` variable. Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` sudo grep eventRecordQPS /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ``` or If using command line arguments, kubelet service file is located /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf ``` sudo grep eventRecordQPS /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf ``` Review the value set for the argument and determine whether this has been set to an appropriate level for the cluster. If the argument does not exist, check that there is a Kubelet config file specified by `--config` and review the value in this location. If using command line arguments",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/kubelet/:https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go",
+ "DefaultValue": "By default, eventRecordQPS argument is set to `5`."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.9",
+ "Description": "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate",
+ "Checks": [
+ "kubelet_tls_cert_and_key"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Setup TLS connection on the Kubelets.",
+ "RationaleStatement": "The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet’s port-forwarding functionality. These connections terminate at the kubelet’s HTTPS endpoint. By default, the apiserver does not verify the kubelet’s serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file> Based on your system, restart the kubelet service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the --tls-cert-file and --tls-private-key-file arguments exist and they are set as appropriate. If these arguments are not present, check that there is a Kubelet config specified by --config and that it contains appropriate settings for tlsCertFile and tlsPrivateKeyFile.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "4.2.10",
+ "Description": "Ensure that the --rotate-certificates argument is not set to false",
+ "Checks": [
+ "kubelet_rotate_certificates"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable kubelet client certificate rotation.",
+ "RationaleStatement": "The `--rotate-certificates` setting causes the kubelet to rotate its client certificates by creating new CSRs as its existing credentials expire. This automated periodic rotation ensures that the there is no downtime due to expired certificates and thus addressing availability in the CIA security triad. **Note:** This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself. **Note:** This feature also require the `RotateKubeletClientCertificate` feature gate to be enabled (which is the default since Kubernetes v1.7)",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to add the line `rotateCertificates: true` or remove it altogether to use the default value. If using command line arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and remove `--rotate-certificates=false` argument from the `KUBELET_CERTIFICATE_ARGS` variable or set --rotate-certificates=true . Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that the `RotateKubeletServerCertificate` argument is not present, or is set to `true`. If the RotateKubeletServerCertificate argument is not present, verify that if there is a Kubelet config file specified by `--config`, that file does not contain `RotateKubeletServerCertificate: false`.",
+ "AdditionalInformation": "",
+ "References": "https://github.com/kubernetes/kubernetes/pull/41912:https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration:https://kubernetes.io/docs/imported/release/notes/:https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/",
+ "DefaultValue": "By default, kubelet client certificate rotation is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.11",
+ "Description": "Verify that the RotateKubeletServerCertificate argument is set to true",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Enable kubelet server certificate rotation.",
+ "RationaleStatement": "`RotateKubeletServerCertificate` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the below parameter in `KUBELET_CERTIFICATE_ARGS` variable. ``` --feature-gates=RotateKubeletServerCertificate=true ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "Ignore this check if serverTLSBootstrap is true in the kubelet config file or if the --rotate-server-certificates parameter is set on kubelet Run the following command on each node: ``` ps -ef | grep kubelet ``` Verify that `RotateKubeletServerCertificate` argument exists and is set to `true`.",
+ "AdditionalInformation": "",
+ "References": "https://github.com/kubernetes/kubernetes/pull/45059:https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#kubelet-configuration",
+ "DefaultValue": "By default, kubelet server certificate rotation is enabled."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.12",
+ "Description": "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers",
+ "Checks": [
+ "kubelet_strong_ciphers_only"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the Kubelet is configured to only use strong cryptographic ciphers.",
+ "RationaleStatement": "TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.",
+ "ImpactStatement": "Kubelet clients that cannot support modern cryptographic ciphers will not be able to make connections to the Kubelet API.",
+ "RemediationProcedure": "If using a Kubelet config file, edit the file to set `tlsCipherSuites:` to `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256` or to a subset of these values. If using executable arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the `--tls-cipher-suites` parameter as follows, or to a subset of these values. ``` --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 ``` Based on your system, restart the `kubelet` service. For example: ``` systemctl daemon-reload systemctl restart kubelet.service ```",
+ "AuditProcedure": "The set of cryptographic ciphers currently considered secure is the following: - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` - `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` - `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305` - `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` - `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` - `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` - `TLS_RSA_WITH_AES_256_GCM_SHA384` - `TLS_RSA_WITH_AES_128_GCM_SHA256` Run the following command on each node: ``` ps -ef | grep kubelet ``` If the `--tls-cipher-suites` argument is present, ensure it only contains values included in this set. If it is not present check that there is a Kubelet config file specified by `--config`, and that file sets `tlsCipherSuites:` to only include values from this set.",
+ "AdditionalInformation": "The list chosen above should be fine for modern clients. It's essentially the list from the Mozilla Modern cipher option with the ciphersuites supporting CBC mode removed, as CBC has traditionally had a lot of issues",
+ "References": "",
+ "DefaultValue": "By default the Kubernetes API server supports a wide range of TLS ciphers"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
+ ]
+ },
+ {
+ "Id": "4.2.13",
+ "Description": "Ensure that a limit is set on pod PIDs",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the Kubelet sets limits on the number of PIDs that can be created by pods running on the node.",
+ "RationaleStatement": "By default pods running in a cluster can consume any number of PIDs, potentially exhausting the resources available on the node. Setting an appropriate limit reduces the risk of a denial of service attack on cluster nodes.",
+ "ImpactStatement": "Setting this value will restrict the number of processes per pod. If this limit is lower than the number of PIDs required by a pod it will not operate.",
+ "RemediationProcedure": "Decide on an appropriate level for this parameter and set it, either via the `--pod-max-pids` command line parameter or the `PodPidsLimit` configuration file setting.",
+ "AuditProcedure": "Review the Kubelet's start-up parameters for the value of `--pod-max-pids`, and check the Kubelet configuration file for the `PodPidsLimit` . If neither of these values is set, then there is no limit in place.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits",
+ "DefaultValue": "By default the number of PIDs is not limited."
+ }
+ ]
+ },
+ {
+ "Id": "4.2.14",
+ "Description": "Ensure that the --seccomp-default parameter is set to true",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.2 Kubelet",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensure that the Kubelet enforces the use of the RuntimeDefault seccomp profile",
+ "RationaleStatement": "By default, Kubernetes disables the seccomp profile which ships with most container runtimes. Setting this parameter will ensure workloads running on the node are protected by the runtime's seccomp profile.",
+ "ImpactStatement": "Setting this will remove some rights from pods running on the node.",
+ "RemediationProcedure": "Set the parameter, either via the `--seccomp-default` command line parameter or the `seccompDefault` configuration file setting.",
+ "AuditProcedure": "Review the Kubelet's start-up parameters for the value of `--seccomp-default`, and check the Kubelet configuration file for the `seccompDefault` . If neither of these values is set, then the seccomp profile is not in use.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tutorials/security/seccomp/#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads",
+ "DefaultValue": "By default the seccomp profile is not enabled."
+ }
+ ]
+ },
+ {
+ "Id": "4.3.1",
+ "Description": "Ensure that the kube-proxy metrics service is bound to localhost",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Worker Nodes",
+ "SubSection": "4.3 kube-proxy",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not bind the kube-proxy metrics port to non-loopback addresses.",
+ "RationaleStatement": "kube-proxy has two APIs which provided access to information about the service and can be bound to network ports. The metrics API service includes endpoints (`/metrics` and `/configz`) which disclose information about the configuration and operation of kube-proxy. These endpoints should not be exposed to untrusted networks as they do not support encryption or authentication to restrict access to the data they provide.",
+ "ImpactStatement": "3rd party services which try to access metrics or configuration information related to kube-proxy will require access to the localhost interface of the node.",
+ "RemediationProcedure": "Modify or remove any values which bind the metrics service to a non-localhost address",
+ "AuditProcedure": "review the start-up flags provided to kube proxy Run the following command on each node: ``` ps -ef | grep -i kube-proxy ``` Ensure that the `--metrics-bind-address` parameter is not set to a value other than 127.0.0.1. From the output of this command gather the location specified in the `--config` parameter. Review any file stored at that location and ensure that it does not specify a value other than 127.0.0.1 for `metricsBindAddress`.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/",
+ "DefaultValue": "The default value is `127.0.0.1:10249`"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.1",
+ "Description": "Ensure that the cluster-admin role is only used where required",
+ "Checks": [
+ "rbac_cluster_admin_usage"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The RBAC role `cluster-admin` provides wide-ranging powers over the environment and should be used only where and when needed.",
+ "RationaleStatement": "Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as `cluster-admin` provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as `cluster-admin` allow super-user access to perform any action on any resource. When used in a `ClusterRoleBinding`, it gives full control over every resource in the cluster and in all namespaces. When used in a `RoleBinding`, it gives full control over every resource in the rolebinding's namespace, including the namespace itself.",
+ "ImpactStatement": "Care should be taken before removing any `clusterrolebindings` from the environment to ensure they were not required for operation of the cluster. Specifically, modifications should not be made to `clusterrolebindings` with the `system:` prefix as they are required for the operation of system components.",
+ "RemediationProcedure": "Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role : ``` kubectl delete clusterrolebinding [name] ```",
+ "AuditProcedure": "Obtain a list of the principals who have access to the `cluster-admin` role by reviewing the `clusterrolebinding` output for each role binding that has access to the `cluster-admin` role. ``` kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name ``` Review each principal listed and ensure that `cluster-admin` privilege is required for it.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/authorization/rbac/#user-facing-roles",
+ "DefaultValue": "By default a single `clusterrolebinding` called `cluster-admin` is provided with the `system:masters` group as its principal."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2",
+ "Description": "Minimize access to secrets",
+ "Checks": [
+ "rbac_minimize_secret_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.",
+ "RationaleStatement": "Inappropriate access to secrets stored within the Kubernetes cluster can allow for an attacker to gain additional access to the Kubernetes cluster or external resources whose credentials are stored as secrets.",
+ "ImpactStatement": "Care should be taken not to remove access to secrets to system components which require this for their operation",
+ "RemediationProcedure": "Where possible, restrict access to secret objects in the cluster by removing get, list, and watch permissions.",
+ "AuditProcedure": "Review the users who have `get`, `list`, or `watch` access to `secrets` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default in a kubeadm cluster the following list of principals have `get` privileges on `secret` objects ``` CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-system system:controller:expand-controller expand-controller ServiceAccount kube-system system:controller:generic-garbage-collector generic-garbage-collector ServiceAccount kube-system system:controller:namespace-controller namespace-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-system system:kube-controller-manager system:kube-controller-manager User ```"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3",
+ "Description": "Minimize wildcard use in Roles and ClusterRoles",
+ "Checks": [
+ "rbac_minimize_wildcard_use_roles"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard * which matches all items. Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product.",
+ "RationaleStatement": "The principle of least privilege recommends that users are provided only the access required for their role and nothing more. The use of wildcard rights grants is likely to provide excessive rights to the Kubernetes API.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible replace any use of wildcards in ClusterRoles and Roles with specific objects or actions.",
+ "AuditProcedure": "Retrieve the roles defined across each namespaces in the cluster and review for wildcards ``` kubectl get roles --all-namespaces -o yaml ``` Retrieve the cluster roles defined in the cluster and review for wildcards ``` kubectl get clusterroles -o yaml ```",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4",
+ "Description": "Minimize access to create pods",
+ "Checks": [
+ "rbac_minimize_pod_creation_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The ability to create pods in a namespace can provide a number of opportunities for privilege escalation, such as assigning privileged service accounts to these pods or mounting hostPaths with access to sensitive data (unless Pod Security Policies are implemented to restrict this access) As such, access to create new pods should be restricted to the smallest possible group of users.",
+ "RationaleStatement": "The ability to create pods in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.",
+ "ImpactStatement": "Care should be taken not to remove access to pods to system components which require this for their operation",
+ "RemediationProcedure": "Where possible, remove `create` access to `pod` objects in the cluster.",
+ "AuditProcedure": "Review the users who have create access to pod objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default in a kubeadm cluster the following list of principals have `create` privileges on `pod` objects ``` CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-system system:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-system system:controller:job-controller job-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-system system:controller:replicaset-controller replicaset-controller ServiceAccount kube-system system:controller:replication-controller replication-controller ServiceAccount kube-system system:controller:statefulset-controller statefulset-controller ServiceAccount kube-system ```"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5",
+ "Description": "Ensure that default service accounts are not actively used.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The `default` service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.",
+ "RationaleStatement": "Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured to ensure that it does not automatically provide a service account token, and it must not have any non-default role bindings or custom role assignments",
+ "ImpactStatement": "All workloads which require access to the Kubernetes API will require an explicit service account to be created.",
+ "RemediationProcedure": "Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value ``` automountServiceAccountToken: false ```",
+ "AuditProcedure": "For each namespace in the cluster, review the rights assigned to the default service account and ensure that it has no roles or cluster roles bound to it apart from the defaults. Additionally ensure that the `automountServiceAccountToken: false` setting is in place for each default service account.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
+ "DefaultValue": "By default the `default` service account allows for its service account token to be mounted in pods in its namespace."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.6",
+ "Description": "Ensure that Service Account Tokens are only mounted where necessary",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server",
+ "RationaleStatement": "Mounting service account tokens inside pods can provide an avenue for privilege escalation attacks where an attacker is able to compromise a single pod in the cluster. Avoiding mounting these tokens removes this attack avenue.",
+ "ImpactStatement": "Pods mounted without service account tokens will not be able to communicate with the API server, except where the resource is available to unauthenticated principals.",
+ "RemediationProcedure": "Modify the definition of pods and service accounts which do not need to mount service account tokens to disable it.",
+ "AuditProcedure": "Review pod and service account objects in the cluster and ensure that the option below is set, unless the resource explicitly requires this access. ``` automountServiceAccountToken: false ```",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
+ "DefaultValue": "By default, all pods get a service account token mounted in them."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.7",
+ "Description": "Avoid use of system:masters group",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The special group `system:masters` should not be used to grant permissions to any user or service account, except where strictly necessary (e.g. bootstrapping access prior to RBAC being fully available)",
+ "RationaleStatement": "The `system:masters` group has unrestricted access to the Kubernetes API hard-coded into the API server source code. An authenticated user who is a member of this group cannot have their access reduced, even if all bindings and cluster role bindings which mention it, are removed. When combined with client certificate authentication, use of this group can allow for irrevocable cluster-admin level credentials to exist for a cluster.",
+ "ImpactStatement": "Once the RBAC system is operational in a cluster `system:masters` should not be specifically required, as ordinary bindings from principals to the `cluster-admin` cluster role can be made where unrestricted access is required.",
+ "RemediationProcedure": "Remove the `system:masters` group from all users in the cluster.",
+ "AuditProcedure": "Review a list of all credentials which have access to the cluster and ensure that the group `system:masters` is not used.",
+ "AdditionalInformation": "",
+ "References": "https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/rbac/escalation_check.go#L38",
+ "DefaultValue": "By default some clusters will create a break glass client certificate which is a member of this group. Access to this client certificate should be carefully controlled and it should not be used for general cluster operations."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.8",
+ "Description": "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators",
+ "RationaleStatement": "The impersonate privilege allows a subject to impersonate other users gaining their rights to the cluster. The bind privilege allows the subject to add a binding to a cluster role or role which escalates their effective permissions in the cluster. The escalate privilege allows a subject to modify cluster roles to which they are bound, increasing their rights to that level. Each of these permissions has the potential to allow for privilege escalation to cluster-admin level.",
+ "ImpactStatement": "There are some cases where these permissions are required for cluster service operation, and care should be taken before removing these permissions from system service accounts.",
+ "RemediationProcedure": "Where possible, remove the impersonate, bind, and escalate rights from subjects.",
+ "AuditProcedure": "Review the users who have access to cluster roles or roles which provide the impersonate, bind, or escalate privileges.",
+ "AdditionalInformation": "",
+ "References": "https://raesene.github.io/blog/2020/12/12/Escalating_Away/:https://raesene.github.io/blog/2021/01/16/Getting-Into-A-Bind-with-Kubernetes/",
+ "DefaultValue": "In a default kubeadm cluster, the system:masters group and clusterrole-aggregation-controller service account have access to the escalate privilege. The system:masters group also has access to bind and impersonate."
+ }
+ ]
+ },
+ {
+ "Id": "5.1.9",
+ "Description": "Minimize access to create persistent volumes",
+ "Checks": [
+ "rbac_minimize_pv_creation_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of `hostPath` volumes. As persistent volumes are not covered by Pod Security Admission, a user with access to create persistent volumes may be able to get access to sensitive files from the underlying host even where restrictive Pod Security Admission policies are in place.",
+ "RationaleStatement": "The ability to create persistent volumes in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible, remove `create` access to `PersistentVolume` objects in the cluster.",
+ "AuditProcedure": "Review the users who have create access to `PersistentVolume` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#persistent-volume-creation",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.10",
+ "Description": "Minimize access to the proxy sub-resource of nodes",
+ "Checks": [
+ "rbac_minimize_node_proxy_subresource_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Users with access to the `Proxy` sub-resource of `Node` objects automatically have permissions to use the kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs. The kubelet provides an API which includes rights to execute commands in any container running on the node. Access to this API is covered by permissions to the main Kubernetes API via the `node` object. The proxy sub-resource specifically allows wide ranging access to the kubelet API. Direct access to the kubelet API bypasses controls like audit logging (there is no audit log of kubelet API access) and admission control.",
+ "RationaleStatement": "The ability to use the `proxy` sub-resource of `node` objects opens up possibilities for privilege escalation and should be restricted, where possible.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible, remove access to the `proxy` sub-resource of `node` objects.",
+ "AuditProcedure": "Review the users who have access to the `proxy` sub-resource of `node` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#access-to-proxy-subresource-of-nodes:https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/#kubelet-authorization",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.11",
+ "Description": "Minimize access to the approval sub-resource of certificatesigningrequests objects",
+ "Checks": [
+ "rbac_minimize_csr_approval_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Users with access to the update the `approval` sub-resource of `CertificateSigningRequests` objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts. This can allow for privilege escalation to full cluster administrator, depending on users configured in the cluster",
+ "RationaleStatement": "The ability to update certificate signing requests should be limited.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible, remove access to the `approval` sub-resource of `CertificateSigningRequests` objects.",
+ "AuditProcedure": "Review the users who have access to update the `approval` sub-resource of `CertificateSigningRequests` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#csrs-and-certificate-issuing",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.12",
+ "Description": "Minimize access to webhook configuration objects",
+ "Checks": [
+ "rbac_minimize_webhook_config_access"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Users with rights to create/modify/delete `validatingwebhookconfigurations` or `mutatingwebhookconfigurations` can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.",
+ "RationaleStatement": "The ability to manage webhook configuration should be limited",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible, remove access to the `validatingwebhookconfigurations` or `mutatingwebhookconfigurations` objects",
+ "AuditProcedure": "Review the users who have access to `validatingwebhookconfigurations` or `mutatingwebhookconfigurations` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#control-admission-webhooks",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.1.13",
+ "Description": "Minimize access to the service account token creation",
+ "Checks": [
+ "rbac_minimize_service_account_token_creation"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.1 RBAC and Service Accounts",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.",
+ "RationaleStatement": "The ability to create service account tokens should be limited.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "Where possible, remove access to the `token` sub-resource of `serviceaccount` objects.",
+ "AuditProcedure": "Review the users who have access to create the `token` sub-resource of `serviceaccount` objects in the Kubernetes API.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/rbac-good-practices/#token-request",
+ "DefaultValue": ""
+ }
+ ]
+ },
+ {
+ "Id": "5.2.1",
+ "Description": "Ensure that the cluster has at least one active policy control mechanism in place",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Every Kubernetes cluster should have at least one policy control mechanism in place to enforce the other requirements in this section. This could be the in-built Pod Security Admission controller, or a third party policy control system.",
+ "RationaleStatement": "Without an active policy control mechanism, it is not possible to limit the use of containers with access to underlying cluster nodes, via mechanisms like privileged containers, or the use of hostPath volume mounts.",
+ "ImpactStatement": "Where policy control systems are in place, there is a risk that workloads required for the operation of the cluster may be stopped from running. Care is required when implementing admission control policies to ensure that this does not occur.",
+ "RemediationProcedure": "Ensure that either Pod Security Admission or an external policy control system is in place for every namespace which contains user workloads.",
+ "AuditProcedure": "Review the workloads deployed to the cluster to understand if Pod Security Admission or external admission control systems are in place.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-admission",
+ "DefaultValue": "By default, Pod Security Admission is enabled but no policies are in place."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2",
+ "Description": "Minimize the admission of privileged containers",
+ "Checks": [
+ "core_minimize_privileged_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run with the `securityContext.privileged` flag set to `true`.",
+ "RationaleStatement": "Privileged containers have access to all Linux Kernel capabilities and devices. A container running with full privileges can do almost everything that the host can do. This flag exists to allow special use-cases, like manipulating the network stack and accessing devices. There should be at least one admission control policy defined which does not permit privileged containers. If you need to run privileged containers, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `spec.containers[].securityContext.privileged: true`, `spec.initContainers[].securityContext.privileged: true` and `spec.ephemeralContainers[].securityContext.privileged: true` will not be permitted.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of privileged containers.",
+ "AuditProcedure": "Run the following command: `kubectl get pods -A -o=jsonpath='{range .items[*]}{@.metadata.name}: {@..securityContext}{end}'`It will produce an inventory of all the privileged use on the cluster, if any (please, refer to a sample below). Further grepping can be done to automate each specific violation detection. calico-kube-controllers-57b57c56f-jtmk4: {} << No Elevated Privileges calico-node-c4xv4: {} {privileged:true} {privileged:true} {privileged:true} {privileged:true} << Violates 5.2.2 dashboard-metrics-scraper-7bc864c59-2m2xw: {seccompProfile:{type:RuntimeDefault}} {allowPrivilegeEscalation:false,readOnlyRootFilesystem:true,runAsGroup:2001,runAsUser:1001}",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of privileged containers."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3",
+ "Description": "Minimize the admission of containers wishing to share the host process ID namespace",
+ "Checks": [
+ "core_minimize_hostPID_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run with the `hostPID` flag set to true.",
+ "RationaleStatement": "A container running in the host's PID namespace can inspect processes running outside the container. If the container also has access to ptrace capabilities this can be used to escalate privileges outside of the container. There should be at least one admission control policy defined which does not permit containers to share the host PID namespace. If you need to run containers which require hostPID, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `spec.hostPID: true` will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Configure the Admission Controller to restrict the admission of `hostPID` containers.",
+ "AuditProcedure": "Fetch hostPID from each pod with `get pods -A -o=jsonpath='{range .items[*]}{@.metadata.name}: {@.spec.hostPID}{end}'`",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of `hostPID` containers."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4",
+ "Description": "Minimize the admission of containers wishing to share the host IPC namespace",
+ "Checks": [
+ "core_minimize_hostIPC_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run with the `hostIPC` flag set to true.",
+ "RationaleStatement": "A container running in the host's IPC namespace can use IPC to interact with processes outside the container. There should be at least one admission control policy defined which does not permit containers to share the host IPC namespace. If you need to run containers which require hostIPC, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `spec.hostIPC: true` will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers.",
+ "AuditProcedure": "Fetch hostIPC from each pod with `get pods -A -o=jsonpath='{range .items[*]}{@.metadata.name}: {@.spec.hostIPC}{end}'`",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of `hostIPC` containers."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.5",
+ "Description": "Minimize the admission of containers wishing to share the host network namespace",
+ "Checks": [
+ "core_minimize_hostNetwork_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run with the `hostNetwork` flag set to true.",
+ "RationaleStatement": "A container running in the host's network namespace could access the local loopback device, and could access network traffic to and from other pods. There should be at least one admission control policy defined which does not permit containers to share the host network namespace. If you need to run containers which require access to the host's network namespaces, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `spec.hostNetwork: true` will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostNetwork` containers.",
+ "AuditProcedure": "Fetch hostNetwork from each pod with `get pods -A -o=jsonpath='{range .items[*]}{@.metadata.name}: {@.spec.hostNetwork}{end}'`",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of `hostNetwork` containers."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.6",
+ "Description": "Minimize the admission of containers with allowPrivilegeEscalation",
+ "Checks": [
+ "core_minimize_allowPrivilegeEscalation_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run with the `allowPrivilegeEscalation` flag set to true. Allowing this right can lead to a process running a container getting more rights than it started with. It's important to note that these rights are still constrained by the overall container sandbox, and this setting does not relate to the use of privileged containers.",
+ "RationaleStatement": "A container running with the `allowPrivilegeEscalation` flag set to `true` may have processes that can gain more privileges than their parent. There should be at least one admission control policy defined which does not permit containers to allow privilege escalation. The option exists (and is defaulted to true) to permit setuid binaries to run. If you have need to run containers which use setuid binaries or require privilege escalation, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `securityContext: allowPrivilegeEscalation: true` will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `securityContext: allowPrivilegeEscalation: true`",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that each policy disallows the admission of containers which allow privilege escalation. To fetch a list of pods which `allowPrivilegeEscalation` run this command: `get pods -A -o=jsonpath='{range .items[*]}{@.metadata.name}: {@..securityContext}{end}'`",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on contained process ability to escalate privileges, within the context of the container."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.7",
+ "Description": "Minimize the admission of root containers",
+ "Checks": [
+ "core_minimize_root_containers_admission"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers to be run as the root user.",
+ "RationaleStatement": "Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features still have a escalated likelihood of container breakout. Ideally, all containers should run as a defined non-UID 0 user. There should be at least one admission control policy defined which does not permit root containers. If you need to run root containers, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods with containers which run as the root user will not be permitted.",
+ "RemediationProcedure": "Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` or `MustRunAs` with the range of UIDs not including 0, is set.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that each policy restricts the use of root containers by setting `MustRunAsNonRoot` or `MustRunAs` with the range of UIDs not including 0.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the use of root containers and if a User is not specified in the image, the container will run as root."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.8",
+ "Description": "Minimize the admission of containers with the NET_RAW capability",
+ "Checks": [
+ "core_minimize_net_raw_capability_admission"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers with the potentially dangerous NET_RAW capability.",
+ "RationaleStatement": "Containers run with a default set of capabilities as assigned by the Container Runtime. By default this can include potentially dangerous capabilities. With Docker as the container runtime the NET_RAW capability is enabled which may be misused by malicious containers. Ideally, all containers should drop this capability. There should be at least one admission control policy defined which does not permit containers with the NET_RAW capability. If you need to run containers with this capability, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods with containers which run with the NET_RAW capability will not be permitted.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with the `NET_RAW` capability.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that at least one policy disallows the admission of containers with the `NET_RAW` capability.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/:https://www.nccgroup.trust/uk/our-research/abusing-privileged-and-unprivileged-linux-containers/",
+ "DefaultValue": "By default, there are no restrictions on the creation of containers with the `NET_RAW` capability."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.9",
+ "Description": "Minimize the admission of containers with capabilities assigned",
+ "Checks": [
+ "core_minimize_containers_capabilities_assigned"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers with capabilities",
+ "RationaleStatement": "Containers run with a default set of capabilities as assigned by the Container Runtime. Capabilities are parts of the rights generally granted on a Linux system to the root user. In many cases applications running in containers do not require any capabilities to operate, so from the perspective of the principal of least privilege use of capabilities should be minimized.",
+ "ImpactStatement": "Pods with containers require capabilities to operate will not be permitted.",
+ "RemediationProcedure": "Review the use of capabilities in applications running on your cluster. Where a namespace contains applications which do not require any Linux capabilities to operate consider adding a policy which forbids the admission of containers which do not drop all capabilities.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that at least one policy requires that capabilities are dropped by all containers.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/:https://www.nccgroup.trust/uk/our-research/abusing-privileged-and-unprivileged-linux-containers/",
+ "DefaultValue": "By default, there are no restrictions on the creation of containers with additional capabilities"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.10",
+ "Description": "Minimize the admission of Windows HostProcess Containers",
+ "Checks": [
+ "core_minimize_admission_windows_hostprocess_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit Windows containers to be run with the `hostProcess` flag set to true.",
+ "RationaleStatement": "A Windows container making use of the `hostProcess` flag can interact with the underlying Windows cluster node. As per the Kubernetes documentation, this provides privileged access to the Windows node. Where Windows containers are used inside a Kubernetes cluster, there should be at least one admission control policy which does not permit `hostProcess` Windows containers. If you need to run Windows containers which require `hostProcess`, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `securityContext.windowsOptions.hostProcess: true` will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostProcess` containers.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that each policy disallows the admission of `hostProcess` containers",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tasks/configure-pod-container/create-hostprocess-pod/:https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of `hostProcess` containers."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.11",
+ "Description": "Minimize the admission of HostPath volumes",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally admit containers which make use of `hostPath` volumes.",
+ "RationaleStatement": "A container which mounts a `hostPath` volume as part of its specification will have access to the filesystem of the underlying cluster node. The use of `hostPath` volumes may allow containers access to privileged areas of the node filesystem. There should be at least one admission control policy defined which does not permit containers to mount `hostPath` volumes. If you need to run containers which require `hostPath` volumes, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined which make use of `hostPath` volumes will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which use `hostPath` volumes.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that each policy disallows the admission of containers with `hostPath` volumes.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the creation of `hostPath` volumes."
+ }
+ ]
+ },
+ {
+ "Id": "5.2.12",
+ "Description": "Minimize the admission of containers which use HostPorts",
+ "Checks": [
+ "core_minimize_admission_hostport_containers"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.2 Pod Security Standards",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Do not generally permit containers which require the use of HostPorts.",
+ "RationaleStatement": "Host ports connect containers directly to the host's network. This can bypass controls such as network policy. There should be at least one admission control policy defined which does not permit containers which require the use of HostPorts. If you need to run containers which require HostPorts, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
+ "ImpactStatement": "Pods defined with `hostPort` settings in either the container, initContainer or ephemeralContainer sections will not be permitted unless they are run under a specific policy.",
+ "RemediationProcedure": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which use `hostPort` sections.",
+ "AuditProcedure": "List the policies in use for each namespace in the cluster, ensure that each policy disallows the admission of containers which have `hostPort` sections.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+ "DefaultValue": "By default, there are no restrictions on the use of HostPorts."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.1",
+ "Description": "Ensure that the CNI in use supports Network Policies",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.3 Network Policies and CNI",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster.",
+ "RationaleStatement": "Kubernetes network policies are enforced by the CNI plugin in use. As such it is important to ensure that the CNI plugin supports both Ingress and Egress network policies.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "If the CNI plugin in use does not support network policies, consideration should be given to making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster.",
+ "AuditProcedure": "Review the documentation of CNI plugin in use by the cluster, and confirm that it supports Ingress and Egress network policies.",
+ "AdditionalInformation": "One example here is Flannel (https://github.com/coreos/flannel) which does not support Network policy unless Calico is also in use.",
+ "References": "https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/",
+ "DefaultValue": "This will depend on the CNI plugin in use."
+ }
+ ]
+ },
+ {
+ "Id": "5.3.2",
+ "Description": "Ensure that all Namespaces have Network Policies defined",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.3 Network Policies and CNI",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Use network policies to isolate traffic in your cluster network.",
+ "RationaleStatement": "Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace.",
+ "ImpactStatement": "Once network policies are in use within a given namespace, traffic not explicitly allowed by a network policy will be denied. As such it is important to ensure that, when introducing network policies, legitimate traffic is not blocked.",
+ "RemediationProcedure": "Follow the documentation and create `NetworkPolicy` objects as you need them.",
+ "AuditProcedure": "Run the below command and review the `NetworkPolicy` objects created in the cluster. ``` kubectl get networkpolicy --all-namespaces ``` Ensure that each namespace defined in the cluster has at least one Network Policy.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/services-networking/networkpolicies/:https://octetz.com/posts/k8s-network-policy-apis:https://kubernetes.io/docs/tasks/configure-pod-container/declare-network-policy/",
+ "DefaultValue": "By default, network policies are not created."
+ }
+ ]
+ },
+ {
+ "Id": "5.4.1",
+ "Description": "Prefer using secrets as files over secrets as environment variables",
+ "Checks": [
+ "core_no_secrets_envs"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.4 Secrets Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets.",
+ "RationaleStatement": "It is reasonably common for application code to log out its environment (particularly in the event of an error). This will include any secret values passed in as environment variables, so secrets can easily be exposed to any user or entity who has access to the logs.",
+ "ImpactStatement": "Application code which expects to read secrets in the form of environment variables would need modification",
+ "RemediationProcedure": "If possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables.",
+ "AuditProcedure": "Run the following command to find references to objects which use environment variables defined from secrets. ``` kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]}{.kind}{@.metadata.name}{end}' -A ```",
+ "AdditionalInformation": "Mounting secrets as volumes has the additional benefit that secret values can be updated without restarting the pod",
+ "References": "https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets",
+ "DefaultValue": "By default, secrets are not defined"
+ }
+ ]
+ },
+ {
+ "Id": "5.4.2",
+ "Description": "Consider external secret storage",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.4 Secrets Management",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets.",
+ "RationaleStatement": "Kubernetes supports secrets as first-class objects, but care needs to be taken to ensure that access to secrets is carefully limited. Using an external secrets provider can ease the management of access to secrets, especially where secrests are used across both Kubernetes and non-Kubernetes environments.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Refer to the secrets management options offered by your cloud provider or a third-party secrets management solution.",
+ "AuditProcedure": "Review your secrets management implementation.",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "By default, no external secret management is configured."
+ }
+ ]
+ },
+ {
+ "Id": "5.5.1",
+ "Description": "Configure Image Provenance using ImagePolicyWebhook admission controller",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.5 Extensible Admission Control",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Configure Image Provenance for your deployment.",
+ "RationaleStatement": "Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster.",
+ "ImpactStatement": "You need to regularly maintain your provenance configuration based on container image updates.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and setup image provenance.",
+ "AuditProcedure": "Review the pod definitions in your cluster and verify that image provenance is configured as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/admin/admission-controllers/#imagepolicywebhook:https://github.com/kubernetes/community/blob/master/contributors/design-proposals/image-provenance.md:https://hub.docker.com/r/dnurmi/anchore-toolbox/:https://github.com/kubernetes/kubernetes/issues/22888",
+ "DefaultValue": "By default, image provenance is not set."
+ }
+ ]
+ },
+ {
+ "Id": "5.6.1",
+ "Description": "Create administrative boundaries between resources using namespaces",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.6 General Policies",
+ "Profile": "Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Use namespaces to isolate your Kubernetes objects.",
+ "RationaleStatement": "Limiting the scope of user permissions can reduce the impact of mistakes or malicious activities. A Kubernetes namespace allows you to partition created resources into logically named groups. Resources created in one namespace can be hidden from other namespaces. By default, each resource created by a user in Kubernetes cluster runs in a default namespace, called `default`. You can create additional namespaces and attach resources and users to them. You can use Kubernetes Authorization plugins to create policies that segregate access to namespace resources between different users.",
+ "ImpactStatement": "You need to switch between namespaces for administration.",
+ "RemediationProcedure": "Follow the documentation and create namespaces for objects in your deployment as you need them.",
+ "AuditProcedure": "Run the below command and review the namespaces created in the cluster. ``` kubectl get namespaces ``` Ensure that these namespaces are the ones you need and are adequately administered as per your requirements.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#viewing-namespaces:http://blog.kubernetes.io/2016/08/security-best-practices-kubernetes-deployment.html:https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/589-efficient-node-heartbeats",
+ "DefaultValue": "By default, Kubernetes starts with 4 initial namespaces: 1. `default` - The default namespace for objects with no other namespace 1. `kube-system` - The namespace for objects created by the Kubernetes system 1. `kube-node-lease` - Namespace used for node heartbeats 1. `kube-public` - Namespace used for public information in a cluster"
+ }
+ ]
+ },
+ {
+ "Id": "5.6.2",
+ "Description": "Ensure that the seccomp profile is set to docker/default in your pod definitions",
+ "Checks": [
+ "core_seccomp_profile_docker_default"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.6 General Policies",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Enable `docker/default` seccomp profile in your pod definitions.",
+ "RationaleStatement": "Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. You should enable it to ensure that the workloads have restricted actions available within the container.",
+ "ImpactStatement": "If the `docker/default` seccomp profile is too restrictive for you, you would have to create/manage your own seccomp profiles.",
+ "RemediationProcedure": "Use security context to enable the `docker/default` seccomp profile in your pod definitions. An example is as below: ``` securityContext: seccompProfile: type: RuntimeDefault ```",
+ "AuditProcedure": "Review the pod definitions in your cluster. It should create a line as below: ``` securityContext: seccompProfile: type: RuntimeDefault ```",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/tutorials/clusters/seccomp/:https://docs.docker.com/engine/security/seccomp/",
+ "DefaultValue": "By default, seccomp profile is set to `unconfined` which means that no seccomp profiles are enabled."
+ }
+ ]
+ },
+ {
+ "Id": "5.6.3",
+ "Description": "Apply Security Context to Your Pods and Containers",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.6 General Policies",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Apply Security Context to Your Pods and Containers",
+ "RationaleStatement": "A security context defines the operating system security settings (uid, gid, capabilities, SELinux role, etc..) applied to a container. When designing your containers and pods, make sure that you configure the security context for your pods, containers, and volumes. A security context is a property defined in the deployment yaml. It controls the security parameters that will be assigned to the pod/container/volume. There are two levels of security context: pod level security context, and container level security context.",
+ "ImpactStatement": "If you incorrectly apply security contexts, you may have trouble running the pods.",
+ "RemediationProcedure": "Follow the Kubernetes documentation and apply security contexts to your pods. For a suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker Containers.",
+ "AuditProcedure": "Review the pod definitions in your cluster and verify that you have security contexts defined as appropriate.",
+ "AdditionalInformation": "",
+ "References": "https://kubernetes.io/docs/concepts/policy/security-context/:https://learn.cisecurity.org/benchmarks",
+ "DefaultValue": "By default, no security contexts are automatically applied to pods."
+ }
+ ]
+ },
+ {
+ "Id": "5.6.4",
+ "Description": "The default namespace should not be used",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Policies",
+ "SubSection": "5.6 General Policies",
+ "Profile": "Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.",
+ "RationaleStatement": "Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources.",
+ "ImpactStatement": "None",
+ "RemediationProcedure": "Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace.",
+ "AuditProcedure": "Run this command to list objects in default namespace ``` kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default ``` The only entries there should be system managed resources such as the `kubernetes` service",
+ "AdditionalInformation": "",
+ "References": "",
+ "DefaultValue": "Unless a namespace is specific on object creation, the `default` namespace will be used"
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/kubernetes/pci_4.0_kubernetes.json b/prowler/compliance/kubernetes/pci_4.0_kubernetes.json
index 0b301a0645..38d9557d5f 100644
--- a/prowler/compliance/kubernetes/pci_4.0_kubernetes.json
+++ b/prowler/compliance/kubernetes/pci_4.0_kubernetes.json
@@ -8268,6 +8268,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "10.5.1: Audit log history is retained and available for analysis.",
@@ -10054,6 +10062,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.",
@@ -10250,6 +10266,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.",
@@ -13004,6 +13028,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 365
+ }
+ ],
"Attributes": [
{
"Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.",
diff --git a/prowler/compliance/kubernetes/prowler_threatscore_kubernetes.json b/prowler/compliance/kubernetes/prowler_threatscore_kubernetes.json
index 11ffe42485..58ef7c6ddb 100644
--- a/prowler/compliance/kubernetes/prowler_threatscore_kubernetes.json
+++ b/prowler/compliance/kubernetes/prowler_threatscore_kubernetes.json
@@ -1083,6 +1083,23 @@
"LevelOfRisk": 4,
"Weight": 100
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "kubelet_strong_ciphers_only",
+ "ConfigKey": "kubelet_strong_ciphers",
+ "Operator": "subset",
+ "Value": [
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256"
+ ]
+ }
]
},
{
@@ -1199,6 +1216,14 @@
"Checks": [
"apiserver_audit_log_maxage_set"
],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxage_set",
+ "ConfigKey": "audit_log_maxage",
+ "Operator": "gte",
+ "Value": 30
+ }
+ ],
"Attributes": [
{
"Title": "API Server audit log retention configured",
@@ -1227,6 +1252,14 @@
"LevelOfRisk": 3,
"Weight": 10
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxbackup_set",
+ "ConfigKey": "audit_log_maxbackup",
+ "Operator": "gte",
+ "Value": 10
+ }
]
},
{
@@ -1245,6 +1278,14 @@
"LevelOfRisk": 2,
"Weight": 8
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "apiserver_audit_log_maxsize_set",
+ "ConfigKey": "audit_log_maxsize",
+ "Operator": "gte",
+ "Value": 100
+ }
]
},
{
diff --git a/prowler/compliance/m365/cis_4.0_m365.json b/prowler/compliance/m365/cis_4.0_m365.json
index 23582fbaac..35d64d358e 100644
--- a/prowler/compliance/m365/cis_4.0_m365.json
+++ b/prowler/compliance/m365/cis_4.0_m365.json
@@ -565,6 +565,68 @@
"References": "https://learn.microsoft.com/en-us/powershell/module/exchange/get-malwarefilterpolicy?view=exchange-ps:https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/office/compatibility/office-file-format-reference",
"DefaultValue": "The following extensions are blocked by default:ace, ani, apk, app, appx, arj, bat, cab, cmd, com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_malware_policy_comprehensive_attachments_filter_applied",
+ "ConfigKey": "recommended_blocked_file_types",
+ "Operator": "superset",
+ "Value": [
+ "ace",
+ "ani",
+ "apk",
+ "app",
+ "appx",
+ "arj",
+ "bat",
+ "cab",
+ "cmd",
+ "com",
+ "deb",
+ "dex",
+ "dll",
+ "docm",
+ "elf",
+ "exe",
+ "hta",
+ "img",
+ "iso",
+ "jar",
+ "jnlp",
+ "kext",
+ "lha",
+ "lib",
+ "library",
+ "lnk",
+ "lzh",
+ "macho",
+ "msc",
+ "msi",
+ "msix",
+ "msp",
+ "mst",
+ "pif",
+ "ppa",
+ "ppam",
+ "reg",
+ "rev",
+ "scf",
+ "scr",
+ "sct",
+ "sys",
+ "uif",
+ "vb",
+ "vbe",
+ "vbs",
+ "vxd",
+ "wsc",
+ "wsf",
+ "wsh",
+ "xll",
+ "xz",
+ "z"
+ ]
+ }
]
},
{
@@ -1209,6 +1271,14 @@
"References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime",
"DefaultValue": "The default configuration for user sign-in frequency is a rolling window of 90 days."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "entra_admin_users_sign_in_frequency_enabled",
+ "ConfigKey": "sign_in_frequency",
+ "Operator": "lte",
+ "Value": 4
+ }
]
},
{
diff --git a/prowler/compliance/m365/cis_6.0_m365.json b/prowler/compliance/m365/cis_6.0_m365.json
index d0dcfb2e6d..5815c67ac9 100644
--- a/prowler/compliance/m365/cis_6.0_m365.json
+++ b/prowler/compliance/m365/cis_6.0_m365.json
@@ -582,6 +582,68 @@
"References": "https://learn.microsoft.com/en-us/powershell/module/exchange/get-malwarefilterpolicy?view=exchange-ps:https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/office/compatibility/office-file-format-reference",
"DefaultValue": "53 extensions are blocked by default."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_malware_policy_comprehensive_attachments_filter_applied",
+ "ConfigKey": "recommended_blocked_file_types",
+ "Operator": "superset",
+ "Value": [
+ "ace",
+ "ani",
+ "apk",
+ "app",
+ "appx",
+ "arj",
+ "bat",
+ "cab",
+ "cmd",
+ "com",
+ "deb",
+ "dex",
+ "dll",
+ "docm",
+ "elf",
+ "exe",
+ "hta",
+ "img",
+ "iso",
+ "jar",
+ "jnlp",
+ "kext",
+ "lha",
+ "lib",
+ "library",
+ "lnk",
+ "lzh",
+ "macho",
+ "msc",
+ "msi",
+ "msix",
+ "msp",
+ "mst",
+ "pif",
+ "ppa",
+ "ppam",
+ "reg",
+ "rev",
+ "scf",
+ "scr",
+ "sct",
+ "sys",
+ "uif",
+ "vb",
+ "vbe",
+ "vbs",
+ "vxd",
+ "wsc",
+ "wsf",
+ "wsh",
+ "xll",
+ "xz",
+ "z"
+ ]
+ }
]
},
{
@@ -1949,6 +2011,14 @@
"References": "https://learn.microsoft.com/en-us/purview/audit-mailboxes?view=o365-worldwide",
"DefaultValue": "AuditEnabled: True for all mailboxes except Resource Mailboxes, Public Folder Mailboxes, and DiscoverySearch Mailbox"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "exchange_user_mailbox_auditing_enabled",
+ "ConfigKey": "audit_log_age",
+ "Operator": "gte",
+ "Value": 90
+ }
]
},
{
@@ -2110,6 +2180,14 @@
"References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips",
"DefaultValue": "MailTipsAllTipsEnabled: True, MailTipsExternalRecipientsTipsEnabled: False, MailTipsGroupMetricsEnabled: True, MailTipsLargeAudienceThreshold: 25"
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "exchange_organization_mailtips_enabled",
+ "ConfigKey": "recommended_mailtips_large_audience_threshold",
+ "Operator": "lte",
+ "Value": 25
+ }
]
},
{
diff --git a/prowler/compliance/m365/cis_7.0_m365.json b/prowler/compliance/m365/cis_7.0_m365.json
new file mode 100644
index 0000000000..941a33b187
--- /dev/null
+++ b/prowler/compliance/m365/cis_7.0_m365.json
@@ -0,0 +1,3614 @@
+{
+ "Framework": "CIS",
+ "Name": "CIS Microsoft 365 Foundations Benchmark v7.0.0",
+ "Version": "7.0",
+ "Provider": "M365",
+ "Description": "The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for establishing a secure configuration posture for Microsoft 365 Cloud offerings running on any OS. This guide includes recommendations for Exchange Online, SharePoint Online, OneDrive for Business, Teams, Power BI (Fabric) and Microsoft Entra ID.",
+ "Requirements": [
+ {
+ "Id": "1.1.1",
+ "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Regular user accounts should never be utilized for administrative tasks and care should be taken, in the case of a hybrid environment, to keep administrative accounts separate from on-prem accounts. Administrative accounts should not have applications assigned so that they have no access to potentially vulnerable services (EX. email, Teams, SharePoint, etc.) and only access to perform tasks as needed for administrative purposes. Ensure administrative accounts are not On-premises sync enabled.",
+ "Checks": [
+ "entra_admin_users_cloud_only"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.1 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Regular user accounts should never be utilized for administrative tasks and care should be taken, in the case of a hybrid environment, to keep administrative accounts separate from on-prem accounts. Administrative accounts should not have applications assigned so that they have no access to potentially vulnerable services (EX. email, Teams, SharePoint, etc.) and only access to perform tasks as needed for administrative purposes. Ensure administrative accounts are not On-premises sync enabled.",
+ "RationaleStatement": "In a hybrid environment, having separate accounts will help ensure that in the event of a breach in the cloud, that the breach does not affect the on-prem environment and vice versa.",
+ "ImpactStatement": "Administrative users will need to utilize login/logout functionality to switch accounts when performing administrative tasks, which means they will not benefit from SSO. This will require a migration process from the 'daily driver' account to a dedicated admin account. Once the new admin account is created, permission sets should be migrated from the 'daily driver' account to the new admin account. This includes both M365 and Azure RBAC roles. Failure to migrate Azure RBAC roles could prevent an admin from seeing their subscriptions/resources while using their admin account.",
+ "RemediationProcedure": "Remediation will require first identifying the privileged accounts that are synced from on- premises and then creating a new cloud-only account for that user. Once a replacement account is established, the hybrid account should have its role reduced to that of a non- privileged user or removed depending on the need.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Identity > Users and select All users. 3. To the right of the search box click the Add filter button. 4. Add the On-premises sync enabled filter with the value set to Yes and click Apply. 5. Verify that no user accounts in administrative roles are present in the filtered list. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"RoleManagement.Read.Directory\",\"User.Read.All\" 2. Run the following PowerShell script: $DirectoryRoles = Get-MgDirectoryRole # Get privileged role IDs $PrivilegedRoles = $DirectoryRoles | Where-Object { $_.DisplayName -like \"*Administrator*\" -or $_.DisplayName -eq \"Global Reader\" } # Get the members of these various roles $RoleMembers = $PrivilegedRoles | ForEach-Object { Get-MgDirectoryRoleMember -DirectoryRoleId $_.Id } | Select-Object Id -Unique # Retrieve details about the members in these roles $PrivilegedUsers = $RoleMembers | ForEach-Object { Get-MgUser -UserId $_.Id -Property UserPrincipalName, DisplayName, Id, OnPremisesSyncEnabled } $PrivilegedUsers | Where-Object { $_.OnPremisesSyncEnabled -eq $true } | ft DisplayName,UserPrincipalName,OnPremisesSyncEnabled 3. The script will output any hybrid users that are also members of privileged roles. If nothing returns, then no users with that criteria exist.",
+ "AdditionalInformation": "",
+ "DefaultValue": "N/A",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/add-users?view=o365-worldwide:https://learn.microsoft.com/en-us/microsoft-365/enterprise/protect-your-global-administrator-accounts?view=o365-worldwide:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices#9-use-cloud-native-accounts-for-microsoft-entra-roles:https://learn.microsoft.com/en-us/entra/fundamentals/whatis:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.2",
+ "Description": "Emergency access or \"break glass\" accounts are limited for emergency scenarios where normal administrative accounts are unavailable. They are not assigned to a specific user and will have a combination of physical and technical controls to prevent them from being accessed outside a true emergency. These emergencies could be due to several things, including: - Technical failures of a cellular provider or Microsoft related service such as MFA. - The last remaining Global Administrator account is inaccessible. Ensure two Emergency Access accounts have been defined. Note: Microsoft provides several recommendations for these accounts and how to configure them. For more information on this, please refer to the references section. The CIS Benchmark outlines the more critical things to consider.",
+ "Checks": [
+ "entra_break_glass_account_fido2_security_key_registered",
+ "entra_emergency_access_exclusion"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.1 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Emergency access or \"break glass\" accounts are limited for emergency scenarios where normal administrative accounts are unavailable. They are not assigned to a specific user and will have a combination of physical and technical controls to prevent them from being accessed outside a true emergency. These emergencies could be due to several things, including: - Technical failures of a cellular provider or Microsoft related service such as MFA. - The last remaining Global Administrator account is inaccessible. Ensure two Emergency Access accounts have been defined. Note: Microsoft provides several recommendations for these accounts and how to configure them. For more information on this, please refer to the references section. The CIS Benchmark outlines the more critical things to consider.",
+ "RationaleStatement": "In various situations, an organization may require the use of a break glass account to gain emergency access. In the event of losing access to administrative functions, an organization may experience a significant loss in its ability to provide support, lose insight into its security posture, and potentially suffer financial losses.",
+ "ImpactStatement": "Failure to properly implement emergency access accounts can weaken the security posture. Microsoft recommends excluding at least one of the two emergency access accounts from all conditional access rules, necessitating passwords with sufficient entropy and length to protect against random guesses. For a secure passwordless solution, FIDO2 security keys may be used instead of passwords.",
+ "RemediationProcedure": "To remediate using the UI: Step 1 - Create two emergency access accounts: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Expand Users > Active Users 3. Click Add user and create a new user with this criteria: o Name the account in a way that does NOT identify it with a particular person. o Assign the account to the default .onmicrosoft.com domain and not the organization's. o The password must be at least 16 characters and generated randomly. o Do not assign a license. o Assign the user the Global Administrator role. 4. Repeat the above steps for the second account. Step 2 - Exclude at least one account from conditional access policies: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Protection > Conditional Access. 3. Inspect the conditional access policies. 4. For each rule add an exclusion for at least one of the emergency access accounts. 5. Users > Exclude > Users and groups and select one emergency access account. Step 3 - Ensure the necessary procedures and policies are in place: - In order for accounts to be effectively used in a break glass situation the proper policies and procedures must be authorized and distributed by senior management. - FIDO2 Security Keys should be locked in a secure separate fireproof location. - Passwords should be at least 16 characters, randomly generated and MAY be separated in multiple pieces to be joined in case of an emergency. Warning: As of 10/15/2024 MFA is required for all users including Break Glass Accounts. It is recommended to update these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. Both methods satisfy the MFA requirement. Additional suggestions for emergency account management: - Create access reviews for these users. - Exclude users from conditional access rules. - Add the account to a restricted management administrative unit. Warning: If CA (conditional access) exclusion is managed by a group, this group should be added to PIM for groups (licensing required) or be created as a role-assignable group. If it is a regular security group, then users with the Group Administrators role are able to bypass CA entirely.",
+ "AuditProcedure": "To audit using the UI: Step 1 - Ensure a policy and procedure is in place at the organization: - In order for accounts to be effectively used in a break-glass situation the proper policies and procedures must be authorized and distributed by senior management. - FIDO2 Security Keys should be locked in a secure separate fireproof location. - Passwords should be at least 16 characters, randomly generated and MAY be separated in multiple pieces to be joined in case of an emergency. Step 2 - Ensure two emergency access accounts are defined: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Expand Users > Active Users 3. Inspect the designated emergency access accounts and ensure the following: o The accounts are named correctly, and do NOT identify with a particular person. o The accounts use the default .onmicrosoft.com domain and not the organization's. o The accounts are cloud-only. o The accounts are unlicensed. o The accounts are not disabled or Sign-in blocked. o The accounts are assigned the Global Administrator directory role. Step 3 - Ensure at least one account is excluded from all conditional access rules: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Protection > Conditional Access. 3. Inspect the conditional access rules. 4. Ensure one of the emergency access accounts is excluded from all rules. Warning: As of 10/15/2024 MFA is required for all users including Break Glass Accounts. It is recommended to update these accounts to use passkey (FIDO2) or configure certificate-based authentication for MFA. Both methods satisfy the MFA requirement.",
+ "AdditionalInformation": "Microsoft has additional instructions regarding using Azure Monitor to capture events in the Log Analytics workspace, and then generate alerts for Emergency Access accounts. This requires an Azure subscription but should be strongly considered as a method of monitoring activity on these accounts: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security- emergency-access#monitor-sign-in-and-audit-logs",
+ "DefaultValue": "Not defined.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning#stage-1-critical-items-to-do-right-now:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication#accounts"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.3",
+ "Description": "Between two and four global administrators should be designated in the tenant. Ideally, these accounts will not have licenses assigned to them which supports additional controls found in this benchmark.",
+ "Checks": [
+ "admincenter_users_between_two_and_four_global_admins"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.1 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Between two and four global administrators should be designated in the tenant. Ideally, these accounts will not have licenses assigned to them which supports additional controls found in this benchmark.",
+ "RationaleStatement": "The Global Administrator role grants unrestricted access across all services in Microsoft Entra ID and should never be used for routine daily activities. Limiting the number of Global Administrators reduces the attack surface of the tenant and aligns with the principle of least privilege. Fewer than two Global Administrators creates a single point of failure and removes the peer oversight needed to detect unauthorized actions. More than four increases the likelihood of account compromise by an external attacker. Maintaining between two and four Global Administrators balances operational redundancy against privileged access risk. For any accounts assigned the Global Administrator role, at least one strong authentication method such as a FIDO2 key or certificate is strongly advised.",
+ "ImpactStatement": "The potential impact associated with ensuring compliance with this requirement is dependent upon the current number of global administrators configured in the tenant. If there is only one global administrator in a tenant, an additional global administrator will need to be identified and configured. If there are more than four global administrators, a review of role requirements for current global administrators will be required to identify which of the users require global administrator access.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com 2. Select Users > Active Users. 3. In the Search field enter the name of the user to be made a Global Administrator. 4. To create a new Global Admin: 1. Select the user's name. 2. A window will appear to the right. 3. Select Manage roles. 4. Select Admin center access. 5. Check Global Administrator. 6. Click Save changes. 5. To remove a Global Admin: 1. In the Search field, enter the name of the user to be removed. 2. Select the user's name. 3. A window will appear to the right. 4. Under Roles, select Manage roles. 5. Uncheck Global Administrator. 6. Click Save changes.",
+ "AuditProcedure": "Note: If an organization's tenant is using a third-party identity provider, the audit and remediation procedures presented here may not be relevant. The principle of the recommendation is still relevant, and compensating controls that are relevant to the third-party identity provider should be implemented. To audit using the UI: 1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com 2. Select Roles > Role assignments. 3. Select the Global Administrator role from the list and click on Assigned. 4. Review the list of Global Administrators. o If there are groups present, then inspect each group and its members. o Take note of the total number of Global Administrators in and outside of groups. 5. Verify the number of Global Administrators is between two and four. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes Directory.Read.All 2. Run the following PowerShell script: # Determine Id of GA role using the immutable RoleTemplateId value. $GlobalAdminRole = Get-MgDirectoryRole -Filter \"RoleTemplateId eq '62e90394- 69f5-4237-9190-012177145e10'\" $RoleMembers = Get-MgDirectoryRoleMember -DirectoryRoleId $GlobalAdminRole.Id $GlobalAdmins = [System.Collections.Generic.List[Object]]::new() foreach ($object in $RoleMembers) { $Type = $object.AdditionalProperties.'@odata.type' # Check for and process role assigned groups if ($Type -eq '#microsoft.graph.group') { $GroupId = $object.Id $GroupMembers = (Get-MgGroupMember -GroupId $GroupId).AdditionalProperties foreach ($member in $GroupMembers) { if ($member.'@odata.type' -eq '#microsoft.graph.user') { $GlobalAdmins.Add([PSCustomObject][Ordered]@{ DisplayName = $member.displayName UserPrincipalName = $member.userPrincipalName }) } } } elseif ($Type -eq '#microsoft.graph.user') { $DisplayName = $object.AdditionalProperties.displayName $UPN = $object.AdditionalProperties.userPrincipalName $GlobalAdmins.Add([PSCustomObject][Ordered]@{ DisplayName = $DisplayName UserPrincipalName = $UPN }) } } $GlobalAdmins = $GlobalAdmins | select DisplayName,UserPrincipalName -Unique Write-Host \"*** There are\" $GlobalAdmins.Count \"Global Administrators in the organization.\" 3. Review the output and ensure there are between 2 and 4 Global Administrators. Note: When tallying the number of Global Administrators, the above does not account for Partner relationships. Those are located under Settings > Partner Relationships and should be reviewed on a recurring basis.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdirectoryrole?view=graph-powershell-1.0:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#all-roles:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5:https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide#security-guidelines-for-assigning-roles"
+ }
+ ]
+ },
+ {
+ "Id": "1.1.4",
+ "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. A license can enable an account to gain access to a variety of different applications, depending on the license assigned. The recommended state is to not license a privileged account or use licenses without associated applications such as Microsoft Entra ID P1 or Microsoft Entra ID P2.",
+ "Checks": [
+ "admincenter_users_admins_reduced_license_footprint"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.1 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. A license can enable an account to gain access to a variety of different applications, depending on the license assigned. The recommended state is to not license a privileged account or use licenses without associated applications such as Microsoft Entra ID P1 or Microsoft Entra ID P2.",
+ "RationaleStatement": "Ensuring administrative accounts do not use licenses with applications assigned to them will reduce the attack surface of high privileged identities in the organization's environment. Granting access to a mailbox or other collaborative tools increases the likelihood that privileged users might interact with these applications, raising the risk of exposure to social engineering attacks or malicious content. These activities should be restricted to an unprivileged 'daily driver' account. Note: In order to participate in Microsoft 365 security services such as Identity Protection, PIM and Conditional Access an administrative account will need a license attached to it. Ensure that the license used does not include any applications with potentially vulnerable services by using either Microsoft Entra ID P1 or Microsoft Entra ID P2 for the cloud-only account with administrator roles.",
+ "ImpactStatement": "Administrative users will be required to switch accounts and use manual login/logout procedures when performing privileged tasks. This change also means they will not benefit from Single Sign-On (SSO), potentially impacting workflow efficiency and user experience. Note: Alerts will be sent to TenantAdmins, including Global Administrators, by default. To ensure proper receipt, configure alerts to be sent to security or operations staff with valid email addresses or a security operations center. Otherwise, after adoption of this recommendation, alerts sent to TenantAdmins may go unreceived due to the lack of an application-based license assigned to the Global Administrator accounts.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Users > Active users. 3. Click Add a user. 4. Fill out the appropriate fields for Name, user, etc. 5. When prompted to assign licenses select as needed Microsoft Entra ID P1 or Microsoft Entra ID P2, then click Next. 6. Under the Option settings screen you may choose from several types of privileged roles. Choose Admin center access followed by the appropriate role then click Next. 7. Select Finish adding. Note: Utilizing PIM to best practices will satisfy this control. CIS and Microsoft recommend an organization keep zero permanently active assignments for roles other than emergency access accounts.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Users > Active users. 3. Sort by the Licenses column. 4. For each user account in an administrative role verify the account is assigned a license that is not associated with applications i.e. (Microsoft Entra ID P1, Microsoft Entra ID P2). o If an organization uses PIM to elevate a daily driver account to privileged levels, this control and licensing requirement can be considered satisfied. Note: The final step assumes PIM is properly configured to best practices. Accounts eligible for the Global Administrator role should require approval to activate. Using the PIM blade to permanently assign accounts to privileged roles would not satisfy this audit procedure. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"RoleManagement.Read.Directory\",\"User.Read.All\" 2. Run the following PowerShell script: $DirectoryRoles = Get-MgDirectoryRole # Get privileged role IDs $PrivilegedRoles = $DirectoryRoles | Where-Object { $_.DisplayName -like \"*Administrator*\" -or $_.DisplayName -eq \"Global Reader\" } # Get the members of these various roles $RoleMembers = $PrivilegedRoles | ForEach-Object { Get-MgDirectoryRoleMember -DirectoryRoleId $_.Id } | Select-Object Id -Unique # Retrieve details about the members in these roles $PrivilegedUsers = $RoleMembers | ForEach-Object { Get-MgUser -UserId $_.Id -Property UserPrincipalName, DisplayName, Id } $Report = [System.Collections.Generic.List[Object]]::new() foreach ($Admin in $PrivilegedUsers) { $License = $null $License = (Get-MgUserLicenseDetail -UserId $Admin.id).SkuPartNumber - join \", \" $Object = [pscustomobject][ordered]@{ DisplayName = $Admin.DisplayName UserPrincipalName = $Admin.UserPrincipalName License = $License } $Report.Add($Object) } $Report 3. The output will display users assigned privileged roles alongside their assigned licenses. Additional manual assessment is required to determine if the licensing is appropriate for the user.",
+ "AdditionalInformation": "",
+ "DefaultValue": "N/A",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/enterprise/protect-your-global-administrator-accounts?view=o365-worldwide:https://learn.microsoft.com/en-us/entra/fundamentals/whatis#what-are-the-microsoft-entra-id-licenses:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference:https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-protect-admin-accounts?view=o365-worldwide:https://learn.microsoft.com/en-us/microsoft-365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings?view=o365-worldwide#licenses:https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-deployment-plan#principle-of-least-privilege"
+ }
+ ]
+ },
+ {
+ "Id": "1.2.1",
+ "Description": "Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. When a new group is created in the Administration panel, the default privacy value of the group is \"Public\". (In this case, 'public' means accessible to the identities within the organization without requiring group owner authorization to join.) The recommended state is Microsoft 365 Groups are set to Private in the Administration panel. Note: Although there are several different group types, this recommendation concerns Microsoft 365 Groups specifically.",
+ "Checks": [
+ "admincenter_groups_not_public_visibility"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.2 Teams & groups",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. When a new group is created in the Administration panel, the default privacy value of the group is \"Public\". (In this case, 'public' means accessible to the identities within the organization without requiring group owner authorization to join.) The recommended state is Microsoft 365 Groups are set to Private in the Administration panel. Note: Although there are several different group types, this recommendation concerns Microsoft 365 Groups specifically.",
+ "RationaleStatement": "If group privacy is not controlled, any user may access sensitive information, depending on the group they try to access. When the privacy value of a group is set to \"Public,\" users may access data related to this group (e.g. SharePoint) via three methods: 1. The Azure Portal: Users can add themselves to the public group via the Azure Portal; however, administrators are notified when users access the Portal. 2. Access Requests: Users can request to join the group via the Groups application in the Access Panel. This provides the user with immediate access to the group, even though they are required to send a message to the group owner when requesting to join. 3. SharePoint URL: Users can directly access a group via its SharePoint URL, which is usually guessable and can be found in the Groups application within the Access Panel.",
+ "ImpactStatement": "If the recommendation is applied, group owners could receive more access requests than usual, especially regarding groups originally meant to be public.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Teams & groups > Active teams & groups. 3. On the Active teams and groups page, select the group's name that is public. 4. On the popup groups name page, Select Settings. 5. Under Privacy, select Private.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Teams & groups > Active teams & groups. 3. On the Active teams and groups page, check that no groups have the status 'Public' in the privacy column. To audit using PowerShell: 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"Group.Read.All\". 2. Run the following Microsoft Graph PowerShell command: $Groups = Get-MgGroup -All -Filter \"groupTypes/any(c:c eq 'Unified')\" ` -Property Id,DisplayName,Visibility,GroupTypes # Displays the groups to the console for review $Groups | ft Id,DisplayName,Visibility 3. Verify that Visibility is Private for each group.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Public when created from the Administration portal; private otherwise.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management:https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "1.2.2",
+ "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people. Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from \"Contoso Support\" or \"Building A Reception Desk.\" Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation. The recommended state is Sign in blocked for Shared mailboxes.",
+ "Checks": [
+ "exchange_shared_mailbox_sign_in_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.2 Teams & groups",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people. Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from \"Contoso Support\" or \"Building A Reception Desk.\" Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation. The recommended state is Sign in blocked for Shared mailboxes.",
+ "RationaleStatement": "The intent of the shared mailbox is to only allow delegated access from other mailboxes. An admin could reset the password, or an attacker could potentially gain access to the shared mailbox allowing the direct sign-in to the shared mailbox and subsequently the sending of email from a sender that does not have a unique identity. To prevent this, block sign-in for the account that is associated with the shared mailbox.",
+ "ImpactStatement": "Blocking sign-in to shared mailboxes prevents direct authentication to these accounts. Authorized users can still access shared mailbox content through their own accounts using Outlook delegation or by being granted Send As/Send on Behalf permissions. This change strengthens security by ensuring shared mailboxes cannot serve as entry points for unauthorized access.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com/ 2. Click to expand Teams & groups and select Shared mailboxes. 3. Take note of all shared mailboxes. 4. Click to expand Users and select Active users. 5. Select a shared mailbox account to open its properties pane and then select Block sign-in. 6. Check the box for Block this user from signing in. 7. Repeat for any additional shared mailboxes. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"User.ReadWrite.All\" 2. Connect to Exchange Online using Connect-ExchangeOnline. 3. To disable sign-in for a single account: $MBX = Get-EXOMailbox -Identity TestUser@example.com Update-MgUser -UserId $MBX.ExternalDirectoryObjectId -AccountEnabled:$false The following can be used block sign-in to all Shared Mailboxes: $MBX = Get-EXOMailbox -RecipientTypeDetails SharedMailbox $MBX | ForEach-Object { Update-MgUser -UserId $_.ExternalDirectoryObjectId - AccountEnabled:$false }",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com/ 2. Expand Teams & groups and select Shared mailboxes. 3. Take note of all shared mailboxes. 4. Expand Users and select Active users. 5. Select a shared mailbox account to open its properties pane, and review. 6. Verify that the text under the name reads Sign-in blocked. 7. Repeat for any additional shared mailboxes. Note: If sign-in is not blocked there will be an option to Block sign-in. This means the shared mailbox is out of compliance with this recommendation. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline 2. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"User.Read.All\" 3. Run the following PowerShell commands: $MBX = Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited $MBX | ForEach-Object { Get-MgUser -UserId $_.ExternalDirectoryObjectId ` -Property DisplayName, UserPrincipalName, AccountEnabled } | Format-Table DisplayName, UserPrincipalName, AccountEnabled 4. Ensure AccountEnabled is set to False for all Shared Mailboxes.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AccountEnabled: True",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes?view=o365-worldwide:https://learn.microsoft.com/en-us/microsoft-365/admin/email/create-a-shared-mailbox?view=o365-worldwide#block-sign-in-for-the-shared-mailbox-account:https://learn.microsoft.com/en-us/microsoft-365/enterprise/block-user-accounts-with-microsoft-365-powershell?view=o365-worldwide#block-individual-user-accounts"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.1",
+ "Description": "Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or not passwords expire at all.",
+ "Checks": [
+ "admincenter_settings_password_never_expire"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or not passwords expire at all.",
+ "RationaleStatement": "Organizations such as NIST and Microsoft recommend against arbitrarily requiring users to change their passwords after a set period, unless there is evidence of compromise or the user has forgotten the password. This guidance applies even to single-factor (password-only) scenarios, as forced, periodic changes often lead to weaker passwords and reduced security. Additionally, this Benchmark advises implementing multi-factor authentication (MFA) for all accounts, which further diminishes the value of password expiration policies. Long-lived passwords can be further strengthened by enabling additional password protection features in Entra ID.",
+ "ImpactStatement": "When setting passwords not to expire it is important to have other controls in place to supplement this setting. See below for related recommendations and user guidance. - Ban common passwords. - Educate users to not reuse organization passwords anywhere else. - Enforce Multi-Factor Authentication registration for all users.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org Settings. 3. Click on Security & privacy. 4. Check the Set passwords to never expire (recommended) box. 5. Click Save. To remediate using PowerShell: 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"Domain.ReadWrite.All\". 2. Run the following Microsoft Graph PowerShell command: Update-MgDomain -DomainId <Domain> -PasswordValidityPeriodInDays 2147483647",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org Settings. 3. Click on Security & privacy. 4. Select Password expiration policy and verify that Set passwords to never expire (recommended) has been checked. To audit using PowerShell: 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"Domain.Read.All\". 2. Run the following Microsoft Online PowerShell command: Get-MgDomain | ft id,PasswordValidityPeriodInDays 3. Verify the value returned for valid domains is 2147483647",
+ "AdditionalInformation": "",
+ "DefaultValue": "If the property is not set, a default value of 90 days will be used",
+ "References": "https://pages.nist.gov/800-63-3/sp800-63b.html:https://www.cisecurity.org/white-papers/cis-password-policy-guide/:https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.2",
+ "Description": "Idle session timeout allows the configuration of a setting which will timeout inactive users after a pre-determined amount of time. When a user reaches the set idle timeout session, they'll get a notification that they're about to be signed out. They must choose to stay signed in or they'll be automatically signed out of all Microsoft 365 web apps. Combined with a Conditional Access rule this will only impact unmanaged devices. A managed device is considered a device managed by Intune MDM or joined to a domain (Entra ID or Hybrid joined). The following Microsoft 365 web apps are supported. - Outlook Web App - OneDrive - SharePoint - Microsoft Fabric - Microsoft365.com and other start pages - Microsoft 365 web apps (Word, Excel, PowerPoint) - Microsoft 365 Admin Center - M365 Defender Portal - Microsoft Purview Compliance Portal The recommended setting is 3 hours (or less) for unmanaged devices. Note: Idle session timeout doesn't affect Microsoft 365 desktop and mobile apps.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Idle session timeout allows the configuration of a setting which will timeout inactive users after a pre-determined amount of time. When a user reaches the set idle timeout session, they'll get a notification that they're about to be signed out. They must choose to stay signed in or they'll be automatically signed out of all Microsoft 365 web apps. Combined with a Conditional Access rule this will only impact unmanaged devices. A managed device is considered a device managed by Intune MDM or joined to a domain (Entra ID or Hybrid joined). The following Microsoft 365 web apps are supported. - Outlook Web App - OneDrive - SharePoint - Microsoft Fabric - Microsoft365.com and other start pages - Microsoft 365 web apps (Word, Excel, PowerPoint) - Microsoft 365 Admin Center - M365 Defender Portal - Microsoft Purview Compliance Portal The recommended setting is 3 hours (or less) for unmanaged devices. Note: Idle session timeout doesn't affect Microsoft 365 desktop and mobile apps.",
+ "RationaleStatement": "Ending idle sessions through an automatic process can help protect sensitive company data and will add another layer of security for end users who work on unmanaged devices that can potentially be accessed by the public. Unauthorized individuals onsite or remotely can take advantage of systems left unattended over time. Automatic timing out of sessions makes this more difficult.",
+ "ImpactStatement": "If step 2 in the Audit/Remediation procedure is left out, then there is no issue with this from a security standpoint. However, it will require users on trusted devices to sign in more frequently which could result in credential prompt fatigue. Users don't get signed out in these cases: - If they get single sign-on (SSO) into the web app from the device joined account. - If they selected Stay signed in at the time of sign-in. For more info on hiding this option for your organization, see Add branding to your organization's sign-in page. - If they're on a managed device, that is compliant or joined to a domain and using a supported browser, like Microsoft Edge, or Google Chrome with the Microsoft Single Sign On extension. Note: Idle session timeout also affects the Azure Portal idle timeout if this is not explicitly set to a different timeout. The Azure Portal idle timeout applies to all kinds of devices, not just unmanaged. See: change the directory timeout setting admin",
+ "RemediationProcedure": "Step 1 - Configure Idle session timeout: To remediate using the UI: 1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com/. 2. Expand Settings > Org settings. 3. Click Security & Privacy tab. 4. Select Idle session timeout. 5. Check the box Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps 6. Set a maximum value of 3 hours. 7. Click save. Step 2 - Ensure the Conditional Access policy is in place: To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Protect > Conditional Access. 3. Click New policy and give the policy a name. o Select Users > All users. o Select Cloud apps or actions > Select apps and select Office 365 o Select Conditions > Client apps > Yes check only Browser unchecking all other boxes. o Select Sessions and check Use app enforced restrictions. 4. Set Enable policy to On and click Create. Note: To ensure that idle timeouts affect only unmanaged devices, both steps 1 and 2 must be completed. Otherwise managed devices will also be impacted by the timeout policy.",
+ "AuditProcedure": "Step 1 - Ensure Idle session timeout is configured: To audit using the UI: 1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com/. 2. Expand Settings > Org settings. 3. Click Security & Privacy tab. 4. Select Idle session timeout. 5. Verify that Turn on to set the period of inactivity for users to be signed off of Microsoft 365 web apps is set to 3 hours (or less). To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\": 2. Run the following script: $TimeoutPolicy = Get-MgPolicyActivityBasedTimeoutPolicy $BenchmarkTimeSpan = [TimeSpan]::Parse('03:00:00') # 3 hours if ($TimeoutPolicy) { $PolicyDefinition = $TimeoutPolicy.Definition | ConvertFrom-Json $Timeout = $PolicyDefinition.ActivityBasedTimeoutPolicy.ApplicationPolicies[0].WebSessio nIdleTimeout $TimeSpan = [TimeSpan]::Parse($Timeout) $TimeoutReadable = \"{0} days, {1} hours, {2} minutes\" ` -f $TimeSpan.Days, $TimeSpan.Hours, $TimeSpan.Minutes if ($TimeSpan -le $BenchmarkTimeSpan) { Write-Host \"** PASS ** Timeout is set to $TimeoutReadable.\" } else { Write-Host \"** FAIL ** Timeout is too long. It is set to $TimeoutReadable.\" } } else { Write-Host \"** FAIL **: Idle session timeout is not configured.\" } 3. Verify the policy exists and is 3 hours or less. Step 2 - Ensure the Conditional Access policy is in place: To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Protect > Conditional Access. 3. Inspect existing conditional access rules for one that meets the below conditions: o Users or agents (Preview) is set to include All users. o Cloud apps or actions > Select apps is set to Office 365. o Conditions > Client apps is Browser and nothing else. o Session is set to Use app enforced restrictions. o Enable Policy is set to On To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\": 2. Run the following script: $Caps = Get-MgIdentityConditionalAccessPolicy -All | Where-Object { $_.SessionControls.ApplicationEnforcedRestrictions.IsEnabled } $CapReport = [System.Collections.Generic.List[Object]]::new() # Filter to policies with \"Use app enforced restrictions\" enabled # Loop through policies and generate a per policy report. foreach ($policy in $Caps) { $Name = $policy.DisplayName $Users = $policy.Conditions.Users.IncludeUsers $Targets = $policy.Conditions.Applications.IncludeApplications $ClientApps = $policy.Conditions.ClientAppTypes $Restrictions = $policy.SessionControls.ApplicationEnforcedRestrictions.IsEnabled $State = $policy.State $CountPass = $Targets.count -eq 1 -and $ClientApps.count -eq 1 $Pass = $Targets -eq 'Office365' -and $ClientApps -eq 'browser' -and $Restrictions -and $CountPass -and $State -eq 'enabled' $obj = [PSCustomObject]@{ DisplayName = $Name AuditState = if ($Pass) { \"PASS\" } else { \"FAIL\" } IncludeUsers = $Users IncludeApplications = $Targets ClientAppTypes = $ClientApps AppEnforcedRestrictions = $Restrictions State = $State } $CapReport.Add($obj) } if ($Caps) { $CapReport } else { Write-Host \"** FAIL **: There are no qualifying conditional access policies.\" } 3. The script will output qualifying Conditional Access Policies. If one policy passes, then the recommendation passes. A passing policy will have the following properties: DisplayName : (CIS) Idle timeout for unmanaged AuditState : PASS IncludeUsers : {All} # IncludeUsers not currently scored IncludeApplications : {Office365} ClientAppTypes : {browser} AppEnforcedRestrictions : True State : enabled Note: Both steps 1 and 2 must pass audit checks in order for the recommendation to pass as a whole.",
+ "AdditionalInformation": "According to Microsoft idle session timeout isn't supported when third party cookies are disabled in the browser. Users won't see any sign-out prompts.",
+ "DefaultValue": "Not configured. (Idle sessions will not timeout.)",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/manage/idle-session-timeout-web-apps?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.3",
+ "Description": "External calendar sharing allows an administrator to enable the ability for users to share calendars with anyone outside of the organization. Outside users will be sent a URL that can be used to view the calendar.",
+ "Checks": [
+ "admincenter_external_calendar_sharing_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "External calendar sharing allows an administrator to enable the ability for users to share calendars with anyone outside of the organization. Outside users will be sent a URL that can be used to view the calendar.",
+ "RationaleStatement": "Attackers often spend time learning about organizations before launching an attack. Publicly available calendars can help attackers understand organizational relationships and determine when specific users may be more vulnerable to an attack, such as when they are traveling.",
+ "ImpactStatement": "This functionality is not widely used. As a result, it is unlikely that implementation of this setting will cause an impact to most users. Users that do utilize this functionality are likely to experience a minor inconvenience when scheduling meetings or synchronizing calendars with people outside the tenant.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings select Org settings. 3. In the Services section click Calendar. 4. Uncheck Let your users share their calendars with people outside of your organization who have Office 365 or Exchange. 5. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following Exchange Online PowerShell command: Set-SharingPolicy -Identity \"Default Sharing Policy\" -Enabled $False",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. In the Services section click Calendar. 4. Verify that Let your users share their calendars with people outside of your organization who have Office 365 or Exchange is unchecked. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following Exchange Online PowerShell command: Get-SharingPolicy -Identity \"Default Sharing Policy\" | ft Name,Enabled 3. Verify that Enabled is set to False",
+ "AdditionalInformation": "The following script can be used to audit any mailboxes that might be sharing calendars prior to disabling the feature globally: $mailboxes = Get-Mailbox -ResultSize Unlimited foreach ($mailbox in $mailboxes) { # Get the name of the default calendar folder (depends on the mailbox's language) $calendarFolder = [string](Get-ExoMailboxFolderStatistics $mailbox.PrimarySmtpAddress -FolderScope Calendar| Where-Object { $_.FolderType -eq 'Calendar' }).Name # Get users calendar folder settings for their default Calendar folder # calendar has the format identity:\\<calendar folder name> $calendar = Get-MailboxCalendarFolder -Identity \"$($mailbox.PrimarySmtpAddress):\\$calendarFolder\" if ($calendar.PublishEnabled) { Write-Host -ForegroundColor Yellow \"Calendar publishing is enabled for $($mailbox.PrimarySmtpAddress) on $($calendar.PublishedCalendarUrl)\" } }",
+ "DefaultValue": "Enabled (True)",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/manage/share-calendars-with-external-users?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.4",
+ "Description": "By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application. Do not allow users to install add-ins in Word, Excel, or PowerPoint.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application. Do not allow users to install add-ins in Word, Excel, or PowerPoint.",
+ "RationaleStatement": "Attackers commonly use vulnerable and custom-built add-ins to access data in user applications. While allowing users to install add-ins by themselves does allow them to easily acquire useful add-ins that integrate with Microsoft applications, it can represent a risk if not used and monitored carefully. Disabling future users' ability to install add-ins in Microsoft Word, Excel, or PowerPoint helps reduce your threat-surface and mitigate this risk.",
+ "ImpactStatement": "Implementation of this change will impact both end users and administrators. End users will not be able to install add-ins that they may want to install.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. In Services select User owned apps and services. 4. Uncheck Let users access the Office Store and Let users start trials on behalf of your organization. 5. Click Save. To remediate using PowerShell 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"OrgSettings-AppsAndServices.ReadWrite.All\". 2. Run the following Microsoft Graph PowerShell commands: $uri = \"https://graph.microsoft.com/beta/admin/appsAndServices\" $body = @{ \"Settings\" = @{ \"isAppAndServicesTrialEnabled\" = $false \"isOfficeStoreEnabled\" = $false } } | ConvertTo-Json Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. In Services select User owned apps and services. 4. Verify that Let users access the Office Store and Let users start trials on behalf of your organization are not checked. To Audit using PowerShell: 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"OrgSettings-AppsAndServices.Read.All\". 2. Run the following Microsoft Graph PowerShell command: $Uri = \"https://graph.microsoft.com/beta/admin/appsAndServices/settings\" Invoke-MgGraphRequest -Uri $Uri 3. Verify both isOfficeStoreEnabled and isAppAndServicesTrialEnabled are False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Let users access the Office Store is Checked Let users start trials on behalf of your organization is Checked",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center?view=o365-worldwide#manage-add-in-downloads-by-turning-onoff-the-office-store-across-all-apps-except-outlook"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.5",
+ "Description": "Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.",
+ "RationaleStatement": "Enabling internal phishing protection for Microsoft Forms will prevent attackers using forms for phishing attacks by asking personal or other sensitive information and URLs.",
+ "ImpactStatement": "If potential phishing was detected, the form will be temporarily blocked and cannot be distributed, and response collection will not happen until it is unblocked by the administrator or keywords were removed by the creator.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Under Services select Microsoft Forms. 4. Click the checkbox labeled Add internal phishing protection under Phishing protection. 5. Click Save. To remediate using PowerShell 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"OrgSettings-AppsAndServices.ReadWrite.All\". 2. Run the following Microsoft Graph PowerShell commands: $uri = 'https://graph.microsoft.com/beta/admin/forms/settings' $body = @{ \"isInOrgFormsPhishingScanEnabled\" = $true } | ConvertTo-Json Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Under Services select Microsoft Forms. 4. Verify the checkbox labeled Add internal phishing protection is checked under Phishing protection. To Audit using PowerShell: 1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes \"OrgSettings-Forms.Read.All\". 2. Run the following Microsoft Graph PowerShell commands: $uri = 'https://graph.microsoft.com/beta/admin/forms/settings' Invoke-MgGraphRequest -Uri $uri | select isInOrgFormsPhishingScanEnabled 3. Verify that isInOrgFormsPhishingScanEnabled is 'True'.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Internal Phishing Protection is enabled.",
+ "References": "https://learn.microsoft.com/en-US/microsoft-forms/administrator-settings-microsoft-forms:https://learn.microsoft.com/en-US/microsoft-forms/review-unblock-forms-users-detected-blocked-potential-phishing"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.6",
+ "Description": "Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.",
+ "Checks": [
+ "admincenter_organization_customer_lockbox_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.",
+ "RationaleStatement": "Enabling this feature protects organizational data against data spillage and exfiltration.",
+ "ImpactStatement": "Administrators will need to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Select Security & privacy tab. 4. Click Customer lockbox. 5. Check the box Require approval for all data access requests. 6. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-OrganizationConfig -CustomerLockBoxEnabled $true",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Select Security & privacy tab. 4. Click Customer lockbox. 5. Verify the box labeled Require approval for all data access requests is checked. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-OrganizationConfig | Select-Object CustomerLockBoxEnabled 3. Verify the value is set to True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Require approval for all data access requests - Unchecked CustomerLockboxEnabled - False",
+ "References": "https://learn.microsoft.com/en-us/purview/customer-lockbox-requests#turn-customer-lockbox-requests-on-or-off"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.7",
+ "Description": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. Ensure Microsoft 365 on the web third-party storage services are restricted.",
+ "Checks": [
+ "exchange_mailbox_policy_additional_storage_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites. Ensure Microsoft 365 on the web third-party storage services are restricted.",
+ "RationaleStatement": "By using external storage services an organization may increase the risk of data breaches and unauthorized access to confidential information. Additionally, third-party services may not adhere to the same security standards as the organization, making it difficult to maintain data privacy and security.",
+ "ImpactStatement": "Impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Go to Settings > Org Settings > Services > Microsoft 365 on the web 3. Uncheck Let users open files stored in third-party storage services in Microsoft 365 on the web To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Application.ReadWrite.All\" 2. Run the following script: $SP = Get-MgServicePrincipal -Filter \"appId eq 'c1f33bc0-bdb4-4248-ba9b- 096807ddb43e'\" # If the service principal doesn't exist then create it first. if (-not $SP) { $SP = New-MgServicePrincipal -AppId \"c1f33bc0-bdb4-4248-ba9b- 096807ddb43e\" } Update-MgServicePrincipal -ServicePrincipalId $SP.Id -AccountEnabled:$false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Go to Settings > Org Settings > Services > Microsoft 365 on the web 3. Verify that Let users open files stored in third-party storage services in Microsoft 365 on the web is not checked. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Application.Read.All\". 2. Run the following script: $SP = Get-MgServicePrincipal -Filter \"appId eq 'c1f33bc0-bdb4-4248-ba9b- 096807ddb43e'\" if ((-not $SP) -or $SP.AccountEnabled) { Write-Host \"Audit Result: ** FAIL **\" } else { Write-Host \"Audit Result: ** PASS **\" } 3. Verify that AccountEnabled is False. Note: The check will also fail if the Service Principal does not exist as users will still be able to open files stored in third-party storage services in Microsoft 365 on the web.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled - Users are able to open files stored in third-party storage services",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/setup/set-up-file-storage-and-sharing?view=o365-worldwide#enable-or-disable-third-party-storage-services"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.8",
+ "Description": "Sway is a Microsoft 365 app that lets organizations create interactive, web-based presentations using images, text, videos and other media. Its design engine simplifies the process, allowing for quick customization. Presentations can then be shared via a link. This setting controls user Sway sharing capability, both within and outside of the organization. By default, Sway is enabled for everyone in the organization.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Sway is a Microsoft 365 app that lets organizations create interactive, web-based presentations using images, text, videos and other media. Its design engine simplifies the process, allowing for quick customization. Presentations can then be shared via a link. This setting controls user Sway sharing capability, both within and outside of the organization. By default, Sway is enabled for everyone in the organization.",
+ "RationaleStatement": "Disable external sharing of Sway documents that can contain sensitive information to prevent accidental or arbitrary data leaks.",
+ "ImpactStatement": "Interactive reports, presentations, newsletters, and other items created in Sway will not be shared outside the organization by users.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Under Services select Sway o Uncheck: Let people in your organization share their sways with people outside your organization. 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings > Org settings. 3. Under Services select Sway. 4. Verify that under Sharing, the following is not checked: o Let people in your organization share their sways with people outside your organization.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Let people in your organization share their sways with people outside your organization - Enabled",
+ "References": "https://support.microsoft.com/en-us/office/administrator-settings-for-sway-d298e79b-b6ab-44c6-9239-aa312f5784d4:https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-sway-service-description"
+ }
+ ]
+ },
+ {
+ "Id": "1.3.9",
+ "Description": "Shared Bookings allows you to invite your team members and create booking pages and let your customers book time with you and your team. It contains various settings to define services, manage staff members, configure schedules and availability, business hours and customize how appointments are scheduled. These pages can be customized to fit the diverse needs of your organization. It is an extension of Person Bookings. The recommended state is to restrict the OwaMailboxPolicy-Default policy or disable at the organization level.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "1 Microsoft 365 admin center",
+ "SubSection": "1.3 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Shared Bookings allows you to invite your team members and create booking pages and let your customers book time with you and your team. It contains various settings to define services, manage staff members, configure schedules and availability, business hours and customize how appointments are scheduled. These pages can be customized to fit the diverse needs of your organization. It is an extension of Person Bookings. The recommended state is to restrict the OwaMailboxPolicy-Default policy or disable at the organization level.",
+ "RationaleStatement": "Shared Bookings pages can be exploited by threat actors to impersonate legitimate users using convincing internal email addresses. A compromised low-privilege account could be used to mimic high-profile identities (e.g., the CEO) and bypass impersonation filters to initiate fraudulent actions like fund transfers. Additionally, attackers may create authoritative-looking addresses (e.g., admin@, hostmaster@) to conduct social engineering attacks on external parties aimed at the transfer of infrastructure control. To reduce this risk, access to Shared Bookings should be limited to users with a clear business need and subject to monitoring and governance.",
+ "ImpactStatement": "Disabling Shared Bookings will limit users' ability to create self-service scheduling pages, which may reduce convenience for teams that rely on automated meeting coordination. Approved users will need to be added to a separate OWA Policy which will increase administrative overhead. Note: Before modifying the default owa policy, ensure that any users who rely on Shared Bookings are assigned a separate policy that explicitly allows its use. This will help prevent unintended service disruptions.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-OwaMailboxPolicy \"OwaMailboxPolicy-Default\" - BookingsMailboxCreationEnabled $false Optionally: For a more restrictive state Bookings can be disabled at the organization level 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following command: Set-OrganizationConfig -BookingsEnabled $false Note: Disabling Bookings at the tenant (organization) level will be more impactful to end users and is not required for compliance.",
+ "AuditProcedure": "Ensure Shared Bookings is turned off in the OWA Default policy. If booking is disabled at the tenant (OrganizationConfig) level this is also a compliant state. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following command: Get-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default | fl BookingsMailboxCreationEnabled 3. Verify that BookingsMailboxCreationEnabled is set to False. Optionally: If Bookings is disabled at the organization level, this is also considered a compliant state. 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following command: Get-OrganizationConfig | fl BookingsEnabled 3. If BookingsEnabled is set to False, the organization is using a more restrictive and compliant configuration. In this case changing the default OWA policy would not be required for compliance.",
+ "AdditionalInformation": "",
+ "DefaultValue": "BookingsMailboxCreationEnabled : True (OwaMailboxPolicy-Default) BookingsEnabled : True",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/bookings/turn-bookings-on-or-off?view=o365-worldwide:https://techcommunity.microsoft.com/blog/office365businessappsblog/enhancing-security-in-microsoft-bookings-best-practices-for-admins/4382447:https://learn.microsoft.com/en-us/microsoft-365/bookings/best-practices-shared-bookings?view=o365-worldwide&source=recommendations:https://www.cyberis.com/article/microsoft-bookings-facilitating-impersonation"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.1",
+ "Description": "Enabling Safe Links policy for Office applications allows URL's that exist inside of Office documents and email applications opened by Office, Office Online and Office mobile to be processed against Defender for Office time-of-click verification and rewritten if required. Note: E5 Licensing includes a number of Built-in Protection policies. When auditing policies note which policy you are viewing, and keep in mind CIS recommendations often extend the Default or Built-in Policies provided by MS. In order to Pass the highest priority policy must match all settings recommended.",
+ "Checks": [
+ "defender_safelinks_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Enabling Safe Links policy for Office applications allows URL's that exist inside of Office documents and email applications opened by Office, Office Online and Office mobile to be processed against Defender for Office time-of-click verification and rewritten if required. Note: E5 Licensing includes a number of Built-in Protection policies. When auditing policies note which policy you are viewing, and keep in mind CIS recommendations often extend the Default or Built-in Policies provided by MS. In order to Pass the highest priority policy must match all settings recommended.",
+ "RationaleStatement": "Safe Links for Office applications extends phishing protection to documents and emails that contain hyperlinks, even after they have been delivered to a user.",
+ "ImpactStatement": "User impact associated with this change is minor - users may experience a very short delay when clicking on URLs in Office documents before being directed to the requested site. Users should be informed of the change as, in the event a link is unsafe and blocked, they will receive a message that it has been blocked.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com 2. Under Email & collaboration select Policies & rules 3. Select Threat policies then Safe Links 4. Click on +Create 5. Name the policy then click Next 6. In Domains select all valid domains for the organization and Next 7. Ensure the following URL & click protection settings are defined: Email o Checked On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default o Checked Apply Safe Links to email messages sent within the organization o Checked Apply real-time URL scanning for suspicious links and links that point to files o Checked Wait for URL scanning to complete before delivering the message o Unchecked Do not rewrite URLs, do checks via Safe Links API only. Teams o Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten Office 365 Apps o Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps. URLs are not rewritten Click protection settings o Checked Track user clicks o Unchecked Let users click through the original URL o There is no recommendation for organization branding. 8. Click Next twice and finally Submit To remediate using PowerShell: 1. Connect using Connect-ExchangeOnline. 2. Run the following PowerShell script to create a policy at highest priority that will apply to all valid domains on the tenant: # Create the Policy $params = @{ Name = \"CIS SafeLinks Policy\" EnableSafeLinksForEmail = $true EnableSafeLinksForTeams = $true EnableSafeLinksForOffice = $true TrackClicks = $true AllowClickThrough = $false ScanUrls = $true EnableForInternalSenders = $true DeliverMessageAfterScan = $true DisableUrlRewrite = $false } New-SafeLinksPolicy @params # Create the rule for all users in all valid domains and associate with Policy New-SafeLinksRule -Name \"CIS SafeLinks\" -SafeLinksPolicy \"CIS SafeLinks Policy\" -RecipientDomainIs (Get-AcceptedDomain).Name -Priority 0",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com 2. Under Email & collaboration select Policies & rules 3. Select Threat policies then Safe Links 4. Inspect each policy and attempt to identify one that matches the parameters outlined below. 5. Scroll down the pane and click on Edit Protection settings (Global Readers will look for on or off values) 6. Verify that the following protection settings are set as outlined: Email o Checked On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default o Checked Apply Safe Links to email messages sent within the organization o Checked Apply real-time URL scanning for suspicious links and links that point to files o Checked Wait for URL scanning to complete before delivering the message o Unchecked Do not rewrite URLs, do checks via Safe Links API only. Teams o Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten Office 365 Apps o Checked On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office apps. URLs are not rewritten Click protection settings oChecked Track user clicks oUnchecked Let users click through the original URL 7. There is no recommendation for organization branding. 8. Click close To audit using PowerShell: 1. Connect using Connect-ExchangeOnline. 2. Run the following to output properties from all Safe Links policies: $params = @( 'Identity', 'EnableSafeLinksForEmail', 'EnableSafeLinksForTeams', 'EnableSafeLinksForOffice', 'TrackClicks', 'AllowClickThrough', 'ScanUrls', 'EnableForInternalSenders', 'DeliverMessageAfterScan', 'DisableUrlRewrite' ) Get-SafeLinksPolicy | Select-Object -Property $Params 3. Verify there is at least one policy that matches the properties and values below: Identity : <Example CIS SafeLinks Policy> EnableSafeLinksForEmail : True EnableSafeLinksForTeams : True EnableSafeLinksForOffice : True TrackClicks : True AllowClickThrough : False ScanUrls : True EnableForInternalSenders : True DeliverMessageAfterScan : True DisableUrlRewrite : False",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/safe-links-policies-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/powershell/module/exchange/set-safelinkspolicy?view=exchange-ps:https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.2",
+ "Description": "The Common Attachment Types Filter is a setting within Exchange Online Protection's anti-malware policy that blocks inbound and outbound email messages containing attachments of specified file types. When enabled, messages with attachments matching the blocked extensions are quarantined before delivery. Microsoft maintains a default set of file types considered high risk; organizations may also add custom extensions to the list. The recommended state is Enable the common attachments filter set to On, on the default anti-malware policy, with the default list of blocked file types.",
+ "Checks": [
+ "defender_malware_policy_common_attachments_filter_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The Common Attachment Types Filter is a setting within Exchange Online Protection's anti-malware policy that blocks inbound and outbound email messages containing attachments of specified file types. When enabled, messages with attachments matching the blocked extensions are quarantined before delivery. Microsoft maintains a default set of file types considered high risk; organizations may also add custom extensions to the list. The recommended state is Enable the common attachments filter set to On, on the default anti-malware policy, with the default list of blocked file types.",
+ "RationaleStatement": "Email is a primary delivery vector for malware, including ransomware, trojans, and remote access tools distributed via executable, script, and installer file formats. The Common Attachment Types Filter blocks delivery of file types that have no legitimate business use in email but are routinely weaponized (such as .exe, .vbs, .bat, .msi), and similar formats. Enforcing this filter at the gateway reduces the attack surface before any client-side or endpoint control has the opportunity to respond.",
+ "ImpactStatement": "Emails containing attachments with blocked extensions, including those sent by trusted internal senders, will be quarantined and not delivered. Some file types in the default block list may be used legitimately in some IT workflows. Administrators who need to permit specific extensions for specific users or groups should create a scoped custom anti-malware policy with a higher priority than the Default policy rather than modifying the Default policy's file type list.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under polices select Anti-malware and click on the Default (Default) policy. 5. On the Policy page that appears on the right hand pane scroll to the bottom and click on Edit protection settings, check the Enable the common attachments filter. o If any of the default file types are missing click Select file types and add the missing file types in. o Reference the Default Value section of this document for the list of extensions that should be blocked. 6. Click Save to save the changes. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following to enable the common attachment filter: Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true 3. Use Set-MalwareFilterPolicy -Identity Default with the -FileTypes parameter to add any missing file types from the default list. o FileTypes accepts an array of strings. o To avoid using it destructively, first retrieve the existing list of file types using Get-MalwareFilterPolicy and append any missing file types to the list before using Set-MalwareFilterPolicy to update the policy.",
+ "AuditProcedure": "Note: The following procedures audit only the Default anti-malware policy. Auditing custom policies is not required for compliance and is discretionary based on the organization's needs. To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under Policies select Anti-malware and click on the Default (Default) policy. 5. On the policy page that appears on the righthand pane, under Protection settings, verify that the Enable the common attachments filter has the value of On. 6. Click on Edit protection settings to view the list of file types that are blocked by the common attachment filter. Verify that the list of file types contains at least the 53 file types found in the Default Value section of this document. Note: Verifying the complete file type list via the UI requires manual comparison against the default extensions listed in the Default Value section of this document. Auditors who require a programmatic comparison should use the PowerShell method. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following Exchange Online PowerShell command: Get-MalwareFilterPolicy -Identity Default 3. Verify that the EnableFileFilter property has the value of True. 4. Verify that the FileTypes property contains at least default list of 53 file types found in the Default Value section of this document.",
+ "AdditionalInformation": "",
+ "DefaultValue": "EnableFileFilter : True Default extensions: [ \"ani\", \"apk\", \"app\", \"appx\", \"arj\", \"bat\", \"cab\", \"cmd\", \"com\", \"deb\", \"dex\", \"dll\", \"docm\", \"elf\", \"exe\", \"hta\", \"img\", \"iso\", \"jar\", \"jnlp\", \"kext\", \"lha\", \"lib\", \"library\", \"lnk\", \"lzh\", \"macho\", \"msc\", \"msi\", \"msix\", \"msp\", \"mst\", \"pif\", \"ppa\", \"ppam\", \"reg\", \"rev\", \"scf\", \"scr\", \"sct\", \"sys\", \"uif\", \"vb\", \"vbe\", \"vbs\", \"vxd\", \"wsc\", \"wsf\", \"wsh\", \"xll\", \"xz\", \"z\", \"ace\" ]",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/exchange/get-malwarefilterpolicy?view=exchange-ps:https://learn.microsoft.com/en-us/defender-office-365/anti-malware-policies-configure?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.3",
+ "Description": "Exchange Online Protection (EOP) is Microsoft's cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes. EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity.",
+ "Checks": [
+ "defender_malware_policy_notifications_internal_users_malware_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Exchange Online Protection (EOP) is Microsoft's cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes. EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity.",
+ "RationaleStatement": "This setting alerts administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated.",
+ "ImpactStatement": "Notification of account with potential issues should not have an impact on the user.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand E-mail & Collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under Policies select Anti-malware. 5. Click on the Default (Default) policy. 6. Click on Edit protection settings and change the settings for Notify an admin about undelivered messages from internal senders to On and enter the email address of the administrator who should be notified under Administrator email address. 7. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following command: Set-MalwareFilterPolicy -Identity '{Identity Name}' - EnableInternalSenderAdminNotifications $True -InternalSenderAdminAddress {admin@domain1.com} Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization's tenant, then ensure the setting is set as outlined in the highest priority policy listed.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand E-mail & Collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under Policies select Anti-malware. 5. Click on the Default (Default) policy. 6. Verify that Notify an admin about undelivered messages from internal senders is set to On and that there is at least one email address under Administrator email address. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following command: Get-MalwareFilterPolicy | fl Identity, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress 3. Verify that EnableInternalSenderAdminNotifications is set to True and a InternalSenderAdminAddress address is defined. Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization's tenant, then ensure the setting is set as outlined in the highest priority policy listed.",
+ "AdditionalInformation": "",
+ "DefaultValue": "EnableInternalSenderAdminNotifications : False InternalSenderAdminAddress : $null",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-about:https://learn.microsoft.com/en-us/defender-office-365/anti-malware-policies-configure"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.4",
+ "Description": "The Safe Attachments policy helps protect users from malware in email attachments by scanning attachments for viruses, malware, and other malicious content. When an email attachment is received by a user, Safe Attachments will scan the attachment in a secure environment and provide a verdict on whether the attachment is safe or not.",
+ "Checks": [
+ "defender_safe_attachments_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "The Safe Attachments policy helps protect users from malware in email attachments by scanning attachments for viruses, malware, and other malicious content. When an email attachment is received by a user, Safe Attachments will scan the attachment in a secure environment and provide a verdict on whether the attachment is safe or not.",
+ "RationaleStatement": "Enabling Safe Attachments policy helps protect against malware threats in email attachments by analyzing suspicious attachments in a secure, cloud-based environment before they are delivered to the user's inbox. This provides an additional layer of security and can prevent new or unseen types of malware from infiltrating the organization's network.",
+ "ImpactStatement": "Delivery of email with attachments may be delayed while scanning is occurring.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand E-mail & Collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under Policies select Safe Attachments. 5. Click + Create. 6. Create a Policy Name and Description, and then click Next. 7. Select all valid domains and click Next. 8. Select Block. 9. Quarantine policy is AdminOnlyAccessPolicy. 10. Leave Enable redirect unchecked. 11. Click Next and finally Submit. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. To change an existing policy modify the example below and run the following PowerShell command: Set-SafeAttachmentPolicy -Identity 'Example policy' -Action 'Block' - QuarantineTag 'AdminOnlyAccessPolicy' -Enable $true 3. Or, edit and run the below example to create a new safe attachments policy. New-SafeAttachmentPolicy -Name \"CIS 2.1.4\" -Enable $true -Action 'Block' - QuarantineTag 'AdminOnlyAccessPolicy' New-SafeAttachmentRule -Name \"CIS 2.1.4 Rule\" -SafeAttachmentPolicy \"CIS 2.1.4\" -RecipientDomainIs 'exampledomain[.]com' Note: Policy targets such as users and domains should include domains, or groups that provide coverage for a majority of users in the organization. Different inclusion and exclusion use cases are not covered in the benchmark.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand E-mail & Collaboration > Policies & rules. 3. On the Policies & rules page select Threat policies. 4. Under Policies select Safe Attachments. 5. Inspect the highest priority policy. 6. Verify that Users and domains and Included recipient domains are in scope for the organization. 7. Verify that Safe Attachments detection response: is set to Block - Block current and future messages and attachments with detected malware. 8. Verify that Quarantine Policy is set to AdminOnlyAccessPolicy. 9. Verify that the policy is not disabled. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-SafeAttachmentPolicy | ft Identity,Enable,Action,QuarantineTag 3. Inspect the highest priority safe attachments policy and ensure the properties and values match the below: Enable : True Action : Block QuarantineTag : AdminOnlyAccessPolicy Note: To view the priority for a policy the Get-SafeAttachmentRule must be used. Built-in policies will always have a priority of lowest while presets like strict and standard can be viewed with Get-ATPProtectionPolicyRule. Strict and standard presets always operate at a higher priority than custom policies.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Identity : Built-In Protection Policy Enable : True Action : Block QuarantineTag : AdminOnlyAccessPolicy Priority : (lowest)",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about:https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-policies-configure"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.5",
+ "Description": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.",
+ "Checks": [
+ "defender_atp_safe_attachments_and_docs_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.",
+ "RationaleStatement": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protect organizations from inadvertently sharing malicious files. When a malicious file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.",
+ "ImpactStatement": "Impact associated with Safe Attachments is minimal, and equivalent to impact associated with anti-virus scanners in an environment.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com 2. Under Email & collaboration select Policies & rules 3. Select Threat policies then Safe Attachments. 4. Click on Global settings 5. Click to Enable Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams 6. Click to Enable Turn on Safe Documents for Office clients 7. Click to Disable Allow people to click through Protected View even if Safe Documents identified the file as malicious. 8. Click Save To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-AtpPolicyForO365 -EnableATPForSPOTeamsODB $true -EnableSafeDocs $true - AllowSafeDocsOpen $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Under Email & collaboration select Policies & rules. 3. Select Threat policies then Safe Attachments. 4. Click on Global settings. 5. Verify that the Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams toggle is set to Enabled. 6. Verify that the Turn on Safe Documents for Office clients toggle is set to Enabled. 7. Verify that the Allow people to click through Protected View even if Safe Documents identified the file as malicious toggle is set to Disabled. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-AtpPolicyForO365 | fl Name,EnableATPForSPOTeamsODB,EnableSafeDocs,AllowSafeDocsOpen Verify the values for each parameter as below: EnableATPForSPOTeamsODB : True EnableSafeDocs : True AllowSafeDocsOpen : False",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.6",
+ "Description": "In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP. Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.",
+ "Checks": [
+ "defender_antispam_outbound_policy_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP. Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.",
+ "RationaleStatement": "A blocked account is a good indication that the account in question has been breached, and an attacker is using it to send spam emails to other people.",
+ "ImpactStatement": "Notification of users that have been blocked should not cause an impact to the user.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules> Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Anti-spam outbound policy (default). 5. Select Edit protection settings then under Notifications: 6. Check Send a copy of suspicious outbound messages or message that exceed these limits to these users and groups then enter the desired email addresses. 7. Check Notify these users and groups if a sender is blocked due to sending outbound spam then enter the desired email addresses. 8. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: $BccEmailAddress = @(\"<INSERT-EMAIL>\") $NotifyEmailAddress = @(\"<INSERT-EMAIL>\") Set-HostedOutboundSpamFilterPolicy -Identity Default - BccSuspiciousOutboundAdditionalRecipients $BccEmailAddress - BccSuspiciousOutboundMail $true -NotifyOutboundSpam $true - NotifyOutboundSpamRecipients $NotifyEmailAddress Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization's tenant, then ensure the setting is set as outlined in the highest priority policy listed.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Anti-spam outbound policy (default). 5. Verify that Send a copy of suspicious outbound messages or message that exceed these limits to these users and groups is set to On, ensure the email address is correct. 6. Verify that Notify these users and groups if a sender is blocked due to sending outbound spam is set to On, ensure the email address is correct. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-HostedOutboundSpamFilterPolicy | Select-Object Bcc*, Notify* 3. Verify both BccSuspiciousOutboundMail and NotifyOutboundSpam are set to True and the email addresses to be notified are correct. Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization's tenant, then ensure the setting is set as outlined in the highest priority policy listed.",
+ "AdditionalInformation": "",
+ "DefaultValue": "BccSuspiciousOutboundAdditionalRecipients : {} BccSuspiciousOutboundMail : False NotifyOutboundSpamRecipients : {} NotifyOutboundSpam : False",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.7",
+ "Description": "By default, Office 365 includes built-in features that help protect users from phishing attacks. Set up anti-phishing polices to increase this protection, for example by refining settings to better detect and prevent impersonation and spoofing attacks. The default policy applies to all users within the organization and is a single view to fine-tune anti- phishing protection. Custom policies can be created and configured for specific users, groups or domains within the organization and will take precedence over the default policy for the scoped users.",
+ "Checks": [
+ "defender_antiphishing_policy_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "By default, Office 365 includes built-in features that help protect users from phishing attacks. Set up anti-phishing polices to increase this protection, for example by refining settings to better detect and prevent impersonation and spoofing attacks. The default policy applies to all users within the organization and is a single view to fine-tune anti- phishing protection. Custom policies can be created and configured for specific users, groups or domains within the organization and will take precedence over the default policy for the scoped users.",
+ "RationaleStatement": "Protects users from phishing attacks (like impersonation and spoofing) and uses safety tips to warn users about potentially harmful messages.",
+ "ImpactStatement": "Mailboxes that are used for support systems such as helpdesk and billing systems send mail to internal users and are often not suitable candidates for impersonation protection. Care should be taken to ensure that these systems are excluded from Impersonation Protection.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules 3. Select Threat policies. 4. Under Policies select Anti-phishing and click Create. 5. Name the policy, continuing and clicking Next as needed: o Add Groups and/or Domains that contain a majority of the organization. o Set Phishing email threshold to 3 - More Aggressive o Check Enable users to protect and add up to 350 users o Check Enable domains to protect and check Include domains I own o Check Enable mailbox intelligence (Recommended) o Check Enable Intelligence for impersonation protection (Recommended) o Check Enable spoof intelligence (Recommended) 6. Under Actions configure the following: o Set If a message is detected as user impersonation to Quarantine the message o Set If a message is detected as domain impersonation to Quarantine the message o Set If Mailbox Intelligence detects an impersonated user to Quarantine the message o Leave Honor DMARC record policy when the message is detected as spoof checked. o Check Show first contact safety tip (Recommended) o Check Show user impersonation safety tip o Check Show domain impersonation safety tip o Check Show user impersonation unusual characters safety tip 7. Finally, click Next and Submit the policy. Note: DefaultFullAccessWithNotificationPolicy is suggested but not required. Users will be notified that impersonation emails are in the Quarantine. To remediate using PowerShell: 1. Connect to Exchange Online service using Connect-ExchangeOnline. 2. Run the following Exchange Online PowerShell script to create an AntiPhish policy: # Create the Policy $params = @{ Name = \"CIS AntiPhish Policy\" PhishThresholdLevel = 3 EnableTargetedUserProtection = $true EnableOrganizationDomainsProtection = $true EnableMailboxIntelligence = $true EnableMailboxIntelligenceProtection = $true EnableSpoofIntelligence = $true TargetedUserProtectionAction = 'Quarantine' TargetedDomainProtectionAction = 'Quarantine' MailboxIntelligenceProtectionAction = 'Quarantine' TargetedUserQuarantineTag = 'DefaultFullAccessWithNotificationPolicy' MailboxIntelligenceQuarantineTag = 'DefaultFullAccessWithNotificationPolicy' TargetedDomainQuarantineTag = 'DefaultFullAccessWithNotificationPolicy' EnableFirstContactSafetyTips = $true EnableSimilarUsersSafetyTips = $true EnableSimilarDomainsSafetyTips = $true EnableUnusualCharactersSafetyTips = $true HonorDmarcPolicy = $true } New-AntiPhishPolicy @params # Create the rule for all users in all valid domains and associate with Policy New-AntiPhishRule -Name $params.Name -AntiPhishPolicy $params.Name - RecipientDomainIs (Get-AcceptedDomain).Name -Priority 0 3. The new policy can be edited in the UI or via PowerShell. Note: Remediation guidance is intended to help create a qualifying AntiPhish policy that meets the recommended criteria while protecting the majority of the organization. It's understood some individual user exceptions may exist or exceptions for the entire policy if another product acts as a similar control.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules 3. Select Threat policies. 4. Under Policies select Anti-phishing. 5. Verify an AntiPhish policy exists that is On and meets the following criteria: 6. Under Users, groups, and domains o Verify that the included domains and groups includes a majority of the organization. 7. Under Phishing threshold & protection verify the following: o Phishing email threshold is at least 3 - More Aggressive. o User impersonation protection is On and contains a subset of users. o Domain impersonation protection is On for owned domains. o Mailbox intelligence and Mailbox intelligence for impersonations and Spoof intelligence are On. 8. Under Actions verify the following: o If a message is detected as user impersonation is set to Quarantine the message. o If a message is detected as domain impersonation is set to Quarantine the message. o If Mailbox Intelligence detects an impersonated user is set to Quarantine the message. o First contact safety tip is On. o User impersonation safety tip is On. o Domain impersonation safety tip is On. o Unusual characters safety tip is On. o Honor DMARC record policy when the message is detected as spoof is On. Note: DefaultFullAccessWithNotificationPolicy is suggested but not required. Users will be notified that impersonation emails are in the Quarantine. To audit using PowerShell: 1. Connect to Exchange Online service using Connect-ExchangeOnline. 2. Run the following Exchange Online PowerShell commands: $params = @( \"name\",\"Enabled\",\"PhishThresholdLevel\",\"EnableTargetedUserProtection\" \"EnableOrganizationDomainsProtection\",\"EnableMailboxIntelligence\" \"EnableMailboxIntelligenceProtection\",\"EnableSpoofIntelligence\" \"TargetedUserProtectionAction\",\"TargetedDomainProtectionAction\" \"MailboxIntelligenceProtectionAction\",\"EnableFirstContactSafetyTips\" \"EnableSimilarUsersSafetyTips\",\"EnableSimilarDomainsSafetyTips\" \"EnableUnusualCharactersSafetyTips\",\"TargetedUsersToProtect\" \"HonorDmarcPolicy\" ) Get-AntiPhishPolicy | fl $params 3. Verify there is a policy created that has matching values for the following parameters: Enabled : True PhishThresholdLevel : 3 EnableTargetedUserProtection : True EnableOrganizationDomainsProtection : True EnableMailboxIntelligence : True EnableMailboxIntelligenceProtection : True EnableSpoofIntelligence : True TargetedUserProtectionAction : Quarantine TargetedDomainProtectionAction : Quarantine MailboxIntelligenceProtectionAction : Quarantine EnableFirstContactSafetyTips : True EnableSimilarUsersSafetyTips : True EnableSimilarDomainsSafetyTips : True EnableUnusualCharactersSafetyTips : True TargetedUsersToProtect : {<contains users>} HonorDmarcPolicy : True 4. Verify that TargetedUsersToProtect contains a subset of the organization, up to 350 users, for targeted Impersonation Protection. 5. Use PowerShell to verify the AntiPhishRule is configured and enabled. Get-AntiPhishRule | ft AntiPhishPolicy,Priority,State,SentToMemberOf,RecipientDomainIs 6. Identity correct rule from the matching AntiPhishPolicy name in step 3. Ensure the rule defines groups or domains that include the majority of the organization by inspecting SentToMemberOf or RecipientDomainIs. Note: Audit guidance is intended to help identify a qualifying AntiPhish policy+rule that meets the recommended criteria while protecting the majority of the organization. It's understood some individual user exceptions may exist or exceptions for the entire policy if another product stands in as an equivalent control.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about:https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-eop-configure"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.8",
+ "Description": "For each domain that is configured in Exchange, a corresponding Sender Policy Framework (SPF) record should be created.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "For each domain that is configured in Exchange, a corresponding Sender Policy Framework (SPF) record should be created.",
+ "RationaleStatement": "SPF records enable Exchange Online Protection and other mail systems to verify which servers are authorized to send email for a domain. This helps those systems determine whether a message is legitimate or potentially spoofed. Enforcing a -all or ~all ensures that any undocumented or unauthorized networks attempting to send on behalf of the organization are immediately rejected, reducing the risk of impersonation. If an organization does not have full visibility into where its email originates, this represents a significant security gap. For example, if an email server is sending mail from an unexpected location across the country without your knowledge, that is a serious issue. Addressing this requires a deliberate discovery process to identify all legitimate sending sources, rather than allowing unknown systems to continue sending email unchecked.",
+ "ImpactStatement": "Setting up SPF records typically has minimal operational impact. However, organizations must ensure proper configuration, as misconfigured SPF records can cause legitimate email to be flagged as spam or fail authentication checks. Additionally, identifying all legitimate senders outside of the default Microsoft 365 IP ranges may require extra time and coordination during the discovery phase.",
+ "RemediationProcedure": "To remediate using a DNS provider: For each domain identified as non-compliant during the audit, make the necessary updates in your DNS provider or through your third-party SPF management service. Missing SPF Record: If a domain does not currently have an SPF record, create one similar to the example below, assuming all email is routed through Exchange Online (Microsoft 365 or Microsoft 365 GCC): # Hard fail v=spf1 include:spf.protection.outlook.com -all # Soft fail v=spf1 include:spf.protection.outlook.com ~all Additional Senders: If other authorized email services are used, add their SPF entries using the include: mechanism as needed. For example: v=spf1 include:spf.protection.outlook.com include:exampledomain.net -all",
+ "AuditProcedure": "STEP 1: Determine the list of domains to audit Using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Expand Settings > Domains. 3. Take note of all custom domains and subdomains defined. o Exclude the (MOERA) domain *.onmicrosoft.com o Exclude the coexistence domain *.mail.onmicrosoft.com (if shown). 4. Use this list of domains in the audit procedure. Using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following: Get-AcceptedDomain | Where-Object {$_.IsCoExistenceDomain -eq $false -and $_.InitialDomain -eq $false} 3. Use this list in the audit procedure. Note: Microsoft owns the tenant's organizational level *.onmicrosoft.com domains, so it is not necessary to create SPF records for the initial (MOERA) or the coexistence (hybrid) domain. STEP 2: Perform the Audit using PowerShell: 1. Open a PowerShell prompt. 2. Run the following for each custom domain identified in Step 1 that sends email from Exchange Online: Resolve-DnsName domain1.com -Type TXT | fl Ensure the following criteria are met: 1. A valid TXT record must begin with v=spf1, which indicates it is SPF v1 (the current standard). 2. The record must be either directly or indirectly managed: o An indirectly managed record uses a modifier like redirect=[domain], which allows centralized SPF management by a trusted vendor. 3. The record must end with a hard or soft fail policy: o The record must end with: -all or ~all, allowing for a hard fail or soft fail. o If the SPF record uses the redirect= modifier, the redirected SPF record must terminate with a compliant qualifier (not the parent). This will require repeating the DNS lookup against the redirected domain. o Other qualifiers not listed are not compliant as an end state. Parked domains: Ensure that any domain not used for sending email has an SPF record explicitly indicating that no mail is authorized from that domain, using v=spf1 - all. Below are examples of SPF records that are compliant. The audit does not evaluate specific include domains for compliant states. v=spf1 include:spf.protection.outlook.com -all v=spf1 include:spf.protection.outlook.com ~all # GCC High or DoD example v=spf1 include:exampledomain.net include:spf.protection.office365.us ~all # 21Vianet v=spf1 include:spf.protection.partner.outlook.cn ~all # Parked domains v=spf1 -all Note: Resolve-DnsName is not available on versions of Windows earlier than Windows 8 and Windows Server 2012. Use alternatives such as nslookup when needed.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf-configure?view=o365-worldwide:https://datatracker.ietf.org/doc/html/rfc7208:https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure?view=o365-worldwide#scenario-parked-domains"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.9",
+ "Description": "DKIM is one of the trio of Authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. DKIM lets an organization add a digital signature to outbound email messages in the message header. When DKIM is configured, the organization authorizes it's domain to associate, or sign, it's name to an email message using cryptographic authentication. Email systems that get email from this domain can use a digital signature to help verify whether incoming email is legitimate. Use of DKIM in addition to SPF and DMARC to help prevent malicious actors using spoofing techniques from sending messages that look like they are coming from your domain.",
+ "Checks": [
+ "defender_domain_dkim_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "DKIM is one of the trio of Authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. DKIM lets an organization add a digital signature to outbound email messages in the message header. When DKIM is configured, the organization authorizes it's domain to associate, or sign, it's name to an email message using cryptographic authentication. Email systems that get email from this domain can use a digital signature to help verify whether incoming email is legitimate. Use of DKIM in addition to SPF and DMARC to help prevent malicious actors using spoofing techniques from sending messages that look like they are coming from your domain.",
+ "RationaleStatement": "By enabling DKIM with Office 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and not being spoofed.",
+ "ImpactStatement": "There should be no impact of setting up DKIM however, organizations should ensure appropriate setup to ensure continuous mail-flow.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Rules section click Email authentication settings. 4. Select DKIM 5. Select the domain to remediate. 6. Click Create DKIM keys. 7. Microsoft provides the properly formatted CNAME records, copy these for later use. 8. In another browser tab or window, go to the domain registrar for the domain, and then create the two CNAME records using the information from the previous step. 9. Return the domain properties flyout and toggle Sign messages for this domain with DKIM signatures to Enabled. If successful the status will show Signing DKIM signatures for this domain.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Rules section click Email authentication settings. 4. Select DKIM. 5. For each Accepted domain that is configured to send email: o Skip any *.onmicrosoft.com domain (MOERA or Coexistence), these outbound messages are automatically signed by Microsoft. o Click on the domain name. o Confirm Sign messages for this domain with DKIM signatures is Enabled. o Ensure Status reads Signing DKIM signatures for this domain. 6. A status of Not signing DKIM signatures for this domain or No DKIM keys saved for this domain is out of compliance. Note: For step 5 these can also be audited the overview showing all domains. In this case a passing audit procedure will display the Toggle set as Enabled and Status as Valid. To audit using PowerShell: 1. Connect to Exchange Online service using Connect-ExchangeOnline. 2. Run the following: # Get-DkimSigningConfig does not display unconfigured domains, # so we first get all accepted domains and then match them against # the DKIM signing configurations. $Domains = Get-AcceptedDomain | Where-Object {$_.IsCoExistenceDomain -eq $false -and $_.InitialDomain -eq $false} $DKIMCfg = Get-DkimSigningConfig # Generate the report $Report = foreach ($Domain in $Domains) { $DKIM = $DKIMCfg | Where-Object { $_.Name -eq $Domain.Name } [PSCustomObject]@{ DomainName = $Domain.Name Enabled = [bool]$DKIM.Enabled Status = if ($DKIM) { $DKIM.Status } else { \"Not Configured\" } IsCISCompliant = ($DKIM.Enabled -and $DKIM.Status -eq \"Valid\") } } # Output the report $Report | Format-Table -AutoSize # Optionally, export the report to a CSV file # $Report | Export-Csv -Path \"2_1_9.csv\" -NoTypeInformation 3. For each domain that is configured to send email verify: o Enabled is True o Status is Valid. o Note: The property IsCISCompliant will also validate whether the state is compliant. Note: If you own registered domains that aren't used for email or anything at all (also known as parked domains), don't publish DKIM records for those domains. The lack of a DKIM record (hence, the lack of a public key in DNS to validate the message signature) prevents DKIM validation of forged domains.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Custom domains: Not configured by default MOERA onmicrosoft.com domain: Outbound email is automatically signed",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.10",
+ "Description": "DMARC, or Domain-based Message Authentication, Reporting, and Conformance, assists recipient mail systems in determining the appropriate action to take when messages from a domain fail to meet SPF or DKIM authentication criteria.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "DMARC, or Domain-based Message Authentication, Reporting, and Conformance, assists recipient mail systems in determining the appropriate action to take when messages from a domain fail to meet SPF or DKIM authentication criteria.",
+ "RationaleStatement": "DMARC strengthens the trustworthiness of messages sent from an organization's domain to destination email systems. When combined with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), DMARC significantly enhances defenses against email spoofing and phishing attempts. This includes the MOERA domain (e.g., contoso.onmicrosoft.com), which is provisioned with every Microsoft 365 tenant and is capable of originating email. Because it is often overlooked in favor of custom domains, it represents a common gap in email authentication coverage if left unprotected. Leaving a DMARC policy set to p=none can result in the mail system taking no action when a spear-phishing email fails DMARC but passes SPF and DKIM checks. Having DMARC fully configured is a critical part of preventing business email compromise.",
+ "ImpactStatement": "The remediation portion can take time to implement and involves a multi-staged approach over time. First, a baseline of the current state of email will be established with p=none and rua and ruf. Once the environment is better understood and reports have been analyzed, an organization will move to the final state with DMARC record values as outlined in the audit section.",
+ "RemediationProcedure": "To remediate using a DNS provider: 1. For any out of compliance domain sending email, add the following record to DNS: Record: _dmarc.domain1.com Type: TXT Value: v=DMARC1; p=none; rua=mailto:<rua-report@example.com>; ruf=mailto:<ruf-report@example.com> 2. This will create a basic DMARC policy that will allow the organization to start monitoring message statistics. 3. One week is enough time for data generated by the reports to be useful in understanding email trends and traffic. The final step requires implementing a policy of p=reject OR p=quarantine and pct=100 with the necessary rua and ruf email addresses defined: Record: _dmarc.domain1.com Type: TXT Value: v=DMARC1; p=reject; pct=100; rua=mailto:<rua-report@example.com>; ruf=mailto:<ruf-report@example.com> Parked Domains: For any domain not used for sending email, add the following record to DNS: Record: _dmarc.domain1.com Type: TXT Value: v=DMARC1; p=reject; To remediate the MOERA domain using the UI: 1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com/ 2. Expand Settings and select Domains. 3. Select your tenant domain (for example, contoso.onmicrosoft.com). 4. Select DNS records and click + Add record. 5. Add a new record with the TXT name of _dmarc with the appropriate values outlined above.",
+ "AuditProcedure": "STEP 1: Determine the list of domains to audit Using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com 2. Expand Settings > Domains. 3. Take note of all custom domains and subdomains defined. o Exclude the coexistence domain *.mail.onmicrosoft.com (if shown). 4. Include the MOERA domain: [tenant].onmicrosoft.com 5. Use this list of domains in the audit procedure. Using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following: Get-AcceptedDomain | Where-Object {$_.IsCoExistenceDomain -eq $false} 3. Use this list in the audit procedure. STEP 2: Perform the Audit using PowerShell: Note: Resolve-DnsName is not available on versions of Windows earlier than Windows 8 and Windows Server 2012. Use alternatives such as nslookup when needed. 1. Open a PowerShell prompt. 2. Run the following for each domain identified in Step 1: Resolve-DnsName _dmarc.domain1.com -Type TXT 3. Ensure the following criteria are met: 1. The record must be either directly or indirectly managed: - An indirectly managed record would use a CNAME to point to another record. - If the record is managed indirectly then that record must meet all criteria. This would require an additional DNS lookup. 2. The version v tag value must be v=DMARC1, which identifies it as a DMARC record. 3. The policy p tag value is p=quarantine OR p=reject. 4. The sampling rate pct tag value is pct=100 or does not exist. (A non- existent pct tag indicates sampling is 100 percent) 5. The aggregate data rua tag value is configured, i.e. rua=mailto:<reporting email address>. 6. The failure data ruf tag value is configured, i.e. ruf=mailto:<reporting email address>. 4. Subdomain considerations o When subdomains of the organizational domain are in scope, DMARC policy is determined using a two-step record discovery process (RFC 7489, Section 6.6.3): 1. If the subdomain has its own valid DMARC record (i.e., a record that includes the required p= tag), only that record is used. Nothing is inherited from the organizational domain. Any tags not explicitly defined in the subdomain's record fall back to their RFC- defined default values. 2. If the subdomain does not have a valid DMARC record - either because no record exists or because the record is malformed (e.g., missing the required p= tag) - the organizational domain's record is used. When determining policy disposition, the sp= (subdomain policy) tag is applied if present; otherwise, the p= tag is used. o This fallback is record discovery, not per-tag inheritance. The lookup always falls back to the organizational domain directly. Intermediate parent subdomains are never consulted. o The sp= tag is only meaningful when set on the organizational domain's record and is ignored on subdomain records. 5. Compliance is met when each domain and subdomain meets the requirements in steps 3 and 4. Parked Domains: Ensure that any domain not used for sending email has a DMARC record explicitly indicating that no mail is authorized from that domain. 1. The version v tag value must be v=DMARC1, which identifies it as a DMARC record. 2. The policy p tag value is p=reject. The following example records would pass as they contain a policy that would either quarantine or reject messages failing DMARC, and the policy affects 100% of mail pct=100 as well as containing valid reporting and aggregate addresses: v=DMARC1; p=reject; pct=100; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; fo=1 v=DMARC1; p=reject; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; fo=1 v=DMARC1; p=quarantine; pct=100; sp=none; fo=1; ri=3600; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; # Parked domains v=DMARC1; p=reject; Note: The third example includes sp=none, which sets the subdomain policy to monitor- only. While the organizational domain itself would be compliant, any subdomains would not meet the audit criteria if they exist. Auditors must evaluate subdomains separately to confirm compliance.",
+ "AdditionalInformation": "Microsoft has a list of best practices for implementing DMARC that cover these steps in detail.",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/how-to-enable-dmarc-reporting-for-microsoft-online-email-routing-address-moera-and-parked-domains?view=o365-worldwide:https://media.defense.gov/2024/May/02/2003455483/-1/-1/0/CSA-NORTH-KOREAN-ACTORS-EXPLOIT-WEAK-DMARC.PDF:https://www.rfc-editor.org/rfc/rfc7489"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.11",
+ "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails. The policy provided by Microsoft covers 53 extensions, and an additional custom list of extensions can be defined. The list of 186 extensions provided in this recommendation is comprehensive but not exhaustive.",
+ "Checks": [
+ "defender_malware_policy_comprehensive_attachments_filter_applied"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails. The policy provided by Microsoft covers 53 extensions, and an additional custom list of extensions can be defined. The list of 186 extensions provided in this recommendation is comprehensive but not exhaustive.",
+ "RationaleStatement": "Blocking known malicious file types can help prevent malware-infested files from infecting a host or performing other malicious attacks such as phishing and data extraction. Defining a comprehensive list of attachments can help protect against additional unknown and known threats. Many legacy file formats, binary files and compressed files have been used as delivery mechanisms for malicious software. Organizations can protect themselves from Business E-mail Compromise (BEC) by allow-listing only the file types relevant to their line of business and blocking all others.",
+ "ImpactStatement": "For file types that are business necessary users will need to use other organizationally approved methods to transfer blocked extension types between business partners.",
+ "RemediationProcedure": "To Remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following script after editing InternalSenderAdminAddress: # Create an attachment policy and associated rule. The rule is # intentionally disabled allowing the org to enable it when ready $Policy = @{ Name = \"CIS L2 Attachment Policy\" EnableFileFilter = $true ZapEnabled = $true EnableInternalSenderAdminNotifications = $true InternalSenderAdminAddress = 'admin@contoso.com' # Change this. } $L2Extensions = @( \"7z\", \"a3x\", \"ace\", \"ade\", \"adp\", \"ani\", \"app\", \"appinstaller\", \"applescript\", \"application\", \"appref-ms\", \"appx\", \"appxbundle\", \"arj\", \"asd\", \"asx\", \"bas\", \"bat\", \"bgi\", \"bz2\", \"cab\", \"chm\", \"cmd\", \"com\", \"cpl\", \"crt\", \"cs\", \"csh\", \"daa\", \"dbf\", \"dcr\", \"deb\", \"desktopthemepackfile\", \"dex\", \"diagcab\", \"dif\", \"dir\", \"dll\", \"dmg\", \"doc\", \"docm\", \"dot\", \"dotm\", \"elf\", \"eml\", \"exe\", \"fxp\", \"gadget\", \"gz\", \"hlp\", \"hta\", \"htc\", \"htm\", \"html\", \"hwpx\", \"ics\", \"img\", \"inf\", \"ins\", \"iqy\", \"iso\", \"isp\", \"jar\", \"jnlp\", \"js\", \"jse\", \"kext\", \"ksh\", \"lha\", \"lib\", \"library-ms\", \"lnk\", \"lzh\", \"macho\", \"mam\", \"mda\", \"mdb\", \"mde\", \"mdt\", \"mdw\", \"mdz\", \"mht\", \"mhtml\", \"mof\", \"msc\", \"msi\", \"msix\", \"msp\", \"msrcincident\", \"mst\", \"ocx\", \"odt\", \"ops\", \"oxps\", \"pcd\", \"pif\", \"plg\", \"pot\", \"potm\", \"ppa\", \"ppam\", \"ppkg\", \"pps\", \"ppsm\", \"ppt\", \"pptm\", \"prf\", \"prg\", \"ps1\", \"ps11\", \"ps11xml\", \"ps1xml\", \"ps2\", \"ps2xml\", \"psc1\", \"psc2\", \"pub\", \"py\", \"pyc\", \"pyo\", \"pyw\", \"pyz\", \"pyzw\", \"rar\", \"reg\", \"rev\", \"rtf\", \"scf\", \"scpt\", \"scr\", \"sct\", \"searchConnector-ms\", \"service\", \"settingcontent-ms\", \"sh\", \"shb\", \"shs\", \"shtm\", \"shtml\", \"sldm\", \"slk\", \"so\", \"spl\", \"stm\", \"svg\", \"swf\", \"sys\", \"tar\", \"theme\", \"themepack\", \"timer\", \"uif\", \"url\", \"uue\", \"vb\", \"vbe\", \"vbs\", \"vhd\", \"vhdx\", \"vxd\", \"wbk\", \"website\", \"wim\", \"wiz\", \"ws\", \"wsc\", \"wsf\", \"wsh\", \"xla\", \"xlam\", \"xlc\", \"xll\", \"xlm\", \"xls\", \"xlsb\", \"xlsm\", \"xlt\", \"xltm\", \"xlw\", \"xnk\", \"xps\", \"xsl\", \"xz\", \"z\" ) # Create the policy New-MalwareFilterPolicy @Policy -FileTypes $L2Extensions # Create the rule for all accepted domains $Rule = @{ Name = $Policy.Name Enabled = $false MalwareFilterPolicy = $Policy.Name RecipientDomainIs = (Get-AcceptedDomain).Name Priority = 0 } New-MalwareFilterRule @Rule 3. When prepared enable the rule either through the UI or PowerShell. Note: Due to the number of extensions the UI method is not covered. The objects can however be edited in the UI or manually added using the list from the script. 1. Navigate to Microsoft Defender at https://security.microsoft.com/ 2. Browse to Policies & rules > Threat policies > Anti-malware.",
+ "AuditProcedure": "For this control, a Level 2 comprehensive attachment policy is defined as one that includes at least 120 extensions. The 184 extensions included are a known vector for malicious activity. To pass, organizations must demonstrate at least a 90% adoption rate of the extension list referenced in the script below, with allowances for justified exceptions. Since individual extensions are not assigned specific risk weights, exceptions should be based on documented business needs. Note: Utilizing the UI for auditing Anti-malware policies can be very time consuming so it is recommended to use a script like the one supplied below. To Audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following script: $AttachExts = @( '7z', 'a3x', 'ace', 'ade', 'adp', 'ani', 'apk', 'app', 'appinstaller', 'applescript', 'application', 'appref-ms', 'appx', 'appxbundle', 'arj', 'asd', 'asx', 'bas', 'bat', 'bgi', 'bz2', 'cab', 'chm', 'cmd', 'com', 'cpl', 'crt', 'cs', 'csh', 'daa', 'dbf', 'dcr', 'deb', 'desktopthemepackfile', 'dex', 'diagcab', 'dif', 'dir', 'dll', 'dmg', 'doc', 'docm', 'dot', 'dotm', 'elf', 'eml', 'exe', 'fxp', 'gadget', 'gz', 'hlp', 'hta', 'htc', 'htm', 'html', 'hwpx', 'ics', 'img', 'inf', 'ins', 'iqy', 'iso', 'isp', 'jar', 'jnlp', 'js', 'jse', 'kext', 'ksh', 'lha', 'lib', 'library', 'library-ms', 'lnk', 'lzh', 'macho', 'mam', 'mda', 'mdb', 'mde', 'mdt', 'mdw', 'mdz', 'mht', 'mhtml', 'mof', 'msc', 'msi', 'msix', 'msp', 'msrcincident', 'mst', 'ocx', 'odt', 'ops', 'oxps', 'pcd', 'pif', 'plg', 'pot', 'potm', 'ppa', 'ppam', 'ppkg', 'pps', 'ppsm', 'ppt', 'pptm', 'prf', 'prg', 'ps1', 'ps11', 'ps11xml', 'ps1xml', 'ps2', 'ps2xml', 'psc1', 'psc2', 'pub', 'py', 'pyc', 'pyo', 'pyw', 'pyz', 'pyzw', 'rar', 'reg', 'rev', 'rtf', 'scf', 'scpt', 'scr', 'sct', 'searchConnector-ms', 'service', 'settingcontent-ms', 'sh', 'shb', 'shs', 'shtm', 'shtml', 'sldm', 'slk', 'so', 'spl', 'stm', 'svg', 'swf', 'sys', 'tar', 'theme', 'themepack', 'timer', 'uif', 'url', 'uue', 'vb', 'vbe', 'vbs', 'vhd', 'vhdx', 'vxd', 'wbk', 'website', 'wim', 'wiz', 'ws', 'wsc', 'wsf', 'wsh', 'xla', 'xlam', 'xlc', 'xll', 'xlm', 'xls', 'xlsb', 'xlsm', 'xlt', 'xltm', 'xlw', 'xnk', 'xps', 'xsl', 'xz', 'z' ) $MalwareFilterPolicies = Get-MalwareFilterPolicy $MalwareFilterRules = Get-MalwareFilterRule # A policy must have at least 90% of the extensions in the reference list to pass. # This allows for some flexibility with exceptions. $PassingValue = .90 # 90% $FailThreshold = [int]($AttachExts.count * (1 - $PassingValue)) # Only evaluate policies that have more than 120 extensions defined # so we don't output failures on policies that aren't specific to # extension filtering. $CompPolicies = $MalwareFilterPolicies | Where-Object { $_.FileTypes.Count - gt 120 } if (-not $CompPolicies) { Write-Output \"## FAIL ## No comprehensive policies found to evaluate.\" return } $ExtensionReport = foreach ($policy in $CompPolicies) { $Missing = Compare-Object -ReferenceObject $AttachExts ` -DifferenceObject $policy.FileTypes ` -PassThru | Where-Object { $_.SideIndicator -eq '<=' } $FoundRule = $MalwareFilterRules | Where-Object { $_.MalwareFilterPolicy -eq $policy.Id } # Define passing conditions to determine if this policy passes all checks. $Pass = ($Missing.Count -lt $FailThreshold) -and ($FoundRule.State -eq 'Enabled') -and ($policy.EnableFileFilter -eq $true) [PSCustomObject]@{ PolicyName = $policy.Identity IsCISCompliant = $Pass EnableFileFilter = $policy.EnableFileFilter State = $FoundRule.State MissingCount = $Missing.count MissingExtensions = $Missing -join \", \" ExtensionCount = $policy.FileTypes.count } } # Output results in various formats $ExtensionReport | Format-Table -AutoSize <# Optional: Export methods $ExtensionReport | Out-GridView -Title \"Attachment Filter results\" $ExtensionReport | Export-Csv -Path \"2.1.11.csv\" -NoTypeInformation $ExtensionReport | ConvertTo-Json | Out-File -FilePath \"2.1.11.json\" #> 3. Review the results, only policies with over 120 extensions defined will be evaluated. At the end of the script examples of different output formats are given. 4. A pass is given for the following conditions: o A single active policy exists that covers all file extensions listed except those defined as an exception by the organization. o The policy has a state of Enabled. o The EnableFileFilter property is set to True. 5. The report includes a IsCISCompliant property, where True indicates in compliance, allowing for up to 10% of the listed extensions to be missing as documented exceptions. Note: Organizations should evaluate any extensions missing from the report to determine if they are valid exceptions. Note: The audit procedure intentionally does not include the action taken for matched extensions, e.g. Reject with NDR or Quarantine the message. These are considered organization specific and are not scored. When FileTypeAction is not specified the action will default to Reject the message with a non-delivery receipt (NDR). The Quarantine Policy is also considered organization specific.",
+ "AdditionalInformation": "",
+ "DefaultValue": "The following extensions are blocked by default: ace, ani, apk, app, appx, arj, bat, cab, cmd, com, deb, dex, dll, docm, elf, exe, hta, img, iso, jar, jnlp, kext, lha, lib, library, lnk, lzh, macho, msc, msi, msix, msp, mst, pif, ppa, ppam, reg, rev, scf, scr, sct, sys, uif, vb, vbe, vbs, vxd, wsc, wsf, wsh, xll, xz, z",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/exchange/get-malwarefilterpolicy?view=exchange-ps:https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/office/compatibility/office-file-format-reference"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_malware_policy_comprehensive_attachments_filter_applied",
+ "ConfigKey": "recommended_blocked_file_types",
+ "Operator": "superset",
+ "Value": [
+ "ace",
+ "ani",
+ "apk",
+ "app",
+ "appx",
+ "arj",
+ "bat",
+ "cab",
+ "cmd",
+ "com",
+ "deb",
+ "dex",
+ "dll",
+ "docm",
+ "elf",
+ "exe",
+ "hta",
+ "img",
+ "iso",
+ "jar",
+ "jnlp",
+ "kext",
+ "lha",
+ "lib",
+ "library",
+ "lnk",
+ "lzh",
+ "macho",
+ "msc",
+ "msi",
+ "msix",
+ "msp",
+ "mst",
+ "pif",
+ "ppa",
+ "ppam",
+ "reg",
+ "rev",
+ "scf",
+ "scr",
+ "sct",
+ "sys",
+ "uif",
+ "vb",
+ "vbe",
+ "vbs",
+ "vxd",
+ "wsc",
+ "wsf",
+ "wsh",
+ "xll",
+ "xz",
+ "z"
+ ]
+ }
+ ]
+ },
+ {
+ "Id": "2.1.12",
+ "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are IP Allow List, IP Block List and Safe list. The recommended state is IP Allow List empty or undefined.",
+ "Checks": [
+ "defender_antispam_connection_filter_policy_empty_ip_allowlist"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are IP Allow List, IP Block List and Safe list. The recommended state is IP Allow List empty or undefined.",
+ "RationaleStatement": "Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered. Messages that are determined to be malware or high confidence phishing are filtered.",
+ "ImpactStatement": "This is the default behavior. IP Allow lists may reduce false positives, however, this benefit is outweighed by the importance of a policy which scans all messages regardless of the origin. This supports the principle of zero trust.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules> Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Connection filter policy (Default). 5. Click Edit connection filter policy. 6. Remove any IP entries from Always allow messages from the following IP addresses or address range:. 7. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @{}",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Connection filter policy (Default). 5. Verify that IP Allow list contains no entries. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-HostedConnectionFilterPolicy -Identity Default | fl IPAllowList 3. Verify that IPAllowList is empty or {}",
+ "AdditionalInformation": "",
+ "DefaultValue": "IPAllowList : {}",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/connection-filter-policies-configure:https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-the-ip-allow-list:https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined#user-and-tenant-settings-conflict"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.13",
+ "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are IP Allow List, IP Block List and Safe list. The safe list is a pre-configured allow list that is dynamically updated by Microsoft. The recommended safe list state is: Off or False",
+ "Checks": [
+ "defender_antispam_connection_filter_policy_safe_list_off"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are IP Allow List, IP Block List and Safe list. The safe list is a pre-configured allow list that is dynamically updated by Microsoft. The recommended safe list state is: Off or False",
+ "RationaleStatement": "Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered. Messages that are determined to be malware or high confidence phishing are filtered. The safe list is managed dynamically by Microsoft, and administrators do not have visibility into which senders are included. Incoming messages from email servers on the safe list bypass spam filtering.",
+ "ImpactStatement": "This is the default behavior. IP Allow lists may reduce false positives, however, this benefit is outweighed by the importance of a policy which scans all messages regardless of the origin. This supports the principle of zero trust.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules> Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Connection filter policy (Default). 5. Click Edit connection filter policy. 6. Uncheck Turn on safe list. 7. Click Save. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-HostedConnectionFilterPolicy -Identity Default -EnableSafeList $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Policies select Anti-spam. 4. Click on the Connection filter policy (Default). 5. Verify that Safe list is Off. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-HostedConnectionFilterPolicy -Identity Default | fl EnableSafeList 3. Verify that EnableSafeList is False",
+ "AdditionalInformation": "",
+ "DefaultValue": "EnableSafeList : False",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/connection-filter-policies-configure:https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-the-ip-allow-list:https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined#user-and-tenant-settings-conflict"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.14",
+ "Description": "Anti-spam protection is a feature of Exchange Online that utilizes policies to help to reduce the amount of junk email, bulk and phishing emails a mailbox receives. These policies contain lists to allow or block specific senders or domains. - The allowed senders list - The allowed domains list - The blocked senders list - The blocked domains list The recommended state is: Do not define any Allowed domains",
+ "Checks": [
+ "defender_antispam_policy_inbound_no_allowed_domains"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Anti-spam protection is a feature of Exchange Online that utilizes policies to help to reduce the amount of junk email, bulk and phishing emails a mailbox receives. These policies contain lists to allow or block specific senders or domains. - The allowed senders list - The allowed domains list - The blocked senders list - The blocked domains list The recommended state is: Do not define any Allowed domains",
+ "RationaleStatement": "Messages from entries in the allowed senders list or the allowed domains list bypass most email protection (except malware and high confidence phishing) and email authentication checks (SPF, DKIM and DMARC). Entries in the allowed senders list or the allowed domains list create a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered. The risk is increased even more when allowing common domain names as these can be easily spoofed by attackers. Microsoft specifies in its documentation that allowed domains should be used for testing purposes only.",
+ "ImpactStatement": "This is the default behavior. Allowed domains may reduce false positives, however, this benefit is outweighed by the importance of having a policy which scans all messages regardless of the origin. As an alternative consider sender based lists. This supports the principle of zero trust.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules> Threat policies. 3. Under Policies select Anti-spam. 4. Open each out of compliance inbound anti-spam policy by clicking on it. 5. Click Edit allowed and blocked senders and domains. 6. Select Allow domains. 7. Delete each domain from the domains list. 8. Click Done > Save. 9. Repeat as needed. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-HostedContentFilterPolicy -Identity <Policy name> -AllowedSenderDomains @{} Or, run this to remove allowed domains from all inbound anti-spam policies: $AllowedDomains = Get-HostedContentFilterPolicy | Where-Object {$_.AllowedSenderDomains} $AllowedDomains | Set-HostedContentFilterPolicy -AllowedSenderDomains @{}",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Policies select Anti-spam. 4. Inspect each inbound anti-spam policy 5. Verify that Allowed domains does not contain any domain names. 6. Repeat as needed for any additional inbound anti-spam policy. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-HostedContentFilterPolicy | ft Identity,AllowedSenderDomains 3. Verify that AllowedSenderDomains is undefined for each inbound policy. Note: Each inbound policy must pass for this recommendation to be considered to be in a passing state.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AllowedSenderDomains : {}",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-about#allow-and-block-lists-in-anti-spam-policies"
+ }
+ ]
+ },
+ {
+ "Id": "2.1.15",
+ "Description": "The default outbound anti-spam policy in Microsoft Defender automatically applies to all users and is designed to detect and limit suspicious email-sending behavior. The policy enforces limits based on both volume and spam detection. If a user sends too many emails too quickly or if a high percentage of their messages are flagged as spam, their ability to send email can be temporarily restricted. This helps prevent abuse from compromised accounts or inadvertent spam campaigns. When these limits are exceeded, Microsoft routes the messages through a high-risk delivery pool to protect its IP reputation and notifies administrators through built-in alert policies. The recommended state is: - External: Restrict sending to external recipients (per hour) - 500 - Internal: Restrict sending to internal recipients (per hour) - 1000 - Daily: Maximum recipient limit per day - 1000 - Action: Over limit action - Restrict the user from sending mail",
+ "Checks": [
+ "defender_antispam_outbound_policy_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.1 Email & collaboration",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The default outbound anti-spam policy in Microsoft Defender automatically applies to all users and is designed to detect and limit suspicious email-sending behavior. The policy enforces limits based on both volume and spam detection. If a user sends too many emails too quickly or if a high percentage of their messages are flagged as spam, their ability to send email can be temporarily restricted. This helps prevent abuse from compromised accounts or inadvertent spam campaigns. When these limits are exceeded, Microsoft routes the messages through a high-risk delivery pool to protect its IP reputation and notifies administrators through built-in alert policies. The recommended state is: - External: Restrict sending to external recipients (per hour) - 500 - Internal: Restrict sending to internal recipients (per hour) - 1000 - Daily: Maximum recipient limit per day - 1000 - Action: Over limit action - Restrict the user from sending mail",
+ "RationaleStatement": "Message limit settings help lessen the impact of a Business Email Compromise (BEC) by automatically restricting accounts that send unusually high volumes of email. This containment prevents compromised accounts from launching large-scale attacks and helps ensure the organization's email remains trusted and deliverable. Without these limits, excessive or suspicious outbound traffic could result in Microsoft blocking the organization's email, disrupting communication and damaging reputation.",
+ "ImpactStatement": "Enforcing message limits may result in legitimate users being temporarily blocked from sending email if their bulk messaging activity resembles spam or exceeds volume thresholds. This can disrupt business operations, delay communication, and require administrative effort to investigate and restore access. However, these adverse effects typically stem from a lack of planning around mass mailings. To avoid triggering these limits, Microsoft recommends sending bulk email through custom subdomains or third- party bulk email providers.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules> Threat policies. 3. Under Policies select Anti-spam and click to open Anti-spam outbound policy (Default). 4. Select Edit protection settings. 5. Set the following settings to the recommended values, or more restrictive values. Message limit values of 0 are not compliant, as it represents the service default o External: Set an external message limit - 500 o Internal: Set an internal message limit - 1000 o Daily: Set a daily message limit - 1000 o Action: Restriction placed on users who reach the message limit - Restrict the user from sending mail 6. Verify that Notify these users and groups if a sender is blocked due to sending outbound spam contains a monitored mailbox. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Change the example email addresses below and run the following PowerShell commands: $params = @{ RecipientLimitExternalPerHour = 500 RecipientLimitInternalPerHour = 1000 RecipientLimitPerDay = 1000 ActionWhenThresholdReached = 'BlockUser' NotifyOutboundSpamRecipients = @('admin@example.com','security@example.com') } Set-HostedOutboundSpamFilterPolicy -Identity 'Default' @params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com. 2. Expand Email & collaboration > Policies & rules > Threat policies. 3. Under Policies select Anti-spam and click to open Anti-spam outbound policy (Default). 4. Verify the following settings are configured to the recommended level or a more restrictive value. Message limit values of 0 are not compliant, as it represents the service default: o External: Restrict sending to external recipients (per hour) - 500 o Internal: Restrict sending to internal recipients (per hour) - 1000 o Daily: Maximum recipient limit per day - 1000 o Action: Over limit action - Restrict the user from sending mail 5. Verify that a monitored mailbox is configured as a recipient under Notify these users and groups if a sender is blocked due to sending outbound spam. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following: $params = @( 'RecipientLimitExternalPerHour' 'RecipientLimitInternalPerHour' 'RecipientLimitPerDay' 'ActionWhenThresholdReached' 'NotifyOutboundSpamRecipients' ) Get-HostedOutboundSpamFilterPolicy -Identity Default | fl $params 3. Verify that each of the following properties is configured as specified: o RecipientLimitExternalPerHour is 500 or less, but not 0 o RecipientLimitInternalPerHour is 1000 or less, but not 0 o RecipientLimitPerDay is 1000 or less, but not 0 o ActionWhenThresholdReached is BlockUser o NotifyOutboundSpamRecipients contains a monitored mailbox. Note: Microsoft's Recommended Strict values represent a more restrictive and also compliant configuration. These values 400, 800, and 800 align with the values above. For further details on Standard and Strict settings, refer to the references section.",
+ "AdditionalInformation": "",
+ "DefaultValue": "RecipientLimitExternalPerHour : 0 RecipientLimitInternalPerHour : 0 RecipientLimitPerDay : 0 ActionWhenThresholdReached : BlockUserForToday The value of 0 means the service defaults are being used. More information on sending limits is here: https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange- online-service-description/exchange-online-limits#sending-limits-1",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about:https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365#outbound-spam-policy-settings:https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits#sending-limits-1"
+ }
+ ]
+ },
+ {
+ "Id": "2.2.1",
+ "Description": "Organizations should monitor sign-in and audit log activity from the emergency accounts and trigger notifications to other administrators. When you monitor the activity for emergency access accounts, you can verify these accounts are only used for testing or actual emergencies. You can use Azure Monitor, Microsoft Sentinel, Defender for Cloud Apps or other tools to monitor the sign-in logs and trigger email and SMS alerts to your administrators whenever emergency access accounts sign in. This recommendation uses Defender for Cloud Apps Policies to alert on emergency access account activity. The recommended state is to monitor Activity type Log on on break-glass or emergency access accounts.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.2 Cloud apps",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Organizations should monitor sign-in and audit log activity from the emergency accounts and trigger notifications to other administrators. When you monitor the activity for emergency access accounts, you can verify these accounts are only used for testing or actual emergencies. You can use Azure Monitor, Microsoft Sentinel, Defender for Cloud Apps or other tools to monitor the sign-in logs and trigger email and SMS alerts to your administrators whenever emergency access accounts sign in. This recommendation uses Defender for Cloud Apps Policies to alert on emergency access account activity. The recommended state is to monitor Activity type Log on on break-glass or emergency access accounts.",
+ "RationaleStatement": "Emergency access accounts should be used in very few scenarios, for example, the last Global Administrator has left the organization and the account is inaccessible. All activity on an emergency access account should be reviewed at the time of the event to ensure the sign on is legitimate and authorized.",
+ "ImpactStatement": "There is no real world impact to monitoring these accounts beyond allocating staff. The frequency of emergency account sign on should be so low that any activity raises a red flag that is treated with the highest priority.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com 2. Under the Cloud Apps section select Policies -> Policy management. 3. Click on All policies and then Create policy -> Activity policy. 4. Give the policy a name and set the following: o Policy severity to High severity. o Category to Privileged accounts. o Act on Single activity. o Click Select a filter -> Activity type equals Log on. o Click Add a filter -> User Name equals <Emergency access account> as Any role. o Ensure all emergency access accounts are added to this policy or another. o Select an alert method such as Send alert as email. Note: Multiple accounts can be monitored by a single policy or by separate policies.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com 2. Under the Cloud Apps section select Policies -> Policy management. 3. Locate a privileged accounts policy that meets the following criteria o Policy severity is High severity. o Category is Privileged accounts. o Act on Single activity is selected. o Under Activities matching all of the following verify: o Filter1: Activity type equals Log on o Filter2: User Name equals <Emergency access account> as Any role o Verify all additional emergency access accounts are accounted for. o Under Alerts, verify alerting is configured. 4. Repeat this process for any additional emergency access or break-glass accounts in the organization. If matching policies do not exist, then the audit procedure is considered a fail. Note: Multiple accounts can be monitored by a single policy or by separate policies. Note: Emergency access account activity can be monitored in various ways. The audit procedure passes as long as all emergency access account activity is monitored.",
+ "AdditionalInformation": "",
+ "DefaultValue": "A policy to monitor emergency access accounts does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access#monitor-sign-in-and-audit-logs:https://learn.microsoft.com/en-us/defender-cloud-apps/control-cloud-apps-with-policies"
+ }
+ ]
+ },
+ {
+ "Id": "2.4.1",
+ "Description": "Identify priority accounts to utilize Microsoft 365's advanced custom security features. This is an essential tool to bolster protection for users who are frequently targeted due to their critical positions, such as executives, leaders, managers, or others who have access to sensitive, confidential, financial, or high-priority information. Once these accounts are identified, several services and features can be enabled, including threat policies, enhanced sign-in protection through conditional access policies, and alert policies, enabling faster response times for incident response teams.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.4 System",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Identify priority accounts to utilize Microsoft 365's advanced custom security features. This is an essential tool to bolster protection for users who are frequently targeted due to their critical positions, such as executives, leaders, managers, or others who have access to sensitive, confidential, financial, or high-priority information. Once these accounts are identified, several services and features can be enabled, including threat policies, enhanced sign-in protection through conditional access policies, and alert policies, enabling faster response times for incident response teams.",
+ "RationaleStatement": "Enabling priority account protection for users in Microsoft 365 is necessary to enhance security for accounts with access to sensitive data and high privileges, such as CEOs, CISOs, CFOs, and IT admins. These priority accounts are often targeted by spear phishing or whaling attacks and require stronger protection to prevent account compromise. To address this, Microsoft 365 and Microsoft Defender for Office 365 offer several key features that provide extra security, including the identification of incidents and alerts involving priority accounts and the use of built-in custom protections designed specifically for them.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "To remediate using the UI: Remediate with a 3-step process Step 1: Enable Priority account protection in Microsoft 365 Defender: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Select System > Settings near the bottom of the left most panel. 3. Select E-mail & Collaboration > Priority account protection 4. Ensure Priority account protection is set to On Step 2: Tag priority accounts: 5. Select User tags 6. Select the PRIORITY ACCOUNT tag and click Edit 7. Select Add members to add users, or groups. Groups are recommended. 8. Repeat the previous 2 steps for any additional tags needed, such as Finance or HR. 9. Next and Submit. Step 3: Configure E-mail alerts for Priority Accounts: 10. Expand E-mail & Collaboration on the left column. 11. Select Policies & rules > Alert policy 12. Select New Alert Policy 13. Enter a valid policy Name & Description. Set Severity to High and Category to Threat management. 14. Set Activity is to Detected malware in an e-mail message 15. Mail direction is Inbound 16. Select Add Condition and User: recipient tags are 17. In the Selection option field add chosen priority tags such as Priority account. 18. Select Every time an activity matches the rule. 19. Next and verify valid recipient(s) are selected. 20. Next and select Yes, turn it on right away. Click Submit to save the alert. 21. Repeat steps 12 - 18 to create a 2nd alert for the Activity field Activity is: Phishing email detected at time of delivery Note: Any additional activity types may be added as needed. Above are the minimum recommended.",
+ "AuditProcedure": "To audit using the UI: Audit with a 3-step process Step 1: Verify Priority account protection is enabled: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Select System > Settings near the bottom of the left most panel. 3. Select E-mail & collaboration > Priority account protection 4. Verify that Priority account protection is set to On Step 2: Verify that priority accounts are identified and tagged accordingly: 5. Select User tags 6. Select the PRIORITY ACCOUNT tag and click Edit 7. Verify the assigned members match the organization's defined priority accounts or groups. 8. Repeat the previous 2 steps for any additional tags identified, such as Finance or HR. Step 3: Ensure alerts are configured: 9. Expand E-mail & Collaboration on the left column. 10. Select Policies & rules > Alert policy 11. Verify that at least two alert policies are configured to monitor priority accounts for the activities Detected malware in an email message and Phishing email detected at time of delivery. These alerts should meet the following criteria: o Severity: High o Category: Threat management o Mail Direction: Inbound o Recipient Tags: Includes Priority account To audit using PowerShell: 1. Connect to Exchange using Connect-ExchangeOnline 2. Retrieve the Priority Account protection state: Get-EmailTenantSettings | select EnablePriorityAccountProtection - Ensure EnablePriorityAccountProtection is true. 3. Connect to Security & Compliance PowerShell using Connect-IPPSSession 4. Retrieve alert policies targeting priority accounts: Get-ProtectionAlert | Where-Object { $_.RecipientTags -Match 'Priority account' } 5. For each returned policy, verify all of the following criteria: o Severity is High o Filter matches the pattern Mail.Direction -eq 'Inbound' o RecipientTags matches the pattern Priority account o NotificationEnabled is true o NotifyUser contains a valid email recipient o Disabled is false 6. The control is compliant when the results include: o One passing phishing policy (ThreatType = Phish) o One passing malware policy (ThreatType = Malware). o EnablePriorityAccountProtection is true from step 2.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default, priority accounts are undefined.",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/setup/priority-accounts:https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-security-recommendations"
+ }
+ ]
+ },
+ {
+ "Id": "2.4.2",
+ "Description": "Preset security policies have been established by Microsoft, utilizing observations and experiences within datacenters to strike a balance between the exclusion of malicious content from users and limiting unwarranted disruptions. These policies can apply to all, or select users and encompass recommendations for addressing spam, malware, and phishing threats. The policy parameters are pre-determined and non-adjustable. Strict protection has the most aggressive protection of the 3 presets. - EOP: Anti-spam, Anti-malware and Anti-phishing - Defender: Spoof protection, Impersonation protection and Advanced phishing - Defender: Safe Links and Safe Attachments NOTE: The preset security polices cannot target Priority account TAGS currently, groups should be used instead.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.4 System",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Preset security policies have been established by Microsoft, utilizing observations and experiences within datacenters to strike a balance between the exclusion of malicious content from users and limiting unwarranted disruptions. These policies can apply to all, or select users and encompass recommendations for addressing spam, malware, and phishing threats. The policy parameters are pre-determined and non-adjustable. Strict protection has the most aggressive protection of the 3 presets. - EOP: Anti-spam, Anti-malware and Anti-phishing - Defender: Spoof protection, Impersonation protection and Advanced phishing - Defender: Safe Links and Safe Attachments NOTE: The preset security polices cannot target Priority account TAGS currently, groups should be used instead.",
+ "RationaleStatement": "Enabling priority account protection for users in Microsoft 365 is necessary to enhance security for accounts with access to sensitive data and high privileges, such as CEOs, CISOs, CFOs, and IT admins. These priority accounts are often targeted by spear phishing or whaling attacks and require stronger protection to prevent account compromise. The implementation of stringent, pre-defined policies may result in instances of false positive, however, the benefit of requiring the end-user to preview junk email before accessing their inbox outweighs the potential risk of mistakenly perceiving a malicious email as safe due to its placement in the inbox.",
+ "ImpactStatement": "Strict policies are more likely to cause false positives in anti-spam, phishing, impersonation, spoofing and intelligence responses.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand E-mail & collaboration > Policies & rules > Threat policies. 3. Select Preset security policies. 4. Click to Manage protection settings for Strict protection preset. 5. For Apply Exchange Online Protection select at minimum Specific recipients and include the Accounts/Groups identified as Priority Accounts. 6. For Apply Defender for Office 365 Protection select at minimum Specific recipients and include the Accounts/Groups identified as Priority Accounts. 7. For Impersonation protection click Next and add valid e-mails or priority accounts both internal and external that may be subject to impersonation. 8. For Protected custom domains add the organization's domain name, along side other key partners. 9. Click Next and finally Confirm",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand E-mail & collaboration > Policies & rules > Threat policies. 3. From here visit each section in turn: Anti-phishing Anti-spam Anti-malware Safe Attachments Safe Links 4. Verify that each contains a policy named Strict Preset Security Policy that includes the organization's priority accounts and groups. To audit using PowerShell: 1. Connect to Exchange using Connect-ExchangeOnline 2. Retrieve the ATP strict presets rule for Defender: Get-ATPProtectionPolicyRule | Where-Object { $_.Identity -eq 'Strict Preset Security Policy' } 3. Retrieve the EOP strict preset rule for Defender: Get-EOPProtectionPolicyRule | Where-Object { $_.Identity -eq 'Strict Preset Security Policy' } 4. Verify the following criteria for both the EOP Rule and ATP Rule: o State is Enabled o At least one recipient target is populated with a VIP, i.e.: - SentTo, SentToMemberOf or RecipientDomainIs is not null 5. The control is compliant when both the ATP rule and the EOP rule exist and pass the criteria in step 4.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default, presets are not applied to any users or groups.",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies?view=o365-worldwide:https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-security-recommendations:https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365?view=o365-worldwide#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365"
+ }
+ ]
+ },
+ {
+ "Id": "2.4.3",
+ "Description": "Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility into suspicious activity in Microsoft 365, enabling investigation into potential security issues and facilitating the implementation of remediation measures if necessary. Some risk detection methods provided by Entra Identity Protection also require Microsoft Defender for Cloud Apps: - Suspicious manipulation of inbox rules - Suspicious inbox forwarding - New country detection - Impossible travel detection - Activity from anonymous IP addresses - Mass access to sensitive files",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.4 System",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility into suspicious activity in Microsoft 365, enabling investigation into potential security issues and facilitating the implementation of remediation measures if necessary. Some risk detection methods provided by Entra Identity Protection also require Microsoft Defender for Cloud Apps: - Suspicious manipulation of inbox rules - Suspicious inbox forwarding - New country detection - Impossible travel detection - Activity from anonymous IP addresses - Mass access to sensitive files",
+ "RationaleStatement": "Security teams can receive notifications of triggered alerts for atypical or suspicious activities, see how the organization's data in Microsoft 365 is accessed and used, suspend user accounts exhibiting suspicious activity, and require users to log back in to Microsoft 365 apps after an alert has been triggered.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Cloud apps. 3. Scroll to Information Protection and select Files. 4. Check Enable file monitoring. 5. Scroll up to Cloud Discovery and select Microsoft Defender for Endpoint. 6. Check Enforce app access, configure a Notification URL and Save. Note: Defender for Endpoint requires a Defender for Endpoint license. Configure App Connectors: 1. Scroll to Connected apps and select App connectors. 2. Click on Connect an app and select Microsoft 365. 3. Check all Azure and Office 365 boxes then click Connect Office 365. 4. Repeat for the Microsoft Azure application.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Cloud apps. 3. Scroll to Connected apps and select App connectors. 4. Verify that Microsoft 365 and Microsoft Azure both show in the list as Connected. 5. Go to Cloud Discovery > Microsoft Defender for Endpoint and verify that the integration is enabled. 6. Go to Information Protection > Files and verify Enable file monitoring is checked.",
+ "AdditionalInformation": "Additional Microsoft 365 Defender features include: - The option to use Defender for cloud apps as a reverse proxy, allowing for the application of access or session controls through the definition of a conditional access policy. - The purchase and implementation of the \"App Governance\" add-on, which provides more precise control over OAuth app permissions and includes additional built-in policies. A list of Defender for Cloud Apps built-in policies for Office 365 can be found at https://learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365.",
+ "DefaultValue": "Disabled",
+ "References": "https://learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365#connect-microsoft-365-to-microsoft-defender-for-cloud-apps:https://learn.microsoft.com/en-us/defender-cloud-apps/protect-azure#connect-azure-to-microsoft-defender-for-cloud-apps:https://learn.microsoft.com/en-us/defender-cloud-apps/best-practices:https://learn.microsoft.com/en-us/defender-cloud-apps/get-started:https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks"
+ }
+ ]
+ },
+ {
+ "Id": "2.4.4",
+ "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.",
+ "Checks": [
+ "defender_zap_for_teams_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.4 System",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.",
+ "RationaleStatement": "ZAP is intended to protect users that have received zero-day malware messages or content that is weaponized after being delivered to users. It does this by continually monitoring spam and malware signatures taking automated retroactive action on messages that have already been delivered.",
+ "ImpactStatement": "As with any anti-malware or anti-phishing product, false positives may occur.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Email & collaboration > Microsoft Teams protection. 3. Set Zero-hour auto purge (ZAP) to On (Default) To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following cmdlet: Set-TeamsProtectionPolicy -Identity \"Teams Protection Policy\" -ZapEnabled $true",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Email & collaboration > Microsoft Teams protection. 3. Verify that Zero-hour auto purge (ZAP) is set to On (Default) 4. Under Exclude these participants review the list of exclusions and verify they are justified and within tolerance for the organization. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following cmdlets: Get-TeamsProtectionPolicy | fl ZapEnabled Get-TeamsProtectionPolicyRule | fl ExceptIf* 3. Verify that ZapEnabled is True. 4. Review the list of exclusions and ensure they are justified and within tolerance for the organization. If nothing returns from the 2nd cmdlet then there are no exclusions defined.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On (Default)",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams:https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about?view=o365-worldwide#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2"
+ }
+ ]
+ },
+ {
+ "Id": "2.4.5",
+ "Description": "Automated Investigation and Response (AIR) investigates alerts and correlates related signals into investigations. When AIR identifies malicious email messages, it groups them into clusters based on shared characteristics like common malicious file, URL, or sending attributes and produces remediation actions for each cluster. This setting controls whether AIR-identified malicious message clusters are remediated automatically, without requiring SecOps approval. Administrators can enable automatic remediation for one or more cluster types: - Similar files: Clusters sharing a similar malicious file - Similar URLs: Clusters sharing a similar malicious URL - Multiple similar attributes: Clusters grouped by multiple shared attributes such as sender IP address, sender domain, or message subject When enabled, the configured remediation action is applied immediately upon cluster identification. The recommended state is to automatically remediate message clusters.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "2 Microsoft Defender",
+ "SubSection": "2.4 System",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Automated Investigation and Response (AIR) investigates alerts and correlates related signals into investigations. When AIR identifies malicious email messages, it groups them into clusters based on shared characteristics like common malicious file, URL, or sending attributes and produces remediation actions for each cluster. This setting controls whether AIR-identified malicious message clusters are remediated automatically, without requiring SecOps approval. Administrators can enable automatic remediation for one or more cluster types: - Similar files: Clusters sharing a similar malicious file - Similar URLs: Clusters sharing a similar malicious URL - Multiple similar attributes: Clusters grouped by multiple shared attributes such as sender IP address, sender domain, or message subject When enabled, the configured remediation action is applied immediately upon cluster identification. The recommended state is to automatically remediate message clusters.",
+ "RationaleStatement": "When automatic remediation is disabled, malicious message clusters identified by AIR remain in users' mailboxes as pending actions until a security analyst manually approves each remediation. During this approval window, users may interact with, open, or forward malicious messages, increasing the risk of a successful compromise. Enabling automatic remediation ensures identified threats are contained immediately upon detection, minimizing the exposure window and reducing the operational burden on security teams to manually review and approve routine threat clusters.",
+ "ImpactStatement": "Automatic remediation removes the manual SecOps approval step for qualifying message cluster actions. If AIR incorrectly classifies a legitimate message cluster as malicious, affected messages will be soft deleted without prior review. Soft deleted messages are moved to the Recoverable Items folder and can be restored through the Action center, Threat Explorer, or Advanced Hunting, subject to each mailbox's deleted item retention period (14 days by default). Organizations should verify retention policies and legal obligations before enabling this setting, as retention configuration affects whether soft deleted messages remain recoverable. Clusters exceeding 10,000 messages are always excluded from automatic remediation and will continue to require manual approval. License Requirement: This setting requires Defender for Office 365 Plan 2 which is included in Microsoft 365 E5.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Email & collaboration > MDO automation settings. 3. Under Message clusters check the following: o Similar files o Similar URLs o Multiple similar attributes 4. Click Save to apply the changes.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Defender https://security.microsoft.com/ 2. Expand System > Settings > Email & collaboration > MDO automation settings. 3. Verify that under Message clusters the following are checked: o Similar files o Similar URLs o Multiple similar attributes Note: At the time of publication, Soft delete is the only available remediation action and is selected by default. Because the action cannot be changed, verifying the selected remediation action is not part of the audit criteria for this recommendation.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default automatic remediation for message clusters is disabled.",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation:https://learn.microsoft.com/en-us/defender-office-365/air-about:https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder:https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention"
+ }
+ ]
+ },
+ {
+ "Id": "3.1.1",
+ "Description": "When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 180 days by default. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.",
+ "Checks": [
+ "purview_audit_log_search_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "3 Microsoft Purview",
+ "SubSection": "3.1 Audit",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 180 days by default. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.",
+ "RationaleStatement": "Enabling audit log search in the Microsoft Purview compliance portal can help organizations improve their security posture, meet regulatory compliance requirements, respond to security incidents, and gain valuable operational insights.",
+ "ImpactStatement": "",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Purview https://purview.microsoft.com/ 2. Select Solutions and then Audit to open the audit search. 3. Click blue bar Start recording user and admin activity. 4. Click Yes on the dialog box to confirm. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Purview https://purview.microsoft.com/ 2. Select Solutions and then Audit to open the audit search. 3. Choose a date and time frame in the past 30 days. 4. Verify search capabilities (e.g. try searching for Activities as Accessed file and results should be displayed). To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled 3. Ensure UnifiedAuditLogIngestionEnabled is set to True. Note: If the Get-AdminAuditLogConfig cmdlet is executed while connected to both Security & Compliance PowerShell as well as Exchange Online PowerShell then UnifiedAuditLogIngestionEnabled will always display False. This depends on the orders the module were imported. If Security & Compliance is needed in the same session be sure to connect to it first, and then Exchange PowerShell second.",
+ "AdditionalInformation": "",
+ "DefaultValue": "180 days",
+ "References": "https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?view=o365-worldwide&tabs=microsoft-purview-portal:https://learn.microsoft.com/en-us/powershell/module/exchange/set-adminauditlogconfig?view=exchange-ps:https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?view=o365-worldwide&tabs=microsoft-purview-portal#verify-the-auditing-status-for-your-organization"
+ }
+ ]
+ },
+ {
+ "Id": "3.2.1",
+ "Description": "Data Loss Prevention (DLP) policies allow Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Microsoft Purview",
+ "SubSection": "3.2 Data Loss Protection",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Data Loss Prevention (DLP) policies allow Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.",
+ "RationaleStatement": "Enabling DLP policies alerts users and administrators that specific types of data should not be exposed, helping to protect the data from accidental exposure.",
+ "ImpactStatement": "Enabling a Teams DLP policy will allow sensitive data in Exchange Online and SharePoint Online to be detected or blocked. Always ensure to follow appropriate procedures during testing and implementation of DLP policies based on organizational standards.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Purview https://purview.microsoft.com/ 2. Click Solutions > Data loss prevention then Policies. 3. Click Create policy. 4. Create a policy that is specific to the types of data the organization wishes to protect.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Purview https://purview.microsoft.com/ 2. Click Solutions > Data loss prevention and then Policies. 3. Inspect the list of policies and verify the following criteria: o A policy exists that meets the organizations DLP needs o Mode is On 4. Open the policy and verify there is at least one of the following locations defined: o Exchange email o SharePoint sites o OneDrive accounts o Teams chat and channel messages 5. Compliance is met when there is at least one policy the meets the above criteria. To audit using the PowerShell: 1. Connect to the Security & Compliance PowerShell using Connect-IPPSSession. 2. Execute the following cmdlet to get a list of DLP Policies: Get-DlpCompliancePolicy 3. For each policy returned verify the following criteria: o Mode is Enable o At least one of the following locations is defined: o ExchangeLocation o SharePointLocation o OneDriveLocation o TeamsLocation 4. Compliance is met when there is at least one policy the meets the above criteria. Note: The types of policies an organization should implement to protect information are specific to their industry. However, certain types of information, such as credit card numbers, social security numbers, and certain personally identifiable information (PII), are universally important to safeguard across all industries.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "3.2.2",
+ "Description": "The default Teams Data Loss Prevention (DLP) policy rule in Microsoft 365 is a preconfigured rule that is automatically applied to all Teams conversations and channels. The default rule helps prevent accidental sharing of sensitive information by detecting and blocking certain types of content that are deemed sensitive or inappropriate by the organization. By default, the rule includes a check for the sensitive info type Credit Card Number which is pre-defined by Microsoft.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Microsoft Purview",
+ "SubSection": "3.2 Data Loss Protection",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The default Teams Data Loss Prevention (DLP) policy rule in Microsoft 365 is a preconfigured rule that is automatically applied to all Teams conversations and channels. The default rule helps prevent accidental sharing of sensitive information by detecting and blocking certain types of content that are deemed sensitive or inappropriate by the organization. By default, the rule includes a check for the sensitive info type Credit Card Number which is pre-defined by Microsoft.",
+ "RationaleStatement": "Enabling the default Teams DLP policy rule in Microsoft 365 helps protect an organization's sensitive information by preventing accidental sharing or leakage of Credit Card information in Teams conversations and channels. DLP rules are not one size fits all, but at a minimum something should be defined. The organization should identify sensitive information important to them and seek to intercept it using DLP.",
+ "ImpactStatement": "End-users may be prevented from sharing certain types of content, which may require them to adjust their behavior or seek permission from administrators to share specific content. Administrators may receive requests from end-users for permission to share certain types of content or to modify the policy to better fit the needs of their teams.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Under Solutions select Data loss prevention then Policies. 3. Click Policies tab. 4. Check Default policy for Teams then click Edit policy. 5. The edit policy window will appear click Next 6. At the Choose locations to apply the policy page, turn the status toggle to On for Teams chat and channel messages location and then click Next. 7. On Customized advanced DLP rules page, ensure the Default Teams DLP policy rule Status is On and click Next. 8. On the Policy mode page, select the radial for Turn it on right away and click Next. 9. Review all the settings for the created policy on the Review your policy and create it page, and then click submit. 10. Once the policy has been successfully submitted click Done. Note: Some tenants may not have a default policy for teams as Microsoft started creating these by default at a particular point in time. In this case a new policy will have to be created that includes a rule to protect data important to the organization such as credit cards and PII.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Under Solutions select Data loss prevention then Policies. 3. Locate the Default policy for Teams. 4. Verify the Status is On. 5. Verify Locations include Teams chat and channel messages - All accounts. 6. Verify Policy settings includes the Default Teams DLP policy rule or one specific to the organization. Note: If there is not a default policy for teams inspect existing policies starting with step 4. DLP rules are specific to the organization and each organization should take steps to protect the data that matters to them. The default teams DLP rule will only alert on Credit Card matches. To audit using PowerShell: 1. Connect to the Security & Compliance PowerShell using Connect-IPPSSession. 2. Run the following to return policies that include Teams chat and channel messages: $DlpPolicy = Get-DlpCompliancePolicy $DlpPolicy | Where-Object {$_.Workload -match \"Teams\"} | ft Name,Mode,TeamsLocation* 3. If nothing returns, then there are no policies that include Teams and remediation is required. 4. For any returned policy verify Mode is set to Enable. 5. Verify TeamsLocation includes All. 6. Verify TeamsLocationException includes only permitted exceptions. Note: Some tenants may not have a default policy for teams as Microsoft started creating these by default at a particular point in time. In this case a new policy will have to be created that includes a rule to protect data important to the organization such as credit cards and PII.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled (On)",
+ "References": "https://learn.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps:https://learn.microsoft.com/en-us/purview/dlp-teams-default-policy:https://learn.microsoft.com/en-us/powershell/module/exchange/connect-ippssession?view=exchange-ps"
+ }
+ ]
+ },
+ {
+ "Id": "3.2.3",
+ "Description": "Microsoft Purview Data Loss Prevention (DLP) policies can be scoped to Microsoft 365 Copilot and Copilot Chat interactions. When active, these policies can restrict Copilot from processing or surfacing content that matches configured sensitive information types. Organizations must define the sensitive data categories relevant to their environment and configure at least one DLP policy that covers Copilot interactions in enforcement mode. The recommended state is to configure at least one DLP policy that includes Microsoft 365 Copilot and Copilot Chat - All accounts as a location with rules specific to the organization's needs.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Microsoft Purview",
+ "SubSection": "3.2 Data Loss Protection",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Purview Data Loss Prevention (DLP) policies can be scoped to Microsoft 365 Copilot and Copilot Chat interactions. When active, these policies can restrict Copilot from processing or surfacing content that matches configured sensitive information types. Organizations must define the sensitive data categories relevant to their environment and configure at least one DLP policy that covers Copilot interactions in enforcement mode. The recommended state is to configure at least one DLP policy that includes Microsoft 365 Copilot and Copilot Chat - All accounts as a location with rules specific to the organization's needs.",
+ "RationaleStatement": "Microsoft 365 Copilot can retrieve, summarize, and generate content based on data the authenticated user has access to across M365 workloads, including SharePoint, OneDrive, Teams, and Exchange. Without a DLP policy scoped to Copilot interactions, no technical control exists to prevent sensitive information such as PII, financial data, or health records from being incorporated into Copilot-generated responses and potentially exposed to users who would not otherwise have direct access to the source content. Enforcing DLP policies for Copilot ensures that sensitive data categories defined by the organization are intercepted before they are processed or surfaced by AI-generated responses.",
+ "ImpactStatement": "Users may find that Copilot declines to process or respond to prompts that involve content matching the organization's configured sensitive information types. In these cases, Copilot will notify the user that the request was blocked by policy. Users who rely on Copilot to summarize, draft, or retrieve content containing sensitive data such as documents with PII, financial records, or health information may need to rephrase their prompts or work with the content directly outside of Copilot. Administrators should communicate the scope of active DLP policies to affected users prior to enforcement.",
+ "RemediationProcedure": "To remediate using the UI: Note: Microsoft provides a guided wizard to create the Default DLP policy - Protect sensitive M365 Copilot interactions policy, which can be used when no Copilot DLP policy exists in the tenant. The steps below describe how to create a custom policy from scratch with Copilot included as a location. 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Under Solutions select Data loss prevention then Policies. 3. Click Policies tab. 4. Click + Create Policy. 5. Click on Enterprise applications & devices. 6. Under Categories select Custom and then Custom policy for the regulation. 7. Name the policy, and if appropriate, select an Admin Unit. 8. In Locations select Microsoft 365 Copilot and Copilot Chat. 9. Click on Next to proceed to the Advanced DLP rules page. 10. Click on + Create Rule 1. Name the rule and give a brief description of the data that is being targeted. 2. Click on + Add condition and select Content Contains 3. Click on Add and select Sensitive info types 4. Select the sensitive information types the organization wants to protect from being processed in Copilot interactions and click Add. 5. Click on + Add an action and select Restrict Copilot from processing content 6. Check the box for a relevant restriction. 7. Click on Save. 11. Repeat step 10 to create as many rules as the organization requires 12. Click Next. 13. On the Policy mode page, select the radial for Turn it on right away and click Next. 14. Click Submit to create the policy once it has been reviewed. 15. Finally, click Done. Note: Compliance with this recommendation is not achieved until the policy is in enforcement mode.",
+ "AuditProcedure": "Note: Some tenants may have a default policy called Default DLP policy - Protect sensitive M365 Copilot interactions that was automatically created. If not present, it can also be created using a guided process in the Policies blade. If this policy exists, it may be used to satisfy the requirements of this control provided it meets the compliance criteria below. To audit using the UI: 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Under Solutions select Data loss prevention then Policies. 3. Inspect the list of policies and verify the following criteria: o Locations includes Microsoft 365 Copilot and Copilot Chat - All accounts. o Mode is On. o The policy includes Rules that restrict sensitive data from being shared in Copilot interactions based on the organization's needs. 4. Compliance is met when there is at least one policy that meets the above criteria. To audit using PowerShell: 1. Connect to the Security & Compliance PowerShell using Connect-IPPSSession. 2. Run the following to return policies that include Teams chat and channel messages: $DlpPolicy = Get-DlpCompliancePolicy $DlpPolicy | Where-Object {$_.EnforcementPlanes -match \"CopilotExperiences\"} | FT Name,Mode,LocationInclusions,LocationExclusions 3. If nothing returns, then there are no policies that include Copilot and remediation is required. 4. For any returned policy verify Mode is set to Enable. 5. Verify LocationInclusions includes All. 6. Verify LocationExclusions includes only permitted exceptions. Note: DLP rules are specific to the organization and each organization should take steps to protect the data that matters to them. At a minimum, organizations should consider protecting personally identifiable information (PII) specific to their locale.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No Copilot DLP policy exists by default for most tenants. Some tenants may have had a Default DLP policy - Protect sensitive M365 Copilot interactions policy automatically provisioned by Microsoft; if present, it may satisfy this recommendation if it meets the audit criteria.",
+ "References": "https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about:https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-default-policy:https://learn.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps"
+ }
+ ]
+ },
+ {
+ "Id": "3.3.1",
+ "Description": "Sensitivity labels enable organizations to classify and label content across Microsoft 365 based on its sensitivity and business impact. These labels can be applied manually by users or automatically based on the content. When applied, labels can automatically encrypt content, provide \"Confidential\" watermarks, restrict access, and offer various data protection features. Labels can be scoped to data assets and containers: - Files & other data assets in Microsoft 365, Fabric, Azure, AWS and other platforms - Email messages sent from all versions of Outlook - Meeting calendar events and schedules in Outlook and Teams - Teams, Microsoft 365 Groups and SharePoint sites",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "3 Microsoft Purview",
+ "SubSection": "3.3 Information Protection",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Sensitivity labels enable organizations to classify and label content across Microsoft 365 based on its sensitivity and business impact. These labels can be applied manually by users or automatically based on the content. When applied, labels can automatically encrypt content, provide \"Confidential\" watermarks, restrict access, and offer various data protection features. Labels can be scoped to data assets and containers: - Files & other data assets in Microsoft 365, Fabric, Azure, AWS and other platforms - Email messages sent from all versions of Outlook - Meeting calendar events and schedules in Outlook and Teams - Teams, Microsoft 365 Groups and SharePoint sites",
+ "RationaleStatement": "Consistent usage of sensitivity labels can help reduce the risk of data loss or exposure and enable more effective incident response if a breach does occur. They can also help organizations comply with regulatory requirements and provide visibility and control over sensitive information.",
+ "ImpactStatement": "Encryption configurations (control access, DKE, BYOK) in the individual labels may impact users' ability to access site documents and information. Careful consideration of the individual sensitivity label configurations should be exercised prior to applying an auto labeling policy, publishing policy, sensitivity label configuration, or PowerShell based label settings to SharePoint sites. Additionally, when updating or deleting Sensitivity Labels, an assessment of the potential impacts should be conducted to avoid unintended consequences. If tenants are configured for sharing with guests or external domains and Sensitivity Labels have encryption applied, this can affect the ability to share documents via email stored in SharePoint. Some recipients may be unable to open the document depending on their email client, which could trigger Purview Advanced Encryptions and OME flows based on the recipient type and the cloud license from which the email is sent (e.g., government clouds vs. commercial clouds).",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Select Information protection > Sensitivity labels. 3. Click Create a label to create a label. 4. Click Publish labels and select any newly created labels to publish according to the organization's information protection needs.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com/ 2. Select Information protection > Policies > Label publishing policies. 3. Ensure that a Label policy exists and is published according to the organization's information protection needs. To audit using PowerShell: 1. Connect to the Security & Compliance PowerShell using Connect-IPPSSession. 2. Run the following script: $Policies = Get-LabelPolicy -WarningAction Ignore | Where-Object { $_.Type -eq \"PublishedSensitivityLabel\" } if ($Policies) { $Policies | Format-List -Property Name, *Location* Write-Host \"$($Policies.Count) Sensitivity Label policies found.\" } else { Write-Host \"No Sensitivity Label policies found\" } 3. Ensure there is at least one sensitivity label policy published. 4. Review the locations defined to ensure they're in scope with the organization's needs. Note: These policies are specific to the information protection needs of each organization. Whether an organization passes the audit is open to interpretation by the auditor and depends largely on how effectively it implements information protection features to safeguard data.",
+ "AdditionalInformation": "",
+ "DefaultValue": "The \"Global sensitivity label policy\" exists by default.",
+ "References": "https://learn.microsoft.com/en-us/purview/sensitivity-labels:https://learn.microsoft.com/en-us/purview/create-sensitivity-labels"
+ }
+ ]
+ },
+ {
+ "Id": "4.1",
+ "Description": "Compliance policies are sets of rules and conditions that are used to evaluate the configuration of managed devices. These policies can help secure organizational data and resources from devices that don't meet those configuration requirements. Managed devices must satisfy the conditions you set in your policies to be considered compliant by Intune. When combined with conditional access, this allows more control over how non-compliant devices are treated. The recommended state is Mark devices with no compliance policy assigned as as Not compliant",
+ "Checks": [
+ "intune_device_compliance_policy_unassigned_devices_not_compliant_by_default"
+ ],
+ "Attributes": [
+ {
+ "Section": "4 Microsoft Intune admin center",
+ "SubSection": "",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Compliance policies are sets of rules and conditions that are used to evaluate the configuration of managed devices. These policies can help secure organizational data and resources from devices that don't meet those configuration requirements. Managed devices must satisfy the conditions you set in your policies to be considered compliant by Intune. When combined with conditional access, this allows more control over how non-compliant devices are treated. The recommended state is Mark devices with no compliance policy assigned as as Not compliant",
+ "RationaleStatement": "Implementing this setting is a first step in adopting compliance policies for devices. When used together with Conditional Access policies the attack surface can be reduced by forcing an action to be taken for non-compliant devices. Note: This section does not focus on which compliance policies to use, only that an organization should adopt and enforce them to their needs.",
+ "ImpactStatement": "Any devices without a compliance policy will be marked not compliant. Care should be taken to first deploy any new compliance policies with a Conditional Access (CA) policy that is in the Report-only state. After the environment's device compliance is better understood it is then appropriate to finally align with Mark devices with no compliance policy assigned as and enable any CA policies that enforce actions based on device compliance. If a mature environment already has an existing device compliance CA policy and a large number of devices without an assigned compliance policy, this could cause disruption as those devices would then be suddenly considered not compliant.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Intune admin center https://intune.microsoft.com/ 2. Select Devices and then under Manage devices click Compliance 3. Click Compliance settings. 4. Set Mark devices with no compliance policy assigned as to Not compliant. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"DeviceManagementConfiguration.ReadWrite.All\" 2. Run the following commands: $Uri = 'https://graph.microsoft.com/v1.0/deviceManagement' $Body = @{ settings = @{ secureByDefault = $true } } | ConvertTo-Json Invoke-MgGraphRequest -Uri $Uri -Method PATCH -Body $Body",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Intune admin center https://intune.microsoft.com/ 2. Select Devices and then under Manage devices click Compliance 3. Click Compliance settings. 4. Verify that Mark devices with no compliance policy assigned as is set to Not compliant. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"DeviceManagementConfiguration.Read.All\" 2. Run the following commands: $Uri = 'https://graph.microsoft.com/v1.0/deviceManagement/settings' Invoke-MgGraphRequest -Uri $Uri -Method GET 3. Verify that secureByDefault is set to True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "UI: \"Compliant\" Graph: secureByDefault = $false",
+ "References": "https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started"
+ }
+ ]
+ },
+ {
+ "Id": "4.2",
+ "Description": "Device enrollment restrictions let you restrict devices from enrolling in Intune based on certain device attributes such as device limit, device platform, OS Version, manufacturer or device ownership (Personally owned devices). The recommended state is to Block personally owned devices from enrollment.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "4 Microsoft Intune admin center",
+ "SubSection": "",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Device enrollment restrictions let you restrict devices from enrolling in Intune based on certain device attributes such as device limit, device platform, OS Version, manufacturer or device ownership (Personally owned devices). The recommended state is to Block personally owned devices from enrollment.",
+ "RationaleStatement": "Restricting the enrollment of personally owned devices prevents attackers who have bypassed other controls from registering a new device to gain an additional foothold, further hiding or obscuring their activities. An attack path could be: 1. Account Compromise via Phishing and AiTM 2. Conditional Access Bypass 3. Reconnaissance using e.g. ROADrecon, GraphRunner or AADInternals 4. Lateral Movement, Privilege Escalation or Persistence through a newly registered device enrolled in Intune",
+ "ImpactStatement": "Per platform personally owned device enrollment impacts are listed below. It is important to test the changes to the defaults prior to moving into production and implementing this control. Windows Devices The following enrollment methods are authorized for corporate enrollment for Windows devices, any other enrollment method will be considered \"Personal\" and blocked: - The device enrolls through Windows Autopilot. - The device enrolls through GPO, or automatic enrollment from Configuration Manager for co-management. - The device enrolls through a bulk provisioning package. - The enrolling user is using a device enrollment manager account. MacOS By default, Intune classifies macOS devices as personally owned. To be classified as corporate-owned, a Mac must fulfill one of the following conditions: - Registered with a serial number. - Enrolled via Apple Automated Device Enrollment (ADE). iOS/IPadOS devices By default, Intune classifies iOS/iPadOS devices as personally owned. To be classified as corporate-owned, an iOS/iPadOS device must fulfill one of the following conditions: - Registered with a serial number or IMEI. - Enrolled by using Automated Device Enrollment (formerly Device Enrollment Program). Android devices By default, until you manually make changes in the admin center, your Android Enterprise work profile device settings and Android device administrator device settings are the same. If you block Android Enterprise work profile enrollment on personal devices, only corporate-owned devices can enroll with personally owned work profiles.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Intune admin center https://intune.microsoft.com/ 2. Select Devices and then under Device onboarding click Enrollment 3. Under Enrollment options select Device platform restriction. 4. Inspect the policies listed under Device type restrictions o For the Default priority policy, click All Users. o Select Properties. 5. Click Edit to change Platform settings. 6. In the Personally owned column set each platform to Block. Note: Blocking platforms that are not used in the organization is a more restrictive best practice and will also effectively block enrollment of personally owned devices for the selected platform, ensuring compliance for this recommendation.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Intune admin center https://intune.microsoft.com/ 2. Select Devices and then under Device onboarding click Enrollment 3. Under Enrollment options select Device platform restriction. 4. Inspect the policies listed under Device type restrictions o For the Default priority policy, click All Users. o Select Properties. 5. Verify that all platforms are set to Block in the Personally owned column. 6. If the Platform itself is set to Block for any of the platforms shown this is also a passing state for that platform. Note: Blocking platforms that are not used in the organization is a more restrictive best practice and will also effectively block enrollment of personally owned devices for the selected platform, ensuring compliance for this recommendation. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"DeviceManagementConfiguration.Read.All\" 2. Run the following script: $Uri = 'https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurat ions' $Config = (Invoke-MgGraphRequest -Uri $Uri -Method GET).value | Where-Object { $_.id -match 'DefaultPlatformRestrictions' -and $_.priority - eq 0 } $Result = [PSCustomObject]@{ WindowsPersonalDeviceEnrollmentBlocked = $Config.windowsRestriction.personalDeviceEnrollmentBlocked iOSPersonalDeviceEnrollmentBlocked = $Config.iosRestriction.personalDeviceEnrollmentBlocked AndroidForWorkPersonalDeviceEnrollmentBlocked = $Config.androidForWorkRestriction.personalDeviceEnrollmentBlocked MacOPersonalDeviceEnrollmentBlocked = $Config.macOSRestriction.personalDeviceEnrollmentBlocked AndroidPersonalDeviceEnrollmentBlocked = $Config.androidRestriction.personalDeviceEnrollmentBlocked } $Result 3. Inspect the output, ensure each platform displays True next to its property. A passing output will look like the below: WindowsPersonalDeviceEnrollmentBlocked : True iOSPersonalDeviceEnrollmentBlocked : True AndroidForWorkPersonalDeviceEnrollmentBlocked : True MacOPersonalDeviceEnrollmentBlocked : True AndroidPersonalDeviceEnrollmentBlocked : True Note: If platformBlocked is true then that platform is also in compliance as the platform is blocked from enrollment entirely. This is not currently reflected in the audit script but can be queried from the same API call.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Allow",
+ "References": "https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set:https://www.glueckkanja.com/blog/security/2025/01/compliant-device-bypass-en/"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.1",
+ "Description": "Legacy per-user Multi-Factor Authentication (MFA) can be configured to require individual users to provide multiple authentication factors, such as passwords and additional verification codes, to access their accounts. It was introduced in earlier versions of Office 365, prior to the more comprehensive implementation of Conditional Access (CA).",
+ "Checks": [
+ "entra_users_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Legacy per-user Multi-Factor Authentication (MFA) can be configured to require individual users to provide multiple authentication factors, such as passwords and additional verification codes, to access their accounts. It was introduced in earlier versions of Office 365, prior to the more comprehensive implementation of Conditional Access (CA).",
+ "RationaleStatement": "Both security defaults and conditional access with security defaults turned off are not compatible with per-user multi-factor authentication (MFA), which can lead to undesirable user authentication states. The CIS Microsoft 365 Benchmark explicitly employs Conditional Access for MFA as an enhancement over security defaults and as a replacement for the outdated per-user MFA. To ensure a consistent authentication state disable per-user MFA on all accounts.",
+ "ImpactStatement": "Accounts using per-user MFA will need to be migrated to use CA. Prior to disabling per-user MFA the organization must be prepared to implement conditional access MFA to avoid security gaps and allow for a smooth transition. This will help ensure relevant accounts are covered by MFA during the change phase from disabling per-user MFA to enabling CA MFA. Section 5.2.2 in this document covers the creation of a CA rule for both administrators and all users in the tenant. Microsoft has documentation on migrating from per-user MFA Convert users from per- user MFA to Conditional Access based MFA",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select All users. 3. Click on Per-user MFA on the top row. 4. Click the empty box next to Display Name to select all accounts. 5. On the far right under quick steps click Disable.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select All users. 3. Click on Per-user MFA on the top row. 4. Verify that the Multi-factor Auth Status column shows Disabled for each account. To audit using Microsoft Graph 1. Determine the id or userPrincipalName of the user being audited. 2. Execute a GET request to the following relative URI: beta/users/{id | userPrincipalName}/authentication/requirements # Example https://graph.microsoft.com/beta/users/071cc716-8147-4397-a5ba- b2105951cc0b/authentication/requirements 3. Verify that the perUserMfaState property is set to disabled. 4. Repeat this process for all users within the tenant. Note: This API is in beta and does not support a list operation. To prevent server-side throttling, clients should implement batching and client-side rate limiting when auditing medium to large sized environments.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates#convert-users-from-per-user-mfa-to-conditional-access:https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#use-conditional-access-policies:https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates#convert-per-user-mfa-enabled-and-enforced-users-to-disabled:https://learn.microsoft.com/en-us/graph/api/authentication-get?view=graph-rest-beta"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.2",
+ "Description": "This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications.",
+ "Checks": [
+ "entra_thirdparty_integrated_apps_not_allowed"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications.",
+ "RationaleStatement": "Allowing standard users to create app registrations expands the tenant's attack surface. A compromised account or malicious insider could create a rogue app registration to establish a persistent OAuth client, facilitate token theft, or impersonate a legitimate application. Restricting app registration to privileged roles ensures that new application identities in the directory are subject to administrative review and approval before they can be granted permissions to organizational resources.",
+ "ImpactStatement": "End users will no longer be able to register applications independently, including both third-party integrations and custom applications. Developers and IT staff who create app registrations as part of normal workflows will be affected and will need to submit registration requests to a privileged administrator (e.g., Application Administrator or Cloud Application Administrator). Organizations should establish a formal request and approval process before implementing this change to avoid workflow disruption.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select Users settings. 3. Set Users can register applications to No. 4. Click Save. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run the following commands: $param = @{ AllowedToCreateApps = $false } Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select Users settings. 3. Verify that Users can register applications is set to No. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | fl AllowedToCreateApps 3. Verify the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Yes (Users can register applications.)",
+ "References": "https://learn.microsoft.com/en-us/entra/identity-platform/how-applications-are-added:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles#restrict-who-can-create-applications"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.3",
+ "Description": "Non-privileged users can create tenants in the Microsoft Entra ID and Microsoft Entra administration portal under \"Manage tenant\". The creation of a tenant is recorded in the Audit log as category \"DirectoryManagement\" and activity \"Create Company\". By default, the user who creates a Microsoft Entra tenant is automatically assigned the Global Administrator role. The newly created tenant doesn't inherit any settings or configurations.",
+ "Checks": [
+ "entra_policy_ensure_default_user_cannot_create_tenants"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Non-privileged users can create tenants in the Microsoft Entra ID and Microsoft Entra administration portal under \"Manage tenant\". The creation of a tenant is recorded in the Audit log as category \"DirectoryManagement\" and activity \"Create Company\". By default, the user who creates a Microsoft Entra tenant is automatically assigned the Global Administrator role. The newly created tenant doesn't inherit any settings or configurations.",
+ "RationaleStatement": "Restricting tenant creation prevents unauthorized or uncontrolled deployment of resources and ensures that the organization retains control over its infrastructure. User generation of shadow IT could lead to multiple, disjointed environments that can make it difficult for IT to manage and secure the organization's data, especially if other users in the organization began using these tenants for business purposes under the misunderstanding that they were secured by the organization's security team.",
+ "ImpactStatement": "Non-admin users will need to contact I.T. if they have a valid reason to create a tenant.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Users and select User settings. 3. Set Restrict non-admin users from creating tenants to Yes then Save. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run the following commands: # Create hashtable and update the auth policy $params = @{ AllowedToCreateTenants = $false } Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Users and select User settings. 3. Verify that Restrict non-admin users from creating tenants is set to Yes To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following commands: (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Select-Object AllowedToCreateTenants 3. Verify the returned value is False",
+ "AdditionalInformation": "",
+ "DefaultValue": "No - Non-administrators can create tenants. AllowedToCreateTenants is True",
+ "References": "https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#tenant-creator"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.4",
+ "Description": "This setting restricts non-administrators from loading a set of frequently visited pages in the Microsoft Entra admin center and Azure portal, including home, tenant overview, and the users list. What does it not do? - It does not block programmatic access to Microsoft Entra data via PowerShell, Microsoft Graph API, or other tools like Visual Studio. - It does not apply to users with an administrative role, including custom roles. - It does not prevent all access to the admin center. Many areas are still reachable through alternate paths.",
+ "Checks": [
+ "entra_admin_portals_access_restriction"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "This setting restricts non-administrators from loading a set of frequently visited pages in the Microsoft Entra admin center and Azure portal, including home, tenant overview, and the users list. What does it not do? - It does not block programmatic access to Microsoft Entra data via PowerShell, Microsoft Graph API, or other tools like Visual Studio. - It does not apply to users with an administrative role, including custom roles. - It does not prevent all access to the admin center. Many areas are still reachable through alternate paths.",
+ "RationaleStatement": "The Microsoft Entra admin center contains sensitive data and permission settings, which are still enforced based on the user's role. However, an end user may inadvertently change properties or account settings on their own account. This could result in increased administrative overhead. Additionally, a compromised end-user account could be used to enumerate tenant structure, users, and group memberships to support privilege escalation or lateral movement.",
+ "ImpactStatement": "Non-administrators who own groups will be unable to reach group management pages through the standard admin center navigation. Self-service access to other portal-facing features may also be affected depending on the navigation path used. Because the restriction targets specific frequently accessed pages rather than all portal content, users with direct (deep) links to other admin center sections may still be able to access them. Note: Users will still be able to sign into Microsoft Entra admin center but will be unable to see directory information.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Users and select User settings. 3. Set Restrict access to Microsoft Entra admin center to Yes then Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Users and select User settings. 3. Verify under the Administration center section that Restrict access to Microsoft Entra admin center is set to Yes.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No - Non-administrators can access the Microsoft Entra admin center.",
+ "References": "https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.5",
+ "Description": "The option for the user to Stay signed in, or the Keep me signed in option, will prompt a user after a successful login. When the user selects this option, a persistent refresh token is created. The refresh token lasts for 90 days by default and does not prompt for sign-in or multifactor.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "The option for the user to Stay signed in, or the Keep me signed in option, will prompt a user after a successful login. When the user selects this option, a persistent refresh token is created. The refresh token lasts for 90 days by default and does not prompt for sign-in or multifactor.",
+ "RationaleStatement": "Allowing users to select this option presents risk, especially if the user signs into their account on a publicly accessible computer/web browser. In this case it would be trivial for an unauthorized person to gain access to any associated cloud data from that account.",
+ "ImpactStatement": "Once this setting is hidden users will no longer be prompted upon sign-in with the message Stay signed in?. This may mean users will be forced to sign in more frequently. Important: some features of SharePoint Online and Office 2010 have a dependency on users remaining signed in. If you hide this option, users may get additional and unexpected sign in prompts.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Set Show keep user signed in to No. 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Verify that Show keep user signed in is highlighted No.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Users may select stay signed in",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime:https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-stay-signed-in-prompt"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.2.6",
+ "Description": "LinkedIn account connections allow users to connect their Microsoft work or school account with LinkedIn. After a user connects their accounts, information and highlights from LinkedIn are available in some Microsoft apps and services.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.2 Users",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "LinkedIn account connections allow users to connect their Microsoft work or school account with LinkedIn. After a user connects their accounts, information and highlights from LinkedIn are available in some Microsoft apps and services.",
+ "RationaleStatement": "Disabling LinkedIn integration prevents potential phishing attacks and risk scenarios where an external party could accidentally disclose sensitive information.",
+ "ImpactStatement": "Users will not be able to sync contacts or use LinkedIn integration.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Under LinkedIn account connections select No. 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Users and select User settings. 3. Under LinkedIn account connections, verify that No is selected.",
+ "AdditionalInformation": "",
+ "DefaultValue": "LinkedIn integration is enabled by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/linkedin-integration:https://learn.microsoft.com/en-us/entra/identity/users/linkedin-user-consent"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3.1",
+ "Description": "This setting allows users in the organization to create new security groups and add members to these groups in the Azure portal, API, or PowerShell. These new groups also show up in the Access Panel for all other users. If the policy setting on the group allows it, other users can create requests to join these groups. The recommended state is Users can create security groups in Azure portals, API or PowerShell set to No.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.3 Groups",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting allows users in the organization to create new security groups and add members to these groups in the Azure portal, API, or PowerShell. These new groups also show up in the Access Panel for all other users. If the policy setting on the group allows it, other users can create requests to join these groups. The recommended state is Users can create security groups in Azure portals, API or PowerShell set to No.",
+ "RationaleStatement": "Allowing end users to create security groups without oversight can lead to uncontrolled group sprawl, increasing the risk of inappropriate access to sensitive data. The default assignment of group ownership to the creator introduces a potential for privilege escalation, especially if IT teams overlook how these groups are later used to manage access. A more malicious scenario arises when a compromised non-privileged user creates deceptively named security groups such as \"Accounting\" or \"Break-glass\", or uses homograph techniques to mimic legitimate group names. Third-party IT teams may be particularly susceptible, as they might not be familiar with the environment or lack consistent naming conventions. An unsuspecting administrator could then mistakenly assign elevated privileges, grant access to sensitive data, or exclude these groups from Conditional Access policies, inadvertently creating a serious security gap.",
+ "ImpactStatement": "Restrictions may introduce some operational friction, particularly in fast-paced or decentralized environments where teams rely on self-service capabilities for collaboration and access management. This can increase reliance on IT teams for routine tasks, potentially causing delays. However, these impacts can be minimized through automated approval workflows and clear governance processes.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Set Users can create security groups in Azure portals, API or PowerShell to No. 4. Click Save. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run the following commands: $params = @{ defaultUserRolePermissions = @{ AllowedToCreateSecurityGroups = $false } } Update-MgPolicyAuthorizationPolicy -BodyParameter $params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Verify that Users can create security groups in Azure portals, API or PowerShell is set to No. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | fl 3. Verify that AllowedToCreateSecurityGroups is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AllowedToCreateSecurityGroups : True",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management?WT.mc_id=Portal-Microsoft_AAD_IAM#group-settings:https://learn.microsoft.com/en-us/graph/api/authorizationpolicy-get?view=graph-rest-1.0&tabs=http:https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management#making-a-group-available-for-end-user-self-service"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3.2",
+ "Description": "This setting restricts standard users from accessing the My Groups web interface in the My Account portal (https://myaccount.microsoft.com/groups). When set to Yes, this web interface access is removed for standard users. The recommended state is Yes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.3 Groups",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "This setting restricts standard users from accessing the My Groups web interface in the My Account portal (https://myaccount.microsoft.com/groups). When set to Yes, this web interface access is removed for standard users. The recommended state is Yes.",
+ "RationaleStatement": "By default, any authenticated user can access the My Groups portal and enumerate group memberships, SharePoint site URLs, group email addresses, Teams URLs, and Yammer URLs across the tenant. This information enables reconnaissance, where a user could identify high-value or privileged groups, map resource URLs, and use that data to plan further attacks or lateral movement. Restricting the web interface limits passive enumeration by users who do not require group browsing as part of their duties, reducing the available attack surface without impacting core productivity. Note: This setting applies only to the My Groups web interface. API-based enumeration remains possible for users with appropriate permissions or tooling, and this control should not be treated as a complete enumeration defense.",
+ "ImpactStatement": "Setting this to Yes creates administrative overhead for users who need to look up group memberships and must now request that information from an administrator.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Under Self Service Group Management, set Restrict user ability to access groups features in My Groups. Group and User Admin will have read-only access when the value of this setting is 'Yes' to Yes. 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Under Self Service Group Management, verify that Restrict user ability to access groups features in My Groups. Group and User Admin will have read-only access when the value of this setting is 'Yes' is set to Yes.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3.3",
+ "Description": "Microsoft Entra ID provides self-service group management features that enable users to create and manage their own security groups or Microsoft 365 groups. The owner of the group can approve or deny membership requests and delegate control of group membership. Self-service group management features aren't available for mail-enabled security groups or distribution lists. The recommended state is No.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.3 Groups",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Microsoft Entra ID provides self-service group management features that enable users to create and manage their own security groups or Microsoft 365 groups. The owner of the group can approve or deny membership requests and delegate control of group membership. Self-service group management features aren't available for mail-enabled security groups or distribution lists. The recommended state is No.",
+ "RationaleStatement": "Group owners are standard users who may not have visibility into access governance requirements for a given group. Allowing owners to approve membership requests through My Groups means additions to security groups or Microsoft 365 groups can occur without administrator review, bypassing formal access provisioning controls. Unauthorized or excessive group membership can expand a user's effective permissions and increase the blast radius of a compromised account.",
+ "ImpactStatement": "Administrators will be responsible for managing group membership requests instead of group owners, which is the default behavior. Administrative overhead will only increase if this setting was previously changed to Yes.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups select General. 3. Set Owners can manage group membership requests in My Groups to No. 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Verify that Owners can manage group membership requests in My Groups is set to No",
+ "AdditionalInformation": "",
+ "DefaultValue": "No",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/groups-self-service-management#making-a-group-available-for-end-user-self-service"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.3.4",
+ "Description": "All users within a Microsoft Entra organization are permitted to create new Microsoft 365 groups and add members to those groups through the Azure portal, API, or PowerShell. Newly created groups also appear in the Access Panel for all other users. When the applicable group policy settings allow it, users can submit requests to join these groups. The recommended state is No.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.3 Groups",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "All users within a Microsoft Entra organization are permitted to create new Microsoft 365 groups and add members to those groups through the Azure portal, API, or PowerShell. Newly created groups also appear in the Access Panel for all other users. When the applicable group policy settings allow it, users can submit requests to join these groups. The recommended state is No.",
+ "RationaleStatement": "Restricting Microsoft 365 group creation to administrators only ensures that creation of Microsoft 365 groups is controlled by the administrator. Appropriate groups should be created and managed by the administrator and group creation rights should not be delegated to any other user.",
+ "ImpactStatement": "Enabling this setting could create a number of requests that would need to be managed by an administrator.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Set Users can create Microsoft 365 groups in Azure portals, API or PowerShell to No 4. Click Save. To remediate using the Microsoft Graph API: 1. Execute a PATCH request to the following relative URI: v1.0/groupSettings 2. Target the object with the templateId of 62375ab9-6b52-47ed-826b- 58e47e0e304b 3. Update EnableGroupCreation to false. Note: If a group with the above templateId doesn't exist this means the defaults are present and it would be advisable to use the UI to remediate, as this will automatically create the Group.Unified object with its defaults. Microsoft's documentation does cover using a POST request to build this using the API, however.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Groups and select General. 3. Verify that Users can create Microsoft 365 groups in Azure portals, API or PowerShell is set to No To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/groupSettings 2. Filter to groups with the templateId of 62375ab9-6b52-47ed-826b- 58e47e0e304b 3. Verify that EnableGroupCreation is false. 4. If the group with the above templateId does not exist, then it means the setting is in its default state and is not compliant.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Yes",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups:https://learn.microsoft.com/en-us/graph/api/group-list-settings?view=graph-rest-0&tabs=http:https://learn.microsoft.com/en-us/graph/api/groupsetting-update?view=graph-rest-1.0&tabs=http"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.1",
+ "Description": "This setting enables you to select the users who can register their devices as Microsoft Entra joined devices. The recommended state is Selected or None. Note: This setting is applicable only to Microsoft Entra join on Windows 10 or newer. This setting doesn't apply to Microsoft Entra hybrid joined devices, Microsoft Entra joined VMs in Azure, or Microsoft Entra joined devices that use Windows Autopilot self- deployment mode because these methods work in a userless context.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting enables you to select the users who can register their devices as Microsoft Entra joined devices. The recommended state is Selected or None. Note: This setting is applicable only to Microsoft Entra join on Windows 10 or newer. This setting doesn't apply to Microsoft Entra hybrid joined devices, Microsoft Entra joined VMs in Azure, or Microsoft Entra joined devices that use Windows Autopilot self- deployment mode because these methods work in a userless context.",
+ "RationaleStatement": "If a threat actor compromises a standard user account, they can enroll a rogue device under that user's identity. This device may inherit MDM policies and appear compliant, giving attackers persistent access to cloud resources without triggering MFA. In a 2023 blog, Microsoft IR reports that it has detected threat actors registering their own devices to the Microsoft Entra tenant, giving them a platform to escalate the cyberattack. While simply joining a device to a Microsoft Entra tenant may present limited immediate risk, it could allow a threat actor to establish a foothold in the environment.",
+ "ImpactStatement": "Restricting the setting requires IT teams to assign enrollment permissions to specific staff, such as helpdesk or provisioning personnel, which may impact user-driven Autopilot scenarios and increase administrative overhead for device onboarding and support.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Users may join devices to Microsoft Entra to Selected (and add members) or None.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Users may join devices to Microsoft Entra is set to Selected or None. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: beta/policies/deviceRegistrationPolicy 3. Verify that azureADJoin.allowedToJoin.@odata.type is one of the following: o #microsoft.graph.enumeratedDeviceRegistrationMembership (Selected) o #microsoft.graph.noDeviceRegistrationMembership (None). Note: When set to Selected, users and groups will also appear in the output of the Graph Request.",
+ "AdditionalInformation": "",
+ "DefaultValue": "All",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://www.microsoft.com/en-us/security/blog/2023/12/05/microsoft-incident-response-lessons-on-preventing-cloud-identity-compromise/#poor-device:https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.2",
+ "Description": "This setting defines the maximum number of Microsoft Entra joined or registered devices that a user can have in Microsoft Entra ID. Once this limit is reached, no additional devices can be added until existing ones are removed. Values above 100 are automatically capped at 100. The recommended state is 10 or less.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting defines the maximum number of Microsoft Entra joined or registered devices that a user can have in Microsoft Entra ID. Once this limit is reached, no additional devices can be added until existing ones are removed. Values above 100 are automatically capped at 100. The recommended state is 10 or less.",
+ "RationaleStatement": "Microsoft incident response teams have observed threat actors enrolling their own devices to establish persistence after a non-privileged user has been compromised. High device quotas can exacerbate this risk by enabling attackers to register multiple devices that appear legitimate, while also contributing to unmanaged or personal devices cluttering the environment, driving up licensing costs and complicating compliance efforts. Enforcing a reasonable device limit per user supports good governance, reduces the attack surface, and encourages administrators to reassess and clean up legacy or unused device enrollments.",
+ "ImpactStatement": "IT staff who need to enroll more than 10 devices on behalf of the organization must be assigned the role of Device Enrollment Manager in the Intune admin center. Device Enrollment Managers are non-administrator accounts that can enroll and manage up to 1,000 devices. It is recommended to use dedicated service accounts for this role rather than assigning it to users' primary or daily-use accounts. Warning: Do not delete accounts assigned as a Device enrollment manager if any devices were enrolled using the account. Doing so will lead to issues with these devices.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Maximum number of devices per user to 10 or less.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Maximum number of devices per user is set to 10 or less. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/policies/deviceRegistrationPolicy 2. Verify that userDeviceQuota is 10 or less.",
+ "AdditionalInformation": "",
+ "DefaultValue": "50",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://learn.microsoft.com/en-us/intune/intune-service/enrollment/device-enrollment-manager-enroll:https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.3",
+ "Description": "This setting controls whether the Global Administrator role is automatically added to the local administrators group on a device during the Microsoft Entra join process. The recommended state is No.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting controls whether the Global Administrator role is automatically added to the local administrators group on a device during the Microsoft Entra join process. The recommended state is No.",
+ "RationaleStatement": "System administrators may be inclined to use over-privileged accounts for convenience when managing devices. Enforcing this control helps discourage that behavior by requiring administrative actions to be performed using accounts specifically designated for local administration. This promotes adherence to the principle of least privilege and reduces the risk associated with using high-level roles for routine tasks. For example, using a Global Administrator account to authenticate to a compromised endpoint and continue performing tasks significantly increases the risk of broader organizational compromise.",
+ "ImpactStatement": "Restricting the default behavior and requiring manual assignment to least privilege roles introduces minor administrative overhead. During the Microsoft Entra join process, the Microsoft Entra Joined Device Local Administrator role is automatically added to the device's local administrators group and should be used instead.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview) to No.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Global administrator role is added as local administrator on the device during Microsoft Entra join (Preview) is set to No. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: beta/policies/deviceRegistrationPolicy 2. Verify that azureADJoin.localAdmins.enableGlobalAdmins is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Yes",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta:https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.4",
+ "Description": "This setting determines if the Microsoft Entra user registering their device as Microsoft Entra join will be added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join. The recommended state is Selected or None.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting determines if the Microsoft Entra user registering their device as Microsoft Entra join will be added to the local administrators group. This setting applies only once during the actual registration of the device as Microsoft Entra join. The recommended state is Selected or None.",
+ "RationaleStatement": "To uphold the principle of least privilege, the assignment of local administrator rights during Microsoft Entra join should be centrally managed using appropriate built-in roles through Intune. This approach minimizes the number of disparate users with elevated privileges, reducing the attack surface and potential for misuse. Centralized management also streamlines the deprovisioning process, ensuring that administrative access can be revoked efficiently and consistently across all devices, rather than requiring manual intervention on each individual endpoint.",
+ "ImpactStatement": "Restricting the default behavior and requiring manual assignment to built-in roles introduces minor administrative overhead. During the Microsoft Entra join process, the Microsoft Entra Joined Device Local Administrator role is automatically added to the device's local administrators group and should be used instead.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Registering user is added as local administrator on the device during Microsoft Entra join (Preview) to Selected (and add members) or None.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Registering user is added as local administrator on the device during Microsoft Entra join (Preview) is set to Selected or None. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: beta/policies/deviceRegistrationPolicy 2. Verify that azureADJoin.localAdmins.registeringUsers.@odata.type is one of the following: o #microsoft.graph.enumeratedDeviceRegistrationMembership (Selected) o #microsoft.graph.noDeviceRegistrationMembership (None). Note: When set to Selected, users and groups will also appear in the output of the Graph Request.",
+ "AdditionalInformation": "",
+ "DefaultValue": "All",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta:https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.5",
+ "Description": "Local Administrator Password Solution (LAPS) is the management of local account passwords on Windows devices. LAPS provides a solution to securely manage and retrieve the built-in local admin password. With cloud version of LAPS, customers can enable storing and rotation of local admin passwords for both Microsoft Entra and Microsoft Entra hybrid join devices The recommended state is Yes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Local Administrator Password Solution (LAPS) is the management of local account passwords on Windows devices. LAPS provides a solution to securely manage and retrieve the built-in local admin password. With cloud version of LAPS, customers can enable storing and rotation of local admin passwords for both Microsoft Entra and Microsoft Entra hybrid join devices The recommended state is Yes.",
+ "RationaleStatement": "Managing local Administrator passwords across multiple systems can be challenging. As a result, many organizations opt to configure the same password on all workstations and/or member servers during deployment. However, this practice introduces a significant security risk: if an attacker compromises one system and obtains the local Administrator password, they can potentially gain administrative access to every other system using that same password. Additionally, enabling LAPS at the tenant level is a prerequisite for implementing LAPS- related recommendations outlined in the CIS Microsoft Intune for Windows Workstation Benchmarks. Note: Enabling LAPS at the tenant level does not automatically enforce password rotation for built-in Administrator accounts. To activate LAPS functionality, appropriate policies must be configured in Intune Settings Catalog or under the Endpoint security > Account protection blade. The CIS Microsoft 365 Foundations Benchmark focuses on hardening at the tenant level, while the CIS Intune Benchmarks focus on endpoint-specific configurations.",
+ "ImpactStatement": "Enabling LAPS requires some additional operational overhead. Although unlikely if a password is rotated and not retrieved or backed up before the device becomes unreachable (e.g., due to hardware failure, network isolation, or being decommissioned), administrators may be locked out.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Enable Microsoft Entra Local Administrator Password Solution (LAPS) to Yes.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Enable Microsoft Entra Local Administrator Password Solution (LAPS) is set to Yes. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/policies/deviceRegistrationPolicy 2. Verify that localAdminPassword.isEnabled is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://learn.microsoft.com/en-us/graph/api/resources/deviceregistrationpolicy?view=graph-rest-beta:https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.4.6",
+ "Description": "This setting determines if users can self-service recover their BitLocker key(s). 'Yes' restricts non-admin users from being able to see the BitLocker key(s) for their owned devices if there are any. 'No' allows all users to recover their BitLocker key(s). The recommended state is Yes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.4 Devices",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting determines if users can self-service recover their BitLocker key(s). 'Yes' restricts non-admin users from being able to see the BitLocker key(s) for their owned devices if there are any. 'No' allows all users to recover their BitLocker key(s). The recommended state is Yes.",
+ "RationaleStatement": "Restricting user access to the self-service BitLocker recovery key portal helps mitigate the risk of recovery key exposure in the event of a compromised user account. If an attacker gains access to both the user's credentials and the physical device, they could potentially retrieve the recovery key and decrypt sensitive data. The recovery key itself is also considered sensitive information.",
+ "ImpactStatement": "Restricting this setting will increase administrative overhead and may introduce friction between end users and the helpdesk, as users will no longer be able to retrieve BitLocker recovery keys through the self-service portal. This portal was originally designed to streamline recovery and reduce support burden. During the CrowdStrike Falcon Sensor outage in July 2024, many endpoints entered recovery mode, and delays in accessing recovery keys contributed to prolonged downtime. Limiting self-service access could exacerbate such delays in future incidents, especially in large or distributed environments.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Set Restrict users from recovering the BitLocker key(s) for their owned devices to Yes. To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run the following: $params = @{ defaultUserRolePermissions = @{ AllowedToReadBitlockerKeysForOwnedDevice = $false } } Update-MgPolicyAuthorizationPolicy -BodyParameter $params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Devices and select Device settings. 3. Verify that Restrict users from recovering the BitLocker key(s) for their owned devices is set to Yes. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following: (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | fl 3. Verify that AllowedToReadBitlockerKeysForOwnedDevice is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#configure-device-settings:https://learn.microsoft.com/en-us/graph/api/authorizationpolicy-get?view=graph-rest-1.0:https://techcommunity.microsoft.com/blog/intunecustomersuccess/user-self-service-bitlocker-recovery-key-access-with-intune-company-portal-websi/4150458:https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-process#self-recovery"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.1",
+ "Description": "Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.",
+ "Checks": [
+ "entra_policy_restricts_user_consent_for_apps"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.",
+ "RationaleStatement": "Attackers commonly use custom applications to trick users into granting them access to company data. Restricting user consent mitigates this risk and helps to reduce the threat-surface.",
+ "ImpactStatement": "If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator. Tenant-wide admin consent can be requested by users through an integrated administrator consent request workflow or through organizational support processes.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Consent and permissions > User consent settings. 4. Under User consent for applications select Do not allow user consent. 5. Click the Save option at the top of the window.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Consent and permissions > User consent settings. 4. Verify that User consent for applications is set to Do not allow user consent. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Select-Object -ExpandProperty PermissionGrantPoliciesAssigned 3. Verify that the returned array does not contain either ManagePermissionGrantsForSelf.microsoft-user-default-low or ManagePermissionGrantsForSelf.microsoft-user-default-legacy. If either of these strings is present, the audit fails.",
+ "AdditionalInformation": "",
+ "DefaultValue": "UI - Allow user consent for apps",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal:https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/get-mgpolicyauthorizationpolicy?view=graph-powershell-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.2",
+ "Description": "The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.",
+ "Checks": [
+ "entra_admin_consent_workflow_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.",
+ "RationaleStatement": "The admin consent workflow (Preview) gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer acts on the request, and the user is notified of the action.",
+ "ImpactStatement": "To approve requests, a reviewer must be a global administrator, cloud application administrator, or application administrator. The reviewer must already have one of these admin roles assigned; simply designating them as a reviewer doesn't elevate their privileges.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Consent and permissions. 4. Under Manage select Admin consent settings. 5. Set Users can request admin consent to apps they are unable to consent to to Yes under Admin consent requests. 6. Under the Reviewers choose the Roles and Groups that will review user generated app consent requests. 7. Set Selected users will receive email notifications for requests to Yes 8. Select Save at the top of the window.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Consent and permissions. 4. Under Manage select Admin consent settings. 5. Verify that Users can request admin consent to apps they are unable to consent to is set to Yes. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: Get-MgPolicyAdminConsentRequestPolicy | fl IsEnabled,NotifyReviewers,RemindersEnabled 3. Verify that IsEnabled is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Users can request admin consent to apps they are unable to consent to: No - Selected users to review admin consent requests: None - Selected users will receive email notifications for requests: Yes - Selected users will receive request expiration reminders: Yes - Consent request expires after (days): 30",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.3",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using either certificate credentials or password credentials (also referred to as client secrets). This setting enforces a tenant-wide restriction that prevents new password credentials from being added to any application registration or service principal. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not revoke or invalidate existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Block password addition set to On.",
+ "Checks": [
+ "entra_default_app_management_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using either certificate credentials or password credentials (also referred to as client secrets). This setting enforces a tenant-wide restriction that prevents new password credentials from being added to any application registration or service principal. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not revoke or invalidate existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Block password addition set to On.",
+ "RationaleStatement": "Password credentials (client secrets) used for application authentication are static string values that offer weaker security guarantees than certificate or federated credentials. Unlike certificates, client secrets carry no built-in proof of possession and are frequently stored in plaintext in source code, configuration files, CI/CD pipelines, and shell history. A leaked client secret grants any holder the ability to authenticate as the application to Microsoft Entra ID, potentially accessing any resource or permission scope assigned to that application. Blocking the addition of new password credentials eliminates this attack surface for applications created going forward and forces adoption of stronger credential types such as certificates.",
+ "ImpactStatement": "This policy applies to new password credential additions only. Existing client secrets remain valid until they expire or are explicitly revoked; this recommendation does not retroactively invalidate credentials created before the policy was enabled. Any automated process, pipeline, or script that programmatically adds client secrets to application registrations or service principals will be blocked once the policy is enabled, unless an exception is configured. Applications that have not yet migrated to certificate- based authentication or workload identity federation will require changes before new credentials can be added.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Block password addition. 5. Set Status to On. 6. Set Applies to to one of the following: o All applications o All applications with exclusions (if using exclusions, ensure they are reviewed annually). 7. Set Only apply to apps created after to a desired date or leave it unconfigured. 8. Select Save and close to apply the changes. To remediate using the Microsoft Graph API: Important: The PATCH request replaces the passwordCredentials array in full. Retrieve the current policy first and include all existing entries in the request body to avoid overwriting other configured restrictions or exclusions. 1. Execute a GET request to retrieve the current policy: v1.0/policies/defaultAppManagementPolicy 2. Modify the returned JSON to reflect the following changes: - Set isEnabled to true. - Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is passwordAddition and set the following: o state to enabled o restrictForAppsCreatedAfterDateTime to 0001-01-01T00:00:00Z or a desired date. - Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is passwordAddition and set the following: o state to enabled o restrictForAppsCreatedAfterDateTime to 0001-01-01T00:00:00Z or a desired date. 3. Execute a PATCH request to the same URI with the modified JSON in the request body to apply the changes. Note: The References section includes a link to the API documentation with full remediation examples in multiple languages including HTTP, PowerShell, and Python.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Block password addition. 5. Verify that Status is set to On. 6. Verify that Applies to is set to one of the following: o All applications o All applications with exclusions (if using exclusions, verify they are reviewed annually). 7. Verify that Only apply to apps created after is one of the following states: o Not configured (Field will show Select a date with no date selected) o A date that is on or before the date of the assessment. 8. Compliance is met when all of the above conditions are satisfied. To audit using the Microsoft Graph API: Note: Both the application restrictions and service principal restrictions must be audited to ensure password addition is properly blocked, as they can be independently configured in Graph or PowerShell. The UI only surfaces the combined state of both settings. 1. Execute a GET request to the following relative URI to get the default app management policy: v1.0/policies/defaultAppManagementPolicy 2. Verify that isEnabled is true, this indicates that the default app management policy is enabled and being applied to the tenant. Part 1: Audit application restrictions 1. Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is passwordAddition. 2. Verify the following conditions are met for applicationRestrictions.passwordCredentials: o state is enabled o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Part 2: Audit service principal restrictions 1. Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is passwordAddition. 2. Verify the following conditions are met for servicePrincipalRestrictions.passwordCredentials: o state is enabled o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Note: Presently the API does not surface application exclusions, only excluded callers, so it is not necessary to audit them for compliance.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal:https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph:https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0:https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.4",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). This setting enforces a tenant- wide maximum lifetime for new password credentials added to any application registration or service principal. When enabled, any client secret created must have an expiration date that falls within the configured maximum, which for this recommendation is 180 days or less. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not retroactively shorten or invalidate existing password credentials; secrets created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Restrict max password lifetime set to On: 180 days or less.",
+ "Checks": [
+ "entra_default_app_management_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). This setting enforces a tenant- wide maximum lifetime for new password credentials added to any application registration or service principal. When enabled, any client secret created must have an expiration date that falls within the configured maximum, which for this recommendation is 180 days or less. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not retroactively shorten or invalidate existing password credentials; secrets created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Restrict max password lifetime set to On: 180 days or less.",
+ "RationaleStatement": "Long-lived client secrets extend the window of exploitation if a credential is compromised. A secret valid for multiple years that is never rotated remains usable even if it was leaked in source code, a build log, or a security breach long after the initial exposure. Enforcing a maximum lifetime of 180 days ensures that client secrets expire on a regular basis, limiting the period during which a stolen credential remains valid and reducing the blast radius of a compromise. This control also encourages teams to establish automated rotation practices, which further reduces reliance on static, long- lived credentials.",
+ "ImpactStatement": "Any automated process, pipeline, or script that creates client secrets with a lifetime exceeding the configured maximum will fail once the policy is enabled, unless an exception is configured. Organizations will need to update secret creation workflows to specify expiration dates within the allowed range and establish rotation processes for secrets approaching expiry.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Restrict max password lifetime. 5. Set Status to On. 6. Set the maximum lifetime to 180 days or less. 7. Set Applies to to one of the following: o All applications o All applications with exclusions (if using exclusions, ensure they are reviewed annually). 8. Set Only apply to apps created after to a desired date or leave it unconfigured. 9. Select Save and close to apply the changes. To remediate using the Microsoft Graph API: Important: The PATCH request replaces the passwordCredentials array in full. Retrieve the current policy first and include all existing entries in the request body to avoid overwriting other configured restrictions or exclusions. 1. Execute a GET request to retrieve the current policy: v1.0/policies/defaultAppManagementPolicy 2. Modify the returned JSON to reflect the following changes: o Set isEnabled to true. o Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is passwordLifetime and set the following: - state to enabled - maxLifetime to P180D or a shorter duration. - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. o Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is passwordLifetime and set the following: - state to enabled - maxLifetime to P180D or a shorter duration. - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. 3. Execute a PATCH request to the same URI with the modified JSON in the request body to apply the changes. Note: The References section includes a link to the API documentation with full remediation examples in multiple languages including HTTP, PowerShell, and Python.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Restrict max password lifetime. 5. Verify that Status is set to On. 6. Verify that the configured maximum lifetime is 180 days or less. 7. Verify that Applies to is set to one of the following: o All applications o All applications with exclusions (if using exclusions, verify they are reviewed annually). 8. Verify that Only apply to apps created after is one of the following states: o Not configured (Field will show Select a date with no date selected) o A date that is on or before the date of the assessment. 9. Compliance is met when all of the above conditions are satisfied. To audit using the Microsoft Graph API: Note: Both the application restrictions and service principal restrictions must be audited to ensure the password lifetime is properly restricted, as they can be independently configured in Graph or PowerShell. The UI only surfaces the combined state of both settings. 1. Execute a GET request to the following relative URI to get the default app management policy: v1.0/policies/defaultAppManagementPolicy 2. Verify that isEnabled is true, this indicates that the default app management policy is enabled and being applied to the tenant. Part 1: Audit application restrictions 1. Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is passwordLifetime. 2. Verify the following conditions are met for applicationRestrictions.passwordCredentials: o state is enabled o maxLifetime is P180D or a shorter duration (e.g., P90D, P30D, etc.) o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Part 2: Audit service principal restrictions 1. Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is passwordLifetime. 2. Verify the following conditions are met for servicePrincipalRestrictions.passwordCredentials: o state is enabled o maxLifetime is P180D or a shorter duration (e.g., P90D, P30D, etc.) o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Note: Presently the API does not surface application exclusions, only excluded callers, so it is not necessary to audit them for compliance.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal:https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph:https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0:https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.5",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). By default, when adding a new password credential, the caller may supply a custom password value or allow the system to generate one. This setting enforces a tenant-wide restriction that blocks the use of custom password values, requiring all new password credentials to be system- generated. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not affect existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Block custom passwords set to On.",
+ "Checks": [
+ "entra_default_app_management_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). By default, when adding a new password credential, the caller may supply a custom password value or allow the system to generate one. This setting enforces a tenant-wide restriction that blocks the use of custom password values, requiring all new password credentials to be system- generated. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not affect existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Block custom passwords set to On.",
+ "RationaleStatement": "Custom password values are chosen by the caller and are susceptible to low entropy, predictable patterns, and reuse across multiple applications. A weak or reused client secret that is compromised through source code exposure, logging, or a supply-chain breach can be trivially exploited by an attacker to authenticate as the application. System-generated passwords use random values of sufficient length and complexity, making them resistant to brute-force and dictionary attacks. Blocking custom passwords removes the weakest credential creation path and ensures that all new client secrets meet a consistent entropy baseline.",
+ "ImpactStatement": "Any automated process, pipeline, or script that programmatically creates a client secret by supplying a custom password value will be blocked once the policy is enabled, unless an exception is configured. Most tooling, including the Microsoft Entra admin center, Azure CLI, and Azure PowerShell, already defaults to system-generated values, so the operational impact for typical workflows is minimal. Organizations that rely on custom password values in their automation will need to update those workflows to omit the custom value and accept the system-generated secret. Organizations that have policies or regulatory requirements that mandate specific password formats may need to maintain exclusions for certain applications. Exceptions should be scoped narrowly and reviewed regularly to minimize risk.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Block custom passwords. 5. Set Status to On. 6. Set Applies to to one of the following: o All applications o All applications with exclusions (if using exclusions, ensure they are reviewed annually). 7. Set Only apply to apps created after to a desired date or leave it unconfigured. 8. Select Save and close to apply the changes. To remediate using the Microsoft Graph API: Important: The PATCH request replaces the passwordCredentials array in full. Retrieve the current policy first and include all existing entries in the request body to avoid overwriting other configured restrictions or exclusions. 1. Execute a GET request to retrieve the current policy: v1.0/policies/defaultAppManagementPolicy 2. Modify the returned JSON to reflect the following changes: o Set isEnabled to true. o Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is customPasswordAddition and set the following: - state to enabled - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. o Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is customPasswordAddition and set the following: - state to enabled - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. 3. Execute a PATCH request to the same URI with the modified JSON in the request body to apply the changes. Note: The References section includes a link to the API documentation with full remediation examples in multiple languages including HTTP, PowerShell, and Python.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Block custom passwords. 5. Verify that Status is set to On. 6. Verify that Applies to is set to one of the following: o All applications o All applications with exclusions (if using exclusions, verify they are reviewed annually). 7. Verify that Only apply to apps created after is one of the following states: o Not configured (Field will show Select a date with no date selected) o A date that is on or before the date of the assessment. 8. Compliance is met when all of the above conditions are satisfied. To audit using the Microsoft Graph API: Note: Both the application restrictions and service principal restrictions must be audited to ensure custom password addition is properly blocked, as they can be independently configured in Graph or PowerShell. The UI only surfaces the combined state of both settings. 1. Execute a GET request to the following relative URI to get the default app management policy: v1.0/policies/defaultAppManagementPolicy 2. Verify that isEnabled is true, this indicates that the default app management policy is enabled and being applied to the tenant. Part 1: Audit application restrictions 1. Under applicationRestrictions.passwordCredentials, locate the entry where restrictionType is customPasswordAddition. 2. Verify the following conditions are met for applicationRestrictions.passwordCredentials: o state is enabled o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Part 2: Audit service principal restrictions 1. Under servicePrincipalRestrictions.passwordCredentials, locate the entry where restrictionType is customPasswordAddition. 2. Verify the following conditions are met for servicePrincipalRestrictions.passwordCredentials: o state is enabled o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Note: Presently the API does not surface application exclusions, only excluded callers, so it is not necessary to audit them for compliance.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal:https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph:https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0:https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.5.6",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using certificate credentials. This setting enforces a tenant-wide maximum lifetime for new certificate credentials added to any application registration or service principal. When enabled, any certificate uploaded must have a validity period that falls within the configured maximum, which for this recommendation is 180 days or less. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not retroactively shorten or invalidate existing certificate credentials; certificates uploaded before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Restrict maximum certificate lifetime set to On: 180 days or less.",
+ "Checks": [
+ "entra_default_app_management_policy_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.5 Enterprise apps",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In Microsoft Entra ID, applications and service principals can authenticate using certificate credentials. This setting enforces a tenant-wide maximum lifetime for new certificate credentials added to any application registration or service principal. When enabled, any certificate uploaded must have a validity period that falls within the configured maximum, which for this recommendation is 180 days or less. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured. The setting does not retroactively shorten or invalidate existing certificate credentials; certificates uploaded before the policy was enabled remain valid until they expire or are explicitly removed. The recommended state is Restrict maximum certificate lifetime set to On: 180 days or less.",
+ "RationaleStatement": "Long-lived certificates extend the window of exploitation if a credential is compromised. A certificate valid for multiple years that is never rotated remains usable even if the private key was exposed through a server breach, misconfigured storage, or supply- chain compromise long after the initial exposure. Enforcing a maximum lifetime of 180 days ensures that certificates expire on a regular basis, limiting the period during which a stolen credential remains valid and reducing the blast radius of a compromise. This control also encourages teams to establish automated certificate rotation practices, which further reduces reliance on static, long-lived credentials.",
+ "ImpactStatement": "Any automated process, pipeline, or script that uploads certificates with a validity period exceeding the configured maximum will be blocked once the policy is enabled, unless an exception is configured. Organizations will need to update certificate issuance workflows to generate certificates with expiration dates within the allowed range and establish rotation processes for certificates approaching expiry.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Restrict max certificate lifetime. 5. Set Status to On. 6. Set Applies to to one of the following: o All applications o All applications with exclusions (if using exclusions, ensure they are reviewed annually). 7. Set Only apply to apps created after to a desired date or leave it unconfigured. 8. Set Maximum lifetime (in days) to 180 days or less. 9. Select Save and close to apply the changes. To remediate using the Microsoft Graph API: 1. Execute a GET request to retrieve the current policy: v1.0/policies/defaultAppManagementPolicy 2. Modify the returned JSON to reflect the following changes: o Set isEnabled to true. o Under applicationRestrictions.keyCredentials, locate the entry where restrictionType is asymmetricKeyLifetime and set the following: - state to enabled - maxLifetime to P180D or a shorter duration. - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. o Under servicePrincipalRestrictions.keyCredentials, locate the entry where restrictionType is asymmetricKeyLifetime and set the following: - state to enabled - maxLifetime to P180D or a shorter duration. - restrictForAppsCreatedAfterDateTime to 0001-01- 01T00:00:00Z or a desired date. 3. Execute a PATCH request to the same URI with the modified JSON in the request body to apply the changes. Note: The References section includes a link to the API documentation with full remediation examples in multiple languages including HTTP, PowerShell, and Python.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID and select Enterprise apps. 3. Under Security select Application policies. 4. Select Restrict max certificate lifetime. 5. Verify that Status is set to On. 6. Verify that Applies to is set to one of the following: o All applications o All applications with exclusions (if using exclusions, verify they are reviewed annually). 7. Verify that Only apply to apps created after is one of the following states: o Not configured (Field will show Select a date with no date selected) o A date that is on or before the date of the assessment. 8. Verify that Maximum lifetime (in days) is 180 days or less. 9. Compliance is met when all of the above conditions are satisfied. To audit using the Microsoft Graph API: Note: Both the application restrictions and service principal restrictions must be audited to ensure the certificate lifetime is properly restricted, as they can be independently configured in Graph or PowerShell. The UI only surfaces the combined state of both settings. 1. Execute a GET request to the following relative URI to get the default app management policy: v1.0/policies/defaultAppManagementPolicy 2. Verify that isEnabled is true, this indicates that the default app management policy is enabled and being applied to the tenant. Part 1: Audit application restrictions 1. Under applicationRestrictions.keyCredentials, locate the entry where restrictionType is asymmetricKeyLifetime. 2. Verify the following conditions are met for applicationRestrictions.keyCredentials: o state is enabled o maxLifetime is P180D or a shorter duration (e.g., P90D, P30D, etc.) o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Part 2: Audit service principal restrictions 1. Under servicePrincipalRestrictions.keyCredentials, locate the entry where restrictionType is asymmetricKeyLifetime. 2. Verify the following conditions are met for servicePrincipalRestrictions.keyCredentials: o state is enabled o maxLifetime is P180D or a shorter duration (e.g., P90D, P30D, etc.) o restrictForAppsCreatedAfterDateTime is one of the following states: - 0001-01-01T00:00:00Z (not configured) - A date that is on or before the date of the assessment. 3. Compliance is met when all of the above conditions are satisfied. Note: Presently the API does not surface application exclusions, only excluded callers, so it is not necessary to audit them for compliance.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal:https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph:https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0:https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.6.1",
+ "Description": "B2B collaboration is a feature within Microsoft Entra External ID that allows for guest invitations to an organization. Ensure users can only send invitations to specified domains. Note: This list works independently from OneDrive for Business and SharePoint Online allow/block lists. To restrict individual file sharing in SharePoint Online, set up an allow or blocklist for OneDrive for Business and SharePoint Online. For instance, in SharePoint or OneDrive users can still share with external users from prohibited domains by using Anyone links if they haven't been disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.6 External Identities",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "B2B collaboration is a feature within Microsoft Entra External ID that allows for guest invitations to an organization. Ensure users can only send invitations to specified domains. Note: This list works independently from OneDrive for Business and SharePoint Online allow/block lists. To restrict individual file sharing in SharePoint Online, set up an allow or blocklist for OneDrive for Business and SharePoint Online. For instance, in SharePoint or OneDrive users can still share with external users from prohibited domains by using Anyone links if they haven't been disabled.",
+ "RationaleStatement": "By specifying allowed domains for collaborations, external user's companies are explicitly identified. Also, this prevents internal users from inviting unknown external users such as personal accounts and granting them access to resources.",
+ "ImpactStatement": "This could make collaboration more difficult if the setting is not quickly updated when a new domain is identified as \"allowed\".",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Collaboration restrictions, select Allow invitations only to the specified domains (most restrictive) is selected. Then specify the allowed domains under Target domains.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Collaboration restrictions, verify that Allow invitations only to the specified domains (most restrictive) is selected. Then verify allowed domains are specified under Target domains. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following: $Uri = \"https://graph.microsoft.com/beta/legacy/policies\" $Response = (Invoke-MgGraphRequest -Uri $Uri).value | Where-Object { $_.type -eq 'B2BManagementPolicy' } if ($Response) { $Definition = $Response.definition | ConvertFrom-Json $DomainsPolicy = $Definition.B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy } else { Write-Output \"No policy found.\" return } $DomainsPolicy 3. Verify that the output includes an AllowedDomains property that either contains no domains or lists only organizationally approved domains. If a BlockedDomains property is present, the configuration is considered non-compliant. Example of a compliant output with AllowedDomains defined: AllowedDomains -------------- {cisecurity.org, contoso.com, example.com} Allowed with no domains allowed (also compliant): AllowedDomains -------------- {}",
+ "AdditionalInformation": "",
+ "DefaultValue": "Allow invitations to be sent to any domain (most inclusive)",
+ "References": "https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list:https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.6.2",
+ "Description": "Microsoft Entra ID, part of Microsoft Entra, allows you to restrict what external guest users can see in their organization in Microsoft Entra ID. Guest users are set to a limited permission level by default in Microsoft Entra ID, while the default for member users is the full set of user permissions. These directory level permissions are enforced across Microsoft Entra services including Microsoft Graph, PowerShell v2, the Azure portal, and My Apps portal. Microsoft 365 services leveraging Microsoft 365 groups for collaboration scenarios are also affected, specifically Outlook, Microsoft Teams, and SharePoint. They do not override the SharePoint or Microsoft Teams guest settings. The recommended state is at least Guest users have limited access to properties and memberships of directory objects or more restrictive.",
+ "Checks": [
+ "entra_policy_guest_users_access_restrictions"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.6 External Identities",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID, part of Microsoft Entra, allows you to restrict what external guest users can see in their organization in Microsoft Entra ID. Guest users are set to a limited permission level by default in Microsoft Entra ID, while the default for member users is the full set of user permissions. These directory level permissions are enforced across Microsoft Entra services including Microsoft Graph, PowerShell v2, the Azure portal, and My Apps portal. Microsoft 365 services leveraging Microsoft 365 groups for collaboration scenarios are also affected, specifically Outlook, Microsoft Teams, and SharePoint. They do not override the SharePoint or Microsoft Teams guest settings. The recommended state is at least Guest users have limited access to properties and memberships of directory objects or more restrictive.",
+ "RationaleStatement": "By limiting guest access to the most restrictive state this helps prevent malicious group and user object enumeration in the Microsoft 365 environment. This first step, known as reconnaissance in The Cyber Kill Chain, is often conducted by attackers prior to more advanced targeted attacks.",
+ "ImpactStatement": "The default is Guest users have limited access to properties and memberships of directory objects. When using the 'most restrictive' setting, guests will only be able to access their own profiles and will not be allowed to see other users' profiles, groups, or group memberships. There are some known issues with Yammer that will prevent guests that are signed in from leaving the group.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Guest user access set Guest user access restrictions to one of the following: o Guest users have limited access to properties and memberships of directory objects o Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run the following command to set the guest user access restrictions to default: # Guest users have limited access to properties and memberships of directory objects Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '10dae51f-b6af-4016-8d66- 8c2a99b929b3' 3. Or, run the following command to set it to the \"most restrictive\": # Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc- daa82404023b' Note: Either setting allows for a passing state.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Guest user access verify that Guest user access restrictions is set to one of the following: o Guest users have limited access to properties and memberships of directory objects o Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: Get-MgPolicyAuthorizationPolicy | fl GuestUserRoleId 3. Verify that the value returned is 10dae51f-b6af-4016-8d66-8c2a99b929b3 or 2af84b1e-32c8-42b7-82bc-daa82404023b (most restrictive) Note: Either setting allows for a passing state. Note 2: The value of a0b1b346-4d3e-4e8b-98f8-753987be4970 is equal to Guest users have the same access as members (most inclusive) and should not be used.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- UI: Guest users have limited access to properties and memberships of directory objects - PowerShell: 10dae51f-b6af-4016-8d66-8c2a99b929b3",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions:https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.6.3",
+ "Description": "By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles. The recommended state is Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).",
+ "Checks": [
+ "entra_policy_guest_invite_only_for_admin_roles"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.6 External Identities",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles. The recommended state is Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).",
+ "RationaleStatement": "Restricting who can invite guests limits the exposure the organization might face from unauthorized accounts. The default behavior allows anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.",
+ "ImpactStatement": "This introduces an obstacle to collaboration by restricting who can invite guest users to the organization. Designated Guest Inviters must be assigned, and an approval process established and clearly communicated to all users.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Guest invite settings set Guest invite restrictions to one of the desired compliant states: o Only users assigned to specific admin roles can invite guest users o No one in the organization can invite guest users including admins (most restrictive) To remediate using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.Authorization\" 2. Run one of the following PowerShell commands depending on the desired compliant state: To set to Only users assigned to specific admin roles can invite guest users: Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters' To set to No one in the organization can invite guest users including admins (most restrictive): Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom \"none\"",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > External Identities and select External collaboration settings. 3. Under Guest invite settings verify that Guest invite restrictions is set to one of the following: o Only users assigned to specific admin roles can invite guest users o No one in the organization can invite guest users including admins (most restrictive) To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following command: Get-MgPolicyAuthorizationPolicy | fl AllowInvitesFrom 3. Verify the value returned is adminsAndGuestInviters or none.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- UI: Anyone in the organization can invite guest users including guests and non-admins (most inclusive) - PowerShell: everyone",
+ "References": "https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#guest-inviter"
+ }
+ ]
+ },
+ {
+ "Id": "5.1.8.1",
+ "Description": "Password Hash Synchronization is one of the sign-in methods used to enable hybrid identity authentication. With this method, Microsoft Entra Connect synchronizes a cryptographically derived representation of a user's on-premises Active Directory password to Microsoft Entra ID. The original NT password hash (MD4) is never transmitted to Entra ID. Instead, Entra Connect computes a SHA-256 hash of the original MD4 hash and synchronizes that value. Because only this secondary hash is stored in the cloud, the credential material in Entra ID cannot be reused for on-premises pass-the-hash attacks, even if compromised. Note: The audit and remediation procedures described in this recommendation are applicable only to Microsoft 365 tenants operating in a hybrid identity configuration using Microsoft Entra Connect. They do not apply to federated or cloud-only deployments.",
+ "Checks": [
+ "entra_password_hash_sync_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.1.8 Hybrid management",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Password Hash Synchronization is one of the sign-in methods used to enable hybrid identity authentication. With this method, Microsoft Entra Connect synchronizes a cryptographically derived representation of a user's on-premises Active Directory password to Microsoft Entra ID. The original NT password hash (MD4) is never transmitted to Entra ID. Instead, Entra Connect computes a SHA-256 hash of the original MD4 hash and synchronizes that value. Because only this secondary hash is stored in the cloud, the credential material in Entra ID cannot be reused for on-premises pass-the-hash attacks, even if compromised. Note: The audit and remediation procedures described in this recommendation are applicable only to Microsoft 365 tenants operating in a hybrid identity configuration using Microsoft Entra Connect. They do not apply to federated or cloud-only deployments.",
+ "RationaleStatement": "Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one and enables leaked credential detection for your hybrid accounts. Leaked credential protection is leveraged through Entra ID Protection and is a subset of that feature which can help identify if an organization's user account passwords have appeared on the dark web or public spaces. Using other options for your directory synchronization may be less resilient as Microsoft can still process sign-ins to 365 with Hash Sync even if a network connection to your on-premises environment is not available. This minimizes downtime and ensures business continuity.",
+ "ImpactStatement": "Compliance or regulatory restrictions may exist, depending on the organization's business sector, that preclude hashed versions of passwords from being securely transmitted to cloud data centers.",
+ "RemediationProcedure": "To remediate using the on-prem Microsoft Entra Connect tool: 1. Log in to the on premises server that hosts the Microsoft Entra Connect tool 2. Double-click the Azure AD Connect icon that was created on the desktop 3. Click Configure. 4. On the Additional tasks page, select Customize synchronization options and click Next. 5. Enter the username and password for your global administrator. 6. On the Connect your directories screen, click Next. 7. On the Domain and OU filtering screen, click Next. 8. On the Optional features screen, check Password hash synchronization and click Next. 9. On the Ready to configure screen click Configure. 10. Once the configuration completes, click Exit.",
+ "AuditProcedure": "To audit using the UI: Only Global Admin and Hybrid Identity Administrator roles have access to view the actual Password Hash Sync status message. Inadequate role access will result in a default message stating: \"Unable to retrieve your tenant's password hash sync information.\" 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Entra Connect. 3. Select Connect Sync. 4. Under Microsoft Entra Connect sync, verify the Password Hash Sync status message indicates that synchronization is occurring and no errors are present, with one of the following messages: o Password hash synchronization is enabled o Password hash synchronization cloud configuration is enabled o Password hash synchronization heartbeat detected To audit using the Microsoft Graph API: Permission required: OnPremDirectorySynchronization.Read.All 1. Execute a GET request to the following relative URI: v1.0/directory/onPremisesSynchronization 2. Verify that features.passwordSyncEnabled is true. To audit for the on-prem tool: 1. Log in to the server that hosts the Microsoft Entra Connect tool. 2. Run Azure AD Connect, and then click Configure and View or export current configuration. 3. Verify that PASSWORD HASH SYNCHRONIZATION is enabled on your tenant. To audit using PowerShell: 1. Open PowerShell on the on-premises server running Microsoft Entra Connect. 2. Run the following cmdlet: Get-ADSyncAADCompanyFeature 3. Verify that PasswordHashSync is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Microsoft Entra Connect sync disabled by default - Password Hash Sync is Microsoft's recommended setting for new deployments",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-phs:https://www.microsoft.com/en-us/download/details.aspx?id=47594:https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-staging-server:https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization:https://learn.microsoft.com/en-us/graph/api/resources/onpremisesdirectorysynchronizationfeature?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.1",
+ "Description": "Multifactor authentication is a process that requires an additional form of identification during the sign-in process, such as a code from a mobile device or a fingerprint scan, to enhance security. Ensure users in administrator roles have MFA capabilities enabled.",
+ "Checks": [
+ "entra_admin_users_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Multifactor authentication is a process that requires an additional form of identification during the sign-in process, such as a code from a mobile device or a fingerprint scan, to enhance security. Ensure users in administrator roles have MFA capabilities enabled.",
+ "RationaleStatement": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk. Note: To ensure that accounts cannot be easily used to enumerate resources (reconnaissance) through Microsoft Admin Portals or through Microsoft Azure Service Management API, both MFA conditional access policies must target All Resources: - \"Ensure multifactor authentication is enabled for all users\" and - \"Ensure multifactor authentication is enabled for all users in administrative roles\" (this recommendation)",
+ "ImpactStatement": "Implementation of multifactor authentication for all users in administrative roles will necessitate a change to user routine. All users in administrative roles will be required to enroll in multifactor authentication using phone, SMS, or an authentication application. After enrollment, use of multifactor authentication will be required for future access to the environment.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Click New policy. o Under Users or agents (Preview) include Select users and groups and check Directory roles. o At a minimum, include the directory roles listed below in this section of the document. o Under Target resources include All resources (formerly 'All cloud apps') and do not create any exclusions. - Under Exclude exclude any break-glass accounts. o Under Grant select Grant Access and check either Require multifactor authentication or Require authentication strength. o Click Select at the bottom of the pane. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On. At minimum these directory roles should be included for MFA: - Application administrator - Authentication administrator - Billing administrator - Cloud application administrator - Conditional Access administrator - Exchange administrator - Global administrator - Global reader - Helpdesk administrator - Password administrator - Privileged authentication administrator - Privileged role administrator - Security administrator - SharePoint administrator - User administrator",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify Directory roles specific to administrators are included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected with no exclusions. o Under Grant verify Grant Access is on and either Require multifactor authentication or Require authentication strength is checked. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. For each policy returned, verify the following criteria: o Conditions.Users.IncludeRoles contains the directory roles specific to administrators* o Conditions.Applications.IncludeApplications is All o GrantControls.BuiltInControls contains mfa OR GrantControls.AuthenticationStrength.id is defined o State is enabled 3. Compliance is met when at least one policy is found to meet all the criteria listed above. 4. Verify that any exclusions are documented and reviewed annually. Note: The Authentication Strength requirement is satisfied when any valid GUID is present in the authenticationStrength property of a matching policy. Because Authentication Strength configurations are inherently stronger than the built-in Require multifactor authentication control, the presence of a valid Authentication Strength also fulfills the MFA requirement for all users. Note: A list of Directory roles can be found in the Remediation section.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa:https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-list-policies?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.2",
+ "Description": "Enable multifactor authentication for all users in the Microsoft 365 tenant. Users will be prompted to authenticate with a second factor upon logging in to Microsoft 365 services. The second factor is most commonly a text message to a registered mobile phone number where they type in an authorization code, or with a mobile application like Microsoft Authenticator. Note: Since 2024, Microsoft has been rolling out mandatory multifactor authentication.",
+ "Checks": [
+ "entra_users_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Enable multifactor authentication for all users in the Microsoft 365 tenant. Users will be prompted to authenticate with a second factor upon logging in to Microsoft 365 services. The second factor is most commonly a text message to a registered mobile phone number where they type in an authorization code, or with a mobile application like Microsoft Authenticator. Note: Since 2024, Microsoft has been rolling out mandatory multifactor authentication.",
+ "RationaleStatement": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk. Note: To ensure that accounts cannot be easily used to enumerate resources (reconnaissance) through Microsoft Admin Portals or through Microsoft Azure Service Management API, both MFA conditional access policies must target All Resources: - \"Ensure multifactor authentication is enabled for all users in administrative roles\" and - \"Ensure multifactor authentication is enabled for all users\" (this recommendation)",
+ "ImpactStatement": "Implementation of multifactor authentication for all users will necessitate a change to user routine. All users will be required to enroll in multifactor authentication using phone, SMS, or an authentication application. After enrollment, use of multifactor authentication will be required for future authentication to the environment. External identities that attempt to access documents that utilize Purview Information Protection (Sensitivity Labels) will find their access disrupted. In order to mitigate this create an exclusion for Microsoft Rights Management Services ID: 00000012- 0000-0000-c000-000000000000 Note: Organizations that struggle to enforce MFA globally due to budget constraints preventing the provision of company-owned mobile devices to every user, or due to regulations, unions, or policies that prevent forcing end users to use their personal devices, have another option. FIDO2 security keys can be used as an alternative. They are more secure, phishing-resistant, and affordable for organizations to issue to every end user.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Click New policy. o Under Users or agents (Preview) include All users. o Under Target resources include All resources (formerly 'All cloud apps') and do not create any exclusions. - Under Exclude exclude any break-glass accounts. o Under Grant select Grant Access and check either Require multifactor authentication or Require authentication strength. o Click Select at the bottom of the pane. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected with no exclusions. o Under Grant verify Grant Access and either Require multifactor authentication or Require authentication strength is checked. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o GrantControls.BuiltInControls contains mfa OR GrantControls.AuthenticationStrength.id is defined o State is enabled 3. Compliance is met when at least one policy is found to meet all the criteria listed above. 4. Verify that any exclusions are documented and reviewed annually. Note: The Authentication Strength requirement is satisfied when any valid GUID is present in the authenticationStrength property of a matching policy. Because Authentication Strength configurations are inherently stronger than the built-in Require multifactor authentication control, the presence of a valid Authentication Strength also fulfills the MFA requirement for all users.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. It may be present as a Microsoft-managed policy or created from a Conditional Access template.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa:https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-list-policies?view=graph-rest-1.0:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.3",
+ "Description": "Entra ID supports the most widely used authentication and authorization protocols including legacy authentication. This authentication pattern includes basic authentication, a widely used industry-standard method for collecting username and password information. The following messaging protocols support legacy authentication: - Authenticated SMTP - Used to send authenticated email messages. - Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online. - Exchange ActiveSync (EAS) - Used to connect to mailboxes in Exchange Online. - Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see Connect to Exchange Online PowerShell using multifactor authentication. - Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps. - IMAP4 - Used by IMAP email clients. - MAPI over HTTP (MAPI/HTTP) - Primary mailbox access protocol used by Outlook 2010 SP2 and later. - Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook. - Outlook Anywhere (RPC over HTTP) - Legacy mailbox access protocol supported by all current Outlook versions. - POP3 - Used by POP email clients. - Reporting Web Services - Used to retrieve report data in Exchange Online. - Universal Outlook - Used by the Mail and Calendar app for Windows 10. - Other clients - Other protocols identified as utilizing legacy authentication.",
+ "Checks": [
+ "entra_legacy_authentication_blocked"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Entra ID supports the most widely used authentication and authorization protocols including legacy authentication. This authentication pattern includes basic authentication, a widely used industry-standard method for collecting username and password information. The following messaging protocols support legacy authentication: - Authenticated SMTP - Used to send authenticated email messages. - Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online. - Exchange ActiveSync (EAS) - Used to connect to mailboxes in Exchange Online. - Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see Connect to Exchange Online PowerShell using multifactor authentication. - Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps. - IMAP4 - Used by IMAP email clients. - MAPI over HTTP (MAPI/HTTP) - Primary mailbox access protocol used by Outlook 2010 SP2 and later. - Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook. - Outlook Anywhere (RPC over HTTP) - Legacy mailbox access protocol supported by all current Outlook versions. - POP3 - Used by POP email clients. - Reporting Web Services - Used to retrieve report data in Exchange Online. - Universal Outlook - Used by the Mail and Calendar app for Windows 10. - Other clients - Other protocols identified as utilizing legacy authentication.",
+ "RationaleStatement": "Legacy authentication protocols do not support multi-factor authentication. These protocols are often used by attackers because of this deficiency. Blocking legacy authentication makes it harder for attackers to gain access. Note: Basic authentication is now disabled in all tenants. Before December 31 2022, you could re-enable the affected protocols if users and apps in your tenant couldn't connect. Now no one (you or Microsoft support) can re-enable Basic authentication in your tenant.",
+ "ImpactStatement": "Enabling this setting will block legacy authentication, preventing access from older versions of Microsoft Office, Exchange ActiveSync, and protocols such as IMAP, POP, and SMTP. As a result, some users may need to upgrade to newer Office versions or use email clients that support modern authentication. This change may also affect multifunction devices (MFPs), such as printers using legacy authentication for scan-to-email. Microsoft provides mail flow best practices (linked below) to configure MFPs without relying on legacy authentication. https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a- multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Conditions select Client apps and check the boxes for Exchange ActiveSync clients and Other clients. o Under Grant select Block Access. o Click Select. 4. Set the policy On and click Create.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected. o Verify that only documented resource exclusions exist and that they are reviewed annually. o Under Conditions select Client apps then verify Exchange ActiveSync clients and Other clients is checked. o Under Grant verify Block access is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.ClientAppTypes contains exchangeActiveSync OR other. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o Conditions.ClientAppTypes contains exchangeActiveSync o Conditions.ClientAppTypes contains other o GrantControls.BuiltInControls is block o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Basic authentication is disabled by default as of January 2023.",
+ "References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online:https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365:https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.4",
+ "Description": "In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include: - Resource access from an unmanaged or shared device - Access to sensitive information from an external network - High-privileged users - Business-critical applications Note: This CA policy can be added to the previous CA policy in this benchmark \"Ensure multifactor authentication is enabled for all users in administrative roles\"",
+ "Checks": [
+ "entra_admin_users_sign_in_frequency_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include: - Resource access from an unmanaged or shared device - Access to sensitive information from an external network - High-privileged users - Business-critical applications Note: This CA policy can be added to the previous CA policy in this benchmark \"Ensure multifactor authentication is enabled for all users in administrative roles\"",
+ "RationaleStatement": "Forcing a time out for MFA will help ensure that sessions are not kept alive for an indefinite period of time, ensuring that browser sessions are not persistent will help in prevention of drive-by attacks in web browsers, this also prevents creation and saving of session cookies leaving nothing for an attacker to take.",
+ "ImpactStatement": "Users with Administrative roles will be prompted at the frequency set for MFA.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Conditional Access and select Policies. 3. Click New policy. o Under Users or agents (Preview) include Select users and groups and check Directory roles. o At a minimum, include the directory roles listed below in this section of the document. o Under Target resources include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Grant select Grant Access and check Require multifactor authentication. o Under Session select Sign-in frequency select Periodic reauthentication and set it to 4 hours (or less). o Check Persistent browser session then select Never persistent in the drop-down menu. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On. At minimum these directory roles should be included in the policy: - Application administrator - Authentication administrator - Billing administrator - Cloud application administrator - Conditional Access administrator - Exchange administrator - Global administrator - Global reader - Helpdesk administrator - Password administrator - Privileged authentication administrator - Privileged role administrator - Security administrator - SharePoint administrator - User administrator",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify Directory roles specific to administrators are included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected. o Verify that only documented resource exclusions exist and that they are reviewed annually. o Under Session verify Sign-in frequency is checked and set to Periodic reauthentication. o Verify the timeframe is set to the time determined by the organization. o Verify that Periodic reauthentication does not exceed 4 hours (or less). o Verify that Persistent browser session is set to Never persistent. 4. Verify that Enable policy is set to On To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where SessionControls.PersistentBrowser.IsEnabled is true. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeRoles contains the directory roles specific to administrators* o Conditions.Applications.IncludeApplications is All o SessionControls.SignInFrequency.IsEnabled is true o SessionControls.SignInFrequency.FrequencyInterval is everyTime OR is timeBased AND does not exceed 4 hours. o SessionControls.PersistentBrowser.IsEnabled is true o SessionControls.PersistentBrowser.Mode is never o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually. Note: A list of directory roles applying to Administrators can be found in the remediation section.",
+ "AdditionalInformation": "",
+ "DefaultValue": "The default configuration for user sign-in frequency is a rolling window of 90 days.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.5",
+ "Description": "Authentication strength is a Conditional Access control that allows administrators to specify which combination of authentication methods can be used to access a resource. For example, they can make only phishing-resistant authentication methods available to access a sensitive resource. But to access a non-sensitive resource, they can allow less secure multifactor authentication (MFA) combinations, such as password + SMS. Microsoft has 3 built-in authentication strengths. MFA strength, Passwordless MFA strength, and Phishing-resistant MFA strength. Ensure administrator roles are using a CA policy with Phishing-resistant MFA strength. Administrators can then enroll using one of 3 methods: - FIDO2 Security Key - Windows Hello for Business - Certificate-based authentication (Multi-Factor) Note: Additional steps to configure methods such as FIDO2 keys are not covered here but can be found in related MS articles in the references section. The Conditional Access policy only ensures 1 of the 3 methods is used. Warning: Administrators should be pre-registered for a strong authentication mechanism before this Conditional Access Policy is enforced. Additionally, as stated elsewhere in the CIS Benchmark a break-glass administrator account should be excluded from this policy to ensure unfettered access in the case of an emergency.",
+ "Checks": [
+ "entra_admin_users_phishing_resistant_mfa_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Authentication strength is a Conditional Access control that allows administrators to specify which combination of authentication methods can be used to access a resource. For example, they can make only phishing-resistant authentication methods available to access a sensitive resource. But to access a non-sensitive resource, they can allow less secure multifactor authentication (MFA) combinations, such as password + SMS. Microsoft has 3 built-in authentication strengths. MFA strength, Passwordless MFA strength, and Phishing-resistant MFA strength. Ensure administrator roles are using a CA policy with Phishing-resistant MFA strength. Administrators can then enroll using one of 3 methods: - FIDO2 Security Key - Windows Hello for Business - Certificate-based authentication (Multi-Factor) Note: Additional steps to configure methods such as FIDO2 keys are not covered here but can be found in related MS articles in the references section. The Conditional Access policy only ensures 1 of the 3 methods is used. Warning: Administrators should be pre-registered for a strong authentication mechanism before this Conditional Access Policy is enforced. Additionally, as stated elsewhere in the CIS Benchmark a break-glass administrator account should be excluded from this policy to ensure unfettered access in the case of an emergency.",
+ "RationaleStatement": "Sophisticated attacks targeting MFA are more prevalent as the use of it becomes more widespread. These 3 methods are considered phishing-resistant as they remove passwords from the login workflow. It also ensures that public/private key exchange can only happen between the devices and a registered provider which prevents login to fake or phishing websites.",
+ "ImpactStatement": "If administrators aren't pre-registered for a strong authentication method prior to a conditional access policy being created, then a condition could occur where a user can't register for strong authentication because they don't meet the conditional access policy requirements and therefore are prevented from signing in. Additionally, Internet Explorer based credential prompts in PowerShell do not support prompting for a security key. Implementing phishing-resistant MFA with a security key may prevent admins from running their existing sets of PowerShell scripts. Device Authorization Grant Flow can be used as a workaround in some instances.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Click New policy. o Under Users or agents (Preview) include Select users and groups and check Directory roles. o At a minimum, include the directory roles listed below in this section of the document. o Under Target resources include All resources (formerly 'All cloud apps') and do not create any exclusions other than break-glass accounts. o Under Grant select Grant Access and check Require authentication strength and set Phishing-resistant MFA in the dropdown box. o Click Select. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On. Warning: Ensure administrators are pre-registered with strong authentication before enforcing the policy. After which the policy must be set to On. At minimum these directory roles should be included for the policy: - Application administrator - Authentication administrator - Billing administrator - Cloud application administrator - Conditional Access administrator - Exchange administrator - Global administrator - Global reader - Helpdesk administrator - Password administrator - Privileged authentication administrator - Privileged role administrator - Security administrator - SharePoint administrator - User administrator",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify Directory roles specific to administrators are included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Directory Roles should include at minimum the roles listed in the remediation section. o Under Target resources verify All resources (formerly 'All cloud apps') is selected with no exclusions. o Under Grant verify Grant Access is selected and Require authentication strength is checked with Phishing-resistant MFA set as the value. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where GrantControls.AuthenticationStrength.Id contains any valid id. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeRoles contains the directory roles specific to administrators* o Conditions.Applications.IncludeApplications is All o GrantControls.AuthenticationStrength.AllowedCombinations only contains windowsHelloForBusiness OR fido2 OR x509CertificateMultiFactor o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. It can be created from a Conditional Access template.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless#fido2-security-keys:https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths:https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.6",
+ "Description": "Microsoft Entra ID Protection user risk policies detect the probability that a user account has been compromised. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "Checks": [
+ "entra_identity_protection_user_risk_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID Protection user risk policies detect the probability that a user account has been compromised. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "RationaleStatement": "With the user risk policy turned on, Entra ID protection detects the probability that a user account has been compromised. Administrators can configure a user risk conditional access policy to automatically respond to a specific user risk level.",
+ "ImpactStatement": "Upon policy activation, account access will be either blocked or the user will be required to use multi-factor authentication (MFA) and change their password. Users without registered MFA will be denied access, necessitating an admin to recover the account. To avoid inconvenience, it is advised to configure the MFA registration policy for all users under the User Risk policy. Additionally, users identified in the Risky Users section will be affected by this policy. To gain a better understanding of the impact on the organization's environment, the list of Risky Users should be reviewed before enforcing the policy.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) choose All users o Under Target resources choose All resources (formerly 'All cloud apps') - Under Exclude exclude any break-glass accounts. o Under Conditions choose User risk then Yes and select the user risk level High. o Under Grant select Grant access then check Require multifactor authentication or Require authentication strength. Finally check Require password change. o Under Session set Sign-in frequency to Every time. o Click Select. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected. o Under Conditions verify User risk is set to High. o Under Grant verify Grant access is selected and either Require multifactor authentication or Require authentication strength are checked. Then verify Require password change is checked. o Under Session ensure Sign-in frequency is set to Every time. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.UserRiskLevels contains any string. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o Conditions.UserRiskLevels contains high o GrantControls.BuiltInControls contains passwordChange o GrantControls.BuiltInControls contains mfa OR GrantControls.AuthenticationStrength.id is any id o SessionControls.SignInFrequency.IsEnabled is true o SessionControls.SignInFrequency.FrequencyInterval is everyTime o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually. Note: If the UserRiskLevels array includes medium or low, this still qualifies as compliant, as these enforcement levels are considered more strict. However, it must always include high; omitting this level would exclude users who are classified as high risk.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. It may be created from a Conditional Access template.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-risk-feedback:https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.7",
+ "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "Checks": [
+ "entra_identity_protection_sign_in_risk_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "RationaleStatement": "Turning on the sign-in risk policy ensures that suspicious sign-ins are challenged for multi-factor authentication.",
+ "ImpactStatement": "When the policy triggers, the user will need MFA to access the account. In the case of a user who hasn't registered MFA on their account, they would be blocked from accessing their account. It is therefore recommended that the MFA registration policy be configured for all users who are a part of the Sign-in Risk policy.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) choose All users. o Under Target resources choose All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Conditions choose Sign-in risk then Yes and check the risk level boxes High and Medium. o Under Grant click Grant access then select Require multifactor authentication. o Under Session select Sign-in Frequency and set to Every time. o Click Select. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected. o Under Conditions verify Sign-in risk is set to Yes ensuring High and Medium are selected. o Under Grant verify grant Grant access is selected and Require multifactor authentication checked. o Under Session verify Sign-in Frequency is set to Every time. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.SignInRiskLevels contains any string. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o Conditions.SignInRiskLevels contains high o Conditions.SignInRiskLevels contains medium o GrantControls.BuiltInControls contains mfa OR GrantControls.AuthenticationStrength.id is any id o SessionControls.SignInFrequency.IsEnabled is true o SessionControls.SignInFrequency.FrequencyInterval is everyTime o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually. Note: If the SignInRiskLevels array includes low, this still qualifies as compliant, as these enforcement levels are considered more strict. However, it must always include high and medium; omitting these levels would exclude users who are classified as such. Note 2: If GrantControls.BuiltInControls is block then the Grant and Session controls are considered satisfied, as this is considered a more strict enforcement of sign-in risk control.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. It may be created from a Conditional Access template.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-risk-feedback:https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.8",
+ "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
+ "RationaleStatement": "Sign-in risk is determined at the time of sign-in and includes criteria across both real- time and offline detections for risk. Blocking sign-in to accounts that have risk can prevent undesired access from potentially compromised devices or unauthorized users.",
+ "ImpactStatement": "Sign-in risk is heavily dependent on detecting risk based on atypical behaviors. Due to this it is important to run this policy in a report-only mode to better understand how the organization's environment and user activity may influence sign-in risk before turning the policy on. Once it's understood what actions may trigger a medium or high sign-in risk event I.T. can then work to create an environment to reduce false positives. For example, employees might be required to notify security personnel when they intend to travel with intent to access work resources.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources include All resources (formerly 'All cloud apps') and do not set any exclusions. - Under Exclude exclude any break-glass accounts. o Under Conditions choose Sign-in risk values of High and Medium and click Done. o Under Grant choose Block access and click Select. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected with no exclusions. o Under Conditions verify Sign-in risk values of High and Medium are selected. o Under Grant verify Block access is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.SignInRiskLevels contains any string. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o Conditions.Applications.ExcludeApplications is null or empty o Conditions.SignInRiskLevels contains high o Conditions.SignInRiskLevels contains medium o GrantControls.BuiltInControls is block o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually. Note: If the SignInRiskLevels array includes low, this still qualifies as compliant, as these enforcement levels are considered more strict. However, it must always include high and medium; omitting these levels would exclude users who are classified as such.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#risk-detections-mapped-to-riskeventtype"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.9",
+ "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or unmanaged, providing more granular control over authentication policies. When using Require device to be marked as compliant, the device must pass checks configured in compliance policies defined within Microsoft Intune. Before these checks can be applied, the device must first be enrolled in Intune MDM. By selecting Require Microsoft Entra hybrid joined device this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication. When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator. The recommended state for authentication is: - Require device to be marked as compliant - Require Microsoft Entra hybrid joined device (optional for hybrid environments) - Require one of the selected controls",
+ "Checks": [
+ "entra_managed_device_required_for_authentication"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or unmanaged, providing more granular control over authentication policies. When using Require device to be marked as compliant, the device must pass checks configured in compliance policies defined within Microsoft Intune. Before these checks can be applied, the device must first be enrolled in Intune MDM. By selecting Require Microsoft Entra hybrid joined device this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication. When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator. The recommended state for authentication is: - Require device to be marked as compliant - Require Microsoft Entra hybrid joined device (optional for hybrid environments) - Require one of the selected controls",
+ "RationaleStatement": "\"Managed\" devices are considered more secure because they often have additional configuration hardening enforced through centralized management such as Intune or Group Policy. These devices are also typically equipped with MDR/EDR, managed patching and alerting systems. As a result, they provide a safer environment for users to authenticate and operate from. This policy also ensures that attackers must first gain access to a compliant or trusted device before authentication is permitted, reducing the risk posed by compromised account credentials. When combined with other distinct Conditional Access (CA) policies, such as requiring multi-factor authentication, this adds one additional factor before authentication is permitted. Note: Avoid combining these two settings with other Grant settings in the same policy. In a single policy you can only choose between Require all the selected controls or Require one of the selected controls, which limits the ability to integrate this recommendation with others in this benchmark. CA policies function as an \"AND\" operator across multiple policies. The goal here is to both (Require MFA for all users) AND (Require device to be marked as compliant OR Require Microsoft Entra hybrid joined device).",
+ "ImpactStatement": "Unmanaged devices will not be permitted as a valid authenticator. As a result this may require the organization to mature their device enrollment and management. The following devices can be considered managed: - Entra hybrid joined from Active Directory - Entra joined and enrolled in Intune, with compliance policies - Entra registered and enrolled in Intune, with compliance policies If Guest or external users are collaborating with the organization, they must either be excluded or onboarded with a compliant device to authenticate. Failure to adequately survey the environment and test the Conditional Access (CA) policy in the Report-only state could result in access disruptions for these guest users.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Grant select Grant access. o Select the checkbox Require device to be marked as compliant. o Optionally, also select Require Microsoft Entra hybrid joined device if the organization uses hybrid joined devices. o Choose Require one of the selected controls. o Click Select at the bottom. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On. Note: Guest user accounts, if collaborating with the organization, should be considered when testing this policy.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify All resources (formerly 'All cloud apps') is selected. o Verify that only documented resource exclusions exist and that they are reviewed annually. o Under Grant verify that Require device to be marked as compliant is checked. o Under Grant verify that no other controls are checked except, optionally, Require Microsoft Entra hybrid joined device. o Verify Require one of the selected controls is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where GrantControls.BuiltInControls contains compliantDevice or domainJoinedDevice. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o GrantControls.BuiltInControls contains compliantDevice o GrantControls.BuiltInControls does not contain any values other than compliantDevice and domainJoinedDevice o GrantControls.Operator is OR o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant#require-device-to-be-marked-as-compliant:https://learn.microsoft.com/en-us/entra/identity/devices/concept-hybrid-join:https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.10",
+ "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively, this allows CA to classify devices as managed or unmanaged, providing more granular control over whether a user can register security information from a device. When using Require device to be marked as compliant, the device must pass checks configured in compliance policies defined within Microsoft Intune. Before these checks can be applied, the device must first be enrolled in Intune MDM. By selecting Require Microsoft Entra hybrid joined device this means the device must first be synchronized from an on-premises Active Directory to qualify. When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator. The recommended state for registering security information is: - Require device to be marked as compliant - Require Microsoft Entra hybrid joined device (optional for hybrid environments) - Require one of the selected controls",
+ "Checks": [
+ "entra_managed_device_required_for_mfa_registration"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively, this allows CA to classify devices as managed or unmanaged, providing more granular control over whether a user can register security information from a device. When using Require device to be marked as compliant, the device must pass checks configured in compliance policies defined within Microsoft Intune. Before these checks can be applied, the device must first be enrolled in Intune MDM. By selecting Require Microsoft Entra hybrid joined device this means the device must first be synchronized from an on-premises Active Directory to qualify. When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator. The recommended state for registering security information is: - Require device to be marked as compliant - Require Microsoft Entra hybrid joined device (optional for hybrid environments) - Require one of the selected controls",
+ "RationaleStatement": "Requiring registration on a managed device significantly reduces the risk of bad actors using stolen credentials to register security information. Accounts that are created but never registered with an MFA method are particularly vulnerable to this type of attack. Enforcing this requirement will both reduce the attack surface for fake registrations and ensure that legitimate users register using trusted devices which typically have additional security measures in place already.",
+ "ImpactStatement": "The organization will be required to have a mature device management process. New devices provided to users will need to be pre-enrolled in Intune, auto-enrolled, or be Entra hybrid joined. Otherwise, the user will be unable to complete registration, requiring additional resources from I.T. This could be more disruptive in remote worker environments where the MDM maturity is low. Users who do not yet have access to a managed device, such as new hires, users with lost or replaced devices, or users registering MFA methods on personal mobile devices - will be unable to satisfy the device compliance grant control. To address this, organizations should configure a Temporary Access Pass (TAP) policy and issue a one- time TAP to these users. A one-time TAP satisfies multifactor authentication requirements and allows the user to register security information from any device or location. B2B collaboration users (guest accounts) will also be blocked by this policy, as their devices are not managed in the resource tenant. Organizations should consider excluding All guest and external users from this policy. Alternatively, organizations that trust partner device compliance claims can configure this through cross-tenant access settings.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources select User actions and check Register security information. - Under Exclude exclude any break-glass accounts. o Under Grant select Grant access. o Select the checkbox Require device to be marked as compliant. o Optionally, also select Require Microsoft Entra hybrid joined device if the organization uses hybrid joined devices. o Choose Require one of the selected controls. o Click Select at the bottom. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify User actions is selected with Register security information checked. o Under Grant verify that Require device to be marked as compliant is checked. o Under Grant verify that no other controls are checked except, optionally, Require Microsoft Entra hybrid joined device. o Verify Require one of the selected controls is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.Applications.IncludeUserActions contains urn:user:registersecurityinfo. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeUserActions is urn:user:registersecurityinfo o GrantControls.BuiltInControls contains compliantDevice o GrantControls.BuiltInControls does not contain any values other than compliantDevice and domainJoinedDevice o GrantControls.Operator is OR o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant#require-device-to-be-marked-as-compliant:https://learn.microsoft.com/en-us/entra/identity/devices/concept-hybrid-join:https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment:https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#user-actions:https://docs.azure.cn/en-us/entra/identity/authentication/concept-authentication-strength-how-it-works#how-multiple-authentication-strength-policies-are-evaluated-for-registering-security-info"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.11",
+ "Description": "Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days. The recommended state is a Sign-in frequency of Every time for Microsoft Intune Enrollment Note: Microsoft accounts for a five-minute clock skew when 'every time' is selected in a conditional access policy, ensuring that users are not prompted more frequently than once every five minutes.",
+ "Checks": [
+ "entra_intune_enrollment_sign_in_frequency_every_time"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days. The recommended state is a Sign-in frequency of Every time for Microsoft Intune Enrollment Note: Microsoft accounts for a five-minute clock skew when 'every time' is selected in a conditional access policy, ensuring that users are not prompted more frequently than once every five minutes.",
+ "RationaleStatement": "Intune Enrollment is considered a sensitive action and should be safeguarded. An attack path exists that allows for a bypass of device compliance Conditional Access rule. This could allow compromised credentials to be used through a newly registered device enrolled in Intune, enabling persistence and privilege escalation. Setting sign-in frequency to every time limits the timespan an attacker could use fresh credentials to enroll a new device to Intune.",
+ "ImpactStatement": "New users enrolling into Intune through an automated process may need to sign-in again if the enrollment process goes on for too long.",
+ "RemediationProcedure": "Note: If the Microsoft Intune Enrollment cloud app isn't available then it must be created. To add the app for new tenants, a Microsoft Entra administrator must create a service principal object, with app ID d4ebce55-015a-49b5-a083-c84d1797ae8c, in PowerShell or Microsoft Graph. To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources select Resources (formerly cloud apps), choose Select resources and add Microsoft Intune Enrollment to the list. - Under Exclude exclude any break-glass accounts. o Under Grant select Grant access. o Check either Require multifactor authentication or Require authentication strength. o Under Session check Sign-in frequency and select Every time. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify Resources (formerly cloud apps) includes Microsoft Intune Enrollment. o Under Grant verify Require multifactor authentication or Require authentication strength is checked. o Under Session verify Sign-in frequency is set to Every time. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: Note: The Authentication Strength requirement is satisfied when any valid GUID is present in the authenticationStrength property of a matching policy. Because Authentication Strength configurations are inherently stronger than the built-in Require multifactor authentication control, the presence of a valid Authentication Strength also fulfills the MFA requirement for all users. 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.Applications.IncludeApplications contains d4ebce55-015a-49b5-a083-c84d1797ae8c. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications contains d4ebce55- 015a-49b5-a083-c84d1797ae8c o GrantControls.BuiltInControls contains mfa OR GrantControls.AuthenticationStrength.id is defined o SessionControls.SignInFrequency.IsEnabled is true o SessionControls.SignInFrequency.FrequencyInterval is everyTime o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. Sign-in frequency defaults to 90 days.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-session-lifetime#require-reauthentication-every-time:https://www.blackhat.com/eu-24/briefings/schedule/#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176:https://www.glueckkanja.com/blog/security/2025/01/compliant-device-bypass-en/"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.12",
+ "Description": "The Microsoft identity platform supports the device authorization grant, which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. To enable this flow, the device has the user visit a webpage in a browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed. The recommended state is to Block access for Device code flow in Conditional Access.",
+ "Checks": [
+ "entra_conditional_access_policy_device_code_flow_blocked"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The Microsoft identity platform supports the device authorization grant, which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. To enable this flow, the device has the user visit a webpage in a browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed. The recommended state is to Block access for Device code flow in Conditional Access.",
+ "RationaleStatement": "Since August 2024, Microsoft has observed threat actors, such as Storm-2372, employing \"device code phishing\" attacks. These attacks deceive users into logging into productivity applications, capturing authentication tokens to gain further access to compromised accounts. To mitigate this specific attack, block authentication code flows and permit only those from devices within trusted environments, identified by specific IP addresses.",
+ "ImpactStatement": "Some administrative overhead will be required for stricter management of these devices. Since exclusions do not violate compliance, this feature can still be utilized effectively within a controlled environment.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources > Resources (formerly cloud apps) include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Conditions > Authentication flows set Configure to Yes and check Device code flow. o Click Save. o Under Grant select Block access and click Select. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to `On",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify Resources (formerly cloud apps) includes All resources (formerly 'All cloud apps') o Under Conditions > Authentication flows verify Configure is set to Yes and Device code flow is checked. o Under Grant verify Block access is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where Conditions.AuthenticationFlows.TransferMethods contains deviceCodeFlow. 3. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o Conditions.AuthenticationFlows.TransferMethods contains deviceCodeFlow o GrantControls.BuiltInControls is block o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default. It may be present as a Microsoft-managed policy.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code:https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows:https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/:https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows#device-code-flow-policies"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.13",
+ "Description": "Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days. The recommended state for all users is to enforce periodic reauthentication for 7 days or less.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days. The recommended state for all users is to enforce periodic reauthentication for 7 days or less.",
+ "RationaleStatement": "A 7-day interval balances security and user experience by reducing the maximum lifespan of compromised credentials or stolen tokens without introducing excessive reauthentication prompts that can increase phishing susceptibility and user fatigue.",
+ "ImpactStatement": "Most users will not find weekly reauthentication requirements disruptive. Organizations with legacy applications, custom authentication workflows, or users relying on long-running sessions (such as shared or kiosk devices) may need to evaluate compatibility and apply appropriate exclusions to prevent user disruption.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources verify Resources (formerly cloud apps) include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Session select Sign-in frequency and set Periodic reauthentication to 7 days or less. 4. Under Enable policy set it to Report-only. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria and is set to On: o Under Users or agents (Preview) verify All users is included. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify Resources (formerly cloud apps) includes All resources (formerly 'All cloud apps') o Under Session ensure Sign-in frequency is checked, and Periodic reauthentication is set to 7 days or less. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where SessionControls.SignInFrequency.IsEnabled is true 3. Filter out policies where Conditions.signInRiskLevels and Conditions.userRiskLevels have values defined, excluding these from the assessment. 4. For each policy returned, verify the following criteria: o Conditions.Users.IncludeUsers is All o Conditions.Applications.IncludeApplications is All o SessionControls.SignInFrequency.frequencyInterval is timeBased o SessionControls.SignInFrequency.type is days* o SessionControls.SignInFrequency.value is 7 (or less)* o State is enabled 5. Compliance is met when at least one policy is found to meet all the criteria listed above. 6. Verify that any exclusions are documented and reviewed annually. Note: Any SignInFrequency type and value combination is considered compliant as long as the reauthentication interval is less than or equal to 7 days. For example, a policy applied to all users that requires reauthentication every 20 hours would still meet the requirement.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.14",
+ "Description": "Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization. The recommended state is to define at least one trusted, IP range named location.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization. The recommended state is to define at least one trusted, IP range named location.",
+ "RationaleStatement": "Defining trusted source IP addresses or ranges enables organizations to better tailor and enforce Conditional Access policies based on whether authentication attempts originate from trusted or untrusted network locations. Users signing in from trusted IP ranges can be granted reduced access requirements or fewer authentication prompts, while users coming from untrusted or unknown locations may face stricter controls. Additionally, marking named locations as trusted improves the accuracy of Microsoft Entra ID Protection's risk evaluations. When a user authenticates from a trusted location, their sign-in risk is appropriately lowered, helping reduce false positives and ensuring that risk-based policies trigger only when truly necessary.",
+ "ImpactStatement": "Configuring named locations by country cannot designate those locations as trusted, which means Conditional Access policies cannot use the \"All trusted locations\" option and must instead rely on explicitly selecting locations. This increases the administrative effort needed to configure and maintain these policies and requires more thorough testing to prevent unintended authentication blocks. Because Conditional Access policies can fully prevent users from signing in to Entra ID if misconfigured, organizations should maintain a dedicated break-glass Global Administrator account that is excluded from all Conditional Access policies and secured with a strong passphrase and hardware-based authentication. This account exists solely to recover access if all other administrators are locked out.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Under Manage, click Named locations. 4. Click on IP ranges location to add a new location. 5. Enter a name for this location setting in the Name field. 6. Click on the + icon. 7. Add only a trusted IP Address Range in CIDR notation inside the text box that appears. 8. Click on the Add button. 9. Repeat steps 6 through 8 for each additional IP range. 10. Select the Mark as trusted location checkbox. 11. Once finished, click on Create. Note: There is no single prescribed method for applying a named location to a Conditional Access policy, as the correct configuration depends on the specific access control requirements. Implementers should have a clear understanding of how named locations function before applying them to production policies.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Under Manage, click Named locations. 4. For each named location with a Location type of IP ranges, verify there is one with the following criteria: o Trusted is set to Yes. o At least one IP Range is defined 5. Compliance is met when at least one named location is found to meet all the criteria listed above. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/namedLocations?$filter=isof('microsoft.graph. ipNamedLocation') 2. For each named location returned, verify the following criteria: o isTrusted is true o ipRanges contains at least one ipv4 or ipv6 range 3. Compliance is met when at least one named location is found to meet all the criteria listed above.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Named locations are not configured by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network:https://learn.microsoft.com/en-us/entra/id-protection/concept-risk-detection-types#locations:https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.15",
+ "Description": "Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined. The recommended state is to configure at least one policy to block access from untrusted locations.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined. The recommended state is to configure at least one policy to block access from untrusted locations.",
+ "RationaleStatement": "Using Conditional Access as a deny list at the tenant or subscription level enables an organization to block inbound and outbound traffic from geographic locations that fall outside its operational scope (e.g., customers, suppliers) or legal jurisdiction. Restricting access to only required regions significantly reduces unnecessary exposure to international threat actors, including advanced persistent threats (APTs), and helps maintain a more controlled and defensible security posture. Note: Because the selection of allowed or blocked locations is unique to each organization, this control does not prescribe specific countries or regions. Each organization should determine its geographic access requirements based on operational needs, regulatory obligations, and risk tolerance.",
+ "ImpactStatement": "Limiting access geographically will deny access to users that are traveling or working remotely in a different part of the world. A point-to-site or site to site tunnel such as a VPN is recommended to address exceptions to geographic access policies. CAUTION: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users o Under Target resources include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Network set Configure to Yes: - Select Include, then add entries for untrusted locations that should be blocked - Select Exclude, then add entries for trusted locations that should be allowed 4. Under Access Controls, select Grant select Block Access. 5. Under Enable policy set it to Report-only. 6. Click Create. 7. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria: o Under Users or agents (Preview) verify All users is included o Verify that only documented user exclusions exist and that they are reviewed annually o Under Target resources verify All resources (formerly 'All cloud apps') is selected o Under Network verify Include> Selected networks and locations contains at least one untrusted location o Under Network verify Exclude contains trusted locations through either All trusted networks and locations or Selected networks and locations o Under Grant verify Block access is selected 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. For each policy returned, verify the following criteria: o conditions.users.includeUsers is All o conditions.applications.includeApplications is All o conditions.locations.includeLocations contains at least one GUID of at least one untrusted location. o conditions.locations.excludeLocations is AllTrusted OR contains at least one GUID of at least one trusted location. o grantControls.builtInControls is block o state is enabled 3. Compliance is met when at least one policy is found to meet all the criteria listed above. 4. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "These policies should be tested by using the What If tool in the References. Setting these can and will create issues with logging in for users until they use an MFA device linked to their accounts. Further testing can also be done via the insights and reporting resource in References which monitors Azure sign ins.",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-by-location:https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-report-only"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.16",
+ "Description": "Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like Primary Refresh Tokens (PRTs), are accepted by Microsoft Entra ID when applications request access to protected resources. When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications. The recommended state is to enforce Token Protection for Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like Primary Refresh Tokens (PRTs), are accepted by Microsoft Entra ID when applications request access to protected resources. When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications. The recommended state is to enforce Token Protection for Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services.",
+ "RationaleStatement": "When properly configured, Conditional Access can aid in preventing attacks involving token theft, via hijacking or replay, as part of the attack flow. Although currently considered a rare event, the impact from token impersonation can be severe.",
+ "ImpactStatement": "Token Protection currently supports native applications only. Browser-based applications are not supported. There are also many other known limitations documented in the link below: https://learn.microsoft.com/en-us/entra/identity/conditional-access/deployment-guide- token-protection-windows#known-limitations",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Select New policy. 4. Select Users or agents (Preview): 1. Under Include, select the users or groups to apply this policy. 2. Under Exclude exclude any break-glass accounts. 5. Select Target resources > Resources > Include > Select resources 1. Under Select specific resources, select the following applications: 1. Office 365 Exchange Online 2. Office 365 SharePoint Online 3. Microsoft Teams Services 2. Choose Select 6. Select Conditions: 1. Under Device platforms 1. Set Configure to Yes. 2. Include > Select device platforms > Windows. 3. Select Done. 2. Under Client apps: 1. Set Configure to Yes 2. Under Modern authentication clients, only select Mobile apps and desktop clients. 3. Select Done 7. Under Access controls > Session, select Require token protection for sign-in sessions (Generally available for Windows. Preview for MacOS, iOS) and click Select. 8. Under Enable policy set it to Report-only. 9. Click Create. 10. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access and select Policies. 3. Verify that a policy exists with the following criteria: o Under Users or agents (Preview) verify that None is not selected. o Verify that only documented exclusions exist and that they are reviewed annually o Under Target resources select Select resources and verify at minimum the following are checked: - Office 365 Exchange Online - Office 365 SharePoint Online - Microsoft Teams Services 4. Under Conditions > Device Platforms: verify that Configure is set to Yes and Include indicates Windows platforms. 5. Under Conditions > Client Apps: verify that Configure is set to Yes and only Mobile Apps and Desktop Clients is selected. 6. Under Access controls > Session, verify that Require token protection for sign-in sessions (Generally available for Windows. Preview for MacOS, iOS) is selected. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where sessionControls.secureSignInSession.isEnabled is true. 3. For each policy returned, verify the following criteria: o conditions.users.includeUsers is not None o conditions.applications.includeApplications contains at least the following GUIDs: - 00000002-0000-0ff1-ce00-000000000000 (Office 365 Exchange Online) - 00000003-0000-0ff1-ce00-000000000000 (Office 365 SharePoint Online) - cc15fd57-2c6c-4117-a88c-83b1d56b4bbe (Microsoft Teams Services) o conditions.platforms.includePlatforms contains windows o conditions.clientAppTypes is mobileAppsAndDesktopClients o sessionControls.secureSignInSession.isEnabled is true o State is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection:https://learn.microsoft.com/en-us/entra/identity/conditional-access/deployment-guide-token-protection-windows:https://learn.microsoft.com/en-us/entra/identity/devices/protecting-tokens-microsoft-entra-id"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.2.17",
+ "Description": "Authentication transfer is a flow that lets users seamlessly transfer authenticated state from one device to another. For example, users might see a QR code in the desktop version of Outlook that, when scanned on their mobile device, transfers their authenticated state to the mobile device. The recommended state is to block Authentication transfer.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.2 Conditional Access",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Authentication transfer is a flow that lets users seamlessly transfer authenticated state from one device to another. For example, users might see a QR code in the desktop version of Outlook that, when scanned on their mobile device, transfers their authenticated state to the mobile device. The recommended state is to block Authentication transfer.",
+ "RationaleStatement": "Blocking authentication transfer helps protect against token theft and replay attacks by preventing the use of device tokens to silently authenticate on other devices or browsers. When authentication transfer is enabled, a threat actor who gains access to one device can access resources to unapproved devices, bypassing standard authentication and device compliance checks. When administrators block this flow, organizations can ensure that each authentication request must originate from the original device, maintaining the integrity of the device compliance and user session context.",
+ "ImpactStatement": "Users will no longer be able to use authentication transfer to sign into mobile versions of Microsoft apps (e.g., scanning a QR code in Outlook desktop to sign into Outlook mobile). Each device will require independent, interactive sign-in subject to applicable Conditional Access policies.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access. 3. Create a new policy by selecting New policy. o Under Users or agents (Preview) include All users. o Under Target resources > Resources (formerly cloud apps) include All resources (formerly 'All cloud apps'). - Under Exclude exclude any break-glass accounts. o Under Conditions > Authentication flows set Configure to Yes and check Authentication transfer. - Click Save. o Under Grant select Block access and click Select. 4. Under Enable policy set it to Report-only until the organization is ready to enable it. 5. Click Create. 6. After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.",
+ "AuditProcedure": "Note: Break-glass accounts should be excluded from all Conditional Access policies. To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Conditional Access. 3. Verify that a policy exists with the following criteria: o Under Users or agents (Preview) verify All users is selected. o Verify that only documented user exclusions exist and that they are reviewed annually. o Under Target resources verify Resources (formerly cloud apps) includes All resources (formerly 'All cloud apps') o Under Conditions > Authentication flows verify Configure is set to Yes and Authentication transfer is checked. o Under Grant verify Block access is selected. 4. Verify that Enable policy is set to On. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identity/conditionalAccess/policies 2. Filter to policies where conditions.authenticationFlows.transferMethods contains authenticationTransfer. 3. For each policy returned, verify the following criteria: o conditions.users.includeUsers is All o conditions.applications.includeApplications is All o conditions.authenticationFlows.transferMethods contains authenticationTransfer o grantControls.builtInControls is block o state is enabled 4. Compliance is met when at least one policy is found to meet all the criteria listed above. 5. Verify that any exclusions are documented and reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "This policy does not exist by default.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows#authentication-transfer-policies:https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#authentication-transfer-is-blocked:https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows:https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-transfer"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.1",
+ "Description": "Microsoft provides supporting settings to enhance the configuration of the Microsoft Authenticator application. These settings provide users with additional information and context when they receive MFA passwordless and push requests, including the geographic location of the request, the requesting application, and a requirement for number matching. The recommended state is Enabled for the following: - Show application name in push and passwordless notifications - Show geographic location in push and passwordless notifications Note: On February 27, 2023 Microsoft started enforcing number matching tenant-wide for all users using Microsoft Authenticator.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft provides supporting settings to enhance the configuration of the Microsoft Authenticator application. These settings provide users with additional information and context when they receive MFA passwordless and push requests, including the geographic location of the request, the requesting application, and a requirement for number matching. The recommended state is Enabled for the following: - Show application name in push and passwordless notifications - Show geographic location in push and passwordless notifications Note: On February 27, 2023 Microsoft started enforcing number matching tenant-wide for all users using Microsoft Authenticator.",
+ "RationaleStatement": "As the use of strong authentication has become more widespread, attackers have started to exploit the tendency of users to experience \"MFA fatigue.\" This occurs when users are repeatedly asked to provide additional forms of identification, leading them to eventually approve requests without fully verifying the source. To counteract this, number matching can be employed to ensure the security of the authentication process. With this method, users are prompted to confirm a number displayed on their original device and enter it into the device being used for MFA. Additionally, other information such as geolocation and application details are displayed to enhance the end user's awareness. Among these 3 options, number matching provides the strongest net security gain.",
+ "ImpactStatement": "Additional interaction will be required by end users using number matching as opposed to simply pressing \"Approve\" for login attempts.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Click to expand Entra ID > Authentication methods and select Policies. 3. Select Microsoft Authenticator 4. Under Enable and Target ensure the setting is set to Enable. 5. Select Configure 6. Set the following Microsoft Authenticator settings: o Show application name in push and passwordless notifications Status is set to Enabled, Target All users o Show geographic location in push and passwordless notifications Status is set to Enabled, Target All users Note: Valid groups such as break glass accounts can be excluded per organization policy.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Authentication methods and select Policies. 3. Under Method select Microsoft Authenticator. 4. Under Enable and Target verify the setting is set to Enable. 5. In the Include tab verify that All users is selected. 6. In the Exclude tab verify only valid groups are present (i.e. Break Glass accounts). 7. Select Configure 8. Verify the following Microsoft Authenticator settings: o Show application name in push and passwordless notifications Status is set to Enabled, Target All users o Show geographic location in push and passwordless notifications Status is set to Enabled, Target All users 9. In each setting select Exclude and verify only valid groups are present (i.e. Break Glass accounts). To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/ microsoftAuthenticator 2. Verify that the state is enabled. 3. Verify that includeTargets.id is all_users. 4. Verify that the excludeTargets only includes valid groups (i.e. Break Glass accounts). 5. Under featureSettings verify the following settings: o displayAppInformationRequiredState.state is enabled o displayAppInformationRequiredState.includeTarget.id is all_users o displayLocationInformationRequiredState.state is enabled o displayLocationInformationRequiredState.includeTarget.id is all_users 6. In each setting excludeTarget only includes a valid group (i.e. Break Glass accounts) or a target id of 00000000-0000-0000-0000-000000000000 Note: Compliance cannot be easily validated for exclusions so adding these to a report for human manual review is recommended. These should be reviewed annually.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Microsoft-managed",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-default-enablement:https://techcommunity.microsoft.com/t5/microsoft-entra-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677:https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match:https://learn.microsoft.com/en-us/graph/api/authenticationmethodspolicy-get?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.2",
+ "Description": "With Entra Password Protection, default global banned password lists are automatically applied to all users in an Entra ID tenant. To support business and security needs, custom banned password lists can be defined. When users change or reset their passwords, these banned password lists are checked to enforce the use of strong passwords. A custom banned password list should include some of the following examples: - Brand names - Product names - Locations, such as company headquarters - Company-specific internal terms - Abbreviations that have specific company meaning",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "With Entra Password Protection, default global banned password lists are automatically applied to all users in an Entra ID tenant. To support business and security needs, custom banned password lists can be defined. When users change or reset their passwords, these banned password lists are checked to enforce the use of strong passwords. A custom banned password list should include some of the following examples: - Brand names - Product names - Locations, such as company headquarters - Company-specific internal terms - Abbreviations that have specific company meaning",
+ "RationaleStatement": "Creating a new password can be difficult regardless of one's technical background. It is common to look around one's environment for suggestions when building a password, however, this may include picking words specific to the organization as inspiration for a password. An adversary may employ what is called a 'mangler' to create permutations of these specific words in an attempt to crack passwords or hashes making it easier to reach their goal.",
+ "ImpactStatement": "If a custom banned password list includes too many common dictionary words, or short words that are part of compound words, then perfectly secure passwords may be blocked. The organization should consider a balance between security and usability when creating a list.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Authentication methods and select Password protection. 3. Set Enforce custom list to Yes 4. In Custom banned password list create a list using suggestions outlined in this document. 5. Click Save Note: Below is a list of examples that can be used as a starting place. The references section contains more suggestions. - Brand names - Product names - Locations, such as company headquarters - Company-specific internal terms - Abbreviations that have specific company meaning",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID > Authentication methods and select Password protection. 3. Verify that Enforce custom list is set to Yes 4. Verify that Custom banned password list contains entries specific to the organization or matches a pre-determined list. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Directory.Read.All\" 2. Run the following commands: $PwRuleSettings = '5cf42378-d67d-4f36-ba46-e8b86229381d' Get-MgGroupSetting | Where-Object TemplateId -eq $PwRuleSettings | Select-Object -ExpandProperty Values 3. Verify that EnableBannedPasswordCheck is True and BannedPasswordList is populated.",
+ "AdditionalInformation": "Organization-specific terms can be added to the custom banned password list, such as the following examples: - Brand names - Product names - Locations, such as company headquarters - Company-specific terms - Abbreviations that have specific company meaning - Months and weekdays with your company's local languages The default global banned password list is already applied to your resources which applies the following basic requirements: Characters allowed: - Uppercase characters (A - Z) - Lowercase characters (a - z) - Numbers (0 - 9) - Symbols: - @#$%^&*-_!+=[]{}|\\:',.?/`~\"();<> - blank space Characters not allowed: - Unicode characters Password length: Passwords require: - A minimum of eight characters - A maximum of 256 characters Password complexity: Passwords require three out of four of the following categories: - Uppercase characters - Lowercase characters - Numbers - Symbols Note: Password complexity check isn't required for Education tenants. Password not recently used: - When a user changes or resets their password, the new password can't be the same as the current or recently used passwords. - Password isn't banned by Entra ID Password Protection. - The password can't be on the global list of banned passwords for Azure AD Password Protection, or on the customizable list of banned passwords specific to your organization. Evaluation New passwords are evaluated for strength and complexity by validating against the combined list of terms from the global and custom banned password lists. Even if a user's password contains a banned password, the password may be accepted if the overall password is otherwise strong enough.",
+ "DefaultValue": "By default the custom banned password list is not 'Enabled'.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#custom-banned-password-list:https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-configure-custom-password-protection:https://www.microsoft.com/en-us/research/publication/password-guidance/:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-6-use-strong-authentication-controls"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.3",
+ "Description": "Microsoft Entra Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. To protect on-premises Active Directory Domain Services (AD DS) environment, install and configure Entra Password Protection. Note: This recommendation applies to Hybrid deployments only and will have no impact unless working with on-premises Active Directory.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. To protect on-premises Active Directory Domain Services (AD DS) environment, install and configure Entra Password Protection. Note: This recommendation applies to Hybrid deployments only and will have no impact unless working with on-premises Active Directory.",
+ "RationaleStatement": "This feature protects an organization by prohibiting the use of weak or leaked passwords. In addition, organizations can create custom banned password lists to prevent their users from using easily guessed passwords that are specific to their industry. Deploying this feature to Active Directory will strengthen the passwords that are used in the environment.",
+ "ImpactStatement": "The potential impact associated with implementation of this setting is dependent upon the existing password policies in place in the environment. For environments that have strong password policies in place, the impact will be minimal. For organizations that do not have strong password policies in place, implementation of Microsoft Entra Password Protection may require users to change passwords and adhere to more stringent requirements than they have been accustomed to.",
+ "RemediationProcedure": "To remediate using the UI: - Download and install the Azure AD Password Proxies and DC Agents from the following location: https://www.microsoft.com/download/details.aspx?id=57071 After installed follow the steps below. 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Set Enable password protection on Windows Server Active Directory to Yes and Mode to Enforced.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Verify that Enable password protection on Windows Server Active Directory is set to Yes and that Mode is set to Enforced. To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Directory.Read.All\" 2. Run the following command: (Get-MgGroupSetting | ? { $_.TemplateId -eq '5cf42378-d67d-4f36-ba46- e8b86229381d' }).Values 3. Verify that EnableBannedPasswordCheckOnPremises is set to True and BannedPasswordCheckOnPremisesMode is set to Enforce.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enable - Yes Mode - Audit",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.4",
+ "Description": "Microsoft defines Multifactor authentication capable as being registered and enabled for a strong authentication method. The method must also be allowed by the authentication methods policy. Ensure all member users are MFA capable.",
+ "Checks": [
+ "entra_users_mfa_capable"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft defines Multifactor authentication capable as being registered and enabled for a strong authentication method. The method must also be allowed by the authentication methods policy. Ensure all member users are MFA capable.",
+ "RationaleStatement": "Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Users who are not MFA Capable have never registered a strong authentication method for multifactor authentication that is within policy and may not be using MFA. This could be a result of having never signed in, exclusion from a Conditional Access (CA) policy requiring MFA, or a CA policy does not exist. Reviewing this list of users will help identify possible lapses in policy or procedure.",
+ "ImpactStatement": "When using the UI audit method guest users will appear in the report and unless the organization is applying MFA rules to guests then they will need to be manually filtered. Accounts that provide on-premises directory synchronization also appear in these reports.",
+ "RemediationProcedure": "Remediation steps will depend on the status of the personnel in question or configuration of Conditional Access policies and will not be covered in detail. Administrators should review each user identified on a case-by-case basis using the conditions below. User has never signed on: - Employment status should be reviewed, and appropriate action taken on the user account's roles, licensing and enablement. Conditional Access policy applicability: - Ensure a CA policy is in place requiring all users to use MFA. - Ensure the user is not excluded from the CA MFA policy. - Ensure the policy's state is set to On. - Use What if to determine applicable CA policies. (Protection > Conditional Access > Policies) - Review the user account in Sign-in logs. Under the Activity Details pane click the Conditional Access tab to view applied policies. Note: Conditional Access is covered step by step in section 5.2.2",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select User registration details. 3. Set the filter option Multifactor authentication capable to Not Capable. 4. Review the non-guest users in this list. 5. Excluding any exceptions users found in this report may require remediation. To audit using PowerShell: 1. Connect to Graph using Connect-MgGraph -Scopes \"UserAuthenticationMethod.Read.All,AuditLog.Read.All\" 2. Run the following: Get-MgReportAuthenticationMethodUserRegistrationDetail ` -Filter \"IsMfaCapable eq false and UserType eq 'Member'\" | ft UserPrincipalName,IsMfaCapable,IsAdmin 3. Verify that IsMfaCapable is set to True. 4. Excluding any exceptions users found in this report may require remediation. Note: The CA rule must be in place for a successful deployment of Multifactor Authentication. This policy is outlined in the conditional access section 5.2.2 Note 2: Possible exceptions include on-premises synchronization accounts.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.reports/update-mgreportauthenticationmethoduserregistrationdetail?view=graph-powershell-0#-ismfacapable:https://learn.microsoft.com/en-us/entra/identity/monitoring-health/how-to-view-applied-conditional-access-policies:https://learn.microsoft.com/en-us/entra/identity/conditional-access/what-if-tool:https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-methods-activity"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.5",
+ "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational. SMS and Voice Call rely on telephony carrier communication methods to deliver the authenticating factor. The recommended state is to Disable these methods: - SMS - Voice Call",
+ "Checks": [
+ "entra_authentication_method_sms_voice_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational. SMS and Voice Call rely on telephony carrier communication methods to deliver the authenticating factor. The recommended state is to Disable these methods: - SMS - Voice Call",
+ "RationaleStatement": "Traditional MFA methods such as SMS codes, email-based OTPs, and push notifications are becoming less effective against today's attackers. Sophisticated phishing campaigns have demonstrated that second factors can be intercepted or spoofed. Attackers now exploit social engineering, man-in-the-middle tactics, and user fatigue (e.g., MFA bombing) to bypass these mechanisms. These risks are amplified in distributed, cloud-first organizations with hybrid workforces and varied device ecosystems. The SMS and Voice call methods are vulnerable to SIM swapping which could allow an attacker to gain access to your Microsoft 365 account.",
+ "ImpactStatement": "There may be increased administrative overhead in adopting more secure authentication methods depending on the maturity of the organization.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Policies. 3. Inspect each method that is out of compliance and remediate: o Click on the method to open it. o Change the Enable toggle to the off position. o Click Save. Note: If the save button remains greyed out after toggling a method off, then first turn it back on and then change the position of the Target selection (all users or select groups). Turn the method off again and save. This was observed to be a bug in the UI at the time this document was published. To remediate using Powershell: 1. Connect to Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\" 2. Run the following to disable both authentication methods: $params = @( @{ Id = \"Sms\"; State = \"disabled\" }, @{ Id = \"Voice\"; State = \"disabled\" } ) Update-MgPolicyAuthenticationMethodPolicy -AuthenticationMethodConfigurations $params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Policies. 3. Verify that the following methods in the Enabled column are set to No. o Method: SMS o Method: Voice call To audit using Powershell: 1. Connect to Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following: (Get-MgPolicyAuthenticationMethodPolicy).AuthenticationMethodConfigurations 3. Verify that Sms and Voice are disabled.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- SMS : Disabled - Voice Call : Disabled",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage:https://learn.microsoft.com/en-us/security/zero-trust/sfi/phishing-resistant-mfa#context-and-problem:https://www.microsoft.com/en-us/microsoft-365-life-hacks/privacy-and-safety/what-is-sim-swapping"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.6",
+ "Description": "System-preferred multifactor authentication (MFA) prompts users to sign in by using the most secure method they registered. The user is prompted to sign-in with the most secure method according to the below order. The order of authentication methods is dynamic. It's updated by Microsoft as the security landscape changes, and as better authentication methods emerge. 1. Temporary Access Pass 2. Passkey (FIDO2) 3. Microsoft Authenticator notifications 4. External authentication methods 5. Time-based one-time password (TOTP) 6. Telephony 7. Certificate-based authentication The recommended state is Enabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "System-preferred multifactor authentication (MFA) prompts users to sign in by using the most secure method they registered. The user is prompted to sign-in with the most secure method according to the below order. The order of authentication methods is dynamic. It's updated by Microsoft as the security landscape changes, and as better authentication methods emerge. 1. Temporary Access Pass 2. Passkey (FIDO2) 3. Microsoft Authenticator notifications 4. External authentication methods 5. Time-based one-time password (TOTP) 6. Telephony 7. Certificate-based authentication The recommended state is Enabled.",
+ "RationaleStatement": "Regardless of the authentication method enabled by an administrator or set as preferred by the user, the system will dynamically select the most secure option available at the time of authentication. This approach acts as an additional safeguard to prevent the use of weaker methods, such as voice calls, SMS, and email OTPs, which may have been inadvertently left enabled due to misconfiguration or lack of configuration hardening. Enforcing the default behavior also ensures the feature is not disabled.",
+ "ImpactStatement": "The Microsoft managed value of system-preferred MFA is Enabled and as such enforces the default behavior. No additional impact is expected. Note: Due to known issues with certificate-based authentication (CBA) and system- preferred MFA, Microsoft moved CBA to the bottom of the list. It is still considered a strong authentication method.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Settings. 3. Set the System-preferred multifactor authentication State to Enabled and include All users. 4. Any users exclusions should be documented and reviewed annually.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Settings. 3. Verify the System-preferred multifactor authentication State is set to Enabled and All users are included. 4. Verify that only documented exclusions exist and that they are reviewed annually To audit using PowerShell: 1. Connect to Microsoft Graph using Connect-MgGraph -Scopes \"Policy.Read.AuthenticationMethod\" 2. Run the following commands: $Uri = 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' (Invoke-MgGraphRequest -Method GET -Uri $Uri).systemCredentialPreferences 3. Verify that includeTargets is set to all_users and state is set to enabled.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Microsoft Managed (Enabled)",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-system-preferred-multifactor-authentication:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-system-preferred-multifactor-authentication#how-does-system-preferred-mfa-determine-the-most-secure-method"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.7",
+ "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational. The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in. The recommended state is to Disable email OTP.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational. The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in. The recommended state is to Disable email OTP.",
+ "RationaleStatement": "Traditional MFA methods such as SMS codes, email-based OTPs, and push notifications are becoming less effective against today's attackers. Sophisticated phishing campaigns have demonstrated that second factors can be intercepted or spoofed. Attackers now exploit social engineering, man-in-the-middle tactics, and user fatigue (e.g., MFA bombing) to bypass these mechanisms. These risks are amplified in distributed, cloud-first organizations with hybrid workforces and varied device ecosystems.",
+ "ImpactStatement": "Disabling Email OTP will prevent one-time pass codes from being sent to unverified guest users accessing Microsoft 365 resources on the tenant such as \"@yahoo.com\". They will be required to use a personal Microsoft account, a managed Microsoft Entra account, be part of a federation or be configured as a guest in the host tenant's Microsoft Entra ID.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Policies. 3. Click on Email OTP. 4. Change the Enable toggle to the off position\\ 5. Click Save. Note: If the save button remains greyed out after toggling a method off, then first turn it back on and then change the position of the Target selection (all users or select groups). Turn the method off again and save. This was observed to be a bug in the UI at the time this document was published. To remediate using Powershell: 1. Connect to Graph using Connect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\" 2. Run the following: $params = @( @{ Id = \"Email\"; State = \"disabled\" } ) Update-MgPolicyAuthenticationMethodPolicy -AuthenticationMethodConfigurations $params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Policies. 3. Verify that Email OTP is set to No in the Enabled column. To audit using Powershell: 1. Connect to Graph using Connect-MgGraph -Scopes \"Policy.Read.All\" 2. Run the following: (Get-MgPolicyAuthenticationMethodPolicy).AuthenticationMethodConfigurations 3. Verify the id type Email is set to disabled.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Email OTP : Enabled",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage:https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode:https://learn.microsoft.com/en-us/security/zero-trust/sfi/phishing-resistant-mfa#context-and-problem"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.8",
+ "Description": "The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration. The recommended Lockout threshold is 10 or less.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration. The recommended Lockout threshold is 10 or less.",
+ "RationaleStatement": "Account lockout is a method of protecting against brute-force and password spray attacks. Once the lockout threshold has been exceeded, the account enters a locked- out state which prevents all login attempts for a variable duration. The lockout in combination with a reasonable duration reduces the total number of failed login attempts that a malicious actor can execute in a given period of time.",
+ "ImpactStatement": "If account lockout threshold is set too low (less than 3), users may experience frequent lockout events and the resulting security alerts may contribute to alert fatigue. If account lockout threshold is set too high (more than 10), malicious actors can programmatically execute more password attempts in a given period of time. In hybrid environments using pass-through authentication (PTA), the Microsoft Entra lockout threshold must be set lower than the AD DS account lockout threshold. If the AD DS threshold is equal to or lower than the Entra threshold, AD DS will lock the account before Entra smart lockout activates, bypassing the cloud-side protection and resulting in on-premises account lockouts that require manual administrator intervention to clear. Microsoft recommends configuring the AD DS lockout threshold to be at least two to three times greater than the Entra lockout threshold.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Set Lockout threshold to 10 or less. Note: In hybrid environments using pass-through authentication (PTA), Microsoft recommends to configure the AD DS account lockout threshold to be at least two to three times greater than the value set here to ensure Entra smart lockout activates before AD DS lockout.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Verify that Lockout threshold is set to 10 or less. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/groupSettings 2. Filter to Password Rule settings, where templateId is 5cf42378-d67d-4f36- ba46-e8b86229381d 3. Verify that LockoutThreshold is 10 or less.",
+ "AdditionalInformation": "NOTE: The variable number for failed login attempts allowed before lockout is prescribed by many security and compliance frameworks. The appropriate setting for this variable should be determined by the most restrictive security or compliance framework that your organization follows.",
+ "DefaultValue": "By default, Lockout threshold is set to 10.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout#manage-microsoft-entra-smart-lockout-values:https://learn.microsoft.com/en-us/graph/api/group-list-settings?view=graph-rest-0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.9",
+ "Description": "The account lockout duration value determines how long an account retains the status of lockout, and therefore how long before a user can continue to attempt to login after passing the lockout threshold. The recommended state is Lockout duration in seconds is at least 60.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The account lockout duration value determines how long an account retains the status of lockout, and therefore how long before a user can continue to attempt to login after passing the lockout threshold. The recommended state is Lockout duration in seconds is at least 60.",
+ "RationaleStatement": "Account lockout is a method of protecting against brute-force and password spray attacks. Once the lockout threshold has been exceeded, the account enters a locked- out state which prevents all login attempts for a variable duration. The lockout in combination with a reasonable duration reduces the total number of failed login attempts that a malicious actor can execute in a given period of time.",
+ "ImpactStatement": "If account lockout duration is set too low (less than 60 seconds), malicious actors can perform more password spray and brute-force attempts over a given period of time. If the account lockout duration is set too high (more than 300 seconds) users may experience inconvenient delays during lockout. In hybrid environments using pass-through authentication (PTA), the Microsoft Entra lockout duration must be set longer than the AD DS account lockout duration. Note that Entra lockout duration is configured in seconds while AD DS lockout duration is configured in minutes; verify the units when comparing the two values to ensure Entra smart lockout expires after AD DS lockout.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Set the Lockout duration in seconds to 60 or higher. 4. Click Save. Note: In hybrid environments using pass-through authentication (PTA), ensure the AD DS account lockout duration is shorter than the value set here. The Entra lockout duration is configured in seconds while AD DS lockout duration is configured in minutes; account for the unit difference when comparing the two values.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Authentication methods and select Password protection. 3. Verify that Lockout duration in seconds is set to 60 or higher. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/groupSettings 2. Filter to Password Rule settings, where templateId is 5cf42378-d67d-4f36- ba46-e8b86229381d 3. Verify that LockoutDurationInSeconds is greater than or equal to 60.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default, Lockout duration in seconds is set to 60.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout#manage-microsoft-entra-smart-lockout-values:https://learn.microsoft.com/en-us/graph/api/group-list-settings?view=graph-rest-0"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.3.10",
+ "Description": "Microsoft Entra ID includes a feature called Authenticator Lite, which embeds a subset of Microsoft Authenticator functionality into companion applications such as Outlook mobile. When enabled, users can satisfy MFA requirements using push notifications or time-based one-time passcodes (TOTP) directly from the companion application without installing the standalone Microsoft Authenticator app. The recommended state is Microsoft Authenticator on companion applications set to Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.3 Authentication Methods",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra ID includes a feature called Authenticator Lite, which embeds a subset of Microsoft Authenticator functionality into companion applications such as Outlook mobile. When enabled, users can satisfy MFA requirements using push notifications or time-based one-time passcodes (TOTP) directly from the companion application without installing the standalone Microsoft Authenticator app. The recommended state is Microsoft Authenticator on companion applications set to Disabled.",
+ "RationaleStatement": "Authenticator Lite does not support application name or geographic location context in push notifications, regardless of tenant-wide Authenticator feature settings. These are key defenses against MFA fatigue attacks that are only available in the full Microsoft Authenticator app. Authenticator Lite also does not satisfy Conditional Access authentication strength requirements, does not support passwordless authentication, and does not support SSPR via push notifications. Disabling this feature ensures users authenticate through the full Microsoft Authenticator app where all available security protections are active.",
+ "ImpactStatement": "Users who have registered Authenticator Lite as their only MFA method will be unable to complete MFA until they install and register the standalone Microsoft Authenticator app. Administrators should communicate this change in advance and verify that affected users have registered an alternative MFA method before disabling this feature to avoid authentication lockouts.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Authentication methods and select Policies. 3. Under Method select Microsoft Authenticator. 4. Select Configure. 5. Set Microsoft Authenticator on companion applications: Status to Disabled. 6. Select Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. 2. Expand Entra ID > Authentication methods and select Policies. 3. Under Method select Microsoft Authenticator. 4. Select Configure. 5. Verify that Microsoft Authenticator on companion applications: Status is set to Disabled. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/ microsoftAuthenticator 2. Verify that featureSettings.companionAppAllowedState.state is disabled.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Microsoft managed (enabled as of June 26, 2023)",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-authenticator-lite:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-default-enablement:https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-additional-context"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4.1",
+ "Description": "Enabling self-service password reset allows users to reset their own passwords in Entra ID. When users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. The recommended state is All. Note: Effective Oct. 1st, 2022, Microsoft will begin to enable combined registration for all users in Entra ID tenants created before August 15th, 2020. Tenants created after this date are enabled with combined registration by default.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.4 Password reset",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "Enabling self-service password reset allows users to reset their own passwords in Entra ID. When users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. The recommended state is All. Note: Effective Oct. 1st, 2022, Microsoft will begin to enable combined registration for all users in Entra ID tenants created before August 15th, 2020. Tenants created after this date are enabled with combined registration by default.",
+ "RationaleStatement": "Enabling Self-Service Password Reset (SSPR) significantly reduces helpdesk interactions, streamlining support operations and improving user experience. Traditional methods involving temporary passwords pose notable security risks-they are often weak, predictable, and susceptible to interception. This creates a window of opportunity for threat actors to compromise accounts before users can update their credentials. SSPR minimizes credential exposure and strengthens overall identity protection.",
+ "ImpactStatement": "Users will be required to provide additional contact information in order to enroll in SSPR. Some light user education may be necessary, particularly for individuals who are accustomed to contacting the help desk for password reset assistance. In hybrid environments, SSPR writeback must be enabled before users are able to reset their passwords through self-service.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Properties. 3. Set Self service password reset enabled to All",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Properties. 3. Verify that Self service password reset enabled is set to All",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/let-users-reset-passwords?view=o365-worldwide:https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr:https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4.2",
+ "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset. The recommended state is Number of methods required to reset set to 2.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.4 Password reset",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Manual",
+ "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset. The recommended state is Number of methods required to reset set to 2.",
+ "RationaleStatement": "Requiring Multi-factor Authentication (MFA) for Self-service Password Reset (SSPR) strengthens the password reset process by confirming the user's identity with two separate methods of authentication. With multiple methods required for password reset, an attacker would have to compromise multiple authentication methods before resetting a user's password.",
+ "ImpactStatement": "If multiple methods are required for password reset and a user has lost access to other authentication methods, the resetting user will need an administrator with permissions to remove the lost authentication method. Policy and training are recommended to teach administrators to verify the identity of the requesting user so that social engineering is not an effective vector of compromise. If multifactor authentication is not currently enabled for all users, users with only one registered form of authentication will not be able to reset their passwords through SSPR until another form of authentication is registered. If multifactor authentication is already enabled for all users, the impact of this recommendation should be minimal.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Authentication methods. 3. Set the Number of methods required to reset to 2 4. Click Save",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Authentication methods. 3. Verify that Number of methods required to reset is set to 2",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default, the Number of methods required to reset is 1.",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-registration-mfa-sspr-combined:https://support.microsoft.com/en-us/account-billing/reset-your-work-or-school-password-using-security-info-23dde81f-08bb-4776-ba72-e6b72b9dda9e:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4.3",
+ "Description": "The Require users to register when signing in? setting controls whether users are prompted to register their self-service password reset (SSPR) authentication methods at their next sign-in. When set to Yes, users who have not yet registered are prompted to do so upon signing in. The Number of days before users are asked to re-confirm their authentication information setting designates the period of time before registered users are prompted to re-confirm their existing authentication information is still valid, up to a maximum of 730 days. If set to 0 days, registered users will never be prompted to re-confirm their authentication information.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.4 Password reset",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "The Require users to register when signing in? setting controls whether users are prompted to register their self-service password reset (SSPR) authentication methods at their next sign-in. When set to Yes, users who have not yet registered are prompted to do so upon signing in. The Number of days before users are asked to re-confirm their authentication information setting designates the period of time before registered users are prompted to re-confirm their existing authentication information is still valid, up to a maximum of 730 days. If set to 0 days, registered users will never be prompted to re-confirm their authentication information.",
+ "RationaleStatement": "Without requiring users to register, users may never establish SSPR authentication methods, rendering the re-confirmation setting ineffective regardless of the value it is set to. When users do register authentication methods for self-service password reset (SSPR), those methods may become stale over time as phone numbers, email addresses, or other contact information changes. If re-confirmation is disabled, outdated recovery information persists indefinitely. An attacker who gains access to a former phone number or email address associated with a user's account can exploit that stale recovery information to reset the user's password and take over the account. Requiring registration and periodic re-confirmation ensures that the authentication methods on record remain accurate and under the user's control.",
+ "ImpactStatement": "Because both settings default to the compliant state, organizations that have not altered them will experience no impact. Re-enabling registration prompts unregistered users to register at their next sign-in; re-enabling re-confirmation prompts registered users to verify their information on the configured interval. Organizations with large user populations and short re-confirmation intervals should expect increased SSPR support volume.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Registration. 3. Set Require users to register when signing in? to Yes. 4. Set Number of days before users are asked to re-confirm their authentication information to any organization-approved value other than 0. 5. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Registration. 3. Verify that Require users to register when signing in? is set to Yes. 4. Verify that Number of days before users are asked to re-confirm their authentication information is not set to 0.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Require users to register when signing in?: Yes - Number of days before users are asked to re-confirm their authentication information: 180",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#registration:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4.4",
+ "Description": "This setting determines whether or not users receive an email to their primary and alternate email addresses notifying them when their own password has been reset via the Self-Service Password Reset portal. The recommended state is Notify users on password resets? is set to Yes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.4 Password reset",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "This setting determines whether or not users receive an email to their primary and alternate email addresses notifying them when their own password has been reset via the Self-Service Password Reset portal. The recommended state is Notify users on password resets? is set to Yes.",
+ "RationaleStatement": "User notification on password reset is a proactive way of confirming password reset activity. It helps the user to recognize unauthorized password reset activities.",
+ "ImpactStatement": "Users will receive emails alerting them to password changes to both their primary and alternate emails.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Notifications. 3. Set Notify users on password resets? to Yes 4. Click Save.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Notifications. 3. Verify that Notify users on password resets? is set to Yes.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Yes",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#set-up-notifications-and-customizations:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#notifications:https://support.microsoft.com/en-us/account-billing/reset-your-work-or-school-password-using-security-info-23dde81f-08bb-4776-ba72-e6b72b9dda9e"
+ }
+ ]
+ },
+ {
+ "Id": "5.2.4.5",
+ "Description": "This setting determines whether or not all global administrators receive an email to their primary email address when other administrators reset their own passwords via the Self-Service Password Reset Portal. The recommended state is Notify all admins when other admins reset their password? is set to Yes.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.2.4 Password reset",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "This setting determines whether or not all global administrators receive an email to their primary email address when other administrators reset their own passwords via the Self-Service Password Reset Portal. The recommended state is Notify all admins when other admins reset their password? is set to Yes.",
+ "RationaleStatement": "Administrator accounts are sensitive. Any password reset activity notification, when sent to all Administrators, ensures that all Global Administrators can passively confirm if such a reset is a common pattern within their group. For example, if all Administrators change their password every 30 days, any password reset activity before that may require administrator(s) to evaluate any unusual activity and confirm its origin.",
+ "ImpactStatement": "All Global Administrators will receive a notification from Azure every time a password is reset. This is useful for auditing procedures to confirm that there are no out of the ordinary password resets for Administrators. There is additional overhead, however, in the time required for Global Administrators to audit the notifications. This setting is only useful if all Global Administrators pay attention to the notifications and audit each one.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Notifications. 3. Set Notify all admins when other admins reset their password? to Yes 4. Click Save",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Password reset and select Notifications. 3. Verify that Notify all admins when other admins reset their password? is set to Yes",
+ "AdditionalInformation": "",
+ "DefaultValue": "No",
+ "References": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#notifications:https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#set-up-notifications-and-customizations"
+ }
+ ]
+ },
+ {
+ "Id": "5.3.1",
+ "Description": "Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) activation workflows for privileged Entra ID and Microsoft 365 roles, enabling time- bound access with approval and justification requirements. Rather than holding permanent role assignments, users are made eligible for a role and must explicitly activate it when needed. PIM supports requiring multi-factor authentication at activation, mandatory justification, approval workflows, and configurable activation durations.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.3 ID Governance",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) activation workflows for privileged Entra ID and Microsoft 365 roles, enabling time- bound access with approval and justification requirements. Rather than holding permanent role assignments, users are made eligible for a role and must explicitly activate it when needed. PIM supports requiring multi-factor authentication at activation, mandatory justification, approval workflows, and configurable activation durations.",
+ "RationaleStatement": "Permanent active role assignments expose privileged access continuously, regardless of whether a user is actively performing administrative tasks. If a permanently privileged account is compromised, an attacker immediately holds full role permissions with no time boundary. PIM eliminates standing privilege by requiring users to explicitly activate role assignments, scoping elevated access to a defined duration and requiring justification and, optionally, approval. This reduces the window of opportunity for both external attackers and insider threats to exploit privileged access.",
+ "ImpactStatement": "The implementation of Just in Time privileged access is likely to necessitate changes to administrator routine. Administrators will only be granted access to administrative roles when required. When administrators request role activation, they will need to document the reason for requiring role access, anticipated time required to have the access, and to reauthenticate to enable role access. Note: If all global admins become eligible then there will be no global admin to receive notifications, by default. Alerts are sent to TenantAdmins, including Global Administrators, by default. To ensure proper receipt, configure alerts to be sent to security or operations staff with valid email addresses or a security operations center. Otherwise, after adoption of this recommendation, alerts sent to TenantAdmins may go unreceived due to the lack of a licensed permanently active Global Administrator.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Roles & admins and select All roles. 3. For each user or group role assignment that is out of compliance: o Click on the role to open it in PIM. o Select the Active assignments tab. o Under action click Update or Remove. - If Update is selected, set the Assignment type to Eligible and click Save. - If Remove is selected, the assignment will be removed and the principal will no longer hold the role. 4. For each privileged role with a non-compliant service principal active assignment: 1. Open the Active assignments tab. 2. Click Update to modify the service principal assignment. 3. Uncheck Permanently assigned and set an appropriate end time to create a time-bound assignment based on business needs. 4. Click Save to apply the changes. 5. Repeat for any other privileged role assignments that are out of compliance. Note: CIS Safeguard 6.8, Define and Maintain Role-Based Access Control, recommends reviewing access on a recurring schedule, at least annually and more frequently as needed. This practice is strongly encouraged for service principals when defining time-bound assignments.",
+ "AuditProcedure": "Note: There is no programmatic way to reliably determine whether a principal is a designated break-glass account. Global Administrator assignments require manual review and judgment to confirm that any permanent assignments belong exclusively to the organization's two approved break-glass accounts. To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Entra ID > Roles & admins and select All roles. 3. Select Add filters and apply the Privileged filter to scope the review to built- in and custom privileged roles. 4. For each PRIVILEGED role that has one or more assignments, perform the following review of active assignments: 1. Select the role to open it. 2. Open the Active assignments tab. 3. For each assignment where Type is User or Group, verify that State is Activated. - A State of Assigned is permitted only for approved break-glass accounts assigned to the Global Administrator role, and no more than 2 such accounts may hold this permanent assignment. 4. For each assignment where Type is Service principal, verify that State is Assigned and an End time is designated. 5. Compliance is met when all privileged role assignments meet the verification requirements in step 4. Usage of PIM for management of other administrator roles is recommended but not required for compliance. To audit using Microsoft Graph API: 1. Execute a GET request to the following relative URI to retrieve privileged roles (custom or built-in): beta/roleManagement/directory/roleDefinitions?$filter=isPrivileged eq true&$select=id,displayName,isPrivileged,isBuiltIn,isEnabled 2. Execute a GET request to the following relative URI to retrieve all instances of active role assignments: v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$expand=princip al 3. Correlate by matching each assignment instance's roleDefinitionId to the privileged role list's id to produce a list of privileged role assignment instances. 4. For each privileged role assignment instance, verify the appropriate condition for the principal type: o For users and groups (principal@odata.type is #microsoft.graph.user or #microsoft.graph.group), verify that assignmentType is Activated. An assignmentType of Assigned is permitted only for approved break-glass accounts assigned to the Global Administrator role, and no more than 2 such accounts may hold this permanent assignment. o For service principals (principal@odata.type is #microsoft.graph.servicePrincipal), verify that assignmentType is Assigned and endDateTime is defined (time-bound assignment). 5. Compliance is met when all privileged role assignments meet the verification requirements in step 4. Usage of PIM for management of other administrator roles is recommended but not required for compliance.",
+ "AdditionalInformation": "In addition to enforcing just-in-time activation for active privileged role assignments, organizations are encouraged to periodically review eligible PIM role assignments to confirm ongoing business justification and remove stale entries. Annual review at minimum is recommended. This is a governance process that requires manual judgment and is outside the scope of the automated compliance check for this recommendation.",
+ "DefaultValue": "Without Privileged Identity Management configured, all privileged role assignments are permanent active assignments with no expiration or activation requirement.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure"
+ }
+ ]
+ },
+ {
+ "Id": "5.3.2",
+ "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization. When configured for guest users, access reviews can automatically remove access if no reviewer responds within the review period, enforcing a fail-closed posture for external identities.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.3 ID Governance",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization. When configured for guest users, access reviews can automatically remove access if no reviewer responds within the review period, enforcing a fail-closed posture for external identities.",
+ "RationaleStatement": "Access to groups and applications for guests can change over time. If a guest user's access to a particular resource goes unnoticed, they may unintentionally gain access to sensitive data if a member adds new files or data to the resource. Access reviews can help reduce the risks associated with outdated assignments by requiring a member of the organization to conduct the reviews. Furthermore, these reviews can enable a fail- closed mechanism to remove access to the subject if the reviewer does not respond to the review.",
+ "ImpactStatement": "Legitimate guest users may lose access to resources if designated reviewers fail to respond within the review window, requiring re-invitation and re-provisioning of access. Organizations with a large number of Microsoft 365 groups may face significant reviewer workload from monthly review cycles, which can lead to approval fatigue. - Microsoft Entra ID Governance licensing (included in Microsoft 365 E5) is required to configure access reviews. - As of January 15, 2026, a linked Azure subscription is required to use Entra ID Governance features for guest users.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand ID Governance and select Access reviews 3. Click New access review. 4. In the Resource review box click Select. 5. In Review Type set the following: o Select what to review choose Teams + Groups. o Review Scope to All Microsoft 365 groups with guest users. o Scope to Guest users only then click Next: Reviews. 6. In Reviews set the following: o Select reviewers to Group members or Selected users and groups, ensuring that at least one reviewer is assigned and that the guest is not performing a self-review. o Duration (in days) to 14 days or less. o Review recurrence to Monthly or more frequent. o Start date for the review, ensuring the review becomes active before the next audit date. o End to Never, then click Next: Settings. 7. In Settings set the following: o Auto apply results to resource is checked. o If reviewers don't respond to Remove access o Justification required is checked. o E-mail notifications is checked. o Reminders is checked. o Click Next: Review + Create 8. Click Create. To remediate using the Microsoft Graph API: To create a new access review, execute a POST request to the following relative URI. To update an existing review, execute a PATCH request to the same URI appended with the review's id: v1.0/identityGovernance/accessReviews/definitions The request body must include properties that satisfy the audit criteria above. The Graph API documentation provides complete sample request bodies in multiple languages including HTTP, PowerShell, and Python. See Reference 3 for details.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand ID Governance and select Access reviews 3. Inspect the access reviews, and verify an access review is created with the following criteria: o Overview: Scope is set to Guest users only and Review status is Active o Reviewers: At least one reviewer is assigned, and the reviewer is not a guest user. o Settings > General: - Mail notifications is set to Enable - Reminders is set to Enable o Settings > Reviewers: - Require reason on approval is set to Enable o Settings > Scheduling: - Frequency is set to Monthly or more frequent - Duration (in days) does not exceed 14 days - End is set to Never o Settings > When completed: - Auto apply results to resource is set to Enable - If reviewers don't respond is set to Remove access 4. The control is compliant if there is at least one access review for guests that meets all criteria above. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identityGovernance/accessReviews/definitions 2. Apply the following filters to identify access reviews targeting guest users: o scope.resourceScopes.query matches the pattern userType eq 'Guest' OR o scope.query matches the pattern userType eq 'Guest' 3. For each review that passes the filters above, verify the following criteria: o Recurrence is configured as monthly or more frequent: - recurrence.pattern.type is absoluteMonthly OR - recurrence.pattern.type is weekly o reviewers is not empty o settings.mailNotificationsEnabled is true o settings.instanceDurationInDays is 14 days or less o settings.reminderNotificationsEnabled is true o settings.justificationRequiredOnApproval is true o settings.autoApplyDecisionsEnabled is true o settings.defaultDecision is Deny o settings.recurrence.range.type is noEnd 4. The control is compliant if there is at least one access review for guests that meets all criteria above.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default access reviews are not configured.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview:https://learn.microsoft.com/en-us/entra/id-governance/create-access-review:https://learn.microsoft.com/en-us/graph/api/resources/accessreviewscheduledefinition?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.3.3",
+ "Description": "Access reviews in Microsoft Entra Privileged Identity Management (PIM) enable administrators to periodically validate whether users still require their privileged role assignments. These reviews can be scheduled to recur on a regular cadence and can be delegated to reviewers other than the role holders themselves, such as security auditors.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.3 ID Governance",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Access reviews in Microsoft Entra Privileged Identity Management (PIM) enable administrators to periodically validate whether users still require their privileged role assignments. These reviews can be scheduled to recur on a regular cadence and can be delegated to reviewers other than the role holders themselves, such as security auditors.",
+ "RationaleStatement": "Regular review of critical high privileged roles in Entra ID will help identify role drift, or potential malicious activity. This will enable the practice and application of \"separation of duties\" where even non-privileged users like security auditors can be assigned to review assigned roles in an organization. These reviews can optionally be configured to automatically remove access if a reviewer does not respond within the review window, though this recommendation conservatively sets non-response to result in no change to avoid inadvertent removal of privileged accounts including break-glass accounts.",
+ "ImpactStatement": "In order to avoid disruption reviewers who have the authority to revoke roles should be trusted individuals who understand the significance of access reviews. Additionally, the principle of separation of duties should be applied to ensure that no administrator is responsible for reviewing their own access levels. This will cause additional administrative overhead. If the reviews are configured to automatically revoke highly privileged roles like the Global Administrator role, then this could result in removing all Global Administrators from the organization. Care should be taken when configuring this setting especially in the case of break-glass accounts which would be included in the scope. - Microsoft Entra ID Governance licensing (included in Microsoft 365 E5) is required to configure access reviews.",
+ "RemediationProcedure": "Note: An access review is created for each role selected after completing the process. To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand ID Governance > Privileged Identity Management. 3. Select Microsoft Entra Roles under Manage. 4. Select Access reviews and click New. o Provide a name and description. o Set Frequency to Monthly or more frequently. o Set Duration (in days) to at most 14. o Set End to Never. o Set Users scope to All users and groups. o In Role select the directory roles outlined in the Additional Information section. o Set Assignment type to All active and eligible assignments. o Set Reviewers to member(s) responsible for this type of review, other than self. 5. In Upon completion settings set the following: o Auto apply results to resource to Enable. o If reviewers don't respond to No change. 6. In Advanced settings set the following: o Require reason on approval to Enable o Mail notifications to Enable o Reminders to Enable 7. Click Start to save and begin the review series. Warning: Care should be taken when configuring the If reviewers don't respond setting for Global Administrator reviews, if misconfigured break-glass accounts could automatically have roles revoked. Additionally, reviewers should be educated on the purpose of break-glass accounts to prevent accidental manual removal of roles. To remediate using the Microsoft Graph API: To create a new access review, execute a POST request to the following relative URI. To update an existing review, execute a PATCH request to the same URI appended with the review's id: v1.0/identityGovernance/accessReviews/definitions The request body must include properties that satisfy the audit criteria above. The Graph API documentation provides complete sample request bodies in multiple languages including HTTP, PowerShell, and Python. See Reference 3 for details",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand ID Governance > Privileged Identity Management. 3. Select Microsoft Entra Roles under Manage. 4. Select Access reviews 5. For each privileged role listed in the Additional Information section, verify an access review exists that meets the following criteria: o Overview: - Role assignment type is set to Eligible and Active - Scope is set to Everyone - Review status is Active o Reviewers: At least one reviewer is assigned, and the reviewer is not self- reviewing. o Settings > General: - Mail notifications is set to Enable - Reminders is set to Enable o Settings > Reviewers: - Require reason on approval is set to Enable o Settings > Scheduling: - Frequency is set to Monthly or more frequently - Duration (in days) does not exceed 14 days - End is set to Never o Settings > When completed: - Auto apply results to resource is set to Enable - If reviewers don't respond is set to No change To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI: v1.0/identityGovernance/accessReviews/definitions 2. Apply the following filters to identify relevant access review definitions: o scope.resourceScopes.query matches the pattern /directory/roleDefinitions/ o scope.resourceScopes.query matches the GUID of one of the 6 privileged directory roles outlined in the Additional Information section. 3. For each review that passes the filters above, verify the following criteria: o Scoped to Eligible and Active role assignments: - scope.principalScopes.query contains /v1.0/users AND - scope.principalScopes.query contains /v1.0/groups o Recurrence is configured as monthly or more frequent: - recurrence.pattern.type is absoluteMonthly OR - recurrence.pattern.type is weekly - recurrence.range.startDate is in the past relative to the audit date o reviewers is not empty o settings.mailNotificationsEnabled is true o settings.reminderNotificationsEnabled is true o settings.justificationRequiredOnApproval is true o settings.instanceDurationInDays is less than or equal to 14 o settings.autoApplyDecisionsEnabled is true o settings.defaultDecision is None 4. The control is compliant when all 6 privileged directory roles have an associated access review definition that meets all the criteria listed above. Note: The 6 roles referenced and their associated GUIDs can be found in the Additional Information section.",
+ "AdditionalInformation": "The 6 privileged directory roles referenced in the audit and remediation procedures and their associated GUIDs are as follows: Role Name Role Definition GUID Global Administrator 62e90394-69f5-4237-9190-012177145e10 Privileged Role Administrator e8611ab8-c189-46e8-94e1-60213ab1f814 Exchange Administrator 29232cdf-9323-42fd-ade2-1d097af3e4de SharePoint Administrator f28a1f50-f6e7-4571-818b-6a12f2af6b6c Teams Administrator 69091246-20e8-4a56-aa4d-066075b2a7a8 Security Administrator 194ae4cb-b126-40b2-bd5b-6091b380977d",
+ "DefaultValue": "By default access reviews are not configured.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review:https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview:https://learn.microsoft.com/en-us/graph/api/resources/accessreviewscheduledefinition?view=graph-rest-1.0"
+ }
+ ]
+ },
+ {
+ "Id": "5.3.4",
+ "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Global Administrator role.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.3 ID Governance",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Global Administrator role.",
+ "RationaleStatement": "Requiring approval for Global Administrator role activation enhances visibility and accountability every time this highly privileged role is used. This process reduces the risk of an attacker elevating a compromised account to the highest privilege level, as any activation must first be reviewed and approved by a trusted party. Note: This only acts as protection for eligible users that are activating a role. Directly assigning a role does not require an approval workflow so therefore it is important to implement and use PIM correctly.",
+ "ImpactStatement": "Approvers do not need to be assigned the same role or be members of the same group. It's important to have at least two approvers and an emergency access (break-glass) account to prevent a scenario where no Global Administrators are available. For example, if the last active Global Administrator leaves the organization, and only eligible but inactive Global Administrators remain, a trusted approver without the Global Administrator role or an emergency access account would be essential to avoid delays in critical administrative tasks.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand ID Governance > Privileged Identity Management. 3. Under Manage select Microsoft Entra Roles. 4. Under Manage select Roles. 5. Select Global Administrator in the list. 6. Select Role settings and click Edit. 7. Check the Require approval to activate box. 8. Add at least one approver. 9. Click Update.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand ID Governance > Privileged Identity Management. 3. Under Manage select Microsoft Entra Roles. 4. Under Manage select Roles. 5. Select Global Administrator in the list. 6. Select Role settings. 7. Verify that Require approval to activate is set to Yes. 8. Verify there is at least 1 approvers in the list. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI to retrieve the policyID for the Global Administrator-role: v1.0/policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq '62e90394-69f5-4237- 9190-012177145e10'&$select=policyId 2. Execute a GET request to the following relative URI to retrieve the policy's Approval setting using the policyId from the previous call: v1.0/policies/roleManagementPolicies/{policyID}/rules/Approval_EndUser_Assign ment # Example https://graph.microsoft.com/v1.0/policies/roleManagementPolicies/DirectoryRol e_9c4d49a8-1f7a-4256-b1a2-b7cb0e7180f4_86522f3f-cfd0-4634-95a0- 38083127ca00/rules/Approval_EndUser_Assignment 3. Verify that isApprovalRequired is true. 4. Verify that approvalStages.primaryApprovers contains one or more valid users. Note: Approvers should be reviewed on a regular basis to ensure the members are active and valid.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Require approval to activate : No.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure:https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#require-approval-to-activate"
+ }
+ ]
+ },
+ {
+ "Id": "5.3.5",
+ "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Privileged Role Administrator role.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "5 Microsoft Entra admin center",
+ "SubSection": "5.3 ID Governance",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Privileged Role Administrator role.",
+ "RationaleStatement": "This role grants the ability to manage assignments for all Microsoft Entra roles including the Global Administrator role. This role does not include any other privileged abilities in Microsoft Entra ID like creating or updating users. However, users assigned to this role can grant themselves or others additional privilege by assigning additional roles. Requiring approval for activation enhances visibility and accountability every time this highly privileged role is used. This process reduces the risk of an attacker elevating a compromised account to the highest privilege level, as any activation must first be reviewed and approved by a trusted party. Note: This only acts as protection for eligible users that are activating a role. Directly assigning a role does not require an approval workflow so therefore it is important to implement and use PIM correctly.",
+ "ImpactStatement": "Requiring approvers for automatic role assignment can slightly increase administrative overhead and add delays to tasks.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand ID Governance > Privileged Identity Management. 3. Under Manage select Microsoft Entra Roles. 4. Under Manage select Roles. 5. Select Privileged Role Administrator in the list. 6. Select Role settings and click Edit. 7. Check the Require approval to activate box. 8. Add at least one approver. 9. Click Update.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand ID Governance > Privileged Identity Management. 3. Under Manage select Microsoft Entra Roles. 4. Under Manage select Roles. 5. Select Privileged Role Administrator in the list. 6. Select Role settings. 7. Verify Require approval to activate is set to Yes. 8. Verify there is at least one approvers in the list. To audit using the Microsoft Graph API: 1. Execute a GET request to the following relative URI to retrieve the policyID for the Privileged Role Administrator-role: v1.0/policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq 'e8611ab8-c189-46e8- 94e1-60213ab1f814'&$select=policyId 2. Execute a GET request to the following relative URI to retrieve the policy's Approval setting using the policyId from the previous call: v1.0/policies/roleManagementPolicies/{policyID}/rules/Approval_EndUser_Assign ment # Example https://graph.microsoft.com/v1.0/policies/roleManagementPolicies/DirectoryRol e_d1fdbf46-5729-4c53-a951-7ab677be380f_3679e0d0-412a-444d-b517- ab23973d6067/rules/Approval_EndUser_Assignment 3. Verify that isApprovalRequired is true. 4. Verify that approvalStages.primaryApprovers contains one or more valid users. Note: Approvers should be reviewed on a regular basis to ensure the members are active and valid.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Require approval to activate : No.",
+ "References": "https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure:https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#require-approval-to-activate"
+ }
+ ]
+ },
+ {
+ "Id": "6.1.1",
+ "Description": "The value False indicates that mailbox auditing on by default is turned on for the organization. Mailbox auditing on by default in the organization overrides the mailbox auditing settings on individual mailboxes. For example, if mailbox auditing is turned off for a mailbox (the AuditEnabled property on the mailbox is False), the default mailbox actions are still audited for the mailbox, because mailbox auditing on by default is turned on for the organization. Turning off mailbox auditing on by default ($true) has the following results: - Mailbox auditing is turned off for your organization. - From the time you turn off mailbox auditing on by default, no mailbox actions are audited, even if mailbox auditing is enabled on a mailbox (the AuditEnabled property on the mailbox is True). - Mailbox auditing isn't turned on for new mailboxes and setting the AuditEnabled property on a new or existing mailbox to True is ignored. - Any mailbox audit bypass association settings (configured by using the Set- MailboxAuditBypassAssociation cmdlet) are ignored. - Existing mailbox audit records are retained until the audit log age limit for the record expires. The recommended state for this setting is False at the organization level. This will enable auditing and enforce the default.",
+ "Checks": [
+ "exchange_organization_mailbox_auditing_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.1 Audit",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The value False indicates that mailbox auditing on by default is turned on for the organization. Mailbox auditing on by default in the organization overrides the mailbox auditing settings on individual mailboxes. For example, if mailbox auditing is turned off for a mailbox (the AuditEnabled property on the mailbox is False), the default mailbox actions are still audited for the mailbox, because mailbox auditing on by default is turned on for the organization. Turning off mailbox auditing on by default ($true) has the following results: - Mailbox auditing is turned off for your organization. - From the time you turn off mailbox auditing on by default, no mailbox actions are audited, even if mailbox auditing is enabled on a mailbox (the AuditEnabled property on the mailbox is True). - Mailbox auditing isn't turned on for new mailboxes and setting the AuditEnabled property on a new or existing mailbox to True is ignored. - Any mailbox audit bypass association settings (configured by using the Set- MailboxAuditBypassAssociation cmdlet) are ignored. - Existing mailbox audit records are retained until the audit log age limit for the record expires. The recommended state for this setting is False at the organization level. This will enable auditing and enforce the default.",
+ "RationaleStatement": "Enforcing the default ensures auditing was not turned off intentionally or accidentally. Auditing mailbox actions will allow forensics and IR teams to trace various malicious activities that can generate TTPs caused by inbox access and tampering.",
+ "ImpactStatement": "None - this is the default behavior as of 2019.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-OrganizationConfig -AuditDisabled $false",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-OrganizationConfig | Format-List AuditDisabled 3. Verify that AuditDisabled is set to False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "False",
+ "References": "https://learn.microsoft.com/en-us/purview/audit-mailboxes?view=o365-worldwide:https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps#-auditdisabled"
+ }
+ ]
+ },
+ {
+ "Id": "6.1.2",
+ "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level. The recommended state per mailbox is AuditEnabled to True including all default audit actions with additional actions outlined below in the audit and remediation sections. Note: Audit (Standard) licensing allows for up to 180 days log retention as of October 2023.",
+ "Checks": [
+ "exchange_user_mailbox_auditing_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.1 Audit",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level. The recommended state per mailbox is AuditEnabled to True including all default audit actions with additional actions outlined below in the audit and remediation sections. Note: Audit (Standard) licensing allows for up to 180 days log retention as of October 2023.",
+ "RationaleStatement": "Whether it is for regulatory compliance or for tracking unauthorized configuration changes in Microsoft 365, enabling mailbox auditing and ensuring the proper mailbox actions are accounted for allows for Microsoft 365 teams to run security operations, forensics or general investigations on mailbox activities. The following mailbox types ignore the organizational default and must have AuditEnabled set to True at the mailbox level in order to capture relevant audit data. - Resource Mailboxes - Public Folder Mailboxes - DiscoverySearch Mailbox",
+ "ImpactStatement": "Adding additional audit action types and increasing the AuditLogAgeLimit from 90 to 180 days will have a limited impact on mailbox storage. Mailbox audit log records are stored in a subfolder (named Audits) in the Recoverable Items folder in each user's mailbox. - Mailbox audit records count against the storage quota of the Recoverable Items folder. - Mailbox audit records also count against the folder limit for the Recoverable Items folder. A maximum of 3 million items (audit records) can be stored in the Audits subfolder. The following cmdlet in Exchange Online PowerShell can be run to display the size and number of items in the Audits subfolder in the Recoverable Items folder: Get-MailboxFolderStatistics -Identity <MailboxIdentity> -FolderScope RecoverableItems | Where-Object {$_.Name -eq 'Audits'} | Format-List FolderPath,FolderSize,ItemsInFolder Note: It's unlikely that mailbox auditing on by default impacts the storage quota or the folder limit for the Recoverable Items folder.",
+ "RemediationProcedure": "For each UserMailbox ensure AuditEnabled is True and the following audit actions are included in addition to default actions of each sign-in type. - Admin actions: Copy, FolderBind and Move. - Delegate actions: FolderBind and Move. - Owner actions: Create, MailboxLogin and Move. Note: The defaults can be found in the Default Value section and the combined total can be found in the scripts of the Audit/Remediation sections. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell script to remediate every 'UserMailbox' in the organization: $AuditAdmin = @( \"ApplyRecord\", \"Copy\", \"Create\", \"FolderBind\", \"HardDelete\", \"MailItemsAccessed\", \"Move\", \"MoveToDeletedItems\", \"SendAs\", \"SendOnBehalf\", \"Send\", \"SoftDelete\", \"Update\", \"UpdateCalendarDelegation\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) $AuditDelegate = @( \"ApplyRecord\", \"Create\", \"FolderBind\", \"HardDelete\", \"Move\", \"MailItemsAccessed\", \"MoveToDeletedItems\", \"SendAs\", \"SendOnBehalf\", \"SoftDelete\", \"Update\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) $AuditOwner = @( \"ApplyRecord\", \"Create\", \"HardDelete\", \"MailboxLogin\", \"Move\", \"MailItemsAccessed\", \"MoveToDeletedItems\", \"Send\", \"SoftDelete\", \"Update\", \"UpdateCalendarDelegation\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) $MBX = Get-EXOMailbox -ResultSize Unlimited | Where-Object { $_.RecipientTypeDetails -eq \"UserMailbox\" } $MBX | Set-Mailbox -AuditEnabled $true ` -AuditLogAgeLimit 180 -AuditAdmin $AuditAdmin -AuditDelegate $AuditDelegate ` -AuditOwner $AuditOwner 3. The script will apply the prescribed Audit Actions for each sign-in type (Owner, Delegate, Admin) and the AuditLogAgeLimit to each UserMailbox in the organization. Note: Mailboxes with Audit (Premium) licenses, which is included with E5, can retain audit logs beyond 180 days.",
+ "AuditProcedure": "Inspect each UserMailbox and ensure AuditEnabled is True and the following audit actions are included in addition to default actions of each sign-in type. - Admin actions: Copy, FolderBind and Move. - Delegate actions: FolderBind and Move. - Owner actions: Create, MailboxLogin and Move. Note: The defaults can be found in the Default Value section and the combined total can be found in the scripts of the Audit/Remediation sections. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell script: $AdminActions = @( \"ApplyRecord\", \"Copy\", \"Create\", \"FolderBind\", \"HardDelete\", \"MailItemsAccessed\", \"Move\", \"MoveToDeletedItems\", \"SendAs\", \"SendOnBehalf\", \"Send\", \"SoftDelete\", \"Update\", \"UpdateCalendarDelegation\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) $DelegateActions = @( \"ApplyRecord\", \"Create\", \"FolderBind\", \"HardDelete\", \"Move\", \"MailItemsAccessed\", \"MoveToDeletedItems\", \"SendAs\", \"SendOnBehalf\", \"SoftDelete\", \"Update\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) $OwnerActions = @( \"ApplyRecord\", \"Create\", \"HardDelete\", \"MailboxLogin\", \"Move\", \"MailItemsAccessed\", \"MoveToDeletedItems\", \"Send\", \"SoftDelete\", \"Update\", \"UpdateCalendarDelegation\", \"UpdateFolderPermissions\", \"UpdateInboxRules\" ) function VerifyActions { param ( [array]$ExpectedActions, [array]$ActualActions ) $Missing = $ExpectedActions | Where-Object { $_ -notin $ActualActions } return $Missing } $MBX = Get-EXOMailbox -PropertySets Audit, Minimum -ResultSize Unlimited | Where-Object { $_.RecipientTypeDetails -eq \"UserMailbox\" } $Results = foreach ($mailbox in $MBX) { $AdminMissing = VerifyActions -ExpectedActions $AdminActions ` -ActualActions $mailbox.AuditAdmin $DelegateMissing = VerifyActions -ExpectedActions $DelegateActions ` -ActualActions $mailbox.AuditDelegate $OwnerMissing = VerifyActions -ExpectedActions $OwnerActions ` -ActualActions $mailbox.AuditOwner $IsCompliant = $AdminMissing.Count -eq 0 -and $DelegateMissing.Count -eq 0 -and $OwnerMissing.Count -eq 0 -and $mailbox.AuditEnabled [PSCustomObject]@{ Mailbox = $mailbox.UserPrincipalName AuditEnabled = $mailbox.AuditEnabled AdminMissing = if ($AdminMissing.Count -gt 0) { $AdminMissing -join \", \" } else { \"None\" } DelegateMissing = if ($DelegateMissing.Count -gt 0) { $DelegateMissing -join \", \" } else { \"None\" } OwnerMissing = if ($OwnerMissing.Count -gt 0) { $OwnerMissing -join \", \" } else { \"None\" } ComplianceState = if ($IsCompliant) { \"Compliant\" } else { \"Non-Compliant\" } } } # Display results in table format $Results | Format-Table -AutoSize <# Optional: Export methods $Results | Out-GridView -Title \"Mailbox Audit Results\" $Results | Export-Csv -Path \"6.1.2.csv\" -NoTypeInformation $Results | ConvertTo-Json | Out-File -FilePath \"6.1.2.json\" #> 3. Inspect the results. Mailboxes will be labeled as either Compliant or Non- compliant, accompanied by supporting details that outline the missing actions for each type and the current state of AuditEnabled. Optional methods for exporting the data to CSV, JSON, or GridView are also shown at the end of the script. Note: Mailboxes with Audit (Premium) licenses, which is included with E5, can retain audit logs beyond 180 days.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AuditEnabled: True for all mailboxes except below: - Resource Mailboxes - Public Folder Mailboxes - DiscoverySearch Mailbox AuditAdmin: ApplyRecord, Create, HardDelete, MailItemsAccessed, MoveToDeletedItems, Send, SendAs, SendOnBehalf, SoftDelete, Update, UpdateCalendarDelegation, UpdateFolderPermissions, UpdateInboxRules AuditDelegate: ApplyRecord, Create, HardDelete, MailItemsAccessed, MoveToDeletedItems, SendAs, SendOnBehalf, SoftDelete, Update, UpdateFolderPermissions, UpdateInboxRules AuditOwner: ApplyRecord, HardDelete, MailItemsAccessed, MoveToDeletedItems, Send, SoftDelete, Update, UpdateCalendarDelegation, UpdateFolderPermissions, UpdateInboxRules",
+ "References": "https://learn.microsoft.com/en-us/purview/audit-mailboxes?view=o365-worldwide"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "exchange_user_mailbox_auditing_enabled",
+ "ConfigKey": "audit_log_age",
+ "Operator": "gte",
+ "Value": 90
+ }
+ ]
+ },
+ {
+ "Id": "6.1.3",
+ "Description": "When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts. Ensure AuditBypassEnabled is not enabled on accounts without a written exception.",
+ "Checks": [
+ "exchange_mailbox_audit_bypass_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.1 Audit",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts. Ensure AuditBypassEnabled is not enabled on accounts without a written exception.",
+ "RationaleStatement": "If a mailbox audit bypass association is added for an account, the account can access any mailbox in the organization to which it has been assigned access permissions, without generating any mailbox audit logging entries for such access or recording any actions taken, such as message deletions. Enabling this parameter, whether intentionally or unintentionally, could allow insiders or malicious actors to conceal their activity on specific mailboxes. Ensuring proper logging of user actions and mailbox operations in the audit log will enable comprehensive incident response and forensics.",
+ "ImpactStatement": "None - this is the default behavior.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. The following example PowerShell script will disable AuditBypass for all mailboxes which currently have it enabled: # Get mailboxes with AuditBypassEnabled set to $true $MBXAudit = Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where- Object { $_.AuditBypassEnabled -eq $true } foreach ($mailbox in $MBXAudit) { $mailboxName = $mailbox.Name Set-MailboxAuditBypassAssociation -Identity $mailboxName - AuditBypassEnabled $false Write-Host \"Audit Bypass disabled for mailbox Identity: $mailboxName\" - ForegroundColor Green }",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: $MBXData = Get-MailboxAuditBypassAssociation -ResultSize unlimited $Report = $MBXData | ? {$_.AuditBypassEnabled -eq $true} | select Name,AuditBypassEnabled $Report <# Optional: Export methods $Report | Out-GridView -Title \"Mailbox Audit Bypass Association\" $Report | Export-Csv -Path \"6.1.3.csv\" -NoTypeInformation #> 3. If nothing is returned, then there are no accounts with Audit Bypass enabled. Note: The cmdlet Get-MailboxAuditBypassAssociation may display a WARNING on system objects that begin with \"Asc-2X1\", this is not part of the Audit procedure and can be ignored.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AuditBypassEnabled False",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/exchange/get-mailboxauditbypassassociation?view=exchange-ps"
+ }
+ ]
+ },
+ {
+ "Id": "6.2.1",
+ "Description": "Exchange Online offers several methods of managing the flow of email messages. These are Remote domain, Transport Rules, and Anti-spam outbound policies. These methods work together to provide comprehensive coverage for potential automatic forwarding channels: - Outlook forwarding using inbox rules. - Outlook forwarding configured using OOF rule. - OWA forwarding setting (ForwardingSmtpAddress). - Forwarding set by the admin using EAC (ForwardingAddress). - Forwarding using Power Automate / Flow. Ensure a Transport rule and Anti-spam outbound policy are used to block mail forwarding. NOTE: Any exclusions should be implemented based on organizational policy.",
+ "Checks": [
+ "exchange_transport_rules_mail_forwarding_disabled",
+ "defender_antispam_outbound_policy_forwarding_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.2 Mail flow",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Exchange Online offers several methods of managing the flow of email messages. These are Remote domain, Transport Rules, and Anti-spam outbound policies. These methods work together to provide comprehensive coverage for potential automatic forwarding channels: - Outlook forwarding using inbox rules. - Outlook forwarding configured using OOF rule. - OWA forwarding setting (ForwardingSmtpAddress). - Forwarding set by the admin using EAC (ForwardingAddress). - Forwarding using Power Automate / Flow. Ensure a Transport rule and Anti-spam outbound policy are used to block mail forwarding. NOTE: Any exclusions should be implemented based on organizational policy.",
+ "RationaleStatement": "Attackers often create these rules to exfiltrate data from your tenancy, this could be accomplished via access to an end-user account or otherwise. An insider could also use one of these methods as a secondary channel to exfiltrate sensitive data.",
+ "ImpactStatement": "Care should be taken before implementation to ensure there is no business need for case-by-case auto-forwarding. Disabling auto-forwarding to remote domains will affect all users in an organization. Any exclusions should be implemented based on organizational policy.",
+ "RemediationProcedure": "Note: Remediation is a two step procedure as follows: STEP 1: Transport rules To remediate using the UI: 1. Select Exchange to open the Exchange admin center. 2. Select Mail Flow then Rules. 3. For each rule that redirects email to external domains, select the rule and click the 'Delete' icon. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Remove-TransportRule {RuleName} STEP 2: Anti-spam outbound policy To remediate using the UI: 1. Navigate to Microsoft 365 Defender https://security.microsoft.com/ 2. Expand E-mail & collaboration then select Policies & rules. 3. Select Threat policies > Anti-spam. 4. Select Anti-spam outbound policy (default) 5. Click Edit protection settings 6. Set Automatic forwarding rules dropdown to Off - Forwarding is disabled and click Save 7. Repeat steps 4-6 for any additional higher priority, custom policies. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-HostedOutboundSpamFilterPolicy -Identity {policyName} -AutoForwardingMode Off 3. To remove AutoForwarding from all outbound policies you can also run: Get-HostedOutboundSpamFilterPolicy | Set-HostedOutboundSpamFilterPolicy - AutoForwardingMode Off",
+ "AuditProcedure": "Note: Audit is a two step procedure as follows: STEP 1: Transport rules To audit using the UI: 1. Select Exchange to open the Exchange admin center. 2. Select Mail Flow then Rules. 3. Review the rules and verify that none of them are forwards or redirects e-mail to external domains. To audit using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. Run the following PowerShell command to review the Transport Rules that are redirecting email: Get-TransportRule | Where-Object {$_.RedirectMessageTo -ne $null} | ft Name,RedirectMessageTo 3. Verify that none of the addresses listed belong to external domains outside of the organization. If nothing returns then there are no transport rules set to redirect messages. STEP 2: Anti-spam outbound policy To audit using the UI: 1. Navigate to Microsoft 365 Defender https://security.microsoft.com/ 2. Expand E-mail & collaboration then select Policies & rules. 3. Select Threat policies > Anti-spam. 4. Inspect Anti-spam outbound policy (default) and ensure Automatic forwarding is set to Off - Forwarding is disabled 5. Inspect any additional custom outbound policies and ensure Automatic forwarding is set to Off - Forwarding is disabled, in accordance with the organization's exclusion policies. To audit using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. Run the following PowerShell cmdlet: Get-HostedOutboundSpamFilterPolicy | ft Name, AutoForwardingMode 3. In each outbound policy verify AutoForwardingMode is Off. Note: According to Microsoft if a recipient is defined in multiple policies of the same type (anti-spam, anti-phishing, etc.), only the policy with the highest priority is applied to the recipient. Any remaining policies of that type are not evaluated for the recipient (including the default policy). However, it is our recommendation to audit the default policy as well in the case a higher priority custom policy is removed. This will keep the organization's security posture strong.",
+ "AdditionalInformation": "",
+ "DefaultValue": "",
+ "References": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules:https://techcommunity.microsoft.com/t5/exchange-team-blog/all-you-need-to-know-about-automatic-email-forwarding-in/ba-p/2074888#:~:text=%20%20%20Automatic%20forwarding%20option%20%20,%:https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "6.2.2",
+ "Description": "Mail flow rules (transport rules) in Exchange Online can be configured to set the spam confidence level (SCL) of a message to -1, which bypasses spam and phishing filtering. When a rule applies this action to messages based on the sender's domain, all mail from that domain is treated as trusted and skips anti-malware and anti-phishing evaluation regardless of message content.",
+ "Checks": [
+ "exchange_transport_rules_whitelist_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.2 Mail flow",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Mail flow rules (transport rules) in Exchange Online can be configured to set the spam confidence level (SCL) of a message to -1, which bypasses spam and phishing filtering. When a rule applies this action to messages based on the sender's domain, all mail from that domain is treated as trusted and skips anti-malware and anti-phishing evaluation regardless of message content.",
+ "RationaleStatement": "Whitelisting domains in transport rules bypasses regular malware and phishing scanning, which can enable an attacker to launch attacks against your users from a safe haven domain. Note: If an organization identifies a business need for an exception, the domain should only be whitelisted if inbound emails from that domain originate from a specific IP address. These exceptions should be documented and regularly reviewed.",
+ "ImpactStatement": "Removing SCL bypass rules will subject previously whitelisted domains to standard spam and phishing filtering. Mail from those domains that does not pass filtering may be quarantined or rejected, which could disrupt established business communications. Prior to removal, identify any rules in scope and coordinate with affected business owners. If a legitimate need exists, consider replacing domain-based whitelisting with approved sender lists at the connection level.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com 2. Click to expand Mail Flow and then select Rules. 3. For each rule that sets the spam confidence level to -1 for a specific domain, select the rule and click Delete. To remediate using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. To remove a specific non-compliant rule: Remove-TransportRule -Identity \"RuleName\" Note: If the rule serves a legitimate purpose beyond domain whitelisting, consider modifying it to remove the SenderDomainIs condition or the SetSCL -1 action rather than deleting it entirely.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com 2. Click to expand Mail Flow and then select Rules. 3. Review each rule and ensure that a single rule does not contain both of these properties together: o Under Apply this rule if: Sender's address domain portion belongs to any of these domains: '<domain>' o Under Do the following: Set the spam confidence level (SCL) to '-1' Note: Setting the spam confidence level to -1 indicates the message is from a trusted sender, so the message bypasses spam filtering. The recommendation fails if any external domain has a SCL of -1. To audit using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-TransportRule | Where-Object { $_.setscl -eq -1 -and $_.SenderDomainIs - ne $null } | ft Name,SenderDomainIs,SetSCL 3. Transport rules that fail the audit will be shown. If no output is shown, the recommendation passes. To pass, all rules with SetSCL set to -1 must not include any domains in the SenderDomainIs property.",
+ "AdditionalInformation": "",
+ "DefaultValue": "No mail flow rules that set the SCL to -1 based on sender domain exist by default.",
+ "References": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/configuration-best-practices:https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules"
+ }
+ ]
+ },
+ {
+ "Id": "6.2.3",
+ "Description": "External callouts provide a native experience to identify emails from senders outside the organization. This is achieved by presenting a new tag on emails called \"External\" (the string is localized based on the client language setting) and exposing related user interface at the top of the message reading view to see and verify the real sender's email address. The recommended state is ExternalInOutlook set to Enabled True",
+ "Checks": [
+ "exchange_external_email_tagging_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.2 Mail flow",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "External callouts provide a native experience to identify emails from senders outside the organization. This is achieved by presenting a new tag on emails called \"External\" (the string is localized based on the client language setting) and exposing related user interface at the top of the message reading view to see and verify the real sender's email address. The recommended state is ExternalInOutlook set to Enabled True",
+ "RationaleStatement": "Tagging emails from external senders helps to inform end users about the origin of the email. This can allow them to proceed with more caution and make informed decisions when it comes to identifying spam or phishing emails. Mail flow rules are often used by Exchange administrators to accomplish the External email tagging by appending a tag to the front of a subject line. There are limitations to this outlined here. The preferred method in the CIS Benchmark is to use the native experience. Note: Existing emails in a user's inbox from external senders are not tagged retroactively.",
+ "ImpactStatement": "Mail flow rules using external tagging must be disabled, along with third-party mail filtering tools that offer similar features, to avoid duplicate [External] tags. External tags can consume additional screen space on systems with limited real estate, such as thin clients or mobile devices. After enabling this feature via PowerShell, it may take 24-48 hours for users to see the External sender tag in emails from outside your organization. Rolling back the feature takes the same amount of time. Note: Third-party tools that provide similar functionality will also meet compliance requirements, although Microsoft recommends using the native experience for better interoperability.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-ExternalInOutlook -Enabled $true",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-ExternalInOutlook 3. For each identity verify Enabled is set to True and the AllowList only contains email addresses the organization has permitted to bypass external tagging.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled (False)",
+ "References": "https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098:https://learn.microsoft.com/en-us/powershell/module/exchange/set-externalinoutlook?view=exchange-ps"
+ }
+ ]
+ },
+ {
+ "Id": "6.3.1",
+ "Description": "Role assignment policies in Exchange Online control whether users can install and manage add-ins for Outlook. Three management roles govern this capability: My Custom Apps allows users to sideload custom add-ins, My Marketplace Apps allows users to install add-ins from the marketplace, and My ReadWriteMailbox Apps allows users to install add-ins that request read/write mailbox permissions. When these roles are assigned to a user's role assignment policy, users can self-install add-ins in both Outlook desktop and Outlook on the web, granting those add-ins access to mailbox data. This recommendation applies to the default role assignment policy, which is automatically assigned to new mailboxes unless a custom policy is specified.",
+ "Checks": [
+ "exchange_roles_assignment_policy_addins_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.3 Roles",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Role assignment policies in Exchange Online control whether users can install and manage add-ins for Outlook. Three management roles govern this capability: My Custom Apps allows users to sideload custom add-ins, My Marketplace Apps allows users to install add-ins from the marketplace, and My ReadWriteMailbox Apps allows users to install add-ins that request read/write mailbox permissions. When these roles are assigned to a user's role assignment policy, users can self-install add-ins in both Outlook desktop and Outlook on the web, granting those add-ins access to mailbox data. This recommendation applies to the default role assignment policy, which is automatically assigned to new mailboxes unless a custom policy is specified.",
+ "RationaleStatement": "Attackers exploit vulnerable or malicious add-ins to read, exfiltrate, or modify mailbox content including email, calendar items, and contacts. Restricting user-installed add-ins reduces this attack surface and centralizes add-in approval with administrators.",
+ "ImpactStatement": "End users will be unable to self-install third-party Outlook add-ins. Administrators may receive requests to evaluate and deploy add-ins on behalf of users. Organizations that rely on user-deployed add-ins for business workflows should inventory those add-ins and deploy them centrally via Centralized Deployment before implementing this recommendation.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com. 2. Click to expand Roles and select User roles. 3. Select Default Role Assignment Policy. 4. In the properties pane on the right click on Manage permissions. 5. Under Other roles uncheck any non-compliant roles: My Custom Apps, My Marketplace Apps, and My ReadWriteMailbox Apps. 6. Click Save changes. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following script: $TargetRoles = @( \"My Custom Apps\", \"My Marketplace Apps\", \"My ReadWriteMailbox Apps\" ) $DefaultPolicy = Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault -eq $true } $Assignments = Get-ManagementRoleAssignment -RoleAssignee $DefaultPolicy.Identity | Where-Object { $_.Role -in $TargetRoles } foreach ($Assignment in $Assignments) { Remove-ManagementRoleAssignment -Identity $Assignment.Identity - Confirm:$false }",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com. 2. Expand Roles and select User roles. 3. Select Default Role Assignment Policy. 4. In the properties pane on the right click on Manage permissions. 5. Under Other roles verify that My Custom Apps, My Marketplace Apps, and My ReadWriteMailbox Apps are not checked. Note: As of this release of the Benchmark the manage permissions link no longer displays anything when a user assigned the Global Reader role clicks on it. As an alternative, users assigned the Global Reader directory role can inspect the Roles column or use the PowerShell method to perform the audit. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following script: $RoleList = @( \"My Custom Apps\", \"My Marketplace Apps\", \"My ReadWriteMailbox Apps\" ) $DefaultPolicy = Get-RoleAssignmentPolicy | Where-Object { $_.IsDefault -eq $true } $NonCompliantRoles = $DefaultPolicy.AssignedRoles | Where-Object { $_ -in $RoleList } Write-Host \"Checking Default Role Assignment Policy: $($DefaultPolicy.Name)\" if ($NonCompliantRoles) { \"Non-compliant - the following roles are assigned: \" + ($NonCompliantRoles -join \", \") } else { \"Compliant - no add-in roles are assigned to the default policy.\" } 3. Verify that the output indicates compliance. If My Custom Apps, My Marketplace Apps, or My ReadWriteMailbox Apps are listed, the default policy is non-compliant.",
+ "AdditionalInformation": "",
+ "DefaultValue": "UI - My Custom Apps, My Marketplace Apps, and My ReadWriteMailbox Apps are checked. PowerShell - My Custom Apps, My Marketplace Apps, and My ReadWriteMailbox Apps are assigned.",
+ "References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/specify-who-can-install-and-manage-add-ins?source=recommendations:https://learn.microsoft.com/en-us/exchange/permissions-exo/role-assignment-policies"
+ }
+ ]
+ },
+ {
+ "Id": "6.3.2",
+ "Description": "Outlook on the web (OWA) mailbox policies include two settings that control personal account integration in Outlook. PersonalAccountsEnabled controls whether users can add personal email accounts (e.g., Outlook.com, Gmail, Yahoo) in the new Outlook for Windows. PersonalAccountCalendarsEnabled controls whether users can connect personal Outlook.com or Google calendars in Outlook on the web. Neither setting applies to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps. The recommended state for the default OWA Mailbox Policy is: - PersonalAccountsEnabled is set to False - PersonalAccountCalendarsEnabled is set to False",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.3 Roles",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Outlook on the web (OWA) mailbox policies include two settings that control personal account integration in Outlook. PersonalAccountsEnabled controls whether users can add personal email accounts (e.g., Outlook.com, Gmail, Yahoo) in the new Outlook for Windows. PersonalAccountCalendarsEnabled controls whether users can connect personal Outlook.com or Google calendars in Outlook on the web. Neither setting applies to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps. The recommended state for the default OWA Mailbox Policy is: - PersonalAccountsEnabled is set to False - PersonalAccountCalendarsEnabled is set to False",
+ "RationaleStatement": "Personal email accounts are not subject to corporate security controls such as anti- malware scanning, data loss prevention (DLP), Safe Links, or audit logging. Allowing personal accounts alongside the corporate mailbox enables side-channel data exfiltration (e.g., forwarding sensitive content to a personal inbox) and creates an ingress path for malware and phishing payloads that bypass tenant mail-flow protections.",
+ "ImpactStatement": "This control does not apply to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps. Organizations requiring broader coverage should evaluate additional controls like application management policies to restrict personal account usage on those clients. This also does not block users from accessing personal accounts via other email clients or web browsers. Changes to OWA mailbox policies may take up to 60 minutes to take effect. If users previously added personal accounts before this policy was applied, those accounts will be disabled once the policy is detected, and affected users will see a message advising them to remove the personal account from Outlook, which may generate helpdesk inquiries. The audit only applies to the default OWA mailbox policy. Users assigned to a non- default OWA mailbox policy are not covered; optionally, custom policies can be reviewed separately to ensure a level of enforcement beyond the compliance requirements of this control.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following: $DefaultPolicy = Get-OwaMailboxPolicy | Where-Object { $_.IsDefault } Set-OwaMailboxPolicy -Identity $DefaultPolicy.Identity - PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false",
+ "AuditProcedure": "Note: The default OWA Mailbox Policy is the only policy required for compliance with this control. Other mailbox policies are discretionary and left up to the organization to audit as needed. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following: Get-OwaMailboxPolicy | Where-Object { $_.IsDefault } | Format-List PersonalAccountsEnabled, PersonalAccountCalendarsEnabled 3. Verify the output matches the following: PersonalAccountsEnabled : False PersonalAccountCalendarsEnabled : False",
+ "AdditionalInformation": "",
+ "DefaultValue": "- PersonalAccountsEnabled is True. - PersonalAccountCalendarsEnabled is True.",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-owamailboxpolicy?view=exchange-ps#-personalaccountsenabled:https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/get-started/supported-account-types#prevent-adding-personal-accounts:https://learn.microsoft.com/en-us/microsoft-365-apps/outlook/manage/policy-management"
+ }
+ ]
+ },
+ {
+ "Id": "6.5.1",
+ "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers. When you enable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use modern authentication to log in to Microsoft 365 mailboxes. When you disable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use basic authentication to log in to Microsoft 365 mailboxes. When users initially configure certain email clients, like Outlook 2013 and Outlook 2016, they may be required to authenticate using enhanced authentication mechanisms, such as multifactor authentication. Other Outlook clients that are available in Microsoft 365 (for example, Outlook Mobile and Outlook for Mac 2016) always use modern authentication to log in to Microsoft 365 mailboxes.",
+ "Checks": [
+ "exchange_organization_modern_authentication_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.5 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers. When you enable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use modern authentication to log in to Microsoft 365 mailboxes. When you disable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use basic authentication to log in to Microsoft 365 mailboxes. When users initially configure certain email clients, like Outlook 2013 and Outlook 2016, they may be required to authenticate using enhanced authentication mechanisms, such as multifactor authentication. Other Outlook clients that are available in Microsoft 365 (for example, Outlook Mobile and Outlook for Mac 2016) always use modern authentication to log in to Microsoft 365 mailboxes.",
+ "RationaleStatement": "Strong authentication controls, such as the use of multifactor authentication, may be circumvented if basic authentication is used by Exchange Online email clients such as Outlook 2016 and Outlook 2013. Enabling modern authentication for Exchange Online ensures strong authentication mechanisms are used when establishing sessions between email clients and Exchange Online.",
+ "ImpactStatement": "Users of older email clients, such as Outlook 2013 and Outlook 2016, will no longer be able to authenticate to Exchange using Basic Authentication, which will necessitate migration to modern authentication practices.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings and select Org Settings. 3. Select Modern authentication. 4. Check Turn on modern authentication for Outlook 2013 for Windows and later (recommended) to enable modern authentication. To remediate using PowerShell: 1. Run the Microsoft Exchange Online PowerShell Module. 2. Connect to Exchange Online using Connect-ExchangeOnline. 3. Run the following PowerShell command: Set-OrganizationConfig -OAuth2ClientProfileEnabled $True",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft 365 admin center https://admin.microsoft.com. 2. Expand Settings and select Org Settings. 3. Select Modern authentication. 4. Verify that Turn on modern authentication for Outlook 2013 for Windows and later (recommended) is checked. To audit using PowerShell: 1. Run the Microsoft Exchange Online PowerShell Module. 2. Connect to Exchange Online using Connect-ExchangeOnline. 3. Run the following PowerShell command: Get-OrganizationConfig | Format-Table -Auto Name, OAuth* 4. Verify that OAuth2ClientProfileEnabled is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "True",
+ "References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online"
+ }
+ ]
+ },
+ {
+ "Id": "6.5.2",
+ "Description": "MailTips are informative messages displayed to users while they're composing a message. While a new message is open and being composed, Exchange analyzes the message (including recipients). If a potential problem is detected, the user is notified with a MailTip prior to sending the message. Using the information in the MailTip, the user can adjust the message to avoid undesirable situations or non-delivery reports (also known as NDRs or bounce messages).",
+ "Checks": [
+ "exchange_organization_mailtips_enabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.5 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "MailTips are informative messages displayed to users while they're composing a message. While a new message is open and being composed, Exchange analyzes the message (including recipients). If a potential problem is detected, the user is notified with a MailTip prior to sending the message. Using the information in the MailTip, the user can adjust the message to avoid undesirable situations or non-delivery reports (also known as NDRs or bounce messages).",
+ "RationaleStatement": "Setting up MailTips gives a visual aid to users when they send emails to large groups of recipients or send emails to recipients not within the tenant.",
+ "ImpactStatement": "Not applicable.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: $TipsParams = @{ MailTipsAllTipsEnabled = $true MailTipsExternalRecipientsTipsEnabled = $true MailTipsGroupMetricsEnabled = $true MailTipsLargeAudienceThreshold = '25' } Set-OrganizationConfig @TipsParams",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-OrganizationConfig | fl MailTips* 3. Verify the values for MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, and MailTipsGroupMetricsEnabled are set to True and MailTipsLargeAudienceThreshold is set to an acceptable value; 25 is the default value.",
+ "AdditionalInformation": "",
+ "DefaultValue": "MailTipsAllTipsEnabled: True MailTipsExternalRecipientsTipsEnabled: False MailTipsGroupMetricsEnabled: True MailTipsLargeAudienceThreshold: 25",
+ "References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips:https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps"
+ }
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "exchange_organization_mailtips_enabled",
+ "ConfigKey": "recommended_mailtips_large_audience_threshold",
+ "Operator": "lte",
+ "Value": 25
+ }
+ ]
+ },
+ {
+ "Id": "6.5.3",
+ "Description": "This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that Microsoft doesn't control the use terms or privacy policies of those third-party services. Ensure AdditionalStorageProvidersAvailable is restricted on the default OWA policy.",
+ "Checks": [
+ "exchange_mailbox_policy_additional_storage_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.5 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that Microsoft doesn't control the use terms or privacy policies of those third-party services. Ensure AdditionalStorageProvidersAvailable is restricted on the default OWA policy.",
+ "RationaleStatement": "By default, additional storage providers are allowed in Office on the Web (such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.). This could lead to information leakage and additional risk of infection from organizational non-trusted storage providers. Restricting this will inherently reduce risk as it will narrow opportunities for infection and data leakage.",
+ "ImpactStatement": "The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default - AdditionalStorageProvidersAvailable $false",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command to audit the default OWA policy: Get-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default | fl AdditionalStorageProvidersAvailable 3. Verify that AdditionalStorageProvidersAvailable is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AdditionalStorageProvidersAvailable : True",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/exchange/set-owamailboxpolicy?view=exchange-ps:https://support.microsoft.com/en-us/topic/3rd-party-cloud-storage-services-supported-by-office-apps-fce12782-eccc-4cf5-8f4b-d1ebec513f72"
+ }
+ ]
+ },
+ {
+ "Id": "6.5.4",
+ "Description": "This setting enables or disables authenticated client SMTP submission (SMTP AUTH) at an organization level in Exchange Online. The recommended state is Turn off SMTP AUTH protocol for your organization (checked).",
+ "Checks": [
+ "exchange_transport_config_smtp_auth_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.5 Settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting enables or disables authenticated client SMTP submission (SMTP AUTH) at an organization level in Exchange Online. The recommended state is Turn off SMTP AUTH protocol for your organization (checked).",
+ "RationaleStatement": "SMTP AUTH is a legacy protocol. Disabling it at the organization level supports the principle of least functionality and serves to further back additional controls that block legacy protocols, such as in Conditional Access. Virtually all modern email clients that connect to Exchange Online mailboxes in Microsoft 365 can do so without using SMTP AUTH.",
+ "ImpactStatement": "This enforces the default behavior, so no impact is expected unless the organization is using it globally. A per-mailbox setting exists that overrides the tenant-wide setting, allowing an individual mailbox SMTP AUTH capability for special cases.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com. 2. Expand Settings and select Mail flow. 3. Check Turn off SMTP AUTH protocol for your organization to disable the protocol. To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-TransportConfig -SmtpClientAuthenticationDisabled $true",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Exchange admin center https://admin.exchange.microsoft.com. 2. Expand Settings and select Mail flow. 3. Ensure Turn off SMTP AUTH protocol for your organization is checked. To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled 3. Verify that the value returned is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "SmtpClientAuthenticationDisabled : True",
+ "References": "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission"
+ }
+ ]
+ },
+ {
+ "Id": "6.5.5",
+ "Description": "Direct Send is a method used to send emails directly to an Exchange Online customer's hosted mailboxes from on-premises devices, applications, or third-party cloud services using the customer's own accepted domain. This method does not require any form of authentication because, by its nature, it mimics incoming anonymous emails from the internet, apart from the sender domain. The recommended state is to configure RejectDirectSend to True.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "6 Exchange admin center",
+ "SubSection": "6.5 Settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Direct Send is a method used to send emails directly to an Exchange Online customer's hosted mailboxes from on-premises devices, applications, or third-party cloud services using the customer's own accepted domain. This method does not require any form of authentication because, by its nature, it mimics incoming anonymous emails from the internet, apart from the sender domain. The recommended state is to configure RejectDirectSend to True.",
+ "RationaleStatement": "Direct Send allows devices and applications to transmit unauthenticated email directly to Exchange Online. While this method may support legacy systems such as printers or scanners, it introduces significant security risks: - Unauthenticated Email Delivery: Direct Send does not require authentication, making it an attractive vector for threat actors to deliver spoofed or malicious emails that appear to originate from trusted internal sources. - Phishing and Spoofing Risks: Because these emails bypass standard authentication mechanisms, they can easily impersonate internal users or services, increasing the likelihood of successful phishing attacks. - Lack of Visibility and Control: Emails sent via Direct Send may not be subject to the same security policies, logging, or filtering as authenticated traffic, reducing the organization's ability to monitor and respond to threats effectively. Threat research from Varonis has shown that attackers are actively exploiting Direct Send to impersonate internal accounts and distribute malicious content without needing to compromise any credentials. These campaigns have successfully targeted organizations by leveraging predictable infrastructure and public user data to craft convincing phishing emails. Because these messages originate from outside the tenant but appear internal, they often evade detection and filtering mechanisms.",
+ "ImpactStatement": "Per Microsoft, there is a forwarding scenario that could be affected by this feature. It is possible that someone in your organization sends a message to a 3rd party and they in turn forward it to another mailbox in your organization. If the 3rd party's email provider does not support Sender Rewriting Scheme (SRS), the message will return with the original sender's address. Prior to this feature being enabled, those messages will already be punished by SPF failing but could still end up in inboxes. Enabling the Reject Direct Send feature without a partner mail flow connector being set up will lead to these messages being rejected outright.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Set-OrganizationConfig -RejectDirectSend $true",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: Get-OrganizationConfig | fl RejectDirectSend 3. Verify that the value returned for RejectDirectSend is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "RejectDirectSend : False",
+ "References": "https://techcommunity.microsoft.com/blog/exchange/introducing-more-control-over-direct-send-in-exchange-online/4408790?WT.mc_id=M365-MVP-9501:https://techcommunity.microsoft.com/blog/exchange/direct-send-vs-sending-directly-to-an-exchange-online-tenant/4439865:https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps:https://www.varonis.com/blog/direct-send-exploit:https://techcommunity.microsoft.com/discussions/microsoft-365/disable-direct-send-in-exchange-online-to-mitigate-ongoing-phishing-threats/4434649"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.1",
+ "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers.",
+ "Checks": [
+ "sharepoint_modern_authentication_required"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers.",
+ "RationaleStatement": "Strong authentication controls, such as the use of multifactor authentication, may be circumvented if basic authentication is used by SharePoint applications. Requiring modern authentication for SharePoint applications ensures strong authentication mechanisms are used when establishing sessions between these applications, SharePoint, and connecting users.",
+ "ImpactStatement": "Implementation of modern authentication for SharePoint will require users to authenticate to SharePoint using modern authentication. This may cause a minor impact to typical user behavior. This may also prevent third-party apps from accessing SharePoint Online resources. Also, this will also block apps using the SharePointOnlineCredentials class to access SharePoint Online resources.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint. 2. Expand Policies and select Access control. 3. Select Apps that don't use modern authentication. 4. Select the radio button for Block access. 5. Click Save. To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com replacing tenant with your value. 2. Run the following SharePoint Online PowerShell command: Set-SPOTenant -LegacyAuthProtocolsEnabled $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint. 2. Expand Policies and select Access control. 3. Select Apps that don't use modern authentication and ensure that it is set to Block access. To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com replacing tenant with your value. 2. Run the following SharePoint Online PowerShell command: Get-SPOTenant | ft LegacyAuthProtocolsEnabled 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "True (Apps that don't use modern authentication are allowed)",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.2",
+ "Description": "Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams. Note: Global Reader role currently can't access SharePoint using PowerShell.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams. Note: Global Reader role currently can't access SharePoint using PowerShell.",
+ "RationaleStatement": "External users assigned guest accounts will be subject to Entra ID access policies, such as multi-factor authentication. This provides a way to manage guest identities and control access to SharePoint and OneDrive resources. Without this integration, files can be shared without account registration, making it more challenging to audit and manage who has access to the organization's data.",
+ "ImpactStatement": "After enabling Microsoft Entra B2B integration, external users attempting to access previously shared links (One Time Passcode) will encounter access issues. They receive error 'This organization has updated its guest access settings'. To restore access, your users need to reshare files/folders/sites to external users.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService 2. Run the following command: Set-SPOTenant -EnableAzureADB2BIntegration $true",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService 2. Run the following command: Get-SPOTenant | ft EnableAzureADB2BIntegration 3. Verify that the returned value is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "False",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration#enabling-the-integration:https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b:https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.3",
+ "Description": "The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization. The new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization's directory, and they can send invitations to people who will be added to the directory if they sign in. The recommended state is New and existing guests or less permissive.",
+ "Checks": [
+ "sharepoint_external_sharing_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization. The new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization's directory, and they can send invitations to people who will be added to the directory if they sign in. The recommended state is New and existing guests or less permissive.",
+ "RationaleStatement": "Forcing guest authentication on the organization's tenant enables the implementation of controls and oversight over external file sharing. When a guest is registered with the organization, they now have an identity which can be accounted for. This identity can also have other restrictions applied to it through group membership and conditional access rules.",
+ "ImpactStatement": "When using B2B integration, Entra ID external collaboration settings, such as guest invite settings and collaboration restrictions apply.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. Under SharePoint, move the slider bar to New and existing guests or a less permissive level. o OneDrive will also be moved to the same level and can never be more permissive than SharePoint. To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet to establish the minimum recommended state: Set-SPOTenant -SharingCapability ExternalUserSharingOnly Note: Other acceptable values for this parameter that are more restrictive include: Disabled and ExistingExternalUserSharingOnly.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. Under SharePoint, verify that the slider bar is set to New and existing guests or a less permissive level. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Get-SPOTenant | fl SharingCapability 3. Verify that SharingCapability is set to one of the following values: o ExternalUserSharingOnly o ExistingExternalUserSharingOnly o Disabled",
+ "AdditionalInformation": "",
+ "DefaultValue": "Anyone (ExternalUserAndGuestSharing)",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off:https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.4",
+ "Description": "This setting governs the global permissiveness of OneDrive content sharing in the organization. OneDrive content sharing can be restricted independent of SharePoint but can never be more permissive than the level established with SharePoint. The recommended state is Only people in your organization.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting governs the global permissiveness of OneDrive content sharing in the organization. OneDrive content sharing can be restricted independent of SharePoint but can never be more permissive than the level established with SharePoint. The recommended state is Only people in your organization.",
+ "RationaleStatement": "OneDrive, designed for end-user cloud storage, inherently provides less oversight and control compared to SharePoint, which often involves additional content overseers or site administrators. This autonomy can lead to potential risks such as inadvertent sharing of privileged information by end users. Restricting external OneDrive sharing will require users to transfer content to SharePoint folders first which have those tighter controls.",
+ "ImpactStatement": "Users will be required to take additional steps to share OneDrive content or use other official channels.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. Under OneDrive, set the slider bar to Only people in your organization. To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Set-SPOTenant -OneDriveSharingCapability Disabled Alternative remediation method using PowerShell: 1. Connect to SharePoint Online. 2. Run one of the following: # Replace [tenant] with your tenant id Set-SPOSite -Identity https://[tenant]-my.sharepoint.com/ -SharingCapability Disabled # Or run this to filter to the specific site without supplying the tenant name. $OneDriveSite = Get-SPOSite -Filter { Url -like \"*-my.sharepoint.com/\" } Set-SPOSite -Identity $OneDriveSite -SharingCapability Disabled",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. Under OneDrive, verify that the slider bar is set to Only people in your organization. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Get-SPOTenant | fl OneDriveSharingCapability 3. Verify that the returned value is Disabled. Alternative audit method using PowerShell: 1. Connect to SharePoint Online. 2. Use one of the following methods: # Replace [tenant] with your tenant id Get-SPOSite -Identity https://[tenant]-my.sharepoint.com/ | fl Url,SharingCapability # Or run this to filter to the specific site without supplying the tenant name. $OneDriveSite = Get-SPOSite -Filter { Url -like \"*-my.sharepoint.com/\" } Get-SPOSite -Identity $OneDriveSite | fl Url,SharingCapability 2. Verify that the returned value for SharingCapability is Disabled Note: As of March 2024, using Get-SPOSite with Where-Object or filtering against the entire site and then returning the SharingCapability parameter can result in a different value as opposed to running the cmdlet specifically against the OneDrive specific site using the -Identity switch as shown in the example. Note 2: The parameter OneDriveSharingCapability may not be yet fully available in all tenants. It is demonstrated in official Microsoft documentation as linked in the references section but not in the Set-SPOTenant cmdlet itself. If the parameter is unavailable, then either use the UI method or alternative PowerShell audit method.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Anyone (ExternalUserAndGuestSharing)",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps#-onedrivesharingcapability"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.5",
+ "Description": "SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.",
+ "Checks": [
+ "sharepoint_guest_sharing_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.",
+ "RationaleStatement": "Sharing and collaboration are key; however, file, folder, or site collection owners should have the authority over what external users get shared with to prevent unauthorized disclosures of information.",
+ "ImpactStatement": "The impact associated with this change is highly dependent upon current practices. If users do not regularly share with external parties, then minimal impact is likely. However, if users do regularly share with guests/externally, minimum impacts could occur as those external users will be unable to 're-share' content.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Expand More external sharing settings, uncheck Allow guests to share items they don't own. 4. Click Save. To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following SharePoint Online PowerShell command: Set-SPOTenant -PreventExternalUsersFromResharing $True",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Expand More external sharing settings, verify that Allow guests to share items they don't own is unchecked. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following SharePoint Online PowerShell command: Get-SPOTenant | ft PreventExternalUsersFromResharing 3. Verify that the returned value is True.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Checked (False)",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off:https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.6",
+ "Description": "The external sharing features of SharePoint and OneDrive let users in the organization share content with people outside the organization (such as partners, vendors, clients, or customers). It can also be used to share between licensed users on multiple Microsoft 365 subscriptions if your organization has more than one subscription. The recommended state is Limit external sharing by domain > Allow only specific domains",
+ "Checks": [
+ "sharepoint_external_sharing_managed"
+ ],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "The external sharing features of SharePoint and OneDrive let users in the organization share content with people outside the organization (such as partners, vendors, clients, or customers). It can also be used to share between licensed users on multiple Microsoft 365 subscriptions if your organization has more than one subscription. The recommended state is Limit external sharing by domain > Allow only specific domains",
+ "RationaleStatement": "Attackers will often attempt to expose sensitive information to external entities through sharing, and restricting the domains that users can share documents with will reduce that surface area.",
+ "ImpactStatement": "Users will be unable to initiate new shares with parties whose domains are not on the approved allowlist, which may require administrative action before collaboration with new partners or vendors can begin. Administrators must keep the allowlist current to reflect active business relationships; an outdated list can block legitimate sharing and generate support requests. Note that existing shares to domains not on the allowlist are not revoked when this setting is configured.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint. 2. Expand Policies > Sharing. 3. Expand More external sharing settings and check Limit external sharing by domain. 4. Select Add domains, choose Allow only specific domains, enter the list of approved domain names, and select Done. 5. Click Save at the bottom of the page. To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run the following PowerShell command: Set-SPOTenant -SharingDomainRestrictionMode AllowList - SharingAllowedDomainList \"domain1.com domain2.com\"",
+ "AuditProcedure": "Note: If the SharePoint external sharing slider is set to Only people in your organization, this recommendation is compliant regardless of the configured value for Limit external sharing by domain. To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. If the SharePoint slider is set to Only people in your organization, this recommendation is compliant. 5. Otherwise, expand More external sharing settings and confirm that Limit external sharing by domain is checked. 6. Verify that Allow only specific domains is selected and that domains listed are approved by the organization. To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run the following PowerShell command: Get-SPOTenant | fl SharingCapability,SharingDomainRestrictionMode,SharingAllowedDomainList 3. Verify that one of the following conditions is true: o SharingCapability is Disabled, OR o SharingDomainRestrictionMode is AllowList and SharingAllowedDomainList contains domains trusted by the organization for external sharing.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Limit external sharing by domain is unchecked SharingDomainRestrictionMode: None SharingAllowedDomainList: (empty)",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off?WT.mc_id=365AdminCSH_spo#more-external-sharing-settings"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.7",
+ "Description": "This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options. The recommended state is Specific people (only the people the user specifies) or Only people in your organization.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options. The recommended state is Specific people (only the people the user specifies) or Only people in your organization.",
+ "RationaleStatement": "By defaulting to specific people, the user will first need to consider whether or not the content being shared should be accessible by the entire organization versus select individuals. This aids in reinforcing the concept of least privilege.",
+ "ImpactStatement": "Changing the default sharing link type influences the user experience when sharing files and folders in SharePoint and OneDrive. The configured default option will appear pre- selected in the sharing dialog, guiding users toward the organization's preferred sharing method.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to File and folder links. 4. Set Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive to Specific people (only the people the user specifies) or Only people in your organization. To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run one of the following PowerShell commands depending on the desired compliant state: To set the default sharing link to specific people: Set-SPOTenant -DefaultSharingLinkType Direct To set the default sharing link to people in the organization: Set-SPOTenant -DefaultSharingLinkType Internal",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to File and folder links. 4. Verify that the setting Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive is set to Specific people (only the people the user specifies) or Only people in your organization. To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run the following PowerShell command: Get-SPOTenant | fl DefaultSharingLinkType 3. Verify that the returned value is Direct or Internal.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Only people in your organization (Internal)",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.8",
+ "Description": "External sharing of content can be restricted to specific security groups. This setting is global, applies to sharing in both SharePoint and OneDrive and cannot be set at the site level in SharePoint.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "External sharing of content can be restricted to specific security groups. This setting is global, applies to sharing in both SharePoint and OneDrive and cannot be set at the site level in SharePoint.",
+ "RationaleStatement": "Without restricting external sharing to designated security groups, any user in the organization can share SharePoint or OneDrive content with external recipients. A compromised or insider-threat account can exfiltrate sensitive data by sharing files externally without additional authorization controls. Limiting external sharing to members of specific Entra ID security groups ensures that only reviewed and authorized users have this capability, reducing the attack surface for data exfiltration through sharing.",
+ "ImpactStatement": "Users who are not members of the designated security groups will lose the ability to create new external shares or invite new external guests. Existing sharing links they previously established will remain active for current recipients. Organizations should ensure the security groups are populated with appropriate members before enabling this setting to avoid inadvertently blocking all external sharing. Helpdesk volume may increase as users in non-designated groups encounter sharing restrictions.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to and expand More external sharing settings. 4. Set the following: o Check Allow only users in specific security groups to share externally o Click Manage security groups, then add at least one security group authorized for external sharing. To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run the following command, replacing <GroupObjectId> with the GUID of the security group to be authorized for external sharing: Set-SPOTenant -WhoCanShareAuthenticatedGuestAllowList \"<GroupObjectId>\" Note: To authorize multiple security groups, provide a comma-delimited list of Object IDs: \"<GroupObjectId1>\",\"<GroupObjectId2>\". Note: Users in the designated security groups must also be permitted to invite guests in Microsoft Entra. Verify this at Identity > External Identities > External collaboration settings.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Locate the External sharing section. 4. If the SharePoint slider is set to Only people in your organization, this recommendation is compliant. 5. Otherwise, scroll to and expand More external sharing settings. 6. Verify the following: o Allow only users in specific security groups to share externally is checked o Manage security groups contains at least one security group. To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService. 2. Run the following PowerShell command: Get-SPOTenant | fl SharingCapability, WhoCanShareAuthenticatedGuestAllowList 3. Verify the output using the following logic: o If SharingCapability is Disabled, the recommendation is compliant regardless of the value of WhoCanShareAuthenticatedGuestAllowList. o Otherwise, verify that WhoCanShareAuthenticatedGuestAllowList contains at least one security group GUID. If the value is empty or $null, the recommendation is not compliant.",
+ "AdditionalInformation": "",
+ "DefaultValue": "By default, this restriction is not in place, allowing any user in the organization to share content externally, subject only to the top-level sharing slider.",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/manage-security-groups:https://learn.microsoft.com/en-us/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant?view=sharepoint-ps"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.9",
+ "Description": "This policy setting configures the expiration time for each guest that is invited to the SharePoint site or with whom users share individual files and folders with. Expiration can be a number 30 to 730. The recommended state is 30.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting configures the expiration time for each guest that is invited to the SharePoint site or with whom users share individual files and folders with. Expiration can be a number 30 to 730. The recommended state is 30.",
+ "RationaleStatement": "This setting ensures that guests who no longer need access to the site or link no longer have access after a set period of time. Allowing guest access for an indefinite amount of time could lead to loss of data confidentiality and oversight. Note: Guest membership applies at the Microsoft 365 group level. Guests who have permission to view a SharePoint site or use a sharing link may also have access to a Microsoft Teams team or security group.",
+ "ImpactStatement": "Site collection administrators will have to renew access to guests who still need access after 30 days. They will receive an e-mail notification once per week about guest access that is about to expire. Note: The guest expiration policy only applies to guests who use sharing links or guests who have direct permissions to a SharePoint site after the guest policy is enabled. The guest policy does not apply to guest users that have pre-existing permissions or access through a sharing link before the guest expiration policy is applied.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to and expand More external sharing settings. 4. Set Guest access to a site or OneDrive will expire automatically after this many days to 30 To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Set-SPOTenant -ExternalUserExpireInDays 30 -ExternalUserExpirationRequired $True",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to and expand More external sharing settings. 4. Verify that Guest access to a site or OneDrive will expire automatically after this many days is checked and set to 30. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Get-SPOTenant | fl ExternalUserExpirationRequired,ExternalUserExpireInDays 3. Verify the following values are returned: o ExternalUserExpirationRequired is True. o ExternalUserExpireInDays is 30.",
+ "AdditionalInformation": "",
+ "DefaultValue": "ExternalUserExpirationRequired $false ExternalUserExpireInDays 60 days",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#change-the-organization-level-external-sharing-setting:https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.10",
+ "Description": "This setting configures if guests who use a verification code to access the site or links are required to reauthenticate after a set number of days. The recommended state is 15 or less.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting configures if guests who use a verification code to access the site or links are required to reauthenticate after a set number of days. The recommended state is 15 or less.",
+ "RationaleStatement": "By increasing the frequency of times guests need to reauthenticate this ensures guest user access to data is not prolonged beyond an acceptable amount of time.",
+ "ImpactStatement": "Guests who use Microsoft 365 in their organization can sign in using their work or school account to access the site or document. After the one-time passcode for verification has been entered for the first time, guests will authenticate with their work or school account and have a guest account created in the host's organization. Note: If OneDrive and SharePoint integration with Entra ID B2B is enabled as per the CIS Benchmark the one-time-passcode experience will be replaced. Please visit Secure external sharing in SharePoint - SharePoint in Microsoft 365 | Microsoft Learn for more information.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to and expand More external sharing settings. 4. Set People who use a verification code must reauthenticate after this many days to 15 or less. To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to and expand More external sharing settings. 4. Verify that People who use a verification code must reauthenticate after this many days is set to 15 or less. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Get-SPOTenant | fl EmailAttestationRequired,EmailAttestationReAuthDays 3. Verify that the following values are returned: o EmailAttestationRequired True o EmailAttestationReAuthDays 15 or less days.",
+ "AdditionalInformation": "",
+ "DefaultValue": "EmailAttestationRequired : False EmailAttestationReAuthDays : 30",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/what-s-new-in-sharing-in-targeted-release:https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#change-the-organization-level-external-sharing-setting:https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode"
+ }
+ ]
+ },
+ {
+ "Id": "7.2.11",
+ "Description": "This setting configures the permission that is selected by default for sharing link from a SharePoint site. The recommended state is View.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.2 Policies",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting configures the permission that is selected by default for sharing link from a SharePoint site. The recommended state is View.",
+ "RationaleStatement": "Setting the view permission as the default ensures that users must deliberately select the edit permission when sharing a link. This approach reduces the risk of unintentionally granting edit privileges to a resource that only requires read access, supporting the principle of least privilege.",
+ "ImpactStatement": "Not applicable.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to File and folder links. 4. Set Choose the permission that's selected by default for sharing links to View. To remediate using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Set-SPOTenant -DefaultLinkPermission View",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint 2. Expand Policies > Sharing. 3. Scroll to File and folder links. 4. Verify that Choose the permission that's selected by default for sharing links is set to View. To audit using PowerShell: 1. Connect to SharePoint Online service using Connect-SPOService. 2. Run the following cmdlet: Get-SPOTenant | fl DefaultLinkPermission 3. Verify that the returned value is View.",
+ "AdditionalInformation": "",
+ "DefaultValue": "DefaultLinkPermission : Edit",
+ "References": "https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#file-and-folder-links"
+ }
+ ]
+ },
+ {
+ "Id": "7.3.1",
+ "Description": "By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "7 SharePoint admin center",
+ "SubSection": "7.3 Settings",
+ "Profile": "E5 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.",
+ "RationaleStatement": "Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.",
+ "ImpactStatement": "The only potential impact associated with implementation of this setting is potential inconvenience associated with the small percentage of false positive detections that may occur.",
+ "RemediationProcedure": "To remediate using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com, replacing \"tenant\" with the appropriate value. 2. Run the following PowerShell command to set the recommended value: Set-SPOTenant -DisallowInfectedFileDownload $true Note: The Global Reader role cannot access SharePoint using PowerShell according to Microsoft. See the reference section for more information.",
+ "AuditProcedure": "To audit using PowerShell: 1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com, replacing \"tenant\" with the appropriate value. 2. Run the following PowerShell command: Get-SPOTenant | Select-Object DisallowInfectedFileDownload 3. Ensure that the DisallowInfectedFileDownload is set to True. Note: According to Microsoft, SharePoint cannot be accessed through PowerShell by users with the Global Reader role. For further information, please refer to the reference section.",
+ "AdditionalInformation": "",
+ "DefaultValue": "False",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide:https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide:https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-reader"
+ }
+ ]
+ },
+ {
+ "Id": "8.1.1",
+ "Description": "Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well. Note: Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.",
+ "Checks": [
+ "teams_external_file_sharing_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.1 Teams",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well. Note: Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.",
+ "RationaleStatement": "Ensuring that only authorized cloud storage providers are accessible from Teams will help to dissuade the use of non-approved storage providers.",
+ "ImpactStatement": "The impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Select Settings & policies > Global (Org-wide default) settings. 3. Click Teams to open the Teams settings section. 4. Under files set storages providers to Off unless they have first been authorized by the organization. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following PowerShell command to disable external providers that are not authorized. (the example disables Citrix Files, DropBox, Box, Google Drive and Egnyte) $Params = @{ Identity = 'Global' AllowGoogleDrive = $false AllowShareFile = $false AllowBox = $false AllowDropBox = $false AllowEgnyte = $false } Set-CsTeamsClientConfiguration @Params",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Select Settings & policies > Global (Org-wide default) settings. 3. Click Teams to open the Teams settings section. 4. Under files verify that only organizationally authorized cloud storage options are set to On and all others Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following to verify the recommended state: $Params = @( 'AllowDropbox' 'AllowBox' 'AllowGoogleDrive' 'AllowShareFile' 'AllowEgnyte' ) Get-CsTeamsClientConfiguration -Identity Global | fl $Params 3. Verify that only authorized providers are set to True and all others False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "AllowDropBox : True AllowBox : True AllowGoogleDrive : True AllowShareFile : True AllowEgnyte : True",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/teams-powershell-managing-teams"
+ }
+ ]
+ },
+ {
+ "Id": "8.1.2",
+ "Description": "This setting controls whether Teams channels are allowed to receive emails sent to their unique email addresses. When enabled, emails sent to a channel's address will be delivered and appear in the channel's conversation thread; when disabled, the channel will reject incoming emails, preventing them from being posted. The recommended state is Off.",
+ "Checks": [
+ "teams_email_sending_to_channel_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.1 Teams",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting controls whether Teams channels are allowed to receive emails sent to their unique email addresses. When enabled, emails sent to a channel's address will be delivered and appear in the channel's conversation thread; when disabled, the channel will reject incoming emails, preventing them from being posted. The recommended state is Off.",
+ "RationaleStatement": "Channel email addresses are not under the tenant's domain and organizations do not have control over the security settings for this email address. An attacker could email channels directly if they discover the channel email address.",
+ "ImpactStatement": "Depending on the organization's adoption, disabling this may disrupt workflows that rely on email-to-channel communication, particularly in environments where email is used to bridge external systems or vendors into Teams. This could include reduced visibility of important updates or alerts that were previously routed into Teams channels via email.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Select Settings & policies > Global (Org-wide default) settings. 3. Click Teams to open the Teams settings section. 4. Under email integration set Users can send emails to a channel email address to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Select Settings & policies > Global (Org-wide default) settings. 3. Click Teams to open the Teams settings section. 4. Under email integration verify that Users can send emails to a channel email address is Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsClientConfiguration -Identity Global | fl AllowEmailIntoChannel 3. Ensure the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On (True)",
+ "References": "https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/step-by-step-guides/reducing-attack-surface-in-microsoft-teams?view=o365-worldwide#restricting-channel-email-messages-to-approved-domains:https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference#email-integration:https://support.microsoft.com/en-us/office/send-an-email-to-a-channel-in-microsoft-teams-d91db004-d9d7-4a47-82e6-fb1b16dfd51e"
+ }
+ ]
+ },
+ {
+ "Id": "8.2.1",
+ "Description": "This policy controls whether external domains are allowed, blocked or permitted based on an allowlist or denylist. When external domains are allowed, users in your organization can chat, add users to meetings, and use audio video conferencing with users in external organizations. The recommended state is Off on the Global (Org-wide default) policy.",
+ "Checks": [
+ "teams_external_domains_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.2 Users",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy controls whether external domains are allowed, blocked or permitted based on an allowlist or denylist. When external domains are allowed, users in your organization can chat, add users to meetings, and use audio video conferencing with users in external organizations. The recommended state is Off on the Global (Org-wide default) policy.",
+ "RationaleStatement": "Unrestricted external federation allows any Teams user from any organization to initiate contact with your users, making them susceptible to social engineering, phishing, and malware delivery via Teams chat. Restricting external domains to an allowlist or blocking them entirely eliminates this unsolicited contact vector. Real-world attacks and exploits delivered via Teams over external access channels include: - DarkGate malware - Social engineering / phishing attacks by \"Midnight Blizzard\" - GIFShell - Username enumeration",
+ "ImpactStatement": "Restricting external domains will limit users' ability to collaborate with individuals outside the organization unless their domain is explicitly allowlisted or they are invited as a guest in Microsoft Entra ID. Administrators choosing an allowlist approach will incur ongoing overhead to manage approved domains as external collaboration needs evolve. Note: Organizations may create custom external access policies with federation enabled and assign them to specific users or groups requiring external access, while keeping the Global (Org-wide default) policy restrictive.",
+ "RemediationProcedure": "Note: Configuring this setting at the organization level in Organization settings to either Off, Block all external domains or Allow only specific external domains is also a compliant remediation for this control. To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Set Manage external domains for this policy to Off. 6. Click Save. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command to configure the Global (Org-wide default) policy. Set-CsExternalAccessPolicy -Identity Global -EnableFederationAccess $false",
+ "AuditProcedure": "Note: The focus of this control at a minimum is the Global (Org-wide default) policy. If the organization-wide setting is configured to Allow only specific external domains or Block all external domains, then this is also considered a passing state due to its increased restrictiveness. To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Verify that Manage external domains for this policy is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Get-CsExternalAccessPolicy -Identity Global 3. Verify that EnableFederationAccess is False. Organization settings: Optional passing state 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Organization settings tab. 4. Verify that Manage external domains for this organization is set to one of the following: o Off o On with Allow or block external domains set to Allow only specific external domains o On with Allow or block external domains set to Block all external domains To audit using PowerShell: 1. Run the following command: Get-CsTenantFederationConfiguration | fl AllowFederatedUsers,AllowedDomains 2. Verify the output meets one of the following compliant conditions: o Off: AllowFederatedUsers is False o Block all external domains: AllowFederatedUsers is True and AllowedDomains is empty o Allow only specific external domains: AllowFederatedUsers is True and AllowedDomains contains only authorized domain names",
+ "AdditionalInformation": "",
+ "DefaultValue": "EnableFederationAccess - $True",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings:https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/:https://www.bitdefender.com/blog/hotforsecurity/gifshell-attack-lets-hackers-create-reverse-shell-through-microsoft-teams-gifs/"
+ }
+ ]
+ },
+ {
+ "Id": "8.2.2",
+ "Description": "This policy setting controls chats and meetings initiated through the external access channel with unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)). This does not govern anonymous meeting join via shared link, which is controlled separately. The recommended state is: People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts set to Off.",
+ "Checks": [
+ "teams_unmanaged_communication_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls chats and meetings initiated through the external access channel with unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)). This does not govern anonymous meeting join via shared link, which is controlled separately. The recommended state is: People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts set to Off.",
+ "RationaleStatement": "Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Real-world attacks and exploits delivered via Teams over external access channels include: - DarkGate malware - Social engineering / Phishing attacks by \"Midnight Blizzard\" - GIFShell - Username enumeration",
+ "ImpactStatement": "Users will be unable to communicate with Teams users who are not managed by an organization. Organizations may choose to create additional policies for specific groups needing to communicate with unmanaged external users. Note: The settings that govern chats and meetings with external unmanaged Teams users aren't available in GCC, GCC High, or DOD deployments, or in private cloud environments.",
+ "RemediationProcedure": "Note: Configuring this setting at the organization level in Organization settings to Off is also a compliant remediation for this control. To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Set People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts to Off. 6. Click Save. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerAccess $false",
+ "AuditProcedure": "Note: The focus of this control at a minimum is the Global (Org-wide default) policy. If the organization-wide setting is configured to Off, then this is also considered a passing state due to its increased restrictiveness. To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Verify that People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Get-CsExternalAccessPolicy -Identity Global Verify that EnableTeamsConsumerAccess is set to False. Organization settings: Optional passing state 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Organization settings tab. 4. Verify that People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts is set to Off. To audit using PowerShell: 1. Run the following command: Get-CsTenantFederationConfiguration | fl AllowTeamsConsumer 2. Verify that AllowTeamsConsumer is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- EnableTeamsConsumerAccess (Global policy): True - AllowTeamsConsumer (Organization settings): True",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings:https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/:https://www.bitdefender.com/blog/hotforsecurity/gifshell-attack-lets-hackers-create-reverse-shell-through-microsoft-teams-gifs/"
+ }
+ ]
+ },
+ {
+ "Id": "8.2.3",
+ "Description": "This setting prevents external users who are not managed by an organization from initiating contact with users in the protected organization. The recommended state is to uncheck People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts. Note: Disabling this setting is used as an additional stop gap for the parent setting which disables communication with unmanaged Teams users entirely. If an organization chooses to have an exception to Ensure communication with unmanaged Teams users is disabled they can do so while also disabling the ability for the same group of users to initiate contact. Disabling communication entirely will also disable the ability for unmanaged users to initiate contact.",
+ "Checks": [
+ "teams_external_users_cannot_start_conversations"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting prevents external users who are not managed by an organization from initiating contact with users in the protected organization. The recommended state is to uncheck People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts. Note: Disabling this setting is used as an additional stop gap for the parent setting which disables communication with unmanaged Teams users entirely. If an organization chooses to have an exception to Ensure communication with unmanaged Teams users is disabled they can do so while also disabling the ability for the same group of users to initiate contact. Disabling communication entirely will also disable the ability for unmanaged users to initiate contact.",
+ "RationaleStatement": "Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Real-world attacks and exploits delivered via Teams over external access channels include: - DarkGate malware - Social engineering / Phishing attacks by \"Midnight Blizzard\" - GIFShell - Username enumeration",
+ "ImpactStatement": "Unmanaged Teams users (those using personal Microsoft accounts or free Teams) will be unable to initiate new chats or meeting invitations with members of the organization. Organization members may still be able to join externally-initiated meetings depending on the configuration of the parent setting. Organizations that need to allow inbound contact from specific external users can assign a custom external access policy to those users that has EnableTeamsConsumerInbound enabled. Note: Chats and meetings with external unmanaged Teams users isn't available in GCC, GCC High, or DOD deployments, or in private cloud environments.",
+ "RemediationProcedure": "Note: Configuring this setting at the organization level in Organization settings to Off is also a compliant remediation for this control. To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Locate the parent setting People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts. 6. Uncheck People in my org can join external meetings and receive new chats from users who have unmanaged Microsoft accounts. 7. Click Save. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Set-CsExternalAccessPolicy -Identity Global -EnableTeamsConsumerInbound $false",
+ "AuditProcedure": "Note: The focus of this control at a minimum is the Global (Org-wide default) policy. If the equivalent organization-wide setting is disabled, then this is also considered a passing state due to its increased restrictiveness. To audit using the UI: Note: If the parent setting People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts is already set to Off then this setting will not be visible in the UI. 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Open the Policies tab. 4. Click on the Global (Org-wide default) settings policy. 5. Locate the parent setting People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts. 6. Verify that People in my org can join external meetings and receive new chats from users who have unmanaged Microsoft accounts is not checked. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Get-CsExternalAccessPolicy -Identity Global Verify that EnableTeamsConsumerInbound is False Organization settings: Optional passing state 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Select the Organization settings tab. 4. Locate the parent setting People in my org can chat and have meetings with external users who have unmanaged Microsoft accounts. 5. Verify that People in my org can join external meetings and receive new chats from users who have unmanaged Microsoft accounts is not checked. To audit using PowerShell: 1. Run the following command: Get-CsTenantFederationConfiguration | fl AllowTeamsConsumerInbound Verify that AllowTeamsConsumerInbound is False",
+ "AdditionalInformation": "",
+ "DefaultValue": "- EnableTeamsConsumerInbound (Global policy) : True - AllowTeamsConsumerInbound (Organization settings) : True",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings:https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/:https://www.bitdefender.com/blog/hotforsecurity/gifshell-attack-lets-hackers-create-reverse-shell-through-microsoft-teams-gifs/"
+ }
+ ]
+ },
+ {
+ "Id": "8.2.4",
+ "Description": "This setting controls the organization's external access with Teams \"trial-only\" tenants. These are tenants that don't have any purchased seats. When set to Blocked, users from these trial-only tenants aren't able to search and contact your users via chats, Teams calls, and meetings (using the users' authenticated identities) and your users aren't able to reach users in these trial-only tenants. Users from the trial-only tenant are also removed from existing chats. The recommended state for People in my organization can communicate with accounts in trial Teams tenant is Off.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.2 Users",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting controls the organization's external access with Teams \"trial-only\" tenants. These are tenants that don't have any purchased seats. When set to Blocked, users from these trial-only tenants aren't able to search and contact your users via chats, Teams calls, and meetings (using the users' authenticated identities) and your users aren't able to reach users in these trial-only tenants. Users from the trial-only tenant are also removed from existing chats. The recommended state for People in my organization can communicate with accounts in trial Teams tenant is Off.",
+ "RationaleStatement": "Microsoft introduced this setting as Off by default on July 29, 2024 in order to block attack vectors being exploited by threat actors who have abused trial tenants. Enforcing the default ensures the setting is not reenabled for any reason. Allowing users to communicate with unmanaged Teams users presents a potential security threat as little effort is required by threat actors to gain access to a trial or free Microsoft Teams account. Real-world attacks and exploits delivered via Teams over external access channels include: - DarkGate malware - Social engineering / Phishing attacks by \"Midnight Blizzard\" - GIFShell - Username enumeration",
+ "ImpactStatement": "Users currently in chat conversations with accounts from trial tenants will be removed from those existing chats when this setting is disabled. Organizations that have established communication with external contacts who are using trial tenants will need to use alternative channels (such as email) until those contacts migrate to a licensed tenant.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Select the Organization settings tab. 4. Set People in my organization can communicate with accounts in trial Teams tenant to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants \"Blocked\"",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Expand External collaboration and select External access. 3. Select the Organization settings tab. 4. Verify that People in my organization can communicate with accounts in trial Teams tenant is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command: Get-CsTenantFederationConfiguration Verify that ExternalAccessWithTrialTenants is set to Blocked.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Off (UI) - Blocked (PowerShell)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/trusted-organizations-external-meetings-chat?tabs=organization-settings#block-federation-with-teams-trial-only-tenants:https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/:https://www.bitdefender.com/en-us/blog/hotforsecurity/gifshell-attack-lets-hackers-create-reverse-shell-through-microsoft-teams-gifs"
+ }
+ ]
+ },
+ {
+ "Id": "8.4.1",
+ "Description": "This policy setting controls which class of apps are available for users to install.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.4 Teams apps",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Manual",
+ "Description": "This policy setting controls which class of apps are available for users to install.",
+ "RationaleStatement": "Allowing users to install third-party or unverified apps poses a potential risk of introducing malicious software to the environment.",
+ "ImpactStatement": "Users will only be able to install approved classes of apps.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Expand Teams apps and select Manage apps. 3. In the upper right click Actions > Org-wide app settings. 4. For Third-party apps set Let users install and use available apps by default to Off. 5. For Custom apps set Let users install and use available apps by default to Off. 6. For Custom apps set Let users interact with custom apps in preview to Off.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Expand Teams apps and select Manage apps. 3. In the upper right click Actions > Org-wide app settings. 4. For Third-party apps verify Let users install and use available apps by default is Off. 5. For Custom apps verify Let users install and use available apps by default is Off. 6. For Custom apps verify Let users interact with custom apps in preview is Off.",
+ "AdditionalInformation": "",
+ "DefaultValue": "- Third-party apps: On - Custom apps: On",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/app-centric-management:https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/reducing-attack-surface-in-microsoft-teams?view=o365-worldwide#disabling-third-party--custom-apps"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.1",
+ "Description": "Anonymous users are users whose identity can't be verified. They may be logged in to an organization without a mutual trust relationship or they may not have an account (guest or user). Anonymous participants appear with \"(Unverified)\" appended to their name in meetings. These users could include: - Users who aren't logged in to Teams with a work or school account. - Users from non-trusted organizations (as configured in external access) and from organizations that you trust but which don't trust your organization. When defining trusted organizations for external meetings and chat, ensure both organizations allow each other's domains. Meeting organizers and participants should have user policies that allow external access. These settings prevent attendees from being considered anonymous due to external access settings. For details, see IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities The recommended state is Anonymous users can join a meeting unverified set to Off.",
+ "Checks": [
+ "teams_meeting_anonymous_user_join_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Anonymous users are users whose identity can't be verified. They may be logged in to an organization without a mutual trust relationship or they may not have an account (guest or user). Anonymous participants appear with \"(Unverified)\" appended to their name in meetings. These users could include: - Users who aren't logged in to Teams with a work or school account. - Users from non-trusted organizations (as configured in external access) and from organizations that you trust but which don't trust your organization. When defining trusted organizations for external meetings and chat, ensure both organizations allow each other's domains. Meeting organizers and participants should have user policies that allow external access. These settings prevent attendees from being considered anonymous due to external access settings. For details, see IT Admins - Manage external meetings and chat with people and organizations using Microsoft identities The recommended state is Anonymous users can join a meeting unverified set to Off.",
+ "RationaleStatement": "For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly sent an invite before admitting them to the meeting. This will also prevent the anonymous user from using the meeting link to have meetings at unscheduled times. Note: Those companies that don't normally operate at a Level 2 environment, but do deal with sensitive information, may want to consider this policy setting.",
+ "ImpactStatement": "Individuals who were not sent or forwarded a meeting invite will not be able to join the meeting automatically.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby set Anonymous users can join a meeting unverified to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToJoinMeeting $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby verify that Anonymous users can join a meeting unverified is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowAnonymousUsersToJoinMeeting 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On (True)",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/reducing-attack-surface-in-microsoft-teams?view=o365-worldwide#configure-meeting-settings:https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference?WT.mc_id=TeamsAdminCenterCSH#meeting-join--lobby:https://learn.microsoft.com/en-us/MicrosoftTeams/configure-meetings-sensitive-protection:https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings:https://learn.microsoft.com/en-us/microsoftteams/plan-meetings-external-participants"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.2",
+ "Description": "This policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization. Anonymous participants are classified as: - Participants who are not logged in to Teams with a work or school account. - Participants from non-trusted organizations (as configured in external access). - Participants from organizations where there is not mutual trust. Note: This setting only applies when Who can bypass the lobby is set to Everyone. If the anonymous users can join a meeting organization-level setting or meeting policy is Off, this setting only applies to dial-in callers.",
+ "Checks": [
+ "teams_meeting_anonymous_user_start_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization. Anonymous participants are classified as: - Participants who are not logged in to Teams with a work or school account. - Participants from non-trusted organizations (as configured in external access). - Participants from organizations where there is not mutual trust. Note: This setting only applies when Who can bypass the lobby is set to Everyone. If the anonymous users can join a meeting organization-level setting or meeting policy is Off, this setting only applies to dial-in callers.",
+ "RationaleStatement": "Not allowing anonymous participants to automatically join a meeting reduces the risk of meeting spamming.",
+ "ImpactStatement": "Anonymous participants will not be able to start a Microsoft Teams meeting.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby set Anonymous users and dial-in callers can start a meeting to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -AllowAnonymousUsersToStartMeeting $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby verify that Anonymous users and dial-in callers can start a meeting is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowAnonymousUsersToStartMeeting 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off (False)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/anonymous-users-in-meetings:https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby#overview-of-lobby-settings-and-policies"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.3",
+ "Description": "This policy setting controls who can join a meeting directly and who must wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting. The recommended state is People who were invited, People in my org or Only organizers and co-organizers.",
+ "Checks": [
+ "teams_meeting_external_lobby_bypass_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls who can join a meeting directly and who must wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting. The recommended state is People who were invited, People in my org or Only organizers and co-organizers.",
+ "RationaleStatement": "For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly sent an invite before admitting them to the meeting. This will also prevent the anonymous user from using the meeting link to have meetings at unscheduled times.",
+ "ImpactStatement": "Individuals who are not part of the organization will have to wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting. Any individual who dials into the meeting regardless of status will also have to wait in the lobby. This includes internal users who are considered unauthenticated when dialing in.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby set Who can bypass the lobby to one of the following: o People who were invited o People in my org o Only organizers and co-organizers To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run one of the following PowerShell commands depending on the desired compliant state: To set to People who were invited: Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers \"InvitedUsers\" To set to People in my org: Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers \"EveryoneInCompanyExcludingGuests\" To set to Only organizers and co-organizers: Set-CsTeamsMeetingPolicy -Identity Global -AutoAdmittedUsers \"OrganizerOnly\"",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby verify Who can bypass the lobby is set to one of the following: o People who were invited o People in my org o Only organizers and co-organizers To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AutoAdmittedUsers 3. Verify that the returned value is one of the following strings: o InvitedUsers o EveryoneInCompanyExcludingGuests o OrganizerOnly",
+ "AdditionalInformation": "",
+ "DefaultValue": "People in my org and guests (EveryoneInCompany)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby#overview-of-lobby-settings-and-policies:https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.4",
+ "Description": "This policy setting controls if users who dial in by phone can join the meeting directly or must wait in the lobby. Admittance to the meeting from the lobby is authorized by the meeting organizer, co-organizer, or presenter of the meeting.",
+ "Checks": [
+ "teams_meeting_dial_in_lobby_bypass_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls if users who dial in by phone can join the meeting directly or must wait in the lobby. Admittance to the meeting from the lobby is authorized by the meeting organizer, co-organizer, or presenter of the meeting.",
+ "RationaleStatement": "For meetings that could contain sensitive information, it is best to allow the meeting organizer to vet anyone not directly from the organization.",
+ "ImpactStatement": "Individuals who are dialing in to the meeting must wait in the lobby until a meeting organizer, co-organizer, or presenter admits them.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby set People dialing in can bypass the lobby to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -AllowPSTNUsersToBypassLobby $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting join & lobby verify that People dialing in can bypass the lobby is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowPSTNUsersToBypassLobby 3. Verify that the value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off (False)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby#overview-of-lobby-settings-and-policies:https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.5",
+ "Description": "This policy setting controls who has access to read and write chat messages during a meeting.",
+ "Checks": [
+ "teams_meeting_chat_anonymous_users_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls who has access to read and write chat messages during a meeting.",
+ "RationaleStatement": "Ensuring that only authorized individuals can read and write chat messages during a meeting reduces the risk that a malicious user can inadvertently show content that is not appropriate or view sensitive information.",
+ "ImpactStatement": "Only authorized individuals will be able to read and write chat messages during a meeting.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting engagement set Meeting chat to On for everyone but anonymous users. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the minimum recommended state: Set-CsTeamsMeetingPolicy -Identity Global -MeetingChatEnabledType \"EnabledExceptAnonymous\" Note: The audit section outlines additional compliant states which are more restrictive than the recommended state.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting engagement verify that Meeting chat is set to On for everyone but anonymous users or a more restrictive value: In-meeting only except anonymous or Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl MeetingChatEnabledType 3. Verify that the returned value is EnabledExceptAnonymous or a more restrictive value EnabledInMeetingOnlyForAllExceptAnonymous or Disabled.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On for everyone (Enabled)",
+ "References": "https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps#-meetingchatenabledtype"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.6",
+ "Description": "This policy setting controls who can present in a Teams meeting. Note: Organizers and co-organizers can change this setting when the meeting is set up.",
+ "Checks": [
+ "teams_meeting_presenters_restricted"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting controls who can present in a Teams meeting. Note: Organizers and co-organizers can change this setting when the meeting is set up.",
+ "RationaleStatement": "Ensuring that only authorized individuals are able to present reduces the risk that a malicious user can inadvertently show content that is not appropriate.",
+ "ImpactStatement": "Only organizers and co-organizers will be able to present without being granted permission.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under content sharing set Who can present to Only organizers and co- organizers. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -DesignatedPresenterRoleMode \"OrganizerOnlyUserOverride\"",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under content sharing verify Who can present is set to Only organizers and co-organizers. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl DesignatedPresenterRoleMode 3. Verify that the returned value is OrganizerOnlyUserOverride.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Everyone (EveryoneUserOverride)",
+ "References": "https://learn.microsoft.com/en-US/microsoftteams/meeting-who-present-request-control:https://learn.microsoft.com/en-us/microsoftteams/meeting-who-present-request-control#manage-who-can-present:https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/reducing-attack-surface-in-microsoft-teams?view=o365-worldwide#configure-meeting-settings-restrict-presenters:https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.7",
+ "Description": "This policy setting allows control of who can present in meetings and who can request control of the presentation while a meeting is underway.",
+ "Checks": [
+ "teams_meeting_external_control_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This policy setting allows control of who can present in meetings and who can request control of the presentation while a meeting is underway.",
+ "RationaleStatement": "Ensuring that only authorized individuals and not external participants are able to present and request control reduces the risk that a malicious user can inadvertently show content that is not appropriate. External participants are categorized as follows: external users, guests, and anonymous users.",
+ "ImpactStatement": "External participants will not be able to present or request control during the meeting. Warning: This setting also affects webinars. Note: At this time, to give and take control of shared content during a meeting, both parties must be using the Teams desktop client. Control isn't supported when either party is running Teams in a browser.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under content sharing set External participants can give or request control to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global - AllowExternalParticipantGiveRequestControl $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under content sharing verify that External participants can give or request control is Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowExternalParticipantGiveRequestControl 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Off (False)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/meeting-who-present-request-control:https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.8",
+ "Description": "This meeting policy setting controls whether users can read or write messages in external meeting chats with untrusted organizations. If an external organization is on the list of trusted organizations this setting will be ignored.",
+ "Checks": [
+ "teams_meeting_external_chat_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This meeting policy setting controls whether users can read or write messages in external meeting chats with untrusted organizations. If an external organization is on the list of trusted organizations this setting will be ignored.",
+ "RationaleStatement": "Restricting access to chat in meetings hosted by external organizations limits the opportunity for an exploit like GIFShell or DarkGate malware from being delivered to users.",
+ "ImpactStatement": "When joining external meetings users will be unable to read or write chat messages in Teams meetings with organizations that they don't have a trust relationship with. This will completely remove the chat functionality in meetings. From an I.T. perspective both the upkeep of adding new organizations to the trusted list and the decision-making process behind whether to trust or not trust an external partner will increase time expenditure.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab.. 3. Select Meetings to open the meeting settings section. 4. Under meeting engagement set External meeting chat to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalNonTrustedMeetingChat $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under meeting engagement verify that External meeting chat is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowExternalNonTrustedMeetingChat 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On(True)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference#meeting-engagement"
+ }
+ ]
+ },
+ {
+ "Id": "8.5.9",
+ "Description": "This setting controls the ability for a user to initiate a recording of a meeting in progress. The recommended state is Off for the Global (Org-wide default) meeting policy.",
+ "Checks": [
+ "teams_meeting_recording_disabled"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.5 Meetings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting controls the ability for a user to initiate a recording of a meeting in progress. The recommended state is Off for the Global (Org-wide default) meeting policy.",
+ "RationaleStatement": "Disabling meeting recordings in the Global meeting policy ensures that only authorized users, such as organizers, co-organizers, and leads, can initiate a recording. This measure helps safeguard sensitive information by preventing unauthorized individuals from capturing and potentially sharing meeting content. Restricting recording capabilities to specific roles allows organizations to exercise greater control over what is recorded, aligning it with the meeting's confidentiality requirements. Note: Creating a separate policy for users or groups who are allowed to record is expected and in compliance. This control is only for the default meeting policy.",
+ "ImpactStatement": "If there are no additional policies allowing anyone to record, then recording will effectively be disabled.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under Recording & transcription set Meeting recording to Off. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to set the recommended state: Set-CsTeamsMeetingPolicy -Identity Global -AllowCloudRecording $false",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Meetings to open the meeting settings section. 4. Under Recording & transcription verify that Meeting recording is set to Off. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following command to verify the recommended state: Get-CsTeamsMeetingPolicy -Identity Global | fl AllowCloudRecording 3. Verify that the returned value is False.",
+ "AdditionalInformation": "",
+ "DefaultValue": "On (True)",
+ "References": "https://learn.microsoft.com/en-us/microsoftteams/settings-policies-reference#recording--transcription"
+ }
+ ]
+ },
+ {
+ "Id": "8.6.1",
+ "Description": "User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all must be configured for compliance: - In the Teams admin center: On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant. - In the Microsoft 365 Defender portal: On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page. - Defender - Report message destinations: This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.",
+ "Checks": [
+ "teams_security_reporting_enabled",
+ "defender_chat_report_policy_configured"
+ ],
+ "Attributes": [
+ {
+ "Section": "8 Microsoft Teams admin center",
+ "SubSection": "8.6 Messaging",
+ "Profile": "E5 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all must be configured for compliance: - In the Teams admin center: On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant. - In the Microsoft 365 Defender portal: On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page. - Defender - Report message destinations: This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.",
+ "RationaleStatement": "Users will be able to more quickly and systematically alert administrators of suspicious malicious messages within Teams. The content of these messages may be sensitive in nature and therefore should be kept within the organization and not shared with Microsoft without first consulting company policy. Note: - The reported message remains visible to the user in the Teams client. - Users can report the same message multiple times. - The message sender isn't notified that messages were reported.",
+ "ImpactStatement": "Enabling message reporting has an impact beyond just addressing security concerns. When users of the platform report a message, the content could include messages that are threatening or harassing in nature, possibly stemming from colleagues. Due to this the security staff responsible for reviewing and acting on these reports should be equipped with the skills to discern and appropriately direct such messages to the relevant departments, such as Human Resources (HR).",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Messaging to open the messaging settings section. 4. Set Report a security concern to On. 5. Next, navigate to Microsoft 365 Defender https://security.microsoft.com/ 6. Expand System > Settings and select Email & collaboration. 7. Click on User reported settings. 8. Under Microsoft Teams check the box for Monitor reported items in Microsoft Teams and click Save. 9. Set Send reported messages to: to My reporting mailbox only with reports configured to be sent to authorized staff. To remediate using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Connect to Exchange Online PowerShell using Connect-ExchangeOnline. 3. Run the following cmdlet: Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true 4. To configure the Defender reporting policies, edit and run this script: $usersub = \"userreportedmessages@fabrikam.com\" # Change this. $params = @{ Identity = \"DefaultReportSubmissionPolicy\" EnableReportToMicrosoft = $false ReportChatMessageEnabled = $false ReportChatMessageToCustomizedAddressEnabled = $true ReportJunkToCustomizedAddress = $true ReportNotJunkToCustomizedAddress = $true ReportPhishToCustomizedAddress = $true ReportJunkAddresses = $usersub ReportNotJunkAddresses = $usersub ReportPhishAddresses = $usersub } Set-ReportSubmissionPolicy @params New-ReportSubmissionRule -Name DefaultReportSubmissionRule - ReportSubmissionPolicy DefaultReportSubmissionPolicy -SentTo $usersub",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com. 2. Click Settings & policies and select the Global (Org-wide default) settings tab. 3. Select Messaging to open the messaging settings section. 4. Verify that Report a security concern is On. 5. Next, navigate to Microsoft 365 Defender https://security.microsoft.com/ 6. Expand System > Settings and select Email & collaboration. 7. Click on User reported settings. 8. Under Microsoft Teams verify that Monitor reported items in Microsoft Teams is checked. 9. Verify that Send reported messages to: is set to My reporting mailbox only with report email addresses defined for authorized staff. To audit using PowerShell: 1. Connect to Teams PowerShell using Connect-MicrosoftTeams. 2. Run the following cmdlet for to assess Teams: Get-CsTeamsMessagingPolicy -Identity Global | fl AllowSecurityEndUserReporting 3. Verify that the value returned is True. 4. Connect to Exchange Online PowerShell using Connect-ExchangeOnline. 5. Run this cmdlet to assess Defender: Get-ReportSubmissionPolicy | fl Report* 6. Verify that the output matches the following values with organization specific email addresses: ReportJunkToCustomizedAddress : True ReportNotJunkToCustomizedAddress : True ReportPhishToCustomizedAddress : True ReportJunkAddresses : {SOC@contoso.com} ReportNotJunkAddresses : {SOC@contoso.com} ReportPhishAddresses : {SOC@contoso.com} ReportChatMessageEnabled : False ReportChatMessageToCustomizedAddressEnabled : True",
+ "AdditionalInformation": "",
+ "DefaultValue": "On (True) Report message destination: Microsoft Only",
+ "References": "https://learn.microsoft.com/en-us/defender-office-365/submissions-teams?view=o365-worldwide"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.1",
+ "Description": "This setting allows business-to-business (B2B) guests access to Microsoft Fabric, and contents that they have permissions to. With the setting turned off, B2B guest users receive an error when trying to access Power BI. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting allows business-to-business (B2B) guests access to Microsoft Fabric, and contents that they have permissions to. With the setting turned off, B2B guest users receive an error when trying to access Power BI. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Establishing and enforcing a dedicated security group prevents unauthorized access to Microsoft Fabric for guests collaborating in Azure that are new or assigned guest status from other applications. This upholds the principle of least privilege and uses role-based access control (RBAC). These security groups can also be used for tasks like conditional access, enhancing risk management and user accountability across the organization.",
+ "ImpactStatement": "Security groups will need to be more closely tended to and monitored.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Guest users can access Microsoft Fabric to one of these states: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Guest users can access Microsoft Fabric is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName AllowGuestUserToAccessSharedContent in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is false. o enabled is true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.2",
+ "Description": "This setting helps organizations choose whether new external users can be invited to the organization through Power BI sharing, permissions, and subscription experiences. This setting only controls the ability to invite through Power BI. The recommended state is Enabled for a subset of the organization or Disabled. Note: To invite external users to the organization, the user must also have the Microsoft Entra Guest Inviter role.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting helps organizations choose whether new external users can be invited to the organization through Power BI sharing, permissions, and subscription experiences. This setting only controls the ability to invite through Power BI. The recommended state is Enabled for a subset of the organization or Disabled. Note: To invite external users to the organization, the user must also have the Microsoft Entra Guest Inviter role.",
+ "RationaleStatement": "Establishing and enforcing a dedicated security group prevents unauthorized access to Microsoft Fabric for guests collaborating in Azure that are new or assigned guest status from other applications. This upholds the principle of least privilege and uses role-based access control (RBAC). These security groups can also be used for tasks like conditional access, enhancing risk management and user accountability across the organization.",
+ "ImpactStatement": "Guest user invitations will be limited to only specific employees.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Users can invite guest users to collaborate through item sharing and permissions to one of these states: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Users can invite guest users to collaborate through item sharing and permissions is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName ExternalSharingV2 in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is false. o enabled is true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing:https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-azure-ad-b2b#invite-guest-users"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.3",
+ "Description": "This setting allows Microsoft Entra B2B guest users to have full access to the browsing experience using the left-hand navigation pane in the organization. Guest users who have been assigned workspace roles or specific item permissions will continue to have those roles and/or permissions, even if this setting is disabled. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting allows Microsoft Entra B2B guest users to have full access to the browsing experience using the left-hand navigation pane in the organization. Guest users who have been assigned workspace roles or specific item permissions will continue to have those roles and/or permissions, even if this setting is disabled. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Establishing and enforcing a dedicated security group prevents unauthorized access to Microsoft Fabric for guests collaborating in Entra that are new or assigned guest status from other applications. This upholds the principle of least privilege and uses role-based access control (RBAC). These security groups can also be used for tasks like conditional access, enhancing risk management and user accountability across the organization.",
+ "ImpactStatement": "Security groups will need to be more closely tended to and monitored.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Guest users can browse and access Fabric content to one of these states: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Guest users can browse and access Fabric content is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName ElevatedGuestsTenant in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is false. o enabled is true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.4",
+ "Description": "Power BI enables users to share reports and materials directly on the internet from both the application's desktop version and its web user interface. This functionality generates a publicly reachable web link that doesn't necessitate authentication or the need to be an Entra ID user in order to access and view it. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Power BI enables users to share reports and materials directly on the internet from both the application's desktop version and its web user interface. This functionality generates a publicly reachable web link that doesn't necessitate authentication or the need to be an Entra ID user in order to access and view it. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "When using Publish to Web anyone on the Internet can view a published report or visual. Viewing requires no authentication. It includes viewing detail-level data that your reports aggregate. By disabling the feature, restricting access to certain users and allowing existing embed codes organizations can mitigate the exposure of confidential or proprietary information.",
+ "ImpactStatement": "Depending on the organization's utilization administrators may experience more overhead managing embed codes, and requests.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Publish to web to one of these states: o Disabled o Enabled with Choose how embed codes work set to Only allow existing codes AND Specific security groups selected and defined Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Publish to web is set to one of the following: o Disabled o Enabled with Choose how embed codes work set to Only allow existing codes AND Specific security groups selected and defined Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName PublishToWeb in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is false. o enabled is true AND createP2w is false AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: The createP2w property can be found nested under properties.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization Only allow existing codes",
+ "References": "https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-publish-to-web:https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing#publish-to-web"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.5",
+ "Description": "Power BI allows the integration of R and Python scripts directly into visuals. This feature allows data visualizations by incorporating custom calculations, statistical analyses, machine learning models, and more using R or Python scripts. Custom visuals can be created by embedding them directly into Power BI reports. Users can then interact with these visuals and see the results of the custom code within the Power BI interface.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 2",
+ "AssessmentStatus": "Automated",
+ "Description": "Power BI allows the integration of R and Python scripts directly into visuals. This feature allows data visualizations by incorporating custom calculations, statistical analyses, machine learning models, and more using R or Python scripts. Custom visuals can be created by embedding them directly into Power BI reports. Users can then interact with these visuals and see the results of the custom code within the Power BI interface.",
+ "RationaleStatement": "Disabling this feature can reduce the attack surface by preventing potential malicious code execution leading to data breaches, or unauthorized access. The potential for sensitive or confidential data being leaked to unintended users is also increased with the use of scripts.",
+ "ImpactStatement": "Use of R and Python scripting will require exceptions for developers, along with more stringent code review.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to R and Python visuals settings. 4. Set Interact with and share R and Python visuals to Disabled",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to R and Python visuals settings. 4. Verify that Interact with and share R and Python visuals is set to Disabled To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName RScriptVisual in the output. 3. Verify that enabled is false.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-r-python-visuals:https://learn.microsoft.com/en-us/power-bi/visuals/service-r-visuals:https://www.r-project.org/"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.6",
+ "Description": "Information protection tenant settings help to protect sensitive information in the Power BI tenant. Allowing and applying sensitivity labels to content ensures that information is only seen and accessed by the appropriate users. The recommended state is Enabled or Enabled for a subset of the organization. Note: Sensitivity labels and protection are only applied to files exported to Excel, PowerPoint, or PDF files, that are controlled by \"Export to Excel\" and \"Export reports as PowerPoint presentation or PDF documents\" settings. All other export and sharing options do not support the application of sensitivity labels and protection. Note 2: There are some prerequisite steps that need to be completed in order to fully utilize labeling. See here.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Information protection tenant settings help to protect sensitive information in the Power BI tenant. Allowing and applying sensitivity labels to content ensures that information is only seen and accessed by the appropriate users. The recommended state is Enabled or Enabled for a subset of the organization. Note: Sensitivity labels and protection are only applied to files exported to Excel, PowerPoint, or PDF files, that are controlled by \"Export to Excel\" and \"Export reports as PowerPoint presentation or PDF documents\" settings. All other export and sharing options do not support the application of sensitivity labels and protection. Note 2: There are some prerequisite steps that need to be completed in order to fully utilize labeling. See here.",
+ "RationaleStatement": "Establishing data classifications and affixing labels to data at creation enables organizations to discern the data's criticality, sensitivity, and value. This initial identification enables the implementation of appropriate protective measures, utilizing technologies like Data Loss Prevention (DLP) to avert inadvertent exposure and enforcing access controls to safeguard against unauthorized access. This practice can also promote user awareness and responsibility in regard to the nature of the data they interact with. Which in turn can foster awareness in other areas of data management across the organization.",
+ "ImpactStatement": "Additional license requirements like Power BI Pro are required, as outlined in the Licensed and requirements page linked in the description and references sections.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Information protection. 4. Set Allow users to apply sensitivity labels for content to one of these states: o Enabled o Enabled with Specific security groups selected and defined.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Information protection. 4. Verify that Allow users to apply sensitivity labels for content is set to one of the following: o Enabled o Enabled with Specific security groups selected and defined. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName EimInformationProtectionEdit in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is true. o enabled is true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled",
+ "References": "https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels:https://learn.microsoft.com/en-us/fabric/governance/data-loss-prevention-overview:https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels#licensing-and-requirements"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.7",
+ "Description": "Creating a shareable link allows a user to create a link to a report or dashboard, then add that link to an email or another messaging application. There are 3 options that can be selected when creating a shareable link: - People in your organization - People with existing access - Specific people This setting solely deals with restrictions to People in the organization. External users by default are not included in any of these categories, and therefore cannot use any of these links regardless of the state of this setting. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Creating a shareable link allows a user to create a link to a report or dashboard, then add that link to an email or another messaging application. There are 3 options that can be selected when creating a shareable link: - People in your organization - People with existing access - Specific people This setting solely deals with restrictions to People in the organization. External users by default are not included in any of these categories, and therefore cannot use any of these links regardless of the state of this setting. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "While external users are unable to utilize shareable links, disabling or restricting this feature ensures that a user cannot generate a link accessible by individuals within the same organization who lack the necessary clearance to the shared data. For example, a member of Human Resources intends to share sensitive information with a particular employee or another colleague within their department. The owner would be prompted to specify either People with existing access or Specific people when generating the link requiring the person clicking the link to pass a first layer access control list. This measure along with proper file and folder permissions can help prevent unintended access and potential information leakage.",
+ "ImpactStatement": "If the setting is Enabled then only specific people in the organization would be allowed to create general links viewable by the entire organization.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Allow shareable links to grant access to everyone in your organization to one of these states: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Allow shareable links to grant access to everyone in your organization is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName ShareLinkToEntireOrg in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is set to false. o enabled is set to true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-share-dashboards?wt.mc_id=powerbi_inproduct_sharedialog#link-settings:https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.8",
+ "Description": "Power BI admins can specify which users or user groups can share datasets externally with guests from a different tenant through the in-place mechanism. Disabling this setting prevents any user from sharing datasets externally by restricting the ability of users to turn on external sharing for datasets they own or manage. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Power BI admins can specify which users or user groups can share datasets externally with guests from a different tenant through the in-place mechanism. Disabling this setting prevents any user from sharing datasets externally by restricting the ability of users to turn on external sharing for datasets they own or manage. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Establishing and enforcing a dedicated security group prevents unauthorized access to Microsoft Fabric for guests collaborating in Azure that are new or from other applications. This upholds the principle of least privilege and uses role-based access control (RBAC). These security groups can also be used for tasks like conditional access, enhancing risk management and user accountability across the organization.",
+ "ImpactStatement": "Security groups will need to be more closely tended to and monitored.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Set Allow specific users to turn on external data sharing to one of these states: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Export and Sharing settings. 4. Verify that Allow specific users to turn on external data sharing is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName EnableDatasetInPlaceSharing in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is set to false. o enabled is set to true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-export-sharing"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.9",
+ "Description": "This setting blocks the use of resource key based authentication. The Block ResourceKey Authentication setting applies to streaming and PUSH datasets. If blocked users will not be allowed to send data to streaming and PUSH datasets using the API with a resource key. The recommended state is Enabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "This setting blocks the use of resource key based authentication. The Block ResourceKey Authentication setting applies to streaming and PUSH datasets. If blocked users will not be allowed to send data to streaming and PUSH datasets using the API with a resource key. The recommended state is Enabled.",
+ "RationaleStatement": "Resource keys are a form of authentication that allows users to access Power BI resources (such as reports, dashboards, and datasets) without requiring individual user accounts. While convenient, this method bypasses the organization's centralized identity and access management controls. Enabling ensures that access to Power BI resources is tied to the organization's authentication mechanisms, providing a more secure and controlled environment.",
+ "ImpactStatement": "Developers will need to request a special exception in order to use this feature.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Block ResourceKey Authentication to Enabled",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Verify that Block ResourceKey Authentication is set to Enabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName BlockResourceKeyAuthentication in the output. 3. Verify that enabled is set to true. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-developer:https://learn.microsoft.com/en-us/power-bi/connect-data/service-real-time-streaming"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.10",
+ "Description": "Use a service principal to access Fabric public APIs that include create, read, update, and delete (CRUD) operations, and are protected by a Fabric permission model. To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Use a service principal to access Fabric public APIs that include create, read, update, and delete (CRUD) operations, and are protected by a Fabric permission model. To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.",
+ "ImpactStatement": "Service principals will need to be members of specific security groups in order to perform public API calls.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can call Fabric public APIs to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Verify that Service principals can call Fabric public APIs is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName ServicePrincipalAccessPermissionAPIs in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is set to false. o enabled is set to true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Enabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-developer"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.11",
+ "Description": "Service principal profiles provide a flexible solution for apps used in a multitenancy deployment. The profiles enable customer data isolation and tighter security boundaries between customers that are utilizing the app. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Service principal profiles provide a flexible solution for apps used in a multitenancy deployment. The profiles enable customer data isolation and tighter security boundaries between customers that are utilizing the app. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Service Principals should be restricted to a security group to limit which Service Principals can interact with profiles. This supports the principle of least privilege.",
+ "ImpactStatement": "Disabled is the default behavior.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Allow service principals to create and use profiles to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Verify that Allow service principals to create and use profiles is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName AllowServicePrincipalsCreateAndUseProfiles in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is set to false. o enabled is set to true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-developer:https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-multi-tenancy"
+ }
+ ]
+ },
+ {
+ "Id": "9.1.12",
+ "Description": "Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "Checks": [],
+ "Attributes": [
+ {
+ "Section": "9 Microsoft Fabric",
+ "SubSection": "9.1 Tenant settings",
+ "Profile": "E3 Level 1",
+ "AssessmentStatus": "Automated",
+ "Description": "Use a service principal to access these Fabric APIs that aren't protected by a Fabric permission model. - Create Workspace - Create Connection - Create Deployment Pipeline To allow an app to use service principal authentication, its service principal must be included in an allowed security group. You can control who can access service principals by creating dedicated security groups and using these groups in other tenant settings. The recommended state is Enabled for a subset of the organization or Disabled.",
+ "RationaleStatement": "Leaving API access unrestricted increases the attack surface in the event an adversary gains access to a Service Principal. APIs are a feature-rich method for programmatic access to many areas of Power Bi and should be guarded closely.",
+ "ImpactStatement": "Service principals will need to be members of specific security groups in order to perform public API calls.",
+ "RemediationProcedure": "To remediate using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Set Service principals can create workspaces, connections, and deployment pipelines to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled.",
+ "AuditProcedure": "To audit using the UI: 1. Navigate to Microsoft Fabric https://app.powerbi.com/admin-portal 2. Select Tenant settings. 3. Scroll to Developer settings. 4. Verify that Service principals can create workspaces, connections, and deployment pipelines is set to one of the following: o Disabled o Enabled with Specific security groups selected and defined. Important: If the organization doesn't actively use this feature it is recommended to keep it Disabled. To audit using PowerShell: 1. Inspect the results of the Get-CISFabricTenantSettings function from the section overview. 2. Locate the settingName ServicePrincipalAccessGlobalAPIs in the output. 3. Verify that the properties adhere to one of the following compliant configurations: o enabled is set to false. o enabled is set to true AND enabledSecurityGroups contains at least one security group. 4. If neither condition is met, the setting is non-compliant. Note: If the Specific security groups setting is not enabled then the enabledSecurityGroups property does not appear in the output.",
+ "AdditionalInformation": "",
+ "DefaultValue": "Disabled for the entire organization",
+ "References": "https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-developer"
+ }
+ ]
+ }
+ ]
+}
diff --git a/prowler/compliance/m365/prowler_threatscore_m365.json b/prowler/compliance/m365/prowler_threatscore_m365.json
index 286a4fff39..f5a6cd1cd8 100644
--- a/prowler/compliance/m365/prowler_threatscore_m365.json
+++ b/prowler/compliance/m365/prowler_threatscore_m365.json
@@ -819,6 +819,14 @@
"LevelOfRisk": 4,
"Weight": 100
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "entra_admin_users_sign_in_frequency_enabled",
+ "ConfigKey": "sign_in_frequency",
+ "Operator": "lte",
+ "Value": 4
+ }
]
},
{
@@ -964,6 +972,68 @@
"LevelOfRisk": 2,
"Weight": 8
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "defender_malware_policy_comprehensive_attachments_filter_applied",
+ "ConfigKey": "recommended_blocked_file_types",
+ "Operator": "superset",
+ "Value": [
+ "ace",
+ "ani",
+ "apk",
+ "app",
+ "appx",
+ "arj",
+ "bat",
+ "cab",
+ "cmd",
+ "com",
+ "deb",
+ "dex",
+ "dll",
+ "docm",
+ "elf",
+ "exe",
+ "hta",
+ "img",
+ "iso",
+ "jar",
+ "jnlp",
+ "kext",
+ "lha",
+ "lib",
+ "library",
+ "lnk",
+ "lzh",
+ "macho",
+ "msc",
+ "msi",
+ "msix",
+ "msp",
+ "mst",
+ "pif",
+ "ppa",
+ "ppam",
+ "reg",
+ "rev",
+ "scf",
+ "scr",
+ "sct",
+ "sys",
+ "uif",
+ "vb",
+ "vbe",
+ "vbs",
+ "vxd",
+ "wsc",
+ "wsf",
+ "wsh",
+ "xll",
+ "xz",
+ "z"
+ ]
+ }
]
},
{
diff --git a/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
index bac3d9132e..66747cdba7 100644
--- a/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
+++ b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
@@ -25,6 +25,14 @@
"CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the edit icon next to the Priority 1 rule. 4. Verify the \"Maximum Okta global session idle time\" is set to 15 minutes. If \"Maximum Okta global session idle time\" is not set to 15 minutes, this is a finding.",
"FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session idle time\" to 15 minutes."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "signon_global_session_idle_timeout_15min",
+ "ConfigKey": "okta_max_session_idle_minutes",
+ "Operator": "lte",
+ "Value": 15
+ }
]
},
{
@@ -46,6 +54,14 @@
"CheckText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", verify the \"Maximum app session idle time\" is set to 15 minutes. If the \"Maximum app session idle time\" is not set to 15 minutes, this is a finding.",
"FixText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", set the \"Maximum app session idle time\" to 15 minutes."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "application_admin_console_session_idle_timeout_15min",
+ "ConfigKey": "okta_admin_console_idle_timeout_max_minutes",
+ "Operator": "lte",
+ "Value": 15
+ }
]
},
{
@@ -69,6 +85,14 @@
"CheckText": "If Okta Services rely on external directory services for user sourcing, this is not applicable, and the connected directory services must perform this function. Go to Workflows >> Automations and verify that an Automation has been created to disable accounts after 35 days of inactivity. If the Okta configuration does not automatically disable accounts after a 35-day period of account inactivity, this is a finding.",
"FixText": "From the Admin Console: 1. Go to Workflow >> Automations and select \"Add Automation\". 2. Create a name for the Automation (e.g., \"User Inactivity\"). 3. Click \"Add Condition\" and select \"User Inactivity in Okta\". 4. In the duration field, enter 35 days and click \"Save\". 5 Click the edit button next to \"Select Schedule\". 6. Configure the \"Schedule\" field for \"Run Daily\" and set the \"Time\" field to an organizationally defined time to run this automation. Click \"Save\". 7. Click the edit button next to \"Select group membership\". 8. In the \"Applies to\" field, select the group \"Everyone\" by typing it into the field. Click \"Save\". 9. Click \"Add Action\" and select \"Change User lifecycle state in Okta\". 10. In the \"Change user state to\" field, select \"Suspended\" and click \"Save\". 11. Click the \"Inactive\" button near the top of the section screen and select \"Activate\"."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "user_inactivity_automation_35d_enabled",
+ "ConfigKey": "okta_user_inactivity_max_days",
+ "Operator": "lte",
+ "Value": 35
+ }
]
},
{
@@ -395,6 +419,14 @@
"CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the \"Edit\" icon next to the Priority 1 rule. 4. Verify \"Maximum Okta global session lifetime\" is set to 18 hours. If the above is not set, this is a finding.",
"FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session lifetime\" to 18 hours."
}
+ ],
+ "ConfigRequirements": [
+ {
+ "Check": "signon_global_session_lifetime_18h",
+ "ConfigKey": "okta_max_session_lifetime_minutes",
+ "Operator": "lte",
+ "Value": 1080
+ }
]
},
{
diff --git a/prowler/config/config.py b/prowler/config/config.py
index 78b48756fe..bee2984db3 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -49,7 +49,7 @@ class _MutableTimestamp:
timestamp = _MutableTimestamp(datetime.today())
timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.32.0"
+prowler_version = "5.36.0"
html_logo_url = "https://github.com/prowler-cloud/prowler/"
square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
@@ -81,6 +81,7 @@ class Provider(str, Enum):
OKTA = "okta"
STACKIT = "stackit"
LINODE = "linode"
+ E2ENETWORKS = "e2enetworks"
# Compliance
@@ -88,15 +89,22 @@ actual_directory = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
def _get_ep_compliance_dirs() -> dict:
- """Discover compliance directories from entry points. Returns {provider: path}."""
+ """Discover compliance directories from entry points. Returns {provider: [paths]}.
+
+ A provider may be contributed by several packages, so accumulate every
+ directory instead of overwriting.
+ """
dirs = {}
for ep in importlib.metadata.entry_points(group="prowler.compliance"):
try:
module = ep.load()
if hasattr(module, "__path__"):
- dirs[ep.name] = module.__path__[0]
+ path = module.__path__[0]
elif hasattr(module, "__file__"):
- dirs[ep.name] = os.path.dirname(module.__file__)
+ path = os.path.dirname(module.__file__)
+ else:
+ continue
+ dirs.setdefault(ep.name, []).append(path)
except Exception as error:
logger.warning(
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -145,12 +153,15 @@ def get_available_compliance_frameworks(provider=None):
continue
if name not in available_compliance_frameworks:
available_compliance_frameworks.append(name)
- # External per-provider compliance via entry points.
+ # External compliance via entry points; a provider may be served by
+ # several packages, so iterate every directory it contributes.
ep_dirs = _get_ep_compliance_dirs()
- for prov, path in ep_dirs.items():
+ for prov, paths in ep_dirs.items():
if provider and prov != provider:
continue
- if os.path.isdir(path):
+ for path in paths:
+ if not os.path.isdir(path):
+ continue
for file in os.scandir(path):
if file.is_file() and file.name.endswith(".json"):
name = file.name.removesuffix(".json")
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index 9d41a0e592..aba7fd6481 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -3,6 +3,32 @@ aws:
# AWS Global Configuration
# aws.mute_non_default_regions --> Set to True to muted failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config
mute_non_default_regions: False
+
+ # AWS Resource Scan Limit Configuration
+ # Limits the number of resources scanned per service for services that can
+ # accumulate huge numbers of resources (EBS snapshots, backup recovery
+ # points, CloudWatch log groups, Lambda functions, ECS task definitions,
+ # CodeArtifact packages). Limits apply to resources analyzed, not findings:
+ # a selected resource can produce zero, one, or many findings. Where the AWS
+ # API supports server-side ordering the latest resources are scanned first;
+ # otherwise it is best-effort API order.
+ # Disabled by default: scan every resource unless a positive limit is configured.
+ # Set to 0 (or a negative value) to disable the limit (scan every resource).
+ # aws.max_scanned_resources_per_service --> global default for all services below
+ max_scanned_resources_per_service: 0
+ # Per-service overrides. Leave as null to fall back to the global default.
+ # aws.max_ebs_snapshots --> ec2_ebs_* checks (EBS snapshots)
+ max_ebs_snapshots: null
+ # aws.max_backup_recovery_points --> backup_recovery_point_* checks
+ max_backup_recovery_points: null
+ # aws.max_cloudwatch_log_groups --> cloudwatch_log_group_* checks
+ max_cloudwatch_log_groups: null
+ # aws.max_lambda_functions --> awslambda_function_* checks
+ max_lambda_functions: null
+ # aws.max_ecs_task_definitions --> ecs_task_definitions_* checks
+ max_ecs_task_definitions: null
+ # aws.max_codeartifact_packages --> codeartifact_packages_* checks
+ max_codeartifact_packages: null
# aws.disallowed_regions --> List of AWS regions to exclude from the scan.
# Also settable via the PROWLER_AWS_DISALLOWED_REGIONS environment variable or
# the --excluded-region CLI flag. Precedence: CLI > env var > config file.
@@ -398,6 +424,21 @@ aws:
- "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"
- "SecurityPolicy_TLS13_1_2_PQ_2025_09"
+ # aws.elbv2_listener_pqc_tls_enabled
+ # Allowed post-quantum TLS security policies for ELBv2 HTTPS/TLS listeners
+ elbv2_listener_pqc_tls_allowed_policies:
+ - "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09"
+
# aws.rolesanywhere_trust_anchor_pqc_pki
# Allowed post-quantum key algorithms for AWS Private CAs backing IAM Roles Anywhere trust anchors
rolesanywhere_pqc_pca_key_algorithms:
@@ -423,6 +464,27 @@ aws:
# Patterns to ignore in the secrets checks
secrets_ignore_patterns: []
+ # aws.awslambda_function_no_secrets_in_code
+ # Glob patterns of file names inside the Lambda deployment package to skip
+ # when scanning for secrets. Useful to suppress known false positives such
+ # as .NET dependency manifests.
+ # Example:
+ # secrets_ignore_files:
+ # - "*.deps.json"
+ # WARNING: use at your own risk. Any file whose name matches one of these
+ # patterns is fully excluded from secret scanning, so a real secret placed
+ # in such a file will NOT be detected. Keep patterns as narrow and specific
+ # as possible; this is not recommended unless you have confirmed the matched
+ # files only ever contain false positives.
+ secrets_ignore_files: []
+
+ # Validate discovered secrets by checking whether they are live against the
+ # provider APIs. WARNING: this makes outbound network calls that authenticate
+ # with the discovered secret itself; the credential is exercised against the
+ # provider and the call will appear in the audited account's logs (and may
+ # trigger its monitoring). Disabled by default (scans stay fully offline).
+ secrets_validate: False
+
# AWS Secrets Manager Configuration
# aws.secretsmanager_secret_unused
# Maximum number of days a secret can be unused
@@ -436,36 +498,17 @@ aws:
# Minimum retention period in hours for Kinesis streams
min_kinesis_stream_retention_hours: 168 # 7 days
- # Detect Secrets plugin configuration
- detect_secrets_plugins: [
- {"name": "ArtifactoryDetector"},
- {"name": "AWSKeyDetector"},
- {"name": "AzureStorageKeyDetector"},
- {"name": "BasicAuthDetector"},
- {"name": "CloudantDetector"},
- {"name": "DiscordBotTokenDetector"},
- {"name": "GitHubTokenDetector"},
- {"name": "GitLabTokenDetector"},
- {"name": "Base64HighEntropyString", "limit": 6.0},
- {"name": "HexHighEntropyString", "limit": 3.0},
- {"name": "IbmCloudIamDetector"},
- {"name": "IbmCosHmacDetector"},
- # {"name": "IPPublicDetector"}, https://github.com/Yelp/detect-secrets/pull/885
- {"name": "JwtTokenDetector"},
- {"name": "KeywordDetector"},
- {"name": "MailchimpDetector"},
- {"name": "NpmDetector"},
- {"name": "OpenAIDetector"},
- {"name": "PrivateKeyDetector"},
- {"name": "PypiTokenDetector"},
- {"name": "SendGridDetector"},
- {"name": "SlackDetector"},
- {"name": "SoftlayerDetector"},
- {"name": "SquareOAuthDetector"},
- {"name": "StripeDetector"},
- # {"name": "TelegramBotTokenDetector"}, https://github.com/Yelp/detect-secrets/pull/878
- {"name": "TwilioKeyDetector"},
- ]
+ # AWS S3 Configuration
+ # aws.s3_bucket_object_public
+ # This check performs a spot-check by sampling object ACLs within a bucket, so
+ # it is disabled by default. For complete coverage, rely on s3_bucket_acl_prohibited
+ # which enforces BucketOwnerEnforced Object Ownership (AWS's recommended approach).
+ # Set s3_bucket_object_public_enabled to True to opt in.
+ s3_bucket_object_public_enabled: False
+ # Maximum number of objects to list per bucket (upper bound for the sampling pool)
+ s3_bucket_object_public_max_objects: 100
+ # Number of objects to randomly sample from the listed pool and inspect ACLs for
+ s3_bucket_object_public_sample_size: 3
# AWS CodeBuild Configuration
# aws.codebuild_project_uses_allowed_github_organizations
@@ -705,9 +748,76 @@ okta:
# 15 per DISA STIG V-273186 (OKTA-APP-000020); raise it only with an
# explicit risk acceptance.
okta_max_session_idle_minutes: 15
+ # okta.signon_global_session_lifetime_18h
+ # Maximum acceptable Global Session lifetime, in minutes. Defaults to
+ # 18h (1080); raise it only with an explicit risk acceptance.
+ okta_max_session_lifetime_minutes: 1080
# Okta Applications
# okta.application_admin_console_session_idle_timeout_15min
# Maximum acceptable Okta Admin Console app idle timeout, in minutes.
# Defaults to 15 per DISA STIG V-273187 (OKTA-APP-000025); raise it only
# with an explicit risk acceptance.
okta_admin_console_idle_timeout_max_minutes: 15
+ # Okta API rate limiting
+ # Max retries on HTTP 429. The Okta SDK sleeps until the X-Rate-Limit-Reset
+ # window before each retry, so raising this lets scans ride out more rate-limit
+ # windows on busy orgs instead of failing with partial data. SDK default is 2.
+ okta_max_retries: 5
+ # Per-request timeout in seconds. In the Okta SDK this value plays a DUAL role:
+ # it is both the per-HTTP-call socket timeout AND the total wall-clock budget
+ # across the whole retry+backoff loop. It defaults to 300 (not 0) because it is
+ # the only effective hang guard, and 300s is the smallest value that still lets
+ # all okta_max_retries rate-limit waits (~60s Okta reset windows) complete
+ # without being cut short. Keep it roughly >= okta_max_retries * 60 if you
+ # raise okta_max_retries.
+ okta_request_timeout: 300
+ # Maximum aggregate Okta API requests per second. Prowler paces all requests
+ # through a shared limiter so scans stay under Okta's rate limits proactively,
+ # rather than relying on the 429 retry above as a safety net. Okta enforces
+ # limits per endpoint, so this is a deliberately simple global cap; lower it if
+ # scans still hit limits, raise it to scan faster. Set to 0 to disable. Valid
+ # range: 0 or 0.1..100 — non-zero rates below 0.1 are rejected because they
+ # would make a scan impractically slow.
+ okta_requests_per_second: 4
+ # Okta Users
+ # okta.user_inactivity_automation_35d_enabled
+ # Maximum number of days a user can stay inactive before the
+ # inactivity-automation check flags the org. Defaults to 35.
+ okta_user_inactivity_max_days: 35
+ # Okta Identity Providers
+ # okta.idp_smart_card_dod_approved_ca
+ # Extra regex patterns matched against a Smart Card IdP certificate issuer
+ # DN to recognise a DOD-approved CA, on top of the built-in `OU=DoD` /
+ # `OU=ECA` patterns.
+ okta_dod_approved_ca_issuer_patterns: []
+
+alibabacloud:
+ # alibabacloud.cs_kubernetes_cluster_check_recent / cs_kubernetes_cluster_check_weekly
+ # Maximum number of days an ACK cluster can go without a security check
+ # before being flagged. Defaults to 7.
+ max_cluster_check_days: 7
+ # alibabacloud.ram_user_console_access_unused
+ # Days a RAM user's console access can stay unused before being flagged.
+ # Defaults to 90.
+ max_console_access_days: 90
+ # alibabacloud.sls_logstore_retention_period
+ # Minimum required SLS log store retention, in days. Defaults to 365.
+ min_log_retention_days: 365
+ # alibabacloud.rds_instance_sql_audit_retention
+ # Minimum required RDS SQL audit log retention, in days. Defaults to 180.
+ min_rds_audit_retention_days: 180
+
+openstack:
+ # openstack.image_not_shared_with_multiple_projects
+ # Maximum number of accepted project members a shared image may have before
+ # being flagged. Defaults to 5.
+ image_sharing_threshold: 5
+ # openstack.<compute|blockstorage|objectstorage>_*_metadata_sensitive_data
+ # Regex patterns whose matches are excluded from secret scanning of
+ # resource metadata.
+ secrets_ignore_patterns: []
+
+# E2E Networks Configuration
+e2enetworks:
+ # load_balancer_bitninja_enabled
+ require_bitninja_on_load_balancers: false
diff --git a/prowler/config/e2enetworks_mutelist_example.yaml b/prowler/config/e2enetworks_mutelist_example.yaml
new file mode 100644
index 0000000000..40443287a6
--- /dev/null
+++ b/prowler/config/e2enetworks_mutelist_example.yaml
@@ -0,0 +1,23 @@
+### Account, Check and/or Region can be * to apply for all the cases.
+### Account == * (E2E Networks findings are matched by resource, so use * to apply to all)
+### Region == <E2E Networks location, e.g. Delhi> or * for all locations
+### Resources and tags are lists that can have either Regex or Keywords.
+### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
+### Use an alternation Regex to match one of multiple tags with "ORed" logic.
+### For each check you can except Accounts, Regions, Resources and/or Tags.
+########################### MUTELIST EXAMPLE ###########################
+Mutelist:
+ Accounts:
+ "*":
+ Checks:
+ "node_public_ip_not_assigned":
+ Regions:
+ - "Delhi"
+ Resources:
+ - "example-node-id"
+ - "bastion-.*"
+ "storage_bucket_public_access_disabled":
+ Regions:
+ - "*"
+ Resources:
+ - "public-assets-bucket"
diff --git a/prowler/config/scan_config_schema.py b/prowler/config/scan_config_schema.py
index ac00250c78..431c4cec60 100644
--- a/prowler/config/scan_config_schema.py
+++ b/prowler/config/scan_config_schema.py
@@ -9,21 +9,49 @@ The Prowler App, however, needs to surface those errors to the user when
they save a Scan Config from the UI, and to expose the schema as JSON so
the UI can validate live with `ajv`. This module provides:
-- `validate_scan_config(payload)` — STRICT: returns a list of
- `{path, message}` errors without silently dropping anything. The DRF
- serializer (`api/.../v1/serializers.py:validate_scan_config_payload`)
- turns each entry into a `ValidationError`.
+- `validate_and_normalize_scan_config(payload)` — STRICT: returns
+ ``(normalized, errors)``. When ``errors`` is non-empty the normalized
+ dictionary is empty so callers never persist a partially validated
+ configuration. On success the normalized payload is JSON-serializable
+ (`model_dump(mode="json", exclude_unset=True)`), so the API can store
+ it directly in a Django ``JSONField`` and consume it at scan time
+ without re-running schema validation.
+
+- `validate_scan_config(payload)` — thin backward-compatible wrapper that
+ returns only the validation errors, preserved for callers that don't
+ need the normalized payload.
- `SCAN_CONFIG_SCHEMA` — aggregated JSON Schema derived from the Pydantic
models via `model_json_schema()`. Served by the `/scan-configs/schema`
endpoint and consumed by the UI editor for in-editor live validation.
"""
+import json
+from functools import lru_cache
from typing import Any
from pydantic import ValidationError
from prowler.config.schema.registry import SCHEMAS
+from prowler.lib.check.check import list_services
+from prowler.lib.check.models import CheckMetadata
+
+# Pydantic v2 prefixes messages emitted from a ``field_validator`` that
+# raises ``ValueError`` with this string. Strip it so the message that
+# reaches the UI is the one the validator actually wrote.
+_PYDANTIC_VALUE_ERROR_PREFIX = "Value error, "
+
+
+@lru_cache(maxsize=None)
+def _get_provider_check_ids(provider: str) -> frozenset[str]:
+ """Return cached check identifiers for a provider."""
+ return frozenset(CheckMetadata.get_bulk(provider))
+
+
+@lru_cache(maxsize=None)
+def _get_provider_services(provider: str) -> frozenset[str]:
+ """Return cached service identifiers for a provider."""
+ return frozenset(list_services(provider))
def _format_loc(loc: tuple) -> str:
@@ -50,48 +78,145 @@ def _format_loc(loc: tuple) -> str:
return ".".join(parts) if parts else "<root>"
-def validate_scan_config(payload: Any) -> list[dict]:
- """Validate a scan config payload against the registered provider schemas.
+def validate_and_normalize_scan_config(
+ payload: Any,
+) -> tuple[dict, list[dict[str, str]]]:
+ """Strict validation and normalization of a scan configuration payload.
- Strict by design: every Pydantic violation surfaces as a `{path, message}`
- entry so the caller can decide how to present it. Unknown provider
- sections are accepted (consistent with `additionalProperties: True` at
- the top level — the SDK simply has no opinion on them).
+ Returns ``(normalized, errors)``:
+
+ - ``normalized`` is a JSON-serializable dict that mirrors the layout of
+ ``prowler/config/config.yaml`` (keyed by provider type). Registered
+ provider sections are dumped from their Pydantic models with
+ ``mode="json"`` (so the API can persist the result in a Django
+ ``JSONField``) and ``exclude_unset=True`` (so omitted defaults are
+ not injected into pre-existing configurations). Unknown provider
+ sections and unknown keys inside registered sections are preserved
+ untouched for forward compatibility with plugin-provided keys.
+ - ``errors`` is a list of ``{"path": <dotted-path>, "message": <str>}``
+ entries, one per schema or exclusion-catalog violation. When any error
+ is present the normalized dictionary is returned empty so the caller
+ never persists a partially validated configuration.
+
+ The input payload is never mutated.
"""
if not isinstance(payload, dict):
- return [
+ return {}, [
{
"path": "<root>",
"message": "Scan config must be a mapping with provider sections.",
}
]
- errors: list[dict] = []
+ errors: list[dict[str, str]] = []
+ normalized: dict[str, Any] = {}
+
for provider, section in payload.items():
- schema_cls = SCHEMAS.get(provider)
+ # Reject non-string provider keys so distinct entries like ``123``
+ # and ``"123"`` don't collide after ``str()`` in the normalized dict.
+ # YAML always produces string keys at this level; anything else
+ # comes from a hand-built payload and is a caller bug.
+ if not isinstance(provider, str):
+ errors.append(
+ {
+ "path": repr(provider),
+ "message": "provider keys must be strings.",
+ }
+ )
+ continue
+
+ provider_key = provider
+ schema_cls = SCHEMAS.get(provider_key)
if schema_cls is None:
- # Unknown provider type: tolerated. The SDK will simply ignore it.
+ # Unknown provider type: tolerated, but only when its contents
+ # are already JSON-serializable. The API persists the returned
+ # payload in a Django ``JSONField`` and would blow up at write
+ # time if we let a ``set()`` or similar through here.
+ try:
+ json.dumps(section)
+ except (TypeError, ValueError) as exc:
+ errors.append(
+ {
+ "path": provider_key,
+ "message": (
+ "unknown provider section is not JSON-serializable: "
+ f"{exc}"
+ ),
+ }
+ )
+ continue
+ normalized[provider_key] = section
continue
if not isinstance(section, dict):
errors.append(
{
- "path": str(provider),
+ "path": provider_key,
"message": "section must be a mapping.",
}
)
continue
try:
- schema_cls.model_validate(section)
+ model = schema_cls.model_validate(section)
except ValidationError as exc:
for err in exc.errors():
loc = err.get("loc") or ()
- path = _format_loc((str(provider), *loc))
- errors.append(
- {
- "path": path,
- "message": err.get("msg", "validation error"),
- }
- )
+ path = _format_loc((provider_key, *loc))
+ message = err.get("msg", "validation error")
+ # Only strip on the specific error type that pydantic
+ # prefixes — a legitimate future message that happens to
+ # start with "Value error, " keeps its text intact.
+ if err.get("type") == "value_error" and message.startswith(
+ _PYDANTIC_VALUE_ERROR_PREFIX
+ ):
+ message = message[len(_PYDANTIC_VALUE_ERROR_PREFIX) :]
+ errors.append({"path": path, "message": message})
+ continue
+
+ if model.excluded_checks:
+ available_checks = _get_provider_check_ids(provider_key)
+ for index, check in enumerate(model.excluded_checks):
+ if check not in available_checks:
+ errors.append(
+ {
+ "path": f"{provider_key}.excluded_checks[{index}]",
+ "message": (
+ f"Unknown check '{check}' for provider "
+ f"'{provider_key}'."
+ ),
+ }
+ )
+
+ if model.excluded_services:
+ available_services = _get_provider_services(provider_key)
+ for index, service in enumerate(model.excluded_services):
+ if service not in available_services:
+ errors.append(
+ {
+ "path": f"{provider_key}.excluded_services[{index}]",
+ "message": (
+ f"Unknown service '{service}' for provider "
+ f"'{provider_key}'."
+ ),
+ }
+ )
+
+ normalized[provider_key] = model.model_dump(mode="json", exclude_unset=True)
+
+ if errors:
+ return {}, errors
+ return normalized, []
+
+
+def validate_scan_config(payload: Any) -> list[dict]:
+ """Backward-compatible wrapper returning only validation errors.
+
+ Preserved for callers that only need the strict-validation error list
+ (e.g. the DRF serializer that turns each entry into a
+ ``ValidationError``). New callers should prefer
+ :func:`validate_and_normalize_scan_config` to also receive the
+ normalized payload.
+ """
+ _, errors = validate_and_normalize_scan_config(payload)
return errors
diff --git a/prowler/config/schema/alibabacloud.py b/prowler/config/schema/alibabacloud.py
new file mode 100644
index 0000000000..104f8a3556
--- /dev/null
+++ b/prowler/config/schema/alibabacloud.py
@@ -0,0 +1,54 @@
+"""Alibaba Cloud provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class AlibabaCloudProviderConfig(ProviderConfigBase):
+ """Alibaba Cloud provider configuration schema.
+
+ Bounds the retention and staleness thresholds consumed by the Alibaba
+ Cloud checks. Every field is optional: when omitted (or dropped for being
+ out of range) the check falls back to its own default via
+ ``audit_config.get(key, default)``.
+ """
+
+ max_cluster_check_days: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=365,
+ description=(
+ "Maximum number of days an ACK cluster can go without a security "
+ "check before being flagged. Range: 1..365 (defaults to 7)."
+ ),
+ )
+ max_console_access_days: Optional[int] = Field(
+ default=None,
+ ge=30,
+ le=180,
+ description=(
+ "Days a RAM user's console access can stay unused before being "
+ "flagged. Range: 30..180 (defaults to 90)."
+ ),
+ )
+ min_log_retention_days: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=3650,
+ description=(
+ "Minimum required SLS log store retention, in days. Range: "
+ "1..3650 (defaults to 365)."
+ ),
+ )
+ min_rds_audit_retention_days: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=3650,
+ description=(
+ "Minimum required RDS SQL audit log retention, in days. Range: "
+ "1..3650 (defaults to 180)."
+ ),
+ )
diff --git a/prowler/config/schema/aws.py b/prowler/config/schema/aws.py
index 1a44bb9bcc..7ac12d60de 100644
--- a/prowler/config/schema/aws.py
+++ b/prowler/config/schema/aws.py
@@ -14,7 +14,7 @@ thresholds) and avoids ints that obviously break downstream maths
from typing import Annotated, Literal, Optional
-from pydantic import AfterValidator, Field
+from pydantic import AfterValidator, BeforeValidator, Field
from prowler.config.schema.base import ProviderConfigBase
from prowler.config.schema.validators import (
@@ -101,33 +101,65 @@ def _validate_account_ids(v: Optional[list[str]]) -> Optional[list[str]]:
return v
-# ---- Nested models ----------------------------------------------------------
+def _reject_bool_resource_limit(v):
+ if isinstance(v, bool):
+ raise ValueError("resource scan limits must be integers, not booleans")
+ return v
-class _DetectSecretsPlugin(ProviderConfigBase):
- """One entry inside ``detect_secrets_plugins``.
-
- Only ``name`` is required by the upstream library. ``limit`` is used by
- the entropy detectors. Any other plugin-specific kwarg is preserved by
- the ``extra="allow"`` policy inherited from ProviderConfigBase.
- """
-
- name: str
- limit: Optional[float] = Field(
- default=None,
- ge=0.0,
- le=10.0,
- description=(
- "Entropy threshold for detect-secrets entropy plugins. Range: 0..10 "
- "(Shannon entropy is bounded by log2(256)=8; >10 is meaningless)."
- ),
- )
+ResourceScanLimit = Annotated[
+ Optional[int], BeforeValidator(_reject_bool_resource_limit)
+]
# ---- Main schema ------------------------------------------------------------
class AWSProviderConfig(ProviderConfigBase):
+ # --- Resource scan limits ---------------------------------------------
+ max_scanned_resources_per_service: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Global resource scan limit for high-volume AWS services. Use 0 or -1 to disable.",
+ )
+ max_ebs_snapshots: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for EBS snapshots. Use 0 or -1 to disable.",
+ )
+ max_backup_recovery_points: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for AWS Backup recovery points. Use 0 or -1 to disable.",
+ )
+ max_cloudwatch_log_groups: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for CloudWatch log groups. Use 0 or -1 to disable.",
+ )
+ max_lambda_functions: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for Lambda functions. Use 0 or -1 to disable.",
+ )
+ max_ecs_task_definitions: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for ECS task definitions. Use 0 or -1 to disable.",
+ )
+ max_codeartifact_packages: ResourceScanLimit = Field(
+ default=None,
+ ge=-1,
+ le=1_000_000,
+ description="Resource scan limit for CodeArtifact packages. Use 0 or -1 to disable.",
+ )
+
# --- IAM ---------------------------------------------------------------
mute_non_default_regions: Optional[bool] = None
disallowed_regions: Optional[list[str]] = None
@@ -383,6 +415,10 @@ class AWSProviderConfig(ProviderConfigBase):
le=6,
description="Min AZs an Application/Network LB must span. Range: 1..6.",
)
+ elbv2_listener_pqc_tls_allowed_policies: Optional[list[str]] = Field(
+ default=None,
+ description="ELBv2 SSL policies that satisfy the PQ TLS listener check.",
+ )
# --- ElastiCache -----------------------------------------------------
minimum_snapshot_retention_period: Optional[int] = Field(
@@ -394,6 +430,15 @@ class AWSProviderConfig(ProviderConfigBase):
# --- Secrets ---------------------------------------------------------
secrets_ignore_patterns: Optional[list[str]] = None
+ secrets_ignore_files: Optional[list[str]] = None
+ secrets_validate: Optional[bool] = Field(
+ default=None,
+ description=(
+ "Validate discovered secrets against the provider APIs (live check). "
+ "Makes outbound network calls that authenticate with the discovered "
+ "secret. Disabled by default."
+ ),
+ )
max_days_secret_unused: Optional[int] = Field(
default=None,
ge=7,
@@ -418,5 +463,30 @@ class AWSProviderConfig(ProviderConfigBase):
description="Hours of Kinesis stream retention. Range: 24..8760 (1 day .. 1 year).",
)
- # --- detect-secrets plugin list -------------------------------------
- detect_secrets_plugins: Optional[list[_DetectSecretsPlugin]] = None
+ # --- S3 --------------------------------------------------------------
+ s3_bucket_object_public_enabled: Optional[bool] = Field(
+ default=None,
+ description=(
+ "Enable the s3_bucket_object_public spot-check, which samples object "
+ "ACLs per bucket. Disabled by default because it lists and reads object "
+ "ACLs, which is expensive on large buckets."
+ ),
+ )
+ s3_bucket_object_public_max_objects: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=1000,
+ description=(
+ "Max objects to list per bucket as the sampling pool. Range: 1..1000 "
+ "(ListObjectsV2 returns at most 1000 keys per page)."
+ ),
+ )
+ s3_bucket_object_public_sample_size: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=1000,
+ description=(
+ "Number of objects sampled from the listed pool for ACL inspection. "
+ "Range: 1..1000. Must be positive to avoid a no-op or invalid sample."
+ ),
+ )
diff --git a/prowler/config/schema/base.py b/prowler/config/schema/base.py
index cc473a4545..fc5a76af43 100644
--- a/prowler/config/schema/base.py
+++ b/prowler/config/schema/base.py
@@ -1,4 +1,12 @@
-from pydantic import BaseModel, ConfigDict
+from typing import Annotated
+
+from pydantic import BaseModel, ConfigDict, Field, StringConstraints, field_validator
+
+# Item type for excluded_checks / excluded_services list entries. Item
+# whitespace is stripped via ``str_strip_whitespace`` on the base
+# ``model_config`` (no second stripping implementation added here), so
+# ``min_length=1`` catches "", " ", and any all-whitespace input uniformly.
+NonEmptyScopeIdentifier = Annotated[str, StringConstraints(min_length=1)]
class ProviderConfigBase(BaseModel):
@@ -15,3 +23,28 @@ class ProviderConfigBase(BaseModel):
str_strip_whitespace=True,
validate_assignment=False,
)
+
+ excluded_checks: list[NonEmptyScopeIdentifier] = Field(
+ default_factory=list,
+ description="Check identifiers to exclude from the scan scope.",
+ json_schema_extra={"default": [], "uniqueItems": True},
+ )
+ excluded_services: list[NonEmptyScopeIdentifier] = Field(
+ default_factory=list,
+ description="Service identifiers to exclude from the scan scope.",
+ json_schema_extra={"default": [], "uniqueItems": True},
+ )
+
+ @field_validator("excluded_checks", "excluded_services")
+ @classmethod
+ def _reject_duplicates(cls, value: list[str]) -> list[str]:
+ seen: set[str] = set()
+ duplicates: set[str] = set()
+ for item in value:
+ if item in seen:
+ duplicates.add(item)
+ else:
+ seen.add(item)
+ if duplicates:
+ raise ValueError(f"duplicate values are not allowed: {sorted(duplicates)}")
+ return value
diff --git a/prowler/config/schema/e2enetworks.py b/prowler/config/schema/e2enetworks.py
new file mode 100644
index 0000000000..57e29e32d6
--- /dev/null
+++ b/prowler/config/schema/e2enetworks.py
@@ -0,0 +1,22 @@
+"""E2E Networks provider config schema."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class E2eNetworksProviderConfig(ProviderConfigBase):
+ """E2E Networks provider configuration schema.
+
+ Defines optional configuration parameters for E2E Networks security checks.
+ """
+
+ require_bitninja_on_load_balancers: Optional[bool] = Field(
+ default=None,
+ description=(
+ "Whether BitNinja protection is required on load balancers for the "
+ "loadbalancer_bitninja_enabled check."
+ ),
+ )
diff --git a/prowler/config/schema/okta.py b/prowler/config/schema/okta.py
new file mode 100644
index 0000000000..933948f3b6
--- /dev/null
+++ b/prowler/config/schema/okta.py
@@ -0,0 +1,124 @@
+"""Okta provider config schema with safety bounds."""
+
+from typing import Annotated, Optional
+
+from pydantic import AfterValidator, Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+# Lowest non-zero request rate we accept. Below this a scan is paced so slowly
+# it becomes impractical (e.g. 0.001 req/s is ~1000s per request, turning a
+# routine scan into days or years). 0 stays valid as the "disable throttling"
+# sentinel; anything between 0 and this floor is rejected so a typo can never
+# stall a scan.
+MIN_REQUESTS_PER_SECOND = 0.1
+
+
+def _validate_requests_per_second(value: Optional[float]) -> Optional[float]:
+ """Reject impractically slow non-zero request rates.
+
+ ``0`` (and ``None``) pass through unchanged — ``0`` is the documented
+ "disable throttling" sentinel. Any positive value below
+ ``MIN_REQUESTS_PER_SECOND`` is rejected; the ``ge``/``le`` bounds on the
+ field already handle negatives and the upper cap.
+ """
+ if value is None or value == 0:
+ return value
+ if value < MIN_REQUESTS_PER_SECOND:
+ raise ValueError(
+ f"must be 0 (disable throttling) or >= {MIN_REQUESTS_PER_SECOND}; "
+ "smaller rates make scans impractically slow"
+ )
+ return value
+
+
+class OktaProviderConfig(ProviderConfigBase):
+ """Okta provider configuration schema.
+
+ Bounds the session, idle-timeout and inactivity thresholds consumed by
+ the Okta checks, plus the provider's API rate-limit handling (proactive
+ request throttling and the SDK retry safety net). Every field is optional:
+ when omitted (or dropped for being out of range) the check falls back to
+ its own DISA STIG-derived default via ``audit_config.get(key, default)``.
+ """
+
+ okta_max_session_idle_minutes: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=1440,
+ description=(
+ "Maximum acceptable Global Session idle timeout, in minutes. "
+ "Range: 1..1440 (DISA STIG V-273186 recommends 15; raising it "
+ "weakens the idle-timeout control)."
+ ),
+ )
+ okta_max_session_lifetime_minutes: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=43200,
+ description=(
+ "Maximum acceptable Global Session lifetime, in minutes. "
+ "Range: 1..43200 i.e. up to 30 days (DISA STIG recommends 18h = "
+ "1080; raising it weakens the session-lifetime control)."
+ ),
+ )
+ okta_admin_console_idle_timeout_max_minutes: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=1440,
+ description=(
+ "Maximum acceptable Okta Admin Console app idle timeout, in "
+ "minutes. Range: 1..1440 (DISA STIG V-273187 recommends 15)."
+ ),
+ )
+ okta_user_inactivity_max_days: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=3650,
+ description=(
+ "Maximum number of days a user can stay inactive before the "
+ "inactivity-automation check flags the org. Range: 1..3650 "
+ "(defaults to 35)."
+ ),
+ )
+ okta_dod_approved_ca_issuer_patterns: Optional[list[str]] = Field(
+ default=None,
+ description=(
+ "Additional regex patterns matched against a Smart Card IdP "
+ "certificate issuer DN to recognise a DOD-approved CA. Extends "
+ "the built-in `OU=DoD` / `OU=ECA` patterns."
+ ),
+ )
+
+ # API rate limiting
+ okta_requests_per_second: Annotated[
+ Optional[float], AfterValidator(_validate_requests_per_second)
+ ] = Field(
+ default=None,
+ ge=0,
+ le=100,
+ description=(
+ "Maximum aggregate Okta API requests per second. Range: 0 or "
+ f"{MIN_REQUESTS_PER_SECOND}..100 (0 disables throttling). Non-zero "
+ f"values below {MIN_REQUESTS_PER_SECOND} are rejected to avoid "
+ "impractically slow scans."
+ ),
+ )
+ okta_max_retries: Optional[int] = Field(
+ default=None,
+ ge=0,
+ le=10,
+ description=(
+ "Max retries on Okta API rate limiting (HTTP 429). Range: 0..10 "
+ "(0 disables retries)."
+ ),
+ )
+ okta_request_timeout: Optional[int] = Field(
+ default=None,
+ ge=0,
+ le=3600,
+ description=(
+ "Per-request timeout in seconds; also the total budget for the SDK "
+ "retry loop. Range: 0..3600 (0 disables the timeout)."
+ ),
+ )
diff --git a/prowler/config/schema/openstack.py b/prowler/config/schema/openstack.py
new file mode 100644
index 0000000000..02b94136ef
--- /dev/null
+++ b/prowler/config/schema/openstack.py
@@ -0,0 +1,34 @@
+"""OpenStack provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class OpenStackProviderConfig(ProviderConfigBase):
+ """OpenStack provider configuration schema.
+
+ Bounds the image-sharing threshold and reuses the ``secrets_ignore_patterns``
+ config consumed by the metadata sensitive-data checks. Every field is
+ optional: when omitted (or dropped for being out of range) the check falls
+ back to its own default via ``audit_config.get(key, default)``.
+ """
+
+ image_sharing_threshold: Optional[int] = Field(
+ default=None,
+ ge=1,
+ le=1000,
+ description=(
+ "Maximum number of accepted project members a shared image may "
+ "have before being flagged. Range: 1..1000 (defaults to 5)."
+ ),
+ )
+ secrets_ignore_patterns: Optional[list[str]] = Field(
+ default=None,
+ description=(
+ "Regex patterns whose matches are excluded from secret "
+ "scanning of resource metadata."
+ ),
+ )
diff --git a/prowler/config/schema/registry.py b/prowler/config/schema/registry.py
index fa31f1e5eb..074ccc264d 100644
--- a/prowler/config/schema/registry.py
+++ b/prowler/config/schema/registry.py
@@ -4,15 +4,19 @@ Kept in its own module so the validator stays free of provider-schema imports
and callers pay the import cost only when they actually need the registry.
"""
+from prowler.config.schema.alibabacloud import AlibabaCloudProviderConfig
from prowler.config.schema.aws import AWSProviderConfig
from prowler.config.schema.azure import AzureProviderConfig
from prowler.config.schema.base import ProviderConfigBase
from prowler.config.schema.cloudflare import CloudflareProviderConfig
+from prowler.config.schema.e2enetworks import E2eNetworksProviderConfig
from prowler.config.schema.gcp import GCPProviderConfig
from prowler.config.schema.github import GitHubProviderConfig
from prowler.config.schema.kubernetes import KubernetesProviderConfig
from prowler.config.schema.m365 import M365ProviderConfig
from prowler.config.schema.mongodbatlas import MongoDBAtlasProviderConfig
+from prowler.config.schema.okta import OktaProviderConfig
+from prowler.config.schema.openstack import OpenStackProviderConfig
from prowler.config.schema.vercel import VercelProviderConfig
SCHEMAS: dict[str, type[ProviderConfigBase]] = {
@@ -24,5 +28,9 @@ SCHEMAS: dict[str, type[ProviderConfigBase]] = {
"github": GitHubProviderConfig,
"mongodbatlas": MongoDBAtlasProviderConfig,
"cloudflare": CloudflareProviderConfig,
+ "e2enetworks": E2eNetworksProviderConfig,
"vercel": VercelProviderConfig,
+ "okta": OktaProviderConfig,
+ "alibabacloud": AlibabaCloudProviderConfig,
+ "openstack": OpenStackProviderConfig,
}
diff --git a/prowler/lib/banner.py b/prowler/lib/banner.py
index 8115983bc6..e1c7fa5a35 100644
--- a/prowler/lib/banner.py
+++ b/prowler/lib/banner.py
@@ -2,6 +2,21 @@ from colorama import Fore, Style
from prowler.config.config import banner_color, orange_color, prowler_version, timestamp
+# Prowler Cloud landing URL used by the CLI banner. The visible text stays
+# "cloud.prowler.com" while the clickable target carries the UTM source so
+# terminals that support OSC 8 hyperlinks attribute the visit to the CLI.
+CLOUD_DISPLAY_TEXT = "cloud.prowler.com"
+CLOUD_BANNER_URL = "https://cloud.prowler.com/sign-up?utm_source=prowler-cli"
+
+
+def _hyperlink(url: str, text: str) -> str:
+ """Wrap ``text`` in an OSC 8 terminal hyperlink pointing to ``url``.
+
+ Terminals that support OSC 8 render ``text`` as a clickable link to ``url``;
+ those that do not simply display ``text`` unchanged.
+ """
+ return f"\033]8;;{url}\033\\{text}\033]8;;\033\\"
+
def print_banner(legend: bool = False, provider: str = None):
"""
@@ -18,8 +33,8 @@ def print_banner(legend: bool = False, provider: str = None):
_ __ _ __ _____ _| | ___ _ __
| '_ \| '__/ _ \ \ /\ / / |/ _ \ '__|
| |_) | | | (_) \ V V /| | __/ |
-| .__/|_| \___/ \_/\_/ |_|\___|_|v{prowler_version}
-|_|{Fore.BLUE} Get the most at https://cloud.prowler.com {Style.RESET_ALL}
+| .__/|_| \___/ \_/\_/ |_|\___|_| CLI - v{prowler_version}
+|_|
{Fore.YELLOW}Date: {timestamp.strftime("%Y-%m-%d %H:%M:%S")}{Style.RESET_ALL}
"""
@@ -43,8 +58,9 @@ def print_prowler_cloud_banner(provider: str = None):
the open-source CLI.
Shown at the start and end of a scan to let users know about the managed
- platform capabilities they are missing (attack paths, AI, organizations,
- continuous scanning, integrations and live compliance dashboards).
+ platform capabilities they are missing (CLI findings upload, attack paths,
+ AI, triage, organizations, continuous scanning with custom scheduling and
+ scan configuration, integrations and live compliance dashboards).
Parameters:
- provider (str): The provider that was scanned, used to tailor the message.
@@ -57,7 +73,9 @@ def print_prowler_cloud_banner(provider: str = None):
print(f"""
{bar} {Style.BRIGHT}You're getting a snapshot 📸. Prowler Cloud gives you the full picture:{Style.RESET_ALL}
{bar}
-{bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - scheduled scans with history, trends and alerts.
+{bar} {check} {Style.BRIGHT}Send your findings{Style.RESET_ALL} - directly from the Prowler CLI to Prowler Cloud.
+{bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - custom scheduling and scan configuration with history, trends and alerts.
+{bar} {check} {Style.BRIGHT}Triage{Style.RESET_ALL} - review findings, flag false positives and track accepted risk with your team.
{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, custom dashboards, prioritization with prevention and remediation.
{bar} {check} {Style.BRIGHT}Alerts{Style.RESET_ALL} - get notified when anything you want is happening.
{bar} {check} {Style.BRIGHT}Live Compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date.
@@ -66,5 +84,5 @@ def print_prowler_cloud_banner(provider: str = None):
{bar} {check} {Style.BRIGHT}Bulk Provisioning{Style.RESET_ALL} - add your entire AWS Organization in seconds.
{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Anything with our MCP + Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC.
{bar}
-{bar} {Fore.BLUE}Start free at 👉 cloud.prowler.com{Style.RESET_ALL}
+{bar} {banner_color}Start free at 👉 {_hyperlink(CLOUD_BANNER_URL, CLOUD_DISPLAY_TEXT)}{Style.RESET_ALL}
""")
diff --git a/prowler/lib/check/compliance_config_eval.py b/prowler/lib/check/compliance_config_eval.py
new file mode 100644
index 0000000000..0024d41e3f
--- /dev/null
+++ b/prowler/lib/check/compliance_config_eval.py
@@ -0,0 +1,410 @@
+"""Shared evaluation of a requirement's configuration constraints.
+
+Some compliance requirements only hold if the configurable checks they map to
+ran with a configuration strict enough for the requirement. For example CIS AWS
+6.0 requirement 2.11 ("credentials unused for 45 days or more are disabled")
+maps `iam_user_accesskey_unused` (config `max_unused_access_keys_days`); if the
+user loosens that to 120 days the check can PASS while the requirement is, in
+fact, not satisfied.
+
+A requirement declares its expectations via ``ConfigRequirements`` (a list of
+``{Check, ConfigKey, Operator, Value}``). The configuration a scan applied is a
+single, scan-global mapping (the provider's ``audit_config``), so the rules are
+evaluated against that mapping directly. This module is consumed by the SDK
+compliance outputs (CSV + CLI table) and by the Prowler App backend so the rule
+lives in one place.
+"""
+
+from typing import Any, Optional
+
+# Leading sentence of the message prepended to a finding's ``status_extended``
+# when its requirement's config constraints are not satisfied and the status is
+# forced to FAIL. It opens every config-not-valid message, so it doubles as a
+# stable marker for detecting the case programmatically.
+CONFIG_NOT_VALID_PREFIX = "Configuration not valid for this requirement."
+
+
+def _format_value(value: Any) -> str:
+ """Render a constraint value for a user-facing message (lists comma-joined)."""
+ if isinstance(value, (list, tuple, set)):
+ return ", ".join(str(item) for item in value)
+ return str(value)
+
+
+def _describe_violation(
+ check: Any, config_key: Any, applied: Any, operator: str, expected: Any
+) -> str:
+ """Return a product-friendly explanation of why a config violates a constraint.
+
+ The message names the check and config key, the value the scan applied, what
+ the requirement needs, and how to fix it, in plain language rather than the
+ operator/value pair.
+
+ Args:
+ check: the check the requirement maps to (e.g. ``iam_user_accesskey_unused``).
+ config_key: the config option that was too loose (e.g. ``max_unused_access_keys_days``).
+ applied: the value the scan actually applied.
+ operator: the constraint operator (``lte``/``gte``/``eq``/``in``/``subset``/``superset``).
+ expected: the value the requirement expects.
+
+ Returns:
+ A full, human-readable message ending with an actionable fix.
+ """
+ applied_str = _format_value(applied)
+ expected_str = _format_value(expected)
+ needs, fix = {
+ "lte": (
+ f"a value of {expected_str} or lower",
+ f"Update it to {expected_str} or lower.",
+ ),
+ "gte": (
+ f"a value of {expected_str} or higher",
+ f"Update it to {expected_str} or higher.",
+ ),
+ "eq": (
+ f"it set to {expected_str}",
+ f"Update it to {expected_str}.",
+ ),
+ "in": (
+ f"it set to one of {expected_str}",
+ f"Update it to one of {expected_str}.",
+ ),
+ "subset": (
+ f"it limited to {expected_str}",
+ f"Remove any value that is not in {expected_str}.",
+ ),
+ "superset": (
+ f"it to include {expected_str}",
+ f"Make sure it includes {expected_str}.",
+ ),
+ }.get(operator, (f"a different value (expected {operator} {expected_str})", ""))
+ message = (
+ f"{CONFIG_NOT_VALID_PREFIX} The check {check} has {config_key} set to "
+ f"{applied_str}, but the requirement needs {needs}."
+ )
+ return f"{message} {fix}".strip()
+
+
+def _check_operator(applied: Any, operator: str, expected: Any) -> bool:
+ """Return whether ``applied`` satisfies ``operator`` against ``expected``."""
+ try:
+ if operator == "lte":
+ return applied <= expected
+ if operator == "gte":
+ return applied >= expected
+ if operator == "eq":
+ return applied == expected
+ if operator == "in":
+ return applied in expected
+ if operator in ("subset", "superset"):
+ # Set comparisons for list-valued configs (allowlists / denylists).
+ # Both sides must be collections; anything else is not satisfiable.
+ if not isinstance(applied, (list, tuple, set)) or not isinstance(
+ expected, (list, tuple, set)
+ ):
+ return False
+ applied_set, expected_set = set(applied), set(expected)
+ if operator == "subset":
+ return applied_set <= expected_set
+ return applied_set >= expected_set
+ except TypeError:
+ # Mismatched/unhashable types → treat as not satisfied.
+ return False
+ # Unknown operator: do not block the requirement on a malformed constraint.
+ return True
+
+
+def evaluate_config_constraints(
+ config_requirements: Optional[list[Any]],
+ audit_config: Optional[dict[str, Any]],
+ provider_type: Optional[str] = None,
+) -> tuple[bool, str]:
+ """Evaluate a requirement's config constraints against the scan's config.
+
+ Args:
+ config_requirements: list of constraints, each a mapping (or object with
+ the same attributes) holding ``Check``, ``ConfigKey``, ``Operator``,
+ ``Value`` and an optional ``Provider``. ``None``/empty means the
+ requirement has no config expectations.
+ audit_config: the scan-global configuration mapping (the provider's
+ ``audit_config``, i.e. ``{config_key: value}``). The applied config
+ is identical across every resource and region of a scan.
+ provider_type: the provider being scanned (e.g. ``aws``). A constraint
+ tagged with a ``Provider`` is only evaluated when it matches this
+ value; this scopes universal (multi-provider) framework constraints
+ to the right provider. ``None`` disables provider scoping (every
+ constraint is evaluated), which is the correct behaviour for
+ single-provider frameworks.
+
+ Returns:
+ ``(is_compliant, reason)``. ``is_compliant`` is ``True`` when there are
+ no constraints or every explicitly-set value satisfies its constraint.
+ When a configured value violates a constraint, returns ``(False, reason)``
+ describing the first violation. A constraint whose ``ConfigKey`` was not
+ explicitly set is skipped (the check's default is assumed to match what
+ the requirement expects).
+ """
+ if not config_requirements:
+ return True, ""
+
+ audit_config = audit_config or {}
+
+ for constraint in config_requirements:
+ # Accept both dicts (API template) and objects (Pydantic model).
+ if isinstance(constraint, dict):
+ check = constraint.get("Check")
+ config_key = constraint.get("ConfigKey")
+ operator = constraint.get("Operator")
+ expected = constraint.get("Value")
+ provider = constraint.get("Provider")
+ else:
+ check = getattr(constraint, "Check", None)
+ config_key = getattr(constraint, "ConfigKey", None)
+ operator = getattr(constraint, "Operator", None)
+ expected = getattr(constraint, "Value", None)
+ provider = getattr(constraint, "Provider", None)
+
+ # Constraint scoped to another provider → not applicable to this scan.
+ # Compared case-insensitively (and trimmed) so a constraint authored as
+ # e.g. "AWS" still scopes to the "aws" scan instead of being silently
+ # bypassed by a casing/format mismatch.
+ if (
+ provider
+ and provider_type
+ and str(provider).strip().lower() != str(provider_type).strip().lower()
+ ):
+ continue
+
+ if config_key not in audit_config:
+ # Config not explicitly set → default is assumed adequate.
+ continue
+
+ applied = audit_config[config_key]
+ if not _check_operator(applied, operator, expected):
+ reason = _describe_violation(check, config_key, applied, operator, expected)
+ return False, reason
+
+ return True, ""
+
+
+def get_scan_audit_config() -> dict[str, Any]:
+ """Return the scan-global applied configuration (the provider's audit_config).
+
+ The applied config is identical across every resource and region of a scan,
+ so every compliance output evaluates constraints against this single mapping.
+ Imported lazily to avoid a circular import with the provider package and to
+ keep this module usable from contexts without a global provider.
+
+ Returns:
+ The provider's ``audit_config`` mapping, or ``{}`` when no global
+ provider is set (``AttributeError``) or the provider package cannot be
+ imported (``ImportError``).
+ """
+ try:
+ from prowler.providers.common.provider import Provider
+
+ return Provider.get_global_provider().audit_config or {}
+ except (AttributeError, ImportError):
+ # No global provider set, or provider package unavailable.
+ return {}
+
+
+def get_scan_provider_type() -> str:
+ """Return the provider being scanned (e.g. ``aws``) for constraint scoping.
+
+ Imported lazily to avoid a circular import with the provider package and to
+ keep this module usable from contexts without a global provider.
+
+ Returns:
+ The provider's ``type`` (e.g. ``aws``), or ``""`` when no global provider
+ is set (``AttributeError``) or the provider package cannot be imported
+ (``ImportError``); an empty string disables provider scoping.
+ """
+ try:
+ from prowler.providers.common.provider import Provider
+
+ return Provider.get_global_provider().type or ""
+ except (AttributeError, ImportError):
+ # No global provider set, or provider package unavailable.
+ return ""
+
+
+def _requirement_id(requirement: Any) -> Optional[str]:
+ """Return a requirement's id across the legacy (``Id``) and universal (``id``) models."""
+ return getattr(requirement, "Id", None) or getattr(requirement, "id", None)
+
+
+def _requirement_constraints(requirement: Any) -> Optional[list]:
+ """Return a requirement's config constraints across both model flavours.
+
+ Legacy ``Compliance_Requirement`` exposes ``ConfigRequirements`` (a list of
+ Pydantic models); ``UniversalComplianceRequirement`` exposes
+ ``config_requirements`` (a list of dicts). ``evaluate_config_constraints``
+ handles both element types.
+ """
+ return getattr(requirement, "ConfigRequirements", None) or getattr(
+ requirement, "config_requirements", None
+ )
+
+
+def build_requirement_config_status(
+ requirements: list[Any],
+ audit_config: Optional[dict[str, Any]] = None,
+ provider_type: Optional[str] = None,
+) -> dict[str, tuple[bool, str]]:
+ """Map every requirement id to its ``(is_compliant, reason)`` config verdict.
+
+ Only requirements that actually declare constraints are included; callers use
+ ``dict.get(req_id)`` (returning ``None`` → no constraints → no override).
+
+ Args:
+ requirements: the framework's requirements (legacy or universal models).
+ audit_config: the applied config; resolved via ``get_scan_audit_config``
+ when omitted.
+ provider_type: the provider being scanned, for constraint scoping;
+ resolved via ``get_scan_provider_type`` when omitted.
+
+ Returns:
+ A mapping ``{requirement_id: (is_compliant, reason)}`` containing only the
+ requirements that declare config constraints.
+ """
+ if audit_config is None:
+ audit_config = get_scan_audit_config()
+ if provider_type is None:
+ provider_type = get_scan_provider_type()
+ status = {}
+ for requirement in requirements:
+ constraints = _requirement_constraints(requirement)
+ if constraints:
+ status[_requirement_id(requirement)] = evaluate_config_constraints(
+ constraints, audit_config, provider_type
+ )
+ return status
+
+
+def resolve_requirement_config_status(
+ requirement: Any,
+ audit_config: dict[str, Any],
+ cache: dict,
+ provider_type: Optional[str] = None,
+) -> tuple[bool, str]:
+ """Return a requirement's ``(is_compliant, reason)`` verdict, memoised in ``cache``.
+
+ For table generators that iterate findings × compliances and only encounter
+ each requirement lazily.
+
+ Args:
+ requirement: the requirement (legacy or universal model).
+ audit_config: the scan-global applied config.
+ cache: a dict keyed by requirement id, reused across the whole table
+ build to memoise verdicts.
+ provider_type: the provider being scanned, for constraint scoping;
+ resolved via ``get_scan_provider_type`` when omitted.
+
+ Returns:
+ The ``(is_compliant, reason)`` verdict; ``(True, "")`` when the
+ requirement declares no constraints.
+ """
+ req_id = _requirement_id(requirement)
+ if req_id not in cache:
+ constraints = _requirement_constraints(requirement)
+ if constraints:
+ if provider_type is None:
+ provider_type = get_scan_provider_type()
+ cache[req_id] = evaluate_config_constraints(
+ constraints, audit_config, provider_type
+ )
+ else:
+ cache[req_id] = (True, "")
+ return cache[req_id]
+
+
+def apply_config_status(
+ status: str,
+ status_extended: str,
+ config_status: Optional[tuple[bool, str]],
+) -> tuple[str, str]:
+ """Override a finding's ``(status, status_extended)`` when its config is invalid.
+
+ A requirement whose configurable checks ran with a config too loose to trust
+ is forced to ``FAIL`` regardless of the finding's own status, with the reason
+ prepended to ``status_extended``.
+
+ Args:
+ status: the finding's original status (e.g. ``PASS`` / ``FAIL``).
+ status_extended: the finding's extended status message.
+ config_status: the ``(is_compliant, reason)`` tuple from
+ ``build_requirement_config_status``/``resolve_requirement_config_status``,
+ or ``None`` when the requirement declares no constraints.
+
+ Returns:
+ The ``(status, status_extended)`` to report: unchanged when the config is
+ valid (or ``config_status`` is ``None``); otherwise ``FAIL`` with the
+ reason prepended to ``status_extended``.
+ """
+ if not config_status or config_status[0]:
+ return status, status_extended
+ return (
+ "FAIL",
+ f"{config_status[1]} {status_extended}".strip(),
+ )
+
+
+def get_effective_status(
+ status: str,
+ config_status: Optional[tuple[bool, str]],
+) -> str:
+ """Return the effective status for table aggregation.
+
+ Args:
+ status: the finding's original status.
+ config_status: the ``(is_compliant, reason)`` tuple, or ``None`` when the
+ requirement declares no constraints.
+
+ Returns:
+ ``FAIL`` when ``config_status`` marks the config invalid; otherwise the
+ finding's original ``status``.
+ """
+ if not config_status or config_status[0]:
+ return status
+ return "FAIL"
+
+
+def accumulate_overview_status(
+ index: int,
+ status: str,
+ pass_indices: set,
+ fail_indices: set,
+ muted_indices: set,
+) -> None:
+ """Record a finding in the overview totals once, with FAIL precedence over PASS (sets mutated in place)."""
+ if status == "Muted":
+ muted_indices.add(index)
+ elif status == "FAIL":
+ fail_indices.add(index)
+ pass_indices.discard(index)
+ elif status == "PASS" and index not in fail_indices:
+ pass_indices.add(index)
+
+
+def accumulate_group_status(
+ index: int,
+ status: str,
+ counts: dict,
+ seen: dict,
+) -> None:
+ """Count a finding once per group, upgrading a counted PASS to FAIL on conflict (mutates ``counts``/``seen``)."""
+ previous = seen.get(index)
+ if status == "MANUAL":
+ # MANUAL findings come from manual, checks-less requirements and are
+ # informational only: they have no PASS/FAIL/Muted column in the section
+ # tally, so counting them would raise KeyError on counts[status] += 1.
+ # Skip them (an unexpected status still raises loudly below).
+ return
+ if previous is None:
+ seen[index] = status
+ counts[status] += 1
+ elif previous == "PASS" and status == "FAIL":
+ seen[index] = "FAIL"
+ counts["PASS"] -= 1
+ counts["FAIL"] += 1
diff --git a/prowler/lib/check/compliance_models.py b/prowler/lib/check/compliance_models.py
index f883bf60b1..80322a6929 100644
--- a/prowler/lib/check/compliance_models.py
+++ b/prowler/lib/check/compliance_models.py
@@ -3,7 +3,7 @@ import json
import os
import sys
from enum import Enum
-from typing import Optional, Union
+from typing import Any, Literal, Optional, Union
from pydantic.v1 import BaseModel, Field, ValidationError, root_validator
@@ -170,6 +170,79 @@ class ISO27001_2013_Requirement_Attribute(BaseModel):
Check_Summary: str
+# Base Compliance Model
+class Compliance_Requirement_ConfigConstraint(BaseModel):
+ """A constraint a requirement places on a configurable check's config.
+
+ Declares that the configurable check ``Check`` must have run with
+ ``ConfigKey`` satisfying ``Operator`` ``Value`` for the requirement's
+ result to be trusted. Example: ``max_unused_access_keys_days <= 45``.
+
+ ``Provider`` scopes the constraint to a single provider. It is required for
+ universal (multi-provider) frameworks, where the same requirement maps
+ checks across providers and a constraint must only apply when that provider
+ is the one being scanned. Single-provider frameworks may omit it (the
+ framework's provider is already the one being scanned).
+
+ Operators:
+ - ``lte``/``gte``/``eq``: scalar comparisons (e.g. a max-age or min-retention
+ threshold, or a boolean toggle).
+ - ``in``: the applied scalar must be one of ``Value`` (a list).
+ - ``subset``: the applied list must be a subset of ``Value`` — for allowlist
+ configs (e.g. ``recommended_minimal_tls_versions``); widening the allowlist
+ with a weaker value (e.g. TLS ``1.0``) breaks the constraint.
+ - ``superset``: the applied list must be a superset of ``Value`` — for
+ denylist configs (e.g. ``insecure_key_algorithms``); removing a forbidden
+ value from the denylist breaks the constraint.
+ """
+
+ Check: str
+ ConfigKey: str
+ Operator: Literal["lte", "gte", "eq", "in", "subset", "superset"]
+ # ``bool`` must precede ``int`` so pydantic v1 keeps booleans (e.g. a
+ # ``mute_non_default_regions == false`` constraint) instead of coercing
+ # them to 0/1.
+ Value: Union[bool, int, float, str, list[Any]]
+ # Provider this constraint applies to (e.g. ``aws``), matched
+ # case-insensitively. ``None`` applies whenever the requirement runs
+ # (single-provider frameworks).
+ Provider: Optional[str] = None
+
+ @root_validator
+ @classmethod
+ def validate_value_matches_operator(cls, values): # noqa: F841
+ """Ensure ``Value``'s type is consistent with ``Operator``.
+
+ Without this, a mistyped value (e.g. ``gte`` with a list, or ``subset``
+ with a scalar) is not rejected at load time and ``_check_operator``
+ silently treats it as *not satisfied*, forcing the requirement to a
+ spurious config-not-valid FAIL. Validating here turns that into a
+ clear error when the framework is loaded.
+ """
+ operator = values.get("Operator")
+ value = values.get("Value")
+ # If Operator/Value failed their own validation they are absent here.
+ if operator is None or value is None:
+ return values
+ if operator in ("in", "subset", "superset"):
+ if not isinstance(value, list):
+ raise ValueError(
+ f"operator '{operator}' requires a list Value, got {type(value).__name__}"
+ )
+ elif operator in ("lte", "gte"):
+ # bool is an int subclass but is never a valid numeric threshold.
+ if isinstance(value, bool) or not isinstance(value, (int, float)):
+ raise ValueError(
+ f"operator '{operator}' requires a numeric Value, got {value!r}"
+ )
+ elif operator == "eq":
+ if not isinstance(value, (bool, int, float, str)):
+ raise ValueError(
+ f"operator 'eq' requires a scalar Value, got {type(value).__name__}"
+ )
+ return values
+
+
# MITRE Requirement Attribute for AWS
class Mitre_Requirement_Attribute_AWS(BaseModel):
"""MITRE Requirement Attribute"""
@@ -217,6 +290,9 @@ class Mitre_Requirement(BaseModel):
list[Mitre_Requirement_Attribute_GCP],
]
Checks: list[str]
+ # MITRE checks may also declare config constraints; without this field
+ # Pydantic silently drops them during parsing.
+ ConfigRequirements: Optional[list[Compliance_Requirement_ConfigConstraint]] = None
# KISA-ISMS-P Requirement Attribute
@@ -303,7 +379,6 @@ class STIG_Requirement_Attribute(BaseModel):
FixText: Optional[str] = None
-# Base Compliance Model
# TODO: move this to compliance folder
class Compliance_Requirement(BaseModel):
"""Compliance_Requirement holds the base model for every requirement within a compliance framework"""
@@ -329,6 +404,7 @@ class Compliance_Requirement(BaseModel):
]
]
Checks: list[str]
+ ConfigRequirements: Optional[list[Compliance_Requirement_ConfigConstraint]] = None
class Compliance(BaseModel):
@@ -701,6 +777,10 @@ class UniversalComplianceRequirement(BaseModel):
name: Optional[str] = None
attributes: dict = Field(default_factory=dict)
checks: dict[str, list[str]] = Field(default_factory=dict)
+ # Typed with the same constraint model as legacy so the operator/value
+ # validation also covers universal frameworks. evaluate_config_constraints
+ # accepts both dicts and model objects, so downstream consumers are unaffected.
+ config_requirements: Optional[list[Compliance_Requirement_ConfigConstraint]] = None
tactics: Optional[list] = None
sub_techniques: Optional[list] = None
platforms: Optional[list] = None
@@ -894,6 +974,11 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
# For MITRE, promote special fields and store raw attributes
raw_attrs = [attr.dict() for attr in req.Attributes]
attrs = {"_raw_attributes": raw_attrs}
+ config_requirements = (
+ [c.dict() for c in req.ConfigRequirements]
+ if getattr(req, "ConfigRequirements", None)
+ else None
+ )
universal_requirements.append(
UniversalComplianceRequirement(
id=req.Id,
@@ -901,6 +986,7 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
name=req.Name,
attributes=attrs,
checks=req_checks,
+ config_requirements=config_requirements,
tactics=req.Tactics,
sub_techniques=req.SubTechniques,
platforms=req.Platforms,
@@ -913,6 +999,11 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
attrs = req.Attributes[0].dict()
else:
attrs = {}
+ config_requirements = (
+ [c.dict() for c in req.ConfigRequirements]
+ if getattr(req, "ConfigRequirements", None)
+ else None
+ )
universal_requirements.append(
UniversalComplianceRequirement(
id=req.Id,
@@ -920,6 +1011,7 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
name=req.Name,
attributes=attrs,
checks=req_checks,
+ config_requirements=config_requirements,
)
)
diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py
index aa16d7969b..5f92ecf481 100644
--- a/prowler/lib/check/models.py
+++ b/prowler/lib/check/models.py
@@ -1286,6 +1286,29 @@ class CheckReportNHN(Check_Report):
self.location = getattr(resource, "location", "kr1")
+@dataclass
+class CheckReportE2eNetworks(Check_Report):
+ """Contains the E2E Networks Check's finding information."""
+
+ resource_name: str
+ resource_id: str
+ location: str
+
+ def __init__(self, metadata: Dict, resource: Any) -> None:
+ """Initialize the E2E Networks Check's finding information.
+
+ Args:
+ metadata: The metadata of the check.
+ resource: Basic information about the E2E Networks resource.
+ """
+ super().__init__(metadata, resource)
+ self.resource_name = getattr(
+ resource, "name", getattr(resource, "resource_name", "")
+ )
+ self.resource_id = getattr(resource, "id", getattr(resource, "resource_id", ""))
+ self.location = getattr(resource, "location", "global")
+
+
@dataclass
class CheckReportStackIT(Check_Report):
"""Contains the StackIT Check's finding information."""
diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py
index b65a702fbc..38661e6445 100644
--- a/prowler/lib/cli/parser.py
+++ b/prowler/lib/cli/parser.py
@@ -48,6 +48,7 @@ class ProwlerArgumentParser:
"nhn",
"mongodbatlas",
"vercel",
+ "e2enetworks",
"okta",
"scaleway",
"stackit",
@@ -74,10 +75,10 @@ class ProwlerArgumentParser:
self.parser = argparse.ArgumentParser(
prog="prowler",
formatter_class=RawTextHelpFormatter,
- usage=f"prowler [-h] [--version] {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,dashboard,iac,image,llm{extra_providers_csv}}} ...",
+ usage=f"prowler [-h] [--version] {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,e2enetworks,dashboard,iac,image,llm{extra_providers_csv}}} ...",
epilog=f"""
Available Cloud Providers:
- {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode{extra_providers_csv}}}
+ {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,e2enetworks{extra_providers_csv}}}
aws AWS Provider
azure Azure Provider
gcp GCP Provider
@@ -98,7 +99,8 @@ Available Cloud Providers:
mongodbatlas MongoDB Atlas Provider
scaleway Scaleway Provider
vercel Vercel Provider
- linode Linode Provider{extra_providers_text}
+ linode Linode Provider
+ e2enetworks E2E Networks Provider{extra_providers_text}
Available components:
@@ -473,6 +475,18 @@ Detailed documentation at https://docs.prowler.com
default=default_fixer_config_file_path,
help="Set configuration fixer file path",
)
+ config_parser.add_argument(
+ "--scan-secrets-validate",
+ action="store_true",
+ default=False,
+ help=(
+ "Validate secrets discovered by the secrets checks by checking "
+ "whether they are live against the provider APIs. WARNING: this "
+ "makes outbound network calls using the discovered secret itself; "
+ "the credential is exercised against the provider and the call "
+ "appears in the audited account's logs. Disabled by default."
+ ),
+ )
def __init_custom_checks_metadata_parser__(self):
# CustomChecksMetadata
diff --git a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
index df23aeb1d1..074e684f33 100644
--- a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
+++ b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_asd_essential_eight_table(
@@ -19,11 +26,13 @@ def get_asd_essential_eight_table(
"Status": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
section_seen = {}
provider = ""
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -31,6 +40,12 @@ def get_asd_essential_eight_table(
if compliance.Framework == "ASD-Essential-Eight":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
if section not in sections:
@@ -39,29 +54,15 @@ def get_asd_essential_eight_table(
"PASS": 0,
"Muted": 0,
}
- section_seen[section] = set()
+ section_seen[section] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
-
- # Per-section counts: count each finding once per section
- # it belongs to (a finding can map to several sections).
- if index not in section_seen[section]:
- section_seen[section].add(index)
- if finding.muted:
- sections[section]["Muted"] += 1
- elif finding.status == "FAIL":
- sections[section]["FAIL"] += 1
- elif finding.status == "PASS":
- sections[section]["PASS"] += 1
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, sections[section], section_seen[section]
+ )
sections = dict(sorted(sections.items()))
for section in sections:
diff --git a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_aws.py b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_aws.py
index c264c81505..4bdf9cd851 100644
--- a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_aws.py
+++ b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.asd_essential_eight.models import (
ASDEssentialEightAWSModel,
@@ -36,10 +40,19 @@ class ASDEssentialEightAWS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ASDEssentialEightAWSModel(
Provider=finding.provider,
@@ -63,8 +76,8 @@ class ASDEssentialEightAWS(ComplianceOutput):
Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py b/prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py
index 4a157b0324..69a37949f8 100644
--- a/prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py
+++ b/prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.aws_well_architected.models import (
AWSWellArchitectedModel,
@@ -36,10 +40,18 @@ class AWSWellArchitected(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSWellArchitectedModel(
Provider=finding.provider,
@@ -58,8 +70,8 @@ class AWSWellArchitected(ComplianceOutput):
Requirements_Attributes_AssessmentMethod=attribute.AssessmentMethod,
Requirements_Attributes_Description=attribute.Description,
Requirements_Attributes_ImplementationGuidanceUrl=attribute.ImplementationGuidanceUrl,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/c5/c5.py b/prowler/lib/outputs/compliance/c5/c5.py
index b48260b5a2..003b2664cf 100644
--- a/prowler/lib/outputs/compliance/c5/c5.py
+++ b/prowler/lib/outputs/compliance/c5/c5.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_c5_table(
@@ -18,12 +25,14 @@ def get_c5_table(
"Status": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
sections = {}
section_seen = {}
provider = ""
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -31,34 +40,26 @@ def get_c5_table(
if compliance.Framework == "C5":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
if section not in sections:
sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- section_seen[section] = set()
+ section_seen[section] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
-
- # Per-section counts: count each finding once per section
- # it belongs to (a finding can map to several sections).
- if index not in section_seen[section]:
- section_seen[section].add(index)
- if finding.muted:
- sections[section]["Muted"] += 1
- elif finding.status == "FAIL":
- sections[section]["FAIL"] += 1
- elif finding.status == "PASS":
- sections[section]["PASS"] += 1
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, sections[section], section_seen[section]
+ )
sections = dict(sorted(sections.items()))
for section in sections:
diff --git a/prowler/lib/outputs/compliance/c5/c5_aws.py b/prowler/lib/outputs/compliance/c5/c5_aws.py
index 5f13b77d7a..b8a4115482 100644
--- a/prowler/lib/outputs/compliance/c5/c5_aws.py
+++ b/prowler/lib/outputs/compliance/c5/c5_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.c5.models import AWSC5Model
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class AWSC5(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSC5Model(
Provider=finding.provider,
@@ -52,8 +65,8 @@ class AWSC5(ComplianceOutput):
Requirements_Attributes_Type=attribute.Type,
Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/c5/c5_azure.py b/prowler/lib/outputs/compliance/c5/c5_azure.py
index 1b3a9e6b90..0899ff6b15 100644
--- a/prowler/lib/outputs/compliance/c5/c5_azure.py
+++ b/prowler/lib/outputs/compliance/c5/c5_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.c5.models import AzureC5Model
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class AzureC5(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AzureC5Model(
Provider=finding.provider,
@@ -52,8 +65,8 @@ class AzureC5(ComplianceOutput):
Requirements_Attributes_Type=attribute.Type,
Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/c5/c5_gcp.py b/prowler/lib/outputs/compliance/c5/c5_gcp.py
index 84e66a141f..c8b874f622 100644
--- a/prowler/lib/outputs/compliance/c5/c5_gcp.py
+++ b/prowler/lib/outputs/compliance/c5/c5_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.c5.models import GCPC5Model
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class GCPC5(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GCPC5Model(
Provider=finding.provider,
@@ -52,8 +65,8 @@ class GCPC5(ComplianceOutput):
Requirements_Attributes_Type=attribute.Type,
Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ccc/ccc.py b/prowler/lib/outputs/compliance/ccc/ccc.py
index d8d76ad2d9..48b2086e78 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_ccc_table(
@@ -18,12 +25,14 @@ def get_ccc_table(
"Status": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
sections = {}
section_seen = {}
provider = ""
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -31,34 +40,26 @@ def get_ccc_table(
if compliance.Framework == "CCC":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
if section not in sections:
sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- section_seen[section] = set()
+ section_seen[section] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
-
- # Per-section counts: count each finding once per section
- # it belongs to (a finding can map to several sections).
- if index not in section_seen[section]:
- section_seen[section].add(index)
- if finding.muted:
- sections[section]["Muted"] += 1
- elif finding.status == "FAIL":
- sections[section]["FAIL"] += 1
- elif finding.status == "PASS":
- sections[section]["PASS"] += 1
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, sections[section], section_seen[section]
+ )
sections = dict(sorted(sections.items()))
for section in sections:
diff --git a/prowler/lib/outputs/compliance/ccc/ccc_aws.py b/prowler/lib/outputs/compliance/ccc/ccc_aws.py
index 1114425574..20d42b1508 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc_aws.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.ccc.models import CCC_AWSModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class CCC_AWS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = CCC_AWSModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class CCC_AWS(ComplianceOutput):
Requirements_Attributes_Recommendation=attribute.Recommendation,
Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ccc/ccc_azure.py b/prowler/lib/outputs/compliance/ccc/ccc_azure.py
index e0cdf32330..4dcc8c5ca8 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc_azure.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.ccc.models import CCC_AzureModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class CCC_Azure(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = CCC_AzureModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class CCC_Azure(ComplianceOutput):
Requirements_Attributes_Recommendation=attribute.Recommendation,
Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ccc/ccc_gcp.py b/prowler/lib/outputs/compliance/ccc/ccc_gcp.py
index 326a15e5c3..ed7c709c24 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc_gcp.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.ccc.models import CCC_GCPModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class CCC_GCP(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = CCC_GCPModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class CCC_GCP(ComplianceOutput):
Requirements_Attributes_Recommendation=attribute.Recommendation,
Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis.py b/prowler/lib/outputs/compliance/cis/cis.py
index 4acbd7fe58..de3120f689 100644
--- a/prowler/lib/outputs/compliance/cis/cis.py
+++ b/prowler/lib/outputs/compliance/cis/cis.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_cis_table(
@@ -23,9 +30,11 @@ def get_cis_table(
"Level 2": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -34,6 +43,12 @@ def get_cis_table(
if compliance.Framework == "CIS" and version_in_name in compliance.Version:
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
# Check if Section exists
@@ -46,43 +61,37 @@ def get_cis_table(
}
section_muted_seen[section] = set()
section_split_seen[section] = {
- "Level 1": set(),
- "Level 2": set(),
+ "Level 1": {},
+ "Level 2": {},
}
+
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
if finding.muted:
- # Overview total: count each finding once per framework
- if index not in muted_count:
- muted_count.append(index)
# Per-section Muted: count each finding once per section
# it belongs to (a finding can map to several sections).
if index not in section_muted_seen[section]:
section_muted_seen[section].add(index)
sections[section]["Muted"] += 1
- else:
- if finding.status == "FAIL" and index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS" and index not in pass_count:
- pass_count.append(index)
+
if "Level 1" in attribute.Profile:
- if (
- not finding.muted
- and index not in section_split_seen[section]["Level 1"]
- ):
- section_split_seen[section]["Level 1"].add(index)
- if finding.status == "FAIL":
- sections[section]["Level 1"]["FAIL"] += 1
- else:
- sections[section]["Level 1"]["PASS"] += 1
+ if not finding.muted:
+ accumulate_group_status(
+ index,
+ effective_status,
+ sections[section]["Level 1"],
+ section_split_seen[section]["Level 1"],
+ )
elif "Level 2" in attribute.Profile:
- if (
- not finding.muted
- and index not in section_split_seen[section]["Level 2"]
- ):
- section_split_seen[section]["Level 2"].add(index)
- if finding.status == "FAIL":
- sections[section]["Level 2"]["FAIL"] += 1
- else:
- sections[section]["Level 2"]["PASS"] += 1
+ if not finding.muted:
+ accumulate_group_status(
+ index,
+ effective_status,
+ sections[section]["Level 2"],
+ section_split_seen[section]["Level 2"],
+ )
# Add results to table
sections = dict(sorted(sections.items()))
diff --git a/prowler/lib/outputs/compliance/cis/cis_alibabacloud.py b/prowler/lib/outputs/compliance/cis/cis_alibabacloud.py
index a1880d3af9..77bf02ee98 100644
--- a/prowler/lib/outputs/compliance/cis/cis_alibabacloud.py
+++ b/prowler/lib/outputs/compliance/cis/cis_alibabacloud.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import AlibabaCloudCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class AlibabaCloudCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AlibabaCloudCISModel(
Provider=finding.provider,
@@ -59,8 +71,8 @@ class AlibabaCloudCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_aws.py b/prowler/lib/outputs/compliance/cis/cis_aws.py
index ac0250150c..58bf7fbc27 100644
--- a/prowler/lib/outputs/compliance/cis/cis_aws.py
+++ b/prowler/lib/outputs/compliance/cis/cis_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import AWSCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,19 @@ class AWSCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSCISModel(
Provider=finding.provider,
@@ -59,8 +72,8 @@ class AWSCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_azure.py b/prowler/lib/outputs/compliance/cis/cis_azure.py
index b1e09ca453..53b1cbdd32 100644
--- a/prowler/lib/outputs/compliance/cis/cis_azure.py
+++ b/prowler/lib/outputs/compliance/cis/cis_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import AzureCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class AzureCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AzureCISModel(
Provider=finding.provider,
@@ -59,8 +71,8 @@ class AzureCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_gcp.py b/prowler/lib/outputs/compliance/cis/cis_gcp.py
index b2889333be..c2a11dae77 100644
--- a/prowler/lib/outputs/compliance/cis/cis_gcp.py
+++ b/prowler/lib/outputs/compliance/cis/cis_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import GCPCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class GCPCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GCPCISModel(
Provider=finding.provider,
@@ -58,8 +70,8 @@ class GCPCIS(ComplianceOutput):
Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_github.py b/prowler/lib/outputs/compliance/cis/cis_github.py
index 2ce5b64480..039bd1b993 100644
--- a/prowler/lib/outputs/compliance/cis/cis_github.py
+++ b/prowler/lib/outputs/compliance/cis/cis_github.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import GithubCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class GithubCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GithubCISModel(
Provider=finding.provider,
@@ -58,8 +70,8 @@ class GithubCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_References=attribute.References,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_googleworkspace.py b/prowler/lib/outputs/compliance/cis/cis_googleworkspace.py
index d74375bf85..cf2d3755c7 100644
--- a/prowler/lib/outputs/compliance/cis/cis_googleworkspace.py
+++ b/prowler/lib/outputs/compliance/cis/cis_googleworkspace.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import GoogleWorkspaceCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class GoogleWorkspaceCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GoogleWorkspaceCISModel(
Provider=finding.provider,
@@ -58,8 +70,8 @@ class GoogleWorkspaceCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_kubernetes.py b/prowler/lib/outputs/compliance/cis/cis_kubernetes.py
index 9607123e44..23c482310e 100644
--- a/prowler/lib/outputs/compliance/cis/cis_kubernetes.py
+++ b/prowler/lib/outputs/compliance/cis/cis_kubernetes.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import KubernetesCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class KubernetesCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = KubernetesCISModel(
Provider=finding.provider,
@@ -59,8 +71,8 @@ class KubernetesCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_References=attribute.References,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_m365.py b/prowler/lib/outputs/compliance/cis/cis_m365.py
index 1a00166946..8dc06155e7 100644
--- a/prowler/lib/outputs/compliance/cis/cis_m365.py
+++ b/prowler/lib/outputs/compliance/cis/cis_m365.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import M365CISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class M365CIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = M365CISModel(
Provider=finding.provider,
@@ -59,8 +71,8 @@ class M365CIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cis/cis_oraclecloud.py b/prowler/lib/outputs/compliance/cis/cis_oraclecloud.py
index 117c3ca004..d8110d72db 100644
--- a/prowler/lib/outputs/compliance/cis/cis_oraclecloud.py
+++ b/prowler/lib/outputs/compliance/cis/cis_oraclecloud.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cis.models import OracleCloudCISModel
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,18 @@ class OracleCloudCIS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = OracleCloudCISModel(
Provider=finding.provider,
@@ -59,8 +71,8 @@ class OracleCloudCIS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_DefaultValue=attribute.DefaultValue,
Requirements_Attributes_References=attribute.References,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/cisa_scuba/cisa_scuba_googleworkspace.py b/prowler/lib/outputs/compliance/cisa_scuba/cisa_scuba_googleworkspace.py
index 9f1336e832..d2f6faa212 100644
--- a/prowler/lib/outputs/compliance/cisa_scuba/cisa_scuba_googleworkspace.py
+++ b/prowler/lib/outputs/compliance/cisa_scuba/cisa_scuba_googleworkspace.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.cisa_scuba.models import (
GoogleWorkspaceCISASCuBAModel,
@@ -36,10 +40,18 @@ class GoogleWorkspaceCISASCuBA(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GoogleWorkspaceCISASCuBAModel(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class GoogleWorkspaceCISASCuBA(ComplianceOutput):
Requirements_Attributes_SubSection=attribute.SubSection,
Requirements_Attributes_Service=attribute.Service,
Requirements_Attributes_Type=attribute.Type,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ens/ens.py b/prowler/lib/outputs/compliance/ens/ens.py
index c39abe0a6a..4fcca922c7 100644
--- a/prowler/lib/outputs/compliance/ens/ens.py
+++ b/prowler/lib/outputs/compliance/ens/ens.py
@@ -2,6 +2,11 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_ens_table(
@@ -25,9 +30,11 @@ def get_ens_table(
"Opcional": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -35,6 +42,12 @@ def get_ens_table(
if compliance.Framework == "ENS":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
marco_categoria = f"{attribute.Marco}/{attribute.Categoria}"
# Check if Marco/Categoria exists
@@ -50,25 +63,24 @@ def get_ens_table(
marco_muted_seen[marco_categoria] = set()
if finding.muted:
# Overview total: count each finding once per framework
- if index not in muted_count:
- muted_count.append(index)
+ muted_count.add(index)
# Per-marco Muted: count each finding once per marco
# it belongs to (a finding can map to several marcos).
if index not in marco_muted_seen[marco_categoria]:
marco_muted_seen[marco_categoria].add(index)
marcos[marco_categoria]["Muted"] += 1
else:
- if finding.status == "FAIL":
+ if effective_status == "FAIL":
if attribute.Tipo != "recomendacion":
- if index not in fail_count:
- fail_count.append(index)
+ fail_count.add(index)
+ pass_count.discard(index)
# Mark every marco the finding belongs to as
# NO CUMPLE, not just the first one seen.
marcos[marco_categoria][
"Estado"
] = f"{Fore.RED}NO CUMPLE{Style.RESET_ALL}"
- elif finding.status == "PASS" and index not in pass_count:
- pass_count.append(index)
+ elif effective_status == "PASS" and index not in fail_count:
+ pass_count.add(index)
if attribute.Nivel == "opcional":
marcos[marco_categoria]["Opcional"] += 1
elif attribute.Nivel == "alto":
diff --git a/prowler/lib/outputs/compliance/ens/ens_aws.py b/prowler/lib/outputs/compliance/ens/ens_aws.py
index 40d185294b..543799f7b9 100644
--- a/prowler/lib/outputs/compliance/ens/ens_aws.py
+++ b/prowler/lib/outputs/compliance/ens/ens_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.ens.models import AWSENSModel
@@ -34,10 +38,19 @@ class AWSENS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSENSModel(
Provider=finding.provider,
@@ -60,8 +73,8 @@ class AWSENS(ComplianceOutput):
Requirements_Attributes_Dependencias=",".join(
attribute.Dependencias
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ens/ens_azure.py b/prowler/lib/outputs/compliance/ens/ens_azure.py
index 20d727fed0..23055da2a2 100644
--- a/prowler/lib/outputs/compliance/ens/ens_azure.py
+++ b/prowler/lib/outputs/compliance/ens/ens_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.ens.models import AzureENSModel
@@ -34,10 +38,19 @@ class AzureENS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AzureENSModel(
Provider=finding.provider,
@@ -60,8 +73,8 @@ class AzureENS(ComplianceOutput):
Requirements_Attributes_Dependencias=",".join(
attribute.Dependencias
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/ens/ens_gcp.py b/prowler/lib/outputs/compliance/ens/ens_gcp.py
index 8a2baaca66..f616e48f83 100644
--- a/prowler/lib/outputs/compliance/ens/ens_gcp.py
+++ b/prowler/lib/outputs/compliance/ens/ens_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.ens.models import GCPENSModel
@@ -34,10 +38,19 @@ class GCPENS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GCPENSModel(
Provider=finding.provider,
@@ -60,8 +73,8 @@ class GCPENS(ComplianceOutput):
Requirements_Attributes_Dependencias=",".join(
attribute.Dependencias
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/generic/generic.py b/prowler/lib/outputs/compliance/generic/generic.py
index b774f09577..b3f1ad7ec9 100644
--- a/prowler/lib/outputs/compliance/generic/generic.py
+++ b/prowler/lib/outputs/compliance/generic/generic.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.generic.models import GenericComplianceModel
@@ -35,11 +39,24 @@ class GenericCompliance(ComplianceOutput):
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
def compliance_row(requirement, attribute, finding=None):
# Read attribute fields defensively: GenericCompliance is the
# last-resort renderer for any framework, and provider-specific
# schemas (e.g. CIS, ENS, ISO27001) do not declare the universal
# Section/SubSection/SubGroup/Service/Type/Comment fields.
+ status, status_extended = (
+ apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
+ if finding
+ else ("MANUAL", "Manual check")
+ )
return GenericComplianceModel(
Provider=(finding.provider if finding else compliance.Provider.lower()),
Description=compliance.Description,
@@ -56,8 +73,8 @@ class GenericCompliance(ComplianceOutput):
Requirements_Attributes_Service=getattr(attribute, "Service", None),
Requirements_Attributes_Type=getattr(attribute, "Type", None),
Requirements_Attributes_Comment=getattr(attribute, "Comment", None),
- Status=finding.status if finding else "MANUAL",
- StatusExtended=(finding.status_extended if finding else "Manual check"),
+ Status=status,
+ StatusExtended=status_extended,
ResourceId=finding.resource_uid if finding else "manual_check",
ResourceName=finding.resource_name if finding else "Manual check",
CheckId=finding.check_id if finding else "manual",
diff --git a/prowler/lib/outputs/compliance/generic/generic_table.py b/prowler/lib/outputs/compliance/generic/generic_table.py
index 9136cf19e2..060acda10a 100644
--- a/prowler/lib/outputs/compliance/generic/generic_table.py
+++ b/prowler/lib/outputs/compliance/generic/generic_table.py
@@ -2,6 +2,11 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_generic_compliance_table(
@@ -15,6 +20,8 @@ def get_generic_compliance_table(
pass_count = []
fail_count = []
muted_count = []
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -25,13 +32,21 @@ def get_generic_compliance_table(
and compliance.Version in compliance_framework.upper()
and compliance.Provider.upper() in compliance_framework.upper()
):
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- else:
- if finding.status == "FAIL" and index not in fail_count:
+ for requirement in compliance.Requirements:
+ # A configurable check that passed with a too-loose config is
+ # forced to FAIL (source of truth: framework ConfigRequirements).
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
+ if finding.muted:
+ if index not in muted_count:
+ muted_count.append(index)
+ elif effective_status == "FAIL" and index not in fail_count:
fail_count.append(index)
- elif finding.status == "PASS" and index not in pass_count:
+ elif effective_status == "PASS" and index not in pass_count:
pass_count.append(index)
if (
len(fail_count) + len(pass_count) + len(muted_count) > 1
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_aws.py b/prowler/lib/outputs/compliance/iso27001/iso27001_aws.py
index 282f27a218..3376b8c5ad 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_aws.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import AWSISO27001Model
@@ -34,10 +38,18 @@ class AWSISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class AWSISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_azure.py b/prowler/lib/outputs/compliance/iso27001/iso27001_azure.py
index 0112bbd7e1..f1f964c726 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_azure.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import AzureISO27001Model
@@ -34,10 +38,18 @@ class AzureISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AzureISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class AzureISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_gcp.py b/prowler/lib/outputs/compliance/iso27001/iso27001_gcp.py
index f60a30e67e..9a5de17bfa 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_gcp.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import GCPISO27001Model
@@ -34,10 +38,18 @@ class GCPISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = GCPISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class GCPISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_kubernetes.py b/prowler/lib/outputs/compliance/iso27001/iso27001_kubernetes.py
index 59fd593ce6..5ca81e82d5 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_kubernetes.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_kubernetes.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import KubernetesISO27001Model
@@ -34,10 +38,18 @@ class KubernetesISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = KubernetesISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class KubernetesISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_m365.py b/prowler/lib/outputs/compliance/iso27001/iso27001_m365.py
index cf6712a4a6..84c5072002 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_m365.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_m365.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import M365ISO27001Model
@@ -34,10 +38,18 @@ class M365ISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = M365ISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class M365ISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/iso27001/iso27001_nhn.py b/prowler/lib/outputs/compliance/iso27001/iso27001_nhn.py
index 2ad5a0bda4..ad8ea6dcab 100644
--- a/prowler/lib/outputs/compliance/iso27001/iso27001_nhn.py
+++ b/prowler/lib/outputs/compliance/iso27001/iso27001_nhn.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.iso27001.models import NHNISO27001Model
@@ -34,10 +38,18 @@ class NHNISO27001(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = NHNISO27001Model(
Provider=finding.provider,
@@ -52,8 +64,8 @@ class NHNISO27001(ComplianceOutput):
Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
Requirements_Attributes_Check_Summary=attribute.Check_Summary,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
CheckId=finding.check_id,
Muted=finding.muted,
diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
index e7c00b188d..dda83342b6 100644
--- a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
+++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
@@ -2,6 +2,12 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_kisa_ismsp_table(
@@ -22,9 +28,11 @@ def get_kisa_ismsp_table(
"Status": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -35,6 +43,12 @@ def get_kisa_ismsp_table(
):
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
# Check if Section exists
@@ -46,29 +60,27 @@ def get_kisa_ismsp_table(
},
"Muted": 0,
}
- section_seen[section] = set()
+ section_seen[section] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
- # Per-section counts: count each finding once per section
- # it belongs to (a finding can map to several sections).
- if index not in section_seen[section]:
- section_seen[section].add(index)
- if finding.muted:
+ # FAIL/PASS live under ["Status"], Muted at top level.
+ previous = section_seen[section].get(index)
+ if previous is None:
+ section_seen[section][index] = status
+ if status == "Muted":
sections[section]["Muted"] += 1
- elif finding.status == "FAIL":
+ elif status == "FAIL":
sections[section]["Status"]["FAIL"] += 1
- elif finding.status == "PASS":
+ elif status == "PASS":
sections[section]["Status"]["PASS"] += 1
+ elif previous == "PASS" and status == "FAIL":
+ section_seen[section][index] = "FAIL"
+ sections[section]["Status"]["PASS"] -= 1
+ sections[section]["Status"]["FAIL"] += 1
# Add results to table
sections = dict(sorted(sections.items()))
diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py
index f927c2d4b1..3d05632d26 100644
--- a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py
+++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.kisa_ismsp.models import AWSKISAISMSPModel
@@ -34,10 +38,19 @@ class AWSKISAISMSP(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = AWSKISAISMSPModel(
Provider=finding.provider,
@@ -55,8 +68,8 @@ class AWSKISAISMSP(ComplianceOutput):
Requirements_Attributes_RelatedRegulations=attribute.RelatedRegulations,
Requirements_Attributes_AuditEvidence=attribute.AuditEvidence,
Requirements_Attributes_NonComplianceCases=attribute.NonComplianceCases,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
index 7492624aff..a352acfa6e 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_mitre_attack_table(
@@ -21,9 +28,11 @@ def get_mitre_attack_table(
"Status": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -34,32 +43,23 @@ def get_mitre_attack_table(
):
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
+ status = "Muted" if finding.muted else effective_status
for tactic in requirement.Tactics:
if tactic not in tactics:
tactics[tactic] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- tactic_seen[tactic] = set()
-
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
-
- # Per-tactic counts: count each finding once per tactic
- # it belongs to (a finding can map to several tactics).
- if index not in tactic_seen[tactic]:
- tactic_seen[tactic].add(index)
- if finding.muted:
- tactics[tactic]["Muted"] += 1
- elif finding.status == "FAIL":
- tactics[tactic]["FAIL"] += 1
- elif finding.status == "PASS":
- tactics[tactic]["PASS"] += 1
+ tactic_seen[tactic] = {}
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, tactics[tactic], tactic_seen[tactic]
+ )
# Add results to table
tactics = dict(sorted(tactics.items()))
for tactic in tactics:
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_aws.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_aws.py
index 33a7aca74b..92f4ac0e5b 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_aws.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.mitre_attack.models import AWSMitreAttackModel
@@ -35,10 +39,19 @@ class AWSMitreAttack(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
compliance_row = AWSMitreAttackModel(
Provider=finding.provider,
Description=compliance.Description,
@@ -66,8 +79,8 @@ class AWSMitreAttack(ComplianceOutput):
Requirements_Attributes_Comments=", ".join(
attribute.Comment for attribute in requirement.Attributes
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_azure.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_azure.py
index 0254aad86e..a43e27e775 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_azure.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.mitre_attack.models import AzureMitreAttackModel
@@ -35,10 +39,19 @@ class AzureMitreAttack(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
compliance_row = AzureMitreAttackModel(
Provider=finding.provider,
Description=compliance.Description,
@@ -67,8 +80,8 @@ class AzureMitreAttack(ComplianceOutput):
Requirements_Attributes_Comments=", ".join(
attribute.Comment for attribute in requirement.Attributes
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_gcp.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_gcp.py
index 4634273494..b8efdc5250 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_gcp.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.mitre_attack.models import GCPMitreAttackModel
@@ -35,10 +39,19 @@ class GCPMitreAttack(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
compliance_row = GCPMitreAttackModel(
Provider=finding.provider,
Description=compliance.Description,
@@ -66,8 +79,8 @@ class GCPMitreAttack(ComplianceOutput):
Requirements_Attributes_Comments=", ".join(
attribute.Comment for attribute in requirement.Attributes
),
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
index 1febe02f60..ef6bb2742a 100644
--- a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
@@ -2,6 +2,11 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
def get_okta_idaas_stig_table(
@@ -24,6 +29,8 @@ def get_okta_idaas_stig_table(
sections = {}
section_seen = {}
provider = ""
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -31,6 +38,14 @@ def get_okta_idaas_stig_table(
if compliance.Framework == "Okta-IDaaS-STIG":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ # A configurable check that passed with a too-loose config is
+ # forced to FAIL (source of truth: framework ConfigRequirements).
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
section = attribute.Section
@@ -42,10 +57,10 @@ def get_okta_idaas_stig_table(
if finding.muted:
if index not in muted_count:
muted_count.append(index)
- elif finding.status == "FAIL":
+ elif effective_status == "FAIL":
if index not in fail_count:
fail_count.append(index)
- elif finding.status == "PASS":
+ elif effective_status == "PASS":
if index not in pass_count:
pass_count.append(index)
@@ -55,9 +70,9 @@ def get_okta_idaas_stig_table(
section_seen[section].add(index)
if finding.muted:
sections[section]["Muted"] += 1
- elif finding.status == "FAIL":
+ elif effective_status == "FAIL":
sections[section]["FAIL"] += 1
- elif finding.status == "PASS":
+ elif effective_status == "PASS":
sections[section]["PASS"] += 1
sections = dict(sorted(sections.items()))
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
index 25f71b4def..b8a72f9f95 100644
--- a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
@@ -34,10 +38,18 @@ class OktaIDaaSSTIG(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = OktaIDaaSSTIGModel(
Provider=finding.provider,
@@ -54,8 +66,8 @@ class OktaIDaaSSTIG(ComplianceOutput):
Requirements_Attributes_CCI=attribute.CCI,
Requirements_Attributes_CheckText=attribute.CheckText,
Requirements_Attributes_FixText=attribute.FixText,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
index b17307f04a..cb23d67ffb 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
@@ -20,18 +27,20 @@ def get_prowler_threatscore_table(
"Score": [],
"Muted": [],
}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
pillars = {}
pillar_seen = {}
provider = ""
generic_score = 0
max_generic_score = 0
- counted_findings_generic = []
+ counted_findings_generic = {}
score_per_pillar = {}
max_score_per_pillar = {}
counted_findings_per_pillar = {}
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check = bulk_checks_metadata[finding.check_metadata.CheckID]
check_compliances = check.Compliance
@@ -39,6 +48,12 @@ def get_prowler_threatscore_table(
if compliance.Framework == "ProwlerThreatScore":
provider = compliance.Provider
for requirement in compliance.Requirements:
+ config_status = resolve_requirement_config_status(
+ requirement, audit_config, config_status_cache
+ )
+ effective_status = get_effective_status(
+ finding.status, config_status
+ )
for attribute in requirement.Attributes:
pillar = attribute.Section
@@ -51,57 +66,51 @@ def get_prowler_threatscore_table(
):
score_per_pillar[pillar] = 0
max_score_per_pillar[pillar] = 0
- counted_findings_per_pillar[pillar] = []
+ counted_findings_per_pillar[pillar] = {}
- if (
- index not in counted_findings_per_pillar[pillar]
- and not finding.muted
- ):
- if finding.status == "PASS":
- score_per_pillar[pillar] += (
- attribute.LevelOfRisk * attribute.Weight
- )
- max_score_per_pillar[pillar] += (
- attribute.LevelOfRisk * attribute.Weight
- )
- counted_findings_per_pillar[pillar].append(index)
+ # Revoke an earlier PASS score if a later requirement FAILs.
+ if not finding.muted:
+ contribution = attribute.LevelOfRisk * attribute.Weight
+ counted = counted_findings_per_pillar[pillar]
+ if index not in counted:
+ max_score_per_pillar[pillar] += contribution
+ if effective_status == "PASS":
+ score_per_pillar[pillar] += contribution
+ counted[index] = contribution
+ else:
+ counted[index] = 0
+ elif effective_status == "FAIL" and counted[index]:
+ score_per_pillar[pillar] -= counted[index]
+ counted[index] = 0
if pillar not in pillars:
pillars[pillar] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- pillar_seen[pillar] = set()
+ pillar_seen[pillar] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, pillars[pillar], pillar_seen[pillar]
+ )
- # Per-pillar counts: count each finding once per pillar
- # it belongs to (a finding can map to several pillars).
- if index not in pillar_seen[pillar]:
- pillar_seen[pillar].add(index)
- if finding.muted:
- pillars[pillar]["Muted"] += 1
- elif finding.status == "FAIL":
- pillars[pillar]["FAIL"] += 1
- elif finding.status == "PASS":
- pillars[pillar]["PASS"] += 1
-
- # Generic score
- if index not in counted_findings_generic and not finding.muted:
- if finding.status == "PASS":
- generic_score += (
- attribute.LevelOfRisk * attribute.Weight
- )
- max_generic_score += (
- attribute.LevelOfRisk * attribute.Weight
- )
- counted_findings_generic.append(index)
+ # Generic score, with the same PASS-revocation on FAIL.
+ if not finding.muted:
+ contribution = attribute.LevelOfRisk * attribute.Weight
+ if index not in counted_findings_generic:
+ max_generic_score += contribution
+ if effective_status == "PASS":
+ generic_score += contribution
+ counted_findings_generic[index] = contribution
+ else:
+ counted_findings_generic[index] = 0
+ elif (
+ effective_status == "FAIL"
+ and counted_findings_generic[index]
+ ):
+ generic_score -= counted_findings_generic[index]
+ counted_findings_generic[index] = 0
no_findings_pillars = []
bulk_compliance = (
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_alibaba.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_alibaba.py
index 510c098dff..7d682a3e62 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_alibaba.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_alibaba.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreAlibaba(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreAlibabaModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreAlibaba(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws.py
index ae992f8a75..f1280808e3 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreAWS(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreAWSModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreAWS(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure.py
index dd0a3b9a56..5118511369 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreAzure(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreAzureModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreAzure(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp.py
index c3bad98ade..39f9c23850 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreGCP(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreGCPModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreGCP(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_kubernetes.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_kubernetes.py
index 51f88348f0..88bf41582a 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_kubernetes.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_kubernetes.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreKubernetes(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreKubernetesModel(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreKubernetes(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365.py
index d0b2ad635c..b7b533c72a 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365.py
@@ -1,4 +1,8 @@
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import Compliance
from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
from prowler.lib.outputs.compliance.prowler_threatscore.models import (
@@ -36,10 +40,19 @@ class ProwlerThreatScoreM365(ComplianceOutput):
Returns:
- None
"""
+ requirement_config_status = build_requirement_config_status(
+ compliance.Requirements
+ )
+
for finding in findings:
for requirement in compliance.Requirements:
# Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
if finding.check_id in requirement.Checks:
+ row_status, row_status_extended = apply_config_status(
+ finding.status,
+ finding.status_extended,
+ requirement_config_status.get(requirement.Id),
+ )
for attribute in requirement.Attributes:
compliance_row = ProwlerThreatScoreM365Model(
Provider=finding.provider,
@@ -56,8 +69,8 @@ class ProwlerThreatScoreM365(ComplianceOutput):
Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
Requirements_Attributes_LevelOfRisk=attribute.LevelOfRisk,
Requirements_Attributes_Weight=attribute.Weight,
- Status=finding.status,
- StatusExtended=finding.status_extended,
+ Status=row_status,
+ StatusExtended=row_status_extended,
ResourceId=finding.resource_uid,
ResourceName=finding.resource_name,
CheckId=finding.check_id,
diff --git a/prowler/lib/outputs/compliance/universal/ocsf_compliance.py b/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
index 2886f7e4d2..07c1f67b10 100644
--- a/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
+++ b/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
@@ -19,6 +19,10 @@ from py_ocsf_models.objects.product import Product
from py_ocsf_models.objects.resource_details import ResourceDetails
from prowler.config.config import prowler_version
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import ComplianceFramework
from prowler.lib.logger import logger
from prowler.lib.outputs.utils import unroll_dict_to_list
@@ -181,11 +185,21 @@ class OCSFComplianceOutput:
for check_id in all_checks:
check_req_map.setdefault(check_id, []).append(req)
+ # Scope constraints to this output's provider (e.g. an Azure constraint
+ # must not affect an AWS output).
+ requirement_config_status = build_requirement_config_status(
+ framework.requirements, provider_type=self._provider
+ )
+
for finding in findings:
if finding.check_id in check_req_map:
for req in check_req_map[finding.check_id]:
cf = self._build_compliance_finding(
- finding, framework, req, compliance_name
+ finding,
+ framework,
+ req,
+ compliance_name,
+ requirement_config_status.get(req.id, (True, "")),
)
if cf:
self._data.append(cf)
@@ -240,10 +254,14 @@ class OCSFComplianceOutput:
framework: ComplianceFramework,
requirement,
compliance_name: str,
+ config_status: tuple = (True, ""),
) -> ComplianceFinding:
try:
+ effective_status, message = apply_config_status(
+ finding.status, finding.status_extended, config_status
+ )
compliance_status = PROWLER_TO_COMPLIANCE_STATUS.get(
- finding.status, ComplianceStatusID.Unknown
+ effective_status, ComplianceStatusID.Unknown
)
check_status = PROWLER_TO_COMPLIANCE_STATUS.get(
finding.status, ComplianceStatusID.Unknown
@@ -272,6 +290,7 @@ class OCSFComplianceOutput:
requirements=[requirement.id],
control=requirement.description,
status_id=compliance_status,
+ # Nested Check preserves the raw check result.
checks=[
Check(
uid=finding.check_id,
@@ -293,7 +312,7 @@ class OCSFComplianceOutput:
else None
),
),
- message=finding.status_extended,
+ message=message,
metadata=Metadata(
event_code=finding.check_id,
product=Product(
@@ -339,8 +358,10 @@ class OCSFComplianceOutput:
severity=finding_severity.name,
status_id=event_status.value,
status=event_status.name,
- status_code=finding.status,
- status_detail=finding.status_extended,
+ # Effective status, so the top-level never contradicts the
+ # nested compliance status.
+ status_code=effective_status,
+ status_detail=message,
time=time_value,
time_dt=(
finding.timestamp
diff --git a/prowler/lib/outputs/compliance/universal/universal_output.py b/prowler/lib/outputs/compliance/universal/universal_output.py
index a3cdb1389a..b1b0d9409b 100644
--- a/prowler/lib/outputs/compliance/universal/universal_output.py
+++ b/prowler/lib/outputs/compliance/universal/universal_output.py
@@ -5,6 +5,10 @@ from typing import TYPE_CHECKING, Optional
from pydantic.v1 import create_model
from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+ apply_config_status,
+ build_requirement_config_status,
+)
from prowler.lib.check.compliance_models import ComplianceFramework
from prowler.lib.logger import logger
from prowler.lib.utils.utils import open_file
@@ -22,6 +26,7 @@ PROVIDER_HEADER_MAP = {
"oraclecloud": ("TenancyId", "account_uid", "Region", "region"),
"alibabacloud": ("AccountId", "account_uid", "Region", "region"),
"nhn": ("AccountId", "account_uid", "Region", "region"),
+ "e2enetworks": ("ProjectId", "account_uid", "Location", "region"),
}
_DEFAULT_HEADERS = ("AccountId", "account_uid", "Region", "region")
@@ -134,7 +139,9 @@ class UniversalComplianceOutput:
return " | ".join(str(v) for v in value)
return value
- def _build_row(self, finding, framework, requirement, is_manual=False):
+ def _build_row(
+ self, finding, framework, requirement, is_manual=False, config_status=None
+ ):
"""Build a single row dict for a finding + requirement combination."""
row = {
"Provider": (
@@ -180,10 +187,14 @@ class UniversalComplianceOutput:
)
row["Requirements_TechniqueURL"] = requirement.technique_url
- row["Status"] = finding.status if not is_manual else "MANUAL"
- row["StatusExtended"] = (
- finding.status_extended if not is_manual else "Manual check"
- )
+ if is_manual:
+ row["Status"] = "MANUAL"
+ row["StatusExtended"] = "Manual check"
+ else:
+ # Config-invalid PASS reports as FAIL, matching OCSF/table outputs.
+ row["Status"], row["StatusExtended"] = apply_config_status(
+ finding.status, finding.status_extended, config_status
+ )
row["ResourceId"] = finding.resource_uid if not is_manual else "manual_check"
row["ResourceName"] = finding.resource_name if not is_manual else "Manual check"
row["CheckId"] = finding.check_id if not is_manual else "manual"
@@ -222,6 +233,12 @@ class UniversalComplianceOutput:
check_req_map[check_id] = []
check_req_map[check_id].append(req)
+ # Scope constraints to this output's provider (e.g. an Azure constraint
+ # must not affect an AWS output).
+ requirement_config_status = build_requirement_config_status(
+ framework.requirements, provider_type=self._provider
+ )
+
# Process findings using the provider-filtered check_req_map.
# This ensures that for multi-provider dict checks, only the checks
# belonging to the current provider produce output rows.
@@ -229,7 +246,12 @@ class UniversalComplianceOutput:
check_id = finding.check_id
if check_id in check_req_map:
for req in check_req_map[check_id]:
- row = self._build_row(finding, framework, req)
+ row = self._build_row(
+ finding,
+ framework,
+ req,
+ config_status=requirement_config_status.get(req.id),
+ )
try:
self._data.append(self._row_model(**row))
except Exception as e:
diff --git a/prowler/lib/outputs/compliance/universal/universal_table.py b/prowler/lib/outputs/compliance/universal/universal_table.py
index e54ad5155c..5f4a6cf88b 100644
--- a/prowler/lib/outputs/compliance/universal/universal_table.py
+++ b/prowler/lib/outputs/compliance/universal/universal_table.py
@@ -2,6 +2,13 @@ from colorama import Fore, Style
from tabulate import tabulate
from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+ accumulate_group_status,
+ accumulate_overview_status,
+ get_effective_status,
+ get_scan_audit_config,
+ resolve_requirement_config_status,
+)
from prowler.lib.check.compliance_models import ComplianceFramework
@@ -164,9 +171,11 @@ def _render_grouped(
check_map = _build_requirement_check_map(framework, provider)
groups = {}
group_seen = {}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check_id = finding.check_metadata.CheckID
@@ -174,32 +183,24 @@ def _render_grouped(
continue
for req in check_map[check_id]:
+ effective_status = get_effective_status(
+ finding.status,
+ resolve_requirement_config_status(
+ req, audit_config, config_status_cache, provider_type=provider
+ ),
+ )
for group_key in _get_group_key(req, group_by):
if group_key not in groups:
groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- group_seen[group_key] = set()
+ group_seen[group_key] = {}
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
-
- # Per-group counts: count each finding once per group it belongs
- # to (a finding can map to several groups via several requirements).
- if index not in group_seen[group_key]:
- group_seen[group_key].add(index)
- if finding.muted:
- groups[group_key]["Muted"] += 1
- elif finding.status == "FAIL":
- groups[group_key]["FAIL"] += 1
- elif finding.status == "PASS":
- groups[group_key]["PASS"] += 1
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, groups[group_key], group_seen[group_key]
+ )
if not _print_overview(
pass_count, fail_count, muted_count, compliance_framework_name, labels
@@ -272,9 +273,11 @@ def _render_split(
groups = {}
group_muted_seen = {}
group_split_seen = {}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check_id = finding.check_metadata.CheckID
@@ -282,6 +285,12 @@ def _render_split(
continue
for req in check_map[check_id]:
+ effective_status = get_effective_status(
+ finding.status,
+ resolve_requirement_config_status(
+ req, audit_config, config_status_cache, provider_type=provider
+ ),
+ )
for group_key in _get_group_key(req, group_by):
if group_key not in groups:
groups[group_key] = {
@@ -289,33 +298,33 @@ def _render_split(
}
groups[group_key]["Muted"] = 0
group_muted_seen[group_key] = set()
- group_split_seen[group_key] = {sv: set() for sv in split_values}
+ group_split_seen[group_key] = {sv: {} for sv in split_values}
split_val = req.attributes.get(split_field, "")
if finding.muted:
# Overview total: count each finding once per framework
- if index not in muted_count:
- muted_count.append(index)
+ muted_count.add(index)
# Per-group Muted: count each finding once per group it
# belongs to (a finding can map to several groups).
if index not in group_muted_seen[group_key]:
group_muted_seen[group_key].add(index)
groups[group_key]["Muted"] += 1
else:
- if finding.status == "FAIL" and index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS" and index not in pass_count:
- pass_count.append(index)
+ if effective_status == "FAIL":
+ fail_count.add(index)
+ pass_count.discard(index)
+ elif effective_status == "PASS" and index not in fail_count:
+ pass_count.add(index)
for sv in split_values:
if sv in str(split_val):
- if index not in group_split_seen[group_key][sv]:
- group_split_seen[group_key][sv].add(index)
- if finding.status == "FAIL":
- groups[group_key][sv]["FAIL"] += 1
- else:
- groups[group_key][sv]["PASS"] += 1
+ accumulate_group_status(
+ index,
+ effective_status,
+ groups[group_key][sv],
+ group_split_seen[group_key][sv],
+ )
if not _print_overview(
pass_count, fail_count, muted_count, compliance_framework_name, labels
@@ -387,16 +396,18 @@ def _render_scored(
weight_field = scoring.weight_field
groups = {}
group_seen = {}
- pass_count = []
- fail_count = []
- muted_count = []
+ pass_count = set()
+ fail_count = set()
+ muted_count = set()
score_per_group = {}
max_score_per_group = {}
counted_per_group = {}
generic_score = 0
max_generic_score = 0
- counted_generic = []
+ counted_generic = {}
+ audit_config = get_scan_audit_config()
+ config_status_cache = {}
for index, finding in enumerate(findings):
check_id = finding.check_metadata.CheckID
@@ -404,6 +415,12 @@ def _render_scored(
continue
for req in check_map[check_id]:
+ effective_status = get_effective_status(
+ finding.status,
+ resolve_requirement_config_status(
+ req, audit_config, config_status_cache, provider_type=provider
+ ),
+ )
for group_key in _get_group_key(req, group_by):
attrs = req.attributes
risk = attrs.get(risk_field, 0)
@@ -411,44 +428,47 @@ def _render_scored(
if group_key not in groups:
groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
- group_seen[group_key] = set()
+ group_seen[group_key] = {}
score_per_group[group_key] = 0
max_score_per_group[group_key] = 0
- counted_per_group[group_key] = []
+ counted_per_group[group_key] = {}
- if index not in counted_per_group[group_key] and not finding.muted:
- if finding.status == "PASS":
- score_per_group[group_key] += risk * weight
- max_score_per_group[group_key] += risk * weight
- counted_per_group[group_key].append(index)
+ # Revoke an earlier PASS score if a later requirement FAILs.
+ if not finding.muted:
+ contribution = risk * weight
+ counted = counted_per_group[group_key]
+ if index not in counted:
+ max_score_per_group[group_key] += contribution
+ if effective_status == "PASS":
+ score_per_group[group_key] += contribution
+ counted[index] = contribution
+ else:
+ counted[index] = 0
+ elif effective_status == "FAIL" and counted[index]:
+ score_per_group[group_key] -= counted[index]
+ counted[index] = 0
- # Overview totals: count each finding once per framework
- if finding.muted:
- if index not in muted_count:
- muted_count.append(index)
- elif finding.status == "FAIL":
- if index not in fail_count:
- fail_count.append(index)
- elif finding.status == "PASS":
- if index not in pass_count:
- pass_count.append(index)
+ status = "Muted" if finding.muted else effective_status
+ accumulate_overview_status(
+ index, status, pass_count, fail_count, muted_count
+ )
+ accumulate_group_status(
+ index, status, groups[group_key], group_seen[group_key]
+ )
- # Per-group counts: count each finding once per group it belongs
- # to (a finding can map to several groups via several requirements).
- if index not in group_seen[group_key]:
- group_seen[group_key].add(index)
- if finding.muted:
- groups[group_key]["Muted"] += 1
- elif finding.status == "FAIL":
- groups[group_key]["FAIL"] += 1
- elif finding.status == "PASS":
- groups[group_key]["PASS"] += 1
-
- if index not in counted_generic and not finding.muted:
- if finding.status == "PASS":
- generic_score += risk * weight
- max_generic_score += risk * weight
- counted_generic.append(index)
+ # Generic score, with the same PASS-revocation on FAIL.
+ if not finding.muted:
+ contribution = risk * weight
+ if index not in counted_generic:
+ max_generic_score += contribution
+ if effective_status == "PASS":
+ generic_score += contribution
+ counted_generic[index] = contribution
+ else:
+ counted_generic[index] = 0
+ elif effective_status == "FAIL" and counted_generic[index]:
+ generic_score -= counted_generic[index]
+ counted_generic[index] = 0
if not _print_overview(
pass_count, fail_count, muted_count, compliance_framework_name, labels
diff --git a/prowler/lib/outputs/finding.py b/prowler/lib/outputs/finding.py
index ed8bda4039..7231572571 100644
--- a/prowler/lib/outputs/finding.py
+++ b/prowler/lib/outputs/finding.py
@@ -342,6 +342,18 @@ class Finding(BaseModel):
output_data["resource_uid"] = check_output.resource_id
output_data["region"] = check_output.location
+ elif provider.type == "e2enetworks":
+ output_data["auth_method"] = "api_key_and_bearer_token"
+ output_data["account_uid"] = str(
+ get_nested_attribute(provider, "identity.project_id")
+ )
+ output_data["account_name"] = str(
+ get_nested_attribute(provider, "identity.project_id")
+ )
+ output_data["resource_name"] = check_output.resource_name
+ output_data["resource_uid"] = check_output.resource_id
+ output_data["region"] = check_output.location
+
elif provider.type == "stackit":
output_data["auth_method"] = getattr(
provider, "auth_method", "api_token"
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 18dd4b0f3d..3463014232 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -2,6 +2,7 @@ import sys
from io import TextIOWrapper
import markdown
+from markupsafe import escape
from prowler.config.config import (
html_logo_url,
@@ -1396,6 +1397,46 @@ class HTML(Output):
)
return ""
+ @staticmethod
+ def get_e2enetworks_assessment_summary(provider: Provider) -> str:
+ """Get the HTML assessment summary for the E2E Networks provider."""
+ try:
+ locations = escape(", ".join(provider.identity.locations))
+ project_id = escape(str(provider.identity.project_id))
+ return f"""
+ <div class="col-md-2">
+ <div class="card">
+ <div class="card-header">
+ E2E Networks Assessment Summary
+ </div>
+ <ul class="list-group list-group-flush">
+ <li class="list-group-item">
+ <b>Project ID:</b> {project_id}
+ </li>
+ <li class="list-group-item">
+ <b>Locations:</b> {locations}
+ </li>
+ </ul>
+ </div>
+ </div>
+ <div class="col-md-4">
+ <div class="card">
+ <div class="card-header">
+ E2E Networks Credentials
+ </div>
+ <ul class="list-group list-group-flush">
+ <li class="list-group-item">
+ <b>Authentication:</b> API Key + Bearer Token
+ </li>
+ </ul>
+ </div>
+ </div>"""
+ except Exception as error:
+ logger.error(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+ )
+ return ""
+
@staticmethod
def get_vercel_assessment_summary(provider: Provider) -> str:
"""
diff --git a/prowler/lib/outputs/jira/jira.py b/prowler/lib/outputs/jira/jira.py
index 9005b5274e..601120cdfc 100644
--- a/prowler/lib/outputs/jira/jira.py
+++ b/prowler/lib/outputs/jira/jira.py
@@ -1,5 +1,6 @@
import base64
import os
+import re
from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import Dict, List, Optional
@@ -37,6 +38,10 @@ from prowler.lib.outputs.jira.exceptions.exceptions import (
)
from prowler.providers.common.models import Connection
+ATLASSIAN_SITE_NAME_REGEX = re.compile(
+ r"\A[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\Z"
+)
+
@dataclass
class JiraConnection(Connection):
@@ -51,6 +56,39 @@ class JiraConnection(Connection):
issue_types: dict = None
+def _format_jira_issue_creation_error(response_json: object, status_code: int) -> str:
+ """Build a safe Jira issue creation error message from structured fields.
+
+ Args:
+ response_json: Parsed Jira response body.
+ status_code: HTTP status code returned by Jira.
+
+ Returns:
+ Safe issue creation error message for user-facing propagation.
+ """
+ message_parts = []
+
+ if not isinstance(response_json, dict):
+ return f"Failed to create Jira issue: Jira returned status code {status_code}."
+
+ errors = response_json.get("errors")
+ if isinstance(errors, dict):
+ message_parts.extend(
+ f"'{field}': '{message}'" for field, message in errors.items() if message
+ )
+
+ error_messages = response_json.get("errorMessages")
+ if isinstance(error_messages, list):
+ message_parts.extend(str(message) for message in error_messages if message)
+ elif isinstance(error_messages, str) and error_messages:
+ message_parts.append(error_messages)
+
+ if message_parts:
+ return f"Failed to create Jira issue: {'; '.join(message_parts)}"
+
+ return f"Failed to create Jira issue: Jira returned status code {status_code}."
+
+
class MarkdownToADFConverter:
"""Helper to convert Markdown strings into Atlassian Document Format blocks."""
@@ -379,6 +417,19 @@ class Jira:
message=init_error, file=os.path.basename(__file__)
)
+ @staticmethod
+ def _sanitize_summary(summary: str) -> str:
+ """Normalize and truncate a Jira issue summary.
+
+ Args:
+ summary: Raw summary text.
+
+ Returns:
+ The summary collapsed to one line and limited to Jira's 255-character
+ summary maximum.
+ """
+ return " ".join(summary.split())[:255]
+
@staticmethod
def _build_code_block_content(code_value: str) -> Optional[Dict]:
if not code_value:
@@ -632,11 +683,14 @@ class Jira:
"""
try:
if self._using_basic_auth:
+ if not domain or not ATLASSIAN_SITE_NAME_REGEX.fullmatch(domain):
+ raise ValueError("Invalid Jira site name.")
headers = self.get_headers(access_token)
response = requests.get(
f"https://{domain}.atlassian.net/_edge/tenant_info",
headers=headers,
timeout=self.REQUEST_TIMEOUT,
+ allow_redirects=False,
)
response = response.json()
return response.get("cloudId")
@@ -1114,6 +1168,101 @@ class Jira:
return "#0000FF"
return "#000000" # Default black color for unknown severities
+ @staticmethod
+ def _adf_colored_strong_marks(color_mark_type: str, color: str) -> list[dict]:
+ """Build ADF marks for bold text with a Jira color mark.
+
+ Args:
+ color_mark_type: Jira ADF color mark type, such as textColor or
+ backgroundColor.
+ color: Hex color value for the mark.
+
+ Returns:
+ ADF marks for strong colored text.
+ """
+ return [
+ {"type": "strong"},
+ {"type": color_mark_type, "attrs": {"color": color}},
+ ]
+
+ def _adf_severity_marks(
+ self, severity: str = "", severity_color: str | None = None
+ ) -> list[dict]:
+ """Build ADF marks for severity text.
+
+ Args:
+ severity: Finding severity used to derive a color when severity_color
+ is not provided.
+ severity_color: Optional explicit severity color.
+
+ Returns:
+ ADF marks for highlighted severity text.
+ """
+ color = severity_color or self.get_severity_color(str(severity).lower())
+ return self._adf_colored_strong_marks("backgroundColor", color)
+
+ def _adf_status_marks(
+ self, status: str = "", status_color: str | None = None
+ ) -> list[dict]:
+ """Build ADF marks for status text.
+
+ Args:
+ status: Finding status used to derive a color when status_color is
+ not provided.
+ status_color: Optional explicit status color.
+
+ Returns:
+ ADF marks for colored status text.
+ """
+ color = status_color or self.get_color_from_status(str(status).upper())
+ return self._adf_colored_strong_marks("textColor", color)
+
+ @staticmethod
+ def _adf_text_node(text: str, marks: list[dict] | None = None) -> dict:
+ """Build an ADF text node.
+
+ Args:
+ text: Text content for the node.
+ marks: Optional ADF marks to apply to the text.
+
+ Returns:
+ ADF text node with optional marks.
+ """
+ node = {"type": "text", "text": text}
+ if marks:
+ node["marks"] = marks
+ return node
+
+ def _adf_severity_text_node(
+ self, severity: str = "", severity_color: str | None = None
+ ) -> dict:
+ """Build an ADF text node for severity.
+
+ Args:
+ severity: Severity text to render.
+ severity_color: Optional explicit severity color.
+
+ Returns:
+ ADF text node with severity marks.
+ """
+ return self._adf_text_node(
+ severity, self._adf_severity_marks(severity, severity_color)
+ )
+
+ def _adf_status_text_node(
+ self, status: str = "", status_color: str | None = None
+ ) -> dict:
+ """Build an ADF text node for status.
+
+ Args:
+ status: Status text to render.
+ status_color: Optional explicit status color.
+
+ Returns:
+ ADF text node with status marks.
+ """
+ return self._adf_text_node(status, self._adf_status_marks(status, status_color))
+
def get_adf_description(
self,
check_id: str = "",
@@ -1252,19 +1401,9 @@ class Jira:
{
"type": "paragraph",
"content": [
- {
- "type": "text",
- "text": severity,
- "marks": [
- {"type": "strong"},
- {
- "type": "backgroundColor",
- "attrs": {
- "color": severity_color,
- },
- },
- ],
- }
+ self._adf_severity_text_node(
+ severity, severity_color
+ )
],
}
],
@@ -1297,17 +1436,7 @@ class Jira:
{
"type": "paragraph",
"content": [
- {
- "type": "text",
- "text": status,
- "marks": [
- {"type": "strong"},
- {
- "type": "textColor",
- "attrs": {"color": status_color},
- },
- ],
- }
+ self._adf_status_text_node(status, status_color)
],
}
],
@@ -1831,6 +1960,239 @@ class Jira:
],
}
+ def get_grouped_adf_description(
+ self,
+ check_id: str = "",
+ check_title: str = "",
+ check_description: str = "",
+ severity: str = "",
+ status: str = "",
+ provider: str = "",
+ service: str = "",
+ affected_failing_resources: int = 0,
+ last_seen: str = "",
+ failing_for: str = "",
+ grouped_resources: list[dict] | None = None,
+ resources_total: int = 0,
+ resources_shown: int = 0,
+ finding_group_url: str = "",
+ finding_group_link_text: str = "",
+ risk: str = "",
+ recommendation_text: str = "",
+ recommendation_url: str = "",
+ ) -> dict:
+ """Build a Jira ADF description for a grouped finding issue.
+
+ Args:
+ check_id: Finding check ID.
+ check_title: Finding check title.
+ check_description: Finding check description.
+ severity: Finding group severity.
+ status: Finding group status.
+ provider: Cloud provider name.
+ service: Provider service name.
+ affected_failing_resources: Number of failing resources in the group.
+ last_seen: Last time the finding group was seen.
+ failing_for: Duration the finding group has been failing.
+ grouped_resources: Resource rows to include in the grouped issue.
+ resources_total: Total number of resources in the group.
+ resources_shown: Number of resources rendered in this Jira issue.
+ finding_group_url: Optional URL for the full finding group.
+ finding_group_link_text: Optional link text for finding_group_url.
+ risk: Risk description for the check.
+ recommendation_text: Remediation recommendation text.
+ recommendation_url: Optional remediation recommendation URL.
+
+ Returns:
+ Jira ADF document describing the finding group.
+ """
+
+ def _safe(value) -> str:
+ return str(value) if value not in (None, "") else "-"
+
+ def _text(value, marks: list[dict] | None = None) -> dict:
+ node = {"type": "text", "text": _safe(value)}
+ if marks:
+ node["marks"] = marks
+ return node
+
+ def _paragraph(value, marks: list[dict] | None = None) -> dict:
+ return {"type": "paragraph", "content": [_text(value, marks)]}
+
+ def _cell(value, marks: list[dict] | None = None) -> dict:
+ return {"type": "tableCell", "content": [_paragraph(value, marks)]}
+
+ def _content_cell(content: list[dict]) -> dict:
+ return {"type": "tableCell", "content": content}
+
+ def _append_link(content: list[dict], url: str) -> list[dict]:
+ if not url:
+ return content
+
+ link_node = {
+ "type": "text",
+ "text": url,
+ "marks": [{"type": "link", "attrs": {"href": url}}],
+ }
+ if content and content[-1].get("type") == "paragraph":
+ paragraph_content = content[-1].setdefault("content", [])
+ if paragraph_content:
+ last_inline = paragraph_content[-1]
+ if last_inline.get("type") != "text" or not last_inline.get(
+ "text", ""
+ ).endswith(" "):
+ paragraph_content.append({"type": "text", "text": " "})
+ paragraph_content.append(link_node)
+ else:
+ content.append({"type": "paragraph", "content": [link_node]})
+ return content
+
+ def _row(cells: list[dict]) -> dict:
+ return {"type": "tableRow", "content": cells}
+
+ strong = [{"type": "strong"}]
+ code = [{"type": "code"}]
+ severity_marks = self._adf_severity_marks(severity)
+ status_marks = self._adf_status_marks(status)
+ recommendation_content = _append_link(
+ self._markdown_converter.convert(_safe(recommendation_text)),
+ recommendation_url,
+ )
+ main_rows = [
+ _row([_cell("Check Id", strong), _cell(check_id, code)]),
+ _row([_cell("Check Title", strong), _cell(check_title)]),
+ _row([_cell("Severity", strong), _cell(severity, severity_marks)]),
+ _row([_cell("Status", strong), _cell(status, status_marks)]),
+ _row([_cell("Provider", strong), _cell(provider, code)]),
+ _row([_cell("Service", strong), _cell(service, code)]),
+ _row(
+ [
+ _cell("Affected Failing Resources", strong),
+ _cell(affected_failing_resources, strong),
+ ]
+ ),
+ _row([_cell("Last Seen", strong), _cell(last_seen)]),
+ _row([_cell("Failing For", strong), _cell(failing_for)]),
+ _row(
+ [
+ _cell("Risk", strong),
+ _content_cell(self._markdown_converter.convert(_safe(risk))),
+ ]
+ ),
+ _row(
+ [
+ _cell("Recommendation", strong),
+ _content_cell(recommendation_content),
+ ]
+ ),
+ ]
+
+ resource_rows = [
+ _row(
+ [
+ _cell("Resource", strong),
+ _cell("Resource UID", strong),
+ _cell("Provider", strong),
+ _cell("Service", strong),
+ _cell("Account / Tenant", strong),
+ _cell("Status", strong),
+ _cell("Severity", strong),
+ _cell("Region", strong),
+ _cell("Last Seen", strong),
+ _cell("Failing For", strong),
+ _cell("Triage", strong),
+ ]
+ )
+ ]
+ for resource in grouped_resources or []:
+ resource_status = resource.get("status")
+ resource_severity = str(resource.get("severity", "")).upper()
+ resource_status_marks = self._adf_status_marks(resource_status)
+ resource_severity_marks = self._adf_severity_marks(resource_severity)
+ resource_rows.append(
+ _row(
+ [
+ _cell(resource.get("resource_name"), code),
+ _cell(resource.get("resource_uid"), code),
+ _cell(resource.get("provider"), code),
+ _cell(resource.get("service"), code),
+ _cell(resource.get("provider_account"), code),
+ _cell(resource_status, resource_status_marks),
+ _cell(resource_severity, resource_severity_marks),
+ _cell(resource.get("region"), code),
+ _cell(resource.get("last_seen")),
+ _cell(resource.get("failing_for")),
+ _cell(resource.get("triage")),
+ ]
+ )
+ )
+
+ content = [
+ _paragraph("Prowler has discovered the following Finding Group:"),
+ {"type": "table", "attrs": {"layout": "full-width"}, "content": main_rows},
+ ]
+
+ content.extend(
+ [
+ {
+ "type": "heading",
+ "attrs": {"level": 2},
+ "content": [_text("Affected failing resources")],
+ },
+ {
+ "type": "table",
+ "attrs": {"layout": "full-width"},
+ "content": resource_rows,
+ },
+ ]
+ )
+
+ if resources_total > resources_shown:
+ remaining_content = [
+ _text(f"Showing {resources_shown} of {resources_total} Findings.")
+ ]
+ if finding_group_url and finding_group_link_text:
+ remaining_content = [
+ _text(
+ f"Showing {resources_shown} of {resources_total} Findings "
+ "in this Jira issue. "
+ ),
+ _text(
+ finding_group_link_text,
+ [
+ {
+ "type": "link",
+ "attrs": {"href": finding_group_url},
+ }
+ ],
+ ),
+ ]
+ content.append(
+ {
+ "type": "paragraph",
+ "content": remaining_content,
+ }
+ )
+ elif finding_group_url and finding_group_link_text:
+ content.append(
+ {
+ "type": "paragraph",
+ "content": [
+ _text(
+ finding_group_link_text,
+ [
+ {
+ "type": "link",
+ "attrs": {"href": finding_group_url},
+ }
+ ],
+ ),
+ ],
+ }
+ )
+
+ return {"type": "doc", "version": 1, "content": content}
+
def send_findings(
self,
findings: list[Finding] = None,
@@ -1924,7 +2286,7 @@ class Jira:
summary_parts.append(finding.resource_uid)
summary = " - ".join(summary_parts[1:])
- summary = f"{summary_parts[0]} {summary}"[:255]
+ summary = self._sanitize_summary(f"{summary_parts[0]} {summary}")
payload = {
"fields": {
@@ -2007,11 +2369,13 @@ class Jira:
self,
check_id: str = "",
check_title: str = "",
+ check_description: str = "",
severity: str = "",
status: str = "",
status_extended: str = "",
provider: str = "",
region: str = "",
+ service: str = "",
resource_uid: str = "",
resource_name: str = "",
risk: str = "",
@@ -2028,6 +2392,14 @@ class Jira:
issue_labels: list[str] = "",
finding_url: str = "",
tenant_info: str = "",
+ affected_failing_resources: int = 0,
+ grouped_resources: list[dict] | None = None,
+ resources_total: int = 0,
+ resources_shown: int = 0,
+ last_seen: str = "",
+ failing_for: str = "",
+ finding_group_url: str = "",
+ finding_group_link_text: str = "",
) -> bool:
"""
Send the finding to Jira
@@ -2035,11 +2407,13 @@ class Jira:
Args:
- check_id: The check ID
- check_title: The check title
+ - check_description: The check description
- severity: The severity
- status: The status
- status_extended: The status extended
- provider: The provider
- region: The region
+ - service: The service
- resource_uid: The resource UID
- resource_name: The resource name
- risk: The risk
@@ -2056,10 +2430,20 @@ class Jira:
- issue_labels: The issue labels
- finding_url: The finding URL
- tenant_info: The tenant info
+ - affected_failing_resources: The number of affected failing resources
+ - grouped_resources: The grouped resources to render, or None for a
+ single finding issue
+ - resources_total: The total resources in the finding group
+ - resources_shown: The resources shown in the Jira issue
+ - last_seen: The last time the finding group was seen
+ - failing_for: The duration the finding group has been failing
+ - finding_group_url: The finding group URL
+ - finding_group_link_text: The link text for the finding group URL
Raises:
- JiraRefreshTokenError: Failed to refresh the access token
- JiraRefreshTokenResponseError: Failed to refresh the access token, response code did not match 200
+ - JiraNoTokenError: Failed to get an access token
- JiraCreateIssueError: Failed to create an issue in Jira
- JiraSendFindingsResponseError: Failed to send the finding to Jira
- JiraRequiredCustomFieldsError: Jira project requires custom fields that are not supported
@@ -2098,40 +2482,66 @@ class Jira:
status_color = self.get_color_from_status(status)
severity_color = self.get_severity_color(severity.lower())
- adf_description = self.get_adf_description(
- check_id=check_id,
- check_title=check_title,
- severity=severity.upper(),
- severity_color=severity_color,
- status=status,
- status_color=status_color,
- status_extended=status_extended,
- provider=provider,
- region=region,
- resource_uid=resource_uid,
- resource_name=resource_name,
- risk=risk,
- recommendation_text=recommendation_text,
- recommendation_url=recommendation_url,
- remediation_code_native_iac=remediation_code_native_iac,
- remediation_code_terraform=remediation_code_terraform,
- remediation_code_cli=remediation_code_cli,
- remediation_code_other=remediation_code_other,
- resource_tags=resource_tags,
- compliance=compliance,
- finding_url=finding_url,
- tenant_info=tenant_info,
- )
+ if grouped_resources is not None:
+ adf_description = self.get_grouped_adf_description(
+ check_id=check_id,
+ check_title=check_title,
+ check_description=check_description,
+ severity=severity.upper(),
+ status=status,
+ provider=provider,
+ service=service,
+ affected_failing_resources=affected_failing_resources,
+ last_seen=last_seen,
+ failing_for=failing_for,
+ grouped_resources=grouped_resources,
+ resources_total=resources_total,
+ resources_shown=resources_shown,
+ finding_group_url=finding_group_url,
+ finding_group_link_text=finding_group_link_text,
+ risk=risk,
+ recommendation_text=recommendation_text,
+ recommendation_url=recommendation_url,
+ )
+ else:
+ adf_description = self.get_adf_description(
+ check_id=check_id,
+ check_title=check_title,
+ severity=severity.upper(),
+ severity_color=severity_color,
+ status=status,
+ status_color=status_color,
+ status_extended=status_extended,
+ provider=provider,
+ region=region,
+ resource_uid=resource_uid,
+ resource_name=resource_name,
+ risk=risk,
+ recommendation_text=recommendation_text,
+ recommendation_url=recommendation_url,
+ remediation_code_native_iac=remediation_code_native_iac,
+ remediation_code_terraform=remediation_code_terraform,
+ remediation_code_cli=remediation_code_cli,
+ remediation_code_other=remediation_code_other,
+ resource_tags=resource_tags,
+ compliance=compliance,
+ finding_url=finding_url,
+ tenant_info=tenant_info,
+ )
summary_parts = ["[Prowler]"]
if severity:
summary_parts.append(severity.upper())
if check_id:
summary_parts.append(check_id)
- if resource_uid:
+ if grouped_resources is not None:
+ summary_parts.append(
+ f"{affected_failing_resources} affected failing resources"
+ )
+ elif resource_uid:
summary_parts.append(resource_uid)
summary = " - ".join(summary_parts[1:])
- summary = f"{summary_parts[0]} {summary}"[:255]
+ summary = self._sanitize_summary(f"{summary_parts[0]} {summary}")
payload = {
"fields": {
@@ -2155,31 +2565,45 @@ class Jira:
try:
response_json = response.json()
except (ValueError, requests.exceptions.JSONDecodeError):
- response_error = f"Failed to send finding: {response.status_code} - {response.text}"
+ response_error = _format_jira_issue_creation_error(
+ {}, response.status_code
+ )
logger.error(response_error)
- return False
+ raise JiraSendFindingsResponseError(
+ message=response_error, file=os.path.basename(__file__)
+ )
# Check if the error is due to required custom fields
- if response.status_code == 400 and "errors" in response_json:
+ if (
+ response.status_code == 400
+ and isinstance(response_json, dict)
+ and "errors" in response_json
+ ):
errors = response_json.get("errors", {})
# Look for custom field errors (fields starting with "customfield_")
- custom_field_errors = {
- k: v for k, v in errors.items() if k.startswith("customfield_")
- }
+ custom_field_errors = {}
+ if isinstance(errors, dict):
+ custom_field_errors = {
+ k: v
+ for k, v in errors.items()
+ if k.startswith("customfield_")
+ }
if custom_field_errors:
custom_fields_formatted = ", ".join(
[f"'{k}': '{v}'" for k, v in custom_field_errors.items()]
)
- logger.error(
- f"Jira project requires custom fields that are not supported: {custom_fields_formatted}"
+ raise JiraRequiredCustomFieldsError(
+ message=f"Jira project requires custom fields that are not supported: {custom_fields_formatted}",
+ file=os.path.basename(__file__),
)
- return False
- response_error = (
- f"Failed to send finding: {response.status_code} - {response_json}"
+ response_error = _format_jira_issue_creation_error(
+ response_json, response.status_code
)
logger.error(response_error)
- return False
+ raise JiraSendFindingsResponseError(
+ message=response_error, file=os.path.basename(__file__)
+ )
else:
try:
response_json = response.json()
@@ -2191,13 +2615,17 @@ class Jira:
return True
except JiraRequiredCustomFieldsError as custom_fields_error:
logger.error(f"Custom fields error: {custom_fields_error}")
- return False
+ raise custom_fields_error
+ except JiraSendFindingsResponseError as response_error:
+ logger.error(f"Jira response error: {response_error}")
+ raise response_error
except JiraRefreshTokenError as refresh_error:
logger.error(f"Token refresh error: {refresh_error}")
- return False
+ raise refresh_error
except JiraRefreshTokenResponseError as response_error:
- logger.error(f"Token response error: {response_error}")
- return False
+ raise response_error
+ except JiraNoTokenError as no_token_error:
+ raise no_token_error
except Exception as e:
logger.error(f"Failed to send finding: {e}")
return False
diff --git a/prowler/lib/outputs/outputs.py b/prowler/lib/outputs/outputs.py
index 40dc4635ba..05421ac584 100644
--- a/prowler/lib/outputs/outputs.py
+++ b/prowler/lib/outputs/outputs.py
@@ -24,6 +24,8 @@ def stdout_report(finding, color, verbose, status, fix, provider=None):
details = finding.location
elif finding.check_metadata.Provider == "nhn":
details = finding.location
+ elif finding.check_metadata.Provider == "e2enetworks":
+ details = finding.location
elif finding.check_metadata.Provider == "stackit":
details = finding.location
elif finding.check_metadata.Provider == "llm":
diff --git a/prowler/lib/outputs/summary_table.py b/prowler/lib/outputs/summary_table.py
index 77b4c2725a..2d8da80597 100644
--- a/prowler/lib/outputs/summary_table.py
+++ b/prowler/lib/outputs/summary_table.py
@@ -70,6 +70,9 @@ def display_summary_table(
elif provider.type == "nhn":
entity_type = "Tenant Domain"
audited_entities = provider.identity.tenant_domain
+ elif provider.type == "e2enetworks":
+ entity_type = "Project"
+ audited_entities = str(provider.identity.project_id)
elif provider.type == "stackit":
if provider.identity.project_name:
entity_type = "Project"
diff --git a/prowler/lib/resource_limit.py b/prowler/lib/resource_limit.py
new file mode 100644
index 0000000000..da144e9dd0
--- /dev/null
+++ b/prowler/lib/resource_limit.py
@@ -0,0 +1,88 @@
+"""Scoped resource scan limits for high-volume resources.
+
+Some services accumulate huge numbers of resources (EBS snapshots, backup
+recovery points, log groups, Lambda functions, ECS task definitions,
+CodeArtifact packages). Scanning all of them causes API throttling, slow
+scans, cost and noisy findings.
+
+``get_resource_scan_limit`` resolves the configured number of resources to
+analyze for a supported resource path. A limited resource can produce zero,
+one, or many findings; findings are not capped or re-ordered here.
+
+Tradeoff: for newest-based resources, services may need to list lightweight or
+base metadata broadly to select the truly newest resources, then apply limits
+only to expensive hydration or analysis. The helper must not send
+user-configured limits as unsafe paginator ``PageSize`` values because AWS
+services validate page sizes differently.
+"""
+
+from collections.abc import Callable, Iterable, Iterator, Mapping
+from itertools import islice
+from typing import Any, Optional, Protocol, TypeVar
+
+GLOBAL_LIMIT_KEY = "max_scanned_resources_per_service"
+T = TypeVar("T")
+
+
+class PaginatorProtocol(Protocol):
+ """Minimal boto3-compatible paginator interface used by this module."""
+
+ def paginate(self, **operation_parameters: Any) -> Iterable[Mapping[str, Any]]:
+ """Return paginator pages for the provided operation parameters."""
+
+
+def get_resource_scan_limit(audit_config: dict, service_key: str) -> Optional[int]:
+ """Resolve the resource scan limit for a service.
+
+ Precedence: per-service key (``service_key``) > global
+ ``max_scanned_resources_per_service`` > unlimited.
+
+ A non-positive resolved value means **unlimited** (``None``), preserving
+ the legacy behavior as an explicit opt-out.
+
+ Args:
+ audit_config: The provider ``audit_config`` dictionary.
+ service_key: The per-service config key, e.g. ``max_lambda_functions``.
+
+ Returns:
+ The limit as a positive ``int``, or ``None`` for unlimited.
+ """
+ value = audit_config.get(service_key)
+ if value is None:
+ value = audit_config.get(GLOBAL_LIMIT_KEY)
+ if value is None or value <= 0:
+ return None
+ return int(value)
+
+
+def limit_resources(resources: Iterable[T], limit: Optional[int]) -> Iterator[T]:
+ """Yield up to ``limit`` resources without changing resource order."""
+ if not limit or limit <= 0:
+ yield from resources
+ return
+ yield from islice(resources, limit)
+
+
+def iter_limited_paginator_items(
+ paginator: PaginatorProtocol,
+ result_key: str,
+ limit: Optional[int],
+ item_filter: Optional[Callable[[T], bool]] = None,
+ **operation_parameters: Any,
+) -> Iterator[T]:
+ """Yield paginator result items, stopping after ``limit`` selected items.
+
+ The configured resource-analysis limit is intentionally not sent as
+ ``PageSize`` because AWS services validate page sizes differently. The
+ paginator receives only the operation parameters needed by the AWS API,
+ while this iterator applies the analysis limit defensively client-side.
+ """
+ selected = 0
+ for page in paginator.paginate(**operation_parameters):
+ for item in page.get(result_key, []):
+ if item_filter and not item_filter(item):
+ continue
+ yield item
+ selected += 1
+ if limit and selected >= limit:
+ return
diff --git a/prowler/lib/scan/scan.py b/prowler/lib/scan/scan.py
index 4bef660d33..b87cfcdf1d 100644
--- a/prowler/lib/scan/scan.py
+++ b/prowler/lib/scan/scan.py
@@ -178,25 +178,58 @@ class Scan:
)
)
- # Exclude checks
+ # Validate excluded checks against the FULL provider catalog — not
+ # just the selected scope — so a global config can exclude a valid
+ # check even when that check is not part of a particular scoped run.
+ excluded_check_set: set[str] = set()
if excluded_checks:
- for check in excluded_checks:
- if check in self._checks_to_execute:
- self._checks_to_execute.remove(check)
- else:
- raise ScanInvalidCheckError(
- f"Invalid check provided: {check}. Check does not exist in the provider."
- )
+ excluded_check_set = set(excluded_checks)
+ if len(excluded_check_set) != len(excluded_checks):
+ raise ScanInvalidCheckError(
+ "Duplicate excluded checks are not allowed."
+ )
+ unknown_checks = excluded_check_set.difference(self._bulk_checks_metadata)
+ if unknown_checks:
+ raise ScanInvalidCheckError(
+ f"Invalid excluded check(s) provided: {sorted(unknown_checks)}."
+ )
- # Exclude services
+ # Validate excluded services against the provider service catalog.
+ # Only resolve the catalog when there is something to check to avoid
+ # walking the provider package tree unnecessarily.
+ excluded_service_set: set[str] = set()
if excluded_services:
- for check in self._checks_to_execute:
- if get_service_name_from_check_name(check) in excluded_services:
- self._checks_to_execute.remove(check)
- else:
- raise ScanInvalidServiceError(
- f"Invalid service provided: {check}. Service does not exist in the provider."
- )
+ excluded_service_set = set(excluded_services)
+ if len(excluded_service_set) != len(excluded_services):
+ raise ScanInvalidServiceError(
+ "Duplicate excluded services are not allowed."
+ )
+ unknown_services = excluded_service_set.difference(
+ list_services(provider.type)
+ )
+ if unknown_services:
+ raise ScanInvalidServiceError(
+ f"Invalid excluded service(s) provided: {sorted(unknown_services)}."
+ )
+
+ if excluded_check_set or excluded_service_set:
+ previous_scope = self._checks_to_execute
+ selected_checks = {
+ check
+ for check in previous_scope
+ if check not in excluded_check_set
+ and get_service_name_from_check_name(check) not in excluded_service_set
+ }
+ # Only complain when exclusions actually emptied a non-empty
+ # scope. If the scope was already empty (e.g. a severity or
+ # category filter matched nothing) the exclusions did not
+ # cause the emptiness and the misleading error would obscure
+ # the real reason.
+ if previous_scope and not selected_checks:
+ raise ScanInvalidCheckError(
+ "The scan configuration excludes every selected check."
+ )
+ self._checks_to_execute = sorted(selected_checks)
self._number_of_checks_to_execute = len(self._checks_to_execute)
diff --git a/prowler/lib/utils/utils.py b/prowler/lib/utils/utils.py
index c4b29f6cc1..62e01d66ef 100644
--- a/prowler/lib/utils/utils.py
+++ b/prowler/lib/utils/utils.py
@@ -9,52 +9,116 @@ except ImportError:
pass
import re
+import shutil
+import subprocess
import sys
import tempfile
from datetime import datetime
-from hashlib import sha512
+from functools import lru_cache
+from hashlib import sha1, sha512
from io import TextIOWrapper
from ipaddress import ip_address
from os.path import exists
from time import mktime
-from typing import Any, Optional
+from typing import Any, Iterable, Mapping, Optional, Union
from colorama import Style
-from detect_secrets import SecretsCollection
-from detect_secrets.settings import transient_settings
from prowler.config.config import encoding_format_utf_8
from prowler.lib.logger import logger
-default_detect_secrets_plugins = [
- {"name": "ArtifactoryDetector"},
- {"name": "AWSKeyDetector"},
- {"name": "AzureStorageKeyDetector"},
- {"name": "BasicAuthDetector"},
- {"name": "CloudantDetector"},
- {"name": "DiscordBotTokenDetector"},
- {"name": "GitHubTokenDetector"},
- {"name": "GitLabTokenDetector"},
- {"name": "Base64HighEntropyString", "limit": 6.0},
- {"name": "HexHighEntropyString", "limit": 3.0},
- {"name": "IbmCloudIamDetector"},
- {"name": "IbmCosHmacDetector"},
- # {"name": "IPPublicDetector"}, https://github.com/Yelp/detect-secrets/pull/885
- {"name": "JwtTokenDetector"},
- {"name": "KeywordDetector"},
- {"name": "MailchimpDetector"},
- {"name": "NpmDetector"},
- {"name": "OpenAIDetector"},
- {"name": "PrivateKeyDetector"},
- {"name": "PypiTokenDetector"},
- {"name": "SendGridDetector"},
- {"name": "SlackDetector"},
- {"name": "SoftlayerDetector"},
- {"name": "SquareOAuthDetector"},
- {"name": "StripeDetector"},
- # {"name": "TelegramBotTokenDetector"}, https://github.com/Yelp/detect-secrets/pull/878
- {"name": "TwilioKeyDetector"},
-]
+# Default minimum confidence level for reporting findings. "low" is required to
+# enable Kingfisher's built-in generic rules (Generic Password / Secret / API
+# Key), which preserve the keyword-based coverage Prowler had with
+# detect-secrets' KeywordDetector; at "medium" those generic rules do not fire.
+# Possible values: "low", "medium", "high".
+default_secrets_confidence = "low"
+
+# Kingfisher exit codes considered successful: 0 (no findings), 200 (findings),
+# 205 (validated findings).
+_kingfisher_success_exit_codes = (0, 200, 205)
+
+# Number of payloads scanned per Kingfisher invocation in batch mode. Bounds
+# peak temp-disk and memory while still amortizing the per-process spawn cost
+# across many fragments (see detect_secrets_scan_batch).
+default_secrets_batch_chunk_size = 500
+
+# Wall-clock cap (seconds) for a single Kingfisher subprocess, so a hung binary
+# cannot block the audit indefinitely.
+default_secrets_scan_timeout = 300
+
+
+class SecretsScanError(Exception):
+ """The secret scanner could not produce a trustworthy result.
+
+ Raised when Kingfisher exits with a non-success code, times out, cannot be
+ located/executed, or returns output that cannot be parsed. This is distinct
+ from "no secrets found": a security check must never treat a scanner failure
+ as a clean result, so callers are expected to surface it as ``MANUAL``
+ (manual review required) instead of ``PASS``.
+ """
+
+
+@lru_cache(maxsize=1)
+def get_kingfisher_binary() -> str:
+ """Return the path to the bundled Kingfisher binary (cached)."""
+ from kingfisher import get_binary_path
+
+ return get_binary_path()
+
+
+def _build_kingfisher_command(
+ scan_paths: list,
+ output_path: str,
+ confidence: str,
+ validate: bool,
+ no_dedup: bool = False,
+) -> list:
+ """Build the Kingfisher ``scan`` command shared by single and batch scans."""
+ command = [
+ get_kingfisher_binary(),
+ "scan",
+ *scan_paths,
+ "--format",
+ "json",
+ "--output",
+ output_path,
+ "--no-update-check",
+ "--confidence",
+ confidence,
+ ]
+ if validate:
+ # Live-validate discovered secrets against provider APIs. Use
+ # conservative defaults (short timeout, no retries) to limit the blast
+ # radius of the outbound calls.
+ command += ["--validation-timeout", "5", "--validation-retries", "0"]
+ else:
+ command.append("--no-validate")
+ if no_dedup:
+ # Report every occurrence (one per file) so batched results match
+ # scanning each payload individually.
+ command.append("--no-dedup")
+ return command
+
+
+def _finding_to_dict(entry: dict, fallback_filename: str) -> dict:
+ """Convert a Kingfisher finding entry into Prowler's finding dict shape."""
+ rule = entry.get("rule", {})
+ finding = entry.get("finding", {})
+ snippet = finding.get("snippet", "") or ""
+ return {
+ "filename": finding.get("path", fallback_filename),
+ "line_number": finding.get("line"),
+ "type": rule.get("name"),
+ # Non-security identifier for the matched secret (matches the
+ # detect-secrets output shape); not used for security.
+ "hashed_secret": (
+ sha1(snippet.encode(), usedforsecurity=False).hexdigest()
+ if snippet
+ else None
+ ),
+ "is_verified": finding.get("validation", {}).get("status") == "Active",
+ }
def open_file(input_file: str, mode: str = "r") -> TextIOWrapper:
@@ -111,77 +175,188 @@ def hash_sha512(string: str) -> str:
return sha512(string.encode(encoding_format_utf_8)).hexdigest()[0:9]
-def detect_secrets_scan(
- data: str = None,
- file=None,
- excluded_secrets: list[str] = None,
- detect_secrets_plugins: dict = None,
-) -> list[dict[str, str]]:
- """detect_secrets_scan scans the data or file for secrets using the detect-secrets library.
- Args:
- data (str): The data to scan for secrets.
- file (str): The file to scan for secrets.
- excluded_secrets (list): A list of regex patterns to exclude from the scan.
- detect_secrets_plugins (dict): The settings to use for the scan.
- Returns:
- dict: The secrets found in the
- Raises:
- Exception: If an error occurs during the scan.
- Examples:
- >>> detect_secrets_scan(data="password=password")
- [{'filename': 'data', 'hashed_secret': 'f7c3bc1d808e04732adf679965ccc34ca7ae3441', 'is_verified': False, 'line_number': 1, 'type': 'Secret Keyword'}]
- >>> detect_secrets_scan(file="file.txt")
- {'file.txt': [{'filename': 'file.txt', 'hashed_secret': 'f7c3bc1d808e04732adf679965ccc34ca7ae3441', 'is_verified': False, 'line_number': 1, 'type': 'Secret Keyword'}]}
+def _scan_batch_chunk(
+ chunk: list,
+ excluded_secrets: list,
+ confidence: str,
+ validate: bool,
+ results: dict,
+) -> None:
+ """Scan one chunk of ``(key, data)`` payloads in a single Kingfisher call.
+
+ Writes each payload to its own file in a temp directory, scans the whole
+ directory once (``--no-dedup`` so per-file results match individual scans),
+ maps findings back to their key by file path, and appends them to
+ ``results``. The temp directory is always removed.
"""
+ if not chunk:
+ return
+ tmp_dir = tempfile.mkdtemp()
+ temp_output_file = None
try:
- if not file:
- temp_data_file = tempfile.NamedTemporaryFile(delete=False)
- temp_data_file.write(bytes(data, encoding="raw_unicode_escape"))
- temp_data_file.close()
+ index_to_key = {}
+ for index, (key, data) in enumerate(chunk):
+ content = data if data.endswith("\n") else data + "\n"
+ name = str(index)
+ with open(os.path.join(tmp_dir, name), "wb") as fh:
+ fh.write(bytes(content, encoding="raw_unicode_escape"))
+ index_to_key[name] = key
- secrets = SecretsCollection()
-
- if not detect_secrets_plugins:
- detect_secrets_plugins = default_detect_secrets_plugins
-
- settings = {
- "plugins_used": detect_secrets_plugins,
- "filters_used": [
- {"path": "detect_secrets.filters.common.is_invalid_file"},
- {"path": "detect_secrets.filters.common.is_known_false_positive"},
- {"path": "detect_secrets.filters.heuristic.is_likely_id_string"},
- {"path": "detect_secrets.filters.heuristic.is_potential_secret"},
- ],
- }
-
- if excluded_secrets and len(excluded_secrets) > 0:
- settings["filters_used"].append(
- {
- "path": "detect_secrets.filters.regex.should_exclude_line",
- "pattern": excluded_secrets,
- }
+ temp_output_file = tempfile.NamedTemporaryFile(delete=False, suffix=".json")
+ temp_output_file.close()
+ command = _build_kingfisher_command(
+ [tmp_dir], temp_output_file.name, confidence, validate, no_dedup=True
+ )
+ process = subprocess.run(
+ command,
+ capture_output=True,
+ text=True,
+ timeout=default_secrets_scan_timeout,
+ )
+ if process.returncode not in _kingfisher_success_exit_codes:
+ raise SecretsScanError(
+ f"Kingfisher exited with code {process.returncode}: "
+ f"{process.stderr.strip()[:500]}"
)
- with transient_settings(settings):
- if file:
- secrets.scan_file(file)
- else:
- secrets.scan_file(temp_data_file.name)
- if not file:
- os.remove(temp_data_file.name)
+ with open(temp_output_file.name, encoding=encoding_format_utf_8) as f:
+ output = f.read()
+ kingfisher_output = json.loads(output) if output.strip() else {}
- detect_secrets_output = secrets.json()
+ source_lines_cache = {}
- if detect_secrets_output:
- if file:
- return detect_secrets_output[file]
- else:
- return detect_secrets_output[temp_data_file.name]
- else:
- return None
- except Exception as e:
- logger.error(f"Error scanning for secrets: {e}")
- return None
+ def source_lines(file_name: str) -> list:
+ if file_name not in source_lines_cache:
+ with open(
+ os.path.join(tmp_dir, file_name),
+ encoding=encoding_format_utf_8,
+ errors="replace",
+ ) as f:
+ source_lines_cache[file_name] = f.read().splitlines()
+ return source_lines_cache[file_name]
+
+ for entry in kingfisher_output.get("findings", []):
+ finding = entry.get("finding", {})
+ name = os.path.basename(finding.get("path", ""))
+ key = index_to_key.get(name)
+ if key is None:
+ continue
+ # Validate the line index before any consumer trusts it. Checks use
+ # ``line_number`` as a 1-based index into their own parallel data
+ # (e.g. CloudWatch does ``events[line_number - 1]``), so a missing,
+ # non-integer, or out-of-range line would crash the check or map the
+ # secret to the wrong resource. Fail closed: surface a malformed
+ # finding as a scan failure so callers report MANUAL instead of a
+ # wrong PASS/FAIL. ``bool`` is rejected explicitly because it is a
+ # subclass of ``int``.
+ line_number = finding.get("line")
+ lines = source_lines(name)
+ if (
+ isinstance(line_number, bool)
+ or not isinstance(line_number, int)
+ or not 1 <= line_number <= len(lines)
+ ):
+ raise SecretsScanError(
+ f"Kingfisher returned an invalid line number "
+ f"{line_number!r} for a finding in {name}"
+ )
+ if excluded_secrets and any(
+ re.search(pattern, lines[line_number - 1])
+ for pattern in excluded_secrets
+ ):
+ continue
+ results.setdefault(key, []).append(_finding_to_dict(entry, name))
+ except SecretsScanError:
+ # Already a typed scan failure; propagate so callers report MANUAL.
+ raise
+ except subprocess.TimeoutExpired as error:
+ raise SecretsScanError(
+ f"Kingfisher timed out after {default_secrets_scan_timeout}s "
+ "while scanning for secrets"
+ ) from error
+ except Exception as error:
+ # Fail closed: a missing/unexecutable binary, unparseable JSON output or
+ # any other runtime failure must NOT be silently treated as "no secrets
+ # found". Surface it so callers can report MANUAL instead of PASS.
+ raise SecretsScanError(f"Secret scan failed: {error}") from error
+ finally:
+ if temp_output_file and os.path.exists(temp_output_file.name):
+ os.remove(temp_output_file.name)
+ shutil.rmtree(tmp_dir, ignore_errors=True)
+
+
+def detect_secrets_scan_batch(
+ payloads: Union[Mapping[Any, str], Iterable[tuple[Any, str]]],
+ excluded_secrets: Optional[list[str]] = None,
+ confidence: str = default_secrets_confidence,
+ validate: bool = False,
+ chunk_size: int = default_secrets_batch_chunk_size,
+) -> dict:
+ """Scan many payloads with Kingfisher in chunked subprocess invocations.
+
+ This is the scan entry point used by every secret check. Each payload is
+ written to its own file and scanned with ``--no-dedup`` so per-payload
+ results match scanning each payload on its own. Payloads are processed in
+ chunks (writing each to disk and releasing it as it is consumed) to bound
+ peak temp-disk and memory use while amortizing the per-process spawn cost
+ across many fragments.
+
+ By default the scan runs fully offline (``--no-validate``,
+ ``--no-update-check``): no network calls are made, so the scanned data is
+ never sent anywhere. When ``validate`` is True, Kingfisher additionally
+ checks whether each discovered secret is live by authenticating with it
+ against the provider's API (the secret itself is the credential; no extra
+ permissions are required). That makes outbound network calls, so it must be
+ explicitly opted in.
+
+ Args:
+ payloads: a mapping ``{key: data}`` or any iterable of ``(key, data)``
+ pairs. ``key`` is any hashable the caller uses to map findings back
+ to its source (e.g. a variable name or a ``(resource, stream)``).
+ excluded_secrets (list): regex patterns; a finding whose source line
+ matches one is excluded.
+ confidence (str): minimum Kingfisher confidence ("low"/"medium"/"high").
+ validate (bool): live-validate discovered secrets (outbound calls).
+ chunk_size (int): payloads scanned per Kingfisher invocation.
+ Returns:
+ dict mapping each key that produced findings to its list of finding
+ dicts, each with ``filename``, ``line_number``, ``type``,
+ ``hashed_secret`` and ``is_verified`` keys. Keys with no findings are
+ omitted.
+ Raises:
+ SecretsScanError: if the scanner fails for any chunk (non-success exit
+ code, timeout, missing/unexecutable binary or unparseable output).
+ An empty result is therefore always "no secrets found", never a
+ silent scan failure; callers must report MANUAL on this error.
+ """
+ items = payloads.items() if hasattr(payloads, "items") else payloads
+ results = {}
+ chunk = []
+ for key, data in items:
+ chunk.append((key, data))
+ if len(chunk) >= chunk_size:
+ _scan_batch_chunk(chunk, excluded_secrets, confidence, validate, results)
+ chunk = []
+ _scan_batch_chunk(chunk, excluded_secrets, confidence, validate, results)
+ return results
+
+
+def annotate_verified_secrets(report, secrets: list) -> None:
+ """Escalate and annotate a finding when any of its secrets is confirmed live.
+
+ When secret validation (``--scan-secrets-validate`` / ``secrets_validate``)
+ confirms that a discovered secret is live, the finding is more severe than a
+ potential secret: its severity is raised to critical and a note is appended
+ to ``status_extended``. No-op when no secret was validated as live, so the
+ default offline behavior (and existing finding messages) is unchanged.
+ """
+ if secrets and any(secret.get("is_verified") for secret in secrets):
+ from prowler.lib.check.models import Severity
+
+ report.check_metadata.Severity = Severity.critical
+ report.status_extended += (
+ " One or more of these secrets were confirmed to be live."
+ )
def validate_ip_address(ip_string):
diff --git a/prowler/providers/alibabacloud/alibabacloud_provider.py b/prowler/providers/alibabacloud/alibabacloud_provider.py
index 82e48e2f14..d7020186a0 100644
--- a/prowler/providers/alibabacloud/alibabacloud_provider.py
+++ b/prowler/providers/alibabacloud/alibabacloud_provider.py
@@ -53,6 +53,7 @@ class AlibabacloudProvider(Provider):
"""
_type: str = "alibabacloud"
+ sdk_only: bool = False
_identity: AlibabaCloudIdentityInfo
_session: AlibabaCloudSession
_audit_resources: list = []
diff --git a/prowler/providers/aws/aws_provider.py b/prowler/providers/aws/aws_provider.py
index cf6cbdd73a..b4c9ed3771 100644
--- a/prowler/providers/aws/aws_provider.py
+++ b/prowler/providers/aws/aws_provider.py
@@ -90,6 +90,7 @@ class AwsProvider(Provider):
"""
_type: str = "aws"
+ sdk_only: bool = False
_identity: AWSIdentityInfo
_session: AWSSession
_organizations_metadata: AWSOrganizationsInfo
diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json
index 0874d14a07..6ee2b8d627 100644
--- a/prowler/providers/aws/aws_regions_by_service.json
+++ b/prowler/providers/aws/aws_regions_by_service.json
@@ -899,6 +899,7 @@
"ap-southeast-3",
"ap-southeast-4",
"ap-southeast-5",
+ "ap-southeast-6",
"ap-southeast-7",
"ca-central-1",
"ca-west-1",
@@ -1238,9 +1239,12 @@
"regions": {
"aws": [
"ap-northeast-1",
+ "ap-southeast-1",
"ap-southeast-2",
"eu-central-1",
"eu-west-1",
+ "eu-west-2",
+ "sa-east-1",
"us-east-1",
"us-west-2"
],
@@ -1310,6 +1314,7 @@
"ca-central-1",
"eu-central-1",
"eu-west-2",
+ "sa-east-1",
"us-east-1"
],
"aws-cn": [],
@@ -1584,9 +1589,13 @@
"ap-south-1",
"ap-southeast-1",
"ap-southeast-2",
+ "ap-southeast-5",
+ "ap-southeast-7",
"ca-central-1",
"eu-central-1",
"eu-north-1",
+ "eu-south-1",
+ "eu-south-2",
"eu-west-1",
"eu-west-2",
"eu-west-3",
@@ -2681,6 +2690,7 @@
"ap-southeast-3",
"ap-southeast-4",
"ap-southeast-5",
+ "ap-southeast-6",
"ca-central-1",
"eu-central-1",
"eu-central-2",
@@ -3185,6 +3195,7 @@
"connecthealth": {
"regions": {
"aws": [
+ "eu-west-2",
"us-east-1",
"us-west-2"
],
@@ -3845,7 +3856,9 @@
"ap-southeast-2",
"ap-southeast-3",
"ap-southeast-4",
+ "ap-southeast-6",
"ca-central-1",
+ "ca-west-1",
"eu-central-1",
"eu-central-2",
"eu-north-1",
@@ -4619,7 +4632,12 @@
},
"elementalinference": {
"regions": {
- "aws": [],
+ "aws": [
+ "ap-south-1",
+ "eu-west-1",
+ "us-east-1",
+ "us-west-2"
+ ],
"aws-cn": [],
"aws-eusc": [],
"aws-us-gov": []
@@ -6899,6 +6917,7 @@
"eu-west-1",
"eu-west-2",
"eu-west-3",
+ "il-central-1",
"me-south-1",
"sa-east-1",
"us-east-1",
@@ -9218,11 +9237,13 @@
"pcs": {
"regions": {
"aws": [
+ "af-south-1",
"ap-northeast-1",
"ap-northeast-3",
"ap-south-1",
"ap-southeast-1",
"ap-southeast-2",
+ "ap-southeast-3",
"eu-central-1",
"eu-north-1",
"eu-south-1",
@@ -9258,9 +9279,7 @@
"us-east-2",
"us-west-2"
],
- "aws-cn": [
- "cn-north-1"
- ],
+ "aws-cn": [],
"aws-eusc": [],
"aws-us-gov": []
}
@@ -10279,6 +10298,7 @@
"ap-southeast-2",
"ap-southeast-3",
"ap-southeast-4",
+ "ap-southeast-6",
"ca-central-1",
"eu-central-1",
"eu-central-2",
@@ -10795,7 +10815,10 @@
"cn-northwest-1"
],
"aws-eusc": [],
- "aws-us-gov": []
+ "aws-us-gov": [
+ "us-gov-east-1",
+ "us-gov-west-1"
+ ]
}
},
"sagemaker": {
@@ -13434,6 +13457,7 @@
"wisdom": {
"regions": {
"aws": [
+ "af-south-1",
"ap-northeast-1",
"ap-northeast-2",
"ap-southeast-1",
@@ -13605,4 +13629,4 @@
}
}
}
-}
\ No newline at end of file
+}
diff --git a/tests/dashboard/__init__.py b/prowler/providers/aws/services/amplify/__init__.py
similarity index 100%
rename from tests/dashboard/__init__.py
rename to prowler/providers/aws/services/amplify/__init__.py
diff --git a/tests/dashboard/compliance/__init__.py b/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/__init__.py
similarity index 100%
rename from tests/dashboard/compliance/__init__.py
rename to prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/__init__.py
diff --git a/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.metadata.json b/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.metadata.json
new file mode 100644
index 0000000000..1a5c209fcb
--- /dev/null
+++ b/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.metadata.json
@@ -0,0 +1,42 @@
+{
+ "Provider": "aws",
+ "CheckID": "amplify_app_no_secrets_in_environment",
+ "CheckTitle": "Amplify app has no sensitive credentials in environment variables or build settings",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "TTPs/Credential Access",
+ "Effects/Data Exposure",
+ "Sensitive Data Identifications/Security"
+ ],
+ "ServiceName": "amplify",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:amplify:region:account-id:apps/app-id",
+ "Severity": "high",
+ "ResourceType": "AwsAmplifyApp",
+ "ResourceGroup": "security",
+ "Description": "AWS Amplify apps and their branches are inspected for hardcoded secrets, such as API keys, tokens, or passwords embedded in environment variables or build settings (buildSpec).",
+ "Risk": "Plaintext secrets in Amplify app environment variables or build configurations can be viewed by anyone with read access to the Amplify console, or may leak during the build process, exposing downstream resources and integrations.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html",
+ "https://docs.prowler.com/developer-guide/secret-scanning-checks"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws amplify update-app --app-id <app-id> --environment-variables <key1=value1,key2=value2>",
+ "NativeIaC": "",
+ "Other": "1. Access the AWS Amplify console.\n2. Navigate to your app settings, choose Environment variables, and check if any secrets are stored in plaintext.\n3. For actual secrets, migrate them to environment secrets or AWS Secrets Manager / Parameter Store and reference them securely during the build phase.\n4. Clean the variables or buildSpec configuration.",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Avoid storing secrets in plaintext environment variables or build specifications for AWS Amplify apps. Store sensitive settings securely in AWS Systems Manager Parameter Store or AWS Secrets Manager.",
+ "Url": "https://hub.prowler.com/check/amplify_app_no_secrets_in_environment"
+ }
+ },
+ "Categories": [
+ "secrets"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.py b/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.py
new file mode 100644
index 0000000000..33175c724f
--- /dev/null
+++ b/prowler/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment.py
@@ -0,0 +1,105 @@
+import json
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
+from prowler.providers.aws.services.amplify.amplify_client import amplify_client
+
+
+class amplify_app_no_secrets_in_environment(Check):
+ """Check that AWS Amplify apps contain no hardcoded secrets in their environment variables or build settings."""
+
+ def execute(self) -> list[Check_Report_AWS]:
+ findings = []
+ secrets_ignore_patterns = amplify_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ validate = amplify_client.audit_config.get("secrets_validate", False)
+ apps = list(amplify_client.apps.values())
+ line_context_by_app = {}
+
+ payloads_list = []
+ for app_index, app in enumerate(apps):
+ payload, line_context = _build_app_payload(app)
+ line_context_by_app[app_index] = line_context
+ if payload:
+ payloads_list.append((app_index, payload))
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads_list,
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for app_index, app in enumerate(apps):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=app)
+ report.resource_tags = app.tags
+ report.status = "PASS"
+ report.status_extended = f"No secrets found in Amplify app {app.name} environment variables or build settings."
+
+ line_context = line_context_by_app.get(app_index, {})
+ if line_context:
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Amplify app {app.name} environment variables "
+ f"for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+
+ detect_secrets_output = batch_results.get(app_index)
+ if detect_secrets_output:
+ secrets_string = ", ".join(
+ [
+ f"{secret['type']} in {line_context.get(secret['line_number'], 'environment variables/build settings')}"
+ for secret in detect_secrets_output
+ ]
+ )
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Potential {'secrets' if len(detect_secrets_output) > 1 else 'secret'} "
+ f"found in Amplify app {app.name} environment variables or build settings -> {secrets_string}."
+ )
+ annotate_verified_secrets(report, detect_secrets_output)
+
+ findings.append(report)
+ return findings
+
+
+def _build_app_payload(app) -> tuple[str, dict[int, str]]:
+ """Build a line-oriented scan payload and map each line to a field context."""
+ lines = []
+ line_context = {}
+
+ def add_line(context: str, value: str) -> None:
+ if value is None:
+ return
+ lines.append(json.dumps({context: value}))
+ line_context[len(lines)] = context
+
+ # App environment variables
+ for var_name, var_value in app.environment_variables.items():
+ add_line(f"app environment variable '{var_name}'", var_value)
+
+ # App buildSpec
+ if app.build_spec:
+ for idx, line in enumerate(app.build_spec.splitlines(), start=1):
+ add_line(f"app buildSpec line {idx}", line)
+
+ # Branch environment variables
+ for branch in app.branches:
+ for var_name, var_value in branch.environment_variables.items():
+ add_line(
+ f"branch '{branch.name}' environment variable '{var_name}'", var_value
+ )
+
+ return "\n".join(lines), line_context
diff --git a/prowler/providers/aws/services/amplify/amplify_client.py b/prowler/providers/aws/services/amplify/amplify_client.py
new file mode 100644
index 0000000000..9d69c68424
--- /dev/null
+++ b/prowler/providers/aws/services/amplify/amplify_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.aws.services.amplify.amplify_service import Amplify
+from prowler.providers.common.provider import Provider
+
+amplify_client = Amplify(Provider.get_global_provider())
diff --git a/prowler/providers/aws/services/amplify/amplify_service.py b/prowler/providers/aws/services/amplify/amplify_service.py
new file mode 100644
index 0000000000..1a80f9ebd3
--- /dev/null
+++ b/prowler/providers/aws/services/amplify/amplify_service.py
@@ -0,0 +1,97 @@
+from botocore.exceptions import ClientError
+from pydantic.v1 import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.aws.lib.service.service import AWSService
+
+
+class Branch(BaseModel):
+ """Represents an AWS Amplify App Branch."""
+
+ name: str
+ arn: str
+ environment_variables: dict = Field(default_factory=dict)
+
+
+class App(BaseModel):
+ """Represents an AWS Amplify App."""
+
+ id: str
+ name: str
+ arn: str
+ region: str
+ environment_variables: dict = Field(default_factory=dict)
+ build_spec: str = ""
+ branches: list[Branch] = Field(default_factory=list)
+ tags: list[dict] = Field(default_factory=list)
+
+
+class Amplify(AWSService):
+ """AWS Amplify service class."""
+
+ def __init__(self, provider):
+ super().__init__(__class__.__name__, provider)
+ self.apps = {}
+ self.__threading_call__(self._list_apps)
+ if self.apps:
+ self.__threading_call__(self._list_branches, self.apps.values())
+
+ def _list_apps(self, regional_client) -> None:
+ logger.info("Amplify - Listing apps...")
+ try:
+ list_apps_paginator = regional_client.get_paginator("list_apps")
+ for page in list_apps_paginator.paginate():
+ for app in page.get("apps", []):
+ app_id = app.get("appId")
+ app_name = app.get("name")
+ app_arn = app.get("appArn")
+ if not self.audit_resources or is_resource_filtered(
+ app_arn, self.audit_resources
+ ):
+ tags = app.get("tags", {})
+ tags_list = [tags] if tags else []
+ self.apps[app_arn] = App(
+ id=app_id,
+ name=app_name,
+ arn=app_arn,
+ region=regional_client.region,
+ environment_variables=app.get("environmentVariables", {}),
+ build_spec=app.get("buildSpec", ""),
+ tags=tags_list,
+ )
+ except ClientError as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _list_branches(self, app: App) -> None:
+ logger.info(f"Amplify - Listing branches for app {app.name}...")
+ try:
+ regional_client = self.regional_clients[app.region]
+ list_branches_paginator = regional_client.get_paginator("list_branches")
+ for page in list_branches_paginator.paginate(appId=app.id):
+ for branch in page.get("branches", []):
+ branch_name = branch.get("branchName")
+ branch_arn = branch.get("branchArn")
+ app.branches.append(
+ Branch(
+ name=branch_name,
+ arn=branch_arn,
+ environment_variables=branch.get(
+ "environmentVariables", {}
+ ),
+ )
+ )
+ except ClientError as error:
+ logger.error(
+ f"{app.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{app.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
diff --git a/tests/dashboard/pages/__init__.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/__init__.py
similarity index 100%
rename from tests/dashboard/pages/__init__.py
rename to prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/__init__.py
diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.metadata.json b/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.metadata.json
new file mode 100644
index 0000000000..d0866175b9
--- /dev/null
+++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.metadata.json
@@ -0,0 +1,39 @@
+{
+ "Provider": "aws",
+ "CheckID": "apigateway_restapi_no_secrets_in_stage_variables",
+ "CheckTitle": "API Gateway REST API stage variables should not contain secrets",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+ ],
+ "ServiceName": "apigateway",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:aws:apigateway:region::/restapis/api-id/stages/stage-name",
+ "Severity": "high",
+ "ResourceType": "AwsApiGatewayStage",
+ "ResourceGroup": "security",
+ "Description": "Checks API Gateway REST API stage variables for hardcoded secrets such as passwords, API keys, and tokens. Stage variables should reference AWS Secrets Manager or Parameter Store rather than containing plaintext credentials.",
+ "Risk": "Hardcoded secrets in stage variables are stored in plaintext in the AWS control plane and are visible to anyone with read access to the API Gateway configuration. This can lead to unauthorized access, credential theft, and lateral movement across systems.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_how-services-use-secrets_api-gateway.html"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws apigateway update-stage --rest-api-id <api-id> --stage-name <stage-name> --patch-operations op=remove,path=/variables/<variable-name>",
+ "NativeIaC": "",
+ "Other": "1. Open AWS Console > API Gateway\n2. Select the REST API and stage\n3. Go to Stage Variables tab\n4. Remove any variables containing plaintext secrets\n5. Reference secrets using AWS Secrets Manager integration instead",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Remove hardcoded secrets from API Gateway stage variables. Use AWS Secrets Manager or Parameter Store to manage credentials and retrieve them at runtime using Lambda authorizers or integration request mapping templates.",
+ "Url": "https://hub.prowler.com/check/apigateway_restapi_no_secrets_in_stage_variables"
+ }
+ },
+ "Categories": [
+ "secrets"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "Infrastructure Protection"
+}
diff --git a/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.py b/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.py
new file mode 100644
index 0000000000..490057a5ed
--- /dev/null
+++ b/prowler/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables.py
@@ -0,0 +1,89 @@
+import json
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
+from prowler.providers.aws.services.apigateway.apigateway_client import (
+ apigateway_client,
+)
+
+
+class apigateway_restapi_no_secrets_in_stage_variables(Check):
+ """Check that API Gateway REST API stage variables contain no hardcoded secrets."""
+
+ def execute(self) -> list[Check_Report_AWS]:
+ findings = []
+ secrets_ignore_patterns = apigateway_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ validate = apigateway_client.audit_config.get("secrets_validate", False)
+
+ # Collect one payload per stage (its variables) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per stage.
+ # Findings are keyed by (rest_api index, stage index).
+ def payloads():
+ for api_index, rest_api in enumerate(apigateway_client.rest_apis):
+ for stage_index, stage in enumerate(rest_api.stages):
+ if stage.variables:
+ yield (api_index, stage_index), json.dumps(
+ stage.variables, indent=2
+ )
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(),
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for api_index, rest_api in enumerate(apigateway_client.rest_apis):
+ for stage_index, stage in enumerate(rest_api.stages):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=rest_api)
+ report.resource_arn = stage.arn
+ report.resource_id = f"{rest_api.name}/{stage.name}"
+ report.status = "PASS"
+ report.status_extended = (
+ f"No secrets found in stage variables of API Gateway "
+ f"REST API {rest_api.name} stage {stage.name}."
+ )
+
+ if stage.variables:
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan stage variables of API Gateway REST API "
+ f"{rest_api.name} stage {stage.name} for secrets: "
+ f"{scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+
+ detect_secrets_output = batch_results.get((api_index, stage_index))
+ if detect_secrets_output:
+ variable_names = list(stage.variables.keys())
+ secrets_string = ", ".join(
+ [
+ f"{secret['type']} in variable "
+ f"{variable_names[secret['line_number'] - 2]}"
+ for secret in detect_secrets_output
+ ]
+ )
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Potential "
+ f"{'secrets' if len(detect_secrets_output) > 1 else 'secret'} "
+ f"found in stage variables of API Gateway REST API "
+ f"{rest_api.name} stage {stage.name} -> {secrets_string}."
+ )
+ annotate_verified_secrets(report, detect_secrets_output)
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/apigateway/apigateway_service.py b/prowler/providers/aws/services/apigateway/apigateway_service.py
index 099551f440..94f7d86b8d 100644
--- a/prowler/providers/aws/services/apigateway/apigateway_service.py
+++ b/prowler/providers/aws/services/apigateway/apigateway_service.py
@@ -179,6 +179,7 @@ class APIGateway(AWSService):
tracing_enabled=tracing_enabled,
cache_enabled=cache_enabled,
cache_data_encrypted=cache_data_encrypted,
+ variables=stage.get("variables", {}),
)
)
except ClientError as error:
@@ -265,6 +266,7 @@ class Stage(BaseModel):
tracing_enabled: Optional[bool] = None
cache_enabled: Optional[bool] = None
cache_data_encrypted: Optional[bool] = None
+ variables: Optional[dict] = {}
class PathResourceMethods(BaseModel):
diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py b/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py
index 6595b71085..dbe6fc534c 100644
--- a/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py
+++ b/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration.py
@@ -4,7 +4,11 @@ from base64 import b64decode
from prowler.config.config import encoding_format_utf_8
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.lib.logger import logger
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.autoscaling.autoscaling_client import (
autoscaling_client,
)
@@ -16,13 +20,19 @@ class autoscaling_find_secrets_ec2_launch_configuration(Check):
secrets_ignore_patterns = autoscaling_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for (
- configuration_arn,
- configuration,
- ) in autoscaling_client.launch_configurations.items():
- report = Check_Report_AWS(metadata=self.metadata(), resource=configuration)
+ validate = autoscaling_client.audit_config.get("secrets_validate", False)
+ configurations = list(autoscaling_client.launch_configurations.values())
- if configuration.user_data:
+ # Collect the decoded User Data of each launch configuration and scan it
+ # all in batched Kingfisher invocations instead of one subprocess each.
+ # Configurations whose User Data cannot be decoded are undecodable (no report),
+ # matching the original per-resource behavior.
+ undecodable = set()
+
+ def payloads():
+ for index, configuration in enumerate(configurations):
+ if not configuration.user_data:
+ continue
user_data = b64decode(configuration.user_data)
try:
if user_data[0:2] == b"\x1f\x8b": # GZIP magic number
@@ -35,24 +45,46 @@ class autoscaling_find_secrets_ec2_launch_configuration(Check):
logger.warning(
f"{configuration.region} -- Unable to decode user data in autoscaling launch configuration {configuration.name}: {error}"
)
+ undecodable.add(index)
continue
except Exception as error:
logger.error(
f"{configuration.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ undecodable.add(index)
continue
+ yield index, user_data
- has_secrets = detect_secrets_scan(
- data=user_data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=autoscaling_client.audit_config.get(
- "detect_secrets_plugins"
- ),
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, configuration in enumerate(configurations):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=configuration)
+
+ if scan_error and configuration.user_data:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan autoscaling {configuration.name} User Data for "
+ f"secrets: {scan_error}; manual review is required."
)
+ findings.append(report)
+ continue
+ if index in undecodable:
+ report.status = "MANUAL"
+ report.status_extended = f"Could not decode User Data for autoscaling {configuration.name}; manual review is required to scan for secrets."
+ elif configuration.user_data:
+ has_secrets = batch_results.get(index)
if has_secrets:
report.status = "FAIL"
report.status_extended = f"Potential secret found in autoscaling {configuration.name} User Data."
+ annotate_verified_secrets(report, has_secrets)
else:
report.status = "PASS"
report.status_extended = f"No secrets found in autoscaling {configuration.name} User Data."
diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py
index 51c56a2011..d4f3010903 100644
--- a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py
+++ b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py
@@ -1,65 +1,120 @@
+import fnmatch
import os
import tempfile
+from collections import defaultdict
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
class awslambda_function_no_secrets_in_code(Check):
def execute(self):
findings = []
- if awslambda_client.functions:
- secrets_ignore_patterns = awslambda_client.audit_config.get(
- "secrets_ignore_patterns", []
- )
+ if not awslambda_client.functions:
+ return findings
+
+ secrets_ignore_patterns = awslambda_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ # Glob patterns of file names inside the deployment package to skip
+ # when scanning for secrets (e.g. "*.deps.json" for .NET Lambdas).
+ secrets_ignore_files = (
+ awslambda_client.audit_config.get("secrets_ignore_files", []) or []
+ )
+ validate = awslambda_client.audit_config.get("secrets_validate", False)
+
+ # Scan files of every function's package in batched
+ # Kingfisher invocations instead of one subprocess per file per function.
+ # Each package is extracted one at a time and its files are
+ # read (byte-faithfully via latin-1) before the extraction is released,
+ # so only a single package is on disk at a time. Findings are keyed by
+ # (function index, package-relative file name) so they can be grouped
+ # back per function.
+ functions_with_code = []
+
+ def code_payloads():
for function, function_code in awslambda_client._get_function_code():
- if function_code:
- report = Check_Report_AWS(
- metadata=self.metadata(), resource=function
- )
-
- report.status = "PASS"
- report.status_extended = (
- f"No secrets found in Lambda function {function.name} code."
- )
- with tempfile.TemporaryDirectory() as tmp_dir_name:
- function_code.code_zip.extractall(tmp_dir_name)
- # List all files
- files_in_zip = next(os.walk(tmp_dir_name))[2]
- secrets_findings = []
- for file in files_in_zip:
- detect_secrets_output = detect_secrets_scan(
- file=f"{tmp_dir_name}/{file}",
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=awslambda_client.audit_config.get(
- "detect_secrets_plugins",
- ),
+ if not function_code:
+ continue
+ index = len(functions_with_code)
+ functions_with_code.append(function)
+ with tempfile.TemporaryDirectory() as tmp_dir_name:
+ function_code.code_zip.extractall(tmp_dir_name)
+ for root, _, files in os.walk(tmp_dir_name):
+ for file_name in files:
+ file_path = os.path.join(root, file_name)
+ relative_file_path = os.path.relpath(
+ file_path, tmp_dir_name
)
- if detect_secrets_output:
- for (
- secret
- ) in (
- detect_secrets_output
- ): # Appears that only 1 file is being scanned at a time, so could rework this
- output_file_name = secret["filename"].replace(
- f"{tmp_dir_name}/", ""
- )
- secrets_string = ", ".join(
- [
- f"{secret['type']} on line {secret['line_number']}"
- for secret in detect_secrets_output
- ]
- )
- secrets_findings.append(
- f"{output_file_name}: {secrets_string}"
- )
+ if any(
+ fnmatch.fnmatch(relative_file_path, pattern)
+ for pattern in secrets_ignore_files
+ ):
+ continue
+ try:
+ with open(file_path, "rb") as code_file:
+ content = code_file.read().decode("latin-1")
+ except Exception:
+ continue
+ yield (index, relative_file_path), content
- if secrets_findings:
- final_output_string = "; ".join(secrets_findings)
- report.status = "FAIL"
- report.status_extended = f"Potential {'secrets' if len(secrets_findings) > 1 else 'secret'} found in Lambda function {function.name} code -> {final_output_string}."
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ code_payloads(),
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
- findings.append(report)
+ if scan_error:
+ # The scan failed before any function's code could be cleared. Report
+ # MANUAL for every function rather than risk a false PASS.
+ for function in awslambda_client.functions.values():
+ report = Check_Report_AWS(metadata=self.metadata(), resource=function)
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Lambda function {function.name} code for "
+ f"secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ return findings
+
+ findings_by_function = defaultdict(dict)
+ for (index, file_name), file_findings in batch_results.items():
+ findings_by_function[index][file_name] = file_findings
+
+ for index, function in enumerate(functions_with_code):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=function)
+ report.status = "PASS"
+ report.status_extended = (
+ f"No secrets found in Lambda function {function.name} code."
+ )
+
+ files_with_secrets = findings_by_function.get(index)
+ if files_with_secrets:
+ all_secrets = []
+ secrets_findings = []
+ for file_name, file_findings in files_with_secrets.items():
+ all_secrets.extend(file_findings)
+ secrets_string = ", ".join(
+ f"{secret['type']} on line {secret['line_number']}"
+ for secret in file_findings
+ )
+ secrets_findings.append(f"{file_name}: {secrets_string}")
+
+ final_output_string = "; ".join(secrets_findings)
+ report.status = "FAIL"
+ report.status_extended = f"Potential {'secrets' if len(secrets_findings) > 1 else 'secret'} found in Lambda function {function.name} code -> {final_output_string}."
+ annotate_verified_secrets(report, all_secrets)
+
+ findings.append(report)
return findings
diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py
index 9448b0239f..065cc7a9b9 100644
--- a/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py
+++ b/prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables.py
@@ -1,7 +1,11 @@
import json
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
@@ -11,7 +15,30 @@ class awslambda_function_no_secrets_in_variables(Check):
secrets_ignore_patterns = awslambda_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for function in awslambda_client.functions.values():
+ validate = awslambda_client.audit_config.get("secrets_validate", False)
+ functions = list(awslambda_client.functions.values())
+
+ # Scan every function's environment variables in batched Kingfisher
+ # invocations instead of one subprocess per function. Payloads are
+ # yielded lazily so only a chunk is held/written at a time, which matters
+ # for accounts with very large numbers of Lambda functions.
+ def environment_payloads():
+ for index, function in enumerate(functions):
+ if function.environment:
+ yield index, json.dumps(function.environment, indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ environment_payloads(),
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, function in enumerate(functions):
report = Check_Report_AWS(metadata=self.metadata(), resource=function)
report.status = "PASS"
@@ -20,17 +47,17 @@ class awslambda_function_no_secrets_in_variables(Check):
)
if function.environment:
- detect_secrets_output = detect_secrets_scan(
- data=json.dumps(function.environment, indent=2),
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=awslambda_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
- original_env_vars = []
- for name, value in function.environment.items():
- original_env_vars.append(name)
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Lambda function {function.name} variables "
+ f"for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
+ original_env_vars = list(function.environment.keys())
secrets_string = ", ".join(
[
f"{secret['type']} in variable {original_env_vars[secret['line_number'] - 2]}"
@@ -39,6 +66,7 @@ class awslambda_function_no_secrets_in_variables(Check):
)
report.status = "FAIL"
report.status_extended = f"Potential secret found in Lambda function {function.name} variables -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
findings.append(report)
diff --git a/prowler/providers/aws/services/awslambda/awslambda_service.py b/prowler/providers/aws/services/awslambda/awslambda_service.py
index 433a5ab588..ac90e9fb11 100644
--- a/prowler/providers/aws/services/awslambda/awslambda_service.py
+++ b/prowler/providers/aws/services/awslambda/awslambda_service.py
@@ -10,6 +10,10 @@ from botocore.client import ClientError
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ limit_resources,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
@@ -18,8 +22,16 @@ class Lambda(AWSService):
def __init__(self, provider):
# Call AWSService's __init__
super().__init__(__class__.__name__, provider)
+ # Functions are listed first, then trimmed to the subset selected for
+ # analysis before expensive per-function detail is hydrated.
self.functions = {}
+ self.security_groups_in_use = set()
+ self.regions_with_functions = set()
+ self.function_limit = get_resource_scan_limit(
+ self.audit_config, "max_lambda_functions"
+ )
self.__threading_call__(self._list_functions)
+ self._select_functions_for_analysis()
self._list_tags_for_resource()
self.__threading_call__(self._get_policy)
self.__threading_call__(self._get_function_url_config)
@@ -30,24 +42,29 @@ class Lambda(AWSService):
try:
list_functions_paginator = regional_client.get_paginator("list_functions")
for page in list_functions_paginator.paginate():
- for function in page["Functions"]:
- if not self.audit_resources or (
- is_resource_filtered(
- function["FunctionArn"], self.audit_resources
- )
+ for function in page.get("Functions", []):
+ if not self.audit_resources or is_resource_filtered(
+ function["FunctionArn"], self.audit_resources
):
lambda_name = function["FunctionName"]
lambda_arn = function["FunctionArn"]
vpc_config = function.get("VpcConfig", {})
+ security_groups = vpc_config.get("SecurityGroupIds", [])
+ self.security_groups_in_use.update(security_groups)
+ self.regions_with_functions.add(regional_client.region)
# We must use the Lambda ARN as the dict key since we could have Lambdas in different regions with the same name
self.functions[lambda_arn] = Function(
name=lambda_name,
arn=lambda_arn,
- security_groups=vpc_config.get("SecurityGroupIds", []),
+ security_groups=security_groups,
vpc_id=vpc_config.get("VpcId"),
subnet_ids=set(vpc_config.get("SubnetIds", [])),
region=regional_client.region,
)
+ if "LastModified" in function:
+ self.functions[lambda_arn].last_modified = function[
+ "LastModified"
+ ]
if "Runtime" in function:
self.functions[lambda_arn].runtime = function["Runtime"]
if "Environment" in function:
@@ -76,26 +93,61 @@ class Lambda(AWSService):
f" {error}"
)
+ def _select_functions_for_analysis(self):
+ self.functions = {
+ function.arn: function
+ for function in limit_resources(
+ sorted(
+ self.functions.values(),
+ key=lambda f: f.last_modified or "",
+ reverse=True,
+ ),
+ self.function_limit,
+ )
+ }
+
def _list_event_source_mappings(self, regional_client):
logger.info("Lambda - Listing Event Source Mappings...")
try:
paginator = regional_client.get_paginator("list_event_source_mappings")
- for page in paginator.paginate():
- for mapping in page.get("EventSourceMappings", []):
- function_arn = mapping.get("FunctionArn", "")
- # Normalise to unqualified ARN (strip :qualifier suffix if present)
- base_arn = ":".join(function_arn.split(":")[:7])
- if base_arn not in self.functions:
- continue
- self.functions[base_arn].event_source_mappings.append(
- EventSourceMapping(
- uuid=mapping["UUID"],
- event_source_arn=mapping.get("EventSourceArn", ""),
- state=mapping.get("State", ""),
- batch_size=mapping.get("BatchSize"),
- starting_position=mapping.get("StartingPosition"),
+ if not self.function_limit:
+ for page in paginator.paginate():
+ self._add_event_source_mappings(page.get("EventSourceMappings", []))
+ return
+
+ for function in self.functions.values():
+ if function.region != regional_client.region:
+ continue
+ try:
+ for page in paginator.paginate(FunctionName=function.name):
+ self._add_event_source_mappings(
+ page.get("EventSourceMappings", [])
)
- )
+ except ClientError as error:
+ if (
+ error.response.get("Error", {}).get("Code")
+ == "InvalidParameterValueException"
+ ):
+ logger.warning(
+ f"{function.region} --"
+ f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+ f" {error}"
+ )
+ else:
+ logger.error(
+ f"{function.region} --"
+ f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+ f" {error}"
+ )
+ raise
+ except ClientError as error:
+ if self.function_limit:
+ raise
+ logger.error(
+ f"{regional_client.region} --"
+ f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+ f" {error}"
+ )
except Exception as error:
logger.error(
f"{regional_client.region} --"
@@ -103,6 +155,23 @@ class Lambda(AWSService):
f" {error}"
)
+ def _add_event_source_mappings(self, event_source_mappings):
+ for mapping in event_source_mappings:
+ function_arn = mapping.get("FunctionArn", "")
+ # Normalise to unqualified ARN (strip :qualifier suffix if present)
+ base_arn = ":".join(function_arn.split(":")[:7])
+ if base_arn not in self.functions:
+ continue
+ self.functions[base_arn].event_source_mappings.append(
+ EventSourceMapping(
+ uuid=mapping["UUID"],
+ event_source_arn=mapping.get("EventSourceArn", ""),
+ state=mapping.get("State", ""),
+ batch_size=mapping.get("BatchSize"),
+ starting_position=mapping.get("StartingPosition"),
+ )
+ )
+
def _get_function_code(self):
logger.info("Lambda - Getting Function Code...")
# Use a thread pool handle the queueing and execution of the _fetch_function_code tasks, up to max_workers tasks concurrently.
@@ -158,7 +227,6 @@ class Lambda(AWSService):
except ClientError as e:
if e.response["Error"]["Code"] == "ResourceNotFoundException":
self.functions[function.arn].policy = {}
-
except Exception as error:
logger.error(
f"{regional_client.region} --"
@@ -187,7 +255,6 @@ class Lambda(AWSService):
except ClientError as e:
if e.response["Error"]["Code"] == "ResourceNotFoundException":
self.functions[function.arn].url_config = None
-
except Exception as error:
logger.error(
f"{regional_client.region} --"
@@ -206,10 +273,9 @@ class Lambda(AWSService):
except ClientError as e:
if e.response["Error"]["Code"] == "ResourceNotFoundException":
function.tags = []
-
except Exception as error:
logger.error(
- f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ f"{function.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
@@ -259,6 +325,7 @@ class Function(BaseModel):
name: str
arn: str
security_groups: list
+ last_modified: Optional[str] = None
runtime: Optional[str] = None
environment: Optional[dict] = None
region: str
diff --git a/prowler/providers/aws/services/backup/backup_service.py b/prowler/providers/aws/services/backup/backup_service.py
index 4320d42c0b..ddacc9e6d2 100644
--- a/prowler/providers/aws/services/backup/backup_service.py
+++ b/prowler/providers/aws/services/backup/backup_service.py
@@ -5,6 +5,10 @@ from botocore.client import ClientError
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ limit_resources,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
@@ -27,8 +31,14 @@ class Backup(AWSService):
self.__threading_call__(self._list_backup_report_plans)
self.protected_resources = []
self.__threading_call__(self._list_backup_selections)
+ # Recovery points are listed first, then only the selected subset is
+ # tagged and exposed for checks.
self.recovery_points = []
- self.__threading_call__(self._list_recovery_points)
+ self.recovery_point_limit = get_resource_scan_limit(
+ self.audit_config, "max_backup_recovery_points"
+ )
+ self.__threading_call__(self._list_recovery_points, self.backup_vaults or [])
+ self._select_recovery_points_for_analysis()
self.__threading_call__(self._list_tags, self.recovery_points)
def _list_backup_vaults(self, regional_client):
@@ -183,40 +193,63 @@ class Backup(AWSService):
f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
- def _list_recovery_points(self, regional_client):
+ def _list_recovery_points(self, backup_vault=None):
logger.info("Backup - Listing Recovery Points...")
+ if backup_vault is None:
+ for vault in self.backup_vaults or []:
+ self._list_recovery_points(vault)
+ return
+
try:
- if self.backup_vaults:
- for backup_vault in self.backup_vaults:
- paginator = regional_client.get_paginator(
- "list_recovery_points_by_backup_vault"
- )
- for page in paginator.paginate(BackupVaultName=backup_vault.name):
- for recovery_point in page.get("RecoveryPoints", []):
- arn = recovery_point.get("RecoveryPointArn")
- if arn:
- self.recovery_points.append(
- RecoveryPoint(
- arn=arn,
- id=arn.split(":")[-1],
- backup_vault_name=backup_vault.name,
- encrypted=recovery_point.get(
- "IsEncrypted", False
- ),
- backup_vault_region=backup_vault.region,
- region=regional_client.region,
- tags=[],
- )
- )
+ regional_client = self.regional_clients[backup_vault.region]
+ paginator = regional_client.get_paginator(
+ "list_recovery_points_by_backup_vault"
+ )
+ for page in paginator.paginate(BackupVaultName=backup_vault.name):
+ for recovery_point in page.get("RecoveryPoints", []):
+ arn = recovery_point.get("RecoveryPointArn")
+ if arn:
+ rp = RecoveryPoint(
+ arn=arn,
+ id=arn.split(":")[-1],
+ backup_vault_name=backup_vault.name,
+ encrypted=recovery_point.get("IsEncrypted", False),
+ creation_date=recovery_point.get("CreationDate"),
+ backup_vault_region=backup_vault.region,
+ region=backup_vault.region,
+ tags=[],
+ )
+ self.recovery_points.append(rp)
except ClientError as error:
logger.error(
- f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ f"{backup_vault.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
except Exception as error:
logger.error(
- f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ f"{backup_vault.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _select_recovery_points_for_analysis(self):
+ self.recovery_points = list(
+ limit_resources(
+ sorted(
+ self.recovery_points,
+ key=lambda rp: (
+ (
+ -rp.creation_date.timestamp()
+ if isinstance(rp.creation_date, datetime)
+ else 0.0
+ ),
+ rp.region or "",
+ rp.backup_vault_name or "",
+ rp.arn or "",
+ rp.id or "",
+ ),
+ ),
+ self.recovery_point_limit,
+ )
+ )
+
class BackupVault(BaseModel):
arn: str
@@ -256,4 +289,5 @@ class RecoveryPoint(BaseModel):
backup_vault_name: str
encrypted: bool
backup_vault_region: str
+ creation_date: Optional[datetime] = None
tags: Optional[list] = None
diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py
index c4adddc344..230cfd2295 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py
+++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py
@@ -30,12 +30,13 @@ class bedrock_model_invocation_logs_encryption_enabled(Check):
s3_encryption = False
if logging.cloudwatch_log_group:
log_group_arn = f"arn:{logs_client.audited_partition}:logs:{region}:{logs_client.audited_account}:log-group:{logging.cloudwatch_log_group}"
+ all_log_groups = getattr(logs_client, "all_log_groups", None) or {}
if (
- log_group_arn in logs_client.log_groups
- and not logs_client.log_groups[log_group_arn].kms_id
+ log_group_arn in all_log_groups
+ and not all_log_groups[log_group_arn].kms_id
) or (
- log_group_arn + ":*" in logs_client.log_groups
- and not logs_client.log_groups[log_group_arn + ":*"].kms_id
+ log_group_arn + ":*" in all_log_groups
+ and not all_log_groups[log_group_arn + ":*"].kms_id
):
cloudwatch_encryption = False
if not s3_encryption and not cloudwatch_encryption:
diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py
index f9b47932bb..b86f851765 100644
--- a/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py
+++ b/prowler/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets.py
@@ -1,5 +1,9 @@
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.cloudformation.cloudformation_client import (
cloudformation_client,
)
@@ -14,26 +18,41 @@ class cloudformation_stack_outputs_find_secrets(Check):
secrets_ignore_patterns = cloudformation_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for stack in cloudformation_client.stacks:
+ validate = cloudformation_client.audit_config.get("secrets_validate", False)
+ stacks = list(cloudformation_client.stacks)
+
+ # Collect one payload per stack (its Outputs) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per stack.
+ def payloads():
+ for index, stack in enumerate(stacks):
+ if stack.outputs:
+ yield index, "".join(f"{output}\n" for output in stack.outputs)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, stack in enumerate(stacks):
report = Check_Report_AWS(metadata=self.metadata(), resource=stack)
report.status = "PASS"
report.status_extended = (
f"No secrets found in CloudFormation Stack {stack.name} Outputs."
)
if stack.outputs:
- data = ""
- # Store the CloudFormation Stack Outputs into a file
- for output in stack.outputs:
- data += f"{output}\n"
-
- detect_secrets_output = detect_secrets_scan(
- data=data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=cloudformation_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
- # If secrets are found, update the report status
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan CloudFormation Stack {stack.name} Outputs "
+ f"for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
secrets_string = ", ".join(
[
@@ -43,7 +62,7 @@ class cloudformation_stack_outputs_find_secrets(Check):
)
report.status = "FAIL"
report.status_extended = f"Potential secret found in CloudFormation Stack {stack.name} Outputs -> {secrets_string}."
-
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status = "PASS"
report.status_extended = (
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs.py
index 5154a5acb7..9cfd17ab0a 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs.py
@@ -1,7 +1,11 @@
from json import dumps, loads
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
convert_to_cloudwatch_timestamp_format,
)
@@ -11,95 +15,197 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
class cloudwatch_log_group_no_secrets_in_logs(Check):
def execute(self):
findings = []
- if logs_client.log_groups:
- secrets_ignore_patterns = logs_client.audit_config.get(
- "secrets_ignore_patterns", []
- )
+ if not logs_client.log_groups:
+ return findings
+
+ secrets_ignore_patterns = logs_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ validate = logs_client.audit_config.get("secrets_validate", False)
+
+ # Phase 1: batch-scan every (log group, log stream). Payloads are yielded
+ # lazily so only a chunk is written/held at a time, which matters for
+ # accounts with very large numbers of log groups/streams. The log group
+ # ARN (not its name) keys every map below, since group and stream names
+ # are not unique across regions and would otherwise collide.
+ def stream_payloads():
for log_group in logs_client.log_groups.values():
- report = Check_Report_AWS(metadata=self.metadata(), resource=log_group)
- report.status = "PASS"
- report.status_extended = (
- f"No secrets found in {log_group.name} log group."
+ if not log_group.log_streams:
+ continue
+ for log_stream_name, events in log_group.log_streams.items():
+ yield (
+ (log_group.arn, log_stream_name),
+ "\n".join(dumps(event["message"]) for event in events),
+ )
+
+ # A scanner failure here must never look like "no secrets": log groups
+ # whose streams could not be scanned are reported MANUAL in Phase 4.
+ stream_scan_error = None
+ try:
+ stream_results = detect_secrets_scan_batch(
+ stream_payloads(),
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ stream_results = {}
+ stream_scan_error = error
+
+ # Phase 2: plan the per-event secrets for each flagged stream and collect
+ # the multiline events to rescan. Each multiline event is rescanned once
+ # to resolve per-line detail; the rescans are batched in Phase 3 instead
+ # of one subprocess per event. The event index (``line_number - 1``,
+ # since Phase 1 joins one event per line) is the per-event discriminator:
+ # a CloudWatch stream can hold several events sharing one millisecond
+ # timestamp, so keying only by timestamp would let a later multiline
+ # event overwrite an earlier one's payload and lose secret evidence.
+ # Output still groups/displays by timestamp; only the rescan identity is
+ # per event.
+ # stream_plans: (group arn, stream) ->
+ # {timestamp: {event index: {"multiline", "types"}}}
+ # rescan_payloads: (group arn, stream, timestamp, event index) ->
+ # multiline event data
+ stream_plans = {}
+ rescan_payloads = {}
+ groups_with_rescan = set() # group arns that depend on the Phase 3 rescan
+ for log_group in logs_client.log_groups.values():
+ for log_stream_name in log_group.log_streams or {}:
+ stream_secrets = stream_results.get((log_group.arn, log_stream_name))
+ if not stream_secrets:
+ continue
+ events = log_group.log_streams[log_stream_name]
+ plan = {}
+ for secret in stream_secrets:
+ event_index = secret["line_number"] - 1
+ flagged_event = events[event_index]
+ cloudwatch_timestamp = convert_to_cloudwatch_timestamp_format(
+ flagged_event["timestamp"]
+ )
+ try:
+ log_event_data = dumps(
+ loads(flagged_event["message"]), indent=2
+ )
+ except Exception:
+ log_event_data = dumps(flagged_event["message"], indent=2)
+ multiline = len(log_event_data.split("\n")) > 1
+ events_at_timestamp = plan.setdefault(cloudwatch_timestamp, {})
+ if event_index not in events_at_timestamp:
+ events_at_timestamp[event_index] = {
+ "multiline": multiline,
+ "types": [],
+ }
+ if multiline:
+ # More informative output is possible with more than one
+ # line: the event is rescanned to get the type and line
+ # number of each secret.
+ rescan_payloads[
+ (
+ log_group.arn,
+ log_stream_name,
+ cloudwatch_timestamp,
+ event_index,
+ )
+ ] = log_event_data
+ groups_with_rescan.add(log_group.arn)
+ else:
+ events_at_timestamp[event_index]["types"].append(secret["type"])
+ stream_plans[(log_group.arn, log_stream_name)] = plan
+
+ # Phase 3: one batched rescan for all multiline flagged events. Validation
+ # is never enabled here: this rescan only resolves line numbers for
+ # display and must not re-authenticate the secret.
+ # If the rescan fails we know secrets were already found in Phase 1, so
+ # the affected groups must not silently pass; they are reported MANUAL.
+ rescan_scan_error = None
+ rescan_results = {}
+ if rescan_payloads:
+ try:
+ rescan_results = detect_secrets_scan_batch(
+ rescan_payloads, excluded_secrets=secrets_ignore_patterns
)
- log_group_secrets = []
- if log_group.log_streams:
- for log_stream_name in log_group.log_streams:
- log_stream_secrets = {}
- log_stream_data = "\n".join(
- [
- dumps(event["message"])
- for event in log_group.log_streams[log_stream_name]
- ]
- )
- log_stream_secrets_output = detect_secrets_scan(
- data=log_stream_data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=logs_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
+ except SecretsScanError as error:
+ rescan_scan_error = error
- if log_stream_secrets_output:
- for secret in log_stream_secrets_output:
- flagged_event = log_group.log_streams[log_stream_name][
- secret["line_number"] - 1
- ]
- cloudwatch_timestamp = (
- convert_to_cloudwatch_timestamp_format(
- flagged_event["timestamp"]
- )
- )
- if (
- cloudwatch_timestamp
- not in log_stream_secrets.keys()
- ):
- log_stream_secrets[cloudwatch_timestamp] = (
- SecretsDict()
- )
+ # Phase 4: assemble one report per log group.
+ for log_group in logs_client.log_groups.values():
+ report = Check_Report_AWS(metadata=self.metadata(), resource=log_group)
+ report.status = "PASS"
+ report.status_extended = f"No secrets found in {log_group.name} log group."
- try:
- log_event_data = dumps(
- loads(flagged_event["message"]), indent=2
- )
- except Exception:
- log_event_data = dumps(
- flagged_event["message"], indent=2
- )
- if len(log_event_data.split("\n")) > 1:
- # Can get more informative output if there is more than 1 line.
- # Will rescan just this event to get the type of secret and the line number
- event_detect_secrets_output = detect_secrets_scan(
- data=log_event_data,
- detect_secrets_plugins=logs_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
- if event_detect_secrets_output:
- for secret in event_detect_secrets_output:
- log_stream_secrets[
- cloudwatch_timestamp
- ].add_secret(
- secret["line_number"], secret["type"]
- )
- else:
- log_stream_secrets[cloudwatch_timestamp].add_secret(
- 1, secret["type"]
- )
- if log_stream_secrets:
- secrets_string = "; ".join(
- [
- f"at {timestamp} - {log_stream_secrets[timestamp].to_string()}"
- for timestamp in log_stream_secrets
- ]
- )
- log_group_secrets.append(
- f"in log stream {log_stream_name} {secrets_string}"
- )
- if log_group_secrets:
- secrets_string = "; ".join(log_group_secrets)
- report.status = "FAIL"
- report.status_extended = f"Potential secrets found in log group {log_group.name} {secrets_string}."
+ # The stream scan failed: we cannot conclude this group is clean.
+ if stream_scan_error and log_group.log_streams:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan log group {log_group.name} for secrets: "
+ f"{stream_scan_error}; manual review is required."
+ )
findings.append(report)
+ continue
+
+ log_group_secrets = []
+ all_secrets = []
+ for log_stream_name in log_group.log_streams or {}:
+ stream_secrets = stream_results.get((log_group.arn, log_stream_name))
+ if not stream_secrets:
+ continue
+ all_secrets.extend(stream_secrets)
+ log_stream_secrets = {}
+ for cloudwatch_timestamp, events_at_timestamp in stream_plans[
+ (log_group.arn, log_stream_name)
+ ].items():
+ secrets_dict = SecretsDict()
+ # Multiple events can share one timestamp; aggregate each
+ # event's secrets into the timestamp's display entry.
+ for event_index, entry in events_at_timestamp.items():
+ if entry["multiline"]:
+ for event_secret in rescan_results.get(
+ (
+ log_group.arn,
+ log_stream_name,
+ cloudwatch_timestamp,
+ event_index,
+ ),
+ [],
+ ):
+ secrets_dict.add_secret(
+ event_secret["line_number"], event_secret["type"]
+ )
+ else:
+ for secret_type in entry["types"]:
+ secrets_dict.add_secret(1, secret_type)
+ # Only record the event when at least one non-ignored secret
+ # remains after the rescan. A multiline event whose secrets
+ # were all dropped by ``secrets_ignore_patterns`` leaves an
+ # empty SecretsDict, which must not produce a FAIL with no
+ # actual secret evidence.
+ if secrets_dict:
+ log_stream_secrets[cloudwatch_timestamp] = secrets_dict
+ if log_stream_secrets:
+ secrets_string = "; ".join(
+ [
+ f"at {timestamp} - {log_stream_secrets[timestamp].to_string()}"
+ for timestamp in log_stream_secrets
+ ]
+ )
+ log_group_secrets.append(
+ f"in log stream {log_stream_name} {secrets_string}"
+ )
+ # The multiline rescan failed for a group that had flagged secrets:
+ # detail is unavailable, so report MANUAL rather than risk a false
+ # PASS when every flagged event was multiline.
+ if rescan_scan_error and log_group.arn in groups_with_rescan:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Secrets were detected in log group {log_group.name} but the "
+ f"detailed rescan failed: {rescan_scan_error}; manual review "
+ "is required."
+ )
+ elif log_group_secrets:
+ secrets_string = "; ".join(log_group_secrets)
+ report.status = "FAIL"
+ report.status_extended = f"Potential secrets found in log group {log_group.name} {secrets_string}."
+ annotate_verified_secrets(report, all_secrets)
+ findings.append(report)
return findings
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_service.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_service.py
index 29ac103867..56b7ebe25c 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_service.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_service.py
@@ -6,6 +6,10 @@ from botocore.exceptions import ClientError
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ limit_resources,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
@@ -83,8 +87,19 @@ class Logs(AWSService):
# Call AWSService's __init__
super().__init__(__class__.__name__, provider)
self.log_group_arn_template = f"arn:{self.audited_partition}:logs:{self.region}:{self.audited_account}:log-group"
+ # Log groups are listed first, then only the selected subset is enriched
+ # and exposed for primary log group checks. Keep a complete lightweight
+ # index for cross-service evidence lookups.
+ self.all_log_groups = {}
self.log_groups = {}
+ self._log_groups_hydrated = set()
+ self.log_group_limit = get_resource_scan_limit(
+ self.audit_config, "max_cloudwatch_log_groups"
+ )
+ # The threshold for number of events to return per log group.
+ self.events_per_log_group_threshold = 1000
self.__threading_call__(self._describe_log_groups)
+ self._select_log_groups_for_analysis()
self.resource_policies = {}
self.__threading_call__(self._describe_resource_policies)
self.metric_filters = []
@@ -94,14 +109,27 @@ class Logs(AWSService):
"cloudwatch_log_group_no_secrets_in_logs"
in provider.audit_metadata.expected_checks
):
- self.events_per_log_group_threshold = (
- 1000 # The threshold for number of events to return per log group.
- )
- self.__threading_call__(self._get_log_events)
+ self.__threading_call__(self._get_log_events, self.log_groups.values())
self.__threading_call__(
self._list_tags_for_resource, self.log_groups.values()
)
+ def _select_log_groups_for_analysis(self):
+ """Select the newest log groups for bounded analysis."""
+ if not self.log_groups:
+ return
+ self.log_groups = {
+ log_group.arn: log_group
+ for log_group in limit_resources(
+ sorted(
+ self.log_groups.values(),
+ key=lambda lg: lg.creation_time or 0,
+ reverse=True,
+ ),
+ self.log_group_limit,
+ )
+ }
+
def _describe_metric_filters(self, regional_client):
logger.info("CloudWatch Logs - Describing metric filters...")
try:
@@ -118,11 +146,21 @@ class Logs(AWSService):
self.metric_filters = []
log_group = None
- for lg in self.log_groups.values():
- if lg.name == filter["logGroupName"]:
+ for lg in (self.all_log_groups or {}).values():
+ if (
+ lg.name == filter["logGroupName"]
+ and lg.region == regional_client.region
+ ):
log_group = lg
break
+ if (
+ log_group
+ and log_group.arn in (self.log_groups or {})
+ and log_group.arn not in self._log_groups_hydrated
+ ):
+ self._list_tags_for_resource(log_group)
+
self.metric_filters.append(
MetricFilter(
arn=arn,
@@ -156,9 +194,9 @@ class Logs(AWSService):
"describe_log_groups"
)
for page in describe_log_groups_paginator.paginate():
- for log_group in page["logGroups"]:
- if not self.audit_resources or (
- is_resource_filtered(log_group["arn"], self.audit_resources)
+ for log_group in page.get("logGroups", []):
+ if not self.audit_resources or is_resource_filtered(
+ log_group["arn"], self.audit_resources
):
never_expire = False
kms = log_group.get("kmsKeyId")
@@ -168,20 +206,26 @@ class Logs(AWSService):
retention_days = 9999
if self.log_groups is None:
self.log_groups = {}
- self.log_groups[log_group["arn"]] = LogGroup(
+ if self.all_log_groups is None:
+ self.all_log_groups = {}
+ log_group_object = LogGroup(
arn=log_group["arn"],
name=log_group["logGroupName"],
retention_days=retention_days,
never_expire=never_expire,
kms_id=kms,
+ creation_time=log_group.get("creationTime"),
region=regional_client.region,
)
+ self.all_log_groups[log_group_object.arn] = log_group_object
+ self.log_groups[log_group_object.arn] = log_group_object
except ClientError as error:
if error.response["Error"]["Code"] == "AccessDeniedException":
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
if not self.log_groups:
+ self.all_log_groups = None
self.log_groups = None
else:
logger.error(
@@ -192,37 +236,29 @@ class Logs(AWSService):
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
- def _get_log_events(self, regional_client):
- regional_log_groups = [
- log_group
- for log_group in self.log_groups.values()
- if log_group.region == regional_client.region
- ]
- total_log_groups = len(regional_log_groups)
+ def _get_log_events(self, log_group):
+ """Retrieve recent log events for a selected log group.
+
+ Args:
+ log_group: Log group selected for bounded analysis.
+ """
logger.info(
- f"CloudWatch Logs - Retrieving log events for {total_log_groups} log groups in {regional_client.region}..."
+ f"CloudWatch Logs - Retrieving log events for log group {log_group.name}..."
)
try:
- for count, log_group in enumerate(regional_log_groups, start=1):
- events = regional_client.filter_log_events(
- logGroupName=log_group.name,
- limit=self.events_per_log_group_threshold,
- )["events"]
- for event in events:
- if event["logStreamName"] not in log_group.log_streams:
- log_group.log_streams[event["logStreamName"]] = []
- log_group.log_streams[event["logStreamName"]].append(event)
- if count % 10 == 0:
- logger.info(
- f"CloudWatch Logs - Retrieved log events for {count}/{total_log_groups} log groups in {regional_client.region}..."
- )
+ regional_client = self.regional_clients[log_group.region]
+ events = regional_client.filter_log_events(
+ logGroupName=log_group.name,
+ limit=self.events_per_log_group_threshold,
+ )["events"]
+ for event in events:
+ if event["logStreamName"] not in log_group.log_streams:
+ log_group.log_streams[event["logStreamName"]] = []
+ log_group.log_streams[event["logStreamName"]].append(event)
except Exception as error:
logger.error(
- f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ f"{log_group.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
- logger.info(
- f"CloudWatch Logs - Finished retrieving log events in {regional_client.region}..."
- )
def _describe_resource_policies(self, regional_client):
logger.info("CloudWatch Logs - Describing resource policies...")
@@ -257,6 +293,13 @@ class Logs(AWSService):
)
def _list_tags_for_resource(self, log_group):
+ """Hydrate tags for a selected log group once.
+
+ Args:
+ log_group: Log group selected for tag hydration.
+ """
+ if log_group.arn in self._log_groups_hydrated:
+ return
logger.info(f"CloudWatch Logs - List Tags for Log Group {log_group.name}...")
try:
regional_client = self.regional_clients[log_group.region]
@@ -264,6 +307,7 @@ class Logs(AWSService):
resourceArn=log_group.arn
)["tags"]
log_group.tags = [response]
+ self._log_groups_hydrated.add(log_group.arn)
except ClientError as error:
if error.response["Error"]["Code"] == "ResourceNotFoundException":
logger.warning(
@@ -292,6 +336,7 @@ class LogGroup(BaseModel):
retention_days: int
never_expire: bool
kms_id: Optional[str]
+ creation_time: Optional[int] = None
region: str
log_streams: dict[str, list[str]] = (
{}
diff --git a/prowler/providers/aws/services/codeartifact/codeartifact_service.py b/prowler/providers/aws/services/codeartifact/codeartifact_service.py
index 1465092063..9a13e8fcf7 100644
--- a/prowler/providers/aws/services/codeartifact/codeartifact_service.py
+++ b/prowler/providers/aws/services/codeartifact/codeartifact_service.py
@@ -1,10 +1,14 @@
from enum import Enum
-from typing import Optional
+from typing import Iterator, Optional, Tuple
from botocore.exceptions import ClientError
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ iter_limited_paginator_items,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
@@ -15,9 +19,18 @@ class CodeArtifact(AWSService):
super().__init__(__class__.__name__, provider)
# repositories is a dictionary containing all the codeartifact service information
self.repositories = {}
+ # repository ARNs whose selected packages have been listed and memoized
+ # into repository.packages.
+ self._packages_listed = set()
+ self.package_limit = get_resource_scan_limit(
+ self.audit_config, "max_codeartifact_packages"
+ )
self.__threading_call__(self._list_repositories)
- self.__threading_call__(self._list_packages)
- self._list_tags_for_resource()
+ for _ in self._load_packages_for_analysis():
+ pass
+ self.__threading_call__(
+ self._list_tags_for_resource, self.repositories.values()
+ )
def _list_repositories(self, regional_client):
logger.info("CodeArtifact - Listing Repositories...")
@@ -51,134 +64,146 @@ class CodeArtifact(AWSService):
f" {error}"
)
- def _list_packages(self, regional_client):
- logger.info("CodeArtifact - Listing Packages and retrieving information...")
- for repository in self.repositories:
- try:
- if self.repositories[repository].region == regional_client.region:
- list_packages_paginator = regional_client.get_paginator(
- "list_packages"
+ def _iter_repository_packages(
+ self, repository, limit: Optional[int] = None
+ ) -> Iterator["Package"]:
+ """Yield packages for a single repository, hydrating each one lazily.
+
+ Each package requires an extra ``list_package_versions`` call to
+ resolve its latest version, so producing them lazily lets the resource
+ limit stop before extra package version calls.
+ """
+ regional_client = self.regional_clients[repository.region]
+ try:
+ list_packages_paginator = regional_client.get_paginator("list_packages")
+ list_packages_parameters = {
+ "domain": repository.domain_name,
+ "domainOwner": repository.domain_owner,
+ "repository": repository.name,
+ }
+ for package in iter_limited_paginator_items(
+ list_packages_paginator,
+ "packages",
+ limit,
+ **list_packages_parameters,
+ ):
+ # Package information
+ package_format = package["format"]
+ package_namespace = package.get("namespace")
+ package_name = package["package"]
+ package_origin_configuration_restrictions_publish = package[
+ "originConfiguration"
+ ]["restrictions"]["publish"]
+ package_origin_configuration_restrictions_upstream = package[
+ "originConfiguration"
+ ]["restrictions"]["upstream"]
+ # Get Latest Package Version
+ list_package_versions_parameters = {
+ "domain": repository.domain_name,
+ "domainOwner": repository.domain_owner,
+ "repository": repository.name,
+ "format": package_format,
+ "package": package_name,
+ "sortBy": "PUBLISHED_TIME",
+ "maxResults": 1,
+ }
+ if package_namespace:
+ list_package_versions_parameters["namespace"] = package_namespace
+ latest_version_information = regional_client.list_package_versions(
+ **list_package_versions_parameters
+ )
+ latest_version = ""
+ latest_origin_type = "UNKNOWN"
+ latest_status = "Published"
+ if latest_version_information.get("versions"):
+ latest_version = latest_version_information["versions"][0].get(
+ "version"
)
- list_packages_parameters = {
- "domain": self.repositories[repository].domain_name,
- "domainOwner": self.repositories[repository].domain_owner,
- "repository": self.repositories[repository].name,
- }
- packages = []
- for page in list_packages_paginator.paginate(
- **list_packages_parameters
- ):
- for package in page["packages"]:
- # Package information
- package_format = package["format"]
- package_namespace = package.get("namespace")
- package_name = package["package"]
- package_origin_configuration_restrictions_publish = package[
- "originConfiguration"
- ]["restrictions"]["publish"]
- package_origin_configuration_restrictions_upstream = (
- package["originConfiguration"]["restrictions"][
- "upstream"
- ]
- )
- # Get Latest Package Version
- if package_namespace:
- latest_version_information = (
- regional_client.list_package_versions(
- domain=self.repositories[
- repository
- ].domain_name,
- domainOwner=self.repositories[
- repository
- ].domain_owner,
- repository=self.repositories[repository].name,
- format=package_format,
- namespace=package_namespace,
- package=package_name,
- sortBy="PUBLISHED_TIME",
- maxResults=1,
- )
- )
- else:
- latest_version_information = (
- regional_client.list_package_versions(
- domain=self.repositories[
- repository
- ].domain_name,
- domainOwner=self.repositories[
- repository
- ].domain_owner,
- repository=self.repositories[repository].name,
- format=package_format,
- package=package_name,
- sortBy="PUBLISHED_TIME",
- maxResults=1,
- )
- )
- latest_version = ""
- latest_origin_type = "UNKNOWN"
- latest_status = "Published"
- if latest_version_information.get("versions"):
- latest_version = latest_version_information["versions"][
- 0
- ].get("version")
- latest_origin_type = (
- latest_version_information["versions"][0]
- .get("origin", {})
- .get("originType", "UNKNOWN")
- )
- latest_status = latest_version_information["versions"][
- 0
- ].get("status", "Published")
-
- packages.append(
- Package(
- name=package_name,
- namespace=package_namespace,
- format=package_format,
- origin_configuration=OriginConfiguration(
- restrictions=Restrictions(
- publish=package_origin_configuration_restrictions_publish,
- upstream=package_origin_configuration_restrictions_upstream,
- )
- ),
- latest_version=LatestPackageVersion(
- version=latest_version,
- status=latest_status,
- origin=OriginInformation(
- origin_type=latest_origin_type
- ),
- ),
- )
- )
- # Save all the packages information
- self.repositories[repository].packages = packages
-
- except ClientError as error:
- if error.response["Error"]["Code"] == "ResourceNotFoundException":
- logger.warning(
- f"{regional_client.region} --"
- f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
- f" {error}"
+ latest_origin_type = (
+ latest_version_information["versions"][0]
+ .get("origin", {})
+ .get("originType", "UNKNOWN")
+ )
+ latest_status = latest_version_information["versions"][0].get(
+ "status", "Published"
)
- continue
- except Exception as error:
- logger.error(
- f"{regional_client.region} --"
+ yield Package(
+ name=package_name,
+ namespace=package_namespace,
+ format=package_format,
+ origin_configuration=OriginConfiguration(
+ restrictions=Restrictions(
+ publish=package_origin_configuration_restrictions_publish,
+ upstream=package_origin_configuration_restrictions_upstream,
+ )
+ ),
+ latest_version=LatestPackageVersion(
+ version=latest_version,
+ status=latest_status,
+ origin=OriginInformation(origin_type=latest_origin_type),
+ ),
+ )
+
+ except ClientError as error:
+ if error.response["Error"]["Code"] == "ResourceNotFoundException":
+ logger.warning(
+ f"{repository.region} --"
f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
f" {error}"
)
+ else:
+ logger.error(
+ f"{repository.region} --"
+ f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+ f" {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{repository.region} --"
+ f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+ f" {error}"
+ )
- def _list_tags_for_resource(self):
+ def _load_packages_for_analysis(self) -> Iterator[Tuple["Repository", "Package"]]:
+ """Yield the ``(repository, package)`` pairs selected for analysis.
+
+ Package listing stays in the service layer so checks receive only the
+ selected packages and remain unaware of resource-analysis limits.
+ """
+ yielded = 0
+ for repository in list(self.repositories.values()):
+ if repository.arn in self._packages_listed:
+ for package in repository.packages:
+ yield repository, package
+ yielded += 1
+ if self.package_limit and yielded >= self.package_limit:
+ return
+ continue
+ collected = []
+ remaining_limit = None
+ if self.package_limit:
+ remaining_limit = self.package_limit - yielded
+ if remaining_limit <= 0:
+ return
+ for package in self._iter_repository_packages(repository, remaining_limit):
+ collected.append(package)
+ repository.packages = collected
+ yield repository, package
+ yielded += 1
+ if self.package_limit and yielded >= self.package_limit:
+ self._packages_listed.add(repository.arn)
+ return
+ self._packages_listed.add(repository.arn)
+
+ def _list_tags_for_resource(self, repository):
logger.info("CodeArtifact - List Tags...")
try:
- for repository in self.repositories.values():
- regional_client = self.regional_clients[repository.region]
- response = regional_client.list_tags_for_resource(
- resourceArn=repository.arn
- )["tags"]
- repository.tags = response
+ regional_client = self.regional_clients[repository.region]
+ response = regional_client.list_tags_for_resource(
+ resourceArn=repository.arn
+ )["tags"]
+ repository.tags = response
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
diff --git a/prowler/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.py b/prowler/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.py
index 8d031cc25a..2e0c5863eb 100644
--- a/prowler/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.py
+++ b/prowler/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.py
@@ -1,7 +1,11 @@
import json
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client
@@ -14,35 +18,71 @@ class codebuild_project_no_secrets_in_variables(Check):
secrets_ignore_patterns = codebuild_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for project in codebuild_client.projects.values():
+ validate = codebuild_client.audit_config.get("secrets_validate", False)
+ projects = list(codebuild_client.projects.values())
+
+ # Collect every scannable plaintext variable across all projects and scan
+ # them in batched Kingfisher invocations instead of one subprocess per
+ # variable. Findings are keyed by (project index, variable index).
+ def payloads():
+ for project_index, project in enumerate(projects):
+ if project.environment_variables:
+ for var_index, env_var in enumerate(project.environment_variables):
+ if (
+ env_var.type == "PLAINTEXT"
+ and env_var.name not in sensitive_vars_excluded
+ ):
+ yield (project_index, var_index), json.dumps(
+ {env_var.name: env_var.value}
+ )
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for project_index, project in enumerate(projects):
report = Check_Report_AWS(metadata=self.metadata(), resource=project)
report.status = "PASS"
report.status_extended = f"CodeBuild project {project.name} does not have sensitive environment plaintext credentials."
secrets_found = []
+ all_secrets = []
+
+ if scan_error and any(
+ env_var.type == "PLAINTEXT"
+ and env_var.name not in sensitive_vars_excluded
+ for env_var in project.environment_variables or []
+ ):
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan CodeBuild project {project.name} environment "
+ f"variables for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
if project.environment_variables:
- for env_var in project.environment_variables:
- if (
- env_var.type == "PLAINTEXT"
- and env_var.name not in sensitive_vars_excluded
- ):
- detect_secrets_output = detect_secrets_scan(
- data=json.dumps({env_var.name: env_var.value}),
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=codebuild_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
- if detect_secrets_output:
- secrets_info = [
+ for var_index, env_var in enumerate(project.environment_variables):
+ detect_secrets_output = batch_results.get(
+ (project_index, var_index)
+ )
+ if detect_secrets_output:
+ all_secrets.extend(detect_secrets_output)
+ secrets_found.extend(
+ [
f"{secret['type']} in variable {env_var.name}"
for secret in detect_secrets_output
]
- secrets_found.extend(secrets_info)
+ )
if secrets_found:
report.status = "FAIL"
report.status_extended = f"CodeBuild project {project.name} has sensitive environment plaintext credentials in variables: {', '.join(secrets_found)}."
+ annotate_verified_secrets(report, all_secrets)
findings.append(report)
diff --git a/tests/lib/outputs/compliance/asd_essential_eight/__init__.py b/prowler/providers/aws/services/datapipeline/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/asd_essential_eight/__init__.py
rename to prowler/providers/aws/services/datapipeline/__init__.py
diff --git a/prowler/providers/aws/services/datapipeline/datapipeline_client.py b/prowler/providers/aws/services/datapipeline/datapipeline_client.py
new file mode 100644
index 0000000000..4732a559a5
--- /dev/null
+++ b/prowler/providers/aws/services/datapipeline/datapipeline_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.aws.services.datapipeline.datapipeline_service import (
+ DataPipeline,
+)
+from prowler.providers.common.provider import Provider
+
+datapipeline_client = DataPipeline(Provider.get_global_provider())
diff --git a/tests/lib/outputs/compliance/c5/__init__.py b/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/c5/__init__.py
rename to prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/__init__.py
diff --git a/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.metadata.json b/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.metadata.json
new file mode 100644
index 0000000000..cadafedfa9
--- /dev/null
+++ b/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.metadata.json
@@ -0,0 +1,43 @@
+{
+ "Provider": "aws",
+ "CheckID": "datapipeline_pipeline_no_secrets_in_definition",
+ "CheckTitle": "Data Pipeline definition has no sensitive credentials",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "TTPs/Credential Access",
+ "Effects/Data Exposure",
+ "Sensitive Data Identifications/Security"
+ ],
+ "ServiceName": "datapipeline",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:datapipeline:region:account-id:pipeline/pipeline-id",
+ "Severity": "high",
+ "ResourceType": "AwsDataPipelinePipeline",
+ "ResourceGroup": "analytics",
+ "Description": "AWS Data Pipeline definitions are inspected for hardcoded secrets, such as keys, tokens, passwords, or database credentials embedded directly in pipeline objects, parameters, or parameter values.",
+ "Risk": "Plaintext secrets in Data Pipeline definitions can be viewed by users with pipeline read permissions and may leak through scripts, SQL commands, logs, or exported definitions. Exposed credentials can enable unauthorized access to databases, storage, and downstream systems.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_GetPipelineDefinition.html",
+ "https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-object-pipeline.html",
+ "https://docs.prowler.com/developer-guide/secret-scanning-checks"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "1. Review the Data Pipeline definition.\n2. Remove hardcoded credentials from pipeline objects, parameter objects, and parameter values.\n3. Store secrets in AWS Secrets Manager or AWS Systems Manager Parameter Store.\n4. Grant the pipeline role least-privilege access to retrieve secrets securely at runtime.\n5. Rotate any exposed credentials.",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Avoid embedding secrets in AWS Data Pipeline definitions. Store sensitive values in AWS Secrets Manager or AWS Systems Manager Parameter Store and reference them securely at runtime with least-privilege IAM permissions.",
+ "Url": "https://hub.prowler.com/check/datapipeline_pipeline_no_secrets_in_definition"
+ }
+ },
+ "Categories": [
+ "secrets"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "AWS Data Pipeline has been closed to new customers since July 25, 2024. Accounts without pre-existing pipelines will not return findings for this check, as the service cannot be used by new customers."
+}
diff --git a/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.py b/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.py
new file mode 100644
index 0000000000..1e6a60facd
--- /dev/null
+++ b/prowler/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition.py
@@ -0,0 +1,112 @@
+import json
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
+from prowler.providers.aws.services.datapipeline.datapipeline_client import (
+ datapipeline_client,
+)
+
+
+class datapipeline_pipeline_no_secrets_in_definition(Check):
+ """Check that AWS Data Pipeline definitions contain no hardcoded secrets."""
+
+ def execute(self) -> list[Check_Report_AWS]:
+ """Execute the Data Pipeline definition secret scan."""
+ findings = []
+ secrets_ignore_patterns = datapipeline_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ validate = datapipeline_client.audit_config.get("secrets_validate", False)
+ pipelines = list(datapipeline_client.pipelines.values())
+ line_context_by_pipeline = {}
+ payloads = []
+ for pipeline_index, pipeline in enumerate(pipelines):
+ payload, line_context = _build_definition_payload(pipeline.definition)
+ line_context_by_pipeline[pipeline_index] = line_context
+ if payload:
+ payloads.append((pipeline_index, payload))
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads, excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for pipeline_index, pipeline in enumerate(pipelines):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=pipeline)
+ report.resource_tags = pipeline.tags
+ report.status = "PASS"
+ report.status_extended = (
+ f"No secrets found in Data Pipeline {pipeline.name} definition."
+ )
+
+ line_context = line_context_by_pipeline.get(pipeline_index, {})
+ if line_context:
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Data Pipeline {pipeline.name} definition "
+ f"for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+
+ detect_secrets_output = batch_results.get(pipeline_index)
+ if detect_secrets_output:
+ secrets_string = ", ".join(
+ [
+ f"{secret['type']} in {line_context.get(secret['line_number'], 'definition')}"
+ for secret in detect_secrets_output
+ ]
+ )
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Potential {'secrets' if len(detect_secrets_output) > 1 else 'secret'} "
+ f"found in Data Pipeline {pipeline.name} definition -> {secrets_string}."
+ )
+ annotate_verified_secrets(report, detect_secrets_output)
+
+ findings.append(report)
+ return findings
+
+
+def _build_definition_payload(definition: dict) -> tuple[str, dict[int, str]]:
+ """Build a line-oriented scan payload and map each line to a definition field."""
+ lines = []
+ line_context = {}
+
+ def add_line(context: str, value) -> None:
+ if value is None:
+ return
+ lines.append(json.dumps({context: value}))
+ line_context[len(lines)] = context
+
+ for pipeline_object in definition.get("pipelineObjects", []):
+ object_name = pipeline_object.get("name") or pipeline_object.get("id")
+ for field in pipeline_object.get("fields", []):
+ field_name = field.get("key")
+ field_value = field.get("stringValue") or field.get("refValue")
+ add_line(f"object {object_name} field {field_name}", field_value)
+
+ for parameter_object in definition.get("parameterObjects", []):
+ parameter_name = parameter_object.get("id")
+ for attribute in parameter_object.get("attributes", []):
+ attribute_name = attribute.get("key")
+ attribute_value = attribute.get("stringValue")
+ add_line(
+ f"parameter object {parameter_name} attribute {attribute_name}",
+ attribute_value,
+ )
+
+ for parameter_value in definition.get("parameterValues", []):
+ parameter_id = parameter_value.get("id")
+ add_line(f"parameter value {parameter_id}", parameter_value.get("stringValue"))
+
+ return "\n".join(lines), line_context
diff --git a/prowler/providers/aws/services/datapipeline/datapipeline_service.py b/prowler/providers/aws/services/datapipeline/datapipeline_service.py
new file mode 100644
index 0000000000..c893dd0557
--- /dev/null
+++ b/prowler/providers/aws/services/datapipeline/datapipeline_service.py
@@ -0,0 +1,96 @@
+from botocore.exceptions import ClientError
+from pydantic.v1 import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.aws.lib.service.service import AWSService
+
+
+class Pipeline(BaseModel):
+ """Represents an AWS Data Pipeline pipeline."""
+
+ id: str
+ name: str
+ arn: str
+ region: str
+ definition: dict = Field(default_factory=dict)
+ tags: list[dict] = Field(default_factory=list)
+
+
+class DataPipeline(AWSService):
+ """AWS Data Pipeline service class to list pipelines and definitions."""
+
+ def __init__(self, provider):
+ """Initialize the AWS Data Pipeline service."""
+ super().__init__(__class__.__name__, provider)
+ self.pipelines = {}
+ self.__threading_call__(self._list_pipelines)
+ if self.pipelines:
+ self.__threading_call__(
+ self._get_pipeline_definition, self.pipelines.values()
+ )
+
+ def _list_pipelines(self, regional_client) -> None:
+ """List AWS Data Pipeline pipelines in a region."""
+ logger.info("DataPipeline - Listing pipelines...")
+ try:
+ list_pipelines_paginator = regional_client.get_paginator("list_pipelines")
+ for page in list_pipelines_paginator.paginate():
+ for pipeline in page.get("pipelineIdList", []):
+ pipeline_id = pipeline.get("id")
+ pipeline_name = pipeline.get("name", pipeline_id)
+ pipeline_arn = (
+ f"arn:{self.audited_partition}:datapipeline:"
+ f"{regional_client.region}:{self.audited_account}:pipeline/{pipeline_id}"
+ )
+ if not self.audit_resources or is_resource_filtered(
+ pipeline_arn, self.audit_resources
+ ):
+ self.pipelines[pipeline_arn] = Pipeline(
+ id=pipeline_id,
+ name=pipeline_name,
+ arn=pipeline_arn,
+ region=regional_client.region,
+ )
+ except ClientError as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _get_pipeline_definition(self, pipeline: Pipeline) -> None:
+ """Get the full definition for an AWS Data Pipeline pipeline."""
+ logger.info(f"DataPipeline - Getting definition for pipeline {pipeline.id}...")
+ try:
+ regional_client = self.regional_clients[pipeline.region]
+ try:
+ pipeline_descriptions = regional_client.describe_pipelines(
+ pipelineIds=[pipeline.id]
+ ).get("pipelineDescriptionList", [])
+ if pipeline_descriptions:
+ pipeline.tags = pipeline_descriptions[0].get("tags", [])
+ except ClientError as error:
+ logger.error(
+ f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ definition = regional_client.get_pipeline_definition(pipelineId=pipeline.id)
+ pipeline.definition = {
+ "pipelineObjects": definition.get("pipelineObjects", []),
+ "parameterObjects": definition.get("parameterObjects", []),
+ "parameterValues": definition.get("parameterValues", []),
+ }
+ except ClientError as error:
+ logger.error(
+ f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
diff --git a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py
index 3ee815fb23..c7eedc7f8f 100644
--- a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py
+++ b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py
@@ -1,6 +1,5 @@
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dlm.dlm_client import dlm_client
-from prowler.providers.aws.services.ec2.ec2_client import ec2_client
class dlm_ebs_snapshot_lifecycle_policy_exists(Check):
@@ -8,8 +7,8 @@ class dlm_ebs_snapshot_lifecycle_policy_exists(Check):
findings = []
for region in dlm_client.lifecycle_policies:
if (
- region in ec2_client.regions_with_snapshots
- and ec2_client.regions_with_snapshots[region]
+ region in dlm_client.regions_with_snapshots
+ and dlm_client.regions_with_snapshots[region]
):
report = Check_Report_AWS(
metadata=self.metadata(),
diff --git a/prowler/providers/aws/services/dlm/dlm_service.py b/prowler/providers/aws/services/dlm/dlm_service.py
index 1d6fff9b5a..f0f67e631c 100644
--- a/prowler/providers/aws/services/dlm/dlm_service.py
+++ b/prowler/providers/aws/services/dlm/dlm_service.py
@@ -9,7 +9,13 @@ class DLM(AWSService):
# Call AWSService's __init__
super().__init__(__class__.__name__, provider)
self.lifecycle_policies = {}
+ self.regions_with_snapshots = {}
self.__threading_call__(self._get_lifecycle_policies)
+ ec2_regional_clients = provider.generate_regional_clients("ec2") or {}
+ self.__threading_call__(
+ self._get_regions_with_snapshots,
+ iterator=ec2_regional_clients.values(),
+ )
def _get_lifecycle_policy_arn_template(self, region):
return (
@@ -35,6 +41,34 @@ class DLM(AWSService):
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _get_regions_with_snapshots(self, regional_client):
+ logger.info("DLM - Checking regions with self-owned EBS snapshots...")
+ try:
+ self.regions_with_snapshots[regional_client.region] = False
+ next_token = None
+ while True:
+ describe_snapshots_args = {
+ "OwnerIds": ["self"],
+ "MaxResults": 5,
+ }
+ if next_token:
+ describe_snapshots_args["NextToken"] = next_token
+
+ snapshots = regional_client.describe_snapshots(
+ **describe_snapshots_args
+ )
+ if snapshots.get("Snapshots"):
+ self.regions_with_snapshots[regional_client.region] = True
+ break
+
+ next_token = snapshots.get("NextToken")
+ if not next_token:
+ break
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
class LifecyclePolicy(BaseModel):
id: str
diff --git a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py
index 2b491529c9..5f1a57897b 100644
--- a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py
+++ b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py
@@ -1,9 +1,14 @@
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client
-from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
+def _get_ec2_client():
+ from prowler.providers.aws.services.ec2.ec2_client import ec2_client
+
+ return ec2_client
+
+
class dms_instance_no_public_access(Check):
def execute(self):
findings = []
@@ -19,7 +24,7 @@ class dms_instance_no_public_access(Check):
if instance.security_groups:
report.status = "PASS"
report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible but filtered with security groups."
- for security_group in ec2_client.security_groups.values():
+ for security_group in _get_ec2_client().security_groups.values():
if security_group.id in instance.security_groups:
for ingress_rule in security_group.ingress_rules:
if check_security_group(
diff --git a/tests/lib/outputs/compliance/ccc/__init__.py b/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/ccc/__init__.py
rename to prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/__init__.py
diff --git a/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.metadata.json b/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.metadata.json
new file mode 100644
index 0000000000..c8638927a3
--- /dev/null
+++ b/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.metadata.json
@@ -0,0 +1,40 @@
+{
+ "Provider": "aws",
+ "CheckID": "ec2_ami_account_block_public_access",
+ "CheckTitle": "AMI block public access is enabled at the account level",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Effects/Data Exposure"
+ ],
+ "ServiceName": "ec2",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "Other",
+ "ResourceGroup": "compute",
+ "Description": "AMI block public access configuration is assessed to see whether public sharing of AMIs is blocked in the account and Region. When enabled (`block-new-sharing`), no AMI in the Region can be made public regardless of individual image permissions.",
+ "Risk": "Without blocking public access, AMIs could be accidentally or maliciously shared publicly, exposing baked-in secrets, source code, and infrastructure details to unauthorized actors.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html",
+ "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/image-block-public-access.html"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws ec2 enable-image-block-public-access --image-block-public-access-state block-new-sharing",
+ "NativeIaC": "",
+ "Other": "1. In the AWS console, select the target Region in the top-right.\n2. Go to EC2 > AMIs.\n3. In the AMIs page, choose Block public access for AMIs (or EC2 Dashboard > Account attributes > Data protection and security).\n4. Choose Manage and enable Block public access.\n5. Save changes.",
+ "Terraform": "```hcl\nresource \"aws_ec2_image_block_public_access\" \"<example_resource_name>\" {\n state = \"block-new-sharing\" # Blocks new public sharing of AMIs in the configured Region\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Enable AMI block public access (`block-new-sharing`) in every active Region. Apply guardrails (SCPs) to prevent it from being disabled, and review any AMIs that are currently shared publicly.",
+ "Url": "https://hub.prowler.com/check/ec2_ami_account_block_public_access"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.py b/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.py
new file mode 100644
index 0000000000..08a892a674
--- /dev/null
+++ b/prowler/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access.py
@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.ec2.ec2_client import ec2_client
+
+
+class ec2_ami_account_block_public_access(Check):
+ def execute(self):
+ findings = []
+ for state in ec2_client.ami_block_public_access_states:
+ report = Check_Report_AWS(
+ metadata=self.metadata(),
+ resource=state,
+ )
+ report.resource_id = ec2_client.audited_account
+ report.resource_arn = ec2_client.account_arn_template
+
+ if state.status == "block-new-sharing":
+ report.status = "PASS"
+ report.status_extended = (
+ f"AMI Block Public Access is enabled in {state.region}."
+ )
+ else:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"AMI Block Public Access is disabled in {state.region}."
+ )
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py
index 3df5fffb58..a708467a94 100644
--- a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py
+++ b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py
@@ -18,4 +18,4 @@ class ec2_ami_public(Check):
findings.append(report)
- return findings
+ return findings
diff --git a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py
index 9abd6239cc..f6b0fce95f 100644
--- a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py
+++ b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py
@@ -14,7 +14,11 @@ class ec2_instance_account_imdsv2_enabled(Check):
metadata=self.metadata(),
resource=instance_metadata_default,
)
- report.resource_arn = ec2_client.account_arn_template
+ report.resource_arn = (
+ f"arn:{ec2_client.audited_partition}:ec2:"
+ f"{instance_metadata_default.region}:"
+ f"{ec2_client.audited_account}:account"
+ )
report.resource_id = ec2_client.audited_account
if instance_metadata_default.http_tokens == "required":
report.status = "PASS"
diff --git a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
index 3c3864c479..31b3f8fb05 100644
--- a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
+++ b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
@@ -4,7 +4,11 @@ from base64 import b64decode
from prowler.config.config import encoding_format_utf_8
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.lib.logger import logger
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
@@ -14,54 +18,86 @@ class ec2_instance_secrets_user_data(Check):
secrets_ignore_patterns = ec2_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for instance in ec2_client.instances:
- if instance.state != "terminated":
- report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
- if instance.user_data:
- user_data = b64decode(instance.user_data)
- try:
- if user_data[0:2] == b"\x1f\x8b": # GZIP magic number
- user_data = zlib.decompress(
- user_data, zlib.MAX_WBITS | 32
- ).decode(encoding_format_utf_8)
- else:
- user_data = user_data.decode(encoding_format_utf_8)
- except UnicodeDecodeError as error:
- logger.warning(
- f"{instance.region} -- Unable to decode user data in EC2 instance {instance.id}: {error}"
- )
- continue
- except Exception as error:
- logger.error(
- f"{instance.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
- )
- continue
- detect_secrets_output = detect_secrets_scan(
- data=user_data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=ec2_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
- if detect_secrets_output:
- secrets_string = ", ".join(
- [
- f"{secret['type']} on line {secret['line_number']}"
- for secret in detect_secrets_output
- ]
- )
- report.status = "FAIL"
- report.status_extended = f"Potential secret found in EC2 instance {instance.id} User Data -> {secrets_string}."
+ validate = ec2_client.audit_config.get("secrets_validate", False)
+ instances = list(ec2_client.instances)
+ # Collect the decoded User Data of each non-terminated instance and scan
+ # it all in batched Kingfisher invocations instead of one subprocess each.
+ # Instances whose User Data cannot be decoded are undecodable (no report),
+ # matching the original per-resource behavior.
+ undecodable = set()
+
+ def payloads():
+ for index, instance in enumerate(instances):
+ if instance.state == "terminated" or not instance.user_data:
+ continue
+ user_data = b64decode(instance.user_data)
+ try:
+ if user_data[0:2] == b"\x1f\x8b": # GZIP magic number
+ user_data = zlib.decompress(
+ user_data, zlib.MAX_WBITS | 32
+ ).decode(encoding_format_utf_8)
else:
- report.status = "PASS"
- report.status_extended = (
- f"No secrets found in EC2 instance {instance.id} User Data."
- )
+ user_data = user_data.decode(encoding_format_utf_8)
+ except UnicodeDecodeError as error:
+ logger.warning(
+ f"{instance.region} -- Unable to decode user data in EC2 instance {instance.id}: {error}"
+ )
+ undecodable.add(index)
+ continue
+ except Exception as error:
+ logger.error(
+ f"{instance.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ undecodable.add(index)
+ continue
+ yield index, user_data
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, instance in enumerate(instances):
+ if instance.state == "terminated":
+ continue
+ report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
+ if scan_error and instance.user_data:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan EC2 instance {instance.id} User Data for "
+ f"secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ if index in undecodable:
+ report.status = "MANUAL"
+ report.status_extended = f"Could not decode User Data for EC2 instance {instance.id}; manual review is required to scan for secrets."
+ elif instance.user_data:
+ detect_secrets_output = batch_results.get(index)
+ if detect_secrets_output:
+ secrets_string = ", ".join(
+ [
+ f"{secret['type']} on line {secret['line_number']}"
+ for secret in detect_secrets_output
+ ]
+ )
+ report.status = "FAIL"
+ report.status_extended = f"Potential secret found in EC2 instance {instance.id} User Data -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status = "PASS"
- report.status_extended = f"No secrets found in EC2 instance {instance.id} since User Data is empty."
+ report.status_extended = (
+ f"No secrets found in EC2 instance {instance.id} User Data."
+ )
+ else:
+ report.status = "PASS"
+ report.status_extended = f"No secrets found in EC2 instance {instance.id} since User Data is empty."
- findings.append(report)
+ findings.append(report)
return findings
diff --git a/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.py b/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.py
index b0dc677e34..3e4d17f4fd 100644
--- a/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.py
+++ b/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.py
@@ -26,11 +26,12 @@ class ec2_instance_with_outdated_ami(Check):
List[Check_Report_AWS]: A list containing the results of the check for each instance.
"""
findings = []
+ images_by_id = getattr(ec2_client, "images_by_id", None)
+ if images_by_id is None:
+ images_by_id = {image.id: image for image in ec2_client.images}
+
for instance in ec2_client.instances:
- ami = next(
- (image for image in ec2_client.images if image.id == instance.image_id),
- None,
- )
+ ami = images_by_id.get(instance.image_id)
if ami and ami.owner == "amazon":
report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
report.status = "PASS"
diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py
index 823553bcdf..e84da724a2 100644
--- a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py
+++ b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py
@@ -4,7 +4,11 @@ from base64 import b64decode
from prowler.config.config import encoding_format_utf_8
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.lib.logger import logger
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
@@ -14,43 +18,77 @@ class ec2_launch_template_no_secrets(Check):
secrets_ignore_patterns = ec2_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for template in ec2_client.launch_templates:
+ validate = ec2_client.audit_config.get("secrets_validate", False)
+ templates = list(ec2_client.launch_templates)
+
+ # Track versions whose User Data cannot be decoded so the template is
+ # surfaced (MANUAL) instead of silently claiming no secrets were found.
+ undecodable_versions = {}
+
+ # Collect the decoded User Data of every (template, version) and scan it
+ # all in batched Kingfisher invocations instead of one subprocess per
+ # version. Versions whose User Data cannot be decoded are recorded above.
+ def payloads():
+ for template_index, template in enumerate(templates):
+ for version_index, version in enumerate(template.versions):
+ if not version.template_data.user_data:
+ continue
+ user_data = b64decode(version.template_data.user_data)
+ try:
+ if user_data[0:2] == b"\x1f\x8b": # GZIP magic number
+ user_data = zlib.decompress(
+ user_data, zlib.MAX_WBITS | 32
+ ).decode(encoding_format_utf_8)
+ else:
+ user_data = user_data.decode(encoding_format_utf_8)
+ except UnicodeDecodeError as error:
+ logger.warning(
+ f"{template.region} -- Unable to decode User Data in EC2 Launch Template {template.name} version {version.version_number}: {error}"
+ )
+ undecodable_versions.setdefault(template_index, []).append(
+ version.version_number
+ )
+ continue
+ except Exception as error:
+ logger.error(
+ f"{template.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ undecodable_versions.setdefault(template_index, []).append(
+ version.version_number
+ )
+ continue
+ yield (template_index, version_index), user_data
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for template_index, template in enumerate(templates):
report = Check_Report_AWS(metadata=self.metadata(), resource=template)
- versions_with_secrets = []
-
- for version in template.versions:
- if not version.template_data.user_data:
- continue
- user_data = b64decode(version.template_data.user_data)
-
- try:
- if user_data[0:2] == b"\x1f\x8b": # GZIP magic number
- user_data = zlib.decompress(
- user_data, zlib.MAX_WBITS | 32
- ).decode(encoding_format_utf_8)
- else:
- user_data = user_data.decode(encoding_format_utf_8)
- except UnicodeDecodeError as error:
- logger.warning(
- f"{template.region} -- Unable to decode User Data in EC2 Launch Template {template.name} version {version.version_number}: {error}"
- )
- continue
- except Exception as error:
- logger.error(
- f"{template.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
- )
- continue
-
- version_secrets = detect_secrets_scan(
- data=user_data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=ec2_client.audit_config.get(
- "detect_secrets_plugins"
- ),
+ if scan_error and any(
+ version.template_data.user_data for version in template.versions
+ ):
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan EC2 Launch Template {template.name} User Data "
+ f"for secrets: {scan_error}; manual review is required."
)
+ findings.append(report)
+ continue
+ versions_with_secrets = []
+ all_secrets = []
+
+ for version_index, version in enumerate(template.versions):
+ version_secrets = batch_results.get((template_index, version_index))
if version_secrets:
+ all_secrets.extend(version_secrets)
secrets_string = ", ".join(
[
f"{secret['type']} on line {secret['line_number']}"
@@ -61,9 +99,14 @@ class ec2_launch_template_no_secrets(Check):
f"Version {version.version_number}: {secrets_string}"
)
+ undecodable = undecodable_versions.get(template_index, [])
if len(versions_with_secrets) > 0:
report.status = "FAIL"
report.status_extended = f"Potential secret found in User Data for EC2 Launch Template {template.name} in template versions: {', '.join(versions_with_secrets)}."
+ annotate_verified_secrets(report, all_secrets)
+ elif undecodable:
+ report.status = "MANUAL"
+ report.status_extended = f"Could not decode User Data for EC2 Launch Template {template.name} versions: {', '.join(str(version_number) for version_number in undecodable)}; manual review is required to scan for secrets."
else:
report.status = "PASS"
report.status_extended = f"No secrets found in User Data of any version for EC2 Launch Template {template.name}."
diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py
index aa621abdfb..c45693c498 100644
--- a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py
+++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py
@@ -15,11 +15,10 @@ class ec2_securitygroup_not_used(Check):
report.resource_details = security_group.name
report.status = "PASS"
report.status_extended = f"Security group {security_group.name} ({security_group.id}) it is being used."
- sg_in_lambda = False
+ sg_in_lambda = (
+ security_group.id in awslambda_client.security_groups_in_use
+ )
sg_associated = False
- for function in awslambda_client.functions.values():
- if security_group.id in function.security_groups:
- sg_in_lambda = True
for sg in ec2_client.security_groups.values():
if security_group.id in sg.associated_sgs:
sg_associated = True
diff --git a/prowler/providers/aws/services/ec2/ec2_service.py b/prowler/providers/aws/services/ec2/ec2_service.py
index ccdb9e58fe..1c1055ba78 100644
--- a/prowler/providers/aws/services/ec2/ec2_service.py
+++ b/prowler/providers/aws/services/ec2/ec2_service.py
@@ -6,9 +6,15 @@ from botocore.client import ClientError
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ limit_resources,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
+DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE = 200
+
class EC2(AWSService):
def __init__(self, provider):
@@ -26,22 +32,31 @@ class EC2(AWSService):
self.snapshots = []
self.volumes_with_snapshots = {}
self.regions_with_snapshots = {}
+ # Snapshots are listed first, then limited after per-region snapshot
+ # presence is derived and before public status is hydrated.
+ self.snapshot_limit = get_resource_scan_limit(
+ self.audit_config, "max_ebs_snapshots"
+ )
self.__threading_call__(self._describe_snapshots)
- self.__threading_call__(self._determine_public_snapshots, self.snapshots)
self.network_interfaces = {}
self.__threading_call__(self._describe_network_interfaces)
self.images = []
+ self.images_by_id = {}
self.__threading_call__(self._describe_images)
self.volumes = []
self.__threading_call__(self._describe_volumes)
self.attributes_for_regions = {}
self.__threading_call__(self._get_resources_for_regions)
+ self._select_snapshots_for_analysis()
+ self.__threading_call__(self._determine_public_snapshots, self.snapshots)
self.ebs_encryption_by_default = []
self.__threading_call__(self._get_ebs_encryption_settings)
self.elastic_ips = []
self.__threading_call__(self._describe_ec2_addresses)
self.ebs_block_public_access_snapshots_states = []
self.__threading_call__(self._get_snapshot_block_public_access_state)
+ self.ami_block_public_access_states = []
+ self.__threading_call__(self._get_ami_block_public_access_state)
self.instance_metadata_defaults = []
self.__threading_call__(self._get_instance_metadata_defaults)
self.launch_templates = []
@@ -207,6 +222,7 @@ class EC2(AWSService):
arn=arn,
region=regional_client.region,
encrypted=snapshot.get("Encrypted", False),
+ start_time=snapshot.get("StartTime"),
tags=snapshot.get("Tags"),
volume=snapshot["VolumeId"],
)
@@ -243,6 +259,18 @@ class EC2(AWSService):
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _select_snapshots_for_analysis(self):
+ self.snapshots = list(
+ limit_resources(
+ sorted(
+ self.snapshots,
+ key=lambda s: (s.start_time.timestamp() if s.start_time else 0.0),
+ reverse=True,
+ ),
+ self.snapshot_limit,
+ )
+ )
+
def _describe_network_interfaces(self, regional_client):
try:
# Get Network Interfaces with Public IPs
@@ -349,36 +377,90 @@ class EC2(AWSService):
def _describe_images(self, regional_client):
try:
- for owner in ["self", "amazon"]:
- try:
- for image in regional_client.describe_images(
- Owners=[owner], IncludeDeprecated=True
- )["Images"]:
- arn = f"arn:{self.audited_partition}:ec2:{regional_client.region}:{self.audited_account}:image/{image['ImageId']}"
- if not self.audit_resources or (
- is_resource_filtered(arn, self.audit_resources)
- ):
- self.images.append(
- Image(
- id=image["ImageId"],
- arn=arn,
- name=image.get("Name", ""),
- public=image.get("Public", False),
- region=regional_client.region,
- tags=image.get("Tags"),
- deprecation_time=image.get("DeprecationTime"),
- owner=owner,
- )
- )
- except Exception as error:
- logger.error(
- f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
- )
+ try:
+ for image in regional_client.describe_images(
+ Owners=["self"], IncludeDeprecated=True
+ )["Images"]:
+ self._add_image(image, regional_client.region, "self")
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ amazon_image_ids = sorted(
+ {
+ instance.image_id
+ for instance in self.instances
+ if instance.region == regional_client.region
+ and instance.image_id
+ and instance.image_id not in self.images_by_id
+ }
+ )
+
+ for image_batch in self._get_image_id_batches(amazon_image_ids):
+ for image in self._describe_images_by_id(regional_client, image_batch):
+ if self._is_amazon_image(image):
+ self._add_image(image, regional_client.region, "amazon")
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _add_image(self, image, region, owner):
+ arn = f"arn:{self.audited_partition}:ec2:{region}:{self.audited_account}:image/{image['ImageId']}"
+ if not self.audit_resources or (
+ is_resource_filtered(arn, self.audit_resources)
+ ):
+ ec2_image = Image(
+ id=image["ImageId"],
+ arn=arn,
+ name=image.get("Name", ""),
+ public=image.get("Public", False),
+ region=region,
+ tags=image.get("Tags"),
+ deprecation_time=image.get("DeprecationTime"),
+ owner=owner,
+ )
+ self.images.append(ec2_image)
+ self.images_by_id[ec2_image.id] = ec2_image
+
+ def _describe_images_by_id(self, regional_client, image_ids):
+ try:
+ return regional_client.describe_images(
+ ImageIds=image_ids, IncludeDeprecated=True
+ )["Images"]
+ except ClientError as error:
+ if error.response["Error"]["Code"] == "InvalidAMIID.NotFound":
+ if len(image_ids) == 1:
+ logger.warning(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return []
+
+ midpoint = len(image_ids) // 2
+ return self._describe_images_by_id(
+ regional_client, image_ids[:midpoint]
+ ) + self._describe_images_by_id(regional_client, image_ids[midpoint:])
+
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return []
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return []
+
+ @staticmethod
+ def _get_image_id_batches(image_ids):
+ for index in range(0, len(image_ids), DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE):
+ yield image_ids[index : index + DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE]
+
+ @staticmethod
+ def _is_amazon_image(image):
+ return image.get("ImageOwnerAlias") == "amazon"
+
def _describe_volumes(self, regional_client):
try:
describe_volumes_paginator = regional_client.get_paginator(
@@ -475,6 +557,21 @@ class EC2(AWSService):
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _get_ami_block_public_access_state(self, regional_client):
+ try:
+ self.ami_block_public_access_states.append(
+ AmiBlockPublicAccess(
+ status=regional_client.get_image_block_public_access_state()[
+ "ImageBlockPublicAccessState"
+ ],
+ region=regional_client.region,
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
def _get_instance_metadata_defaults(self, regional_client):
try:
instances_in_region = self.attributes_for_regions.get(
@@ -686,6 +783,7 @@ class Snapshot(BaseModel):
region: str
encrypted: bool
public: bool = False
+ start_time: Optional[datetime] = None
tags: Optional[list] = []
volume: Optional[str]
@@ -774,6 +872,11 @@ class EbsSnapshotBlockPublicAccess(BaseModel):
region: str
+class AmiBlockPublicAccess(BaseModel):
+ status: str
+ region: str
+
+
class InstanceMetadataDefaults(BaseModel):
http_tokens: Optional[str]
instances: bool
diff --git a/prowler/providers/aws/services/ecs/ecs_service.py b/prowler/providers/aws/services/ecs/ecs_service.py
index 560125bf58..65c3aabf56 100644
--- a/prowler/providers/aws/services/ecs/ecs_service.py
+++ b/prowler/providers/aws/services/ecs/ecs_service.py
@@ -1,9 +1,16 @@
+from datetime import datetime
+from itertools import zip_longest
from re import sub
from typing import Optional
from pydantic.v1 import BaseModel
from prowler.lib.logger import logger
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ iter_limited_paginator_items,
+ limit_resources,
+)
from prowler.lib.scan_filters.scan_filters import is_resource_filtered
from prowler.providers.aws.lib.service.service import AWSService
@@ -12,40 +19,126 @@ class ECS(AWSService):
def __init__(self, provider):
# Call AWSService's __init__
super().__init__(__class__.__name__, provider)
+ # Task definition ARNs are listed first, then only the selected subset
+ # is described and exposed for checks.
self.task_definitions = {}
+ self._task_definition_arns = None
+ self._task_definition_arns_by_region = {}
+ self.task_definition_limit = get_resource_scan_limit(
+ self.audit_config, "max_ecs_task_definitions"
+ )
self.services = {}
self.clusters = {}
self.task_sets = {}
- self.__threading_call__(self._list_task_definitions)
- self.__threading_call__(
- self._describe_task_definition, self.task_definitions.values()
- )
+ for _ in self._load_task_definitions_for_analysis():
+ pass
self.__threading_call__(self._list_clusters)
self.__threading_call__(self._describe_clusters, self.clusters.values())
self.__threading_call__(self._describe_services, self.clusters.values())
- def _list_task_definitions(self, regional_client):
+ def _list_task_definition_arns(self) -> list:
+ """List task definition ARNs newest-first, memoized.
+
+ AWS returns ``list_task_definitions(sort=DESC)`` results per region.
+ Prowler limits the task definitions it describes and exposes to checks.
+ """
+ if self._task_definition_arns is not None:
+ return self._task_definition_arns
logger.info("ECS - Listing Task Definitions...")
+ self.__threading_call__(self._list_task_definition_arns_by_region)
+ arns_by_region = []
+ for region in self.regional_clients:
+ arns_by_region.append(self._task_definition_arns_by_region.get(region, []))
+ arns = []
+ for task_definition_batch in zip_longest(*arns_by_region):
+ for task_definition in task_definition_batch:
+ if task_definition:
+ arns.append(task_definition)
+ self._task_definition_arns = arns
+ return arns
+
+ def _list_task_definition_arns_by_region(self, regional_client):
try:
list_ecs_paginator = regional_client.get_paginator("list_task_definitions")
- for page in list_ecs_paginator.paginate():
- for task_definition in page["taskDefinitionArns"]:
- if not self.audit_resources or (
- is_resource_filtered(task_definition, self.audit_resources)
- ):
- self.task_definitions[task_definition] = TaskDefinition(
- # we want the family name without the revision
- name=sub(":.*", "", task_definition.split("/")[-1]),
- arn=task_definition,
- revision=task_definition.split(":")[-1],
- region=regional_client.region,
- environment_variables=[],
- )
+ regional_arns = []
+ for task_definition in iter_limited_paginator_items(
+ list_ecs_paginator,
+ "taskDefinitionArns",
+ None,
+ item_filter=lambda task_definition: not self.audit_resources
+ or is_resource_filtered(task_definition, self.audit_resources),
+ sort="DESC",
+ ):
+ regional_arns.append((task_definition, regional_client.region))
+ self._task_definition_arns_by_region[regional_client.region] = regional_arns
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _load_task_definitions_for_analysis(self):
+ """Yield task definitions lazily, describing each one on demand.
+
+ Resources already fetched are memoized in ``self.task_definitions`` and
+ reused across checks (checks run sequentially, so no locking is needed).
+ Task definitions are described before applying the configured resource
+ limit because AWS exposes ``registeredAt`` only through
+ ``describe_task_definition``. The limit bounds the task definitions
+ exposed to checks for analysis.
+ """
+ task_definitions = []
+ for arn, region in self._list_task_definition_arns():
+ task_definition = self.task_definitions.get(arn)
+ if task_definition is None:
+ task_definition = TaskDefinition(
+ # we want the family name without the revision
+ name=sub(":.*", "", arn.split("/")[-1]),
+ arn=arn,
+ revision=arn.split(":")[-1],
+ region=region,
+ environment_variables=[],
+ )
+ self.task_definitions[arn] = task_definition
+ task_definitions.append(task_definition)
+
+ self.__threading_call__(self._describe_task_definition, task_definitions)
+
+ selected_task_definitions = list(
+ limit_resources(
+ self._sort_task_definitions_by_registration_date(
+ self.task_definitions.values()
+ ),
+ self.task_definition_limit,
+ )
+ )
+ self.task_definitions = {
+ task_definition.arn: task_definition
+ for task_definition in selected_task_definitions
+ }
+ for task_definition in selected_task_definitions:
+ yield task_definition
+
+ @staticmethod
+ def _sort_task_definitions_by_registration_date(task_definitions):
+ task_definitions = list(task_definitions)
+ if not any(
+ task_definition.registered_at for task_definition in task_definitions
+ ):
+ return task_definitions
+
+ return sorted(
+ task_definitions,
+ key=lambda task_definition: (
+ task_definition.registered_at is None,
+ (
+ -task_definition.registered_at.timestamp()
+ if task_definition.registered_at
+ else 0
+ ),
+ task_definition.arn,
+ ),
+ )
+
def _describe_task_definition(self, task_definition):
logger.info("ECS - Describing Task Definition...")
try:
@@ -84,6 +177,9 @@ class ECS(AWSService):
)
)
task_definition.pid_mode = response["taskDefinition"].get("pidMode", "")
+ task_definition.registered_at = response["taskDefinition"].get(
+ "registeredAt"
+ )
task_definition.tags = response.get("tags")
task_definition.network_mode = response["taskDefinition"].get(
"networkMode", "bridge"
@@ -208,6 +304,7 @@ class TaskDefinition(BaseModel):
region: str
container_definitions: list[ContainerDefinition] = []
pid_mode: Optional[str]
+ registered_at: Optional[datetime] = None
tags: Optional[list] = []
network_mode: Optional[str]
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
index cd835d0149..b0bc7198ee 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
@@ -1,7 +1,11 @@
from json import dumps
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.ecs.ecs_client import ecs_client
@@ -11,33 +15,67 @@ class ecs_task_definitions_no_environment_secrets(Check):
secrets_ignore_patterns = ecs_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for task_definition in ecs_client.task_definitions.values():
+ validate = ecs_client.audit_config.get("secrets_validate", False)
+ task_definitions = list(ecs_client.task_definitions.values())
+
+ # Scan every (task definition, container) environment in batched
+ # Kingfisher invocations instead of one subprocess per container.
+ # Payloads are yielded lazily so only a chunk is held/written at a time.
+ def environment_payloads():
+ for td_index, task_definition in enumerate(task_definitions):
+ for c_index, container in enumerate(
+ task_definition.container_definitions
+ ):
+ if container.environment:
+ dump_env_vars = {
+ env_var.name: env_var.value
+ for env_var in container.environment
+ }
+ yield (td_index, c_index), dumps(dump_env_vars, indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ environment_payloads(),
+ excluded_secrets=secrets_ignore_patterns,
+ validate=validate,
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for td_index, task_definition in enumerate(task_definitions):
report = Check_Report_AWS(
metadata=self.metadata(), resource=task_definition
)
report.resource_id = f"{task_definition.name}:{task_definition.revision}"
report.status = "PASS"
extended_status_parts = []
+ all_secrets = []
- for container in task_definition.container_definitions:
+ if scan_error and any(
+ container.environment
+ for container in task_definition.container_definitions
+ ):
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan ECS task definition {task_definition.name} with "
+ f"revision {task_definition.revision} for secrets: {scan_error}; "
+ "manual review is required."
+ )
+ findings.append(report)
+ continue
+
+ for c_index, container in enumerate(task_definition.container_definitions):
container_secrets_found = []
if container.environment:
- dump_env_vars = {}
- original_env_vars = []
- for env_var in container.environment:
- dump_env_vars.update({env_var.name: env_var.value})
- original_env_vars.append(env_var.name)
-
- env_data = dumps(dump_env_vars, indent=2)
- detect_secrets_output = detect_secrets_scan(
- data=env_data,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=ecs_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
+ original_env_vars = [
+ env_var.name for env_var in container.environment
+ ]
+ detect_secrets_output = batch_results.get((td_index, c_index))
if detect_secrets_output:
+ all_secrets.extend(detect_secrets_output)
secrets_string = ", ".join(
[
f"{secret['type']} on the environment variable {original_env_vars[secret['line_number'] - 2]}"
@@ -56,6 +94,7 @@ class ecs_task_definitions_no_environment_secrets(Check):
+ "; ".join(extended_status_parts)
+ "."
)
+ annotate_verified_secrets(report, all_secrets)
else:
report.status_extended = f"No secrets found in variables of ECS task definition {task_definition.name} with revision {task_definition.revision}."
findings.append(report)
diff --git a/tests/lib/outputs/compliance/kisa_ismsp/__init__.py b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/kisa_ismsp/__init__.py
rename to prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.py
diff --git a/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json
new file mode 100644
index 0000000000..d86778d5ae
--- /dev/null
+++ b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json
@@ -0,0 +1,42 @@
+{
+ "Provider": "aws",
+ "CheckID": "elbv2_listener_pqc_tls_enabled",
+ "CheckTitle": "ELBv2 HTTPS/TLS listeners use a post-quantum TLS security policy",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices"
+ ],
+ "ServiceName": "elbv2",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "low",
+ "ResourceType": "AwsElbv2LoadBalancer",
+ "ResourceGroup": "network",
+ "Description": "**ELBv2 HTTPS and TLS listeners** are assessed for use of **post-quantum (PQ) TLS security policies**. Listeners whose `SslPolicy` is not in the approved PQ set lack hybrid key exchange (ML-KEM 768 + ECDHE), which can increase harvest-now-decrypt-later exposure for recorded traffic.",
+ "Risk": "Without PQ-ready TLS policies, encrypted traffic captured today may be stored for future cryptanalysis if a **cryptographically relevant quantum computer** becomes available (**harvest-now, decrypt-later** attack). PQ-ready TLS policies reduce this long-term confidentiality risk for sensitive data, credentials, and session tokens transmitted through the load balancer.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html",
+ "https://aws.amazon.com/security/post-quantum-cryptography/",
+ "https://csrc.nist.gov/projects/post-quantum-cryptography"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws elbv2 modify-listener --listener-arn <listener_arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ "NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::ElasticLoadBalancingV2::Listener\n Properties:\n LoadBalancerArn: <example_resource_arn>\n Protocol: HTTPS\n Port: 443\n DefaultActions:\n - Type: forward\n TargetGroupArn: <example_resource_arn>\n Certificates:\n - CertificateArn: <example_certificate_arn>\n SslPolicy: ELBSecurityPolicy-TLS13-1-2-PQ-2025-09 # FIX: uses a post-quantum TLS policy\n```",
+ "Other": "1. In the AWS Console, go to EC2 > Load Balancers\n2. Select the load balancer and open the Listeners tab\n3. Select the HTTPS/TLS listener and choose Edit\n4. Set Security policy to ELBSecurityPolicy-TLS13-1-2-PQ-2025-09 (or any approved PQ policy)\n5. Save changes",
+ "Terraform": "```hcl\nresource \"aws_lb_listener\" \"<example_resource_name>\" {\n load_balancer_arn = \"<example_resource_arn>\"\n port = 443\n protocol = \"HTTPS\"\n ssl_policy = \"ELBSecurityPolicy-TLS13-1-2-PQ-2025-09\" # FIX: post-quantum TLS policy\n certificate_arn = \"<example_certificate_arn>\"\n\n default_action {\n type = \"forward\"\n target_group_arn = \"<example_resource_arn>\"\n }\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Migrate all ELBv2 HTTPS and TLS listeners to a **post-quantum TLS policy** (`ELBSecurityPolicy-TLS13-*-PQ-2025-09` family) to enable hybrid key exchange (ML-KEM + ECDHE). Periodically review and update policies as AWS publishes new PQ-ready options.",
+ "Url": "https://hub.prowler.com/check/elbv2_listener_pqc_tls_enabled"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [
+ "elbv2_insecure_ssl_ciphers"
+ ],
+ "Notes": ""
+}
diff --git a/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py
new file mode 100644
index 0000000000..270a2cc31b
--- /dev/null
+++ b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py
@@ -0,0 +1,73 @@
+"""Check that ELBv2 HTTPS/TLS listeners use post-quantum TLS policies."""
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
+
+PQ_TLS_POLICIES_DEFAULT = [
+ "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+]
+
+
+class elbv2_listener_pqc_tls_enabled(Check):
+ """Verify that every ELBv2 HTTPS or TLS listener uses a post-quantum TLS policy.
+
+ This check evaluates whether each HTTPS (ALB) or TLS (NLB) listener on an
+ ELBv2 load balancer terminates TLS with a security policy that offers
+ post-quantum (PQ) hybrid key exchange (ML-KEM 768 combined with ECDHE).
+ - PASS: All HTTPS/TLS listeners on the load balancer use a PQ TLS policy.
+ - FAIL: At least one HTTPS/TLS listener uses a non-PQ TLS policy.
+ """
+
+ def execute(self) -> list[Check_Report_AWS]:
+ """Execute the PQ TLS policy check for every ELBv2 load balancer.
+
+ Returns:
+ A list of reports for load balancers with discovered listeners.
+ """
+ findings = []
+ pq_tls_policies = elbv2_client.audit_config.get(
+ "elbv2_listener_pqc_tls_allowed_policies", PQ_TLS_POLICIES_DEFAULT
+ )
+ for lb in elbv2_client.loadbalancersv2.values():
+ report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
+
+ if lb.listener_discovery_failed:
+ continue
+
+ has_tls_listeners = False
+ non_pq_listeners = []
+ for listener_arn, listener in lb.listeners.items():
+ if listener.protocol in ("HTTPS", "TLS"):
+ has_tls_listeners = True
+ if listener.ssl_policy not in pq_tls_policies:
+ ssl_policy = listener.ssl_policy or "<none>"
+ non_pq_listeners.append(
+ f"{listener.protocol}:{listener.port} ({listener_arn}) uses {ssl_policy}"
+ )
+
+ if not has_tls_listeners:
+ report.status = "PASS"
+ report.status_extended = f"ELBv2 {lb.name} has no HTTPS/TLS listeners."
+ findings.append(report)
+ continue
+
+ if non_pq_listeners:
+ report.status = "FAIL"
+ report.status_extended = f"ELBv2 {lb.name} has HTTPS/TLS listeners without post-quantum TLS policy: {', '.join(non_pq_listeners)}."
+ else:
+ report.status = "PASS"
+ report.status_extended = f"ELBv2 {lb.name} has all HTTPS/TLS listeners using a post-quantum TLS policy."
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/elbv2/elbv2_service.py b/prowler/providers/aws/services/elbv2/elbv2_service.py
index c52110869f..e2d9bd3682 100644
--- a/prowler/providers/aws/services/elbv2/elbv2_service.py
+++ b/prowler/providers/aws/services/elbv2/elbv2_service.py
@@ -86,10 +86,14 @@ class ELBv2(AWSService):
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
else:
+ load_balancer[1].listener_discovery_failed = True
+ load_balancer[1].listener_discovery_error = str(error)
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
except Exception as error:
+ load_balancer[1].listener_discovery_failed = True
+ load_balancer[1].listener_discovery_error = str(error)
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
@@ -209,6 +213,8 @@ class LoadBalancerv2(BaseModel):
drop_invalid_header_fields: Optional[str]
cross_zone_load_balancing: Optional[str]
listeners: Dict[str, Listenerv2] = {}
+ listener_discovery_failed: bool = False
+ listener_discovery_error: Optional[str] = None
scheme: Optional[str]
security_groups: list[str] = []
# Key: ZoneName, Value: SubnetId
diff --git a/prowler/providers/aws/services/glue/glue_etl_jobs_no_secrets_in_arguments/glue_etl_jobs_no_secrets_in_arguments.py b/prowler/providers/aws/services/glue/glue_etl_jobs_no_secrets_in_arguments/glue_etl_jobs_no_secrets_in_arguments.py
index 50c92f8619..fec480efb1 100644
--- a/prowler/providers/aws/services/glue/glue_etl_jobs_no_secrets_in_arguments/glue_etl_jobs_no_secrets_in_arguments.py
+++ b/prowler/providers/aws/services/glue/glue_etl_jobs_no_secrets_in_arguments/glue_etl_jobs_no_secrets_in_arguments.py
@@ -1,52 +1,83 @@
-import json
-
-from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
-from prowler.providers.aws.services.glue.glue_client import glue_client
-
-
-class glue_etl_jobs_no_secrets_in_arguments(Check):
- """Check if Glue ETL jobs have secrets in their default arguments.
-
- Scans the DefaultArguments of each Glue job for hardcoded credentials,
- tokens, passwords, and other sensitive values that should be stored in
- Secrets Manager or Parameter Store instead.
- """
-
- def execute(self):
- findings = []
- secrets_ignore_patterns = glue_client.audit_config.get(
- "secrets_ignore_patterns", []
- )
- for job in glue_client.jobs:
- report = Check_Report_AWS(metadata=self.metadata(), resource=job)
- report.status = "PASS"
- report.status_extended = (
- f"No secrets found in Glue job {job.name} default arguments."
- )
-
- if job.arguments:
- secrets_found = []
- for arg_name, arg_value in job.arguments.items():
- detect_secrets_output = detect_secrets_scan(
- data=json.dumps({arg_name: arg_value}),
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=glue_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
- if detect_secrets_output:
- secrets_found.extend(
- [
- f"{secret['type']} in argument {arg_name}"
- for secret in detect_secrets_output
- ]
- )
-
- if secrets_found:
- report.status = "FAIL"
- report.status_extended = f"Potential secrets found in Glue job {job.name} default arguments: {', '.join(secrets_found)}."
-
- findings.append(report)
-
- return findings
+import json
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
+from prowler.providers.aws.services.glue.glue_client import glue_client
+
+
+class glue_etl_jobs_no_secrets_in_arguments(Check):
+ """Check if Glue ETL jobs have secrets in their default arguments.
+
+ Scans the DefaultArguments of each Glue job for hardcoded credentials,
+ tokens, passwords, and other sensitive values that should be stored in
+ Secrets Manager or Parameter Store instead.
+ """
+
+ def execute(self):
+ findings = []
+ secrets_ignore_patterns = glue_client.audit_config.get(
+ "secrets_ignore_patterns", []
+ )
+ validate = glue_client.audit_config.get("secrets_validate", False)
+ jobs = list(glue_client.jobs)
+
+ # Collect every default argument across all jobs and scan them in batched
+ # Kingfisher invocations instead of one subprocess per argument. Findings
+ # are keyed by (job index, argument name).
+ def payloads():
+ for job_index, job in enumerate(jobs):
+ if job.arguments:
+ for arg_name, arg_value in job.arguments.items():
+ yield (job_index, arg_name), json.dumps({arg_name: arg_value})
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for job_index, job in enumerate(jobs):
+ report = Check_Report_AWS(metadata=self.metadata(), resource=job)
+ report.status = "PASS"
+ report.status_extended = (
+ f"No secrets found in Glue job {job.name} default arguments."
+ )
+
+ if job.arguments and scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Glue job {job.name} default arguments for "
+ f"secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+
+ if job.arguments:
+ secrets_found = []
+ all_secrets = []
+ for arg_name in job.arguments:
+ detect_secrets_output = batch_results.get((job_index, arg_name))
+ if detect_secrets_output:
+ all_secrets.extend(detect_secrets_output)
+ secrets_found.extend(
+ [
+ f"{secret['type']} in argument {arg_name}"
+ for secret in detect_secrets_output
+ ]
+ )
+
+ if secrets_found:
+ report.status = "FAIL"
+ report.status_extended = f"Potential secrets found in Glue job {job.name} default arguments: {', '.join(secrets_found)}."
+ annotate_verified_secrets(report, all_secrets)
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/iam/lib/privilege_escalation.py b/prowler/providers/aws/services/iam/lib/privilege_escalation.py
index 9fded2d5c9..d7f16895d5 100644
--- a/prowler/providers/aws/services/iam/lib/privilege_escalation.py
+++ b/prowler/providers/aws/services/iam/lib/privilege_escalation.py
@@ -19,6 +19,7 @@ from prowler.providers.aws.services.iam.lib.policy import get_effective_actions
# - https://github.com/RhinoSecurityLabs/Security-Research/blob/master/tools/aws-pentest-tools/aws_escalate.py
# - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
# - https://github.com/DataDog/pathfinding.cloud (AWS IAM Privilege Escalation Path Library)
+# - https://www.beyondtrust.com/blog/entry/aws-agentcore-privilege-escalation (AWS Bedrock AgentCore)
privilege_escalation_policies_combination = {
# IAM self-escalation and policy manipulation
@@ -299,6 +300,7 @@ privilege_escalation_policies_combination = {
"PassRole+AgentCoreCreateInterpreter+InvokeInterpreter": {
"iam:PassRole",
"bedrock-agentcore:CreateCodeInterpreter",
+ "bedrock-agentcore:StartCodeInterpreterSession",
"bedrock-agentcore:InvokeCodeInterpreter",
},
# Prerequisite: Existing Bedrock code interpreter with admin role
@@ -306,6 +308,40 @@ privilege_escalation_policies_combination = {
"bedrock-agentcore:StartCodeInterpreterSession",
"bedrock-agentcore:InvokeCodeInterpreter",
},
+ # Prerequisite: Existing AgentCore Runtime or Harness with admin execution role.
+ # InvokeAgentRuntimeCommand runs shell commands as root inside the microVM and
+ # reads the execution role credentials from MMDS, bypassing the agent and guardrails.
+ "AgentCoreInvokeRuntimeCommand": {
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ },
+ "PassRole+AgentCoreCreateRuntime+InvokeRuntimeCommand": {
+ "iam:PassRole",
+ "bedrock-agentcore:CreateAgentRuntime",
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ },
+ "PassRole+AgentCoreCreateHarness+InvokeRuntimeCommand": {
+ "iam:PassRole",
+ "bedrock-agentcore:CreateHarness",
+ "bedrock-agentcore:CreateAgentRuntime",
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ "bedrock-agentcore:GetAgentRuntime",
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ },
+ # Prerequisite: Existing AgentCore Custom Browser with admin execution role.
+ # A remote CDP driver on the browser session reads the role credentials from MMDS.
+ "AgentCoreBrowserSessionConnect": {
+ "bedrock-agentcore:StartBrowserSession",
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ },
+ "PassRole+AgentCoreCreateBrowser+ConnectBrowser": {
+ "iam:PassRole",
+ "bedrock-agentcore:CreateBrowser",
+ "bedrock-agentcore:StartBrowserSession",
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ },
# TO-DO: We have to handle AssumeRole just if the resource is * and without conditions
# "sts:AssumeRole": {"sts:AssumeRole"},
}
diff --git a/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py b/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py
index a9f5efbedd..fd414badfa 100644
--- a/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py
+++ b/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py
@@ -15,11 +15,10 @@ class inspector2_is_enabled(Check):
if inspector.status == "ENABLED":
report.status = "PASS"
report.status_extended = "Inspector2 is enabled for EC2 instances, ECR container images, Lambda functions and code."
- funtions_in_region = False
+ functions_in_region = (
+ inspector.region in awslambda_client.regions_with_functions
+ )
ec2_in_region = False
- for function in awslambda_client.functions.values():
- if function.region == inspector.region:
- funtions_in_region = True
for instance in ec2_client.instances:
if instance == inspector.region:
ec2_in_region = True
@@ -36,12 +35,12 @@ class inspector2_is_enabled(Check):
failed_services.append("ECR")
if inspector.lambda_status != "ENABLED" and (
inspector2_client.provider.scan_unused_services
- or funtions_in_region
+ or functions_in_region
):
failed_services.append("Lambda")
if inspector.lambda_code_status != "ENABLED" and (
inspector2_client.provider.scan_unused_services
- or funtions_in_region
+ or functions_in_region
):
failed_services.append("Lambda Code")
diff --git a/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py b/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py
index cced82a762..1b676ff0b5 100644
--- a/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py
+++ b/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py
@@ -67,7 +67,7 @@ class organizations_scp_check_deny_regions(Check):
# Allow if Condition = {"StringEquals": {"aws:RequestedRegion": [region1, region2]}}
if (
- policy.content.get("Statement") == "Allow"
+ statement.get("Effect") == "Allow"
and "Condition" in statement
and "StringEquals" in statement["Condition"]
and "aws:RequestedRegion"
diff --git a/tests/lib/outputs/compliance/mitre_attack/__init__.py b/prowler/providers/aws/services/s3/s3_bucket_object_public/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/mitre_attack/__init__.py
rename to prowler/providers/aws/services/s3/s3_bucket_object_public/__init__.py
diff --git a/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.metadata.json
new file mode 100644
index 0000000000..197a5aa205
--- /dev/null
+++ b/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.metadata.json
@@ -0,0 +1,37 @@
+{
+ "Provider": "aws",
+ "CheckID": "s3_bucket_object_public",
+ "CheckTitle": "Spot-check S3 bucket objects for public ACLs",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Effects/Data Exposure"
+ ],
+ "ServiceName": "s3",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:s3:::resource",
+ "Severity": "low",
+ "ResourceType": "AwsS3Bucket",
+ "Description": "Spot-checks a configurable sample of objects in each S3 bucket and flags any whose ACL grants access to the AllUsers or AuthenticatedUsers groups. This is a sampling-based check, not a comprehensive audit, so public objects outside the sample can be missed. It is disabled by default and must be enabled via the s3_bucket_object_public_enabled configuration flag.",
+ "Risk": "Public objects can be accessed by anyone on the internet, potentially leaking sensitive data. A bucket can appear private at the bucket-policy level while still containing individual objects with public ACL grants.",
+ "RelatedUrl": "",
+ "Remediation": {
+ "Code": {
+ "CLI": "aws s3api put-object-acl --bucket <bucket_name> --key <object_key> --acl private",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "For complete coverage, enable the s3_bucket_acl_prohibited check, which enforces the BucketOwnerEnforced Object Ownership setting (AWS's recommended approach since April 2023) and prevents public object ACLs entirely. Use this spot-check as a supplementary tool for manual assessments.",
+ "Url": "https://hub.prowler.com/check/s3_bucket_object_public"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [
+ "s3_bucket_acl_prohibited"
+ ],
+ "Notes": "Disabled by default. Configure s3_bucket_object_public_enabled, s3_bucket_object_public_max_objects, and s3_bucket_object_public_sample_size in the Prowler configuration. Because only a sample of objects is inspected, a PASS does not guarantee the bucket is free of public objects; use s3_bucket_acl_prohibited for full assurance."
+}
diff --git a/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.py b/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.py
new file mode 100644
index 0000000000..9912da561b
--- /dev/null
+++ b/prowler/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public.py
@@ -0,0 +1,82 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.s3.s3_client import s3_client
+
+# ACL grantee groups that make an object effectively public. AllUsers is anyone on
+# the internet; AuthenticatedUsers is any authenticated AWS principal (any account).
+PUBLIC_ACL_URIS = {
+ "http://acs.amazonaws.com/groups/global/AllUsers",
+ "http://acs.amazonaws.com/groups/global/AuthenticatedUsers",
+}
+
+
+class s3_bucket_object_public(Check):
+ """Spot-check a sample of S3 bucket objects for public ACL grants."""
+
+ def execute(self) -> List[Check_Report_AWS]:
+ """Evaluate sampled object ACLs for AllUsers/AuthenticatedUsers grants.
+
+ Returns:
+ List[Check_Report_AWS]: One report per sampled bucket (empty when the
+ check is disabled via configuration).
+ """
+ findings = []
+
+ if not s3_client.audit_config.get("s3_bucket_object_public_enabled", False):
+ return findings
+
+ for bucket in s3_client.buckets.values():
+ sampling = bucket.object_sampling
+ # Sampling is populated by the service layer only when the check is
+ # enabled; skip any bucket that was not sampled.
+ if sampling is None or not sampling.performed:
+ continue
+
+ report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
+
+ if sampling.error_code is not None:
+ report.status = "MANUAL"
+ if sampling.error_code == "AccessDenied":
+ report.status_extended = (
+ f"Access Denied when spot-checking objects in bucket "
+ f"{bucket.name}."
+ )
+ else:
+ report.status_extended = (
+ f"Could not spot-check objects in bucket {bucket.name}: "
+ f"{sampling.error_message}."
+ )
+ elif sampling.is_empty:
+ report.status = "PASS"
+ report.status_extended = f"S3 Bucket {bucket.name} is empty."
+ else:
+ public_objects = [
+ obj.key
+ for obj in sampling.objects
+ if any(
+ grantee.type == "Group" and grantee.URI in PUBLIC_ACL_URIS
+ for grantee in obj.grantees
+ )
+ ]
+ sampled = len(sampling.objects)
+
+ if public_objects:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"S3 Bucket {bucket.name} has public objects detected in "
+ f"spot-check sample of {sampled} objects: "
+ f"{', '.join(public_objects)}."
+ )
+ else:
+ report.status = "PASS"
+ report.status_extended = (
+ f"No public objects detected in spot-check sample of "
+ f"{sampled} objects in bucket {bucket.name}. For complete "
+ f"assurance, ensure ACLs are disabled via Object Ownership "
+ f"settings."
+ )
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/s3/s3_service.py b/prowler/providers/aws/services/s3/s3_service.py
index 00605fbe6e..94768138df 100644
--- a/prowler/providers/aws/services/s3/s3_service.py
+++ b/prowler/providers/aws/services/s3/s3_service.py
@@ -36,6 +36,10 @@ class S3(AWSService):
self.__threading_call__(
self._get_bucket_notification_configuration, self.buckets.values()
)
+ # Object-level ACL sampling is expensive and opt-in, so only run it when
+ # the s3_bucket_object_public check is explicitly enabled in the config.
+ if self.audit_config.get("s3_bucket_object_public_enabled", False):
+ self.__threading_call__(self._get_public_objects, self.buckets.values())
def _list_buckets(self, provider):
logger.info("S3 - Listing buckets...")
@@ -487,6 +491,69 @@ class S3(AWSService):
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _get_public_objects(self, bucket):
+ logger.info("S3 - Spot-checking bucket objects for public ACLs...")
+ max_objects = self.audit_config.get("s3_bucket_object_public_max_objects", 100)
+ sample_size = self.audit_config.get("s3_bucket_object_public_sample_size", 3)
+ # Guard against misconfigured non-positive values: a zero sample size would
+ # raise ZeroDivisionError and a negative one would silently sample nothing.
+ if not isinstance(max_objects, int) or max_objects <= 0:
+ max_objects = 100
+ if not isinstance(sample_size, int) or sample_size <= 0:
+ sample_size = 3
+ sampling = BucketObjectSampling(performed=True)
+ regional_client = None
+ try:
+ regional_client = self.regional_clients[bucket.region]
+ contents = regional_client.list_objects_v2(
+ Bucket=bucket.name, MaxKeys=max_objects
+ ).get("Contents", [])
+
+ if not contents:
+ sampling.is_empty = True
+ bucket.object_sampling = sampling
+ return
+
+ all_keys = [obj["Key"] for obj in contents]
+ # Deterministic, evenly-spaced sampling so findings are reproducible
+ # across scans instead of flipping between PASS/FAIL with a random sample.
+ if len(all_keys) <= sample_size:
+ sample_keys = all_keys
+ else:
+ step = len(all_keys) // sample_size
+ sample_keys = [all_keys[i * step] for i in range(sample_size)]
+
+ for key in sample_keys:
+ acl = regional_client.get_object_acl(Bucket=bucket.name, Key=key)
+ grantees = []
+ for grant in acl.get("Grants", []):
+ grant_grantee = grant.get("Grantee", {})
+ grantee = ACL_Grantee(type=grant_grantee.get("Type", ""))
+ grantee.display_name = grant_grantee.get("DisplayName")
+ grantee.ID = grant_grantee.get("ID")
+ grantee.URI = grant_grantee.get("URI")
+ grantee.permission = grant.get("Permission")
+ grantees.append(grantee)
+ sampling.objects.append(ObjectACL(key=key, grantees=grantees))
+
+ bucket.object_sampling = sampling
+ except ClientError as error:
+ sampling.error_code = error.response["Error"]["Code"]
+ sampling.error_message = str(error)
+ bucket.object_sampling = sampling
+ region = regional_client.region if regional_client else bucket.region
+ logger.warning(
+ f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ sampling.error_code = error.__class__.__name__
+ sampling.error_message = str(error)
+ bucket.object_sampling = sampling
+ region = regional_client.region if regional_client else bucket.region
+ logger.error(
+ f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
def _head_bucket(self, bucket_name):
logger.info("S3 - Checking if bucket exists...")
try:
@@ -654,6 +721,19 @@ class PublicAccessBlock(BaseModel):
restrict_public_buckets: bool
+class ObjectACL(BaseModel):
+ key: str
+ grantees: List[ACL_Grantee] = Field(default_factory=list)
+
+
+class BucketObjectSampling(BaseModel):
+ performed: bool = False
+ is_empty: bool = False
+ objects: List[ObjectACL] = Field(default_factory=list)
+ error_code: Optional[str] = None
+ error_message: Optional[str] = None
+
+
class AccessPoint(BaseModel):
arn: str
account_id: str
@@ -703,3 +783,4 @@ class Bucket(BaseModel):
lifecycle: List[LifeCycleRule] = Field(default_factory=list)
replication_rules: List[ReplicationRule] = Field(default_factory=list)
notification_config: Dict = Field(default_factory=dict)
+ object_sampling: Optional[BucketObjectSampling] = None
diff --git a/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py b/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py
index 0ec8502bab..1755c6f736 100644
--- a/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py
+++ b/prowler/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets.py
@@ -1,7 +1,11 @@
import json
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.ssm.ssm_client import ssm_client
@@ -11,7 +15,26 @@ class ssm_document_secrets(Check):
secrets_ignore_patterns = ssm_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for document in ssm_client.documents.values():
+ validate = ssm_client.audit_config.get("secrets_validate", False)
+ documents = list(ssm_client.documents.values())
+
+ # Collect one payload per document (its content) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per document.
+ def payloads():
+ for index, document in enumerate(documents):
+ if document.content:
+ yield index, json.dumps(document.content, indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, document in enumerate(documents):
report = Check_Report_AWS(metadata=self.metadata(), resource=document)
report.status = "PASS"
report.status_extended = (
@@ -19,13 +42,15 @@ class ssm_document_secrets(Check):
)
if document.content:
- detect_secrets_output = detect_secrets_scan(
- data=json.dumps(document.content, indent=2),
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=ssm_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan SSM Document {document.name} for secrets: "
+ f"{scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
secrets_string = ", ".join(
[
@@ -35,6 +60,7 @@ class ssm_document_secrets(Check):
)
report.status = "FAIL"
report.status_extended = f"Potential secret found in SSM Document {document.name} -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
findings.append(report)
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/__init__.py b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/okta_idaas_stig/__init__.py
rename to prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/__init__.py
diff --git a/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.metadata.json b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.metadata.json
new file mode 100644
index 0000000000..14b65b886b
--- /dev/null
+++ b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.metadata.json
@@ -0,0 +1,43 @@
+{
+ "Provider": "aws",
+ "CheckID": "stepfunctions_statemachine_encrypted_with_cmk",
+ "CheckTitle": "Step Functions state machine is encrypted at rest with a customer-managed KMS key",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
+ ],
+ "ServiceName": "stepfunctions",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "AwsStepFunctionStateMachine",
+ "ResourceGroup": "serverless",
+ "Description": "**AWS Step Functions state machines** store execution history and input/output data passed between workflow states. This check verifies that each state machine uses a **customer-managed KMS key** (`CUSTOMER_MANAGED_KMS_KEY`) for encryption at rest rather than the default AWS-owned key.",
+ "Risk": "Without a customer-managed KMS key, execution history containing **sensitive input/output data** is protected only by an AWS-owned key you cannot control, rotate, or revoke. This limits **auditability** via CloudTrail, prevents independent access revocation, and weakens **confidentiality** for regulated workloads.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/step-functions/latest/dg/encryption-at-rest.html",
+ "https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws stepfunctions update-state-machine --state-machine-arn <state-machine-arn> --encryption-configuration '{\"kmsKeyId\": \"<kms-key-id>\", \"type\": \"CUSTOMER_MANAGED_KMS_KEY\", \"kmsDataKeyReusePeriodSeconds\": 300}'",
+ "NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::StepFunctions::StateMachine\n Properties:\n RoleArn: arn:aws:iam::<account-id>:role/<example_role_name>\n DefinitionString: |\n {\"StartAt\":\"Pass\",\"States\":{\"Pass\":{\"Type\":\"Pass\",\"End\":true}}}\n EncryptionConfiguration:\n KmsKeyId: arn:aws:kms:<region>:<account-id>:key/<key-id> # Critical: customer-managed KMS key\n Type: CUSTOMER_MANAGED_KMS_KEY # Critical: must be CUSTOMER_MANAGED_KMS_KEY\n KmsDataKeyReusePeriodSeconds: 300\n```",
+ "Other": "1. Open AWS Console > Step Functions > State machines\n2. Select the state machine and click Edit\n3. Under Encryption, select Customer managed key\n4. Choose an existing KMS key or create a new one\n5. Save changes",
+ "Terraform": "```hcl\nresource \"aws_sfn_state_machine\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n role_arn = \"arn:aws:iam::<account-id>:role/<example_role_name>\"\n definition = jsonencode({ StartAt = \"Pass\", States = { Pass = { Type = \"Pass\", End = true } } })\n\n encryption_configuration {\n kms_key_id = \"arn:aws:kms:<region>:<account-id>:key/<key-id>\" # Critical: customer-managed KMS key\n type = \"CUSTOMER_MANAGED_KMS_KEY\" # Critical: must be CUSTOMER_MANAGED_KMS_KEY\n kms_data_key_reuse_period_seconds = 300\n }\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Configure each Step Functions state machine to use a **customer-managed KMS key** for encryption at rest. Assign a least-privilege key policy, enable **automatic key rotation**, and grant the execution role `kms:GenerateDataKey` and `kms:Decrypt`. Monitor key usage via CloudTrail.",
+ "Url": "https://hub.prowler.com/check/stepfunctions_statemachine_encrypted_with_cmk"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [
+ "stepfunctions_statemachine_logging_enabled"
+ ],
+ "Notes": ""
+}
diff --git a/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.py b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.py
new file mode 100644
index 0000000000..b14de0b482
--- /dev/null
+++ b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk.py
@@ -0,0 +1,50 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.stepfunctions.stepfunctions_client import (
+ stepfunctions_client,
+)
+from prowler.providers.aws.services.stepfunctions.stepfunctions_service import (
+ EncryptionType,
+)
+
+
+class stepfunctions_statemachine_encrypted_with_cmk(Check):
+ """Ensure Step Functions state machines are encrypted at rest with a customer-managed KMS key.
+
+ This check evaluates whether each AWS Step Functions state machine uses a
+ customer-managed KMS key (CUSTOMER_MANAGED_KMS_KEY) for encryption at rest rather
+ than the default AWS-owned key (AWS_OWNED_KEY).
+
+ - PASS: The state machine encryption_configuration type is CUSTOMER_MANAGED_KMS_KEY.
+ - FAIL: The state machine has no encryption_configuration or its type is AWS_OWNED_KEY.
+ """
+
+ def execute(self) -> List[Check_Report_AWS]:
+ """Execute the Step Functions state machine encryption at rest check.
+
+ Iterates over all Step Functions state machines and generates a report
+ indicating whether each state machine uses a customer-managed KMS key
+ for encryption at rest.
+
+ Returns:
+ List[Check_Report_AWS]: A list of report objects with the results of the check.
+ """
+ findings = []
+ for state_machine in stepfunctions_client.state_machines.values():
+ report = Check_Report_AWS(metadata=self.metadata(), resource=state_machine)
+
+ if (
+ state_machine.encryption_configuration
+ and state_machine.encryption_configuration.type
+ == EncryptionType.CUSTOMER_MANAGED_KMS_KEY
+ ):
+ report.status = "PASS"
+ report.status_extended = f"Step Functions state machine {state_machine.name} is encrypted at rest with a customer-managed KMS key."
+ else:
+ report.status = "FAIL"
+ report.status_extended = f"Step Functions state machine {state_machine.name} is not encrypted at rest with a customer-managed KMS key."
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition.py b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition.py
index db04710029..12934528e9 100644
--- a/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition.py
+++ b/prowler/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition.py
@@ -1,5 +1,9 @@
from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.aws.services.stepfunctions.stepfunctions_client import (
stepfunctions_client,
)
@@ -13,20 +17,41 @@ class stepfunctions_statemachine_no_secrets_in_definition(Check):
secrets_ignore_patterns = stepfunctions_client.audit_config.get(
"secrets_ignore_patterns", []
)
- for state_machine in stepfunctions_client.state_machines.values():
+ validate = stepfunctions_client.audit_config.get("secrets_validate", False)
+ state_machines = list(stepfunctions_client.state_machines.values())
+
+ # Collect one payload per state machine (its definition) and scan them
+ # all in batched Kingfisher invocations instead of one subprocess each.
+ def payloads():
+ for index, state_machine in enumerate(state_machines):
+ if state_machine.definition:
+ yield index, state_machine.definition
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, state_machine in enumerate(state_machines):
report = Check_Report_AWS(metadata=self.metadata(), resource=state_machine)
report.status = "PASS"
report.status_extended = f"No secrets found in Step Functions state machine {state_machine.name} definition."
if state_machine.definition:
- detect_secrets_output = detect_secrets_scan(
- data=state_machine.definition,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=stepfunctions_client.audit_config.get(
- "detect_secrets_plugins",
- ),
- )
-
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan Step Functions state machine "
+ f"{state_machine.name} definition for secrets: {scan_error}; "
+ "manual review is required."
+ )
+ findings.append(report)
+ continue
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
secrets_string = ", ".join(
[
@@ -40,6 +65,7 @@ class stepfunctions_statemachine_no_secrets_in_definition(Check):
f"found in Step Functions state machine {state_machine.name} definition "
f"-> {secrets_string}."
)
+ annotate_verified_secrets(report, detect_secrets_output)
findings.append(report)
return findings
diff --git a/tests/lib/outputs/compliance/prowler_threatscore/__init__.py b/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/prowler_threatscore/__init__.py
rename to prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/__init__.py
diff --git a/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.metadata.json b/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.metadata.json
new file mode 100644
index 0000000000..b213398059
--- /dev/null
+++ b/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.metadata.json
@@ -0,0 +1,44 @@
+{
+ "Provider": "aws",
+ "CheckID": "waf_regional_webacl_logging_enabled",
+ "CheckTitle": "AWS WAF Classic Regional Web ACL has logging enabled",
+ "CheckType": [
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+ "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS"
+ ],
+ "ServiceName": "waf",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "AwsWafRegionalWebAcl",
+ "ResourceGroup": "security",
+ "Description": "**AWS WAF Classic Regional Web ACLs** are evaluated for **logging** enabled to capture evaluated web requests and rule actions. Regional Web ACLs protect Application Load Balancers and API Gateway stages.",
+ "Risk": "Without **WAF logging**, you lose **visibility** into attacks (SQLi/XSS probes, bots, brute-force) and into allow/block decisions for ALB and API Gateway traffic. This limits detection, forensics, and incident response, weakening **confidentiality**, **integrity**, and **availability**.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/waf-controls.html",
+ "https://docs.aws.amazon.com/cli/latest/reference/waf-regional/put-logging-configuration.html"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "aws waf-regional put-logging-configuration --logging-configuration ResourceArn=<web_acl_arn>,LogDestinationConfigs=<kinesis_firehose_delivery_stream_arn> --region <region>",
+ "NativeIaC": "",
+ "Other": "1. Create an Amazon Kinesis Data Firehose delivery stream with a name starting with \"aws-waf-logs-\" in the same region as your Web ACL\n2. Open the AWS WAF console and switch to AWS WAF Classic\n3. Select Filter: Regional (your region) and go to Web ACLs\n4. Open the target Web ACL and go to the Logging tab\n5. Click Enable logging and select the Firehose delivery stream created in step 1\n6. Click Enable/Save",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **logging** on all Regional Web ACLs and send records to a centralized logging platform. Apply **least privilege** to log destinations, redact sensitive fields, and monitor for anomalies. Integrate logs with incident response for **defense in depth** and faster containment.",
+ "Url": "https://hub.prowler.com/check/waf_regional_webacl_logging_enabled"
+ }
+ },
+ "Categories": [
+ "logging"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [
+ "waf_global_webacl_logging_enabled"
+ ],
+ "Notes": ""
+}
diff --git a/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.py b/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.py
new file mode 100644
index 0000000000..8d832d6c1e
--- /dev/null
+++ b/prowler/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled.py
@@ -0,0 +1,43 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.waf.wafregional_client import wafregional_client
+
+
+class waf_regional_webacl_logging_enabled(Check):
+ """Ensure AWS WAF Classic Regional Web ACLs have logging enabled.
+
+ This check evaluates whether each AWS WAF Classic Regional Web ACL has logging
+ enabled by verifying the presence of at least one log destination configured
+ in its logging configuration.
+
+ - PASS: The Web ACL has at least one log destination configured.
+ - FAIL: The Web ACL has no log destinations configured (logging is disabled).
+ """
+
+ def execute(self) -> List[Check_Report_AWS]:
+ """Execute the WAF Regional Web ACL logging enabled check.
+
+ Iterates over all WAF Classic Regional Web ACLs and generates a report
+ indicating whether each Web ACL has logging enabled.
+
+ Returns:
+ List[Check_Report_AWS]: A list of report objects with the results of the check.
+ """
+ findings = []
+ for acl in wafregional_client.web_acls.values():
+ report = Check_Report_AWS(metadata=self.metadata(), resource=acl)
+ report.status = "FAIL"
+ report.status_extended = (
+ f"AWS WAF Regional Web ACL {acl.name} does not have logging enabled."
+ )
+
+ if acl.logging_enabled:
+ report.status = "PASS"
+ report.status_extended = (
+ f"AWS WAF Regional Web ACL {acl.name} does have logging enabled."
+ )
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/aws/services/waf/waf_service.py b/prowler/providers/aws/services/waf/waf_service.py
index 25476e6858..602b7116f6 100644
--- a/prowler/providers/aws/services/waf/waf_service.py
+++ b/prowler/providers/aws/services/waf/waf_service.py
@@ -168,6 +168,7 @@ class WAFRegional(AWSService):
)
self.__threading_call__(self._list_web_acls)
self.__threading_call__(self._get_web_acl, self.web_acls.values())
+ self.__threading_call__(self._get_logging_configuration, self.web_acls.values())
self.__threading_call__(self._list_resources_for_web_acl)
def _list_rules(self, regional_client):
@@ -277,6 +278,34 @@ class WAFRegional(AWSService):
f"{acl.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
+ def _get_logging_configuration(self, acl):
+ """Fetch and store the logging configuration for a Regional Web ACL.
+
+ Calls the WAF Regional GetLoggingConfiguration API for the given ACL and
+ sets acl.logging_enabled to True if at least one log destination is configured,
+ False otherwise.
+
+ Args:
+ acl (WebAcl): The Regional Web ACL instance to update.
+ """
+ logger.info(
+ f"WAFRegional - Getting Regional Web ACL {acl.name} logging configuration..."
+ )
+ try:
+ get_logging_configuration = self.regional_clients[
+ acl.region
+ ].get_logging_configuration(ResourceArn=acl.arn)
+ acl.logging_enabled = bool(
+ get_logging_configuration.get("LoggingConfiguration", {}).get(
+ "LogDestinationConfigs", []
+ )
+ )
+
+ except Exception as error:
+ logger.error(
+ f"{acl.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
def _list_resources_for_web_acl(self, regional_client):
logger.info("WAFRegional - Describing resources...")
try:
diff --git a/prowler/providers/azure/azure_provider.py b/prowler/providers/azure/azure_provider.py
index c9496ac0a5..bffc72396b 100644
--- a/prowler/providers/azure/azure_provider.py
+++ b/prowler/providers/azure/azure_provider.py
@@ -16,6 +16,7 @@ from azure.identity import (
DefaultAzureCredential,
InteractiveBrowserCredential,
)
+from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.subscription import SubscriptionClient
from colorama import Fore, Style
from msgraph import GraphServiceClient
@@ -97,12 +98,14 @@ class AzureProvider(Provider):
"""
_type: str = "azure"
+ sdk_only: bool = False
_session: DefaultAzureCredential
_identity: AzureIdentityInfo
_audit_config: dict
_region_config: AzureRegionConfig
_locations: dict
_mutelist: AzureMutelist
+ _resource_groups: dict[str, list[str]]
# TODO: this is not optional, enforce for all providers
audit_metadata: Audit_Metadata
@@ -122,6 +125,7 @@ class AzureProvider(Provider):
mutelist_content: dict = None,
client_id: str = None,
client_secret: str = None,
+ resource_groups: list = [],
):
"""
Initializes the Azure provider.
@@ -141,6 +145,7 @@ class AzureProvider(Provider):
mutelist_content (dict): The mutelist content.
client_id (str): The Azure client ID.
client_secret (str): The Azure client secret.
+ resource_groups (list): List of resource group names.
Returns:
None
@@ -205,7 +210,7 @@ class AzureProvider(Provider):
... managed_identity_auth=False,
... region="AzureUSGovernment",
... )
- - Subscriptions: rowler is multisubscription, which means that is going to scan all the subscriptions is able to list. If you only assign permissions to one subscription, it is going to scan a single one.
+ - Subscriptions: Prowler is multisubscription, which means that is going to scan all the subscriptions is able to list. If you only assign permissions to one subscription, it is going to scan a single one.
Prowler also allows you to specify the subscriptions you want to scan by passing a list of subscription IDs.
>>> AzureProvider(
... az_cli_auth=False,
@@ -214,6 +219,11 @@ class AzureProvider(Provider):
... managed_identity_auth=False,
... subscription_ids=["XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"],
... )
+ - Resource Groups: Prowler allows you to narrow the scan to specific resource groups.
+ >>> AzureProvider(
+ ... az_cli_auth=True,
+ ... resource_groups=["rg-production", "rg-staging"],
+ ... )
"""
logger.info("Setting Azure provider ...")
@@ -271,6 +281,8 @@ class AzureProvider(Provider):
# TODO: should we keep this here or within the identity?
self._locations = self.get_locations()
+ self._resource_groups = self.validate_resource_groups(resource_groups)
+
# Audit Config
if config_content:
self._audit_config = config_content
@@ -336,6 +348,11 @@ class AzureProvider(Provider):
"""Mutelist object associated with this Azure provider."""
return self._mutelist
+ @property
+ def resource_groups(self) -> dict[str, list[str]]:
+ """Mapping of subscription ID to the list of resource groups to scan within it."""
+ return self._resource_groups
+
# TODO: this should be moved to the argparse, if not we need to enforce it from the Provider
# previously was using the AzureException
@staticmethod
@@ -438,7 +455,7 @@ class AzureProvider(Provider):
"""Azure credentials information.
This method prints the Azure Tenant Domain, Azure Tenant ID, Azure Region,
- Azure Subscriptions, Azure Identity Type, and Azure Identity ID.
+ Azure Subscriptions, Azure Resource Groups, Azure Identity Type, and Azure Identity ID.
Args:
None
@@ -454,6 +471,7 @@ class AzureProvider(Provider):
f"Azure Tenant Domain: {Fore.YELLOW}{self._identity.tenant_domain}{Style.RESET_ALL} Azure Tenant ID: {Fore.YELLOW}{self._identity.tenant_ids[0]}{Style.RESET_ALL}",
f"Azure Region: {Fore.YELLOW}{self.region_config.name}{Style.RESET_ALL}",
f"Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL}",
+ f"Azure Resource Groups: {Fore.YELLOW}{sorted({rg for rgs in self._resource_groups.values() for rg in rgs}) if any(self._resource_groups.values()) else ('NONE (no matching resource groups found)' if self._resource_groups else 'ALL')}{Style.RESET_ALL}",
f"Azure Identity Type: {Fore.YELLOW}{self._identity.identity_type}{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}{self._identity.identity_id}{Style.RESET_ALL}",
]
report_title = (
@@ -1101,6 +1119,68 @@ class AzureProvider(Provider):
return set(chain.from_iterable(locations.values()))
+ def validate_resource_groups(self, resource_groups: list) -> dict[str, list[str]]:
+ """Validate requested resource groups across Azure subscriptions.
+
+ Args:
+ resource_groups: Resource group names requested for scanning.
+
+ Returns:
+ A mapping of subscription IDs to the matching resource group names.
+
+ The matching is case-insensitive and resolved independently for each
+ subscription. If a subscription's resource groups cannot be queried, a
+ warning is logged and that subscription keeps an empty resource group
+ list so the remaining subscriptions can still be validated.
+ """
+ resource_groups = [r.strip() for r in resource_groups if r and r.strip()]
+ if not resource_groups:
+ return {}
+
+ rg_map = {
+ subscription_id: [] for subscription_id in self._identity.subscriptions
+ }
+ credentials = self.session
+
+ for subscription_id, display_name in self._identity.subscriptions.items():
+ try:
+ rg_client = ResourceManagementClient(
+ credentials,
+ subscription_id,
+ base_url=self._region_config.base_url,
+ credential_scopes=self._region_config.credential_scopes,
+ )
+ existing_rgs = {
+ rg.name.lower(): rg.name for rg in rg_client.resource_groups.list()
+ }
+ except Exception as error:
+ logger.warning(
+ f"Could not list resource groups for subscription '{display_name}' "
+ f"({subscription_id}): {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}. "
+ "Skipping resource group filtering for this subscription."
+ )
+ continue
+
+ for rg in resource_groups:
+ real_name = existing_rgs.get(rg.lower())
+ if real_name:
+ rg_map[subscription_id].append(real_name)
+
+ for rg in resource_groups:
+ if not any(rg.lower() == r.lower() for rgs in rg_map.values() for r in rgs):
+ logger.warning(
+ f"Resource group '{rg}' was not found in any subscription. "
+ "Please check the resource group name and try again."
+ )
+
+ if not any(rgs for rgs in rg_map.values()):
+ logger.warning(
+ f"None of the provided resource groups {resource_groups} were found "
+ "in any subscription. Please check the resource group names and try again."
+ )
+
+ return rg_map
+
@staticmethod
def validate_static_credentials(
tenant_id: str = None,
diff --git a/prowler/providers/azure/lib/arguments/arguments.py b/prowler/providers/azure/lib/arguments/arguments.py
index 2b624a3f23..87bea948aa 100644
--- a/prowler/providers/azure/lib/arguments/arguments.py
+++ b/prowler/providers/azure/lib/arguments/arguments.py
@@ -53,6 +53,16 @@ def init_parser(self):
type=validate_azure_region,
help="Azure region from `az cloud list --output table`, by default AzureCloud",
)
+ # Resource Groups
+ azure_rg_subparser = azure_parser.add_argument_group("Resource Groups")
+ azure_rg_subparser.add_argument(
+ "--azure-resource-group",
+ "--azure-resource-groups",
+ nargs="+",
+ default=[],
+ dest="resource_groups",
+ help="Azure Resource Group names to scope the scan to specific groups.",
+ )
def validate_azure_region(region):
diff --git a/prowler/providers/azure/lib/service/service.py b/prowler/providers/azure/lib/service/service.py
index a0a832ca01..9d63639e94 100644
--- a/prowler/providers/azure/lib/service/service.py
+++ b/prowler/providers/azure/lib/service/service.py
@@ -1,3 +1,4 @@
+from collections.abc import Callable, Iterable
from concurrent.futures import ThreadPoolExecutor, as_completed
from kiota_authentication_azure.azure_identity_authentication_provider import (
@@ -26,6 +27,7 @@ class AzureService:
)
self.subscriptions = provider.identity.subscriptions
+ self.resource_groups = provider.resource_groups
self.locations = provider.locations
self.audit_config = provider.audit_config
self.fixer_config = provider.fixer_config
@@ -49,6 +51,44 @@ class AzureService:
return results
+ def list_with_rg_scope(
+ self,
+ subscription_id: str,
+ list_all_fn: Callable[[], Iterable[object]],
+ list_by_rg_fn: Callable[..., Iterable[object]],
+ ) -> list[object]:
+ """List Azure resources using the provider resource group scope.
+
+ Args:
+ subscription_id: Subscription ID whose resource group scope should be used.
+ list_all_fn: Callable that lists all resources in the subscription when
+ no resource group filter is configured.
+ list_by_rg_fn: Callable that lists resources for a single resource
+ group. It must accept ``resource_group_name`` as a keyword argument.
+
+ Returns:
+ A list containing the resources returned by the selected Azure SDK
+ list operation.
+ """
+ if not self.resource_groups:
+ return list(list_all_fn())
+ resource_groups = self.resource_groups.get(subscription_id, [])
+ if not resource_groups:
+ logger.info(
+ f"No valid resource groups for subscription {subscription_id}, skipping."
+ )
+ return []
+ output = []
+ for resource_group in resource_groups:
+ try:
+ output += list(list_by_rg_fn(resource_group_name=resource_group))
+ except Exception as error:
+ logger.warning(
+ f"Subscription ID: {subscription_id} -- Resource Group: {resource_group} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return output
+
def __set_clients__(self, identity, session, service, region_config):
clients = {}
try:
diff --git a/prowler/providers/azure/services/aisearch/aisearch_service.py b/prowler/providers/azure/services/aisearch/aisearch_service.py
index 3f482a41a5..01c6a458f7 100644
--- a/prowler/providers/azure/services/aisearch/aisearch_service.py
+++ b/prowler/providers/azure/services/aisearch/aisearch_service.py
@@ -17,7 +17,11 @@ class AISearch(AzureService):
for subscription, client in self.clients.items():
try:
aisearch_services.update({subscription: {}})
- aisearch_services_list = client.services.list_by_subscription()
+ aisearch_services_list = self.list_with_rg_scope(
+ subscription,
+ client.services.list_by_subscription,
+ client.services.list_by_resource_group,
+ )
for aisearch_service in aisearch_services_list:
aisearch_services[subscription].update(
{
diff --git a/prowler/providers/azure/services/aks/aks_service.py b/prowler/providers/azure/services/aks/aks_service.py
index 081edd7b17..0bd7c4d63c 100644
--- a/prowler/providers/azure/services/aks/aks_service.py
+++ b/prowler/providers/azure/services/aks/aks_service.py
@@ -19,8 +19,12 @@ class AKS(AzureService):
for subscription_id, client in self.clients.items():
try:
- clusters_list = client.managed_clusters.list()
clusters.update({subscription_id: {}})
+ clusters_list = self.list_with_rg_scope(
+ subscription_id,
+ client.managed_clusters.list,
+ client.managed_clusters.list_by_resource_group,
+ )
for cluster in clusters_list:
if getattr(cluster, "kubernetes_version", None):
diff --git a/prowler/providers/azure/services/apim/apim_service.py b/prowler/providers/azure/services/apim/apim_service.py
index 98fb00f276..3186716ddb 100644
--- a/prowler/providers/azure/services/apim/apim_service.py
+++ b/prowler/providers/azure/services/apim/apim_service.py
@@ -131,7 +131,11 @@ class APIM(AzureService):
for subscription, client in self.clients.items():
try:
instances.update({subscription: []})
- apim_instances = client.api_management_service.list()
+ apim_instances = self.list_with_rg_scope(
+ subscription,
+ client.api_management_service.list,
+ client.api_management_service.list_by_resource_group,
+ )
for instance in apim_instances:
workspace_id = self._get_log_analytics_workspace_id(
diff --git a/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py b/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py
index 6fec5e7042..a903097beb 100644
--- a/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py
+++ b/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py
@@ -14,7 +14,7 @@ class app_function_application_insights_enabled(Check):
subscription_id, subscription_id
)
for function in functions.values():
- if function.enviroment_variables is not None:
+ if function.environment_variables is not None:
report = Check_Report_Azure(
metadata=self.metadata(), resource=function
)
@@ -22,9 +22,9 @@ class app_function_application_insights_enabled(Check):
report.status = "FAIL"
report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using Application Insights."
- if function.enviroment_variables.get(
+ if function.environment_variables.get(
"APPINSIGHTS_INSTRUMENTATIONKEY", None
- ) or function.enviroment_variables.get(
+ ) or function.environment_variables.get(
"APPLICATIONINSIGHTS_CONNECTION_STRING", None
):
report.status = "PASS"
diff --git a/tests/lib/outputs/compliance/universal/__init__.py b/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/__init__.py
similarity index 100%
rename from tests/lib/outputs/compliance/universal/__init__.py
rename to prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/__init__.py
diff --git a/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.metadata.json b/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.metadata.json
new file mode 100644
index 0000000000..7696bec34f
--- /dev/null
+++ b/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.metadata.json
@@ -0,0 +1,37 @@
+{
+ "Provider": "azure",
+ "CheckID": "app_function_ensure_http_is_redirected_to_https",
+ "CheckTitle": "Function app redirects HTTP to HTTPS",
+ "CheckType": [],
+ "ServiceName": "app",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "microsoft.web/sites",
+ "ResourceGroup": "serverless",
+ "Description": "**Azure Function apps** redirect `HTTP` traffic to `HTTPS` when the `HTTPS Only` setting is enabled. This evaluation identifies Function apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.",
+ "Risk": "Leaving **HTTP accessible** on a Function app enables **man-in-the-middle** interception, credential and token theft, and response tampering. This undermines **confidentiality** and **integrity**, and can lead to session hijacking or downgrade attacks that bypass TLS.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https",
+ "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-3-encrypt-sensitive-data-in-transit"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "az functionapp update --resource-group <RESOURCE_GROUP_NAME> --name <FUNCTION_APP_NAME> --https-only true",
+ "NativeIaC": "```bicep\n// Enable HTTPS-only redirect on an existing Function App\nresource functionApp 'Microsoft.Web/sites@2022-09-01' = {\n name: '<example_resource_name>'\n location: resourceGroup().location\n properties: {\n httpsOnly: true // Critical: forces redirect from HTTP to HTTPS\n }\n}\n```",
+ "Other": "1. Sign in to the Azure portal and go to Function Apps\n2. Select your Function app\n3. Go to TLS/SSL settings and set HTTPS Only to On\n4. Click Save",
+ "Terraform": "```hcl\n# Enforce HTTPS-only on a Function App\nresource \"azurerm_linux_function_app\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n resource_group_name = \"<example_resource_name>\"\n location = \"<example_location>\"\n service_plan_id = \"<example_resource_id>\"\n storage_account_name = \"<example_resource_name>\"\n storage_account_access_key = \"<example_secret_value>\"\n\n https_only = true # Critical: redirects HTTP to HTTPS\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Enforce **HTTPS-only** for all Function apps.\n- Use trusted certificates and require `TLS 1.2` or later\n- Enable **HSTS** to prevent downgrade/mixed-content\n- Redirect legacy `http` links to `https`\n- Minimize HTTP exposure via WAF/CDN or private access\nApply **defense in depth** to protect data in transit.",
+ "Url": "https://hub.prowler.com/check/app_function_ensure_http_is_redirected_to_https"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "This check mirrors app_ensure_http_is_redirected_to_https but evaluates Function apps (Microsoft.Web/sites with kind starting with 'functionapp') via app_client.functions. When HTTPS Only is enabled, every incoming HTTP request is redirected to the HTTPS port."
+}
diff --git a/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.py b/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.py
new file mode 100644
index 0000000000..17090ac2cf
--- /dev/null
+++ b/prowler/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.app.app_client import app_client
+
+
+class app_function_ensure_http_is_redirected_to_https(Check):
+ """Ensure Function Apps redirect HTTP traffic to HTTPS."""
+
+ def execute(self) -> list[Check_Report_Azure]:
+ """Execute the check logic.
+
+ Returns:
+ A list of reports for Function Apps HTTPS-only enforcement.
+ """
+ findings = []
+
+ for (
+ subscription_id,
+ functions,
+ ) in app_client.functions.items():
+ subscription_name = app_client.subscriptions.get(
+ subscription_id, subscription_id
+ )
+ for function in functions.values():
+ report = Check_Report_Azure(metadata=self.metadata(), resource=function)
+ report.subscription = subscription_id
+ report.status = "PASS"
+ report.status_extended = f"HTTP is redirected to HTTPS for Function app '{function.name}' in subscription '{subscription_name} ({subscription_id})'."
+
+ if not function.https_only:
+ report.status = "FAIL"
+ report.status_extended = f"HTTP is not redirected to HTTPS for Function app '{function.name}' in subscription '{subscription_name} ({subscription_id})'."
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py b/prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py
index 828362a8fe..694c5bbdc6 100644
--- a/prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py
+++ b/prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py
@@ -14,7 +14,7 @@ class app_function_latest_runtime_version(Check):
subscription_id, subscription_id
)
for function in functions.values():
- if function.enviroment_variables is not None:
+ if function.environment_variables is not None:
report = Check_Report_Azure(
metadata=self.metadata(), resource=function
)
@@ -23,13 +23,13 @@ class app_function_latest_runtime_version(Check):
report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is using the latest runtime."
if (
- function.enviroment_variables.get(
+ function.environment_variables.get(
"FUNCTIONS_EXTENSION_VERSION", ""
)
!= "~4"
):
report.status = "FAIL"
- report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using the latest runtime. The current runtime is '{function.enviroment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
+ report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using the latest runtime. The current runtime is '{function.environment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
findings.append(report)
diff --git a/prowler/providers/azure/services/app/app_service.py b/prowler/providers/azure/services/app/app_service.py
index 201cd6a344..68c683caa1 100644
--- a/prowler/providers/azure/services/app/app_service.py
+++ b/prowler/providers/azure/services/app/app_service.py
@@ -22,8 +22,12 @@ class App(AzureService):
for subscription_id, client in self.clients.items():
try:
- apps_list = client.web_apps.list()
apps.update({subscription_id: {}})
+ apps_list = self.list_with_rg_scope(
+ subscription_id,
+ client.web_apps.list,
+ client.web_apps.list_by_resource_group,
+ )
for app in apps_list:
# Filter function apps
@@ -117,8 +121,12 @@ class App(AzureService):
for subscription_id, client in self.clients.items():
try:
- functions_list = client.web_apps.list()
functions.update({subscription_id: {}})
+ functions_list = self.list_with_rg_scope(
+ subscription_id,
+ client.web_apps.list,
+ client.web_apps.list_by_resource_group,
+ )
for function in functions_list:
# Filter function apps
@@ -150,7 +158,7 @@ class App(AzureService):
location=function.location,
kind=function.kind,
function_keys=function_keys,
- enviroment_variables=getattr(
+ environment_variables=getattr(
application_settings, "properties", None
),
identity=getattr(function, "identity", None),
@@ -170,6 +178,7 @@ class App(AzureService):
ftps_state=getattr(
function_config, "ftps_state", None
),
+ https_only=getattr(function, "https_only", False),
)
}
)
@@ -217,7 +226,7 @@ class App(AzureService):
name=name,
)
except Exception as error:
- logger.error(
+ logger.warning(
f"Error getting host keys for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
return None
@@ -241,7 +250,7 @@ class App(AzureService):
name=name,
)
except Exception as error:
- logger.error(
+ logger.warning(
f"Error getting application settings for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
return None
@@ -288,8 +297,9 @@ class FunctionApp:
location: str
kind: str
function_keys: Optional[Dict[str, str]]
- enviroment_variables: Optional[Dict[str, str]]
+ environment_variables: Optional[Dict[str, str]]
identity: ManagedServiceIdentity
public_access: bool
vnet_subnet_id: str
ftps_state: Optional[str]
+ https_only: bool = False
diff --git a/prowler/providers/azure/services/appinsights/appinsights_service.py b/prowler/providers/azure/services/appinsights/appinsights_service.py
index 918a0f1b0f..6e92a7b275 100644
--- a/prowler/providers/azure/services/appinsights/appinsights_service.py
+++ b/prowler/providers/azure/services/appinsights/appinsights_service.py
@@ -17,8 +17,12 @@ class AppInsights(AzureService):
for subscription_id, client in self.clients.items():
try:
- components_list = client.components.list()
components.update({subscription_id: {}})
+ components_list = self.list_with_rg_scope(
+ subscription_id,
+ client.components.list,
+ client.components.list_by_resource_group,
+ )
for component in components_list:
components[subscription_id].update(
diff --git a/prowler/providers/azure/services/containerregistry/containerregistry_service.py b/prowler/providers/azure/services/containerregistry/containerregistry_service.py
index ee6cce39f2..c44a0c7ef1 100644
--- a/prowler/providers/azure/services/containerregistry/containerregistry_service.py
+++ b/prowler/providers/azure/services/containerregistry/containerregistry_service.py
@@ -19,8 +19,12 @@ class ContainerRegistry(AzureService):
registries = {}
for subscription, client in self.clients.items():
try:
- registries_list = client.registries.list()
registries.update({subscription: {}})
+ registries_list = self.list_with_rg_scope(
+ subscription,
+ client.registries.list,
+ client.registries.list_by_resource_group,
+ )
for registry in registries_list:
resource_group = self._get_resource_group(registry.id)
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
index e7c53799a7..37b06da1c5 100644
--- a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
@@ -18,8 +18,13 @@ class CosmosDB(AzureService):
accounts = {}
for subscription, client in self.clients.items():
try:
- accounts_list = client.database_accounts.list()
accounts.update({subscription: []})
+ accounts_list = self.list_with_rg_scope(
+ subscription,
+ client.database_accounts.list,
+ client.database_accounts.list_by_resource_group,
+ )
+
for account in accounts_list:
accounts[subscription].append(
Account(
diff --git a/prowler/providers/azure/services/databricks/databricks_service.py b/prowler/providers/azure/services/databricks/databricks_service.py
index b7367d3cbb..128495a2c7 100644
--- a/prowler/providers/azure/services/databricks/databricks_service.py
+++ b/prowler/providers/azure/services/databricks/databricks_service.py
@@ -38,8 +38,13 @@ class Databricks(AzureService):
for subscription, client in self.clients.items():
try:
workspaces[subscription] = {}
+ workspaces_list = self.list_with_rg_scope(
+ subscription,
+ client.workspaces.list_by_subscription,
+ client.workspaces.list_by_resource_group,
+ )
- for workspace in client.workspaces.list_by_subscription():
+ for workspace in workspaces_list:
workspace_parameters = getattr(workspace, "parameters", None)
workspace_managed_disk_encryption = getattr(
getattr(
diff --git a/prowler/providers/azure/services/defender/defender_service.py b/prowler/providers/azure/services/defender/defender_service.py
index 7da96cd8ec..d68d88dc22 100644
--- a/prowler/providers/azure/services/defender/defender_service.py
+++ b/prowler/providers/azure/services/defender/defender_service.py
@@ -230,10 +230,12 @@ class Defender(AzureService):
iot_security_solutions = {}
for subscription_id, client in self.clients.items():
try:
- iot_security_solutions_list = (
- client.iot_security_solution.list_by_subscription()
- )
iot_security_solutions.update({subscription_id: {}})
+ iot_security_solutions_list = self.list_with_rg_scope(
+ subscription_id,
+ client.iot_security_solution.list_by_subscription,
+ client.iot_security_solution.list_by_resource_group,
+ )
for iot_security_solution in iot_security_solutions_list:
iot_security_solutions[subscription_id].update(
{
@@ -267,8 +269,13 @@ class Defender(AzureService):
for subscription_id, client in self.clients.items():
try:
jit_policies[subscription_id] = {}
- policies = client.jit_network_access_policies.list()
- for policy in policies:
+ policies_list = self.list_with_rg_scope(
+ subscription_id,
+ client.jit_network_access_policies.list,
+ client.jit_network_access_policies.list_by_resource_group,
+ )
+
+ for policy in policies_list:
vm_ids = set()
for vm in getattr(policy, "virtual_machines", []):
vm_ids.add(vm.id)
diff --git a/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.metadata.json b/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.metadata.json
index 164a43b5da..241c95ec7f 100644
--- a/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.metadata.json
+++ b/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.metadata.json
@@ -9,7 +9,7 @@
"Severity": "high",
"ResourceType": "microsoft.keyvault/vaults",
"ResourceGroup": "security",
- "Description": "**Azure Key Vault** diagnostic settings capture **audit logs** (`AuditEvent`) when category groups `audit` and `allLogs` are enabled and routed to a supported destination. Logged events include management and data-plane operations on vaults, keys, secrets, and certificates.",
+ "Description": "**Azure Key Vault** diagnostic settings capture **audit logs** (`AuditEvent`) when the `AuditEvent` category is enabled, or when category groups `audit` and `allLogs` are enabled, and routed to a supported destination. Logged events include management and data-plane operations on vaults, keys, secrets, and certificates.",
"Risk": "Without **Key Vault audit logging**, access and changes to keys, secrets, and certificates are untracked.\n\nAttackers can misuse keys to decrypt data, alter or delete crypto material, and evade detection-eroding **confidentiality** and **integrity** and delaying **incident response**.",
"RelatedUrl": "",
"AdditionalURLs": [
@@ -20,13 +20,13 @@
],
"Remediation": {
"Code": {
- "CLI": "az monitor diagnostic-settings create --name <example_resource_name> --resource <example_resource_id> --workspace <example_resource_id> --logs '[{\"categoryGroup\":\"audit\",\"enabled\":true},{\"categoryGroup\":\"allLogs\",\"enabled\":true}]'",
- "NativeIaC": "```bicep\n// Enable Key Vault diagnostic settings with audit + allLogs\nparam keyVaultName string\nparam workspaceId string\n\nresource kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {\n name: keyVaultName\n}\n\nresource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {\n name: '<example_resource_name>'\n scope: kv\n properties: {\n workspaceId: workspaceId\n logs: [\n {\n categoryGroup: 'audit' // critical: enables audit logs\n enabled: true // required to pass the check\n }\n {\n categoryGroup: 'allLogs' // critical: enables allLogs group\n enabled: true // required to pass the check\n }\n ]\n }\n}\n```",
- "Other": "1. In Azure Portal, go to your Key Vault > Monitoring > Diagnostic settings\n2. Click Add diagnostic setting\n3. Under Category groups, select audit and allLogs\n4. Choose a destination (e.g., Send to Log Analytics workspace) and select the workspace\n5. Click Save",
- "Terraform": "```hcl\n# Enable diagnostic settings on Key Vault with audit + allLogs\nresource \"azurerm_monitor_diagnostic_setting\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n target_resource_id = \"<example_resource_id>\" # Key Vault resource ID\n log_analytics_workspace_id = \"<example_resource_id>\" # Destination workspace ID\n\n enabled_log { # critical: audit category group\n category_group = \"audit\" # enables audit logs\n }\n enabled_log { # critical: allLogs category group\n category_group = \"allLogs\" # enables all logs\n }\n}\n```"
+ "CLI": "az monitor diagnostic-settings create --name <example_resource_name> --resource <example_resource_id> --workspace <example_resource_id> --logs '[{\"category\":\"AuditEvent\",\"enabled\":true}]'",
+ "NativeIaC": "```bicep\n// Enable Key Vault AuditEvent diagnostic logs\nparam keyVaultName string\nparam workspaceId string\n\nresource kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {\n name: keyVaultName\n}\n\nresource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {\n name: '<example_resource_name>'\n scope: kv\n properties: {\n workspaceId: workspaceId\n logs: [\n {\n category: 'AuditEvent'\n enabled: true\n }\n ]\n }\n}\n```",
+ "Other": "1. In Azure Portal, go to your Key Vault > Monitoring > Diagnostic settings\n2. Click Add diagnostic setting\n3. Enable AuditEvent audit logs, or select the audit and allLogs category groups\n4. Choose a destination (e.g., Send to Log Analytics workspace) and select the workspace\n5. Click Save",
+ "Terraform": "```hcl\n# Enable AuditEvent diagnostic logs on Key Vault\nresource \"azurerm_monitor_diagnostic_setting\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n target_resource_id = \"<example_resource_id>\"\n log_analytics_workspace_id = \"<example_resource_id>\"\n\n enabled_log {\n category = \"AuditEvent\"\n }\n}\n```"
},
"Recommendation": {
- "Text": "Enable **diagnostic settings** to collect `AuditEvent` logs-covering category groups `audit` and `allLogs`-and send them to a central sink. Apply **least privilege** to log access, enforce secure **retention/immutability**, monitor with alerts for anomalous operations, and use **separation of duties** to prevent logging bypass.",
+ "Text": "Enable **diagnostic settings** to collect `AuditEvent` logs and send them to a central sink. Apply **least privilege** to log access, enforce secure **retention/immutability**, monitor with alerts for anomalous operations, and use **separation of duties** to prevent logging bypass.",
"Url": "https://hub.prowler.com/check/keyvault_logging_enabled"
}
},
diff --git a/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py b/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py
index 68ef149cd7..ea80b920c5 100644
--- a/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py
+++ b/prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py
@@ -16,14 +16,17 @@ class keyvault_logging_enabled(Check):
report.status = "FAIL"
report.status_extended = f"Key Vault {keyvault.name} in subscription {subscription_name} ({subscription_id}) does not have a diagnostic setting with audit logging."
for diagnostic_setting in keyvault.monitor_diagnostic_settings or []:
- has_audit = False
+ has_audit_category = False
+ has_audit_group = False
has_all_logs = False
for log in diagnostic_setting.logs:
+ if log.category == "AuditEvent" and log.enabled:
+ has_audit_category = True
if log.category_group == "audit" and log.enabled:
- has_audit = True
+ has_audit_group = True
if log.category_group == "allLogs" and log.enabled:
has_all_logs = True
- if has_audit and has_all_logs:
+ if has_audit_category or (has_audit_group and has_all_logs):
report.status = "PASS"
report.status_extended = f"Key Vault {keyvault.name} in subscription {subscription_name} ({subscription_id}) has a diagnostic setting with audit logging."
break
diff --git a/prowler/providers/azure/services/keyvault/keyvault_service.py b/prowler/providers/azure/services/keyvault/keyvault_service.py
index 9fb3fd98af..e5b2e76427 100644
--- a/prowler/providers/azure/services/keyvault/keyvault_service.py
+++ b/prowler/providers/azure/services/keyvault/keyvault_service.py
@@ -35,7 +35,11 @@ class KeyVault(AzureService):
for subscription, client in self.clients.items():
try:
key_vaults[subscription] = []
- vaults_list = list(client.vaults.list_by_subscription())
+ vaults_list = self.list_with_rg_scope(
+ subscription,
+ client.vaults.list_by_subscription,
+ client.vaults.list_by_resource_group,
+ )
if not vaults_list:
continue
diff --git a/prowler/providers/azure/services/mysql/mysql_service.py b/prowler/providers/azure/services/mysql/mysql_service.py
index b3a386a193..2898d8445c 100644
--- a/prowler/providers/azure/services/mysql/mysql_service.py
+++ b/prowler/providers/azure/services/mysql/mysql_service.py
@@ -19,8 +19,12 @@ class MySQL(AzureService):
servers = {}
for subscription_id, client in self.clients.items():
try:
- servers_list = client.servers.list()
servers.update({subscription_id: {}})
+ servers_list = self.list_with_rg_scope(
+ subscription_id,
+ client.servers.list,
+ client.servers.list_by_resource_group,
+ )
for server in servers_list:
backup = getattr(server, "backup", None)
ha = getattr(server, "high_availability", None)
diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py
index a924cf9609..54cb02989b 100644
--- a/prowler/providers/azure/services/network/network_service.py
+++ b/prowler/providers/azure/services/network/network_service.py
@@ -24,8 +24,13 @@ class Network(AzureService):
security_groups = {}
for subscription, client in self.clients.items():
try:
+ security_groups_list = self.list_with_rg_scope(
+ subscription,
+ client.network_security_groups.list_all,
+ client.network_security_groups.list,
+ )
+
security_groups.update({subscription: []})
- security_groups_list = client.network_security_groups.list_all()
for security_group in security_groups_list:
security_groups[subscription].append(
SecurityGroup(
@@ -64,8 +69,8 @@ class Network(AzureService):
network_watchers = {}
for subscription, client in self.clients.items():
try:
- network_watchers.update({subscription: []})
network_watchers_list = client.network_watchers.list_all()
+ network_watchers.update({subscription: []})
for network_watcher in network_watchers_list:
flow_logs = self._get_flow_logs(
subscription, network_watcher.name, network_watcher.id
@@ -164,8 +169,13 @@ class Network(AzureService):
bastion_hosts = {}
for subscription, client in self.clients.items():
try:
+ bastion_hosts_list = self.list_with_rg_scope(
+ subscription,
+ client.bastion_hosts.list,
+ client.bastion_hosts.list_by_resource_group,
+ )
+
bastion_hosts.update({subscription: []})
- bastion_hosts_list = client.bastion_hosts.list()
for bastion_host in bastion_hosts_list:
bastion_hosts[subscription].append(
BastionHost(
@@ -186,8 +196,13 @@ class Network(AzureService):
public_ip_addresses = {}
for subscription, client in self.clients.items():
try:
+ public_ip_addresses_list = self.list_with_rg_scope(
+ subscription,
+ client.public_ip_addresses.list_all,
+ client.public_ip_addresses.list,
+ )
+
public_ip_addresses.update({subscription: []})
- public_ip_addresses_list = client.public_ip_addresses.list_all()
for public_ip_address in public_ip_addresses_list:
public_ip_addresses[subscription].append(
PublicIp(
@@ -207,13 +222,17 @@ class Network(AzureService):
def _get_virtual_networks(self):
logger.info("Network - Getting Virtual Networks...")
virtual_networks = {}
- for subscription, client in self.clients.items():
+ for subscription_id, client in self.clients.items():
try:
- virtual_networks[subscription] = []
- vnet_list = client.virtual_networks.list_all()
- for vnet in vnet_list:
+ virtual_networks[subscription_id] = []
+ virtual_networks_list = self.list_with_rg_scope(
+ subscription_id,
+ client.virtual_networks.list_all,
+ client.virtual_networks.list,
+ )
+ for virtual_network in virtual_networks_list:
subnets = []
- for subnet in getattr(vnet, "subnets", []) or []:
+ for subnet in getattr(virtual_network, "subnets", []) or []:
nsg = getattr(subnet, "network_security_group", None)
subnets.append(
VNetSubnet(
@@ -222,20 +241,20 @@ class Network(AzureService):
nsg_id=getattr(nsg, "id", None) if nsg else None,
)
)
- virtual_networks[subscription].append(
+ virtual_networks[subscription_id].append(
VirtualNetwork(
- id=vnet.id,
- name=vnet.name,
- location=vnet.location,
+ id=virtual_network.id,
+ name=virtual_network.name,
+ location=virtual_network.location,
enable_ddos_protection=getattr(
- vnet, "enable_ddos_protection", False
+ virtual_network, "enable_ddos_protection", False
),
subnets=subnets,
)
)
except Exception as error:
logger.error(
- f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ f"Subscription ID: {subscription_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
return virtual_networks
diff --git a/prowler/providers/azure/services/policy/policy_service.py b/prowler/providers/azure/services/policy/policy_service.py
index 1d1381202f..663e9b76a3 100644
--- a/prowler/providers/azure/services/policy/policy_service.py
+++ b/prowler/providers/azure/services/policy/policy_service.py
@@ -18,8 +18,8 @@ class Policy(AzureService):
for subscription_id, client in self.clients.items():
try:
- policy_assigments_list = client.policy_assignments.list()
policy_assigments.update({subscription_id: {}})
+ policy_assigments_list = client.policy_assignments.list()
for policy_assigment in policy_assigments_list:
policy_assigments[subscription_id].update(
diff --git a/prowler/providers/azure/services/postgresql/postgresql_service.py b/prowler/providers/azure/services/postgresql/postgresql_service.py
index 2048299bf1..9bcb6426b8 100644
--- a/prowler/providers/azure/services/postgresql/postgresql_service.py
+++ b/prowler/providers/azure/services/postgresql/postgresql_service.py
@@ -1,6 +1,7 @@
from dataclasses import dataclass
from typing import Optional
+from azure.core.exceptions import ResourceNotFoundError
from azure.mgmt.postgresqlflexibleservers import PostgreSQLManagementClient
from prowler.lib.logger import logger
@@ -19,64 +20,77 @@ class PostgreSQL(AzureService):
for subscription, client in self.clients.items():
try:
flexible_servers.update({subscription: []})
- flexible_servers_list = client.servers.list()
+ flexible_servers_list = self.list_with_rg_scope(
+ subscription,
+ client.servers.list,
+ client.servers.list_by_resource_group,
+ )
+
for postgresql_server in flexible_servers_list:
- resource_group = self._get_resource_group(postgresql_server.id)
- # Fetch full server object once to extract multiple properties
- server_details = client.servers.get(
- resource_group, postgresql_server.name
- )
- require_secure_transport = self._get_require_secure_transport(
- subscription, resource_group, postgresql_server.name
- )
- active_directory_auth = self._extract_active_directory_auth(
- server_details
- )
- entra_id_admins = self._get_entra_id_admins(
- subscription, resource_group, postgresql_server.name
- )
- log_checkpoints = self._get_log_checkpoints(
- subscription, resource_group, postgresql_server.name
- )
- log_disconnections = self._get_log_disconnections(
- subscription, resource_group, postgresql_server.name
- )
- log_connections = self._get_log_connections(
- subscription, resource_group, postgresql_server.name
- )
- connection_throttling = self._get_connection_throttling(
- subscription, resource_group, postgresql_server.name
- )
- log_retention_days = self._get_log_retention_days(
- subscription, resource_group, postgresql_server.name
- )
- firewall = self._get_firewall(
- subscription, resource_group, postgresql_server.name
- )
- location = server_details.location
- backup = getattr(server_details, "backup", None)
- ha = getattr(server_details, "high_availability", None)
- flexible_servers[subscription].append(
- Server(
- id=postgresql_server.id,
- name=postgresql_server.name,
- resource_group=resource_group,
- location=location,
- require_secure_transport=require_secure_transport,
- active_directory_auth=active_directory_auth,
- entra_id_admins=entra_id_admins,
- log_checkpoints=log_checkpoints,
- log_connections=log_connections,
- log_disconnections=log_disconnections,
- connection_throttling=connection_throttling,
- log_retention_days=log_retention_days,
- firewall=firewall,
- geo_redundant_backup=getattr(
- backup, "geo_redundant_backup", None
- ),
- high_availability_mode=getattr(ha, "mode", None),
+ # Isolate each server: a failure collecting one server must
+ # not abort collection of the remaining servers in the
+ # subscription.
+ try:
+ resource_group = self._get_resource_group(postgresql_server.id)
+ # Fetch full server object once to extract multiple properties
+ server_details = client.servers.get(
+ resource_group, postgresql_server.name
+ )
+ require_secure_transport = self._get_require_secure_transport(
+ subscription, resource_group, postgresql_server.name
+ )
+ active_directory_auth = self._extract_active_directory_auth(
+ server_details
+ )
+ entra_id_admins = self._get_entra_id_admins(
+ subscription, resource_group, postgresql_server.name
+ )
+ log_checkpoints = self._get_log_checkpoints(
+ subscription, resource_group, postgresql_server.name
+ )
+ log_disconnections = self._get_log_disconnections(
+ subscription, resource_group, postgresql_server.name
+ )
+ log_connections = self._get_log_connections(
+ subscription, resource_group, postgresql_server.name
+ )
+ connection_throttling = self._get_connection_throttling(
+ subscription, resource_group, postgresql_server.name
+ )
+ log_retention_days = self._get_log_retention_days(
+ subscription, resource_group, postgresql_server.name
+ )
+ firewall = self._get_firewall(
+ subscription, resource_group, postgresql_server.name
+ )
+ location = server_details.location
+ backup = getattr(server_details, "backup", None)
+ ha = getattr(server_details, "high_availability", None)
+ flexible_servers[subscription].append(
+ Server(
+ id=postgresql_server.id,
+ name=postgresql_server.name,
+ resource_group=resource_group,
+ location=location,
+ require_secure_transport=require_secure_transport,
+ active_directory_auth=active_directory_auth,
+ entra_id_admins=entra_id_admins,
+ log_checkpoints=log_checkpoints,
+ log_connections=log_connections,
+ log_disconnections=log_disconnections,
+ connection_throttling=connection_throttling,
+ log_retention_days=log_retention_days,
+ firewall=firewall,
+ geo_redundant_backup=getattr(
+ backup, "geo_redundant_backup", None
+ ),
+ high_availability_mode=getattr(ha, "mode", None),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"Subscription ID: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
- )
except Exception as error:
logger.error(
f"Subscription ID: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -166,33 +180,50 @@ class PostgreSQL(AzureService):
logger.error(f"Error getting Entra ID admins for {server_name}: {e}")
return []
- def _get_connection_throttling(self, subscription, resouce_group_name, server_name):
+ def _get_connection_throttling(
+ self, subscription: str, resouce_group_name: str, server_name: str
+ ) -> Optional[str]:
+ """Get the ``connection_throttle.enable`` setting for a flexible server.
+
+ The ``connection_throttle.enable`` server parameter was removed in
+ PostgreSQL 16+, so it no longer exists on newer flexible servers. When
+ the parameter is genuinely absent the Azure SDK raises
+ ``ResourceNotFoundError`` (error code ``ConfigurationNotExists``); that
+ case is treated as "not enabled" and ``None`` is returned so collection
+ of the server can continue.
+
+ Any other error (permissions, throttling, transient SDK failures) is
+ intentionally left to propagate: returning ``None`` for those would make
+ the downstream check report the server as having connection throttling
+ disabled, silently turning a collection failure into a security finding.
+
+ Args:
+ subscription: Azure subscription identifier.
+ resouce_group_name: Resource group containing the server.
+ server_name: PostgreSQL flexible server name.
+
+ Returns:
+ The uppercased throttling value, or ``None`` when the parameter does
+ not exist on the server.
+
+ Raises:
+ ResourceNotFoundError is handled; any other exception propagates to
+ the caller so it can be surfaced as a collection failure.
+ """
client = self.clients[subscription]
try:
connection_throttling = client.configurations.get(
resouce_group_name, server_name, "connection_throttle.enable"
)
return connection_throttling.value.upper()
- except Exception as error:
- message = str(error).lower()
- if "connection_throttle.enable" in message and (
- "not exist" in message or "not found" in message
- ):
- # The "connection_throttle.enable" parameter does not exist on
- # newer PostgreSQL versions (e.g. v18); this is expected.
- return None
- # Any other failure is a genuine problem: surface it, but still
- # degrade gracefully instead of aborting the subscription inventory.
- logger.error(
- f"Error getting connection throttling for {server_name}: {error}"
- )
+ except ResourceNotFoundError:
return None
def _get_log_retention_days(self, subscription, resouce_group_name, server_name):
client = self.clients[subscription]
try:
log_retention_days = client.configurations.get(
- resouce_group_name, server_name, "log_retention_days"
+ resouce_group_name, server_name, "logfiles.retention_days"
)
log_retention_days = log_retention_days.value
except Exception:
diff --git a/prowler/providers/azure/services/recovery/recovery_service.py b/prowler/providers/azure/services/recovery/recovery_service.py
index 38645219bd..6c414ee446 100644
--- a/prowler/providers/azure/services/recovery/recovery_service.py
+++ b/prowler/providers/azure/services/recovery/recovery_service.py
@@ -56,9 +56,14 @@ class Recovery(AzureService):
try:
vaults_dict: dict[str, dict[str, BackupVault]] = {}
for subscription_id, client in self.clients.items():
- vaults = client.vaults.list_by_subscription_id()
+ vaults_list = self.list_with_rg_scope(
+ subscription_id,
+ client.vaults.list_by_subscription_id,
+ client.vaults.list_by_resource_group,
+ )
+
vaults_dict[subscription_id] = {}
- for vault in vaults:
+ for vault in vaults_list:
vault_obj = BackupVault(
id=vault.id,
name=vault.name,
diff --git a/prowler/providers/azure/services/sqlserver/sqlserver_service.py b/prowler/providers/azure/services/sqlserver/sqlserver_service.py
index af02dace0d..274025fd7b 100644
--- a/prowler/providers/azure/services/sqlserver/sqlserver_service.py
+++ b/prowler/providers/azure/services/sqlserver/sqlserver_service.py
@@ -18,8 +18,13 @@ class SQLServer(AzureService):
sql_servers = {}
for subscription, client in self.clients.items():
try:
+ sql_servers_list = self.list_with_rg_scope(
+ subscription,
+ client.servers.list,
+ client.servers.list_by_resource_group,
+ )
+
sql_servers.update({subscription: []})
- sql_servers_list = client.servers.list()
for sql_server in sql_servers_list:
resource_group = self._get_resource_group(sql_server.id)
auditing_policies = self._get_server_blob_auditing_policies(
diff --git a/prowler/providers/azure/services/storage/storage_service.py b/prowler/providers/azure/services/storage/storage_service.py
index 74b8b3da30..863b33256e 100644
--- a/prowler/providers/azure/services/storage/storage_service.py
+++ b/prowler/providers/azure/services/storage/storage_service.py
@@ -20,8 +20,13 @@ class Storage(AzureService):
storage_accounts = {}
for subscription, client in self.clients.items():
try:
+ storage_accounts_list = self.list_with_rg_scope(
+ subscription,
+ client.storage_accounts.list,
+ client.storage_accounts.list_by_resource_group,
+ )
+
storage_accounts.update({subscription: []})
- storage_accounts_list = client.storage_accounts.list()
for storage_account in storage_accounts_list:
parts = storage_account.id.split("/")
if "resourceGroups" in parts:
diff --git a/prowler/providers/azure/services/vm/vm_service.py b/prowler/providers/azure/services/vm/vm_service.py
index b20f4b5678..8ef27c57f4 100644
--- a/prowler/providers/azure/services/vm/vm_service.py
+++ b/prowler/providers/azure/services/vm/vm_service.py
@@ -22,8 +22,12 @@ class VirtualMachines(AzureService):
for subscription_id, client in self.clients.items():
try:
- virtual_machines_list = client.virtual_machines.list_all()
virtual_machines.update({subscription_id: {}})
+ virtual_machines_list = self.list_with_rg_scope(
+ subscription_id,
+ client.virtual_machines.list_all,
+ client.virtual_machines.list,
+ )
for vm in virtual_machines_list:
storage_profile = getattr(vm, "storage_profile", None)
@@ -155,8 +159,12 @@ class VirtualMachines(AzureService):
for subscription_id, client in self.clients.items():
try:
- disks_list = client.disks.list()
disks.update({subscription_id: {}})
+ disks_list = self.list_with_rg_scope(
+ subscription_id,
+ client.disks.list,
+ client.disks.list_by_resource_group,
+ )
for disk in disks_list:
vms_attached = []
@@ -202,9 +210,13 @@ class VirtualMachines(AzureService):
vm_scale_sets = {}
for subscription_id, client in self.clients.items():
try:
- scale_sets = client.virtual_machine_scale_sets.list_all()
vm_scale_sets[subscription_id] = {}
- for scale_set in scale_sets:
+ scale_sets_list = self.list_with_rg_scope(
+ subscription_id,
+ client.virtual_machine_scale_sets.list_all,
+ client.virtual_machine_scale_sets.list,
+ )
+ for scale_set in scale_sets_list:
backend_pools = []
nic_configs = []
virtual_machine_profile = getattr(
diff --git a/prowler/providers/cloudflare/cloudflare_provider.py b/prowler/providers/cloudflare/cloudflare_provider.py
index 48763df395..9c39839f5d 100644
--- a/prowler/providers/cloudflare/cloudflare_provider.py
+++ b/prowler/providers/cloudflare/cloudflare_provider.py
@@ -46,6 +46,7 @@ class CloudflareProvider(Provider):
"""Cloudflare provider."""
_type: str = "cloudflare"
+ sdk_only: bool = False
_session: CloudflareSession
_identity: CloudflareIdentityInfo
_audit_config: dict
diff --git a/prowler/providers/common/models.py b/prowler/providers/common/models.py
index 120cc1a374..84e71c4809 100644
--- a/prowler/providers/common/models.py
+++ b/prowler/providers/common/models.py
@@ -49,6 +49,16 @@ class ProviderOutputOptions:
if updated_audit_config:
provider._audit_config = updated_audit_config
+ # Secrets validation: --scan-secrets-validate opts into live validation
+ # of discovered secrets. Set the audit_config key directly so it applies
+ # even for providers whose default config does not declare it.
+ self.scan_secrets_validate = getattr(arguments, "scan_secrets_validate", False)
+ if self.scan_secrets_validate:
+ provider = Provider.get_global_provider()
+ audit_config = provider.audit_config or {}
+ audit_config["secrets_validate"] = True
+ provider._audit_config = audit_config
+
# Check output directory, if it is not created -> create it
if self.output_directory and not self.fixer:
if not isdir(self.output_directory):
diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py
index 9c314b3233..d4793adbe7 100644
--- a/prowler/providers/common/provider.py
+++ b/prowler/providers/common/provider.py
@@ -142,6 +142,10 @@ class Provider(ABC):
_cli_help_text: str = ""
+ # CLI/SDK-only provider, hidden from the app (API/UI). Defaults True; a
+ # provider opts into the app with ``sdk_only = False``. See get_app_providers().
+ sdk_only: bool = True
+
@classmethod
def from_cli_args(cls, arguments: Namespace, fixer_config: dict) -> "Provider":
"""Instantiate the provider from CLI arguments and return the instance.
@@ -209,6 +213,65 @@ class Provider(ABC):
f"{self.__class__.__name__} has not implemented get_mutelist_finding_args()"
)
+ @classmethod
+ def get_scan_arguments(
+ cls,
+ provider_uid: str,
+ secret: dict,
+ mutelist_content: Optional[dict] = None,
+ ) -> dict:
+ """Build the provider constructor kwargs from a stored uid and secret.
+
+ This is the programmatic construction interface intended for callers
+ that will persist a provider as a single ``uid`` plus a ``secret`` dict
+ (e.g. the API), as opposed to the CLI which passes explicit per-provider
+ flags.
+
+ The base implementation is a default: it passes the secret through, adds
+ the mutelist, and intentionally drops ``provider_uid``. The API consumes
+ this contract for external providers, so an external provider whose uid
+ is part of the scan scope (e.g. a subscription or project id) or that
+ renames/filters secret keys overrides this to inject the uid into the
+ right kwarg; until it does, the base default is not the final shape for
+ that provider. Built-in providers whose scope derives from the uid are
+ mapped on the API side and do not go through this method.
+ """
+ kwargs = {**secret}
+ if mutelist_content is not None:
+ kwargs["mutelist_content"] = mutelist_content
+ return kwargs
+
+ @classmethod
+ def get_connection_arguments(cls, provider_uid: str, secret: dict) -> dict:
+ """Build the ``test_connection`` kwargs from a stored uid and secret.
+
+ Companion to :meth:`get_scan_arguments` for the connection check, which
+ often needs a different shape than the constructor. The base passes the
+ secret through and intentionally drops ``provider_uid``. An external
+ provider whose uid is part of the scope overrides this to add its
+ identity kwarg (and ``provider_id`` where its ``test_connection``
+ expects it); built-in providers are mapped on the API side and do not go
+ through this method.
+ """
+ return {**secret}
+
+ @classmethod
+ def get_credentials_schema(cls) -> dict:
+ """Return the provider's credential schemas keyed by secret type.
+
+ Maps each secret type the provider accepts (``"static"``, ``"role"`` or
+ ``"service_account"``) to the pydantic model that validates a secret of
+ that type. The provider declares which type each schema belongs to, so
+ the API validates a secret against the model for the secret type it is
+ created with and the chosen type stays bound to the shape it claims.
+
+ Each model documents each field via ``Field(description=...)`` and
+ whether it is required (no default) or optional. An empty dict means no
+ schema is declared: the secret is accepted as an object and validated by
+ :meth:`test_connection`.
+ """
+ return {}
+
def display_compliance_table(
self,
_findings: list,
@@ -344,6 +407,7 @@ class Provider(ABC):
tenant_id=arguments.tenant_id,
region=arguments.azure_region,
subscription_ids=arguments.subscription_id,
+ resource_groups=arguments.resource_groups,
config_path=arguments.config_file,
mutelist_path=arguments.mutelist_file,
fixer_config=fixer_config,
@@ -561,6 +625,16 @@ class Provider(ABC):
mutelist_path=arguments.mutelist_file,
fixer_config=fixer_config,
)
+ elif arguments.provider == "e2enetworks":
+ provider_class(
+ api_key=getattr(arguments, "e2e_networks_api_key", None),
+ auth_token=getattr(arguments, "e2e_networks_auth_token", None),
+ project_id=getattr(arguments, "e2e_networks_project_id", None),
+ locations=getattr(arguments, "region", None),
+ config_path=arguments.config_file,
+ mutelist_path=arguments.mutelist_file,
+ fixer_config=fixer_config,
+ )
elif arguments.provider == "okta":
provider_class(
okta_org_domain=getattr(arguments, "okta_org_domain", ""),
@@ -570,6 +644,12 @@ class Provider(ABC):
arguments, "okta_private_key_file", ""
),
okta_scopes=getattr(arguments, "okta_scopes", None),
+ okta_retries_max_attempts=getattr(
+ arguments, "okta_retries_max_attempts", None
+ ),
+ okta_requests_per_second=getattr(
+ arguments, "okta_requests_per_second", None
+ ),
config_path=arguments.config_file,
mutelist_path=arguments.mutelist_file,
fixer_config=fixer_config,
@@ -637,6 +717,28 @@ class Provider(ABC):
providers.add(ep.name)
return sorted(providers)
+ @staticmethod
+ def get_app_providers() -> list[str]:
+ """Return the providers the app (API/UI) may expose: those with
+ ``sdk_only = False``.
+
+ Counterpart of :meth:`get_available_providers`, which lists every
+ provider for the CLI. A provider whose class cannot be imported is
+ treated as ``sdk_only`` (excluded) so a broken plug-in never leaks in.
+ """
+ app_providers = []
+ for name in Provider.get_available_providers():
+ try:
+ provider_class = Provider.get_class(name)
+ except Exception as error:
+ logger.warning(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ continue
+ if not getattr(provider_class, "sdk_only", True):
+ app_providers.append(name)
+ return app_providers
+
@staticmethod
def is_tool_wrapper_provider(provider: str) -> bool:
"""Return True if the provider delegates scanning to an external tool.
diff --git a/tests/lib/outputs/jira/__init__.py b/prowler/providers/e2enetworks/__init__.py
similarity index 100%
rename from tests/lib/outputs/jira/__init__.py
rename to prowler/providers/e2enetworks/__init__.py
diff --git a/prowler/providers/e2enetworks/e2enetworks_provider.py b/prowler/providers/e2enetworks/e2enetworks_provider.py
new file mode 100644
index 0000000000..480f5ee4a8
--- /dev/null
+++ b/prowler/providers/e2enetworks/e2enetworks_provider.py
@@ -0,0 +1,258 @@
+import os
+
+import requests
+from colorama import Fore, Style
+
+from prowler.config.config import (
+ default_config_file_path,
+ get_default_mute_file_path,
+ load_and_validate_config_file,
+)
+from prowler.lib.logger import logger
+from prowler.lib.utils.utils import print_boxes
+from prowler.providers.common.models import Audit_Metadata, Connection
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.exceptions.exceptions import (
+ E2eNetworksCredentialsError,
+ E2eNetworksSessionError,
+)
+from prowler.providers.e2enetworks.lib.mutelist.mutelist import E2eNetworksMutelist
+from prowler.providers.e2enetworks.models import (
+ E2E_DEFAULT_LOCATIONS,
+ E2eNetworksIdentityInfo,
+ E2eNetworksSession,
+)
+
+
+class E2enetworksProvider(Provider):
+ """Provider class for E2E Networks."""
+
+ _type: str = "e2enetworks"
+ _session: E2eNetworksSession
+ _identity: E2eNetworksIdentityInfo
+ _audit_config: dict
+ _fixer_config: dict
+ _mutelist: E2eNetworksMutelist
+ audit_metadata: Audit_Metadata
+
+ def __init__(
+ self,
+ api_key: str = None,
+ auth_token: str = None,
+ project_id: str | int = None,
+ locations: list[str] | None = None,
+ config_path: str = None,
+ fixer_config: dict = None,
+ mutelist_path: str = None,
+ mutelist_content: dict = None,
+ ):
+ logger.info("Initializing E2E Networks Provider...")
+
+ self._api_key = api_key or os.getenv("E2E_NETWORKS_API_KEY")
+ self._auth_token = auth_token or os.getenv("E2E_NETWORKS_AUTH_TOKEN")
+ project_value = project_id or os.getenv("E2E_NETWORKS_PROJECT_ID")
+ self._project_id = int(project_value) if project_value else None
+ self._locations = self._resolve_locations(locations)
+
+ if not self._api_key or not self._auth_token or self._project_id is None:
+ raise E2eNetworksCredentialsError(
+ message="E2enetworksProvider requires api_key, auth_token, and project_id."
+ )
+
+ self._fixer_config = fixer_config if fixer_config else {}
+ if not config_path:
+ config_path = default_config_file_path
+ self._audit_config = load_and_validate_config_file(self._type, config_path)
+
+ if mutelist_content is not None:
+ self._mutelist = E2eNetworksMutelist(mutelist_content=mutelist_content)
+ else:
+ if not mutelist_path:
+ mutelist_path = get_default_mute_file_path(self._type)
+ self._mutelist = E2eNetworksMutelist(mutelist_path=mutelist_path)
+
+ self._session = E2enetworksProvider.setup_session(
+ api_key=self._api_key,
+ auth_token=self._auth_token,
+ project_id=self._project_id,
+ locations=self._locations,
+ )
+ self._identity = E2eNetworksIdentityInfo(
+ project_id=self._project_id,
+ locations=self._locations,
+ )
+
+ Provider.set_global_provider(self)
+
+ @staticmethod
+ def _resolve_locations(locations: list[str] | None) -> list[str]:
+ """Resolve scan locations from CLI args, env vars, or defaults.
+
+ Args:
+ locations: Optional list of location names from CLI arguments.
+
+ Returns:
+ The resolved list of E2E Networks locations to scan.
+ """
+ if locations:
+ return locations
+
+ env_region = os.getenv("E2E_NETWORKS_REGION")
+ if env_region:
+ return [env_region]
+
+ return list(E2E_DEFAULT_LOCATIONS)
+
+ @property
+ def type(self) -> str:
+ return self._type
+
+ @property
+ def session(self) -> E2eNetworksSession:
+ return self._session
+
+ @property
+ def identity(self) -> E2eNetworksIdentityInfo:
+ return self._identity
+
+ @property
+ def audit_config(self) -> dict:
+ return self._audit_config
+
+ @property
+ def fixer_config(self) -> dict:
+ return self._fixer_config
+
+ @property
+ def mutelist(self) -> E2eNetworksMutelist:
+ return self._mutelist
+
+ @staticmethod
+ def setup_session(
+ api_key: str,
+ auth_token: str,
+ project_id: int,
+ locations: list[str],
+ ) -> E2eNetworksSession:
+ """Create an authenticated E2E Networks API session.
+
+ Args:
+ api_key: E2E Networks API key.
+ auth_token: Bearer auth token for the MyAccount API.
+ project_id: E2E Networks project identifier.
+ locations: Locations included in the session scope.
+
+ Returns:
+ A configured E2eNetworksSession with an HTTP client.
+
+ Raises:
+ E2eNetworksSessionError: If session initialization fails.
+ """
+ try:
+ http_session = requests.Session()
+ http_session.headers.update(
+ {
+ "Authorization": f"Bearer {auth_token}",
+ "Content-Type": "application/json",
+ }
+ )
+ return E2eNetworksSession(
+ api_key=api_key,
+ auth_token=auth_token,
+ project_id=project_id,
+ locations=locations,
+ http_session=http_session,
+ )
+ except Exception as error:
+ raise E2eNetworksSessionError(
+ message="Failed to initialize E2E Networks session.",
+ original_exception=error,
+ ) from error
+
+ def print_credentials(self) -> None:
+ """Print the E2E Networks scan scope to stdout.
+
+ The API key and auth token are never printed, matching the behavior of
+ the other Prowler providers, which only report identity and scope.
+ """
+ report_lines = [
+ f" Authentication: {Fore.YELLOW}API Key{Style.RESET_ALL}",
+ f" Project ID: {self._project_id}",
+ f" Locations: {', '.join(self._locations)}",
+ ]
+ report_title = (
+ f"{Style.BRIGHT}Using the E2E Networks credentials below:{Style.RESET_ALL}"
+ )
+ print_boxes(report_lines, report_title)
+
+ @staticmethod
+ def test_connection(
+ api_key: str = None,
+ auth_token: str = None,
+ project_id: str | int = None,
+ locations: list[str] | None = None,
+ raise_on_exception: bool = True,
+ ) -> Connection:
+ """Test connectivity to the E2E Networks MyAccount API.
+
+ Args:
+ api_key: E2E Networks API key. Falls back to E2E_NETWORKS_API_KEY.
+ auth_token: Bearer auth token. Falls back to E2E_NETWORKS_AUTH_TOKEN.
+ project_id: Project identifier. Falls back to E2E_NETWORKS_PROJECT_ID.
+ locations: Optional locations to use for the probe request.
+ raise_on_exception: Whether to re-raise caught exceptions.
+
+ Returns:
+ Connection indicating success or containing the error.
+
+ Raises:
+ E2eNetworksCredentialsError: If required credentials are missing.
+ E2eNetworksSessionError: If the API returns a non-200 response.
+ Exception: Any unexpected error when raise_on_exception is True.
+ """
+ try:
+ api_key = api_key or os.getenv("E2E_NETWORKS_API_KEY")
+ auth_token = auth_token or os.getenv("E2E_NETWORKS_AUTH_TOKEN")
+ project_value = project_id or os.getenv("E2E_NETWORKS_PROJECT_ID")
+ project_id_int = int(project_value) if project_value else None
+ resolved_locations = locations or (
+ [os.getenv("E2E_NETWORKS_REGION")]
+ if os.getenv("E2E_NETWORKS_REGION")
+ else list(E2E_DEFAULT_LOCATIONS)
+ )
+
+ if not api_key or not auth_token or project_id_int is None:
+ raise E2eNetworksCredentialsError(
+ message="E2E Networks test_connection requires api_key, auth_token, and project_id."
+ )
+
+ session = E2enetworksProvider.setup_session(
+ api_key=api_key,
+ auth_token=auth_token,
+ project_id=project_id_int,
+ locations=resolved_locations,
+ )
+ response = session.http_session.get(
+ f"{session.base_url}/nodes/",
+ params={
+ "apikey": session.api_key,
+ "project_id": session.project_id,
+ "location": resolved_locations[0],
+ },
+ timeout=30,
+ )
+ if response.status_code != 200:
+ error_msg = (
+ f"E2E Networks connection failed with status {response.status_code}: "
+ f"{response.text}"
+ )
+ raise E2eNetworksSessionError(message=error_msg)
+
+ return Connection(is_connected=True)
+ except Exception as error:
+ logger.critical(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ if raise_on_exception:
+ raise error
+ return Connection(error=error)
diff --git a/tests/lib/timeline/__init__.py b/prowler/providers/e2enetworks/exceptions/__init__.py
similarity index 100%
rename from tests/lib/timeline/__init__.py
rename to prowler/providers/e2enetworks/exceptions/__init__.py
diff --git a/prowler/providers/e2enetworks/exceptions/exceptions.py b/prowler/providers/e2enetworks/exceptions/exceptions.py
new file mode 100644
index 0000000000..e01179bbc4
--- /dev/null
+++ b/prowler/providers/e2enetworks/exceptions/exceptions.py
@@ -0,0 +1,93 @@
+from prowler.exceptions.exceptions import ProwlerException
+
+
+# Exceptions codes from 19000 to 19999 are reserved for E2E Networks exceptions
+class E2eNetworksBaseException(ProwlerException):
+ """Base class for E2E Networks errors."""
+
+ E2E_NETWORKS_ERROR_CODES = {
+ (19000, "E2eNetworksCredentialsError"): {
+ "message": "E2E Networks credentials not found or invalid",
+ "remediation": "Provide a valid API key, auth token and project id via the E2E_NETWORKS_API_KEY, E2E_NETWORKS_AUTH_TOKEN and E2E_NETWORKS_PROJECT_ID environment variables.",
+ },
+ (19001, "E2eNetworksAuthenticationError"): {
+ "message": "E2E Networks authentication failed",
+ "remediation": "Verify the E2E Networks API key and auth token and ensure the project id is correct and accessible.",
+ },
+ (19002, "E2eNetworksSessionError"): {
+ "message": "E2E Networks session setup failed",
+ "remediation": "Review the E2E Networks credentials and network connectivity to the MyAccount API.",
+ },
+ (19003, "E2eNetworksAPIError"): {
+ "message": "E2E Networks API request failed",
+ "remediation": "Check the E2E Networks MyAccount API status and that the credentials grant access to the requested resource.",
+ },
+ (19004, "E2eNetworksIdentityError"): {
+ "message": "Unable to retrieve E2E Networks identity or project information",
+ "remediation": "Ensure the credentials allow access to the E2E Networks project and account APIs.",
+ },
+ }
+
+ def __init__(self, code, file=None, original_exception=None, message=None):
+ provider = "E2E"
+ error_info = self.E2E_NETWORKS_ERROR_CODES.get((code, self.__class__.__name__))
+ if error_info is None:
+ error_info = {
+ "message": message or "Unknown E2E Networks error",
+ "remediation": "Check the E2E Networks MyAccount API documentation for more details.",
+ }
+ elif message:
+ error_info = error_info.copy()
+ error_info["message"] = message
+ super().__init__(
+ code=code,
+ source=provider,
+ file=file,
+ original_exception=original_exception,
+ error_info=error_info,
+ )
+
+
+class E2eNetworksCredentialsError(E2eNetworksBaseException):
+ """Exception for E2E Networks credential errors."""
+
+ def __init__(self, file=None, original_exception=None, message=None):
+ super().__init__(
+ 19000, file=file, original_exception=original_exception, message=message
+ )
+
+
+class E2eNetworksAuthenticationError(E2eNetworksBaseException):
+ """Exception for E2E Networks authentication errors."""
+
+ def __init__(self, file=None, original_exception=None, message=None):
+ super().__init__(
+ 19001, file=file, original_exception=original_exception, message=message
+ )
+
+
+class E2eNetworksSessionError(E2eNetworksBaseException):
+ """Exception for E2E Networks session setup errors."""
+
+ def __init__(self, file=None, original_exception=None, message=None):
+ super().__init__(
+ 19002, file=file, original_exception=original_exception, message=message
+ )
+
+
+class E2eNetworksAPIError(E2eNetworksBaseException):
+ """Exception for E2E Networks API request errors."""
+
+ def __init__(self, file=None, original_exception=None, message=None):
+ super().__init__(
+ 19003, file=file, original_exception=original_exception, message=message
+ )
+
+
+class E2eNetworksIdentityError(E2eNetworksBaseException):
+ """Exception for E2E Networks identity errors."""
+
+ def __init__(self, file=None, original_exception=None, message=None):
+ super().__init__(
+ 19004, file=file, original_exception=original_exception, message=message
+ )
diff --git a/tests/providers/alibabacloud/__init__.py b/prowler/providers/e2enetworks/lib/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/__init__.py
rename to prowler/providers/e2enetworks/lib/__init__.py
diff --git a/tests/providers/alibabacloud/lib/__init__.py b/prowler/providers/e2enetworks/lib/api/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/lib/__init__.py
rename to prowler/providers/e2enetworks/lib/api/__init__.py
diff --git a/prowler/providers/e2enetworks/lib/api/client.py b/prowler/providers/e2enetworks/lib/api/client.py
new file mode 100644
index 0000000000..1025bd815e
--- /dev/null
+++ b/prowler/providers/e2enetworks/lib/api/client.py
@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+import requests
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.exceptions.exceptions import E2eNetworksAPIError
+from prowler.providers.e2enetworks.models import E2eNetworksSession
+
+
+def _redact_sensitive_values(message: str) -> str:
+ """Redact E2E Networks secrets from request error messages."""
+ redacted = re.sub(r"(?i)(apikey=)[^&\s]+", r"\1REDACTED", message)
+ return re.sub(
+ r"(?i)(Authorization:\s*Bearer\s+|Bearer\s+)[^\s,;]+",
+ r"\1REDACTED",
+ redacted,
+ )
+
+
+class E2eNetworksAPIClient:
+ """Shared HTTP client for E2E Networks MyAccount API requests."""
+
+ def __init__(self, session: E2eNetworksSession):
+ self.session = session
+
+ def _auth_params(self, location: str, extra: dict | None = None) -> dict[str, Any]:
+ params = {
+ "apikey": self.session.api_key,
+ "project_id": self.session.project_id,
+ "location": location,
+ }
+ if extra:
+ params.update(extra)
+ return params
+
+ def get(
+ self,
+ path: str,
+ location: str,
+ params: dict | None = None,
+ timeout: int = 30,
+ ) -> dict:
+ """Perform a GET request against the E2E Networks API."""
+ url = f"{self.session.base_url}{path}"
+ query_params = self._auth_params(location, params)
+ try:
+ response = self.session.http_session.get(
+ url,
+ params=query_params,
+ timeout=timeout,
+ )
+ response.raise_for_status()
+ payload = response.json()
+ if not isinstance(payload, dict):
+ return {"data": payload}
+ return payload
+ except requests.exceptions.RequestException as error:
+ redacted_error = _redact_sensitive_values(str(error))
+ logger.error(
+ f"E2E API GET {path} failed: {error.__class__.__name__}: {redacted_error}"
+ )
+ raise E2eNetworksAPIError(
+ message=f"GET {path} failed for location {location}",
+ original_exception=Exception(redacted_error),
+ ) from error
+
+ def get_data(
+ self,
+ path: str,
+ location: str,
+ params: dict | None = None,
+ ) -> list | dict:
+ """Return the `data` field from a standard E2E API envelope."""
+ payload = self.get(path, location=location, params=params)
+ return payload.get("data", [])
+
+ def paginate(
+ self,
+ path: str,
+ location: str,
+ params: dict | None = None,
+ per_page: int = 100,
+ ) -> list:
+ """Iterate page_no/per_page style paginated list endpoints."""
+ all_items: list = []
+ page_no = 1
+ total_pages = 1
+
+ while page_no <= total_pages:
+ page_params = {"page_no": page_no, "per_page": per_page}
+ if params:
+ page_params.update(params)
+
+ payload = self.get(path, location=location, params=page_params)
+ data = payload.get("data", [])
+ if isinstance(data, list):
+ all_items.extend(data)
+ elif isinstance(data, dict):
+ all_items.extend(data.values())
+
+ total_pages = int(payload.get("total_page_number", page_no))
+ if not data:
+ break
+ page_no += 1
+
+ return all_items
diff --git a/tests/providers/alibabacloud/lib/mutelist/__init__.py b/prowler/providers/e2enetworks/lib/arguments/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/lib/mutelist/__init__.py
rename to prowler/providers/e2enetworks/lib/arguments/__init__.py
diff --git a/prowler/providers/e2enetworks/lib/arguments/arguments.py b/prowler/providers/e2enetworks/lib/arguments/arguments.py
new file mode 100644
index 0000000000..fde5ff6355
--- /dev/null
+++ b/prowler/providers/e2enetworks/lib/arguments/arguments.py
@@ -0,0 +1,68 @@
+import os
+
+SENSITIVE_ARGUMENTS = frozenset({"--e2e-networks-api-key", "--e2e-networks-auth-token"})
+
+
+def init_parser(self):
+ """Init the E2E Networks Provider CLI parser."""
+ e2enetworks_parser = self.subparsers.add_parser(
+ "e2enetworks",
+ parents=[self.common_providers_parser],
+ help="E2E Networks Provider",
+ )
+
+ auth_group = e2enetworks_parser.add_argument_group("Authentication")
+ auth_group.add_argument(
+ "--e2e-networks-api-key",
+ nargs="?",
+ default=None,
+ metavar="E2E_NETWORKS_API_KEY",
+ help="E2E Networks API key. Use E2E_NETWORKS_API_KEY env var instead of passing directly.",
+ )
+ auth_group.add_argument(
+ "--e2e-networks-auth-token",
+ nargs="?",
+ default=None,
+ metavar="E2E_NETWORKS_AUTH_TOKEN",
+ help="E2E Networks auth token. Use E2E_NETWORKS_AUTH_TOKEN env var instead of passing directly.",
+ )
+ auth_group.add_argument(
+ "--e2e-networks-project-id",
+ nargs="?",
+ default=None,
+ metavar="E2E_NETWORKS_PROJECT_ID",
+ help="E2E Networks project ID. Use E2E_NETWORKS_PROJECT_ID env var instead of passing directly.",
+ )
+
+ regions_subparser = e2enetworks_parser.add_argument_group("Regions")
+ regions_subparser.add_argument(
+ "--region",
+ "--filter-region",
+ "-f",
+ nargs="+",
+ default=None,
+ metavar="REGION",
+ help="E2E Networks region(s) to scan (e.g. Delhi Chennai). If omitted, "
+ "uses E2E_NETWORKS_REGION or scans all regions (Delhi, Chennai).",
+ )
+
+
+def validate_arguments(arguments) -> tuple[bool, str]:
+ """Validate E2E Networks provider CLI arguments.
+
+ Only argument consistency is checked here so that listing operations such as
+ ``--list-checks`` and ``--list-services`` run without credentials. Credential
+ presence (API key, auth token and project ID) is enforced later at provider
+ initialization, when an actual scan is performed.
+ """
+ project_id = arguments.e2e_networks_project_id or os.getenv(
+ "E2E_NETWORKS_PROJECT_ID"
+ )
+
+ if project_id is not None:
+ try:
+ int(project_id)
+ except (TypeError, ValueError):
+ return False, "E2E Networks project ID must be an integer."
+
+ return True, ""
diff --git a/tests/providers/alibabacloud/services/__init__.py b/prowler/providers/e2enetworks/lib/mutelist/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/__init__.py
rename to prowler/providers/e2enetworks/lib/mutelist/__init__.py
diff --git a/prowler/providers/e2enetworks/lib/mutelist/mutelist.py b/prowler/providers/e2enetworks/lib/mutelist/mutelist.py
new file mode 100644
index 0000000000..6468169e17
--- /dev/null
+++ b/prowler/providers/e2enetworks/lib/mutelist/mutelist.py
@@ -0,0 +1,27 @@
+"""E2E Networks mutelist support for suppressing findings."""
+
+from prowler.lib.check.models import CheckReportE2eNetworks
+from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.lib.outputs.utils import unroll_dict, unroll_tags
+
+
+class E2eNetworksMutelist(Mutelist):
+ """Mutelist implementation for E2E Networks check findings."""
+
+ def is_finding_muted(self, **kwargs) -> bool:
+ """Determine whether an E2E Networks finding is muted.
+
+ Args:
+ **kwargs: Keyword arguments; must include ``finding``.
+
+ Returns:
+ True if the finding matches a mutelist entry, otherwise False.
+ """
+ finding: CheckReportE2eNetworks = kwargs["finding"]
+ return self.is_muted(
+ finding.resource_id,
+ finding.check_metadata.CheckID,
+ finding.location,
+ finding.resource_name,
+ unroll_dict(unroll_tags(finding.resource_tags)),
+ )
diff --git a/tests/providers/alibabacloud/services/actiontrail/__init__.py b/prowler/providers/e2enetworks/lib/service/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/actiontrail/__init__.py
rename to prowler/providers/e2enetworks/lib/service/__init__.py
diff --git a/prowler/providers/e2enetworks/lib/service/service.py b/prowler/providers/e2enetworks/lib/service/service.py
new file mode 100644
index 0000000000..7d5b51f463
--- /dev/null
+++ b/prowler/providers/e2enetworks/lib/service/service.py
@@ -0,0 +1,19 @@
+from prowler.providers.e2enetworks.e2enetworks_provider import E2enetworksProvider
+from prowler.providers.e2enetworks.lib.api.client import E2eNetworksAPIClient
+
+
+class E2eNetworksService:
+ """Base class for E2E Networks services."""
+
+ def __init__(self, service: str, provider: E2enetworksProvider):
+ """Initialize an E2E Networks service client.
+
+ Args:
+ service: Service name used for logging and configuration lookup.
+ provider: The active E2E Networks provider instance.
+ """
+ self.provider = provider
+ self.audit_config = provider.audit_config
+ self.fixer_config = provider.fixer_config
+ self.service = service.lower() if not service.islower() else service
+ self.client = E2eNetworksAPIClient(provider.session)
diff --git a/prowler/providers/e2enetworks/models.py b/prowler/providers/e2enetworks/models.py
new file mode 100644
index 0000000000..84d6bf4e57
--- /dev/null
+++ b/prowler/providers/e2enetworks/models.py
@@ -0,0 +1,53 @@
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+from prowler.config.config import output_file_timestamp
+from prowler.providers.common.models import ProviderOutputOptions
+
+E2E_DEFAULT_LOCATIONS = ("Delhi", "Chennai")
+E2E_BASE_URL = "https://api.e2enetworks.com/myaccount/api/v1"
+
+
+class E2eNetworksSession(BaseModel):
+ """E2E Networks API session information."""
+
+ api_key: str = Field(exclude=True, repr=False)
+ auth_token: str = Field(exclude=True, repr=False)
+ project_id: int
+ locations: list[str]
+ base_url: str = E2E_BASE_URL
+ http_session: Any = Field(default=None, exclude=True)
+
+
+class E2eNetworksIdentityInfo(BaseModel):
+ """E2E Networks identity and scoping information."""
+
+ project_id: int
+ locations: list[str]
+
+
+class E2eNetworksOutputOptions(ProviderOutputOptions):
+ """Customize output filenames for E2E Networks scans."""
+
+ def __init__(
+ self,
+ arguments: object,
+ bulk_checks_metadata: dict,
+ identity: E2eNetworksIdentityInfo,
+ ) -> None:
+ """Initialize E2E Networks output options.
+
+ Args:
+ arguments: Parsed CLI arguments for the scan.
+ bulk_checks_metadata: Loaded metadata for all checks in the scan.
+ identity: E2E Networks identity information used in output filenames.
+ """
+ super().__init__(arguments, bulk_checks_metadata)
+ if (
+ not hasattr(arguments, "output_filename")
+ or arguments.output_filename is None
+ ):
+ self.output_filename = f"prowler-output-e2enetworks-{identity.project_id}-{output_file_timestamp}"
+ else:
+ self.output_filename = arguments.output_filename
diff --git a/tests/providers/alibabacloud/services/actiontrail/actiontrail_multi_region_enabled/__init__.py b/prowler/providers/e2enetworks/services/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/actiontrail/actiontrail_multi_region_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/__init__.py
diff --git a/tests/providers/alibabacloud/services/actiontrail/actiontrail_oss_bucket_not_publicly_accessible/__init__.py b/prowler/providers/e2enetworks/services/database/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/actiontrail/actiontrail_oss_bucket_not_publicly_accessible/__init__.py
rename to prowler/providers/e2enetworks/services/database/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_client.py b/prowler/providers/e2enetworks/services/database/database_client.py
new file mode 100644
index 0000000000..5eaf4d6bda
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.database.database_service import Database
+
+database_client = Database(Provider.get_global_provider())
diff --git a/tests/providers/alibabacloud/services/cs/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.metadata.json
new file mode 100644
index 0000000000..1604d0e5f7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_backup_enabled",
+ "CheckTitle": "E2E Networks database clusters have automated backups enabled",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database clusters** should have automated backups enabled so data can be restored after failures, corruption, or accidental deletion. Automated backups capture point-in-time copies of the cluster on a recurring schedule.",
+ "Risk": "Database clusters without backups are vulnerable to permanent **data loss** from hardware failures, corruption, or accidental deletion, with no way to recover to a prior state.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **automated backups** on every database cluster that does not currently have them configured, and validate that backups can be restored.",
+ "Url": "https://hub.prowler.com/check/database_cluster_backup_enabled"
+ }
+ },
+ "Categories": [
+ "resilience"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.py b/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.py
new file mode 100644
index 0000000000..553c05f8ff
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled.py
@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_backup_enabled(Check):
+ """Check if E2E Networks database clusters have backups enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Database cluster {cluster.name} has backups enabled."
+ )
+ if not cluster.backup_enabled:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Database cluster {cluster.name} does not have backups enabled."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_cloudmonitor_enabled/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_cloudmonitor_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.metadata.json
new file mode 100644
index 0000000000..83d2d160c9
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_default_admin_username",
+ "CheckTitle": "E2E Networks database clusters do not use the default admin username",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database clusters** should be configured with a custom administrative username instead of the well-known default, reducing the predictability of privileged credentials.",
+ "Risk": "Default admin usernames are publicly known, so they increase exposure to **credential guessing** and **brute-force attacks** against the privileged database account.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Replace the default administrative username on database clusters with a unique, non-default account name and rotate the associated credentials.",
+ "Url": "https://hub.prowler.com/check/database_cluster_default_admin_username"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.py b/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.py
new file mode 100644
index 0000000000..8a5de20d0e
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_default_admin_username(Check):
+ """Check if E2E Networks database clusters do not use the default admin username."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = f"Database cluster {cluster.name} does not use the default admin username."
+ if cluster.master_username.lower() == "admin":
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Database cluster {cluster.name} uses the default admin username."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_recent/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_recent/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.metadata.json
new file mode 100644
index 0000000000..eebe425046
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_ip_whitelist_configured",
+ "CheckTitle": "E2E Networks database clusters with public IPs have IP whitelisting configured",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database clusters** that expose a public IP should restrict connectivity through an **IP whitelist** instead of accepting connections from any address (`0.0.0.0/0`).",
+ "Risk": "Publicly exposed database clusters without IP whitelisting accept connections from **any source on the internet**, greatly increasing the risk of unauthorized access and data exfiltration.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Configure an **IP whitelist** on publicly exposed database clusters to allow only trusted source ranges, or move the cluster onto private networking.",
+ "Url": "https://hub.prowler.com/check/database_cluster_ip_whitelist_configured"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.py b/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.py
new file mode 100644
index 0000000000..0537f6f9e9
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured.py
@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_ip_whitelist_configured(Check):
+ """Check if E2E Networks database clusters with public IPs have IP whitelisting configured."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ if not cluster.master_has_public_ip:
+ continue
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Database cluster {cluster.name} has IP whitelisting configured."
+ )
+ if not cluster.whitelisted_ips:
+ report.status = "FAIL"
+ report.status_extended = f"Database cluster {cluster.name} has a public IP but no whitelisted IPs."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_weekly/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_weekly/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.metadata.json
new file mode 100644
index 0000000000..a965ef84f7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_public_ip_not_assigned",
+ "CheckTitle": "E2E Networks database cluster master nodes do not expose a public IP",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "The **master node** of each **E2E Networks database cluster** should be reachable only over private networking and must not have a public IP address assigned.",
+ "Risk": "A **public database endpoint** is directly reachable from the internet, expanding the attack surface and increasing the risk of unauthorized access, brute-force attempts, and data exposure.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Remove the **public IP** from the master node of database clusters and access them through private networking such as a VPC.",
+ "Url": "https://hub.prowler.com/check/database_cluster_public_ip_not_assigned"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.py b/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.py
new file mode 100644
index 0000000000..f6116d9e68
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_public_ip_not_assigned(Check):
+ """Check if E2E Networks database clusters do not expose a public IP on the master node."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = f"Database cluster {cluster.name} master node does not have a public IP."
+ if cluster.master_has_public_ip:
+ report.status = "FAIL"
+ report.status_extended = f"Database cluster {cluster.name} master node has a public IP assigned."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_dashboard_disabled/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_running/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_dashboard_disabled/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_running/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.metadata.json
new file mode 100644
index 0000000000..8de420a54b
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_running",
+ "CheckTitle": "E2E Networks database clusters are in RUNNING status",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "low",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database clusters** should be in the `RUNNING` state, confirming they are operational rather than stopped, failed, or stuck in a transitional status.",
+ "Risk": "Database clusters that are not `RUNNING` may indicate outages, failed provisioning, or misconfiguration that impacts **availability** and the ability to recover data.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Start database clusters that are not in the `RUNNING` state and investigate the root cause of any stopped or failed clusters.",
+ "Url": "https://hub.prowler.com/check/database_cluster_running"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.py b/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.py
new file mode 100644
index 0000000000..3322f85863
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_running(Check):
+ """Check if E2E Networks database clusters are in RUNNING status."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = f"Database cluster {cluster.name} is running."
+ if cluster.status != "RUNNING":
+ report.status = "FAIL"
+ report.status_extended = f"Database cluster {cluster.name} is not running (status: {cluster.status})."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_eni_multiple_ip_enabled/__init__.py b/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_eni_multiple_ip_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.metadata.json b/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.metadata.json
new file mode 100644
index 0000000000..f459ffd40b
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_cluster_ssl_enabled",
+ "CheckTitle": "E2E Networks database clusters have SSL enabled on the master node",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database clusters** should require `SSL/TLS` on the master node so that client connections and credentials are encrypted **in transit**.",
+ "Risk": "Without `SSL/TLS`, database credentials and query data travel in **plaintext** and can be intercepted through man-in-the-middle or network eavesdropping attacks.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable `SSL/TLS` on the master node of database clusters to encrypt all client connections in transit.",
+ "Url": "https://hub.prowler.com/check/database_cluster_ssl_enabled"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.py b/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.py
new file mode 100644
index 0000000000..7def7a8c26
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_cluster_ssl_enabled(Check):
+ """Check if E2E Networks database clusters have SSL enabled on the master node."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for cluster in database_client.clusters:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=cluster)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Database cluster {cluster.name} has SSL enabled on the master node."
+ )
+ if not cluster.master_ssl_enabled:
+ report.status = "FAIL"
+ report.status_extended = f"Database cluster {cluster.name} does not have SSL enabled on the master node."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_log_service_enabled/__init__.py b/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_log_service_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/__init__.py
diff --git a/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.metadata.json b/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.metadata.json
new file mode 100644
index 0000000000..268ae1c6ad
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "database_replica_public_ip_not_assigned",
+ "CheckTitle": "E2E Networks database read replicas do not have a public IP assigned",
+ "CheckType": [],
+ "ServiceName": "database",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "database",
+ "Description": "**E2E Networks database read replicas** should be reachable only over private networking and must not have a public IP address assigned.",
+ "Risk": "Read replicas with **public IPs** are directly reachable from the internet, expanding database exposure and increasing the risk of unauthorized access to replicated data.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/database/rds/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Remove the **public IP** from database read replicas and route access through private networking.",
+ "Url": "https://hub.prowler.com/check/database_replica_public_ip_not_assigned"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.py b/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.py
new file mode 100644
index 0000000000..0dadc211a6
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned.py
@@ -0,0 +1,26 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.database.database_client import (
+ database_client,
+)
+
+
+class database_replica_public_ip_not_assigned(Check):
+ """Check if E2E Networks database read replicas do not have a public IP assigned."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for instance in database_client.instances:
+ if instance.role != "replica":
+ continue
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=instance)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Database replica {instance.name} does not have a public IP assigned."
+ )
+ if instance.has_public_ip:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Database replica {instance.name} has a public IP assigned."
+ )
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/database/database_service.py b/prowler/providers/e2enetworks/services/database/database_service.py
new file mode 100644
index 0000000000..703c2871d7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/database/database_service.py
@@ -0,0 +1,164 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+def _has_public_ip(public_ip_address: str | None) -> bool:
+ if not public_ip_address:
+ return False
+ value = str(public_ip_address).strip()
+ if not value or value.lower() in ("[]", "null", "none"):
+ return False
+ return True
+
+
+class Database(E2eNetworksService):
+ """Service class for E2E Networks DBaaS (RDS) resources."""
+
+ def __init__(self, provider):
+ super().__init__("database", provider)
+ self.clusters: list[DatabaseCluster] = []
+ self.instances: list[DatabaseInstance] = []
+ self._fetch_clusters()
+
+ def _fetch_clusters(self):
+ for location in self.provider.session.locations:
+ try:
+ cluster_list = self.client.get_data("/rds/cluster/", location=location)
+ if not isinstance(cluster_list, list):
+ continue
+
+ for item in cluster_list:
+ cluster_id = str(item.get("id", ""))
+ detail = self._get_cluster_detail(cluster_id, location)
+ merged = {**item, **detail}
+
+ master_node = merged.get("master_node", {}) or {}
+ database_info = master_node.get("database", {}) or {}
+ software = (
+ merged.get("software", {})
+ or master_node.get("plan", {}).get("software", {})
+ or {}
+ )
+
+ cluster = DatabaseCluster(
+ id=cluster_id,
+ name=merged.get("name", ""),
+ location=location,
+ status=merged.get("status", ""),
+ software_name=software.get("name", ""),
+ software_version=software.get("version", ""),
+ backup_enabled=bool(merged.get("backup_enabled", False)),
+ whitelisted_ips=merged.get("whitelisted_ips", []) or [],
+ master_ssl_enabled=bool(master_node.get("ssl", False)),
+ master_public_ip=master_node.get("public_ip_address"),
+ master_username=database_info.get("username", ""),
+ master_has_public_ip=_has_public_ip(
+ master_node.get("public_ip_address")
+ ),
+ )
+ self.clusters.append(cluster)
+
+ self.instances.append(
+ DatabaseInstance(
+ id=str(master_node.get("instance_id", cluster_id)),
+ name=master_node.get("node_name", merged.get("name", "")),
+ cluster_id=cluster_id,
+ cluster_name=cluster.name,
+ location=location,
+ role="master",
+ public_ip_address=master_node.get("public_ip_address"),
+ has_public_ip=_has_public_ip(
+ master_node.get("public_ip_address")
+ ),
+ ssl_enabled=bool(master_node.get("ssl", False)),
+ username=database_info.get("username", ""),
+ )
+ )
+
+ for slave in merged.get("slave_nodes", []) or []:
+ if not isinstance(slave, dict):
+ continue
+ slave_db = slave.get("database", {}) or {}
+ self.instances.append(
+ DatabaseInstance(
+ id=str(slave.get("instance_id", "")),
+ name=slave.get("node_name", ""),
+ cluster_id=cluster_id,
+ cluster_name=cluster.name,
+ location=location,
+ role="replica",
+ public_ip_address=slave.get("public_ip_address"),
+ has_public_ip=_has_public_ip(
+ slave.get("public_ip_address")
+ ),
+ ssl_enabled=bool(slave.get("ssl", False)),
+ username=slave_db.get("username", ""),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"database - Error fetching clusters in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _get_cluster_detail(self, cluster_id: str, location: str) -> dict:
+ if not cluster_id:
+ return {}
+ try:
+ data = self.client.get_data(
+ f"/rds/cluster/{cluster_id}/",
+ location=location,
+ )
+ return data if isinstance(data, dict) else {}
+ except Exception as error:
+ logger.error(
+ f"database - Error fetching cluster detail {cluster_id} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return {}
+
+
+class DatabaseCluster(BaseModel):
+ id: str
+ name: str
+ location: str
+ status: str = ""
+ software_name: str = ""
+ software_version: str = ""
+ backup_enabled: bool = False
+ whitelisted_ips: list = []
+ master_ssl_enabled: bool = False
+ master_public_ip: str | None = None
+ master_username: str = ""
+ master_has_public_ip: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+
+class DatabaseInstance(BaseModel):
+ id: str
+ name: str
+ cluster_id: str
+ cluster_name: str
+ location: str
+ role: str
+ public_ip_address: str | None = None
+ has_public_ip: bool = False
+ ssl_enabled: bool = False
+ username: str = ""
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_network_policy_enabled/__init__.py b/prowler/providers/e2enetworks/services/loadbalancer/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_network_policy_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/loadbalancer/__init__.py
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_private_cluster_enabled/__init__.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_private_cluster_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/__init__.py
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.metadata.json b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.metadata.json
new file mode 100644
index 0000000000..641554a2cc
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "loadbalancer_alb_https_uses_ssl_certificate",
+ "CheckTitle": "E2E Networks ALB HTTPS load balancers use an SSL certificate",
+ "CheckType": [],
+ "ServiceName": "loadbalancer",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks application load balancers** serving `HTTPS` traffic should have a valid **SSL certificate** configured so client connections are encrypted and authenticated.",
+ "Risk": "`HTTPS` load balancers without a valid **SSL certificate** expose traffic to interception and downgrade attacks, weakening **confidentiality** and **integrity** for client connections.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/load-balancer/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach a valid **SSL certificate** to every load balancer that serves `HTTPS` traffic.",
+ "Url": "https://hub.prowler.com/check/loadbalancer_alb_https_uses_ssl_certificate"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.py
new file mode 100644
index 0000000000..2ed10c1c14
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate.py
@@ -0,0 +1,25 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_client import (
+ loadbalancer_client,
+)
+
+
+class loadbalancer_alb_https_uses_ssl_certificate(Check):
+ """Check that HTTPS load balancers have an SSL certificate configured."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for lb in loadbalancer_client.load_balancers:
+ if not lb.is_alb_https:
+ continue
+
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=lb)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Load balancer {lb.name} uses an SSL certificate for HTTPS traffic."
+ )
+ if not lb.ssl_certificate_id:
+ report.status = "FAIL"
+ report.status_extended = f"Load balancer {lb.name} does not have an SSL certificate configured for HTTPS traffic."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/cs/cs_kubernetes_rbac_enabled/__init__.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/cs/cs_kubernetes_rbac_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.metadata.json b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.metadata.json
new file mode 100644
index 0000000000..b4c6a710c7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "loadbalancer_backend_health_check_enabled",
+ "CheckTitle": "E2E Networks ALB load balancers have backend health checks enabled",
+ "CheckType": [],
+ "ServiceName": "loadbalancer",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks application load balancers** should have `HTTP` **health checks** configured for their backends so traffic is only routed to healthy nodes.",
+ "Risk": "Load balancers without backend **health checks** may route traffic to failed or unhealthy nodes, causing outages and masking active compromise on degraded backends.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/load-balancer/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Configure `HTTP` **health checks** for ALB backends so unhealthy nodes are automatically removed from rotation.",
+ "Url": "https://hub.prowler.com/check/loadbalancer_backend_health_check_enabled"
+ }
+ },
+ "Categories": [
+ "resilience"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.py
new file mode 100644
index 0000000000..8602797e5f
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled.py
@@ -0,0 +1,25 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_client import (
+ loadbalancer_client,
+)
+
+
+class loadbalancer_backend_health_check_enabled(Check):
+ """Check that ALB load balancers have backend health checks configured."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for lb in loadbalancer_client.load_balancers:
+ if not lb.is_alb:
+ continue
+
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=lb)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Load balancer {lb.name} has backend health checks configured."
+ )
+ if not lb.has_backend_health_check:
+ report.status = "FAIL"
+ report.status_extended = f"Load balancer {lb.name} does not have backend health checks configured."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ecs/__init__.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/__init__.py
rename to prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.metadata.json b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.metadata.json
new file mode 100644
index 0000000000..8ecae9db08
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "loadbalancer_bitninja_enabled",
+ "CheckTitle": "E2E Networks load balancers have BitNinja protection enabled",
+ "CheckType": [],
+ "ServiceName": "loadbalancer",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "low",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks load balancers** should have **BitNinja** protection enabled to provide web application firewall coverage on public endpoints.",
+ "Risk": "Load balancers without **BitNinja** protection have reduced **WAF** coverage, increasing exposure to automated attacks and malicious traffic against public endpoints.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/load-balancer/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **BitNinja** protection on load balancer appliances to strengthen web application firewall coverage.",
+ "Url": "https://hub.prowler.com/check/loadbalancer_bitninja_enabled"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.py
new file mode 100644
index 0000000000..c08ebef982
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_client import (
+ loadbalancer_client,
+)
+
+
+class loadbalancer_bitninja_enabled(Check):
+ """Check that load balancers have BitNinja protection enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for lb in loadbalancer_client.load_balancers:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=lb)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Load balancer {lb.name} has BitNinja protection enabled."
+ )
+ if not lb.enable_bitninja:
+ report.status = "FAIL"
+ report.status_extended = f"Load balancer {lb.name} does not have BitNinja protection enabled."
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_client.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_client.py
new file mode 100644
index 0000000000..88330ec3a8
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service import (
+ LoadBalancers,
+)
+
+loadbalancer_client = LoadBalancers(Provider.get_global_provider())
diff --git a/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_service.py b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_service.py
new file mode 100644
index 0000000000..e572a2f614
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/loadbalancer/loadbalancer_service.py
@@ -0,0 +1,96 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+class LoadBalancers(E2eNetworksService):
+ """Service class for E2E Networks load balancers."""
+
+ def __init__(self, provider):
+ super().__init__("loadbalancer", provider)
+ self.load_balancers: list[LoadBalancer] = []
+ self._fetch_loadbalancers()
+
+ def _fetch_loadbalancers(self):
+ for location in self.provider.session.locations:
+ try:
+ appliances = self.client.paginate(
+ "/appliances/",
+ location=location,
+ )
+ for item in appliances:
+ context = self._extract_context(item)
+ node_detail = item.get("node_detail", {}) or {}
+ self.load_balancers.append(
+ LoadBalancer(
+ id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ location=location,
+ status=item.get("status", ""),
+ lb_mode=context.get("lb_mode", ""),
+ lb_port=str(context.get("lb_port", "")),
+ enable_bitninja=bool(context.get("enable_bitninja", False)),
+ ssl_certificate_id=self._get_ssl_certificate_id(context),
+ backends=context.get("backends", []) or [],
+ public_ip=node_detail.get("public_ip", ""),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"loadbalancer - Error fetching appliances in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ @staticmethod
+ def _extract_context(item: dict) -> dict:
+ instances = item.get("appliance_instance", []) or []
+ if not instances:
+ return {}
+ return instances[0].get("context", {}) or {}
+
+ @staticmethod
+ def _get_ssl_certificate_id(context: dict) -> str | None:
+ ssl_context = context.get("ssl_context", {}) or {}
+ certificate_id = ssl_context.get("ssl_certificate_id")
+ if certificate_id in (None, "", 0):
+ return None
+ return str(certificate_id)
+
+
+class LoadBalancer(BaseModel):
+ id: str
+ name: str
+ location: str
+ status: str = ""
+ lb_mode: str = ""
+ lb_port: str = ""
+ enable_bitninja: bool = False
+ ssl_certificate_id: str | None = None
+ backends: list = []
+ public_ip: str = ""
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+ @property
+ def is_alb(self) -> bool:
+ mode = self.lb_mode.upper()
+ return mode in ("HTTP", "HTTPS", "BOTH")
+
+ @property
+ def is_alb_https(self) -> bool:
+ mode = self.lb_mode.upper()
+ return mode in ("HTTPS", "BOTH")
+
+ @property
+ def has_backend_health_check(self) -> bool:
+ for backend in self.backends:
+ if isinstance(backend, dict) and backend.get("http_check"):
+ return True
+ return False
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_attached_disk_encrypted/__init__.py b/prowler/providers/e2enetworks/services/network/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_attached_disk_encrypted/__init__.py
rename to prowler/providers/e2enetworks/services/network/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_client.py b/prowler/providers/e2enetworks/services/network/network_client.py
new file mode 100644
index 0000000000..d7d16095d3
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.network.network_service import Network
+
+network_client = Network(Provider.get_global_provider())
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_instance_endpoint_protection_installed/__init__.py b/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_instance_endpoint_protection_installed/__init__.py
rename to prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.metadata.json b/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.metadata.json
new file mode 100644
index 0000000000..a9fecbfb0a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "network_reserveip_floating_ip_unattached",
+ "CheckTitle": "E2E Networks floating IPs are attached to nodes",
+ "CheckType": [],
+ "ServiceName": "network",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks floating (reserved) IP addresses** should be attached to a node instead of being left unassigned, since idle floating IPs can be reassigned unexpectedly.",
+ "Risk": "**Unattached floating IPs** may be reassigned unexpectedly to other resources, disrupting secure routing assumptions and potentially exposing services.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/reserve-ip/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach unassigned **floating IPs** to the intended node, or release them if they are no longer needed.",
+ "Url": "https://hub.prowler.com/check/network_reserveip_floating_ip_unattached"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.py b/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.py
new file mode 100644
index 0000000000..c24a270804
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached.py
@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.network.network_client import network_client
+
+
+class network_reserveip_floating_ip_unattached(Check):
+ """Check if E2E Networks floating IPs are attached to nodes."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for ip in network_client.reserved_ips:
+ if ip.reserved_type != "FloatingIP":
+ continue
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=ip)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Floating IP {ip.ip_address} is attached to node(s)."
+ )
+ if ip.status != "Attached" or ip.floating_ip_attached_nodes_count == 0:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Floating IP {ip.ip_address} is not attached to any node."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_instance_latest_os_patches_applied/__init__.py b/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_instance_latest_os_patches_applied/__init__.py
rename to prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.metadata.json b/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.metadata.json
new file mode 100644
index 0000000000..b8c21b4b6b
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "network_reserveip_orphaned_public_ip",
+ "CheckTitle": "E2E Networks public or addon IPs are attached to a resource",
+ "CheckType": [],
+ "ServiceName": "network",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks public and addon reserved IP addresses** should be attached to a resource, identifying orphaned addresses that remain internet-reachable without an owner.",
+ "Risk": "**Orphaned public IPs** remain internet-reachable resources that can be misused or reassigned without ownership controls, expanding the attack surface.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/reserve-ip/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach orphaned **public or addon IPs** to a resource, or delete them to remove unused internet-reachable addresses.",
+ "Url": "https://hub.prowler.com/check/network_reserveip_orphaned_public_ip"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.py b/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.py
new file mode 100644
index 0000000000..bb4a67066d
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip.py
@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.network.network_client import network_client
+
+
+class network_reserveip_orphaned_public_ip(Check):
+ """Check if E2E Networks public or addon IPs are attached."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for ip in network_client.reserved_ips:
+ if ip.reserved_type not in ("PublicIP", "AddonIP"):
+ continue
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=ip)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Reserved IP {ip.ip_address} is attached to a resource."
+ )
+ if ip.status != "Attached" or ip.vm_id is None:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Reserved IP {ip.ip_address} is orphaned (status: {ip.status})."
+ )
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/network/network_service.py b/prowler/providers/e2enetworks/services/network/network_service.py
new file mode 100644
index 0000000000..327749d22c
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_service.py
@@ -0,0 +1,158 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+class Network(E2eNetworksService):
+ """Service class for E2E Networks network resources."""
+
+ def __init__(self, provider):
+ super().__init__("network", provider)
+ self.vpcs: list[Vpc] = []
+ self.reserved_ips: list[ReservedIp] = []
+ self.vpc_tunnels: list[VpcTunnel] = []
+ self._fetch_vpcs()
+ self._fetch_reserved_ips()
+ self._fetch_vpc_tunnels()
+
+ def _fetch_vpcs(self):
+ for location in self.provider.session.locations:
+ try:
+ vpcs = self.client.paginate("/vpc/list/", location=location)
+ if not isinstance(vpcs, list):
+ continue
+ for item in vpcs:
+ gateway_node = item.get("gateway_node", {}) or {}
+ self.vpcs.append(
+ Vpc(
+ network_id=str(item.get("network_id", "")),
+ name=item.get("name", ""),
+ location=location,
+ is_active=bool(item.get("is_active", False)),
+ state=item.get("state", ""),
+ ipv4_cidr=item.get("ipv4_cidr", ""),
+ vm_count=int(item.get("vm_count", 0)),
+ gateway_node_id=str(gateway_node.get("node_id", "")),
+ gateway_public_ip=gateway_node.get("ip_address_public", ""),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"network - Error fetching VPCs in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _fetch_reserved_ips(self):
+ for location in self.provider.session.locations:
+ try:
+ ips = self.client.get_data("/reserve_ips/", location=location)
+ if not isinstance(ips, list):
+ continue
+
+ for item in ips:
+ attached_nodes = item.get("floating_ip_attached_nodes", []) or []
+ self.reserved_ips.append(
+ ReservedIp(
+ reserve_id=str(item.get("reserve_id", "")),
+ ip_address=item.get("ip_address", ""),
+ location=location,
+ status=item.get("status", ""),
+ reserved_type=item.get("reserved_type", ""),
+ vm_id=item.get("vm_id"),
+ floating_ip_attached_nodes_count=len(attached_nodes),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"network - Error fetching reserved IPs in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _fetch_vpc_tunnels(self):
+ for vpc in self.vpcs:
+ if not vpc.network_id:
+ continue
+ try:
+ tunnels = self.client.get_data(
+ f"/vpc/tunnels/{vpc.network_id}/",
+ location=vpc.location,
+ )
+ if not isinstance(tunnels, list):
+ continue
+
+ for item in tunnels:
+ self.vpc_tunnels.append(
+ VpcTunnel(
+ id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ location=vpc.location,
+ local_vpc_network_id=vpc.network_id,
+ local_vpc_name=vpc.name,
+ status=item.get("status", ""),
+ is_peer_vpc_external=bool(
+ item.get("is_peer_vpc_external", False)
+ ),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"network - Error fetching tunnels for VPC {vpc.network_id} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+
+class Vpc(BaseModel):
+ network_id: str
+ name: str
+ location: str
+ is_active: bool = False
+ state: str = ""
+ ipv4_cidr: str = ""
+ vm_count: int = 0
+ gateway_node_id: str = ""
+ gateway_public_ip: str = ""
+
+ @property
+ def resource_id(self) -> str:
+ return self.network_id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+
+class ReservedIp(BaseModel):
+ reserve_id: str
+ ip_address: str
+ location: str
+ status: str = ""
+ reserved_type: str = ""
+ vm_id: int | None = None
+ floating_ip_attached_nodes_count: int = 0
+
+ @property
+ def resource_id(self) -> str:
+ return self.reserve_id
+
+ @property
+ def resource_name(self) -> str:
+ return self.ip_address
+
+
+class VpcTunnel(BaseModel):
+ id: str
+ name: str
+ location: str
+ local_vpc_network_id: str
+ local_vpc_name: str
+ status: str = ""
+ is_peer_vpc_external: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_instance_no_legacy_network/__init__.py b/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_instance_no_legacy_network/__init__.py
rename to prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.metadata.json b/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.metadata.json
new file mode 100644
index 0000000000..59b94ba76a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "network_vpc_has_attached_nodes",
+ "CheckTitle": "E2E Networks VPCs have attached nodes",
+ "CheckType": [],
+ "ServiceName": "network",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "low",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks VPCs** should have at least one node attached, identifying unused network segments that may indicate misconfiguration or forgotten resources.",
+ "Risk": "**VPCs without attached nodes** may indicate unused network segments or misconfiguration that weakens **network segmentation** and increases management overhead.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/vpc/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach nodes to VPCs that are in use, or remove empty VPCs that are no longer required.",
+ "Url": "https://hub.prowler.com/check/network_vpc_has_attached_nodes"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.py b/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.py
new file mode 100644
index 0000000000..3b453e188a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.network.network_client import network_client
+
+
+class network_vpc_has_attached_nodes(Check):
+ """Check if E2E Networks VPCs have attached nodes."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for vpc in network_client.vpcs:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=vpc)
+ report.status = "PASS"
+ report.status_extended = (
+ f"VPC {vpc.name} has {vpc.vm_count} attached node(s)."
+ )
+ if vpc.vm_count <= 0:
+ report.status = "FAIL"
+ report.status_extended = f"VPC {vpc.name} has no attached nodes."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_securitygroup_restrict_rdp_internet/__init__.py b/prowler/providers/e2enetworks/services/network/network_vpc_is_active/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_securitygroup_restrict_rdp_internet/__init__.py
rename to prowler/providers/e2enetworks/services/network/network_vpc_is_active/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.metadata.json b/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.metadata.json
new file mode 100644
index 0000000000..8843bdf1e7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "network_vpc_is_active",
+ "CheckTitle": "E2E Networks VPCs are active",
+ "CheckType": [],
+ "ServiceName": "network",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks VPCs** should be in the `active` state so that attached workloads retain expected connectivity and network isolation.",
+ "Risk": "**Inactive VPCs** can cause connectivity failures and may leave workloads without the expected **network isolation** boundaries.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/vpc/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Activate VPCs that are `inactive` so dependent workloads keep their expected connectivity and isolation.",
+ "Url": "https://hub.prowler.com/check/network_vpc_is_active"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.py b/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.py
new file mode 100644
index 0000000000..d95027d9ae
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.network.network_client import network_client
+
+
+class network_vpc_is_active(Check):
+ """Check if E2E Networks VPCs are active."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for vpc in network_client.vpcs:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=vpc)
+ report.status = "PASS"
+ report.status_extended = f"VPC {vpc.name} is active."
+ if not vpc.is_active or vpc.state != "Active":
+ report.status = "FAIL"
+ report.status_extended = (
+ f"VPC {vpc.name} is not active (state: {vpc.state})."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_securitygroup_restrict_ssh_internet/__init__.py b/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_securitygroup_restrict_ssh_internet/__init__.py
rename to prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.metadata.json b/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.metadata.json
new file mode 100644
index 0000000000..9adbfab90e
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "network_vpc_peering_external_peer_disabled",
+ "CheckTitle": "E2E Networks VPC peering does not use external peers",
+ "CheckType": [],
+ "ServiceName": "network",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks VPC peering connections** should be established only with internal networks and must not extend trust to external peers outside the account.",
+ "Risk": "**VPC peering with external peers** expands trust boundaries and can expose private networks to third parties, enabling lateral movement across accounts.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/vpc/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Remove **VPC peering** tunnels that connect to external peers to keep private networks within trusted boundaries.",
+ "Url": "https://hub.prowler.com/check/network_vpc_peering_external_peer_disabled"
+ }
+ },
+ "Categories": [
+ "trust-boundaries"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.py b/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.py
new file mode 100644
index 0000000000..d47fa0a6df
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.network.network_client import network_client
+
+
+class network_vpc_peering_external_peer_disabled(Check):
+ """Check if E2E Networks VPC peering does not use external peers."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for tunnel in network_client.vpc_tunnels:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=tunnel)
+ report.status = "PASS"
+ report.status_extended = (
+ f"VPC peering {tunnel.name} does not use an external peer VPC."
+ )
+ if tunnel.is_peer_vpc_external:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"VPC peering {tunnel.name} uses an external peer VPC."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ecs/ecs_unattached_disk_encrypted/__init__.py b/prowler/providers/e2enetworks/services/node/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ecs/ecs_unattached_disk_encrypted/__init__.py
rename to prowler/providers/e2enetworks/services/node/__init__.py
diff --git a/tests/providers/alibabacloud/services/oss/__init__.py b/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/oss/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.metadata.json b/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.metadata.json
new file mode 100644
index 0000000000..6229383147
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_accidental_protection_enabled",
+ "CheckTitle": "E2E Networks nodes have accidental protection enabled",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should have **accidental protection** enabled to guard against unintended deletion or modification of compute instances.",
+ "Risk": "Nodes without **accidental protection** are easier to delete or modify unintentionally, increasing the risk of **service disruption** and unplanned exposure of compute resources.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **accidental protection** on nodes to prevent unintended deletion or modification.",
+ "Url": "https://hub.prowler.com/check/node_accidental_protection_enabled"
+ }
+ },
+ "Categories": [
+ "resilience"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.py b/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.py
new file mode 100644
index 0000000000..49a6ff411d
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_accidental_protection_enabled(Check):
+ """Check if E2E Networks nodes have accidental protection enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Node {node.name} has accidental protection enabled."
+ )
+ if not node.is_accidental_protection:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Node {node.name} does not have accidental protection enabled."
+ )
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/node/node_client.py b/prowler/providers/e2enetworks/services/node/node_client.py
new file mode 100644
index 0000000000..a1c9981373
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.node.node_service import Nodes
+
+node_client = Nodes(Provider.get_global_provider())
diff --git a/tests/providers/alibabacloud/services/oss/oss_bucket_logging_enabled/__init__.py b/prowler/providers/e2enetworks/services/node/node_compliance_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/oss/oss_bucket_logging_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_compliance_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.metadata.json b/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.metadata.json
new file mode 100644
index 0000000000..bb3b5f30ef
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_compliance_enabled",
+ "CheckTitle": "E2E Networks nodes have compliance mode enabled",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should run with **compliance mode** enabled so required security controls are enforced and workload activity remains auditable.",
+ "Risk": "Nodes without **compliance mode** may not enforce required security controls, increasing misconfiguration risk and weakening the **auditability** of compute workloads.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **compliance mode** on nodes to enforce required security controls and maintain auditability.",
+ "Url": "https://hub.prowler.com/check/node_compliance_enabled"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.py b/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.py
new file mode 100644
index 0000000000..bae2b16184
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_compliance_enabled(Check):
+ """Check if E2E Networks nodes have compliance mode enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = f"Node {node.name} has compliance mode enabled."
+ if not node.is_node_compliance:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Node {node.name} does not have compliance mode enabled."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/oss/oss_bucket_not_publicly_accessible/__init__.py b/prowler/providers/e2enetworks/services/node/node_encryption_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/oss/oss_bucket_not_publicly_accessible/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_encryption_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.metadata.json b/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.metadata.json
new file mode 100644
index 0000000000..6af8ca2479
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_encryption_enabled",
+ "CheckTitle": "E2E Networks nodes have disk encryption enabled",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should have **disk encryption** enabled so data stored on node volumes and snapshots is protected **at rest**.",
+ "Risk": "**Unencrypted nodes** increase the risk of **data exposure** if disks or snapshots are accessed outside normal operating controls.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **disk encryption** on nodes to protect data at rest on volumes and snapshots.",
+ "Url": "https://hub.prowler.com/check/node_encryption_enabled"
+ }
+ },
+ "Categories": [
+ "encryption"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.py b/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.py
new file mode 100644
index 0000000000..65f65feb83
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_encryption_enabled(Check):
+ """Check if E2E Networks nodes have encryption enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = f"Node {node.name} has encryption enabled."
+ if not node.is_encryption_enabled:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Node {node.name} does not have encryption enabled."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/oss/oss_bucket_secure_transport_enabled/__init__.py b/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/oss/oss_bucket_secure_transport_enabled/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.metadata.json b/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.metadata.json
new file mode 100644
index 0000000000..addcf3feb0
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_public_ip_not_assigned",
+ "CheckTitle": "E2E Networks nodes do not have a public IP assigned",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should not be assigned a public IP address, keeping compute instances off the public internet unless inbound access is explicitly required.",
+ "Risk": "Nodes with **public IP addresses** are directly reachable from the internet, expanding the attack surface and increasing exposure to unauthorized access attempts.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Remove **public IP addresses** from nodes that do not require inbound internet access and reach them over private networking.",
+ "Url": "https://hub.prowler.com/check/node_public_ip_not_assigned"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.py b/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.py
new file mode 100644
index 0000000000..a95bd4552d
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned.py
@@ -0,0 +1,18 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_public_ip_not_assigned(Check):
+ """Check if E2E Networks nodes do not have a public IP assigned."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = f"Node {node.name} does not have a public IP."
+ if node.has_public_ip:
+ report.status = "FAIL"
+ report.status_extended = f"Node {node.name} has a public IP assigned."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ram/__init__.py b/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.metadata.json b/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.metadata.json
new file mode 100644
index 0000000000..8336bc12cb
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_rescue_mode_disabled",
+ "CheckTitle": "E2E Networks nodes do not have rescue mode enabled",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should not be running in **rescue mode**, which grants elevated filesystem access and can bypass normal operating controls.",
+ "Risk": "**Rescue mode** provides elevated access to node filesystems and can bypass normal operating controls, increasing the risk of unauthorized data access or persistence.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Disable **rescue mode** on nodes once recovery tasks are complete to restore normal operating controls.",
+ "Url": "https://hub.prowler.com/check/node_rescue_mode_disabled"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.py b/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.py
new file mode 100644
index 0000000000..bde2da993d
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_rescue_mode_disabled(Check):
+ """Check if E2E Networks nodes do not have rescue mode enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Node {node.name} does not have rescue mode enabled."
+ )
+ if node.rescue_mode_status != "Disabled":
+ report.status = "FAIL"
+ report.status_extended = f"Node {node.name} has rescue mode enabled."
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/node/node_service.py b/prowler/providers/e2enetworks/services/node/node_service.py
new file mode 100644
index 0000000000..03e39be1b9
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_service.py
@@ -0,0 +1,109 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+def _has_public_ip(public_ip_address: str | None) -> bool:
+ if not public_ip_address:
+ return False
+ value = str(public_ip_address).strip()
+ if not value or value in ("[]", "null", "None"):
+ return False
+ return True
+
+
+class Nodes(E2eNetworksService):
+ """Service class for E2E Networks compute nodes."""
+
+ def __init__(self, provider):
+ super().__init__("node", provider)
+ self.nodes: list[Node] = []
+ self._fetch_nodes()
+
+ def _fetch_nodes(self):
+ for location in self.provider.session.locations:
+ try:
+ node_list = self.client.get_data("/nodes/", location=location)
+ if not isinstance(node_list, list):
+ continue
+
+ for item in node_list:
+ node_id = str(item.get("id", ""))
+ detail = self._get_node_detail(node_id, location)
+ merged = {**item, **detail}
+
+ self.nodes.append(
+ Node(
+ id=node_id,
+ name=merged.get("name", ""),
+ status=merged.get("status", ""),
+ location=location,
+ vm_id=str(merged.get("vm_id", merged.get("id", ""))),
+ public_ip_address=merged.get("public_ip_address"),
+ private_ip_address=merged.get("private_ip_address", ""),
+ is_accidental_protection=bool(
+ merged.get("is_accidental_protection", False)
+ ),
+ is_encryption_enabled=bool(
+ merged.get("isEncryptionEnabled", False)
+ ),
+ is_locked=bool(merged.get("is_locked", False)),
+ rescue_mode_status=merged.get(
+ "rescue_mode_status", "Disabled"
+ ),
+ is_node_compliance=bool(
+ merged.get("is_node_compliance", False)
+ ),
+ is_vpc_attached=bool(merged.get("is_vpc_attached", False)),
+ has_public_ip=_has_public_ip(
+ merged.get("public_ip_address")
+ ),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"node - Error fetching nodes in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _get_node_detail(self, node_id: str, location: str) -> dict:
+ if not node_id:
+ return {}
+ try:
+ data = self.client.get_data(
+ f"/nodes/{node_id}/",
+ location=location,
+ )
+ return data if isinstance(data, dict) else {}
+ except Exception as error:
+ logger.error(
+ f"node - Error fetching node detail {node_id} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return {}
+
+
+class Node(BaseModel):
+ id: str
+ name: str
+ status: str
+ location: str
+ vm_id: str
+ public_ip_address: str | None = None
+ private_ip_address: str = ""
+ is_accidental_protection: bool = False
+ is_encryption_enabled: bool = False
+ is_locked: bool = False
+ rescue_mode_status: str = "Disabled"
+ is_node_compliance: bool = False
+ is_vpc_attached: bool = False
+ has_public_ip: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
diff --git a/tests/providers/alibabacloud/services/ram/ram_no_root_access_key/__init__.py b/prowler/providers/e2enetworks/services/node/node_vpc_attached/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_no_root_access_key/__init__.py
rename to prowler/providers/e2enetworks/services/node/node_vpc_attached/__init__.py
diff --git a/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.metadata.json b/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.metadata.json
new file mode 100644
index 0000000000..59822e48e7
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "node_vpc_attached",
+ "CheckTitle": "E2E Networks nodes are attached to a VPC",
+ "CheckType": [],
+ "ServiceName": "node",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "compute",
+ "Description": "**E2E Networks nodes** should be attached to a **VPC** so their traffic benefits from network isolation and segmentation controls.",
+ "Risk": "Nodes not attached to a **VPC** may lack network isolation controls, making traffic routing and **segmentation** harder to enforce.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/compute/nodes/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach nodes to a **VPC** to enforce network isolation and segmentation for their traffic.",
+ "Url": "https://hub.prowler.com/check/node_vpc_attached"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.py b/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.py
new file mode 100644
index 0000000000..5318461d3c
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached.py
@@ -0,0 +1,18 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+
+class node_vpc_attached(Check):
+ """Check if E2E Networks nodes are attached to a VPC."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for node in node_client.nodes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=node)
+ report.status = "PASS"
+ report.status_extended = f"Node {node.name} is attached to a VPC."
+ if not node.is_vpc_attached:
+ report.status = "FAIL"
+ report.status_extended = f"Node {node.name} is not attached to a VPC."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_lowercase/__init__.py b/prowler/providers/e2enetworks/services/securitygroup/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_lowercase/__init__.py
rename to prowler/providers/e2enetworks/services/securitygroup/__init__.py
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_client.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_client.py
new file mode 100644
index 0000000000..4c938fbb2a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_service import (
+ SecurityGroups,
+)
+
+securitygroup_client = SecurityGroups(Provider.get_global_provider())
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_max_login_attempts/__init__.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_max_login_attempts/__init__.py
rename to prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/__init__.py
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.metadata.json b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.metadata.json
new file mode 100644
index 0000000000..23d765050a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "securitygroup_no_all_traffic_rule",
+ "CheckTitle": "E2E Networks security groups do not allow all traffic",
+ "CheckType": [],
+ "ServiceName": "securitygroup",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks security groups** should not have an **all-traffic rule**, which permits unrestricted inbound and outbound network access.",
+ "Risk": "Security groups that allow **all traffic** permit unrestricted network access, increasing exposure to **lateral movement** and **data exfiltration**.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/security-group/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Restrict security group rules to the required ports and sources only, removing any all-traffic rule.",
+ "Url": "https://hub.prowler.com/check/securitygroup_no_all_traffic_rule"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.py
new file mode 100644
index 0000000000..5230211d6f
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule.py
@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_client import (
+ securitygroup_client,
+)
+
+
+class securitygroup_no_all_traffic_rule(Check):
+ """Check that security groups do not allow all traffic."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for group in securitygroup_client.security_groups:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=group)
+ report.status = "PASS"
+ report.status_extended = (
+ f"Security group {group.name} does not allow all traffic."
+ )
+ if group.is_all_traffic_rule:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Security group {group.name} allows all traffic."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_max_password_age/__init__.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_max_password_age/__init__.py
rename to prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/__init__.py
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.metadata.json b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.metadata.json
new file mode 100644
index 0000000000..ebd43c61cc
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "securitygroup_no_inbound_any_all_ports",
+ "CheckTitle": "E2E Networks security groups do not allow inbound all-protocol traffic from any source",
+ "CheckType": [],
+ "ServiceName": "securitygroup",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks security groups** should not allow inbound **all-protocol** traffic from any source (`0.0.0.0/0`), which opens every port to the internet.",
+ "Risk": "Inbound **all-protocol** rules from any source expose services to the entire internet and greatly increase the likelihood of unauthorized access.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/security-group/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Replace overly permissive inbound rules with **least-privilege** rules scoped to specific ports and trusted sources.",
+ "Url": "https://hub.prowler.com/check/securitygroup_no_inbound_any_all_ports"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.py
new file mode 100644
index 0000000000..ee3c38015f
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_client import (
+ securitygroup_client,
+)
+
+
+def _is_open_network(value: str | None) -> bool:
+ if value is None:
+ return False
+ normalized = str(value).lower().strip()
+ return normalized in ("any", "0.0.0.0/0", "::/0")
+
+
+def _is_permissive_inbound(rule) -> bool:
+ if (rule.rule_type or "").lower() != "inbound":
+ return False
+ if (rule.protocol_name or "").lower() != "all":
+ return False
+ return _is_open_network(rule.network) or _is_open_network(rule.network_cidr)
+
+
+class securitygroup_no_inbound_any_all_ports(Check):
+ """Check if E2E Networks security groups do not allow inbound all-protocol traffic from any source."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for group in securitygroup_client.security_groups:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=group)
+ report.status = "PASS"
+ report.status_extended = f"Security group {group.name} does not allow inbound all-protocol traffic from any source."
+ if any(_is_permissive_inbound(rule) for rule in group.rules):
+ report.status = "FAIL"
+ report.status_extended = f"Security group {group.name} allows inbound all-protocol traffic from any source."
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_minimum_length/__init__.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_minimum_length/__init__.py
rename to prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/__init__.py
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.metadata.json b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.metadata.json
new file mode 100644
index 0000000000..15202d4a86
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.metadata.json
@@ -0,0 +1,37 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "securitygroup_restrictive_default",
+ "CheckTitle": "E2E Networks nodes do not rely on permissive default security groups",
+ "CheckType": [],
+ "ServiceName": "securitygroup",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "**E2E Networks nodes** should not rely solely on **default security groups** that have overly permissive inbound rules.",
+ "Risk": "Nodes that rely only on **permissive default security groups** inherit broad inbound access, weakening **network segmentation** and trust boundaries.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/network/security-group/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach custom security groups with **least-privilege** rules to nodes instead of relying on permissive defaults.",
+ "Url": "https://hub.prowler.com/check/securitygroup_restrictive_default"
+ }
+ },
+ "Categories": [
+ "trust-boundaries",
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.py
new file mode 100644
index 0000000000..39d750db6b
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default.py
@@ -0,0 +1,49 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_client import (
+ securitygroup_client,
+)
+
+
+def _is_open_network(value: str | None) -> bool:
+ if value is None:
+ return False
+ normalized = str(value).lower().strip()
+ return normalized in ("any", "0.0.0.0/0", "::/0")
+
+
+def _has_permissive_inbound(rules) -> bool:
+ for rule in rules:
+ if (
+ (rule.rule_type or "").lower() == "inbound"
+ and (rule.protocol_name or "").lower() == "all"
+ and (_is_open_network(rule.network) or _is_open_network(rule.network_cidr))
+ ):
+ return True
+ return False
+
+
+class securitygroup_restrictive_default(Check):
+ """Check if E2E Networks nodes do not rely on permissive default security groups."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ node_groups: dict[str, list] = {}
+ for group in securitygroup_client.node_security_groups:
+ node_groups.setdefault(group.node_id, []).append(group)
+
+ for node_id, groups in node_groups.items():
+ resource = groups[0]
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=resource)
+ report.status = "PASS"
+ report.status_extended = f"Node {resource.node_name} does not rely on a permissive default security group."
+
+ default_groups = [group for group in groups if group.is_default]
+ if default_groups and len(groups) == len(default_groups):
+ if any(
+ _has_permissive_inbound(group.rules) for group in default_groups
+ ):
+ report.status = "FAIL"
+ report.status_extended = f"Node {resource.node_name} uses only default security groups with overly permissive inbound rules."
+
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/securitygroup/securitygroup_service.py b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_service.py
new file mode 100644
index 0000000000..7a874d85ae
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/securitygroup/securitygroup_service.py
@@ -0,0 +1,147 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+class SecurityGroups(E2eNetworksService):
+ """Service class for E2E Networks security groups."""
+
+ def __init__(self, provider):
+ super().__init__("securitygroup", provider)
+ self.security_groups: list[SecurityGroupResource] = []
+ self.node_security_groups: list[NodeSecurityGroup] = []
+ self._fetch_security_groups()
+ self._fetch_node_security_groups()
+
+ def _fetch_security_groups(self):
+ for location in self.provider.session.locations:
+ try:
+ groups = self.client.get_data("/security_group/", location=location)
+ if not isinstance(groups, list):
+ continue
+
+ for item in groups:
+ rules = [
+ SecurityGroupRule(
+ id=str(rule.get("id", "")),
+ rule_type=rule.get("rule_type", ""),
+ protocol_name=rule.get("protocol_name", ""),
+ port_range=rule.get("port_range", ""),
+ network=rule.get("network", ""),
+ network_cidr=rule.get("network_cidr", ""),
+ )
+ for rule in item.get("rules", [])
+ ]
+ self.security_groups.append(
+ SecurityGroupResource(
+ id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ location=location,
+ description=item.get("description", ""),
+ is_default=bool(item.get("is_default", False)),
+ is_all_traffic_rule=bool(
+ item.get("is_all_traffic_rule", False)
+ ),
+ rules=rules,
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"securitygroup - Error fetching groups in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _fetch_node_security_groups(self):
+ from prowler.providers.e2enetworks.services.node.node_client import node_client
+
+ for node in node_client.nodes:
+ if not node.vm_id:
+ continue
+ try:
+ attached = self.client.get_data(
+ f"/security_group/{node.vm_id}/attach/",
+ location=node.location,
+ )
+ if not isinstance(attached, list):
+ continue
+
+ for item in attached:
+ rules = [
+ SecurityGroupRule(
+ id=str(rule.get("id", "")),
+ rule_type=rule.get("rule_type", ""),
+ protocol_name=rule.get("protocol_name", ""),
+ port_range=rule.get("port_range", ""),
+ network=rule.get("network", ""),
+ network_cidr=rule.get("network_cidr", ""),
+ )
+ for rule in item.get("rules", [])
+ ]
+ self.node_security_groups.append(
+ NodeSecurityGroup(
+ node_id=node.id,
+ node_name=node.name,
+ vm_id=node.vm_id,
+ location=node.location,
+ security_group_id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ is_default=bool(item.get("is_default", False)),
+ is_all_traffic_rule=bool(
+ item.get("is_all_traffic_rule", False)
+ ),
+ rules=rules,
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"securitygroup - Error fetching attached groups for node {node.id} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+
+class SecurityGroupRule(BaseModel):
+ id: str
+ rule_type: str
+ protocol_name: str
+ port_range: str
+ network: str
+ network_cidr: str
+
+
+class SecurityGroupResource(BaseModel):
+ id: str
+ name: str
+ location: str
+ description: str = ""
+ is_default: bool = False
+ is_all_traffic_rule: bool = False
+ rules: list[SecurityGroupRule] = []
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+
+class NodeSecurityGroup(BaseModel):
+ node_id: str
+ node_name: str
+ vm_id: str
+ location: str
+ security_group_id: str
+ name: str
+ is_default: bool = False
+ is_all_traffic_rule: bool = False
+ rules: list[SecurityGroupRule] = []
+
+ @property
+ def resource_id(self) -> str:
+ return f"{self.node_id}:{self.security_group_id}"
+
+ @property
+ def resource_name(self) -> str:
+ return f"{self.node_name}/{self.name}"
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_password_reuse_prevention/__init__.py b/prowler/providers/e2enetworks/services/storage/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_password_reuse_prevention/__init__.py
rename to prowler/providers/e2enetworks/services/storage/__init__.py
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_symbol/__init__.py b/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_symbol/__init__.py
rename to prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/__init__.py
diff --git a/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.metadata.json b/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.metadata.json
new file mode 100644
index 0000000000..9c3b0b3391
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "storage_block_volume_not_orphaned",
+ "CheckTitle": "E2E Networks block volumes are not orphaned",
+ "CheckType": [],
+ "ServiceName": "storage",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "low",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "storage",
+ "Description": "**E2E Networks block volumes** in the `Available` state should be attached to a node rather than left provisioned without an owner.",
+ "Risk": "**Orphaned block volumes** remain provisioned without an attached workload, increasing storage cost and the risk of retaining **sensitive data** without active ownership.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/storage/block-storage/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Attach `Available` block volumes to nodes, or delete unused volumes after confirming the data is no longer needed.",
+ "Url": "https://hub.prowler.com/check/storage_block_volume_not_orphaned"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.py b/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.py
new file mode 100644
index 0000000000..0bbf7d488a
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned.py
@@ -0,0 +1,18 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.storage.storage_client import storage_client
+
+
+class storage_block_volume_not_orphaned(Check):
+ """Check that available block volumes are attached to a node."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for volume in storage_client.block_volumes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=volume)
+ report.status = "PASS"
+ report.status_extended = f"Block volume {volume.name} is attached or not in an available orphaned state."
+ if volume.status == "Available" and not volume.is_attached:
+ report.status = "FAIL"
+ report.status_extended = f"Block volume {volume.name} is available and not attached to any node."
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/storage/storage_client.py b/prowler/providers/e2enetworks/services/storage/storage_client.py
new file mode 100644
index 0000000000..b71905e363
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.e2enetworks.services.storage.storage_service import Storage
+
+storage_client = Storage(Provider.get_global_provider())
diff --git a/tests/providers/alibabacloud/services/ram/ram_password_policy_uppercase/__init__.py b/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_password_policy_uppercase/__init__.py
rename to prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/__init__.py
diff --git a/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.metadata.json b/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.metadata.json
new file mode 100644
index 0000000000..7be4fdafe0
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "storage_efs_backup_enabled",
+ "CheckTitle": "E2E Networks EFS volumes have backup enabled",
+ "CheckType": [],
+ "ServiceName": "storage",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "storage",
+ "Description": "**E2E Networks EFS shared file systems** should have **backups** enabled so data can be recovered after failures or accidental changes.",
+ "Risk": "Shared file systems without **backups** increase the risk of permanent **data loss** during failures or accidental changes.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/storage/parallel-file-storage/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Enable **backups** on EFS shared file systems to allow recovery after failures or accidental changes.",
+ "Url": "https://hub.prowler.com/check/storage_efs_backup_enabled"
+ }
+ },
+ "Categories": [
+ "resilience"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.py b/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.py
new file mode 100644
index 0000000000..0e8272b338
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled.py
@@ -0,0 +1,20 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.storage.storage_client import storage_client
+
+
+class storage_efs_backup_enabled(Check):
+ """Check if E2E Networks EFS volumes have backup enabled."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for volume in storage_client.efs_volumes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=volume)
+ report.status = "PASS"
+ report.status_extended = f"EFS volume {volume.name} has backup enabled."
+ if not volume.is_backup_enabled:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"EFS volume {volume.name} does not have backup enabled."
+ )
+ findings.append(report)
+ return findings
diff --git a/tests/providers/alibabacloud/services/ram/ram_rotate_access_key_90_days/__init__.py b/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/ram/ram_rotate_access_key_90_days/__init__.py
rename to prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/__init__.py
diff --git a/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.metadata.json b/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.metadata.json
new file mode 100644
index 0000000000..1fd4d54e63
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.metadata.json
@@ -0,0 +1,34 @@
+{
+ "Provider": "e2enetworks",
+ "CheckID": "storage_efs_vpc_access_restricted",
+ "CheckTitle": "E2E Networks EFS volumes restrict VPC access",
+ "CheckType": [],
+ "ServiceName": "storage",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "storage",
+ "Description": "**E2E Networks EFS volumes** should restrict access to specific VPC resources instead of allowing every resource in the **VPC** to connect.",
+ "Risk": "EFS volumes that allow **all VPC resources** broaden access beyond **least privilege** within the network, increasing the blast radius of a compromised resource.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.e2enetworks.com/api/myaccount/storage/parallel-file-storage/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Restrict EFS volume access to specific VPC resources instead of allowing all resources in the VPC.",
+ "Url": "https://hub.prowler.com/check/storage_efs_vpc_access_restricted"
+ }
+ },
+ "Categories": [],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.py b/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.py
new file mode 100644
index 0000000000..c3bd715fa6
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, CheckReportE2eNetworks
+from prowler.providers.e2enetworks.services.storage.storage_client import storage_client
+
+
+class storage_efs_vpc_access_restricted(Check):
+ """Check if E2E Networks EFS volumes restrict VPC access."""
+
+ def execute(self) -> list[CheckReportE2eNetworks]:
+ findings = []
+ for volume in storage_client.efs_volumes:
+ report = CheckReportE2eNetworks(metadata=self.metadata(), resource=volume)
+ report.status = "PASS"
+ report.status_extended = (
+ f"EFS volume {volume.name} does not allow all VPC resources."
+ )
+ if volume.is_all_vpc_resources_allowed:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"EFS volume {volume.name} allows access from all VPC resources."
+ )
+ findings.append(report)
+ return findings
diff --git a/prowler/providers/e2enetworks/services/storage/storage_service.py b/prowler/providers/e2enetworks/services/storage/storage_service.py
new file mode 100644
index 0000000000..9038d727f1
--- /dev/null
+++ b/prowler/providers/e2enetworks/services/storage/storage_service.py
@@ -0,0 +1,158 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.e2enetworks.lib.service.service import E2eNetworksService
+
+
+class Storage(E2eNetworksService):
+ """Service class for E2E Networks storage resources."""
+
+ def __init__(self, provider):
+ super().__init__("storage", provider)
+ self.block_volumes: list[BlockVolume] = []
+ self.efs_volumes: list[EfsVolume] = []
+ self.epfs_volumes: list[EpfsVolume] = []
+ self._fetch_block_volumes()
+ self._fetch_efs_volumes()
+ self._fetch_epfs_volumes()
+
+ def _fetch_block_volumes(self):
+ for location in self.provider.session.locations:
+ try:
+ volumes = self.client.paginate(
+ "/block_storage/",
+ location=location,
+ )
+ for item in volumes:
+ vm_detail = item.get("vm_detail", {}) or {}
+ self.block_volumes.append(
+ BlockVolume(
+ id=str(item.get("block_id", "")),
+ name=item.get("name", ""),
+ location=location,
+ status=item.get("status", ""),
+ size_string=item.get("size_string", ""),
+ is_attached=bool(vm_detail),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"storage - Error fetching block volumes in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _fetch_efs_volumes(self):
+ for location in self.provider.session.locations:
+ try:
+ volumes = self.client.paginate("/efs/", location=location)
+ for item in volumes:
+ self.efs_volumes.append(
+ EfsVolume(
+ id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ location=location,
+ status=item.get("status", ""),
+ vpc_id=str(item.get("vpc_id", "")),
+ is_backup_enabled=bool(
+ item.get("is_backup_enabled", False)
+ ),
+ is_all_vpc_resources_allowed=bool(
+ item.get("is_all_vpc_resources_allowed", False)
+ ),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"storage - Error fetching EFS volumes in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ def _fetch_epfs_volumes(self):
+ for location in self.provider.session.locations:
+ try:
+ all_items: list = []
+ page = 1
+ total_pages = 1
+ while page <= total_pages:
+ payload = self.client.get(
+ "/epfs/",
+ location=location,
+ params={"page": page, "page_size": 100},
+ )
+ data = payload.get("data", [])
+ if isinstance(data, list):
+ all_items.extend(data)
+ total_pages = int(payload.get("total_page_number", page))
+ if not data:
+ break
+ page += 1
+
+ for item in all_items:
+ vpc = item.get("vpc", {}) or {}
+ self.epfs_volumes.append(
+ EpfsVolume(
+ id=str(item.get("id", "")),
+ name=item.get("name", ""),
+ location=location,
+ vpc_network_id=str(vpc.get("network_id", "")),
+ vpc_name=vpc.get("name", ""),
+ deleted=bool(item.get("deleted", False)),
+ )
+ )
+ except Exception as error:
+ logger.error(
+ f"storage - Error fetching EPFS volumes in {location} -- "
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+
+class BlockVolume(BaseModel):
+ id: str
+ name: str
+ location: str
+ status: str = ""
+ size_string: str = ""
+ is_attached: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+
+class EfsVolume(BaseModel):
+ id: str
+ name: str
+ location: str
+ status: str = ""
+ vpc_id: str = ""
+ is_backup_enabled: bool = False
+ is_all_vpc_resources_allowed: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
+
+
+class EpfsVolume(BaseModel):
+ id: str
+ name: str
+ location: str
+ vpc_network_id: str = ""
+ vpc_name: str = ""
+ deleted: bool = False
+
+ @property
+ def resource_id(self) -> str:
+ return self.id
+
+ @property
+ def resource_name(self) -> str:
+ return self.name
diff --git a/prowler/providers/gcp/gcp_provider.py b/prowler/providers/gcp/gcp_provider.py
index 39b3392fdf..69ab9404ef 100644
--- a/prowler/providers/gcp/gcp_provider.py
+++ b/prowler/providers/gcp/gcp_provider.py
@@ -61,6 +61,7 @@ class GcpProvider(Provider):
"""
_type: str = "gcp"
+ sdk_only: bool = False
_session: Credentials
_project_ids: list
_excluded_project_ids: list
diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py
index 0f6e7f59ea..d832a93f98 100644
--- a/prowler/providers/github/github_provider.py
+++ b/prowler/providers/github/github_provider.py
@@ -91,6 +91,7 @@ class GithubProvider(Provider):
"""
_type: str = "github"
+ sdk_only: bool = False
_auth_method: str = None
MAX_REPO_LIST_LINES: int = 10_000
MAX_REPO_NAME_LENGTH: int = 500
diff --git a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py
index bf615a21b6..1f05035723 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py
@@ -28,6 +28,8 @@ class repository_default_branch_deletion_disabled(Check):
report.status_extended = (
f"Repository {repo.name} does allow default branch deletion."
)
+ if repo.default_branch.branch_deletion_source == "ruleset_not_active":
+ report.status_extended = f"Repository {repo.name} has default branch deletion disabled in a ruleset, but the ruleset is not active."
if not repo.default_branch.branch_deletion:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json
index f774f204d0..2ef741d253 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.metadata.json
@@ -9,12 +9,13 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** blocks **force pushes** through branch protection.\n\nEvaluates whether the default branch permits force pushes.",
+ "Description": "**GitHub repository default branch** blocks **force pushes** through branch protection.\n\nEvaluates whether the default branch permits force pushes. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Allowing **force pushes on the default branch** erodes **integrity** and **auditability** by enabling history rewrites and deletion of commits. Attackers or insiders can inject unreviewed code, bypass reviews and status checks, and corrupt PRs, risking supply-chain compromise and reduced **availability**.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#allow-force-pushes"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#allow-force-pushes",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py
index 16eb7fa794..de61256080 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py
@@ -26,6 +26,11 @@ class repository_default_branch_disallows_force_push(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does allow force pushes on default branch ({repo.default_branch.name})."
+ if (
+ repo.default_branch.allow_force_pushes_source
+ == "ruleset_not_active"
+ ):
+ report.status_extended = f"Repository {repo.name} has force pushes disallowed in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."
if not repo.default_branch.allow_force_pushes:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json
index 70668adbc1..75c84dc752 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.metadata.json
@@ -9,12 +9,13 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** applies **branch protection rules** to **administrators** via `enforce_admins`, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions).",
+ "Description": "**GitHub repository default branch** applies **branch protection rules** to **administrators** via `enforce_admins`, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions). This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without admin enforcement, privileged users can bypass reviews and checks, enabling **unauthorized code changes**. A compromised admin token can inject backdoors, alter dependencies, or disable safeguards, undermining **integrity**, exposing secrets (**confidentiality**), and causing outages (**availability**).",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#do-not-allow-bypassing-the-above-settings"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#do-not-allow-bypassing-the-above-settings",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py
index 0a70cf0aea..142f0a5b7b 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py
@@ -26,6 +26,8 @@ class repository_default_branch_protection_applies_to_admins(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users."
+ if repo.default_branch.enforce_admins_source == "ruleset_not_active":
+ report.status_extended = f"Repository {repo.name} has a ruleset that would apply to administrators, but the ruleset is not active."
if repo.default_branch.enforce_admins:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json
index 8f173e868f..dbefae6179 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.metadata.json
@@ -9,12 +9,13 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** has **branch protection rules** enabled to restrict direct changes and require reviewed, validated merges. The evaluation determines whether the default branch enforces such rules.",
+ "Description": "**GitHub repository default branch** has **branch protection rules** enabled to restrict direct changes and require reviewed, validated merges. The evaluation determines whether the default branch enforces such rules. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without default-branch protection, changes can bypass reviews and checks, enabling:\n- Unauthorized direct pushes/force pushes\n- Malicious code injection and workflow tampering\n- Accidental deletions or unstable releases\nThis undermines code **integrity** and service **availability**.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py
index 1348018ee1..b305f5019a 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py
@@ -26,6 +26,8 @@ class repository_default_branch_protection_enabled(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch.name})."
+ if repo.default_branch.protected_source == "ruleset_not_active":
+ report.status_extended = f"Repository {repo.name} has a ruleset configured on default branch ({repo.default_branch.name}), but the ruleset is not active."
if repo.default_branch.protected:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.metadata.json
index 465e61aad9..53f849271a 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.metadata.json
@@ -9,12 +9,13 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** requires **Code Owners** approval for pull requests that modify paths declared in `CODEOWNERS`",
+ "Description": "**GitHub repository default branch** requires **Code Owners** approval for pull requests that modify paths declared in `CODEOWNERS`. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without required **Code Owners** review, non-owners can merge changes to sensitive code, undermining **integrity**.\nThis increases the chance of **malicious code injection**, hidden backdoors, or fragile changes that enable **data exfiltration** or cause outages, impacting confidentiality and availability.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-review-from-code-owners",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py
index 4c5b75010a..3b8a749961 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py
@@ -30,6 +30,11 @@ class repository_default_branch_requires_codeowners_review(Check):
else:
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not require code owner approval for changes to owned code."
+ if (
+ repo.default_branch.require_code_owner_reviews_source
+ == "ruleset_not_active"
+ ):
+ report.status_extended = f"Repository {repo.name} has code owner approval configured in a ruleset, but the ruleset is not active."
findings.append(report)
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json
index beaff24afb..c304ef26c1 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.metadata.json
@@ -9,12 +9,13 @@
"Severity": "medium",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** uses **branch protection** to require **conversation resolution** on pull requests (`Require conversation resolution before merging`).",
+ "Description": "**GitHub repository default branch** uses **branch protection** to require **conversation resolution** on pull requests (`Require conversation resolution before merging`). This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Unresolved threads let code with known concerns reach default, weakening **integrity** and **confidentiality**. Insecure changes or secrets may ship, enabling injection, auth bypass, or data exposure. **Availability** can suffer from regressions; review accountability is reduced.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py
index da33754cf5..9c25f8a14f 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py
@@ -26,6 +26,11 @@ class repository_default_branch_requires_conversation_resolution(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not require conversation resolution on default branch ({repo.default_branch.name})."
+ if (
+ repo.default_branch.conversation_resolution_source
+ == "ruleset_not_active"
+ ):
+ report.status_extended = f"Repository {repo.name} has conversation resolution configured in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."
if repo.default_branch.conversation_resolution:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json
index 215ab496aa..5ecb27ffc6 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.metadata.json
@@ -9,12 +9,13 @@
"Severity": "low",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** enforces `Require linear history`, blocking merge commits and allowing only `squash` or `rebase` merges",
+ "Description": "**GitHub repository default branch** enforces `Require linear history`, blocking merge commits and allowing only `squash` or `rebase` merges. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without a **linear history**, commit provenance is harder to verify, weakening **integrity** and **accountability**.\n\nMerge commits can obscure diffs entering the default branch, hindering audits and rollbacks, enabling unnoticed **malicious or unreviewed code**, and delaying incident response.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-linear-history",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py
index 29a0e51b51..86f944738c 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py
@@ -26,6 +26,11 @@ class repository_default_branch_requires_linear_history(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch.name})."
+ if (
+ repo.default_branch.required_linear_history_source
+ == "ruleset_not_active"
+ ):
+ report.status_extended = f"Repository {repo.name} has linear history configured in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."
if repo.default_branch.required_linear_history:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json
index dda4f25ea0..c7f07b1101 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.metadata.json
@@ -9,12 +9,13 @@
"Severity": "medium",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** enforces **required reviews** with a minimum of `2` approving reviews before a pull request can be merged.\n\nAssesses whether an approval threshold of at least `2` is configured for code changes targeting the default branch.",
+ "Description": "**GitHub repository default branch** enforces **required reviews** with a minimum of `2` approving reviews before a pull request can be merged.\n\nAssesses whether an approval threshold of at least `2` is configured for code changes targeting the default branch. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without multi-review approval on the default branch, a single actor can merge changes, degrading **integrity** and **accountability**. This enables:\n- supply-chain tampering or backdoors\n- introduction of exploitable bugs\n- bypass of change control via compromised accounts",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/approving-a-pull-request-with-required-reviews",
- "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging"
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py
index 6312b98d02..5ddf37e853 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py
@@ -26,6 +26,8 @@ class repository_default_branch_requires_multiple_approvals(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not enforce at least 2 approvals for code changes."
+ if repo.default_branch.approval_count_source == "ruleset_not_active":
+ report.status_extended = f"Repository {repo.name} has at least 2 approvals configured in a ruleset, but the ruleset is not active."
if repo.default_branch.approval_count >= 2:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.metadata.json
index d3d9c91806..9b045fc4e9 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.metadata.json
@@ -9,12 +9,13 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** enforces **signed and verified commits** (`Require signed commits`), allowing only commits with valid cryptographic signatures to be pushed or merged.",
+ "Description": "**GitHub repository default branch** enforces **signed and verified commits** (`Require signed commits`), allowing only commits with valid cryptographic signatures to be pushed or merged. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without required signing, commit authorship can be spoofed and unverified changes added, impacting integrity.\n- Backdoor injection\n- History tampering and forged identities\n- Release pipeline abuse and supply-chain compromise",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-signed-commits",
- "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification"
+ "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py
index 4b6aa3ae4c..110a7d4a1e 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py
@@ -26,6 +26,11 @@ class repository_default_branch_requires_signed_commits(Check):
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
report.status = "FAIL"
report.status_extended = f"Repository {repo.name} does not require signed commits on default branch ({repo.default_branch.name})."
+ if (
+ repo.default_branch.require_signed_commits_source
+ == "ruleset_not_active"
+ ):
+ report.status_extended = f"Repository {repo.name} has signed commits configured in a ruleset on default branch ({repo.default_branch.name}), but the ruleset is not active."
if repo.default_branch.require_signed_commits:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json
index 6d450fde33..d0799962ce 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json
+++ b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.metadata.json
@@ -9,13 +9,14 @@
"Severity": "high",
"ResourceType": "NotDefined",
"ResourceGroup": "devops",
- "Description": "**GitHub repository default branch** uses **required status checks**, indicating whether merges are gated by successful check results on pull requests",
+ "Description": "**GitHub repository default branch** uses **required status checks**, indicating whether merges are gated by successful check results on pull requests. This protection can be enforced through classic **branch protection** or repository **rulesets**.",
"Risk": "Without required checks, unvetted commits can be merged, degrading code **integrity** and **availability**. Skipped or failing validations may introduce vulnerable dependencies, break builds, or allow malicious code, enabling supply-chain compromise and rapid propagation to production.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule",
"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging",
- "https://docs.gearset.com/en/articles/2437757-managing-status-check-rules-in-github"
+ "https://docs.gearset.com/en/articles/2437757-managing-status-check-rules-in-github",
+ "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets"
],
"Remediation": {
"Code": {
diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py
index e67b9def2c..f96d5b058d 100644
--- a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py
+++ b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py
@@ -28,6 +28,8 @@ class repository_default_branch_status_checks_required(Check):
report.status_extended = (
f"Repository {repo.name} does not enforce status checks."
)
+ if repo.default_branch.status_checks_source == "ruleset_not_active":
+ report.status_extended = f"Repository {repo.name} has status checks configured in a ruleset, but the ruleset is not active."
if repo.default_branch.status_checks:
report.status = "PASS"
diff --git a/prowler/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file.py b/prowler/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file.py
index 7120e0411a..2ece6abf42 100644
--- a/prowler/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file.py
+++ b/prowler/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file.py
@@ -22,6 +22,9 @@ class repository_has_codeowners_file(Check):
"""
findings = []
for repo in repository_client.repositories.values():
+ if repo.archived:
+ continue
+
if repo.codeowners_exists is not None:
report = CheckReportGithub(metadata=self.metadata(), resource=repo)
if repo.codeowners_exists:
diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py
index 0201d199e4..fd8aa28662 100644
--- a/prowler/providers/github/services/repository/repository_service.py
+++ b/prowler/providers/github/services/repository/repository_service.py
@@ -202,15 +202,40 @@ class Repository(GithubService):
return None
- def _get_dismiss_stale_reviews_from_rulesets(
+ def _evaluate_default_branch_rulesets(
self, repo, default_branch: str
- ) -> tuple[Optional[bool], Optional[str]]:
- """Evaluate dismiss-stale-review coverage from repository and parent rulesets."""
- rulesets = self._get_repository_rulesets(repo)
- if rulesets is None:
- return None, None
+ ) -> dict[str, tuple[Optional[int], str]]:
+ """Evaluate default-branch protection coverage provided by rulesets.
- has_inactive_ruleset = False
+ Fetches the repository (and parent) rulesets once and walks every rule that
+ targets the default branch, mapping each ruleset rule to its equivalent classic
+ branch-protection attribute.
+
+ Returns:
+ dict mapping a ``Branch`` attribute name to a ``(value, source)`` tuple where
+ ``source`` is ``"ruleset"`` (enforced by an active ruleset), ``"ruleset_not_active"``
+ (configured by a ruleset that is not active) or absent when no ruleset addresses
+ the attribute. ``value`` is only meaningful for ``approval_count`` (the enforced
+ review count); for boolean attributes it is ``None`` and the caller derives the
+ value from ``source`` and the attribute polarity.
+ """
+ result: dict[str, tuple[Optional[int], str]] = {}
+ rulesets = self._get_repository_rulesets(repo)
+ if not rulesets:
+ return result
+
+ active: set[str] = set()
+ inactive: set[str] = set()
+ active_approval_count: Optional[int] = None
+ inactive_approval_count: Optional[int] = None
+ any_active_ruleset = False
+ any_inactive_ruleset = False
+ # A ruleset with no bypass actors applies to everyone, including administrators
+ # (the rulesets equivalent of "enforce admins"). A ruleset that has bypass actors
+ # would not apply to admins even if activated, so it must not drive the
+ # enforce-admins finding in either the active or the inactive case.
+ admins_enforced_active = False
+ admins_configured_inactive = False
for ruleset in rulesets:
if ruleset.get("target") != "branch":
@@ -219,26 +244,119 @@ class Repository(GithubService):
if not self._ruleset_targets_default_branch(ruleset, default_branch):
continue
+ enforcement = ruleset.get("enforcement")
+ is_active = enforcement in {"active", "enabled"}
+ is_inactive = enforcement in {"disabled", "evaluate"}
+ if not (is_active or is_inactive):
+ continue
+
+ has_no_bypass_actors = not (ruleset.get("bypass_actors") or [])
+ if is_active:
+ any_active_ruleset = True
+ if has_no_bypass_actors:
+ admins_enforced_active = True
+ else:
+ any_inactive_ruleset = True
+ if has_no_bypass_actors:
+ admins_configured_inactive = True
+
+ bucket = active if is_active else inactive
+
for rule in ruleset.get("rules") or []:
- if rule.get("type") != "pull_request":
- continue
+ rule_type = rule.get("type")
+ params = rule.get("parameters") or {}
- dismiss_stale_reviews = (rule.get("parameters") or {}).get(
- "dismiss_stale_reviews_on_push"
- )
- if dismiss_stale_reviews is not True:
- continue
+ if rule_type == "required_linear_history":
+ bucket.add("required_linear_history")
+ elif rule_type == "required_signatures":
+ bucket.add("require_signed_commits")
+ elif rule_type == "required_status_checks":
+ # Only enforced when at least one status check is configured;
+ # an empty list (or just strict policy) requires nothing.
+ if params.get("required_status_checks"):
+ bucket.add("status_checks")
+ elif rule_type == "non_fast_forward":
+ # Presence of the rule disallows force pushes.
+ bucket.add("allow_force_pushes")
+ elif rule_type == "deletion":
+ # Presence of the rule disallows branch deletion.
+ bucket.add("branch_deletion")
+ elif rule_type == "pull_request":
+ bucket.add("require_pull_request")
+ if params.get("require_code_owner_review") is True:
+ bucket.add("require_code_owner_reviews")
+ if params.get("required_review_thread_resolution") is True:
+ bucket.add("conversation_resolution")
+ if params.get("dismiss_stale_reviews_on_push") is True:
+ bucket.add("dismiss_stale_reviews")
+ count = params.get("required_approving_review_count")
+ if isinstance(count, int):
+ if is_active:
+ active_approval_count = max(
+ active_approval_count or 0, count
+ )
+ else:
+ inactive_approval_count = max(
+ inactive_approval_count or 0, count
+ )
- enforcement = ruleset.get("enforcement")
- if enforcement in {"active", "enabled"}:
- return True, "ruleset"
- if enforcement in {"disabled", "evaluate"}:
- has_inactive_ruleset = True
+ for concept in (
+ "required_linear_history",
+ "require_signed_commits",
+ "status_checks",
+ "allow_force_pushes",
+ "branch_deletion",
+ "require_pull_request",
+ "require_code_owner_reviews",
+ "conversation_resolution",
+ "dismiss_stale_reviews",
+ ):
+ if concept in active:
+ result[concept] = (None, "ruleset")
+ elif concept in inactive:
+ result[concept] = (None, "ruleset_not_active")
- if has_inactive_ruleset:
- return False, "ruleset_not_active"
+ if active_approval_count is not None:
+ result["approval_count"] = (active_approval_count, "ruleset")
+ elif inactive_approval_count is not None:
+ result["approval_count"] = (inactive_approval_count, "ruleset_not_active")
- return None, None
+ if any_active_ruleset:
+ result["protected"] = (None, "ruleset")
+ elif any_inactive_ruleset:
+ result["protected"] = (None, "ruleset_not_active")
+
+ if admins_enforced_active:
+ result["enforce_admins"] = (None, "ruleset")
+ elif admins_configured_inactive:
+ result["enforce_admins"] = (None, "ruleset_not_active")
+
+ return result
+
+ @staticmethod
+ def _merge_ruleset_bool(
+ classic_value: Optional[bool], ruleset_source: Optional[str], good: bool = True
+ ) -> tuple[Optional[bool], Optional[str]]:
+ """Merge a boolean branch-protection attribute with its ruleset evaluation.
+
+ Args:
+ classic_value: The value resolved from classic branch protection.
+ ruleset_source: ``"ruleset"``, ``"ruleset_not_active"`` or ``None``.
+ good: The compliant value for the attribute (``True`` for positive attributes,
+ ``False`` for inverted ones such as ``allow_force_pushes``).
+
+ Returns:
+ A ``(value, source)`` tuple. Classic protection wins when it already satisfies
+ the control; otherwise an active ruleset enforces the compliant value, and an
+ inactive ruleset surfaces the non-compliant value with a ``"ruleset_not_active"``
+ source so checks can explain the gap.
+ """
+ classic_pass = classic_value == good
+ if ruleset_source == "ruleset":
+ return good, "ruleset"
+ if ruleset_source == "ruleset_not_active" and not classic_pass:
+ return (not good), "ruleset_not_active"
+ return classic_value, ("classic" if classic_pass else None)
def _list_repositories(self):
"""
@@ -398,6 +516,17 @@ class Repository(GithubService):
conversation_resolution = False
dismiss_stale_reviews = False
dismiss_stale_reviews_source = None
+ protected_source = None
+ require_pull_request_source = None
+ approval_count_source = None
+ required_linear_history_source = None
+ allow_force_pushes_source = None
+ branch_deletion_source = None
+ require_code_owner_reviews_source = None
+ require_signed_commits_source = None
+ status_checks_source = None
+ enforce_admins_source = None
+ conversation_resolution_source = None
try:
branch = repo.get_branch(default_branch)
if branch.protected:
@@ -458,20 +587,98 @@ class Repository(GithubService):
f"{repo.full_name}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
- if dismiss_stale_reviews is not None:
+ # Branch protection enforced through rulesets is equivalent to classic branch
+ # protection, so merge any ruleset coverage before reporting findings to avoid
+ # false positives for repositories that have migrated to rulesets.
+ if branch_protection is not None:
+ ruleset_eval = self._evaluate_default_branch_rulesets(
+ repo, default_branch
+ )
+
+ branch_protection, protected_source = self._merge_ruleset_bool(
+ branch_protection, ruleset_eval.get("protected", (None, None))[1]
+ )
+ require_pr, require_pull_request_source = self._merge_ruleset_bool(
+ require_pr,
+ ruleset_eval.get("require_pull_request", (None, None))[1],
+ )
(
- ruleset_dismiss_stale_reviews,
- ruleset_source,
- ) = self._get_dismiss_stale_reviews_from_rulesets(repo, default_branch)
- if ruleset_dismiss_stale_reviews:
+ required_linear_history,
+ required_linear_history_source,
+ ) = self._merge_ruleset_bool(
+ required_linear_history,
+ ruleset_eval.get("required_linear_history", (None, None))[1],
+ )
+ (
+ require_signed_commits,
+ require_signed_commits_source,
+ ) = self._merge_ruleset_bool(
+ require_signed_commits,
+ ruleset_eval.get("require_signed_commits", (None, None))[1],
+ )
+ status_checks, status_checks_source = self._merge_ruleset_bool(
+ status_checks, ruleset_eval.get("status_checks", (None, None))[1]
+ )
+ (
+ require_code_owner_reviews,
+ require_code_owner_reviews_source,
+ ) = self._merge_ruleset_bool(
+ require_code_owner_reviews,
+ ruleset_eval.get("require_code_owner_reviews", (None, None))[1],
+ )
+ (
+ conversation_resolution,
+ conversation_resolution_source,
+ ) = self._merge_ruleset_bool(
+ conversation_resolution,
+ ruleset_eval.get("conversation_resolution", (None, None))[1],
+ )
+ enforce_admins, enforce_admins_source = self._merge_ruleset_bool(
+ enforce_admins,
+ ruleset_eval.get("enforce_admins", (None, None))[1],
+ )
+ allow_force_pushes, allow_force_pushes_source = (
+ self._merge_ruleset_bool(
+ allow_force_pushes,
+ ruleset_eval.get("allow_force_pushes", (None, None))[1],
+ good=False,
+ )
+ )
+ branch_deletion, branch_deletion_source = self._merge_ruleset_bool(
+ branch_deletion,
+ ruleset_eval.get("branch_deletion", (None, None))[1],
+ good=False,
+ )
+
+ # Dismiss stale reviews keeps its dedicated handling so the classic source
+ # set above (when enabled) is preserved.
+ _, dismiss_source = ruleset_eval.get(
+ "dismiss_stale_reviews", (None, None)
+ )
+ if dismiss_source == "ruleset":
dismiss_stale_reviews = True
dismiss_stale_reviews_source = "ruleset"
elif (
- ruleset_source == "ruleset_not_active" and not dismiss_stale_reviews
+ dismiss_source == "ruleset_not_active" and not dismiss_stale_reviews
):
dismiss_stale_reviews = False
dismiss_stale_reviews_source = "ruleset_not_active"
+ # Approval count takes the strongest requirement between classic and rulesets.
+ approval_value, approval_source = ruleset_eval.get(
+ "approval_count", (None, None)
+ )
+ if approval_source == "ruleset" and approval_value is not None:
+ if approval_value > approval_cnt:
+ approval_cnt = approval_value
+ approval_count_source = "ruleset"
+ elif (
+ approval_source == "ruleset_not_active"
+ and (approval_value or 0) >= 2
+ and approval_cnt < 2
+ ):
+ approval_count_source = "ruleset_not_active"
+
secret_scanning_enabled = False
dependabot_alerts_enabled = False
try:
@@ -517,17 +724,28 @@ class Repository(GithubService):
default_branch=Branch(
name=default_branch,
protected=branch_protection,
+ protected_source=protected_source,
default_branch=True,
require_pull_request=require_pr,
+ require_pull_request_source=require_pull_request_source,
approval_count=approval_cnt,
+ approval_count_source=approval_count_source,
required_linear_history=required_linear_history,
+ required_linear_history_source=required_linear_history_source,
allow_force_pushes=allow_force_pushes,
+ allow_force_pushes_source=allow_force_pushes_source,
branch_deletion=branch_deletion,
+ branch_deletion_source=branch_deletion_source,
status_checks=status_checks,
+ status_checks_source=status_checks_source,
enforce_admins=enforce_admins,
+ enforce_admins_source=enforce_admins_source,
conversation_resolution=conversation_resolution,
+ conversation_resolution_source=conversation_resolution_source,
require_code_owner_reviews=require_code_owner_reviews,
+ require_code_owner_reviews_source=require_code_owner_reviews_source,
require_signed_commits=require_signed_commits,
+ require_signed_commits_source=require_signed_commits_source,
dismiss_stale_reviews=dismiss_stale_reviews,
dismiss_stale_reviews_source=dismiss_stale_reviews_source,
),
@@ -599,17 +817,28 @@ class Branch(BaseModel):
name: str
protected: Optional[bool]
+ protected_source: Optional[str] = None
default_branch: bool
require_pull_request: Optional[bool]
+ require_pull_request_source: Optional[str] = None
approval_count: Optional[int]
+ approval_count_source: Optional[str] = None
required_linear_history: Optional[bool]
+ required_linear_history_source: Optional[str] = None
allow_force_pushes: Optional[bool]
+ allow_force_pushes_source: Optional[str] = None
branch_deletion: Optional[bool]
+ branch_deletion_source: Optional[str] = None
status_checks: Optional[bool]
+ status_checks_source: Optional[str] = None
enforce_admins: Optional[bool]
+ enforce_admins_source: Optional[str] = None
require_code_owner_reviews: Optional[bool]
+ require_code_owner_reviews_source: Optional[str] = None
require_signed_commits: Optional[bool]
+ require_signed_commits_source: Optional[str] = None
conversation_resolution: Optional[bool]
+ conversation_resolution_source: Optional[str] = None
dismiss_stale_reviews: Optional[bool]
dismiss_stale_reviews_source: Optional[str] = None
diff --git a/prowler/providers/googleworkspace/googleworkspace_provider.py b/prowler/providers/googleworkspace/googleworkspace_provider.py
index 4c431aa736..2a40a59ddf 100644
--- a/prowler/providers/googleworkspace/googleworkspace_provider.py
+++ b/prowler/providers/googleworkspace/googleworkspace_provider.py
@@ -54,6 +54,7 @@ class GoogleworkspaceProvider(Provider):
"""
_type: str = "googleworkspace"
+ sdk_only: bool = False
_session: GoogleWorkspaceSession
_identity: GoogleWorkspaceIdentityInfo
_domain_resource: GoogleWorkspaceResource
diff --git a/prowler/providers/iac/iac_provider.py b/prowler/providers/iac/iac_provider.py
index b91fdf070e..df9114e033 100644
--- a/prowler/providers/iac/iac_provider.py
+++ b/prowler/providers/iac/iac_provider.py
@@ -28,6 +28,7 @@ from prowler.providers.common.provider import Provider
class IacProvider(Provider):
_type: str = "iac"
+ sdk_only: bool = False
audit_metadata: Audit_Metadata
def __init__(
diff --git a/prowler/providers/image/image_provider.py b/prowler/providers/image/image_provider.py
index b142240867..7a245e4125 100644
--- a/prowler/providers/image/image_provider.py
+++ b/prowler/providers/image/image_provider.py
@@ -59,6 +59,7 @@ class ImageProvider(Provider):
"""
_type: str = "image"
+ sdk_only: bool = False
FINDING_BATCH_SIZE: int = 100
MAX_IMAGE_LIST_LINES: int = 10_000
MAX_IMAGE_NAME_LENGTH: int = 500
diff --git a/prowler/providers/kubernetes/kubernetes_provider.py b/prowler/providers/kubernetes/kubernetes_provider.py
index 2572b5be88..b350a18ebc 100644
--- a/prowler/providers/kubernetes/kubernetes_provider.py
+++ b/prowler/providers/kubernetes/kubernetes_provider.py
@@ -58,6 +58,7 @@ class KubernetesProvider(Provider):
"""
_type: str = "kubernetes"
+ sdk_only: bool = False
_session: KubernetesSession
_namespaces: list
_audit_config: dict
diff --git a/tests/providers/alibabacloud/services/rds/__init__.py b/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/__init__.py
rename to prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/__init__.py
diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.metadata.json b/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.metadata.json
new file mode 100644
index 0000000000..f25b22231f
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.metadata.json
@@ -0,0 +1,38 @@
+{
+ "Provider": "kubernetes",
+ "CheckID": "core_minimize_hostpath_volume_mounts",
+ "CheckTitle": "Pod does not use hostPath volumes",
+ "CheckType": [],
+ "ServiceName": "core",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "Pod",
+ "ResourceGroup": "container",
+ "Description": "**Kubernetes Pods** are evaluated for volumes of type `hostPath`, which mount paths from the node filesystem into a pod.",
+ "Risk": "`hostPath` volumes weaken the container boundary by exposing node files to workloads. A compromised container can read sensitive host data, tamper with node files, or use writable mounts to escalate privileges and affect node availability.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://kubernetes.io/docs/concepts/storage/volumes/#hostpath",
+ "https://kubernetes.io/docs/concepts/security/pod-security-standards/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "kubectl get pod <pod_name> -n <namespace> -o jsonpath='{range .metadata.ownerReferences[*]}{.kind}/{.name}{\"\\n\"}{end}{range .spec.volumes[?(@.hostPath)]}{.name}{\"\\t\"}{.hostPath.path}{\"\\n\"}{end}'\n# If the Pod is managed by a controller, edit the owning workload and remove hostPath volumes from its Pod template:\nkubectl edit <workload_kind>/<workload_name> -n <namespace>\n# For a standalone Pod, export the manifest, remove hostPath volumes, then recreate it:\nkubectl get pod <pod_name> -n <namespace> -o yaml > pod.yaml\nkubectl delete pod <pod_name> -n <namespace>\nkubectl apply -f pod.yaml",
+ "NativeIaC": "",
+ "Other": "1. Identify the workload that owns the failing Pod (Deployment/DaemonSet/StatefulSet/Job) or confirm it is a standalone Pod\n2. Edit the Pod template and remove volumes that define `hostPath`\n3. Replace hostPath with a safer volume type such as ConfigMap, Secret, emptyDir, persistentVolumeClaim, or a CSI volume when appropriate\n4. Apply the updated manifest and allow the workload to recreate Pods without hostPath volumes",
+ "Terraform": "```hcl\nresource \"kubernetes_pod\" \"<example_resource_name>\" {\n metadata {\n name = \"<example_resource_name>\"\n }\n spec {\n container {\n name = \"app\"\n image = \"nginx\"\n }\n # Do not define host_path blocks under volume.\n }\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Disallow `hostPath` volumes by default with Pod Security Admission or policy-as-code controls. Permit narrow, read-only exceptions only for trusted system workloads, and prefer Kubernetes-native volume types that do not expose the node filesystem.",
+ "Url": "https://hub.prowler.com/check/core_minimize_hostpath_volume_mounts"
+ }
+ },
+ "Categories": [
+ "container-security",
+ "trust-boundaries"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "Exceptions for hostPath volumes should be narrowly scoped, read-only where possible, and monitored."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.py b/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.py
new file mode 100644
index 0000000000..a693f52f0e
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts.py
@@ -0,0 +1,23 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_minimize_hostpath_volume_mounts(Check):
+ def execute(self) -> list[Check_Report_Kubernetes]:
+ findings = []
+ for pod in core_client.pods.values():
+ report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+ report.status = "PASS"
+ report.status_extended = f"Pod {pod.name} does not use hostPath volumes."
+
+ for volume in pod.volumes or []:
+ if volume.get("host_path"):
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Pod {pod.name} uses hostPath volume {volume['name']}."
+ )
+ break
+
+ findings.append(report)
+
+ return findings
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_postgresql_log_connections_enabled/__init__.py b/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/rds_instance_postgresql_log_connections_enabled/__init__.py
rename to prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/__init__.py
diff --git a/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.metadata.json b/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.metadata.json
new file mode 100644
index 0000000000..d28b7ab94f
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+ "Provider": "kubernetes",
+ "CheckID": "core_readonly_root_filesystem_enabled",
+ "CheckTitle": "Containers should run with a read-only root filesystem",
+ "CheckType": [],
+ "ServiceName": "core",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "Pod",
+ "ResourceGroup": "container",
+ "Description": "**Kubernetes Pods** are evaluated to ensure every container sets `readOnlyRootFilesystem: true` in its `securityContext`. A writable root filesystem lets an attacker who gains code execution modify binaries, drop tools, or persist malicious files inside the container.",
+ "Risk": "Without a read-only root filesystem an attacker with code execution inside a container can tamper with binaries or libraries (**integrity**), write credential files or exfiltration tools (**confidentiality**), and persist across process restarts (**availability**).",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://kubernetes.io/docs/tasks/configure-pod-container/security-context/",
+ "https://kubernetes.io/docs/concepts/security/pod-security-standards/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "kubectl patch deployment/<workload-name> -n <namespace> -p '{\"spec\":{\"template\":{\"spec\":{\"containers\":[{\"name\":\"<container-name>\",\"securityContext\":{\"readOnlyRootFilesystem\":true}}]}}}}'\n# Deployment template example for regular containers. For init containers, use initContainers instead of containers. Ephemeral containers are added through the ephemeralcontainers subresource; remove or recreate debug containers with a compliant securityContext.",
+ "NativeIaC": "",
+ "Other": "1. Open your Kubernetes Dashboard (or your cloud provider's Kubernetes console) and locate the workload managing the failing Pod (Deployment/StatefulSet/DaemonSet)\n2. Click Edit to modify the manifest (YAML)\n3. For each container missing `securityContext.readOnlyRootFilesystem: true`, add or set it to `true`\n4. If the container needs write access, mount a writable `emptyDir` or `persistentVolumeClaim` at the specific paths that require writes instead of making the entire root filesystem writable\n5. Save/Apply the changes to trigger a rollout\n6. Verify new Pods have `securityContext.readOnlyRootFilesystem` set to `true`",
+ "Terraform": "```hcl\nresource \"kubernetes_pod\" \"main\" {\n metadata {\n name = \"<example_resource_name>\"\n }\n spec {\n container {\n name = \"app\"\n image = \"nginx\"\n security_context {\n read_only_root_filesystem = true # Critical: enforce a read-only root filesystem\n }\n }\n }\n}\n```"
+ },
+ "Recommendation": {
+ "Text": "Set `readOnlyRootFilesystem: true` for every regular, init, and ephemeral container that is part of a Pod spec. Mount writable `emptyDir` volumes only at the specific paths that genuinely need write access (e.g., `/tmp`, `/var/cache`). Enforce this at admission time with custom admission policies such as ValidatingAdmissionPolicy or OPA/Gatekeeper.",
+ "Url": "https://hub.prowler.com/check/core_readonly_root_filesystem_enabled"
+ }
+ },
+ "Categories": [
+ "container-security"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "Regular, init, and ephemeral containers are evaluated. Workloads that genuinely require root filesystem writes should mount writable volumes at specific paths and may be exempted via Prowler's mutelist."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.py b/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.py
new file mode 100644
index 0000000000..cb7eebcdf7
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled.py
@@ -0,0 +1,38 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_readonly_root_filesystem_enabled(Check):
+ """Check whether every container in each Pod has readOnlyRootFilesystem set to true."""
+
+ def execute(self) -> list[Check_Report_Kubernetes]:
+ """Execute the Kubernetes read-only root filesystem check.
+
+ Returns:
+ List of check reports for Kubernetes pods.
+ """
+ findings = []
+ for pod in core_client.pods.values():
+ report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+ report.status = "PASS"
+ report.status_extended = f"Pod {pod.name} has read-only root filesystem enabled for all containers."
+
+ for containers in (
+ pod.containers,
+ pod.init_containers,
+ pod.ephemeral_containers,
+ ):
+ for container in (containers or {}).values():
+ if (
+ container.security_context.get("read_only_root_filesystem")
+ is not True
+ ):
+ report.status = "FAIL"
+ report.status_extended = f"Pod {pod.name} container {container.name} does not have readOnlyRootFilesystem set to true."
+ break
+ if report.status == "FAIL":
+ break
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/kubernetes/services/core/core_service.py b/prowler/providers/kubernetes/services/core/core_service.py
index b53a81779c..dc44d8f51f 100644
--- a/prowler/providers/kubernetes/services/core/core_service.py
+++ b/prowler/providers/kubernetes/services/core/core_service.py
@@ -32,6 +32,7 @@ class Core(KubernetesService):
ephemeral_containers = self._build_containers(
pod.spec.ephemeral_containers
)
+ volumes = self._build_volumes(pod.spec.volumes)
self.pods[pod.metadata.uid] = Pod(
name=pod.metadata.name,
uid=pod.metadata.uid,
@@ -54,6 +55,7 @@ class Core(KubernetesService):
containers=containers,
init_containers=init_containers,
ephemeral_containers=ephemeral_containers,
+ volumes=volumes,
)
except Exception as error:
logger.error(
@@ -101,6 +103,20 @@ class Core(KubernetesService):
)
return pod_containers
+ @staticmethod
+ def _build_volumes(volumes) -> List[dict]:
+ pod_volumes = []
+ for volume in volumes or []:
+ pod_volumes.append(
+ {
+ "name": volume.name,
+ "host_path": (
+ volume.host_path.to_dict() if volume.host_path else None
+ ),
+ }
+ )
+ return pod_volumes
+
def _list_config_maps(self):
try:
response = self.client.list_config_map_for_all_namespaces()
@@ -188,6 +204,7 @@ class Pod(BaseModel):
containers: Optional[dict]
init_containers: Optional[dict] = None
ephemeral_containers: Optional[dict] = None
+ volumes: Optional[List[dict]] = None
class ConfigMap(BaseModel):
diff --git a/prowler/providers/m365/lib/powershell/m365_powershell.py b/prowler/providers/m365/lib/powershell/m365_powershell.py
index 4dae094d90..d9cbdcee90 100644
--- a/prowler/providers/m365/lib/powershell/m365_powershell.py
+++ b/prowler/providers/m365/lib/powershell/m365_powershell.py
@@ -1002,6 +1002,31 @@ class M365PowerShell(PowerShellSession):
json_parse=True,
)
+ def get_application_access_policies(self) -> dict:
+ """
+ Get Exchange Online Application Access Policies.
+
+ Retrieves all Exchange Online Application Access Policies.
+
+ Returns:
+ dict: Application access policies in JSON format.
+
+ Example:
+ >>> get_application_access_policies()
+ [
+ {
+ "Identity": "Policy1",
+ "AppId": "12345678-1234-1234-1234-123456789012",
+ "AccessRight": "RestrictAccess",
+ "Description": "Restrict mailbox access"
+ }
+ ]
+ """
+ return self.execute(
+ "Get-ApplicationAccessPolicy | ConvertTo-Json -Depth 10",
+ json_parse=True,
+ )
+
def get_user_account_status(self) -> dict:
"""
Get User Account Status.
diff --git a/prowler/providers/m365/m365_provider.py b/prowler/providers/m365/m365_provider.py
index 0454d85f3d..040e390658 100644
--- a/prowler/providers/m365/m365_provider.py
+++ b/prowler/providers/m365/m365_provider.py
@@ -99,6 +99,7 @@ class M365Provider(Provider):
"""
_type: str = "m365"
+ sdk_only: bool = False
_session: DefaultAzureCredential # Must be used besides being named for Azure
_identity: M365IdentityInfo
_audit_config: dict
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_sql_audit_enabled/__init__.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/rds_instance_sql_audit_enabled/__init__.py
rename to prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/__init__.py
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.metadata.json b/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.metadata.json
new file mode 100644
index 0000000000..ccfa9eb086
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.metadata.json
@@ -0,0 +1,39 @@
+{
+ "Provider": "m365",
+ "CheckID": "entra_conditional_access_policy_groups_management_restricted",
+ "CheckTitle": "Conditional Access policy groups are management-restricted or role-assignable",
+ "CheckType": [],
+ "ServiceName": "entra",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "high",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "IAM",
+ "Description": "Microsoft Entra **Conditional Access** policies are evaluated for security groups referenced in `includeGroups` and `excludeGroups`. Referenced groups must be protected by **Restricted Management Administrative Unit** membership or configured as **role-assignable groups**.",
+ "Risk": "Groups referenced by **Conditional Access** policies become privileged identity control points. If their membership can be changed by broad group administrators or applications, an attacker may bypass access controls by adding themselves to an excluded group or removing themselves from an included group, weakening **confidentiality** and **integrity** without modifying the policy.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy?view=graph-rest-1.0",
+ "https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0",
+ "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management",
+ "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com.\n2. Review every group used by enabled or report-only Conditional Access policies under Users > Include and Users > Exclude.\n3. For each group, either place it in a Restricted Management Administrative Unit or recreate/use a role-assignable group where appropriate.\n4. Restrict group ownership and membership management to privileged administrators.\n5. Remove stale or deleted group references from Conditional Access policies.",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Protect every security group that scopes **Conditional Access** decisions with **Restricted Management Administrative Units** or **role-assignable group** controls. Regularly audit group membership, owners, and stale Conditional Access references.",
+ "Url": "https://hub.prowler.com/check/entra_conditional_access_policy_groups_management_restricted"
+ }
+ },
+ "Categories": [
+ "identity-access"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "Conditional Access policies require Microsoft Entra ID P1 or P2 licenses. The check relies on Microsoft Graph group properties `isManagementRestricted` and `isAssignableToRole`, which must be requested with `$select`."
+}
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.py
new file mode 100644
index 0000000000..884f065257
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted.py
@@ -0,0 +1,130 @@
+from collections import defaultdict
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+from prowler.providers.m365.services.entra.entra_service import (
+ ConditionalAccessPolicyState,
+)
+
+
+class entra_conditional_access_policy_groups_management_restricted(Check):
+ """Ensure Conditional Access group scopes are protected against broad management.
+
+ Security groups referenced by enabled or report-only Conditional Access
+ policies (in ``includeGroups`` or ``excludeGroups``) are privileged control
+ points: anyone able to change their membership can silently bypass or weaken
+ a policy. This check reports one finding per referenced group.
+
+ - PASS: The group is management-restricted or role-assignable, or no enabled
+ or report-only policy references any group.
+ - FAIL: The group is neither management-restricted nor role-assignable.
+ - MANUAL: The group reference no longer resolves in Microsoft Entra ID and
+ must be verified or removed.
+ """
+
+ def execute(self) -> list[CheckReportM365]:
+ """Execute the check logic.
+
+ Returns:
+ A list of reports, one per group referenced by an enabled or
+ report-only Conditional Access policy.
+ """
+ findings = []
+
+ group_usage = defaultdict(lambda: {"include": [], "exclude": []})
+
+ for policy in entra_client.conditional_access_policies.values():
+ if policy.state == ConditionalAccessPolicyState.DISABLED:
+ continue
+
+ user_conditions = policy.conditions.user_conditions
+ if not user_conditions:
+ continue
+
+ for group_id in user_conditions.included_groups:
+ group_usage[group_id]["include"].append(policy)
+ for group_id in user_conditions.excluded_groups:
+ group_usage[group_id]["exclude"].append(policy)
+
+ if not group_usage:
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource={},
+ resource_name="Conditional Access Policies",
+ resource_id="conditionalAccessPolicies",
+ )
+ report.status = "PASS"
+ report.status_extended = (
+ "No enabled or report-only Conditional Access Policy references "
+ "groups."
+ )
+ findings.append(report)
+ return findings
+
+ groups_by_id = {group.id: group for group in entra_client.groups}
+
+ for group_id in sorted(group_usage):
+ usage = self._policy_usage(group_usage[group_id])
+ group = groups_by_id.get(group_id)
+
+ if not group:
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource={},
+ resource_name=group_id,
+ resource_id=group_id,
+ )
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Group {group_id} referenced by Conditional Access Policies "
+ f"could not be resolved in Microsoft Entra ID; verify the group "
+ f"exists or remove the stale reference ({usage})."
+ )
+ findings.append(report)
+ continue
+
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource=group,
+ resource_name=group.name,
+ resource_id=group.id,
+ )
+
+ if group.is_management_restricted or group.is_assignable_to_role:
+ report.status = "PASS"
+ report.status_extended = (
+ f"Group {group.name} ({group.id}) referenced by Conditional "
+ f"Access Policies is management-restricted or role-assignable."
+ )
+ else:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Group {group.name} ({group.id}) referenced by Conditional "
+ f"Access Policies is neither management-restricted nor "
+ f"role-assignable ({usage})."
+ )
+
+ findings.append(report)
+
+ return findings
+
+ @staticmethod
+ def _policy_usage(usage) -> str:
+ """Render the include/exclude policy usage of a group as a string.
+
+ Args:
+ usage: Mapping with ``include`` and ``exclude`` lists of policies.
+
+ Returns:
+ A string such as ``"include policies: A; exclude policies: B"``.
+ """
+
+ def policy_names(policies):
+ if not policies:
+ return "none"
+ return ", ".join(sorted({policy.display_name for policy in policies}))
+
+ return (
+ f"include policies: {policy_names(usage['include'])}; "
+ f"exclude policies: {policy_names(usage['exclude'])}"
+ )
diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py
index bbaa80edcc..a083eb1c3c 100644
--- a/prowler/providers/m365/services/entra/entra_service.py
+++ b/prowler/providers/m365/services/entra/entra_service.py
@@ -1,4 +1,5 @@
import asyncio
+import importlib
import json
from asyncio import gather
from datetime import datetime, timezone
@@ -7,10 +8,8 @@ from typing import Any, Dict, List, Optional, Set, Tuple
from uuid import UUID
from kiota_abstractions.base_request_configuration import RequestConfiguration
+from msgraph.generated.groups.groups_request_builder import GroupsRequestBuilder
from msgraph.generated.models.o_data_errors.o_data_error import ODataError
-from msgraph.generated.security.microsoft_graph_security_run_hunting_query.run_hunting_query_post_request_body import (
- RunHuntingQueryPostRequestBody,
-)
from msgraph.generated.users.users_request_builder import UsersRequestBuilder
from pydantic.v1 import BaseModel, validator
@@ -18,6 +17,10 @@ from prowler.lib.logger import logger
from prowler.providers.m365.lib.service.service import M365Service
from prowler.providers.m365.m365_provider import M365Provider
+run_hunting_query_body = importlib.import_module(
+ "msgraph.generated.security.microsoft_graph_security_run_hunting_query."
+ "run_hunting_query_post_request_body"
+)
# Sentinel identifiers used in Conditional Access ``conditions.users``
# collections that do not correspond to real directory objects and must not be
# resolved against Graph. Shared by the resolver below and the check that reads
@@ -83,6 +86,7 @@ class Entra(M365Service):
self.tenant_domain = provider.identity.tenant_domain
self.tenant_id = getattr(provider.identity, "tenant_id", None)
self.user_registration_details_error: Optional[str] = None
+ self.exchange_mailbox_permission_service_principals_error: Optional[str] = None
attributes = loop.run_until_complete(
gather(
self._get_authorization_policy(),
@@ -97,6 +101,7 @@ class Entra(M365Service):
self._get_authentication_method_configurations(),
self._get_service_principals(),
self._get_app_registrations(),
+ self._get_exchange_mailbox_permission_service_principals(),
)
)
@@ -114,6 +119,9 @@ class Entra(M365Service):
] = attributes[9]
self.service_principals: Dict[str, "ServicePrincipal"] = attributes[10]
self.app_registrations: Dict[str, "AppRegistration"] = attributes[11]
+ self.exchange_mailbox_permission_service_principals: Dict[
+ str, "ServicePrincipal"
+ ] = attributes[12]
self.user_accounts_status = {}
# Resolve directory-object identifiers referenced by Conditional Access
@@ -743,16 +751,48 @@ class Entra(M365Service):
logger.info("Entra - Getting groups...")
groups = []
try:
- groups_data = await self.client.groups.get()
- for group in groups_data.value:
- groups.append(
- Group(
- id=group.id,
- name=group.display_name,
- groupTypes=group.group_types,
- membershipRule=group.membership_rule,
- )
+ query_parameters = (
+ GroupsRequestBuilder.GroupsRequestBuilderGetQueryParameters(
+ select=[
+ "id",
+ "displayName",
+ "groupTypes",
+ "membershipRule",
+ "isAssignableToRole",
+ "isManagementRestricted",
+ ],
)
+ )
+ request_configuration = RequestConfiguration(
+ query_parameters=query_parameters,
+ )
+ groups_data = await self.client.groups.get(
+ request_configuration=request_configuration,
+ )
+
+ while groups_data:
+ for group in groups_data.value:
+ groups.append(
+ Group(
+ id=group.id,
+ name=group.display_name,
+ groupTypes=group.group_types or [],
+ membershipRule=group.membership_rule,
+ is_assignable_to_role=getattr(
+ group, "is_assignable_to_role", False
+ )
+ or False,
+ is_management_restricted=getattr(
+ group, "is_management_restricted", False
+ )
+ or False,
+ )
+ )
+
+ next_link = getattr(groups_data, "odata_next_link", None)
+ if not next_link:
+ break
+ groups_data = await self.client.groups.with_url(next_link).get()
except Exception as error:
logger.error(
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -1021,7 +1061,9 @@ OAuthAppInfo
| project OAuthAppId, AppName, AppStatus, PrivilegeLevel, Permissions,
ServicePrincipalId, IsAdminConsented, LastUsedTime, AppOrigin
"""
- request_body = RunHuntingQueryPostRequestBody(query=query)
+ request_body = run_hunting_query_body.RunHuntingQueryPostRequestBody(
+ query=query
+ )
result = await self.client.security.microsoft_graph_security_run_hunting_query.post(
request_body
@@ -1349,6 +1391,112 @@ OAuthAppInfo
)
return service_principals
+ async def _get_exchange_mailbox_permission_service_principals(self):
+ """Retrieve service principals with Exchange mailbox Graph app roles."""
+ logger.info(
+ "Entra - Getting service principals with Exchange mailbox permissions..."
+ )
+ self.exchange_mailbox_permission_service_principals_error = None
+ service_principals = {}
+ graph_service_principal = None
+ candidate_service_principals = []
+
+ try:
+ sp_response = await self.client.service_principals.get()
+ while sp_response:
+ for sp in getattr(sp_response, "value", []) or []:
+ app_id = getattr(sp, "app_id", None)
+ if app_id == MICROSOFT_GRAPH_APP_ID:
+ graph_service_principal = sp
+ continue
+
+ if not getattr(sp, "account_enabled", True):
+ continue
+
+ raw_owner = getattr(sp, "app_owner_organization_id", None)
+ app_owner_org_id = str(raw_owner).lower() if raw_owner else None
+ if app_owner_org_id in MICROSOFT_FIRST_PARTY_TENANT_IDS:
+ continue
+
+ candidate_service_principals.append(sp)
+
+ next_link = getattr(sp_response, "odata_next_link", None)
+ if not next_link:
+ break
+ sp_response = await self.client.service_principals.with_url(
+ next_link
+ ).get()
+
+ if graph_service_principal is None:
+ return service_principals
+
+ graph_service_principal_id = getattr(graph_service_principal, "id", None)
+ exchange_app_roles = {}
+ for role in getattr(graph_service_principal, "app_roles", []) or []:
+ role_value = getattr(role, "value", "") or ""
+ allowed_member_types = getattr(role, "allowed_member_types", []) or []
+ if (
+ role_value in EXCHANGE_MAILBOX_GRAPH_PERMISSIONS
+ and "Application" in allowed_member_types
+ ):
+ exchange_app_roles[str(getattr(role, "id", ""))] = role_value
+
+ if not graph_service_principal_id or not exchange_app_roles:
+ return service_principals
+
+ for sp in candidate_service_principals:
+ assignments_response = (
+ await self.client.service_principals.by_service_principal_id(
+ sp.id
+ ).app_role_assignments.get()
+ )
+ exchange_permissions = set()
+
+ while assignments_response:
+ for assignment in getattr(assignments_response, "value", []) or []:
+ resource_id = str(getattr(assignment, "resource_id", ""))
+ app_role_id = str(getattr(assignment, "app_role_id", ""))
+ if resource_id == graph_service_principal_id:
+ permission = exchange_app_roles.get(app_role_id)
+ if permission:
+ exchange_permissions.add(permission)
+
+ next_link = getattr(assignments_response, "odata_next_link", None)
+ if not next_link:
+ break
+ assignments_response = (
+ await self.client.service_principals.by_service_principal_id(
+ sp.id
+ )
+ .app_role_assignments.with_url(next_link)
+ .get()
+ )
+
+ if exchange_permissions:
+ raw_owner = getattr(sp, "app_owner_organization_id", None)
+ service_principals[sp.id] = ServicePrincipal(
+ id=sp.id,
+ name=getattr(sp, "display_name", "") or "",
+ app_id=getattr(sp, "app_id", "") or "",
+ app_owner_organization_id=(
+ str(raw_owner).lower() if raw_owner else None
+ ),
+ account_enabled=getattr(sp, "account_enabled", True),
+ service_principal_type=getattr(
+ sp, "service_principal_type", "Application"
+ ),
+ exchange_mailbox_permissions=sorted(exchange_permissions),
+ )
+ except Exception as error:
+ self.exchange_mailbox_permission_service_principals_error = (
+ f"{error.__class__.__name__}: {error}"
+ )
+ logger.error(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
+ return service_principals
+
async def _get_app_registrations(self) -> Dict[str, "AppRegistration"]:
"""Retrieve application registrations from Microsoft Entra.
@@ -1818,6 +1966,8 @@ class Group(BaseModel):
name: str
groupTypes: List[str]
membershipRule: Optional[str]
+ is_assignable_to_role: bool = False
+ is_management_restricted: bool = False
class AdminConsentPolicy(BaseModel):
@@ -2029,6 +2179,27 @@ TIER_0_ROLE_TEMPLATE_IDS = {
"e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8", # Partner Tier2 Support
}
+MICROSOFT_GRAPH_APP_ID = "00000003-0000-0000-c000-000000000000"
+
+MICROSOFT_FIRST_PARTY_TENANT_IDS = {
+ "72f988bf-86f1-41af-91ab-2d7cd011db47",
+ "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
+}
+
+EXCHANGE_MAILBOX_GRAPH_PERMISSIONS = {
+ "Calendars.Read",
+ "Calendars.ReadWrite",
+ "Contacts.Read",
+ "Contacts.ReadWrite",
+ "Mail.Read",
+ "Mail.ReadBasic",
+ "Mail.ReadBasic.All",
+ "Mail.ReadWrite",
+ "Mail.Send",
+ "MailboxSettings.Read",
+ "MailboxSettings.ReadWrite",
+}
+
class ServicePrincipal(BaseModel):
"""Model representing a Microsoft Entra ID service principal.
@@ -2061,6 +2232,9 @@ class ServicePrincipal(BaseModel):
password_credentials: List[PasswordCredential] = []
key_credentials: List[KeyCredential] = []
directory_role_template_ids: List[str] = []
+ account_enabled: bool = True
+ service_principal_type: str = "Application"
+ exchange_mailbox_permissions: List[str] = []
sp_owner_ids: List[str] = []
app_owner_ids: List[str] = []
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_sql_audit_retention/__init__.py b/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/rds_instance_sql_audit_retention/__init__.py
rename to prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/__init__.py
diff --git a/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.metadata.json b/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.metadata.json
new file mode 100644
index 0000000000..0e4da9420d
--- /dev/null
+++ b/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.metadata.json
@@ -0,0 +1,41 @@
+{
+ "Provider": "m365",
+ "CheckID": "exchange_application_access_policy_restricts_mailbox_apps",
+ "CheckTitle": "Apps with Exchange mailbox permissions must be scoped via Application Access Policy",
+ "CheckType": [],
+ "ServiceName": "exchange",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "collaboration",
+ "Description": "**Microsoft 365 Exchange Online** applications with mailbox access permissions should be restricted using **Application Access Policies**.\n\nThis check evaluates whether applications granted Exchange-related Microsoft Graph application permissions are scoped using Exchange Online `ApplicationAccessPolicy` objects.",
+ "Risk": "Applications with unrestricted Exchange mailbox permissions may gain tenant-wide mailbox access. Without **Application Access Policies**, compromised or over-privileged applications can read or manipulate mail across all mailboxes, leading to unauthorized access, data exfiltration, phishing, and loss of confidentiality and integrity.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access",
+ "https://learn.microsoft.com/en-us/powershell/module/exchange/new-applicationaccesspolicy",
+ "https://learn.microsoft.com/en-us/powershell/module/exchange/get-applicationaccesspolicy",
+ "https://learn.microsoft.com/en-us/graph/api/resources/serviceprincipal?view=graph-rest-1.0",
+ "https://learn.microsoft.com/en-us/graph/api/serviceprincipal-list-approleassignments?view=graph-rest-1.0"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "New-ApplicationAccessPolicy -AppId <AppId> -PolicyScopeGroupId <Group> -AccessRight RestrictAccess -Description \"Restrict mailbox access\"",
+ "NativeIaC": "",
+ "Other": "1. Connect to Exchange Online PowerShell\n2. Run Get-ApplicationAccessPolicy to review existing policies\n3. Identify applications with Exchange-related Graph application permissions\n4. Create an Application Access Policy for each required application\n5. Scope mailbox access using a dedicated mail-enabled security group",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Restrict applications with Exchange mailbox permissions using **Application Access Policies**. Apply least privilege by limiting mailbox scope to only required users or groups. Regularly review app permissions and remove unused or excessive mailbox access.",
+ "Url": "https://hub.prowler.com/check/exchange_application_access_policy_restricts_mailbox_apps"
+ }
+ },
+ "Categories": [
+ "identity-access",
+ "email-security"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}
diff --git a/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.py b/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.py
new file mode 100644
index 0000000000..d4c786b338
--- /dev/null
+++ b/prowler/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps.py
@@ -0,0 +1,99 @@
+import importlib
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+
+exchange_client = importlib.import_module(
+ "prowler.providers.m365.services.exchange.exchange_client"
+).exchange_client
+
+
+class exchange_application_access_policy_restricts_mailbox_apps(Check):
+ """
+ Check if applications with Exchange mailbox permissions
+ are restricted using Exchange Application Access Policies.
+ """
+
+ def execute(self) -> List[CheckReportM365]:
+ findings = []
+
+ application_access_policies = exchange_client.application_access_policies
+ if application_access_policies is None:
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource=exchange_client.organization_config,
+ resource_name="Exchange Online",
+ resource_id="ExchangeOnlineTenant",
+ )
+ report.status = "MANUAL"
+ report.status_extended = (
+ "Exchange Online PowerShell is unavailable. "
+ "Enable Exchange Online PowerShell credentials to evaluate "
+ "Application Access Policies."
+ )
+ findings.append(report)
+ return findings
+
+ mailbox_permission_collection_error = getattr(
+ entra_client,
+ "exchange_mailbox_permission_service_principals_error",
+ None,
+ )
+ if isinstance(mailbox_permission_collection_error, str):
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource=exchange_client.organization_config,
+ resource_name="Exchange Online",
+ resource_id="ExchangeOnlineTenant",
+ )
+ report.status = "MANUAL"
+ report.status_extended = (
+ "Microsoft Graph mailbox permission collection failed. "
+ "Manually verify whether applications with Exchange mailbox "
+ "permissions are restricted using Application Access Policies."
+ )
+ findings.append(report)
+ return findings
+
+ policy_app_ids = {
+ policy.app_id.lower()
+ for policy in application_access_policies
+ if getattr(policy, "app_id", None)
+ and getattr(policy, "access_right", None) == "RestrictAccess"
+ }
+
+ service_principals = (
+ entra_client.exchange_mailbox_permission_service_principals.values()
+ )
+ for service_principal in service_principals:
+ report = CheckReportM365(
+ metadata=self.metadata(),
+ resource=service_principal,
+ resource_name=service_principal.name,
+ resource_id=service_principal.id,
+ )
+ permissions = ", ".join(service_principal.exchange_mailbox_permissions)
+
+ if service_principal.app_id.lower() in policy_app_ids:
+ report.status = "PASS"
+ report.status_extended = (
+ f"Service principal '{service_principal.name}' "
+ f"({service_principal.app_id}) "
+ "has Exchange mailbox permissions "
+ f"({permissions}) and is restricted using an Application "
+ "Access Policy."
+ )
+ else:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Service principal '{service_principal.name}' "
+ f"({service_principal.app_id}) "
+ "has Exchange mailbox permissions "
+ f"({permissions}) but is not restricted using an Application "
+ "Access Policy."
+ )
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/m365/services/exchange/exchange_service.py b/prowler/providers/m365/services/exchange/exchange_service.py
index 3ce6528aa9..c4e4b309a4 100644
--- a/prowler/providers/m365/services/exchange/exchange_service.py
+++ b/prowler/providers/m365/services/exchange/exchange_service.py
@@ -43,6 +43,7 @@ class Exchange(M365Service):
self.role_assignment_policies = []
self.mailbox_audit_properties = []
self.shared_mailboxes = []
+ self.application_access_policies = None
self.mailboxes = None
if self.powershell:
@@ -56,6 +57,9 @@ class Exchange(M365Service):
self.role_assignment_policies = self._get_role_assignment_policies()
self.mailbox_audit_properties = self._get_mailbox_audit_properties()
self.shared_mailboxes = self._get_shared_mailboxes()
+ self.application_access_policies = (
+ self._get_application_access_policies()
+ )
self.mailboxes = self._get_mailboxes()
self.powershell.close()
@@ -366,6 +370,53 @@ class Exchange(M365Service):
)
return shared_mailboxes
+ def _get_application_access_policies(self):
+ """
+ Get Exchange Online Application Access Policies.
+
+ Returns:
+ Optional[list[ApplicationAccessPolicy]]: List of application access
+ policies, or None if the PowerShell command failed.
+ """
+ logger.info("Microsoft365 - Getting application access policies...")
+
+ application_access_policies = []
+
+ try:
+ policies_data = self.powershell.get_application_access_policies()
+
+ if not policies_data:
+ return application_access_policies
+
+ if isinstance(policies_data, dict):
+ policies_data = [policies_data]
+
+ for policy in policies_data:
+ if policy:
+ application_access_policies.append(
+ ApplicationAccessPolicy(
+ identity=policy.get("Identity", ""),
+ app_id=policy.get("AppId", ""),
+ access_right=policy.get(
+ "AccessRight",
+ "",
+ ),
+ description=policy.get(
+ "Description",
+ "",
+ ),
+ )
+ )
+
+ except Exception as error:
+ logger.error(
+ f"{error.__class__.__name__}"
+ f"[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ return None
+
+ return application_access_policies
+
def _get_mailboxes(self) -> Optional[list["Mailbox"]]:
"""
Get all recipient-facing mailboxes from Exchange Online.
@@ -554,6 +605,17 @@ class SharedMailbox(BaseModel):
identity: str
+class ApplicationAccessPolicy(BaseModel):
+ """
+ Model for Exchange Online Application Access Policy.
+ """
+
+ identity: str
+ app_id: str
+ access_right: str
+ description: str
+
+
class Mailbox(BaseModel):
"""
Model for an Exchange Online recipient-facing mailbox.
diff --git a/prowler/providers/mongodbatlas/mongodbatlas_provider.py b/prowler/providers/mongodbatlas/mongodbatlas_provider.py
index c40f1ced6e..07ff6f86cc 100644
--- a/prowler/providers/mongodbatlas/mongodbatlas_provider.py
+++ b/prowler/providers/mongodbatlas/mongodbatlas_provider.py
@@ -36,6 +36,7 @@ class MongodbatlasProvider(Provider):
"""
_type: str = "mongodbatlas"
+ sdk_only: bool = False
_session: MongoDBAtlasSession
_identity: MongoDBAtlasIdentityInfo
_audit_config: dict
diff --git a/prowler/providers/okta/lib/arguments/arguments.py b/prowler/providers/okta/lib/arguments/arguments.py
index 4ed5cfa187..3865e30a4b 100644
--- a/prowler/providers/okta/lib/arguments/arguments.py
+++ b/prowler/providers/okta/lib/arguments/arguments.py
@@ -42,3 +42,25 @@ def init_parser(self):
default=None,
metavar="OKTA_SCOPES",
)
+ okta_rate_limit_subparser = okta_parser.add_argument_group("Rate limiting")
+ okta_rate_limit_subparser.add_argument(
+ "--okta-retries-max-attempts",
+ type=int,
+ default=None,
+ help=(
+ "Maximum number of retries on Okta API rate limiting (HTTP 429). "
+ "Overrides the config.yaml value (okta_max_retries). Default: 5."
+ ),
+ metavar="OKTA_RETRIES_MAX_ATTEMPTS",
+ )
+ okta_rate_limit_subparser.add_argument(
+ "--okta-requests-per-second",
+ type=float,
+ default=None,
+ help=(
+ "Maximum aggregate Okta API requests per second. Throttles requests "
+ "to stay under Okta's rate limits. Overrides the config.yaml value "
+ "(okta_requests_per_second); set to 0 to disable. Default: 4."
+ ),
+ metavar="OKTA_REQUESTS_PER_SECOND",
+ )
diff --git a/prowler/providers/okta/lib/service/rate_limiter.py b/prowler/providers/okta/lib/service/rate_limiter.py
new file mode 100644
index 0000000000..9a8c72fe63
--- /dev/null
+++ b/prowler/providers/okta/lib/service/rate_limiter.py
@@ -0,0 +1,105 @@
+"""Client-side request throttling for the Okta provider.
+
+The Okta SDK already retries on HTTP 429 (see `service.py`), but retrying is
+reactive: it only helps *after* a rate limit has been hit, and each backoff
+waits out a full reset window. To avoid hitting Okta's limits in the first
+place, this module paces outbound requests with a shared token bucket.
+
+A single `OktaRateLimiter` instance lives on the provider and is shared by every
+service's SDK client, so the cap applies to the *aggregate* request rate rather
+than per client. The limiter is injected by wrapping the SDK's `HTTPClient`
+(via the `httpClient` config key) and awaiting `acquire()` before each call.
+
+Note: Okta enforces rate limits per endpoint, so a single requests-per-second
+cap is a deliberately simple, blunt control. It keeps bursty pagination from
+overrunning the limits without trying to model every per-endpoint budget.
+"""
+
+import asyncio
+import threading
+import time
+
+from okta.http_client import HTTPClient
+
+# Default aggregate request rate. Okta-managed orgs commonly throttle the
+# busiest endpoints around a handful of requests per second, so we pace below
+# that by default. Set `okta_requests_per_second` to 0 (or a negative value) to
+# disable throttling entirely.
+DEFAULT_REQUESTS_PER_SECOND = 4
+
+
+class OktaRateLimiter:
+ """Token-bucket limiter shared across a provider's Okta SDK clients.
+
+ The bucket refills at `requests_per_second` tokens per second up to a small
+ burst capacity. `acquire()` consumes one token, sleeping just long enough
+ when the bucket is empty. Token accounting is wall-clock based
+ (`time.monotonic`) so it stays correct across the separate event loops the
+ services spin up with `asyncio.run`.
+ """
+
+ def __init__(
+ self,
+ requests_per_second: float,
+ *,
+ clock=time.monotonic,
+ sleep=asyncio.sleep,
+ ):
+ if requests_per_second <= 0:
+ raise ValueError("requests_per_second must be greater than 0")
+ self._rate = float(requests_per_second)
+ # Allow up to one second of requests to burst, then settle to the rate.
+ self._capacity = max(1.0, self._rate)
+ self._tokens = self._capacity
+ self._clock = clock
+ self._sleep = sleep
+ self._last = clock()
+ # Guards the token math only; never held across an await.
+ self._lock = threading.Lock()
+
+ async def acquire(self) -> None:
+ """Block until a request token is available, then consume it."""
+ while True:
+ with self._lock:
+ now = self._clock()
+ self._tokens = min(
+ self._capacity, self._tokens + (now - self._last) * self._rate
+ )
+ self._last = now
+ if self._tokens >= 1:
+ self._tokens -= 1
+ return
+ wait = (1 - self._tokens) / self._rate
+ await self._sleep(wait)
+
+
+def build_throttled_http_client(limiter: OktaRateLimiter) -> type[HTTPClient]:
+ """Return an `HTTPClient` subclass that paces requests through `limiter`.
+
+ The Okta SDK instantiates `config["httpClient"]` with its HTTP config, so we
+ return a class (not an instance) that closes over the shared limiter.
+
+ Args:
+ limiter: Shared token-bucket limiter that paces the aggregate request
+ rate across every service client of the provider.
+
+ Returns:
+ An `HTTPClient` subclass that awaits the limiter before each request.
+ """
+
+ class ThrottledHTTPClient(HTTPClient):
+ """`HTTPClient` that acquires a limiter token before each request."""
+
+ async def send_request(self, request):
+ """Acquire a rate-limit token, then delegate to the SDK client.
+
+ Args:
+ request: The request payload built by the Okta SDK.
+
+ Returns:
+ The result of the underlying `HTTPClient.send_request` call.
+ """
+ await limiter.acquire()
+ return await super().send_request(request)
+
+ return ThrottledHTTPClient
diff --git a/prowler/providers/okta/lib/service/service.py b/prowler/providers/okta/lib/service/service.py
index baaabcb219..0c6c24c186 100644
--- a/prowler/providers/okta/lib/service/service.py
+++ b/prowler/providers/okta/lib/service/service.py
@@ -3,11 +3,21 @@ from typing import TYPE_CHECKING
from okta.client import Client as OktaSDKClient
+from prowler.providers.okta.lib.service.rate_limiter import build_throttled_http_client
from prowler.providers.okta.models import OktaSession
if TYPE_CHECKING:
from prowler.providers.okta.okta_provider import OktaProvider
+# Okta API rate-limit handling. The okta-sdk-python `Client` already backs off
+# on HTTP 429 by sleeping until the `X-Rate-Limit-Reset` window before retrying,
+# but it only does so `maxRetries` times (SDK default 2). On busy orgs that is
+# too few and requests fail with partial data, so we raise it. See config.yaml
+# (`okta_max_retries` / `okta_request_timeout`) for the user-facing knobs and the
+# rationale behind the 300s timeout default.
+DEFAULT_MAX_RETRIES = 5
+DEFAULT_REQUEST_TIMEOUT = 300
+
class OktaService:
"""Base class for Okta service implementations.
@@ -20,13 +30,34 @@ class OktaService:
def __init__(self, service: str, provider: "OktaProvider"):
self.provider = provider
self.service = service
- self.client = self.__set_client__(provider.session)
self.audit_config = provider.audit_config
self.fixer_config = provider.fixer_config
+ self.client = self.__set_client__(
+ provider.session, self.audit_config, provider.rate_limiter
+ )
@staticmethod
- def __set_client__(session: OktaSession) -> OktaSDKClient:
- return OktaSDKClient(session.to_sdk_config())
+ def __set_client__(
+ session: OktaSession, audit_config: dict, rate_limiter=None
+ ) -> OktaSDKClient:
+ # Start from the shared SDK config and layer the rate-limit settings on
+ # top. `Client(config)` deep-merges these flat keys onto its defaults, so
+ # `rateLimit`/`requestTimeout` override the SDK's built-in values.
+ config = session.to_sdk_config()
+ audit_config = audit_config or {}
+ config["rateLimit"] = {
+ "maxRetries": audit_config.get("okta_max_retries", DEFAULT_MAX_RETRIES)
+ }
+ config["requestTimeout"] = audit_config.get(
+ "okta_request_timeout", DEFAULT_REQUEST_TIMEOUT
+ )
+ # Proactively pace outbound requests so scans stay under Okta's limits
+ # instead of relying on the 429 retry as a safety net. The limiter is
+ # shared across every service client of the provider, so the cap applies
+ # to the aggregate request rate.
+ if rate_limiter is not None:
+ config["httpClient"] = build_throttled_http_client(rate_limiter)
+ return OktaSDKClient(config)
@staticmethod
def _run(coro):
diff --git a/prowler/providers/okta/okta_provider.py b/prowler/providers/okta/okta_provider.py
index 8859507ec7..757e81d51d 100644
--- a/prowler/providers/okta/okta_provider.py
+++ b/prowler/providers/okta/okta_provider.py
@@ -30,6 +30,10 @@ from prowler.providers.okta.exceptions.exceptions import (
OktaSetUpSessionError,
)
from prowler.providers.okta.lib.mutelist.mutelist import OktaMutelist
+from prowler.providers.okta.lib.service.rate_limiter import (
+ DEFAULT_REQUESTS_PER_SECOND,
+ OktaRateLimiter,
+)
from prowler.providers.okta.models import OktaIdentityInfo, OktaSession
DEFAULT_SCOPES = [
@@ -78,12 +82,14 @@ class OktaProvider(Provider):
"""
_type: str = "okta"
+ sdk_only: bool = False
_auth_method: str = None
_session: OktaSession
_identity: OktaIdentityInfo
_audit_config: dict
_fixer_config: dict
_mutelist: Mutelist
+ _rate_limiter: Optional[OktaRateLimiter]
audit_metadata: Audit_Metadata
def __init__(
@@ -93,6 +99,8 @@ class OktaProvider(Provider):
okta_private_key: str = "",
okta_private_key_file: str = "",
okta_scopes: Optional[Union[str, list[str]]] = None,
+ okta_retries_max_attempts: int = None,
+ okta_requests_per_second: float = None,
config_path: str = None,
config_content: dict = None,
fixer_config: dict = {},
@@ -124,6 +132,30 @@ class OktaProvider(Provider):
if not config_path:
config_path = default_config_file_path
self._audit_config = load_and_validate_config_file(self._type, config_path)
+
+ # CLI flags take precedence over config.yaml for the Okta API rate-limit
+ # settings. Services read these from audit_config when building the SDK
+ # client, so override the loaded values here.
+ if okta_retries_max_attempts is not None:
+ self._audit_config["okta_max_retries"] = okta_retries_max_attempts
+ logger.info(f"Okta max retries set to {okta_retries_max_attempts}")
+ if okta_requests_per_second is not None:
+ self._audit_config["okta_requests_per_second"] = okta_requests_per_second
+
+ # Build the shared request limiter once, here, so every service client
+ # paces against the same token bucket. A value of 0 (or below) disables
+ # throttling.
+ requests_per_second = self._audit_config.get(
+ "okta_requests_per_second", DEFAULT_REQUESTS_PER_SECOND
+ )
+ if requests_per_second and requests_per_second > 0:
+ self._rate_limiter = OktaRateLimiter(requests_per_second)
+ logger.info(
+ f"Okta request throttling enabled at {requests_per_second} req/s"
+ )
+ else:
+ self._rate_limiter = None
+
self._fixer_config = fixer_config
if mutelist_content:
@@ -163,6 +195,10 @@ class OktaProvider(Provider):
def mutelist(self) -> OktaMutelist:
return self._mutelist
+ @property
+ def rate_limiter(self) -> Optional[OktaRateLimiter]:
+ return self._rate_limiter
+
@staticmethod
def validate_arguments(
okta_org_domain: str = "",
diff --git a/prowler/providers/openstack/openstack_provider.py b/prowler/providers/openstack/openstack_provider.py
index e81a399478..e11c4f7909 100644
--- a/prowler/providers/openstack/openstack_provider.py
+++ b/prowler/providers/openstack/openstack_provider.py
@@ -36,6 +36,7 @@ class OpenstackProvider(Provider):
"""OpenStack provider responsible for bootstrapping the SDK session."""
_type: str = "openstack"
+ sdk_only: bool = False
_session: OpenStackSession
_identity: OpenStackIdentityInfo
_audit_config: dict
diff --git a/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.metadata.json b/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.metadata.json
index 597d3ab4d4..bd83049d82 100644
--- a/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.metadata.json
+++ b/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.metadata.json
@@ -36,5 +36,5 @@
"RelatedTo": [
"blockstorage_volume_metadata_sensitive_data"
],
- "Notes": "This check uses the detect-secrets library to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns and detect_secrets_plugins to customize detection."
+ "Notes": "This check uses Kingfisher to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns."
}
diff --git a/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.py b/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.py
index 95de628871..51e25bc5eb 100644
--- a/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.py
+++ b/prowler/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data.py
@@ -2,7 +2,11 @@ import json
from typing import List
from prowler.lib.check.models import Check, CheckReportOpenStack
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.openstack.services.blockstorage.blockstorage_client import (
blockstorage_client,
)
@@ -16,30 +20,42 @@ class blockstorage_snapshot_metadata_sensitive_data(Check):
secrets_ignore_patterns = blockstorage_client.audit_config.get(
"secrets_ignore_patterns", []
)
+ validate = blockstorage_client.audit_config.get("secrets_validate", False)
+ snapshots = list(blockstorage_client.snapshots)
- for snapshot in blockstorage_client.snapshots:
+ # Collect one payload per snapshot (its metadata) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per snapshot.
+ def payloads():
+ for index, snapshot in enumerate(snapshots):
+ if snapshot.metadata:
+ yield index, json.dumps(dict(snapshot.metadata), indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, snapshot in enumerate(snapshots):
report = CheckReportOpenStack(metadata=self.metadata(), resource=snapshot)
report.status = "PASS"
report.status_extended = f"Snapshot {snapshot.name} ({snapshot.id}) metadata does not contain sensitive data."
if snapshot.metadata:
- # Build metadata dict and parallel list of keys
- dump_metadata = {}
- original_metadata_keys = []
- for key, value in snapshot.metadata.items():
- dump_metadata[key] = value
- original_metadata_keys.append(key)
-
- # Convert metadata dict to JSON string for detect-secrets scanning
- metadata_json = json.dumps(dump_metadata, indent=2)
- detect_secrets_output = detect_secrets_scan(
- data=metadata_json,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=blockstorage_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
-
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan snapshot {snapshot.name} ({snapshot.id}) "
+ f"metadata for secrets: {scan_error}; manual review is "
+ "required."
+ )
+ findings.append(report)
+ continue
+ original_metadata_keys = list(snapshot.metadata.keys())
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
# Map line numbers back to metadata keys using the parallel list
# Line numbering: line 1 = "{", line 2 = first key-value, etc.
@@ -54,6 +70,7 @@ class blockstorage_snapshot_metadata_sensitive_data(Check):
)
report.status = "FAIL"
report.status_extended = f"Snapshot {snapshot.name} ({snapshot.id}) metadata contains potential secrets -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status_extended = f"Snapshot {snapshot.name} ({snapshot.id}) has no metadata (no sensitive data exposure risk)."
diff --git a/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.metadata.json b/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.metadata.json
index ec17ee02d1..79874db214 100644
--- a/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.metadata.json
+++ b/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.metadata.json
@@ -34,5 +34,5 @@
],
"DependsOn": [],
"RelatedTo": [],
- "Notes": "This check uses the detect-secrets library to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns and detect_secrets_plugins to customize detection."
+ "Notes": "This check uses Kingfisher to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns."
}
diff --git a/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.py b/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.py
index 1bfa84c3df..48e064642a 100644
--- a/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.py
+++ b/prowler/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data.py
@@ -2,7 +2,11 @@ import json
from typing import List
from prowler.lib.check.models import Check, CheckReportOpenStack
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.openstack.services.blockstorage.blockstorage_client import (
blockstorage_client,
)
@@ -16,30 +20,41 @@ class blockstorage_volume_metadata_sensitive_data(Check):
secrets_ignore_patterns = blockstorage_client.audit_config.get(
"secrets_ignore_patterns", []
)
+ validate = blockstorage_client.audit_config.get("secrets_validate", False)
+ volumes = list(blockstorage_client.volumes)
- for volume in blockstorage_client.volumes:
+ # Collect one payload per volume (its metadata) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per volume.
+ def payloads():
+ for index, volume in enumerate(volumes):
+ if volume.metadata:
+ yield index, json.dumps(dict(volume.metadata), indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, volume in enumerate(volumes):
report = CheckReportOpenStack(metadata=self.metadata(), resource=volume)
report.status = "PASS"
report.status_extended = f"Volume {volume.name} ({volume.id}) metadata does not contain sensitive data."
if volume.metadata:
- # Build metadata dict and parallel list of keys
- dump_metadata = {}
- original_metadata_keys = []
- for key, value in volume.metadata.items():
- dump_metadata[key] = value
- original_metadata_keys.append(key)
-
- # Convert metadata dict to JSON string for detect-secrets scanning
- metadata_json = json.dumps(dump_metadata, indent=2)
- detect_secrets_output = detect_secrets_scan(
- data=metadata_json,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=blockstorage_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
-
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan volume {volume.name} ({volume.id}) metadata "
+ f"for secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ original_metadata_keys = list(volume.metadata.keys())
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
# Map line numbers back to metadata keys using the parallel list
# Line numbering: line 1 = "{", line 2 = first key-value, etc.
@@ -54,6 +69,7 @@ class blockstorage_volume_metadata_sensitive_data(Check):
)
report.status = "FAIL"
report.status_extended = f"Volume {volume.name} ({volume.id}) metadata contains potential secrets -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status_extended = f"Volume {volume.name} ({volume.id}) has no metadata (no sensitive data exposure risk)."
diff --git a/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.metadata.json b/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.metadata.json
index 015a00986d..c7f3e41f8e 100644
--- a/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.metadata.json
+++ b/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.metadata.json
@@ -34,5 +34,5 @@
],
"DependsOn": [],
"RelatedTo": [],
- "Notes": "This check uses the detect-secrets library to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns and detect_secrets_plugins to customize detection. Metadata is world-readable within instance via 169.254.169.254."
+ "Notes": "This check uses Kingfisher to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns. Metadata is world-readable within instance via 169.254.169.254."
}
diff --git a/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.py b/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.py
index 5df151c939..0627862da9 100644
--- a/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.py
+++ b/prowler/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data.py
@@ -2,7 +2,11 @@ import json
from typing import List
from prowler.lib.check.models import Check, CheckReportOpenStack
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.openstack.services.compute.compute_client import compute_client
@@ -14,30 +18,42 @@ class compute_instance_metadata_sensitive_data(Check):
secrets_ignore_patterns = compute_client.audit_config.get(
"secrets_ignore_patterns", []
)
+ validate = compute_client.audit_config.get("secrets_validate", False)
+ instances = list(compute_client.instances)
- for instance in compute_client.instances:
+ # Collect one payload per instance (its metadata) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per instance.
+ def payloads():
+ for index, instance in enumerate(instances):
+ if instance.metadata:
+ yield index, json.dumps(dict(instance.metadata), indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, instance in enumerate(instances):
report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
report.status = "PASS"
report.status_extended = f"Instance {instance.name} ({instance.id}) metadata does not contain sensitive data."
if instance.metadata:
- # Build metadata dict and parallel list of keys (similar to AWS ECS pattern)
- dump_metadata = {}
- original_metadata_keys = []
- for key, value in instance.metadata.items():
- dump_metadata[key] = value
- original_metadata_keys.append(key)
-
- # Convert metadata dict to JSON string for detect-secrets scanning
- metadata_json = json.dumps(dump_metadata, indent=2)
- detect_secrets_output = detect_secrets_scan(
- data=metadata_json,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=compute_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
-
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan instance {instance.name} ({instance.id}) "
+ f"metadata for secrets: {scan_error}; manual review is "
+ "required."
+ )
+ findings.append(report)
+ continue
+ original_metadata_keys = list(instance.metadata.keys())
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
# Map line numbers back to metadata keys using the parallel list
# Line numbering: line 1 = "{", line 2 = first key-value, etc.
@@ -45,11 +61,14 @@ class compute_instance_metadata_sensitive_data(Check):
[
f"{secret['type']} in metadata key '{original_metadata_keys[secret['line_number'] - 2]}'"
for secret in detect_secrets_output
- if secret["line_number"] - 2 < len(original_metadata_keys)
+ if 0
+ <= secret["line_number"] - 2
+ < len(original_metadata_keys)
]
)
report.status = "FAIL"
report.status_extended = f"Instance {instance.name} ({instance.id}) metadata contains potential secrets -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status_extended = f"Instance {instance.name} ({instance.id}) has no metadata (no sensitive data exposure risk)."
diff --git a/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.metadata.json b/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.metadata.json
index b3a39bd3f8..37e7563c27 100644
--- a/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.metadata.json
+++ b/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.metadata.json
@@ -35,5 +35,5 @@
],
"DependsOn": [],
"RelatedTo": [],
- "Notes": "This check uses the detect-secrets library to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns and detect_secrets_plugins to customize detection."
+ "Notes": "This check uses Kingfisher to scan for credentials. May produce false positives on metadata keys containing secret-like keywords. Findings should be reviewed manually. The audit_config allows configuring secrets_ignore_patterns to exclude specific patterns."
}
diff --git a/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.py b/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.py
index 94d281bf32..549be81046 100644
--- a/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.py
+++ b/prowler/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data.py
@@ -2,7 +2,11 @@ import json
from typing import List
from prowler.lib.check.models import Check, CheckReportOpenStack
-from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.lib.utils.utils import (
+ SecretsScanError,
+ annotate_verified_secrets,
+ detect_secrets_scan_batch,
+)
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
objectstorage_client,
)
@@ -16,8 +20,26 @@ class objectstorage_container_metadata_sensitive_data(Check):
secrets_ignore_patterns = objectstorage_client.audit_config.get(
"secrets_ignore_patterns", []
)
+ validate = objectstorage_client.audit_config.get("secrets_validate", False)
+ containers = list(objectstorage_client.containers)
- for container in objectstorage_client.containers:
+ # Collect one payload per container (its metadata) and scan them all in
+ # batched Kingfisher invocations instead of one subprocess per container.
+ def payloads():
+ for index, container in enumerate(containers):
+ if container.metadata:
+ yield index, json.dumps(dict(container.metadata), indent=2)
+
+ scan_error = None
+ try:
+ batch_results = detect_secrets_scan_batch(
+ payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
+ )
+ except SecretsScanError as error:
+ batch_results = {}
+ scan_error = error
+
+ for index, container in enumerate(containers):
report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
report.status = "PASS"
report.status_extended = (
@@ -25,23 +47,16 @@ class objectstorage_container_metadata_sensitive_data(Check):
)
if container.metadata:
- # Build metadata dict and parallel list of keys
- dump_metadata = {}
- original_metadata_keys = []
- for key, value in container.metadata.items():
- dump_metadata[key] = value
- original_metadata_keys.append(key)
-
- # Convert metadata dict to JSON string for detect-secrets scanning
- metadata_json = json.dumps(dump_metadata, indent=2)
- detect_secrets_output = detect_secrets_scan(
- data=metadata_json,
- excluded_secrets=secrets_ignore_patterns,
- detect_secrets_plugins=objectstorage_client.audit_config.get(
- "detect_secrets_plugins"
- ),
- )
-
+ if scan_error:
+ report.status = "MANUAL"
+ report.status_extended = (
+ f"Could not scan container {container.name} metadata for "
+ f"secrets: {scan_error}; manual review is required."
+ )
+ findings.append(report)
+ continue
+ original_metadata_keys = list(container.metadata.keys())
+ detect_secrets_output = batch_results.get(index)
if detect_secrets_output:
# Map line numbers back to metadata keys using the parallel list
# Line numbering: line 1 = "{", line 2 = first key-value, etc.
@@ -56,6 +71,7 @@ class objectstorage_container_metadata_sensitive_data(Check):
)
report.status = "FAIL"
report.status_extended = f"Container {container.name} metadata contains potential secrets -> {secrets_string}."
+ annotate_verified_secrets(report, detect_secrets_output)
else:
report.status_extended = f"Container {container.name} has no metadata (no sensitive data exposure risk)."
diff --git a/prowler/providers/oraclecloud/oraclecloud_provider.py b/prowler/providers/oraclecloud/oraclecloud_provider.py
index 5aa959d985..a4794f6269 100644
--- a/prowler/providers/oraclecloud/oraclecloud_provider.py
+++ b/prowler/providers/oraclecloud/oraclecloud_provider.py
@@ -1,3 +1,4 @@
+from collections.abc import Iterable
import os
import pathlib
import re
@@ -59,6 +60,7 @@ class OraclecloudProvider(Provider):
"""
_type: str = "oraclecloud"
+ sdk_only: bool = False
_identity: OCIIdentityInfo
_session: OCISession
_audit_config: dict
@@ -67,12 +69,13 @@ class OraclecloudProvider(Provider):
_mutelist: OCIMutelist
audit_metadata: Audit_Metadata
_home_region: str = "us-ashburn-1"
+ _bootstrap_region: str = "us-ashburn-1"
def __init__(
self,
oci_config_file: str = None,
profile: str = None,
- region: set = set(),
+ region: str | Iterable[str] = None,
compartment_ids: list = None,
config_path: str = None,
config_content: dict = None,
@@ -128,10 +131,17 @@ class OraclecloudProvider(Provider):
logger.info("Initializing OCI provider ...")
- # Check if the configuration is scanning a single region
- single_region = None
- if region:
- single_region = list(region)[0] if len(region) == 1 else None
+ # Check if the configuration is scanning exactly one explicit region.
+ explicit_regions = self._normalize_region_input(region)
+ single_region = (
+ next(iter(explicit_regions))
+ if explicit_regions and len(explicit_regions) == 1
+ else None
+ )
+ has_direct_credentials = user and fingerprint and tenancy
+ bootstrap_region = single_region or (
+ self._bootstrap_region if has_direct_credentials else None
+ )
# Setup OCI Session
logger.info("Setting up OCI session ...")
@@ -144,7 +154,7 @@ class OraclecloudProvider(Provider):
key_file=key_file,
key_content=key_content,
tenancy=tenancy,
- region=single_region,
+ region=bootstrap_region,
pass_phrase=pass_phrase,
)
@@ -164,7 +174,13 @@ class OraclecloudProvider(Provider):
# Determine the tenancy home region from the full subscription list, independent of
# the --region filter, so tenancy-level APIs (e.g. the Audit configuration) always
# target the home region instead of a filtered, non-home region.
- all_subscribed_regions = self.get_regions_to_audit()
+ try:
+ all_subscribed_regions = self.get_regions_to_audit()
+ except OCISetUpSessionError:
+ if single_region and len(self._regions) == 1:
+ all_subscribed_regions = self._regions
+ else:
+ raise
self._home_region = next(
(region.key for region in all_subscribed_regions if region.is_home_region),
self._regions[0].key if self._regions else "us-ashburn-1",
@@ -242,6 +258,22 @@ class OraclecloudProvider(Provider):
"""
return self._mutelist
+ @staticmethod
+ def _normalize_region_input(region: str | Iterable[str] = None) -> set[str] | None:
+ """Normalize OCI region input while treating strings as one region.
+
+ Args:
+ region: Region input as a string, iterable of strings, or None.
+
+ Returns:
+ A set of region names, or None when no region is provided.
+ """
+ if isinstance(region, str):
+ return {region} if region else None
+ if region:
+ return set(region)
+ return None
+
@staticmethod
def setup_session(
oci_config_file: str = None,
@@ -283,7 +315,7 @@ class OraclecloudProvider(Provider):
signer = None
# If API key credentials are provided directly, create config from them
- if user and fingerprint and tenancy and region:
+ if user and fingerprint and tenancy:
import base64
logger.info("Using API key credentials from direct parameters")
@@ -293,7 +325,7 @@ class OraclecloudProvider(Provider):
"user": user,
"fingerprint": fingerprint,
"tenancy": tenancy,
- "region": region,
+ "region": region or OraclecloudProvider._bootstrap_region,
}
# Handle private key
@@ -552,7 +584,7 @@ class OraclecloudProvider(Provider):
return True
- def get_regions_to_audit(self, region_set: set = None) -> list:
+ def get_regions_to_audit(self, region_set: str | Iterable[str] = None) -> list:
"""
get_regions_to_audit returns the list of regions to audit.
@@ -564,6 +596,8 @@ class OraclecloudProvider(Provider):
"""
regions = []
+ explicit_regions = self._normalize_region_input(region_set)
+
# Audit all subscribed regions
try:
# Create identity client with proper authentication handling
@@ -580,11 +614,9 @@ class OraclecloudProvider(Provider):
).data
# Check if auditing specific region or all
- regions_check = (
- region_set
- if region_set
- else [sub.region_name for sub in region_subscriptions]
- )
+ regions_check = explicit_regions or [
+ sub.region_name for sub in region_subscriptions
+ ]
for region_sub in region_subscriptions:
if region_sub.region_name in regions_check:
@@ -599,11 +631,25 @@ class OraclecloudProvider(Provider):
)
logger.info(f"Found {len(regions)} subscribed regions")
except Exception as error:
+ if not explicit_regions or len(explicit_regions) != 1:
+ logger.critical(
+ f"OCISetUpSessionError[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ raise OCISetUpSessionError(
+ original_exception=error,
+ file=pathlib.Path(__file__).name,
+ message=(
+ "Could not retrieve OCI subscribed regions. "
+ "Configure an explicit region to preserve legacy single-region scans, "
+ "or fix the credentials/permissions required to list region subscriptions."
+ ),
+ ) from error
+
+ config_region = next(iter(explicit_regions))
logger.warning(
- f"Could not retrieve region subscriptions: {error}. Using configured region."
+ f"Could not retrieve region subscriptions: {error}. "
+ f"Using explicitly configured region {config_region}."
)
- # Fallback to configured region
- config_region = self._session.config.get("region", "us-ashburn-1")
regions.append(
OCIRegion(
key=config_region,
@@ -854,17 +900,21 @@ class OraclecloudProvider(Provider):
session = None
# If API key credentials are provided directly, create config from them
- if user and fingerprint and tenancy and region:
+ has_direct_credentials = user and fingerprint and tenancy
+ identity_region = region
+ if has_direct_credentials:
import base64
logger.info("Using API key credentials from direct parameters")
+ identity_region = region or OraclecloudProvider._bootstrap_region
+
# Create config dict from provided credentials
config = {
"user": user,
"fingerprint": fingerprint,
"tenancy": tenancy,
- "region": region,
+ "region": identity_region,
}
# Handle private key
@@ -913,7 +963,7 @@ class OraclecloudProvider(Provider):
identity = OraclecloudProvider.set_identity(
session=session,
- region=region,
+ region=identity_region,
)
# Validate provider_id if provided
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_ssl_enabled/__init__.py b/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/__init__.py
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/rds_instance_ssl_enabled/__init__.py
rename to prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/__init__.py
diff --git a/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.metadata.json b/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.metadata.json
new file mode 100644
index 0000000000..a52c0c01fe
--- /dev/null
+++ b/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.metadata.json
@@ -0,0 +1,37 @@
+{
+ "Provider": "stackit",
+ "CheckID": "iaas_server_public_ip_attached",
+ "CheckTitle": "IaaS servers do not have public IP addresses directly attached",
+ "CheckType": [],
+ "ServiceName": "iaas",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
+ "Severity": "medium",
+ "ResourceType": "NotDefined",
+ "ResourceGroup": "network",
+ "Description": "Servers should not have public IP addresses directly attached to their network interfaces unless strictly required. A public IP exposes the server to inbound traffic from the internet on all ports not blocked by a security group, increasing the attack surface.",
+ "Risk": "**Direct internet exposure.** A server with a directly attached public IP can be reached from the internet. If its security groups allow broad inbound traffic, this exposure can enable unauthorized access, data exfiltration, or server compromise.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.stackit.cloud/products/network/core-networking/public-ip-address/",
+ "https://docs.stackit.cloud/products/network/core-networking/security-groups/"
+ ],
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "1. In the StackIT Portal open Networking > Public IPs and identify the IP attached to the affected server's network interface. 2. Detach the public IP from the server. 3. Use a load balancer for internet-facing workloads or a bastion host / VPN for administrative access. 4. Re-run Prowler to confirm the finding is resolved.",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "**Remove direct public exposure.** Detach the public IP from the server network interface unless it is strictly required. Route internet-facing workloads through a load balancer, and use a bastion host or VPN for administrative access.",
+ "Url": "https://hub.prowler.com/check/iaas_server_public_ip_attached"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": "This check flags servers that have a public IP attached directly to a NIC. Evaluate whether internet exposure is intentional and whether appropriate security groups are in place."
+}
diff --git a/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.py b/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.py
new file mode 100644
index 0000000000..966f385239
--- /dev/null
+++ b/prowler/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached.py
@@ -0,0 +1,43 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.iaas.iaas_client import iaas_client
+
+
+class iaas_server_public_ip_attached(Check):
+ """
+ Check if IaaS servers have public IP addresses directly attached.
+
+ This check verifies that servers do not have a public IP address
+ directly attached to their network interfaces, which would expose
+ them to inbound traffic from the internet.
+ """
+
+ def execute(self):
+ """
+ Execute the check for all servers in the StackIT project.
+
+ Returns:
+ list: A list of CheckReportStackIT findings
+ """
+ findings = []
+
+ for server in iaas_client.servers:
+ report = CheckReportStackIT(
+ metadata=self.metadata(),
+ resource=server,
+ )
+
+ if server.has_public_ip:
+ report.status = "FAIL"
+ report.status_extended = (
+ f"Server {server.name} has a public IP address directly attached, "
+ f"exposing it to the internet."
+ )
+ else:
+ report.status = "PASS"
+ report.status_extended = (
+ f"Server {server.name} does not have a public IP address attached."
+ )
+
+ findings.append(report)
+
+ return findings
diff --git a/prowler/providers/stackit/services/iaas/iaas_service.py b/prowler/providers/stackit/services/iaas/iaas_service.py
index 2cea664241..71e8ec0ae1 100644
--- a/prowler/providers/stackit/services/iaas/iaas_service.py
+++ b/prowler/providers/stackit/services/iaas/iaas_service.py
@@ -39,6 +39,11 @@ class IaaSService:
self.server_nics: list = []
self.in_use_sg_ids: set[str] = set()
+ # Initialize server list and supporting indices
+ self.servers: list[Server] = []
+ self._nic_device_index: dict[str, str] = {} # nic_id → server_id
+ self._public_ip_server_ids: set[str] = set()
+
# Fetch resources from all regions
self._fetch_all_regions()
self._log_skipped_security_groups()
@@ -83,6 +88,8 @@ class IaaSService:
try:
self._list_server_nics(client, region)
self._list_security_groups(client, region)
+ self._list_public_ips(client, region)
+ self._list_servers(client, region)
except Exception as error:
if getattr(error, "status", None) == 404:
logger.info(
@@ -118,6 +125,28 @@ class IaaSService:
)
return []
+ @staticmethod
+ def _get_item_field(item, *keys, default=None):
+ """Read a field from an SDK model (attribute) or a raw ``dict`` (key).
+
+ ``_extract_items`` already yields either SDK models or raw dicts, so the
+ correlation logic must read fields from both shapes. Multiple key aliases
+ are accepted so snake_case SDK attributes and camelCase API/dict keys are
+ both supported (e.g. ``network_interface`` / ``networkInterface``).
+ Returns the first non-None match, otherwise ``default``.
+ """
+ if isinstance(item, dict):
+ for key in keys:
+ value = item.get(key)
+ if value is not None:
+ return value
+ return default
+ for key in keys:
+ value = getattr(item, key, None)
+ if value is not None:
+ return value
+ return default
+
def _handle_api_call(self, api_function, *args, **kwargs):
"""
Centralized API call handler with authentication error detection.
@@ -334,11 +363,94 @@ class IaaSService:
used_sg_ids = self._get_used_security_group_ids(nics_list)
self.in_use_sg_ids.update(used_sg_ids)
+ # Build nic_id → server_id index for public IP cross-reference
+ for nic in nics_list:
+ try:
+ nic_id = str(self._get_item_field(nic, "id") or "")
+ device = self._get_item_field(nic, "device")
+ if nic_id and device:
+ self._nic_device_index[nic_id] = str(device)
+ except Exception as e:
+ logger.debug(f"Error indexing NIC device: {e}")
+ continue
+
logger.info(
f"Successfully listed {len(nics_list)} NICs in {region}. "
f"Found {len(used_sg_ids)} security groups attached to NICs."
)
+ def _list_public_ips(self, client, region: str):
+ """
+ List all public IPs in the project and record which servers have one attached.
+
+ A public IP is considered attached to a server when its ``network_interface``
+ field (a NIC UUID) matches a NIC whose ``device`` field points to a server.
+ The result is stored in ``self._public_ip_server_ids`` so that
+ ``_list_servers`` can set ``has_public_ip`` when creating Server objects.
+ """
+ if not client:
+ logger.warning(
+ f"Cannot list public IPs in {region}: StackIT IaaS client not available"
+ )
+ return
+
+ response = self._handle_api_call(
+ client.list_public_ips, project_id=self.project_id, region=region
+ )
+ ips_list = self._extract_items(response, "list_public_ips")
+
+ for ip_data in ips_list:
+ try:
+ network_interface = self._get_item_field(
+ ip_data, "network_interface", "networkInterface"
+ )
+ if network_interface is None:
+ continue
+ server_id = self._nic_device_index.get(str(network_interface))
+ if server_id:
+ self._public_ip_server_ids.add(server_id)
+ except Exception as e:
+ logger.debug(f"Error processing public IP: {e}")
+ continue
+
+ logger.info(f"Successfully listed {len(ips_list)} public IPs in {region}")
+
+ def _list_servers(self, client, region: str):
+ """
+ List all servers in the project and populate ``self.servers``.
+
+ ``has_public_ip`` is set to True for any server whose ID appears in
+ ``self._public_ip_server_ids`` (populated by ``_list_public_ips``).
+ """
+ if not client:
+ logger.warning(
+ f"Cannot list servers in {region}: StackIT IaaS client not available"
+ )
+ return
+
+ response = self._handle_api_call(
+ client.list_servers, project_id=self.project_id, region=region
+ )
+ servers_list = self._extract_items(response, "list_servers")
+
+ for server_data in servers_list:
+ try:
+ server_id = str(self._get_item_field(server_data, "id") or "")
+ server_name = self._get_item_field(server_data, "name") or server_id
+ server = Server(
+ id=server_id,
+ name=server_name,
+ project_id=self.project_id,
+ region=region,
+ has_public_ip=server_id in self._public_ip_server_ids,
+ )
+ self.servers.append(server)
+ except Exception as e:
+ logger.error(f"Error processing server: {e}")
+ continue
+
+ logger.info(f"Successfully listed {len(servers_list)} servers in {region}")
+
def _get_used_security_group_ids(self, nics_list) -> set[str]:
"""
Get the set of security group IDs that are actively attached to any NIC.
@@ -475,3 +587,22 @@ class SecurityGroup(BaseModel):
region: str
rules: list[SecurityGroupRule] = []
in_use: bool = False
+
+
+class Server(BaseModel):
+ """
+ Represents a StackIT IaaS Server.
+
+ Attributes:
+ id: The unique identifier of the server
+ name: The name of the server
+ project_id: The StackIT project ID containing the server
+ region: The region where the server is located
+ has_public_ip: Whether a public IP is directly attached to any of the server's NICs
+ """
+
+ id: str
+ name: str
+ project_id: str
+ region: str
+ has_public_ip: bool = False
diff --git a/prowler/providers/vercel/vercel_provider.py b/prowler/providers/vercel/vercel_provider.py
index 54ab4627a9..3de89becbe 100644
--- a/prowler/providers/vercel/vercel_provider.py
+++ b/prowler/providers/vercel/vercel_provider.py
@@ -33,6 +33,7 @@ class VercelProvider(Provider):
"""Vercel provider."""
_type: str = "vercel"
+ sdk_only: bool = False
_session: VercelSession
_identity: VercelIdentityInfo
_audit_config: dict
diff --git a/prowler/towncrier.toml b/prowler/towncrier.toml
new file mode 100644
index 0000000000..528e6129ec
--- /dev/null
+++ b/prowler/towncrier.toml
@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true
diff --git a/pyproject.toml b/pyproject.toml
index 37bb1b003a..64affc8556 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -72,11 +72,11 @@ dependencies = [
"dash==3.1.1",
"dash-bootstrap-components==2.0.3",
"defusedxml==0.7.1",
- "detect-secrets==1.5.0",
"dulwich==1.2.5",
"google-api-python-client==2.163.0",
"google-auth-httplib2==0.2.0",
"jsonschema==4.23.0",
+ "kingfisher-bin==1.104.0",
"kubernetes==32.0.1",
"linode-api4==5.45.0",
"markdown==3.10.2",
@@ -125,7 +125,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}
name = "prowler"
readme = "README.md"
requires-python = ">=3.10,<3.14"
-version = "5.32.0"
+version = "5.36.0"
[project.scripts]
prowler = "prowler.__main__:prowler"
diff --git a/scripts/check_test_init_files.py b/scripts/check_test_init_files.py
new file mode 100644
index 0000000000..ddb94548e6
--- /dev/null
+++ b/scripts/check_test_init_files.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Fail when __init__.py files are present inside test directories."""
+
+from __future__ import annotations
+
+import sys
+from argparse import ArgumentParser
+from os import walk
+from pathlib import Path
+
+EXCLUDED_TEST_INIT_ROOTS = {
+ Path("tests/lib/check/fixtures/checks_folder"),
+}
+
+IGNORED_DIRECTORY_NAMES = {
+ ".git",
+ ".mypy_cache",
+ ".nox",
+ ".pytest_cache",
+ ".tox",
+ ".venv",
+ "__pycache__",
+ "node_modules",
+ "venv",
+}
+
+
+def is_test_init_file(path: Path) -> bool:
+ """Return True when the file is a root tests __init__.py."""
+ return path.name == "__init__.py" and path.parts[0] == "tests"
+
+
+def is_excluded_test_init_file(path: Path, root: Path) -> bool:
+ """Return True when the file belongs to an allowed fixture directory."""
+ relative_path = path.relative_to(root)
+ return any(
+ relative_path.is_relative_to(excluded) for excluded in EXCLUDED_TEST_INIT_ROOTS
+ )
+
+
+def find_test_init_files(root: Path) -> list[Path]:
+ """Return sorted __init__.py files found under test directories."""
+ matches = []
+
+ for current_root, directories, filenames in walk(root):
+ directories[:] = [
+ directory
+ for directory in directories
+ if directory not in IGNORED_DIRECTORY_NAMES
+ ]
+ if "__init__.py" in filenames:
+ path = Path(current_root) / "__init__.py"
+ else:
+ continue
+
+ relative_path = path.relative_to(root)
+ if is_test_init_file(relative_path) and not is_excluded_test_init_file(
+ path, root
+ ):
+ matches.append(path)
+
+ return sorted(matches)
+
+
+def main(argv: list[str] | None = None) -> int:
+ parser = ArgumentParser(description=__doc__)
+ parser.add_argument(
+ "root",
+ nargs="?",
+ default=".",
+ help="Repository root to scan. Defaults to the current directory.",
+ )
+ args = parser.parse_args(argv)
+
+ root = Path(args.root).resolve()
+ matches = find_test_init_files(root)
+
+ if not matches:
+ print("No __init__.py files found in test directories.")
+ return 0
+
+ print("Remove __init__.py files from test directories:")
+ for path in matches:
+ print(path.relative_to(root))
+
+ return 1
+
+
+if __name__ == "__main__":
+ sys.exit(main())
diff --git a/skills/prowler-attack-paths-query/SKILL.md b/skills/prowler-attack-paths-query/SKILL.md
index 6dad976983..a70734aa6f 100644
--- a/skills/prowler-attack-paths-query/SKILL.md
+++ b/skills/prowler-attack-paths-query/SKILL.md
@@ -2,13 +2,14 @@
name: prowler-attack-paths-query
description: >
Creates Prowler Attack Paths openCypher queries using the Cartography schema as the source of truth
- for node labels, properties, and relationships. Also covers Prowler-specific additions (Internet node,
- ProwlerFinding, internal isolation labels) and $provider_uid scoping for predefined queries.
+ for node labels, properties, and relationships. Covers Prowler-specific additions (Internet node,
+ ProwlerFinding, internal isolation labels), $provider_uid scoping, and list-property item nodes
+ with typed `HAS_*` edges that run efficiently on both Neo4j and Amazon Neptune sinks.
Trigger: When creating or updating Attack Paths queries.
license: Apache-2.0
metadata:
author: prowler-cloud
- version: "2.0"
+ version: "3.0"
scope: [root, api]
auto_invoke:
- "Creating Attack Paths queries"
@@ -19,36 +20,30 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, Task
## Overview
-Attack Paths queries are openCypher queries that analyze cloud infrastructure graphs (ingested via Cartography) to detect security risks like privilege escalation paths, network exposure, and misconfigurations.
-
-Queries are written in **openCypher Version 9** for compatibility with both Neo4j and Amazon Neptune.
+Attack Paths queries are read-only openCypher queries over a Cartography-ingested cloud graph that detect privilege escalation chains, network exposure, and other graph-shaped security risks. Queries are written in openCypher Version 9 so they run on both Neo4j and Amazon Neptune sinks.
---
## Two query audiences
-This skill covers two types of queries with different isolation mechanisms:
+| | Predefined queries | Custom queries |
+| ------------------ | ----------------------------------------------------------- | --------------------------------------------------------------------- |
+| Where they live | `api/src/backend/api/attack_paths/queries/{provider}.py` | User-supplied via the custom query API endpoint |
+| Provider isolation | `AWSAccount {id: $provider_uid}` anchor + path connectivity | Automatic `_Provider_{uuid}` label injection by `cypher_sanitizer.py` |
+| What to write | Chain every MATCH from the `aws` variable | Plain Cypher, no isolation boilerplate |
+| Internal labels | Never use | Never use (system-injected) |
-| | Predefined queries | Custom queries |
-|---|---|---|
-| **Where they live** | `api/src/backend/api/attack_paths/queries/{provider}.py` | User/LLM-supplied via the custom query API endpoint |
-| **Provider isolation** | `AWSAccount {id: $provider_uid}` anchor + path connectivity | Automatic `_Provider_{uuid}` label injection via `cypher_sanitizer.py` |
-| **What to write** | Chain every MATCH from the `aws` variable | Plain Cypher, no isolation boilerplate needed |
-| **Internal labels** | Never use (`_ProviderResource`, `_Tenant_*`, `_Provider_*`) | Never use (injected automatically by the system) |
+**Predefined queries**: every node must be reachable from the `AWSAccount` root via graph traversal. That is the isolation boundary.
-**For predefined queries**: every node must be reachable from the `AWSAccount` root via graph traversal. This is the isolation boundary.
-
-**For custom queries**: write natural Cypher without isolation concerns. The query runner injects a `_Provider_{uuid}` label into every node pattern before execution, and a post-query filter catches edge cases.
+**Custom queries**: write natural Cypher. The runner injects a `_Provider_{uuid}` label into every node pattern, and a post-query filter handles edge cases.
---
-## Input Sources
+## Input sources
-Queries can be created from:
+Two sources for new queries:
-1. **pathfinding.cloud ID** (e.g., `ECS-001`, `GLUE-001`)
- - Reference: https://github.com/DataDog/pathfinding.cloud
- - The aggregated `paths.json` is too large for WebFetch. Use Bash:
+1. **pathfinding.cloud ID** (e.g. `ECS-001`, `GLUE-001`), the Datadog research catalogue. The aggregated `paths.json` is too large for WebFetch:
```bash
# Fetch a single path by ID
@@ -64,28 +59,24 @@ Queries can be created from:
| jq -r '.[] | select(.id | startswith("ecs")) | "\(.id): \(.name)"'
```
- If `jq` is not available, use `python3 -c "import json,sys; ..."` as a fallback.
+ If `jq` is unavailable, use `python3 -c "import json,sys; ..."`.
-2. **Natural language description** from the user
+2. **Natural language description** from the requester.
---
-## Query Structure
+## Query structure
### Provider scoping parameter
-One parameter is injected automatically by the query runner:
+| Parameter | Property | Used on | Purpose |
+| --------------- | -------- | ------------ | -------------------------------------- |
+| `$provider_uid` | `id` | `AWSAccount` | Scopes the query to a specific account |
-| Parameter | Property it matches | Used on | Purpose |
-| --------------- | ------------------- | ------------ | -------------------------------- |
-| `$provider_uid` | `id` | `AWSAccount` | Scopes to a specific AWS account |
-
-All other nodes are isolated by path connectivity from the `AWSAccount` anchor.
+The runner binds `$provider_uid` automatically. Every other node is isolated by path connectivity from the `AWSAccount` anchor.
### Imports
-All query files start with these imports:
-
```python
from api.attack_paths.queries.types import (
AttackPathsQueryAttribution,
@@ -95,29 +86,33 @@ from api.attack_paths.queries.types import (
from tasks.jobs.attack_paths.config import PROWLER_FINDING_LABEL
```
-The `PROWLER_FINDING_LABEL` constant (value: `"ProwlerFinding"`) is used via f-string interpolation in all queries. Never hardcode the label string.
+Always use `PROWLER_FINDING_LABEL` via f-string interpolation, never hardcode `"ProwlerFinding"`.
-### Privilege escalation sub-patterns
+### Definition fields
-There are four distinct privilege escalation patterns. Choose based on the attack type:
+- **id**: kebab-case `{provider}-{description}`, e.g. `aws-ec2-privesc-passrole-iam`.
+- **name**: short, human-friendly label. Sourced queries append the reference ID: `"EC2 Instance Launch with Privileged Role (EC2-001)"`.
+- **short_description**: one sentence, no technical permissions.
+- **description**: full technical explanation, plain text.
+- **provider**: `aws`, `azure`, `gcp`, `kubernetes`, or `github`.
+- **cypher**: f-string Cypher body. Literal `{` / `}` are escaped as `{{` / `}}`.
+- **parameters**: `parameters=[]` if none.
+- **attribution**: optional `AttackPathsQueryAttribution(text, link)` for sourced queries. `link` uses the lowercase ID.
-| Sub-pattern | Target | `path_target` shape | Example |
-|---|---|---|---|
-| Self-escalation | Principal's own policies | `(aws)--(target_policy:AWSPolicy)--(principal)` | IAM-001 |
-| Lateral to user | Other IAM users | `(aws)--(target_user:AWSUser)` | IAM-002 |
-| Assume-role lateral | Assumable roles | `(aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)` | IAM-014 |
-| PassRole + service | Service-trusting roles | `(aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(...)` | EC2-001 |
+Append the constant to the `{PROVIDER}_QUERIES` list at the bottom of the provider file.
-#### Self-escalation (e.g., IAM-001)
+---
-The principal modifies resources attached to itself. `path_target` loops back to `principal`:
+## Predefined query template
+
+The canonical shape combines a principal walk, an optional target walk, deduplicated nodes, and a typed finding overlay:
```python
AWS_{QUERY_NAME} = AttackPathsQueryDefinition(
id="aws-{kebab-case-name}",
- name="{Human-friendly label} ({REFERENCE_ID})",
- short_description="{Brief explanation, no technical permissions.}",
- description="{Detailed description of the attack vector and impact.}",
+ name="{Label} ({REFERENCE_ID})",
+ short_description="{One sentence.}",
+ description="{Full technical explanation.}",
attribution=AttackPathsQueryAttribution(
text="pathfinding.cloud - {REFERENCE_ID} - {permission}",
link="https://pathfinding.cloud/paths/{reference_id_lowercase}",
@@ -125,29 +120,27 @@ AWS_{QUERY_NAME} = AttackPathsQueryDefinition(
provider="aws",
cypher=f"""
// Find principals with {permission}
- MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
- WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = '{permission_lowercase}'
- OR toLower(action) = '{service}:*'
- OR action = '*'
- )
+ MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
+ MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+ WHERE toLower(act.value) IN ['{permission_lowercase}', '{service}:*']
+ OR act.value = '*'
+ WITH DISTINCT aws, principal, stmt, path_principal
- // Find target resources attached to the same principal
+ // Target resources attached to the same principal (sub-patterns below)
MATCH path_target = (aws)--(target_policy:AWSPolicy)--(principal)
WHERE target_policy.arn CONTAINS $provider_uid
- AND any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_policy.arn CONTAINS resource
- )
+ MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+ WHERE res.value = '*'
+ OR target_policy.arn CONTAINS res.value
+ WITH DISTINCT path_principal, path_target
WITH collect(path_principal) + collect(path_target) AS paths
UNWIND paths AS p
UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
""",
@@ -155,158 +148,146 @@ AWS_{QUERY_NAME} = AttackPathsQueryDefinition(
)
```
-#### Other sub-pattern `path_target` shapes
+Key points:
-The other 3 sub-patterns share the same `path_principal`, deduplication tail, and RETURN as self-escalation. Only the `path_target` MATCH differs:
+- The principal walk types the `POLICY` and `STATEMENT` hops. Both are low-fan-out (each principal has a handful of policies; each policy a handful of statements), so the typed edge lets the planner cost a cheap inline filter.
+- The `(aws)--` hub hops stay anonymous. `AWSAccount` is a high-degree node that fans out to every principal, role, policy, and resource in the account; typing those edges forces the planner to enumerate from the hub and collapses performance on multi-tenant Neptune.
+- Other relationship types appear only where the file's existing queries already use one (`TRUSTS_AWS_PRINCIPAL`, `STS_ASSUMEROLE_ALLOW`, `MEMBER_AWS_GROUP`, `HAS_EXECUTION_ROLE`).
+- The finding probe is typed `:HAS_FINDING` and left undirected. The type lets Neptune apply an inline edge filter; the lack of direction matches the convention of the rest of the file.
+- Collapse duplicate rows after each permission gate with `WITH DISTINCT`, carrying only the variables needed by later clauses.
+- Each `HAS_*` traversal is its own `MATCH` clause with a `WHERE` on the child item node. `WITH DISTINCT path_principal, path_target` precedes `collect(path...)` to dedupe the row multiplication produced by the joins.
+- The `RETURN` shape `paths, dpf, dpfr` is the contract the serializer and visualiser depend on. Do not change it.
+
+---
+
+## Privilege escalation sub-patterns
+
+Four `path_target` shapes cover the common attack types. Each shares the canonical template's `path_principal`, deduplication tail, and `RETURN`; only the `path_target` MATCH and its resource predicate differ.
+
+| Sub-pattern | Target | `path_target` shape | Example |
+| ------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------- | ------- |
+| Self-escalation | Principal's own policies | `(aws)--(target_policy:AWSPolicy)--(principal)` | IAM-001 |
+| Lateral to user | Other IAM users | `(aws)--(target_user:AWSUser)` | IAM-002 |
+| Assume-role lateral | Assumable roles | `(aws)--(target_role:AWSRole)-[:STS_ASSUMEROLE_ALLOW]-(principal)` | IAM-014 |
+| PassRole + service | Service-trusting roles | `(aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]-(:AWSPrincipal {arn: '{service}.amazonaws.com'})` | EC2-001 |
+
+**Multi-permission queries** (e.g. PassRole plus a service-create action) add permission gates before `path_target`. Reuse the per-query counter for new variables (`act2`, `policy2`, `stmt2`) and collapse rows after each gate:
```cypher
-// Lateral to user (e.g., IAM-002) - targets other IAM users
-MATCH path_target = (aws)--(target_user:AWSUser)
-WHERE any(resource IN stmt.resource WHERE resource = '*' OR target_user.arn CONTAINS resource OR resource CONTAINS target_user.name)
-
-// Assume-role lateral (e.g., IAM-014) - targets roles the principal can assume
-MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
-WHERE any(resource IN stmt.resource WHERE resource = '*' OR target_role.arn CONTAINS resource OR resource CONTAINS target_role.name)
-
-// PassRole + service (e.g., EC2-001) - targets roles trusting a service
-MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {arn: '{service}.amazonaws.com'})
-WHERE any(resource IN stmt.resource WHERE resource = '*' OR target_role.arn CONTAINS resource OR resource CONTAINS target_role.name)
+MATCH (principal)-[:POLICY]->(policy2:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {effect: 'Allow'})
+MATCH (stmt2)-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
+WHERE toLower(act2.value) IN ['service:*', 'service:createsomething']
+ OR act2.value = '*'
+WITH DISTINCT aws, principal, stmt, stmt2, path_principal
```
-**Multi-permission**: PassRole queries require a second permission. Add `MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)` with its own WHERE before `path_target`, then check BOTH `stmt.resource` AND `stmt2.resource` against the target. See IAM-015 or EC2-001 in `aws.py` for examples.
+If a permission is an existence-only gate whose statement resource is not checked later, keep the policy and statement anonymous and carry only the variables still needed:
-### Network exposure pattern
+```cypher
+MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(:AWSPolicyStatement {effect: 'Allow'})-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
+WHERE toLower(act3.value) IN ['service:*', 'service:othersomething']
+ OR act3.value = '*'
+WITH DISTINCT aws, principal, stmt, path_principal
+```
-The Internet node is reached via `CAN_ACCESS` through the already-scoped resource, not via a standalone lookup:
+When all matching principals can target the same independent resource set, collect principal paths before expanding targets instead of creating one row per principal-target pair:
+
+```cypher
+WITH aws, collect(DISTINCT path_principal) AS principal_paths
+MATCH path_target = (aws)--(target)
+WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+WITH principal_paths + target_paths AS paths
+```
+
+Statements that constrain a target are still checked via `HAS_RESOURCE` traversals (`res`, `res2`). See IAM-015 or EC2-001 in `aws.py`.
+
+---
+
+## Network exposure pattern
+
+The Internet node is reached via `CAN_ACCESS` through an already-scoped resource, never as a standalone lookup:
```python
-AWS_{QUERY_NAME} = AttackPathsQueryDefinition(
- id="aws-{kebab-case-name}",
- name="{Human-friendly label}",
- short_description="{Brief explanation.}",
- description="{Detailed description.}",
- provider="aws",
- cypher=f"""
- // Match exposed resources (MUST chain from `aws`)
- MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(resource:EC2Instance)
- WHERE resource.exposed_internet = true
+cypher=f"""
+ // Resource scoped through the account anchor
+ MATCH path = (aws:AWSAccount {{id: $provider_uid}})--(resource:EC2Instance)
+ WHERE resource.exposed_internet = true
- // Internet node reached via path connectivity through the resource
- OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(resource)
+ // Internet node reached via path connectivity through the resource
+ OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(resource)
- WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
- UNWIND paths AS p
- UNWIND nodes(p) AS n
+ WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
+ UNWIND paths AS p
+ UNWIND nodes(p) AS n
- WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
- UNWIND unique_nodes AS n
- OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+ WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
+ UNWIND unique_nodes AS n
+ OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
- RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr,
- internet, can_access
- """,
- parameters=[],
-)
+ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr,
+ internet, can_access
+"""
```
-### Register in query list
-
-Add to the `{PROVIDER}_QUERIES` list at the bottom of the file:
-
-```python
-AWS_QUERIES: list[AttackPathsQueryDefinition] = [
- # ... existing queries ...
- AWS_{NEW_QUERY_NAME}, # Add here
-]
-```
+The `CAN_ACCESS` edge stays typed and directed (`-[:CAN_ACCESS]->`); that is its canonical sync-time orientation.
---
-## Step-by-step creation process
+## List-typed properties as child nodes
-### 1. Read the queries module
+Some Cartography node properties carry a list of values: `AWSPolicyStatement.action`, `AWSPolicyStatement.resource`, `KMSKey.encryption_algorithms`, `CloudFrontDistribution.aliases`, and many others. The graph models each such property as a set of child item nodes connected to the parent by a typed edge. Queries reach the values by traversing the edge; the parent does not carry the list as a single field.
-**FIRST**, read all files in the queries module to understand the structure, type definitions, registration, and existing style:
+### Naming convention
-```text
-api/src/backend/api/attack_paths/queries/
-├── __init__.py # Module exports
-├── types.py # AttackPathsQueryDefinition, AttackPathsQueryParameterDefinition
-├── registry.py # Query registry logic
-└── {provider}.py # Provider-specific queries (e.g., aws.py)
+For a list-typed parent property the sink stores:
+
+- **Child label**: `<ParentLabel><PropertyPascal>Item`. Example: `AWSPolicyStatement.resource` → `AWSPolicyStatementResourceItem`.
+- **Edge type**: `HAS_<PROPERTY_UPPER>`. Example: `resource` → `HAS_RESOURCE`.
+- **Child property**: `value` (a single scalar string) for scalar-list properties. For list-of-dict properties (rare; for example `SecretsManagerSecretVersion.tags`) the child carries the dict keys as named fields per the catalog's `field_map`.
+
+### Variable naming for child-item matches
+
+`aws.py` uses a per-query counter for each `HAS_*` traversal so chained matches stay unambiguous:
+
+| Edge | First | Second | Third |
+| ----------------- | ------ | ------- | ------- |
+| `HAS_ACTION` | `act` | `act2` | `act3` |
+| `HAS_RESOURCE` | `res` | `res2` | `res3` |
+| `HAS_NOTACTION` | `nact` | `nact2` | `nact3` |
+| `HAS_NOTRESOURCE` | `nres` | `nres2` | `nres3` |
+
+The counter resets at the top of every query.
+
+### Example - action match
+
+Find statements that grant `iam:PassRole`, `iam:*`, or `*`. Traverse the `HAS_ACTION` edge in its own `MATCH` clause and apply the predicate in the attached `WHERE`:
+
+```cypher
+MATCH (stmt:AWSPolicyStatement {effect: 'Allow'})
+MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
+WHERE toLower(act.value) IN ['iam:passrole', 'iam:*']
+ OR act.value = '*'
```
-**DO NOT** use generic templates. Match the exact style of existing queries in the file.
+The literal-action list is case-folded with `toLower(act.value)` because IAM authors mix case (`iam:PassRole`, `iam:passrole`); the `*` wildcard never lower-cases.
-### 2. Fetch and consult the Cartography schema
+### Example - resource ARN match
-**This is the most important step.** Every node label, property, and relationship in the query must exist in the Cartography schema for the pinned version. Do not guess or rely on memory.
+Find statements whose resource can target a specific role:
-Check `api/pyproject.toml` for the Cartography dependency, then fetch the schema:
-
-```bash
-grep cartography api/pyproject.toml
+```cypher
+MATCH path_target = (aws)--(target_role:AWSRole)
+MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
+WHERE res.value = '*'
+ OR res.value CONTAINS target_role.name
+ OR target_role.arn CONTAINS res.value
```
-Build the schema URL (ALWAYS use the specific tag, not master/main):
+Three predicates cover the cases: full wildcard (`*`), pattern containing the role name (`arn:aws:iam::*:role/admin*`), and pattern that is a prefix or component of the actual ARN.
-```text
-# Git dependency (prowler-cloud/cartography@0.126.1):
-https://raw.githubusercontent.com/prowler-cloud/cartography/refs/tags/0.126.1/docs/root/modules/{provider}/schema.md
+### Catalog of list properties
-# PyPI dependency (cartography = "^0.126.0"):
-https://raw.githubusercontent.com/cartography-cncf/cartography/refs/tags/0.126.0/docs/root/modules/{provider}/schema.md
-```
-
-Read the schema to discover available node labels, properties, and relationships for the target resources. Internal labels (`_ProviderResource`, `_AWSResource`, `_Tenant_*`, `_Provider_*`) exist for isolation but should never appear in queries.
-
-### 4. Create query definition
-
-Use the appropriate pattern (privilege escalation or network exposure) with:
-
-- **id**: `{provider}-{kebab-case-description}`
-- **name**: Short, human-friendly label. For sourced queries, append the reference ID: `"EC2 Instance Launch with Privileged Role (EC2-001)"`.
-- **short_description**: Brief explanation, no technical permissions.
-- **description**: Full technical explanation. Plain text only.
-- **provider**: Provider identifier (aws, azure, gcp, kubernetes, github)
-- **cypher**: The openCypher query with proper escaping
-- **parameters**: Optional list of user-provided parameters (`parameters=[]` if none)
-- **attribution**: Optional `AttackPathsQueryAttribution(text, link)` for sourced queries. The `text` includes source, reference ID, and permissions. The `link` uses a lowercase ID. Omit for non-sourced queries.
-
-### 5. Add query to provider list
-
-Add the constant to the `{PROVIDER}_QUERIES` list.
-
----
-
-## Query naming conventions
-
-### Query ID
-
-```text
-{provider}-{category}-{description}
-```
-
-Examples: `aws-ec2-privesc-passrole-iam`, `aws-ec2-instances-internet-exposed`
-
-### Query constant name
-
-```text
-{PROVIDER}_{CATEGORY}_{DESCRIPTION}
-```
-
-Examples: `AWS_EC2_PRIVESC_PASSROLE_IAM`, `AWS_EC2_INSTANCES_INTERNET_EXPOSED`
-
----
-
-## Query categories
-
-| Category | Description | Example |
-| -------------------- | ------------------------------ | ------------------------- |
-| Basic Resource | List resources with properties | RDS instances, S3 buckets |
-| Network Exposure | Internet-exposed resources | EC2 with public IPs |
-| Privilege Escalation | IAM privilege escalation paths | PassRole + RunInstances |
-| Data Access | Access to sensitive data | EC2 with S3 access |
+The provider catalog lives in `api/src/backend/tasks/jobs/attack_paths/provider_config.py` (`AWS_NORMALIZED_LISTS`). Beyond policy statements it includes KMS algorithms, ECS container-definition lists (`entry_point`, `command`, `links`, `dns_servers`, ...), CloudFront aliases, Inspector finding URL and vulnerability lists, RDS event-subscription categories, and others. To query a list property that is not in the catalog, add an entry there first so the sync layer materialises it.
---
@@ -315,53 +296,42 @@ Examples: `AWS_EC2_PRIVESC_PASSROLE_IAM`, `AWS_EC2_INSTANCES_INTERNET_EXPOSED`
### Match account and principal
```cypher
-MATCH path_principal = (aws:AWSAccount {id: $provider_uid})--(principal:AWSPrincipal)--(policy:AWSPolicy)--(stmt:AWSPolicyStatement)
+MATCH path_principal = (aws:AWSAccount {id: $provider_uid})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
```
-### Check IAM action permissions
+The `(aws)--(principal)` hop stays anonymous; the `POLICY` and `STATEMENT` hops are typed.
+
+### Roles trusting a service
```cypher
-WHERE stmt.effect = 'Allow'
- AND any(action IN stmt.action WHERE
- toLower(action) = 'iam:passrole'
- OR toLower(action) = 'iam:*'
- OR action = '*'
- )
+MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]-(:AWSPrincipal {arn: 'ec2.amazonaws.com'})
```
-### Find roles trusting a service
+### Roles a principal can assume
```cypher
-MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {arn: 'ec2.amazonaws.com'})
+MATCH path_target = (aws)--(target_role:AWSRole)-[:STS_ASSUMEROLE_ALLOW]-(principal)
```
-### Find roles the principal can assume
+### JSON-encoded properties
-Note the arrow direction - `STS_ASSUMEROLE_ALLOW` points from the role to the principal:
+Object-typed Cartography properties (most notably `condition` on `AWSPolicyStatement` and `S3PolicyStatement`) are stored as JSON-encoded strings, e.g. `'{"StringEquals":{"aws:SourceAccount":"123456789012"}}'`. There is no JSON parser at query time, so use `CONTAINS` for substring checks:
```cypher
-MATCH path_target = (aws)--(target_role:AWSRole)<-[:STS_ASSUMEROLE_ALLOW]-(principal)
+WHERE stmt.condition CONTAINS '"aws:SourceAccount"'
```
-### Check resource scope
-
-```cypher
-WHERE any(resource IN stmt.resource WHERE
- resource = '*'
- OR target_role.arn CONTAINS resource
- OR resource CONTAINS target_role.name
-)
-```
+For structured inspection, fetch the rows and parse in Python. Cypher cannot navigate JSON object keys.
### Internet node via path connectivity
-The Internet node is reached through `CAN_ACCESS` relationships to already-scoped resources. No standalone lookup needed:
-
```cypher
OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(resource)
```
-### Multi-label OR (match multiple resource types)
+`resource` must already be bound by the account-anchored pattern above.
+
+### Multi-label OR (multiple resource types)
```cypher
MATCH path = (aws:AWSAccount {id: $provider_uid})-[r]-(x)-[q]-(y)
@@ -373,7 +343,7 @@ WHERE (x:EC2PrivateIp AND x.public_ip = $ip)
### Include Prowler findings
-Deduplicate nodes before the ProwlerFinding lookup to avoid redundant OPTIONAL MATCH calls on nodes that appear in multiple paths:
+Deduplicate nodes before the typed finding probe to avoid one `OPTIONAL MATCH` per path-occurrence of the same node:
```cypher
WITH collect(path_principal) + collect(path_target) AS paths
@@ -382,12 +352,12 @@ UNWIND nodes(p) AS n
WITH paths, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
```
-For network exposure queries, aggregate the internet node and relationship alongside paths:
+For network-exposure queries, aggregate the Internet node and its edge alongside paths:
```cypher
WITH collect(path) AS paths, head(collect(internet)) AS internet, collect(can_access) AS can_access
@@ -396,7 +366,7 @@ UNWIND nodes(p) AS n
WITH paths, internet, can_access, collect(DISTINCT n) AS unique_nodes
UNWIND unique_nodes AS n
-OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
+OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr,
internet, can_access
@@ -406,22 +376,22 @@ RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr,
## Prowler-specific labels and relationships
-These are added by the sync task, not part of the Cartography schema. For all other node labels, properties, and relationships, **always consult the Cartography schema** (see step 2 below).
+Added by the sync task, not part of the Cartography schema. For everything else, consult the pinned Cartography schema (see "Creation steps").
-| Label/Relationship | Description |
-| ---------------------- | -------------------------------------------------- |
-| `ProwlerFinding` | Finding node (`status`, `severity`, `check_id`) |
-| `Internet` | Internet sentinel node |
-| `CAN_ACCESS` | Internet-to-resource exposure (relationship) |
-| `HAS_FINDING` | Resource-to-finding link (relationship) |
-| `TRUSTS_AWS_PRINCIPAL` | Role trust relationship |
-| `STS_ASSUMEROLE_ALLOW` | Can assume role (direction: role -> principal) |
+| Label / Relationship | Description |
+| ---------------------- | ----------------------------------------------------------- |
+| `ProwlerFinding` | Finding node (`status`, `severity`, `check_id`) |
+| `Internet` | Internet sentinel node |
+| `CAN_ACCESS` | `(Internet)-[:CAN_ACCESS]->(resource)` exposure edge |
+| `HAS_FINDING` | `(resource)-[:HAS_FINDING]->(:ProwlerFinding)` finding link |
+| `TRUSTS_AWS_PRINCIPAL` | Role trust relationship |
+| `STS_ASSUMEROLE_ALLOW` | Can assume role |
---
## Parameters
-For queries requiring user input:
+For queries that take user input:
```python
parameters=[
@@ -438,50 +408,84 @@ parameters=[
---
-## Best practices
+## openCypher compatibility
-1. **Chain all MATCHes from the root account node**: Every `MATCH` clause must connect to the `aws` variable (or another variable already bound to the account's subgraph). An unanchored `MATCH` would return nodes from all providers.
+Queries must run on both Neo4j and Amazon Neptune. Avoid these constructs:
- ```cypher
- // WRONG: matches ALL AWSRoles across all providers
- MATCH (role:AWSRole) WHERE role.name = 'admin'
+| Feature | Use instead |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| APOC procedures (`apoc.*`) | Real nodes and relationships in the graph |
+| Neptune extensions | Standard openCypher |
+| `reduce()` | `UNWIND` + `collect()` |
+| `FOREACH` | `WITH` + `UNWIND` + `SET` |
+| Regex `=~` | `toLower()` + exact match, or `STARTS WITH` / `CONTAINS` |
+| `CALL () { UNION }` | Multi-label `OR` in `WHERE` (see pattern above) |
+| Carried value plus aggregate expression | Project the aggregate first: `WITH principal_paths, collect(...) AS target_paths`, then combine lists in the next `WITH` |
+| `any(x IN list ...)` | `size([x IN list WHERE pred]) > 0` |
+| `all(x IN list ...)` | `size([x IN list WHERE pred]) = size(list)` |
+| `none(x IN list ...)` | `size([x IN list WHERE pred]) = 0` |
+| `EXISTS { MATCH (pattern) WHERE pred }` | Standalone `MATCH (pattern)` + `WHERE pred`; precede the downstream `collect(path...)` with `WITH DISTINCT <path-vars>` to dedupe the joins |
- // CORRECT: scoped to the specific account's subgraph
- MATCH (aws)--(role:AWSRole) WHERE role.name = 'admin'
- ```
-
- **Exception**: A second-permission MATCH like `MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)` is safe because `principal` is already bound to the account's subgraph by the first MATCH. It does not need to chain from `aws` again.
-
-2. **Include Prowler findings**: Always add `OPTIONAL MATCH (n)-[pfr]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})` with `collect(DISTINCT pf)`.
-
-3. **Comment the query purpose**: Add inline comments explaining each MATCH clause.
-
-4. **Never use internal labels in queries**: `_ProviderResource`, `_AWSResource`, `_Tenant_*`, `_Provider_*` are for system isolation. They should never appear in predefined or custom query text.
-
-6. **Internet node uses path connectivity**: Reach it via `OPTIONAL MATCH (internet:Internet)-[can_access:CAN_ACCESS]->(resource)` where `resource` is already scoped by the account anchor. No standalone lookup.
+For list-typed properties in the catalog (action, resource, and so on), traverse the `HAS_*` edges to the child item nodes via the multi-`MATCH` shape shown in "List-typed properties as child nodes". The parent node does not carry the list as a single field, so `split(...)` and comma-string predicates do not apply.
---
-## openCypher compatibility
+## Best practices
-Queries must be written in **openCypher Version 9** for compatibility with both Neo4j and Amazon Neptune.
+1. **Chain every MATCH from the account anchor.** An unanchored `MATCH (role:AWSRole)` returns roles from every provider in the graph; `MATCH (aws)--(role:AWSRole)` is scoped. A second-permission MATCH like `MATCH (principal)--(policy2:AWSPolicy)--(stmt2:AWSPolicyStatement)` is safe because `principal` is already bound to the account's subgraph.
+2. **Type the finding probe.** Always `OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})`. The type lets Neptune apply an inline edge filter; an untyped probe scans every incident edge of high-degree nodes.
+3. **Comment each MATCH.** One inline `// ...` line per clause explaining its role.
+4. **Never use internal labels.** `_ProviderResource`, `_AWSResource`, `_Tenant_*`, `_Provider_*` are system isolation labels and must not appear in query text (predefined or custom).
+5. **Reach the Internet node through path connectivity** via `(internet:Internet)-[:CAN_ACCESS]->(resource)`, never as a standalone match.
+6. **Preserve the `RETURN` contract.** `paths, dpf, dpfr` for the standard shape; add `internet, can_access` for network-exposure queries. The serializer and visualiser depend on these names.
-### Avoid these (not in openCypher spec)
+---
-| Feature | Use instead |
-| -------------------------- | ------------------------------------------------------ |
-| APOC procedures (`apoc.*`) | Real nodes and relationships in the graph |
-| Neptune extensions | Standard openCypher |
-| `reduce()` function | `UNWIND` + `collect()` |
-| `FOREACH` clause | `WITH` + `UNWIND` + `SET` |
-| Regex operator (`=~`) | `toLower()` + exact match, or `CONTAINS`/`STARTS WITH`. One legacy query uses `=~` - do not add new usages |
-| `CALL () { UNION }` | Multi-label OR in WHERE (see patterns section) |
+## Naming conventions
+
+- **ID**: kebab-case `{provider}-{category}-{description}`, e.g. `aws-ec2-privesc-passrole-iam`.
+- **Constant**: SHOUTING*SNAKE_CASE `{PROVIDER}*{CATEGORY}\_{DESCRIPTION}`, e.g. `AWS_EC2_PRIVESC_PASSROLE_IAM`.
+
+---
+
+## Creation steps
+
+1. **Read the queries module first** to match the existing style:
+
+ ```text
+ api/src/backend/api/attack_paths/queries/
+ ├── __init__.py
+ ├── types.py # dataclass definitions
+ ├── registry.py
+ └── {provider}.py
+ ```
+
+2. **Fetch the Cartography schema for the pinned version.** Do not guess labels, properties, or relationships. Read the dependency pin:
+
+ ```bash
+ grep cartography api/pyproject.toml
+ ```
+
+ Then fetch the schema for that exact tag:
+
+ ```text
+ # Git pin (prowler-cloud/cartography@<TAG>):
+ https://raw.githubusercontent.com/prowler-cloud/cartography/refs/tags/<TAG>/docs/root/modules/{provider}/schema.md
+
+ # PyPI pin (cartography==<TAG>):
+ https://raw.githubusercontent.com/cartography-cncf/cartography/refs/tags/<TAG>/docs/root/modules/{provider}/schema.md
+ ```
+
+3. **Build the query** using the canonical predefined template plus the appropriate sub-pattern (privilege escalation or network exposure). For list-typed properties (action/resource/etc.), traverse the exploded child nodes via `[:HAS_ACTION]->(:AWSPolicyStatementActionItem)` etc. (see "List-typed properties as child nodes" and the `AWS_NORMALIZED_LISTS` catalog).
+
+4. **Register** the constant in the `{PROVIDER}_QUERIES` list at the bottom of the provider file.
---
## Reference
-- **pathfinding.cloud**: https://github.com/DataDog/pathfinding.cloud (use `curl | jq`, not WebFetch)
-- **Cartography schema**: `https://raw.githubusercontent.com/{org}/cartography/refs/tags/{version}/docs/root/modules/{provider}/schema.md`
-- **Neptune openCypher compliance**: https://docs.aws.amazon.com/neptune/latest/userguide/feature-opencypher-compliance.html
-- **openCypher spec**: https://github.com/opencypher/openCypher
+- **pathfinding.cloud**: https://github.com/DataDog/pathfinding.cloud (use `curl | jq`; the aggregated `paths.json` is too large for WebFetch).
+- **Cartography schema** (per pinned tag): `https://raw.githubusercontent.com/{org}/cartography/refs/tags/{tag}/docs/root/modules/{provider}/schema.md`.
+- **Neptune openCypher compliance**: https://docs.aws.amazon.com/neptune/latest/userguide/feature-opencypher-compliance.html.
+- **openCypher spec**: https://github.com/opencypher/openCypher.
+- **Sync converter** (`tasks/jobs/attack_paths/sync.py`): list-typed node properties listed in `tasks/jobs/attack_paths/provider_config.py::AWS_NORMALIZED_LISTS` are materialised as child item nodes + `HAS_*` edges. Properties that are not in the catalog are serialised to a comma-delimited string and emit a one-time warning. Dict-typed properties become JSON strings. Same shape on both sinks.
diff --git a/skills/prowler-changelog/SKILL.md b/skills/prowler-changelog/SKILL.md
index 67e853b0fd..fef70fa9bc 100644
--- a/skills/prowler-changelog/SKILL.md
+++ b/skills/prowler-changelog/SKILL.md
@@ -6,7 +6,7 @@ description: >
license: Apache-2.0
metadata:
author: prowler-cloud
- version: "1.0"
+ version: "2.0"
scope: [root, ui, api, sdk, mcp_server]
auto_invoke:
- "Add changelog entry for a PR or feature"
@@ -16,70 +16,80 @@ metadata:
allowed-tools: Read, Edit, Write, Glob, Grep, Bash
---
-## Changelog Locations
+## How changelog entries work: fragments
-| Component | File | Version Prefix | Current Version |
-|-----------|------|----------------|-----------------|
-| UI | `ui/CHANGELOG.md` | None | 1.x.x |
-| API | `api/CHANGELOG.md` | None | 1.x.x |
-| MCP Server | `mcp_server/CHANGELOG.md` | None | 0.x.x |
-| SDK | `prowler/CHANGELOG.md` | None | 5.x.x |
+A PR never edits unreleased `CHANGELOG.md` content directly; use fragments instead. Released-block typo/correction fixes are the only direct-edit exception and are described below. For regular entries, add one small **fragment file** per entry under the component's `changelog.d/` directory. Fragments are compiled into the component's `CHANGELOG.md` at release time (deleting the consumed fragments), so concurrent PRs never conflict on the changelog.
-## Format Rules (keepachangelog.com)
+| Component | Fragments directory | Compiled file |
+|-----------|---------------------|---------------|
+| UI | `ui/changelog.d/` | `ui/CHANGELOG.md` |
+| API | `api/changelog.d/` | `api/CHANGELOG.md` |
+| MCP Server | `mcp_server/changelog.d/` | `mcp_server/CHANGELOG.md` |
+| SDK | `prowler/changelog.d/` | `prowler/CHANGELOG.md` |
-### Section Order (ALWAYS this order)
+"What's unreleased" = "what's in `changelog.d/`". The compiled `CHANGELOG.md` files contain only released versions.
-```markdown
-## [X.Y.Z] (Prowler vA.B.C) OR (Prowler UNRELEASED)
+## Fragment filename
-### Added
-### Changed
-### Deprecated
-### Removed
-### Fixed
-### Security
+```text
+<slug>.<type>.md
```
-### Emoji Prefixes (REQUIRED for ALL components)
+- `<slug>` is free-form (`[A-Za-z0-9][A-Za-z0-9._-]*`), chosen by the author, ideally descriptive of the change (e.g. `securityhub-delegated-admin`). The PR number is also a valid slug (e.g. `11259`) when it is already known; it is never required.
+- `<type>` maps 1:1 to the keepachangelog sections:
-| Section | Emoji | Usage |
-|---------|-------|-------|
-| Added | `### 🚀 Added` | New features, checks, endpoints |
-| Changed | `### 🔄 Changed` | Modifications to existing functionality |
-| Deprecated | `### ⚠️ Deprecated` | Features marked for removal |
-| Removed | `### ❌ Removed` | Deleted features |
-| Fixed | `### 🐞 Fixed` | Bug fixes |
-| Security | `### 🔐 Security` | Security patches, CVE fixes |
+| `<type>` | Section | Usage |
+|----------|---------|-------|
+| `added` | `### 🚀 Added` | New features, checks, endpoints |
+| `changed` | `### 🔄 Changed` | Modifications to existing functionality |
+| `deprecated` | `### ⚠️ Deprecated` | Features marked for removal |
+| `removed` | `### ❌ Removed` | Deleted features |
+| `fixed` | `### 🐞 Fixed` | Bug fixes |
+| `security` | `### 🔐 Security` | Security patches, CVE fixes |
-### Entry Format
+- A PR adds as many fragment files as entries it needs, freely mixing types: one file per entry. E.g. a PR touching Added, Changed and Fixed ships `kms-rotation-check.added.md` + `kms-metadata-cache.changed.md` + `kms-disabled-keys.fixed.md`, and all compile with the same PR link into their own sections.
+- Several entries of the SAME type: a different slug per entry (`kms-rotation-check.added.md`, `kms-rotation-docs.added.md`).
+- At least one fragment per touched component, same as the old one-entry-per-changelog rule.
-```markdown
-### Added
+## Fragment content
-- Existing entry one [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- Existing entry two [(#YYYY)](https://github.com/prowler-cloud/prowler/pull/YYYY)
-- NEW ENTRY GOES HERE at the BOTTOM [(#ZZZZ)](https://github.com/prowler-cloud/prowler/pull/ZZZZ)
+The file contains ONLY the entry text, exactly as it should appear in the changelog, on a single line ending with a trailing newline:
-### Changed
-
-- Existing change [(#AAAA)](https://github.com/prowler-cloud/prowler/pull/AAAA)
-- NEW CHANGE ENTRY at BOTTOM [(#BBBB)](https://github.com/prowler-cloud/prowler/pull/BBBB)
+```bash
+echo '`securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on' > prowler/changelog.d/securityhub-delegated-admin.added.md
```
-**Rules:**
-- **ADD NEW ENTRIES AT THE BOTTOM of each section** (before next section header or `---`)
-- **Blank line after section header** before first entry
-- **Blank line between sections**
+**Rules (same prose conventions as always):**
+
+- **NEVER write the PR link in the text.** It is attached automatically at compile time (the compile workflow resolves the PR that added the fragment from git history). Writing `[(#NNNN)](...)` in a fragment produces a duplicated link.
+- No period at the end
+- Do NOT start with redundant verbs (the section header already provides the action)
- Be specific: what changed, not why (that's in the PR)
- Keep entries readable: use spaces around inline code and product names, and wrap endpoints, commands, errors, task names, and file paths in backticks
- Avoid long run-on sentences; split complex changes into one concise result plus one concise context clause
-- One entry per PR (can link multiple PRs for related changes)
-- No period at the end
-- Do NOT start with redundant verbs (section header already provides the action)
-- **CRITICAL: Preserve section order** — when adding a new section to the UNRELEASED block, insert it in the correct position relative to existing sections (Added → Changed → Deprecated → Removed → Fixed → Security). Never append a new section at the top or bottom without checking order
-- **CRITICAL: ALWAYS link to the PR, NEVER to the issue.** Every entry MUST use `https://github.com/prowler-cloud/prowler/pull/N`. Linking to `/issues/N` is FORBIDDEN, even when the PR fixes an issue. The issue↔PR relationship belongs in the PR body (`Fixes #N`), not in the changelog. If a fix has no PR yet, do not add the entry until the PR exists.
-### Semantic Versioning Rules
+### Good fragments
+
+```text
+# ui/changelog.d/provider-search-bar.added.md
+Search bar when adding a provider
+
+# api/changelog.d/scan-dispatch-race.fixed.md
+`POST /api/v1/scans` no longer intermittently fails with `Scan matching query does not exist`; scan dispatch now publishes the `scan-perform` Celery task after the transaction commits
+
+# ui/changelog.d/node-24-bump.security.md
+Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs
+```
+
+### Bad fragments
+
+```text
+Fixed bug. # Too vague, has period, redundant verb
+Add search bar # Redundant verb (the section already says "Added")
+Search bar [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634) # NEVER include the PR link; it is added at compile time
+```
+
+## Semantic Versioning Rules
Prowler follows [semver.org](https://semver.org/):
@@ -89,69 +99,26 @@ Prowler follows [semver.org](https://semver.org/):
| New features (backwards compatible) | MINOR (x.**Y**.0) | 1.16.2 → 1.17.0 |
| Breaking changes, removals | MAJOR (**X**.0.0) | 1.17.0 → 2.0.0 |
-**CRITICAL:** `### ❌ Removed` entries MUST only appear in MAJOR version releases. Removing features is a breaking change.
-
-### Released Versions Are Immutable
-
-**NEVER modify already released versions.** Once a version is released (has a Prowler version tag like `v5.16.0`), its changelog section is frozen.
-
-**Common issue:** A PR is created during release cycle X, includes a changelog entry, but merges after release. The entry is now in the wrong section.
-
-```markdown
-## [1.16.0] (Prowler v5.16.0) ← RELEASED, DO NOT MODIFY
-
-### Added
-- Feature from merged PR [(#9999)] ← WRONG! PR merged after release
-
-## [1.17.0] (Prowler UNRELEASED) ← Move entry HERE
-```
-
-**Fix:** Move the entry from the released version to the UNRELEASED section.
-
-### Version Header Format
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED) # For unreleased changes
-## [1.16.0] (Prowler v5.16.0) # For released versions
-
---- # Horizontal rule between versions
-```
-
-## Mandatory Changelog Preflight
-
-Before editing any `CHANGELOG.md`, always inspect the active release boundary:
-
-1. Read the UNRELEASED block plus the latest three released version blocks:
- ```bash
- awk '/^## \[/{n++} n<=4 {print}' ui/CHANGELOG.md
- ```
-2. Identify the **only writable block**: the block whose header contains `(Prowler UNRELEASED)`.
-3. Treat every block whose header contains `(Prowler vX.Y.Z)` as immutable. Do not add, move, reword, reorder, or deduplicate entries there.
-4. If your PR's entry appears in any of the latest three released blocks, remove it from the released block and add it to the correct section in the UNRELEASED block.
-5. If there is no UNRELEASED block at the top, stop and ask before editing.
-
-**Do not trust the current topmost matching section name.** A released block can contain the same section heading (`### 🚀 Added`, `### 🔄 Changed`, etc.). Always anchor edits to the `Prowler UNRELEASED` version block first.
+**CRITICAL:** `removed` fragments MUST only ship in MAJOR version releases. Removing features is a breaking change.
## Mandatory Human Confirmation Gate
-Before creating or editing any changelog file (`CHANGELOG.md`), the agent MUST stop and get explicit user confirmation. This applies even when the changelog gate is failing, the required edit seems obvious, or the user asked to "fix the changelog".
+Before creating or editing any changelog fragment or `CHANGELOG.md` file, the agent MUST stop and get explicit user confirmation. This applies even when the changelog gate is failing, the required file seems obvious, or the user asked to "fix the changelog".
-Present the proposed changelog action before writing:
+Present the proposed action before writing:
-1. Target file path.
-2. Target version block and section.
-3. Exact entry to add, move, remove, or rewrite.
-4. Reason the changelog is needed.
+1. Target fragment path (component, slug, type) or CHANGELOG.md edit.
+2. Exact entry text.
+3. Reason the changelog entry is needed.
-Only proceed after an explicit approval such as "confirm", "approved", "sí", or equivalent. If the user rejects or does not answer, do not edit or create the changelog. Offer alternatives such as adding `no-changelog` when appropriate.
+Only proceed after an explicit approval such as "confirm", "approved", "sí", or equivalent. If the user rejects or does not answer, do not create or edit anything. Offer alternatives such as adding `no-changelog` when appropriate.
## Adding a Changelog Entry
### Step 1: Determine Affected Component(s)
```bash
-# Check which files changed
-git diff main...HEAD --name-only
+git diff master...HEAD --name-only | grep -E '^(ui|api|mcp_server|prowler)/' | cut -d/ -f1 | sort -u
```
| Path Pattern | Component |
@@ -160,114 +127,63 @@ git diff main...HEAD --name-only
| `api/**` | API |
| `mcp_server/**` | MCP Server |
| `prowler/**` | SDK |
-| Multiple | Update ALL affected changelogs |
+| Root `uv.lock` / `pyproject.toml` | SDK (the gate requires a `prowler/changelog.d/` fragment) |
+| Multiple | One fragment per affected component |
-### Step 2: Determine Change Type
+### Step 2: Create the fragment(s)
-| Change | Section |
-|--------|---------|
-| New feature, check, endpoint | 🚀 Added |
-| Behavior change, refactor | 🔄 Changed |
-| Bug fix | 🐞 Fixed |
-| CVE patch, security improvement | 🔐 Security |
-| Feature removal | ❌ Removed |
-| Deprecation notice | ⚠️ Deprecated |
-
-### Step 3: Add Entry at BOTTOM of Appropriate Section
-
-**CRITICAL:** Add new entries at the BOTTOM of each section, NOT at the top.
-
-**CRITICAL:** The link MUST point to the PR (`/pull/N`). Linking to `/issues/N` is FORBIDDEN. If the PR closes an issue, that mapping goes in the PR body via `Fixes #N` — never in the changelog entry.
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED)
-
-### 🐞 Fixed
-
-- Existing fix one [(#9997)](https://github.com/prowler-cloud/prowler/pull/9997)
-- Existing fix two [(#9998)](https://github.com/prowler-cloud/prowler/pull/9998)
-- Button alignment in dashboard header [(#9999)](https://github.com/prowler-cloud/prowler/pull/9999) ← NEW ENTRY AT BOTTOM
-
-### 🔐 Security
+```bash
+echo 'Entry text describing the change' > <component>/changelog.d/<slug>.<type>.md
```
-This maintains chronological order within each section (oldest at top, newest at bottom).
+### Step 3: Check pending fragments
-## Examples
-
-### Good Entries
-
-```markdown
-### 🚀 Added
-- Search bar when adding a provider [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634)
-
-### 🐞 Fixed
-- OCI update credentials form failing silently due to missing provider UID [(#9746)](https://github.com/prowler-cloud/prowler/pull/9746)
-
-### 🔐 Security
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#9797)](https://github.com/prowler-cloud/prowler/pull/9797)
-```
-
-### Readable Technical Entries
-
-```markdown
-# GOOD - Technical but readable
-### 🐞 Fixed
-- `POST /api/v1/scans` no longer intermittently fails with `Scan matching query does not exist`; scan dispatch now publishes the `scan-perform` Celery task after the transaction commits [(#11122)](https://github.com/prowler-cloud/prowler/pull/11122)
-- `entra_users_mfa_capable` no longer flags disabled guest users; Microsoft Graph is now the source of truth for `account_enabled` because EXO `Get-User` omits guest users [(#11002)](https://github.com/prowler-cloud/prowler/pull/11002)
-```
-
-### Bad Entries
-
-```markdown
-# BAD - Wrong section order (Fixed before Added)
-### 🐞 Fixed
-- Some bug fix [(#123)](...)
-
-### 🚀 Added
-- Some new feature [(#456)](...)
-
-- Fixed bug. # Too vague, has period
-- Added new feature for users # Missing PR link, redundant verb
-- Add search bar [(#123)] # Redundant verb (section already says "Added")
-- This PR adds a cool new thing (#123) # Wrong link format, conversational
-- Some bug fix [(#123)](https://github.com/prowler-cloud/prowler/issues/123) # FORBIDDEN: must link to /pull/N, never /issues/N
-- POST /api/v1/scanswas intermittently failing withScan matching query does not existin thescan-performworker (#11122) # Missing spaces/backticks, unreadable
-- entra_users_mfa_capable no longer flags disabled guest users by requesting accountEnabled and userType from Microsoft Graph via $select and using Graph as the source of truth for account_enabled (EXO Get-User does not return guest users) (#11002) # Run-on sentence, identifiers not formatted
+```bash
+ls prowler/changelog.d/ api/changelog.d/ ui/changelog.d/ mcp_server/changelog.d/
```
## PR Changelog Gate
-The `pr-check-changelog.yml` workflow enforces changelog entries:
+The `pr-check-changelog.yml` workflow enforces fragments:
-1. **REQUIRED**: PRs touching `ui/`, `api/`, `mcp_server/`, or `prowler/` MUST update the corresponding changelog
-2. **SKIP**: Add `no-changelog` label to bypass (use sparingly for docs-only, CI-only changes)
+1. **REQUIRED**: PRs touching `ui/`, `api/`, `mcp_server/`, or `prowler/` MUST add (or fix) a fragment under the corresponding `changelog.d/`
+2. **VALIDATED**: added fragment filenames must match `<slug>.<type>.md` with a valid type
+3. **LINTED**: fragment content must NOT contain a hand-written PR link (`[(#N)](...)`); the gate fails if one is found because the link is attached automatically at compile time
+4. **SKIP**: Add `no-changelog` label to bypass (use sparingly for docs-only, CI-only changes)
-## Commands
+## Release flow (compile)
-```bash
-# Check which changelogs need updates based on changed files
-git diff main...HEAD --name-only | grep -E '^(ui|api|mcp_server|prowler)/' | cut -d/ -f1 | sort -u
+- At release time, the `compile-changelogs` workflow (manual dispatch: `prowler_version` + `target_branch`; per-component versions are auto-derived by mirroring the Prowler version — SDK mirrors it directly, UI is `1.<minor>.<patch>`, API is `1.<minor + 1>.<patch>`, and only the MCP Server derives from its pending fragment types — with optional explicit overrides or `skip`) resolves each fragment's PR from git history, runs the compiler per component, and opens a `chore(changelog): vX.Y.Z` PR (labeled `no-changelog` and `skip-sync`) that inserts the stamped `## [X.Y.Z] (Prowler vX.Y.Z)` block into each `CHANGELOG.md` and deletes the consumed fragments. A human reviews and squash-merges it. `prepare-release.yml` then extracts the stamped sections exactly as before.
+- **Minor release (X.Y.0):** compile on `master` and merge the compile PR BEFORE cutting the `v5.X` branch.
+- **Patch release (X.Y.Z):** fixes are backported to `v5.X` with their fragment files (conflict-free); compile on `v5.X` and merge its PR there. The same workflow run automatically opens a second forward-sync PR against master (labeled `no-changelog` and `skip-sync`) that inserts the same stamped block under master's marker and deletes the consumed fragments, so the next minor cannot re-release them; merge it right after. Fragments that only existed on `v5.X` are skipped with a notice. No manual git is involved.
+- Entries within a section are ordered by PR number ascending (approximately chronological). Do not fight this ordering.
-# View current UNRELEASED section
-head -50 ui/CHANGELOG.md
-head -50 api/CHANGELOG.md
-head -50 mcp_server/CHANGELOG.md
-head -50 prowler/CHANGELOG.md
-```
+## Fixing an already-released entry
-## Migration Note
+Released version blocks in `CHANGELOG.md` are otherwise immutable, but typo/correction fixes to already-released entries are the one case where a PR edits `CHANGELOG.md` directly: make the edit and add the `no-changelog` label.
-**API, MCP Server, and SDK changelogs currently lack emojis.** When editing these files, add emoji prefixes to section headers as you update them:
+If a PR's entry shipped in the wrong released block (e.g. the PR merged after its release was cut), move the entry back to a fragment: delete it from the released block and recreate it as `<component>/changelog.d/<PR>.<type>.md` (label the PR `no-changelog` since it edits `CHANGELOG.md`).
+
+## Compiled CHANGELOG.md format (for reference)
+
+The compiler renders, per release, into each `CHANGELOG.md` right under the `<!-- changelog: release notes start -->` marker (never remove that marker):
```markdown
-# Before (legacy)
-### Added
+## [X.Y.Z] (Prowler vA.B.C)
-# After (standardized)
### 🚀 Added
+
+- Entry text [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
+
+### 🐞 Fixed
+
+- Fix entry [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
+
+---
```
+Section order is always: Added → Changed → Deprecated → Removed → Fixed → Security. `X.Y.Z` is the COMPONENT version; `A.B.C` is the Prowler release version. Every entry ends with its PR link; linking to `/issues/N` is forbidden (the issue↔PR mapping belongs in the PR body via `Fixes #N`).
+
## Resources
- **Templates**: See [assets/](assets/) for entry templates
diff --git a/skills/prowler-changelog/assets/entry-templates.md b/skills/prowler-changelog/assets/entry-templates.md
index cc74efbb63..b2367b0219 100644
--- a/skills/prowler-changelog/assets/entry-templates.md
+++ b/skills/prowler-changelog/assets/entry-templates.md
@@ -1,101 +1,73 @@
-# Changelog Entry Templates
+# Changelog Fragment Templates
-## Entry Placement Rule
+## Fragment basics
-**CRITICAL:** Always add new entries at the **BOTTOM** of each section (before the next section header or `---`).
+One fragment file per entry, under the component's `changelog.d/`:
-This maintains chronological order: oldest entries at top, newest at bottom.
-
-## Section Headers
-
-```markdown
-### 🚀 Added
-### 🔄 Changed
-### ⚠️ Deprecated
-### ❌ Removed
-### 🐞 Fixed
-### 🔐 Security
+```text
+<component>/changelog.d/<slug>.<type>.md
```
-## Entry Patterns
+- `<slug>`: free-form, descriptive (`[A-Za-z0-9][A-Za-z0-9._-]*`)
+- `<type>`: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: a single line with the entry text. **No PR link** (attached automatically at compile time) and no trailing period.
-> **Note:** Section headers already provide the verb. Entries describe WHAT, not the action.
->
-> **Link target rule:** Every entry MUST link to the PR (`https://github.com/prowler-cloud/prowler/pull/N`). Linking to `/issues/N` is FORBIDDEN — even when the PR fixes an issue. The issue↔PR mapping belongs in the PR body (`Fixes #N`), not here.
+> **Note:** The section header already provides the verb. Entries describe WHAT, not the action.
-### Feature Addition (🚀 Added)
-```markdown
-- Search bar when adding a provider [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- `{check_id}` check for {provider} provider [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- `/api/v1/{endpoint}` endpoint to {description} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+## Content Patterns by Type
+
+### Feature Addition (`.added.md`)
+
+```text
+Search bar when adding a provider
+`{check_id}` check for {provider} provider
+`/api/v1/{endpoint}` endpoint to {description}
```
-### Behavior Change (🔄 Changed)
-```markdown
-- Lighthouse AI MCP tool filtering from blacklist to whitelist approach [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {package} from {old} to {new} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Behavior Change (`.changed.md`)
+
+```text
+Lighthouse AI MCP tool filtering from blacklist to whitelist approach
+{package} from {old} to {new}
```
-### Bug Fix (🐞 Fixed)
-```markdown
-- OCI update credentials form failing silently due to missing provider UID [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {What was broken} in {component} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Bug Fix (`.fixed.md`)
+
+```text
+OCI update credentials form failing silently due to missing provider UID
+{What was broken} in {component}
```
-> When a PR fixes a reported issue, the link still goes to the PR (`/pull/N`), never the issue (`/issues/N`). Reference the issue from the PR body with `Fixes #N`.
+### Security Patch (`.security.md`)
-### Security Patch (🔐 Security)
-```markdown
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {package} to version {version} (CVE-XXXX-XXXXX) [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+```text
+Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs
+{package} to version {version} (CVE-XXXX-XXXXX)
```
-### Removal (❌ Removed)
-```markdown
-- Deprecated {feature} from {location} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Removal (`.removed.md`)
+
+```text
+Deprecated {feature} from {location}
```
-## Version Header Templates
+## Full Examples
-### Unreleased
-```markdown
-## [X.Y.Z] (Prowler UNRELEASED)
+```bash
+echo 'Search bar when adding a provider' > ui/changelog.d/provider-search-bar.added.md
+
+echo '`kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less' > prowler/changelog.d/kms-rotation-90d.added.md
+
+echo 'OCI update credentials form failing silently due to missing provider UID' > ui/changelog.d/oci-credentials-form.fixed.md
```
-### Released
-```markdown
-## [X.Y.Z] (Prowler vA.B.C)
+Several entries in one PR → one file per entry, freely mixing types (different slugs when the type repeats):
----
+```text
+prowler/changelog.d/kms-rotation-check.added.md
+prowler/changelog.d/kms-rotation-docs.added.md
+prowler/changelog.d/kms-metadata-cache.changed.md
+prowler/changelog.d/kms-disabled-keys.fixed.md
```
-## Full Entry Example
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED)
-
-### 🚀 Added
-
-- Search bar when adding a provider [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634)
-- New findings table UI with new design system components [(#9699)](https://github.com/prowler-cloud/prowler/pull/9699)
-- YOUR NEW ENTRY GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🔄 Changed
-
-- Lighthouse AI MCP tool filtering from blacklist to whitelist approach [(#9802)](https://github.com/prowler-cloud/prowler/pull/9802)
-- YOUR NEW CHANGE GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🐞 Fixed
-
-- OCI update credentials form failing silently due to missing provider UID [(#9746)](https://github.com/prowler-cloud/prowler/pull/9746)
-- YOUR NEW FIX GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🔐 Security
-
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#9797)](https://github.com/prowler-cloud/prowler/pull/9797)
-- YOUR NEW SECURITY FIX GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
----
-```
-
-> **Remember:** Each new entry is added at the BOTTOM of its section to maintain chronological order.
+> **Remember:** never include the PR link in the fragment text; the compile step resolves and appends it automatically.
diff --git a/skills/prowler-ci/SKILL.md b/skills/prowler-ci/SKILL.md
index b673178c8c..e956cd4ee0 100644
--- a/skills/prowler-ci/SKILL.md
+++ b/skills/prowler-ci/SKILL.md
@@ -31,7 +31,8 @@ Use this skill whenever you are:
- PR template: `.github/pull_request_template.md`
- PR title validation: `.github/workflows/conventional-commit.yml`
-- Changelog gate: `.github/workflows/pr-check-changelog.yml`
+- Changelog gate: `.github/workflows/pr-check-changelog.yml` (requires a fragment under `<component>/changelog.d/`)
+- Changelog compile (release time): `.github/workflows/compile-changelogs.yml`
- Conflict markers check: `.github/workflows/pr-conflict-checker.yml`
- Secret scanning: `.github/workflows/find-secrets.yml`
- Auto labels: `.github/workflows/labeler.yml` and `.github/labeler.yml`
@@ -42,7 +43,7 @@ Use this skill whenever you are:
1. Identify which workflow/job is failing (name + file under `.github/workflows/`).
2. Check path filters: is the workflow supposed to run for your changed files?
3. If it's a title check: verify PR title matches Conventional Commits.
-4. If it's changelog: verify the right `CHANGELOG.md` is updated OR apply `no-changelog` label.
+4. If it's changelog: verify a valid fragment exists under the right `<component>/changelog.d/` OR apply `no-changelog` label.
5. If it's conflict checker: remove `<<<<<<<`, `=======`, `>>>>>>>` markers.
6. If it's secrets (TruffleHog): see section below.
diff --git a/skills/prowler-compliance-review/SKILL.md b/skills/prowler-compliance-review/SKILL.md
index 06f371f81b..6136467538 100644
--- a/skills/prowler-compliance-review/SKILL.md
+++ b/skills/prowler-compliance-review/SKILL.md
@@ -27,7 +27,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
| JSON Valid | `python3 -m json.tool file.json` | No syntax errors |
| All Checks Exist | Run validation script | 0 missing checks |
| No Duplicate IDs | Run validation script | 0 duplicate requirement IDs |
-| CHANGELOG Entry | Manual review | Present under correct version |
+| Changelog fragment | Manual review | Fragment present under `prowler/changelog.d/` |
| Dashboard File | Compare with existing | Follows established pattern |
| Framework Metadata | Manual review | All required fields populated |
@@ -63,8 +63,8 @@ JSON Valid?
Duplicate Requirement IDs?
├── Yes → FAIL: Fix duplicate IDs
└── No ↓
- CHANGELOG Entry Present?
- ├── No → REQUEST CHANGES: Add CHANGELOG entry
+ Changelog Fragment Present?
+ ├── No → REQUEST CHANGES: Add changelog fragment
└── Yes ↓
Dashboard File Follows Pattern?
├── No → REQUEST CHANGES: Fix dashboard pattern
@@ -124,7 +124,7 @@ Compliance frameworks are JSON files in: `prowler/compliance/{provider}/{framewo
| Empty Checks for Automated | AssessmentStatus is Automated but Checks is empty | Add checks or change to Manual |
| Wrong file location | Framework not in `prowler/compliance/{provider}/` | Move to correct directory |
| Missing dashboard file | No corresponding `dashboard/compliance/{framework}.py` | Create dashboard file following pattern |
-| CHANGELOG missing | Not under correct version section | Add entry to prowler/CHANGELOG.md |
+| Changelog fragment missing | No fragment file in the PR diff | Add a fragment under prowler/changelog.d/ |
---
diff --git a/skills/prowler-compliance-review/references/review-checklist.md b/skills/prowler-compliance-review/references/review-checklist.md
index d8673d8c03..34e5e26c67 100644
--- a/skills/prowler-compliance-review/references/review-checklist.md
+++ b/skills/prowler-compliance-review/references/review-checklist.md
@@ -16,7 +16,7 @@
|-----------|----------|
| Compliance JSON | `prowler/compliance/{provider}/{framework}.json` |
| Dashboard | `dashboard/compliance/{framework}_{provider}.py` |
-| CHANGELOG | `prowler/CHANGELOG.md` |
+| Changelog fragment | `prowler/changelog.d/` |
| Checks | `prowler/providers/{provider}/services/{service}/{check}/` |
## Validation Script
@@ -40,7 +40,7 @@ When completing a compliance framework review, use this summary format:
| JSON Valid | PASS/FAIL |
| All Checks Exist | PASS/FAIL (N missing) |
| No Duplicate IDs | PASS/FAIL |
-| CHANGELOG Entry | PASS/FAIL |
+| Changelog fragment | PASS/FAIL |
| Dashboard File | PASS/FAIL |
### Statistics
diff --git a/skills/prowler-mcp/SKILL.md b/skills/prowler-mcp/SKILL.md
index af3c597771..704acf8553 100644
--- a/skills/prowler-mcp/SKILL.md
+++ b/skills/prowler-mcp/SKILL.md
@@ -19,7 +19,7 @@ The Prowler MCP Server uses three sub-servers with prefixed namespacing:
| Sub-Server | Prefix | Auth | Purpose |
|------------|--------|------|---------|
-| Prowler App | `prowler_app_*` | Required | Cloud management tools |
+| Prowler | `prowler_*` | Required | Prowler Cloud, Private Cloud & Local Server management tools |
| Prowler Hub | `prowler_hub_*` | No | Security checks catalog |
| Prowler Docs | `prowler_docs_*` | No | Documentation search |
@@ -27,7 +27,7 @@ For complete architecture, patterns, and examples, see [docs/developer-guide/mcp
---
-## Critical Rules (Prowler App Only)
+## Critical Rules (Prowler Tools Only)
### Tool Implementation
@@ -56,7 +56,7 @@ Use `@mcp.tool()` decorator directly—no BaseTool or models required.
---
-## Quick Reference: New Prowler App Tool
+## Quick Reference: New Prowler Tool
1. Create tool class in `prowler_app/tools/` extending `BaseTool`
2. Create models in `prowler_app/models/` using `MinimalSerializerMixin`
@@ -64,7 +64,7 @@ Use `@mcp.tool()` decorator directly—no BaseTool or models required.
---
-## QA Checklist (Prowler App)
+## QA Checklist (Prowler Tools)
- [ ] Tool docstrings describe LLM-relevant behavior
- [ ] Models use `MinimalSerializerMixin`
diff --git a/skills/prowler-pr/SKILL.md b/skills/prowler-pr/SKILL.md
index e147d37fbe..ee18f7205f 100644
--- a/skills/prowler-pr/SKILL.md
+++ b/skills/prowler-pr/SKILL.md
@@ -56,7 +56,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
- [ ] Review if code is being documented following https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
- [ ] Review if backport is needed.
- [ ] Review if is needed to change the Readme.md
-- [ ] Ensure new entries are added to CHANGELOG.md, if applicable.
+- [ ] Ensure a changelog fragment is added under <component>/changelog.d/, if applicable.
#### SDK/CLI
- Are there new checks included in this PR? Yes / No
@@ -67,7 +67,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
- [ ] Screenshots/Video - Mobile (X < 640px)
- [ ] Screenshots/Video - Tablet (640px > X < 1024px)
- [ ] Screenshots/Video - Desktop (X > 1024px)
-- [ ] Ensure new entries are added to ui/CHANGELOG.md
+- [ ] Ensure a changelog fragment is added under ui/changelog.d/
#### API (if applicable)
- [ ] All issue/task requirements work as expected on the API
@@ -77,7 +77,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
- [ ] Any other relevant evidence of the implementation (if applicable)
- [ ] Verify if API specs need to be regenerated.
- [ ] Check if version updates are required.
-- [ ] Ensure new entries are added to api/CHANGELOG.md
+- [ ] Ensure a changelog fragment is added under api/changelog.d/
### License
@@ -86,12 +86,12 @@ By submitting this pull request, I confirm that my contribution is made under th
## Component-Specific Rules
-| Component | CHANGELOG | Extra Checks |
-|-----------|-----------|--------------|
-| SDK | `prowler/CHANGELOG.md` | New checks → permissions update? |
-| API | `api/CHANGELOG.md` | API specs, version bump, endpoint output, EXPLAIN ANALYZE, performance |
-| UI | `ui/CHANGELOG.md` | Screenshots for Mobile/Tablet/Desktop |
-| MCP | `mcp_server/CHANGELOG.md` | N/A |
+| Component | Changelog fragment | Extra Checks |
+|-----------|--------------------|--------------|
+| SDK | `prowler/changelog.d/` | New checks → permissions update? |
+| API | `api/changelog.d/` | API specs, version bump, endpoint output, EXPLAIN ANALYZE, performance |
+| UI | `ui/changelog.d/` | Screenshots for Mobile/Tablet/Desktop |
+| MCP | `mcp_server/changelog.d/` | N/A |
## Commands
@@ -128,7 +128,7 @@ Follow conventional commits:
1. ✅ All tests pass locally
2. ✅ Linting passes (`make lint` or component-specific)
-3. ✅ CHANGELOG updated (if applicable)
+3. ✅ Changelog fragment added (if applicable)
4. ✅ Branch is up to date with main
5. ✅ Commits are clean and descriptive
diff --git a/skills/prowler-test-api/SKILL.md b/skills/prowler-test-api/SKILL.md
index 5b3e2ae6a1..2b5231104a 100644
--- a/skills/prowler-test-api/SKILL.md
+++ b/skills/prowler-test-api/SKILL.md
@@ -31,7 +31,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
```text
create_test_user (session) ─► tenants_fixture (function) ─► authenticated_client
│
- └─► providers_fixture ─► scans_fixture ─► findings_fixture
+ └─► aws_provider ─► scans_fixture ─► findings_fixture
```
### Key Fixtures
@@ -40,8 +40,12 @@ create_test_user (session) ─► tenants_fixture (function) ─► authenticate
|---------|-------------|
| `create_test_user` | Session user (`dev@prowler.com`) |
| `tenants_fixture` | 3 tenants: [0],[1] have membership, [2] isolated |
-| `authenticated_client` | JWT client for tenant[0] |
-| `providers_fixture` | 9 providers in tenant[0] |
+| `authenticated_client` | Django test client with JWT for tenant[0] |
+| `authenticated_client_for_tenant_factory` | Creates a Django test client with JWT for a specific user and tenant |
+| `provider_factory` | Creates one validated provider with provider-specific defaults |
+| `aws_provider` | 1 AWS provider in tenant[0] |
+| `aws_provider_pair` | 2 AWS providers in tenant[0] |
+| `all_provider_types_fixture` | 1 provider for every supported provider type |
| `tasks_fixture` | 2 Celery tasks with TaskResult |
### RBAC Fixtures
@@ -52,6 +56,14 @@ create_test_user (session) ─► tenants_fixture (function) ─► authenticate
| `authenticated_client_rbac_noroles` | Membership but NO roles |
| `authenticated_client_no_permissions_rbac` | All permissions = False |
+Use `authenticated_client` for normal view behavior tests. It uses a cheap JWT
+and still runs the real request authentication path. Use serializer-generated
+JWTs or API-key clients only when the test is specifically about token
+obtain/refresh, invalid tokens, expired tokens, tenant switching by token, API
+keys, or unauthenticated 401 behavior. Use
+`authenticated_client_for_tenant_factory` when a test needs a cheap JWT client
+for a different user or tenant.
+
---
## 2. JSON:API Requests
diff --git a/skills/prowler-test-api/assets/api_test.py b/skills/prowler-test-api/assets/api_test.py
index 0b70cd599d..e0ca148662 100644
--- a/skills/prowler-test-api/assets/api_test.py
+++ b/skills/prowler-test-api/assets/api_test.py
@@ -22,12 +22,12 @@ from api.rls import Tenant
class TestProviderViewSet:
"""Example API tests for Provider endpoints."""
- def test_list_providers(self, authenticated_client, providers_fixture):
+ def test_list_providers(self, authenticated_client, aws_provider):
"""GET list returns all providers for authenticated tenant."""
response = authenticated_client.get(reverse("provider-list"))
assert response.status_code == status.HTTP_200_OK
- assert len(response.json()["data"]) == len(providers_fixture)
+ assert len(response.json()["data"]) == 1
def test_create_provider(self, authenticated_client):
"""POST with JSON:API format creates provider."""
@@ -49,9 +49,9 @@ class TestProviderViewSet:
assert response.status_code == status.HTTP_201_CREATED
assert response.json()["data"]["attributes"]["uid"] == "123456789012"
- def test_update_provider(self, authenticated_client, providers_fixture):
+ def test_update_provider(self, authenticated_client, aws_provider):
"""PATCH with JSON:API format updates provider."""
- provider = providers_fixture[0]
+ provider = aws_provider
payload = {
"data": {
@@ -95,7 +95,7 @@ class TestRLSIsolation:
assert response.status_code == status.HTTP_404_NOT_FOUND
def test_list_excludes_other_tenants(
- self, authenticated_client, providers_fixture, tenants_fixture
+ self, authenticated_client, aws_provider, tenants_fixture
):
"""List endpoints only return resources from user's tenants."""
# Create provider in isolated tenant
@@ -109,8 +109,8 @@ class TestRLSIsolation:
response = authenticated_client.get(reverse("provider-list"))
assert response.status_code == status.HTTP_200_OK
- # Should only see providers_fixture (9 providers in tenant[0])
- assert len(response.json()["data"]) == len(providers_fixture)
+ # Should only see the AWS provider in tenant[0]
+ assert len(response.json()["data"]) == 1
@pytest.mark.django_db
@@ -136,7 +136,7 @@ class TestRBACPermissions:
response = authenticated_client_rbac_noroles.get(reverse("user-list"))
assert response.status_code == status.HTTP_403_FORBIDDEN
- def test_admin_sees_all(self, authenticated_client_rbac, providers_fixture):
+ def test_admin_sees_all(self, authenticated_client_rbac, aws_provider):
"""Admin with unlimited_visibility=True sees all providers."""
response = authenticated_client_rbac.get(reverse("provider-list"))
assert response.status_code == status.HTTP_200_OK
@@ -153,11 +153,11 @@ class TestAsyncOperations:
mock_delete_task,
mock_task_get,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
"""DELETE returns 202 Accepted with Content-Location header."""
- provider = providers_fixture[0]
+ provider = aws_provider
prowler_task = tasks_fixture[0]
# Mock the Celery task
@@ -184,11 +184,11 @@ class TestAsyncOperations:
mock_scan_task,
mock_task_get,
authenticated_client,
- providers_fixture,
+ aws_provider,
tasks_fixture,
):
"""POST to scan trigger returns 202 with task location."""
- provider = providers_fixture[0]
+ provider = aws_provider
prowler_task = tasks_fixture[0]
task_mock = Mock()
@@ -208,9 +208,9 @@ class TestAsyncOperations:
class TestJSONAPIResponses:
"""Example JSON:API response handling."""
- def test_read_single_resource(self, authenticated_client, providers_fixture):
+ def test_read_single_resource(self, authenticated_client, aws_provider):
"""Read data from single resource response."""
- provider = providers_fixture[0]
+ provider = aws_provider
response = authenticated_client.get(
reverse("provider-detail", kwargs={"pk": provider.id})
)
@@ -222,12 +222,12 @@ class TestJSONAPIResponses:
assert resource_id == str(provider.id)
assert attrs["provider"] == provider.provider
- def test_read_list_response(self, authenticated_client, providers_fixture):
+ def test_read_list_response(self, authenticated_client, aws_provider):
"""Read data from list response."""
response = authenticated_client.get(reverse("provider-list"))
items = response.json()["data"]
- assert len(items) == len(providers_fixture)
+ assert len(items) == 1
def test_read_relationships(self, authenticated_client, scans_fixture):
"""Read relationship data."""
@@ -262,9 +262,9 @@ class TestJSONAPIResponses:
class TestSoftDelete:
"""Example soft-delete manager tests."""
- def test_objects_excludes_soft_deleted(self, providers_fixture):
+ def test_objects_excludes_soft_deleted(self, aws_provider):
"""Default manager excludes soft-deleted records."""
- provider = providers_fixture[0]
+ provider = aws_provider
provider.is_deleted = True
provider.save()
@@ -284,12 +284,12 @@ class TestSoftDelete:
class TestCeleryTaskLogic:
"""Example: Testing Celery task logic directly with apply()."""
- def test_task_logic_directly(self, tenants_fixture, providers_fixture):
+ def test_task_logic_directly(self, tenants_fixture, aws_provider):
"""Use apply() for synchronous execution without Celery worker."""
from tasks.tasks import check_provider_connection_task
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
# Execute task synchronously (no broker needed)
result = check_provider_connection_task.apply(
@@ -328,12 +328,12 @@ class TestSetTenantDecorator:
"""Example: Testing @set_tenant decorator behavior."""
@patch("api.decorators.connection")
- def test_sets_rls_context(self, mock_conn, tenants_fixture, providers_fixture):
+ def test_sets_rls_context(self, mock_conn, tenants_fixture, aws_provider):
"""Verify @set_tenant sets RLS context via SET_CONFIG_QUERY."""
from tasks.tasks import check_provider_connection_task
tenant = tenants_fixture[0]
- provider = providers_fixture[0]
+ provider = aws_provider
# Call task with tenant_id - decorator sets RLS and pops it
check_provider_connection_task.apply(
@@ -349,13 +349,13 @@ class TestBeatScheduling:
"""Example: Testing Beat scheduled task creation."""
@patch("tasks.beat.perform_scheduled_scan_task.apply_async")
- def test_schedule_provider_scan(self, mock_apply, providers_fixture):
+ def test_schedule_provider_scan(self, mock_apply, aws_provider):
"""Verify periodic task is created with correct settings."""
from django_celery_beat.models import PeriodicTask
from tasks.beat import schedule_provider_scan
- provider = providers_fixture[0]
+ provider = aws_provider
mock_apply.return_value = Mock(id="task-123")
schedule_provider_scan(provider)
diff --git a/skills/prowler-test-api/references/test-api-docs.md b/skills/prowler-test-api/references/test-api-docs.md
index 0150fbfe87..02d450e788 100644
--- a/skills/prowler-test-api/references/test-api-docs.md
+++ b/skills/prowler-test-api/references/test-api-docs.md
@@ -24,7 +24,7 @@ create_test_user (session)
│ └─► authenticated_client
│ └─► (most API tests use this)
│
- ├─► providers_fixture
+ ├─► aws_provider
│ └─► scans_fixture
│ └─► findings_fixture
│
@@ -102,12 +102,20 @@ Authentication tests:
```python
@pytest.mark.django_db
class TestProviderViewSet:
- def test_list(self, authenticated_client, providers_fixture):
- # authenticated_client has JWT for tenant[0]
- # providers_fixture has 9 providers in tenant[0]
+ def test_list(self, authenticated_client, aws_provider):
+ # authenticated_client is a Django test client with JWT for tenant[0]
+ # aws_provider creates one validated AWS provider in tenant[0]
...
```
+Use serializer-generated JWTs or API-key clients for authentication behavior
+tests only: token obtain/refresh, invalid or expired tokens, token-scoped tenant
+switching, API keys, and unauthenticated 401 responses. Regular view tests
+should use `authenticated_client` so they still exercise `request.user`,
+`request.auth["tenant_id"]`, RLS, and RBAC without paying token serializer cost.
+Use `authenticated_client_for_tenant_factory` when a test needs the same cheap
+JWT path for a different user or tenant.
+
### RBAC Tests
```python
diff --git a/skills/prowler-ui/SKILL.md b/skills/prowler-ui/SKILL.md
index f0f2bae08e..18d37a9cd2 100644
--- a/skills/prowler-ui/SKILL.md
+++ b/skills/prowler-ui/SKILL.md
@@ -2,14 +2,15 @@
name: prowler-ui
description: >
Prowler UI-specific patterns. For generic patterns, see: typescript, react-19, nextjs-16, tailwind-4.
- Trigger: When working inside ui/ on Prowler-specific conventions (shadcn vs HeroUI legacy, folder placement, actions/adapters, shared types/hooks/lib).
+ Trigger: When working inside ui/ on Prowler-specific conventions (shadcn, folder placement, actions/adapters, shared types/hooks/lib).
license: Apache-2.0
metadata:
author: prowler-cloud
- version: "1.0"
+ version: "1.1"
scope: [root, ui]
auto_invoke:
- "Creating/modifying Prowler UI components"
+ - "Reviewing Prowler UI components"
- "Working on Prowler UI structure (actions/adapters/types/hooks)"
allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
---
@@ -31,25 +32,35 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
Next.js 16.2.3 | React 19.2.5 | Tailwind 4.1.18 | shadcn/ui
Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8
NextAuth 5.0.0-beta.30 | Recharts 2.15.4
-HeroUI 2.8.4 (LEGACY - do not add new components)
```
## CRITICAL: Component Library Rule
- **ALWAYS**: Use `shadcn/ui` + Tailwind (`components/shadcn/`)
-- **NEVER**: Add new HeroUI components (`components/ui/` is legacy only)
+- **NEVER**: Add components to `components/ui/` (temporary re-export shims for the prowler-cloud overlay only)
+
+## Design System Discipline (REQUIRED)
+
+Applies to ALL UI work. The design system is the single source of truth — reuse it exactly, extend it deliberately.
+
+- **Reuse first, never reinvent.** Before building anything, search `components/shadcn/` and existing usages in the codebase for an equivalent. Do NOT create a custom component, modal wrapper, or primitive when one already exists.
+- **Use exactly the defined variants/styles — no more, no less.** At the call site, drive appearance through the component's `variant`/`size`/`tone` props. Never add ad-hoc visual `className` (color, opacity, hover/focus/disabled, spacing-for-looks) to shared controls (`Button`, `SelectTrigger`, `SelectItem`, `Modal`, badges…), and never skip the correct semantic variant.
+- **Modals**: only `@/components/shadcn/modal`. **Selects**: `components/shadcn/select`.
+- **Colors**: reuse existing semantic tokens from `ui/styles/globals.css`. No raw Tailwind color utilities (e.g. `bg-blue-950/40`), no hex. If no token fits, STOP and ask the design owner — do not invent or near-duplicate tokens.
+- **Need a genuinely new variant/token?** That is a design-system change: add it to the shared component API (with design sign-off), then consume it. It is never a call-site decision.
+
+When reviewing UI PRs, flag: custom modals/primitives that duplicate shadcn, call-site visual `className` on shared controls, raw color utilities, and new variants/tokens introduced without going through the shared component API.
## DECISION TREES
### Component Placement
```text
-New feature UI? → shadcn/ui + Tailwind
-Existing HeroUI feature? → Keep HeroUI (don't mix)
-Used 1 feature? → features/{feature}/components/
-Used 2+ features? → components/shared/
-Needs state/hooks? → "use client"
-Server component? → No directive needed
+New UI primitive? → components/shadcn/ (shadcn/ui + Tailwind)
+Used by 1 domain? → components/{domain}/
+Used by 2+ domains? → components/shared/
+Needs state/hooks? → "use client"
+Server component? → No directive needed
```
### Code Location
@@ -63,10 +74,16 @@ Utils (shared 2+) → lib/
Utils (local 1) → {feature}/utils/
Hooks (shared 2+) → hooks/
Hooks (local 1) → {feature}/hooks.ts
-shadcn components → components/shadcn/
-HeroUI components → components/ui/ (LEGACY)
+UI primitive → components/shadcn/
+Domain component → components/{domain}/
```
+> **Deprecated:** `components/ui/` is a temporary re-export shim that maps
+> legacy import paths to `components/shadcn/` for the prowler-cloud overlay.
+> HeroUI is fully removed. Never add or import components here — use
+> `@/components/shadcn` (primitives) or `@/components/{domain}` instead.
+> Delete the shim once the cloud repo migrates to `@/components/shadcn`.
+
### Styling Decision
```text
@@ -97,8 +114,9 @@ ui/
│ ├── services/
│ └── integrations/
├── components/
-│ ├── shadcn/ # shadcn/ui (USE THIS)
-│ ├── ui/ # HeroUI (LEGACY)
+│ ├── shadcn/ # shadcn/ui primitives (USE THIS)
+│ ├── shared/ # Cross-domain composed components (2+ domains)
+│ ├── ui/ # DEPRECATED shim → re-exports shadcn (do not use)
│ ├── {domain}/ # Domain-specific (compliance, findings, providers, etc.)
│ ├── filters/ # Filter components
│ ├── graphs/ # Chart components
@@ -311,16 +329,6 @@ Before requesting re-review from a reviewer:
- [ ] If you disagreed: the reply explains why with clear reasoning — do not leave threads silently open
- [ ] Re-request review only after all threads are in a clean state
-## Migrations Reference
-
-| From | To | Key Changes |
-|------|-----|-------------|
-| React 18 | 19.1 | Async components, React Compiler (no useMemo/useCallback) |
-| Next.js 14 | 15.5 | Improved App Router, better streaming |
-| NextUI | HeroUI 2.8.4 | Package rename only, same API |
-| Zod 3 | 4 | `z.email()` not `z.string().email()`, `error` not `message` |
-| AI SDK 4 | 5 | `@ai-sdk/react`, `sendMessage` not `handleSubmit`, `parts` not `content` |
-
## Resources
- **Documentation**: See [references/](references/) for links to local developer guide
diff --git a/skills/tdd/SKILL.md b/skills/tdd/SKILL.md
index d62d359053..6b82228c9f 100644
--- a/skills/tdd/SKILL.md
+++ b/skills/tdd/SKILL.md
@@ -164,9 +164,9 @@ class Test_ec2_ami_public:
```python
@pytest.mark.django_db
class TestResourceModel:
- def test_create_resource_with_tags(self, providers_fixture):
+ def test_create_resource_with_tags(self, aws_provider):
# Given
- provider, *_ = providers_fixture
+ provider = aws_provider
tenant_id = provider.tenant_id
# When
diff --git a/tests/config/config_test.py b/tests/config/config_test.py
index 2a7aecd330..d10c384b0d 100644
--- a/tests/config/config_test.py
+++ b/tests/config/config_test.py
@@ -320,6 +320,19 @@ config_aws = {
"minimum_snapshot_retention_period": 7,
"elb_min_azs": 2,
"elbv2_min_azs": 2,
+ "elbv2_listener_pqc_tls_allowed_policies": [
+ "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+ ],
"secrets_ignore_patterns": [],
"max_days_secret_unused": 90,
"max_days_secret_unrotated": 90,
@@ -488,7 +501,7 @@ class Test_Config:
with open(json_path, "w") as f:
json.dump({"Framework": "CIS", "Provider": "aws"}, f)
- mock_dirs.return_value = {"aws": tmpdir}
+ mock_dirs.return_value = {"aws": [tmpdir]}
frameworks = get_available_compliance_frameworks("aws")
@@ -497,6 +510,32 @@ class Test_Config:
f"{frameworks.count('cis_2.0_aws')} occurrences in: {frameworks}"
)
+ @mock.patch("prowler.config.config._get_ep_compliance_dirs")
+ def test_get_available_compliance_frameworks_merges_multiple_ep_dirs_same_provider(
+ self, mock_dirs
+ ):
+ """Frameworks from every package contributing the same provider must
+ surface, not just the last directory discovered."""
+ import json
+ import tempfile
+
+ with (
+ tempfile.TemporaryDirectory() as pkg_a,
+ tempfile.TemporaryDirectory() as pkg_b,
+ ):
+ with open(os.path.join(pkg_a, "cis_1.0_template.json"), "w") as f:
+ json.dump({"Framework": "CIS", "Provider": "template"}, f)
+ with open(os.path.join(pkg_b, "nis2_1.0_template.json"), "w") as f:
+ json.dump({"Framework": "NIS2", "Provider": "template"}, f)
+
+ # Two packages register `prowler.compliance` with the same name.
+ mock_dirs.return_value = {"template": [pkg_a, pkg_b]}
+
+ frameworks = get_available_compliance_frameworks("template")
+
+ assert "cis_1.0_template" in frameworks
+ assert "nis2_1.0_template" in frameworks
+
def test_load_and_validate_config_file_aws(self):
path = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
config_test_file = f"{path}/fixtures/config.yaml"
diff --git a/tests/config/fixtures/config.yaml b/tests/config/fixtures/config.yaml
index 39cba5f27d..df663e923a 100644
--- a/tests/config/fixtures/config.yaml
+++ b/tests/config/fixtures/config.yaml
@@ -362,6 +362,21 @@ aws:
# Minimum number of Availability Zones that an ELBv2 must be in
elbv2_min_azs: 2
+ # aws.elbv2_listener_pqc_tls_enabled
+ # Allowed post-quantum TLS security policies for ELBv2 HTTPS/TLS listeners
+ elbv2_listener_pqc_tls_allowed_policies:
+ - "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09"
+ - "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09"
+
# AWS Elasticache Configuration
# aws.elasticache_redis_cluster_backup_enabled
# Minimum number of days that a Redis cluster must have backups retention period
diff --git a/tests/config/schema/aws_schema_test.py b/tests/config/schema/aws_schema_test.py
index ad08e84e3b..838853f52a 100644
--- a/tests/config/schema/aws_schema_test.py
+++ b/tests/config/schema/aws_schema_test.py
@@ -3,6 +3,7 @@ constraint surface (CIDRs, account IDs, port ranges, enums, thresholds)."""
import pytest
+from prowler.config.scan_config_schema import SCAN_CONFIG_SCHEMA
from prowler.config.schema.aws import AWSProviderConfig
from prowler.config.schema.validator import validate_provider_config
@@ -11,6 +12,52 @@ def _validate(raw):
return validate_provider_config("aws", raw, AWSProviderConfig)
+RESOURCE_LIMIT_KEYS = [
+ "max_scanned_resources_per_service",
+ "max_ebs_snapshots",
+ "max_backup_recovery_points",
+ "max_cloudwatch_log_groups",
+ "max_lambda_functions",
+ "max_ecs_task_definitions",
+ "max_codeartifact_packages",
+]
+
+
+class Test_AWS_Resource_Limits:
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_positive_values_round_trip(self, key):
+ assert _validate({key: 100}) == {key: 100}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_null_values_round_trip(self, key):
+ assert _validate({key: None}) == {key: None}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_zero_disable_sentinel_round_trips(self, key):
+ assert _validate({key: 0}) == {key: 0}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_numeric_strings_are_coerced_to_int(self, key):
+ assert _validate({key: "100"}) == {key: 100}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_disable_sentinel_minus_one_round_trips(self, key):
+ assert _validate({key: -1}) == {key: -1}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ @pytest.mark.parametrize("value", [True, False])
+ def test_booleans_are_dropped_not_coerced_to_int(self, key, value):
+ assert _validate({key: value}) == {}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_invalid_strings_are_dropped(self, key):
+ assert _validate({key: "not-an-int"}) == {}
+
+ @pytest.mark.parametrize("key", RESOURCE_LIMIT_KEYS)
+ def test_keys_are_exposed_in_scan_config_schema(self, key):
+ assert key in SCAN_CONFIG_SCHEMA["properties"]["aws"]["properties"]
+
+
class Test_AWS_Threat_Detection_Thresholds:
"""All threat detection thresholds are documented as fractions in 0..1.
The biggest risk of mistyping them is silently disabling the check."""
@@ -129,44 +176,53 @@ class Test_AWS_Enums:
assert _validate({"ecr_repository_vulnerability_minimum_severity": level}) == {}
-class Test_AWS_Detect_Secrets_Plugins:
- def test_plugin_without_limit(self):
- out = _validate({"detect_secrets_plugins": [{"name": "AWSKeyDetector"}]})
- assert out == {"detect_secrets_plugins": [{"name": "AWSKeyDetector"}]}
+class TestAWSELBv2PQCTLSAllowedPolicies:
+ def test_valid_policy_list_round_trips(self):
+ policies = [
+ "ELBSecurityPolicy-TLS13-1-2-Res-2021-06",
+ "ELBSecurityPolicy-TLS13-1-3-2021-06",
+ ]
- def test_plugin_with_limit(self):
- out = _validate(
- {
- "detect_secrets_plugins": [
- {"name": "Base64HighEntropyString", "limit": 6.0}
- ]
- }
- )
- assert out == {
- "detect_secrets_plugins": [
- {"name": "Base64HighEntropyString", "limit": 6.0}
- ]
+ assert _validate({"elbv2_listener_pqc_tls_allowed_policies": policies}) == {
+ "elbv2_listener_pqc_tls_allowed_policies": policies
}
- def test_plugin_missing_name_drops_whole_field(self):
- # ``name`` is required by the upstream library.
- out = _validate({"detect_secrets_plugins": [{"limit": 6.0}]})
- assert out == {}
+ def test_key_is_exposed_in_scan_config_schema(self):
+ aws_properties = SCAN_CONFIG_SCHEMA["properties"]["aws"]["properties"]
- def test_extra_plugin_kwargs_pass_through(self):
- # Plugins can have arbitrary extra params (extra="allow" on the
- # nested model). They must round-trip.
- out = _validate(
- {
- "detect_secrets_plugins": [
- {"name": "Custom", "my_param": "abc", "other": 42}
- ]
- }
- )
- assert out == {
- "detect_secrets_plugins": [
- {"name": "Custom", "my_param": "abc", "other": 42}
- ]
+ assert "elbv2_listener_pqc_tls_allowed_policies" in aws_properties
+
+ @pytest.mark.parametrize(
+ "value",
+ [
+ "ELBSecurityPolicy-TLS13-1-2-Res-2021-06",
+ ["ELBSecurityPolicy-TLS13-1-2-Res-2021-06", 123],
+ ],
+ )
+ def test_invalid_policy_values_are_dropped(self, value):
+ assert _validate({"elbv2_listener_pqc_tls_allowed_policies": value}) == {}
+
+
+class Test_AWS_Secrets_Ignore_Files:
+ def test_valid_file_patterns_round_trip(self):
+ files = ["*.deps.json", "vendor/*.js"]
+ assert _validate({"secrets_ignore_files": files}) == {
+ "secrets_ignore_files": files
+ }
+
+ def test_empty_list_is_valid(self):
+ assert _validate({"secrets_ignore_files": []}) == {"secrets_ignore_files": []}
+
+ def test_exposed_in_scan_config_schema(self):
+ aws_properties = SCAN_CONFIG_SCHEMA["properties"]["aws"]["properties"]
+
+ assert aws_properties["secrets_ignore_files"] == {
+ "anyOf": [
+ {"items": {"type": "string"}, "type": "array"},
+ {"type": "null"},
+ ],
+ "default": None,
+ "title": "Secrets Ignore Files",
}
@@ -214,9 +270,5 @@ class Test_AWS_Full_Default_Config_Round_Trips:
"threat_detection_enumeration_threshold": 0.3,
"threat_detection_llm_jacking_threshold": 0.4,
"ec2_high_risk_ports": [25, 110, 8088],
- "detect_secrets_plugins": [
- {"name": "AWSKeyDetector"},
- {"name": "Base64HighEntropyString", "limit": 6.0},
- ],
}
assert _validate(raw) == raw
diff --git a/tests/config/schema/bounds_test.py b/tests/config/schema/bounds_test.py
index 0e5cad6056..4d8d49bab2 100644
--- a/tests/config/schema/bounds_test.py
+++ b/tests/config/schema/bounds_test.py
@@ -70,6 +70,18 @@ INT_BOUND_CASES = [
("vercel", "stale_invitation_threshold_days", 7, 365),
("vercel", "max_owner_percentage", 1, 50),
("vercel", "max_owners", 1, 1000),
+ # Okta
+ ("okta", "okta_max_session_idle_minutes", 1, 1440),
+ ("okta", "okta_max_session_lifetime_minutes", 1, 43200),
+ ("okta", "okta_admin_console_idle_timeout_max_minutes", 1, 1440),
+ ("okta", "okta_user_inactivity_max_days", 1, 3650),
+ # Alibaba Cloud
+ ("alibabacloud", "max_cluster_check_days", 1, 365),
+ ("alibabacloud", "max_console_access_days", 30, 180),
+ ("alibabacloud", "min_log_retention_days", 1, 3650),
+ ("alibabacloud", "min_rds_audit_retention_days", 1, 3650),
+ # OpenStack
+ ("openstack", "image_sharing_threshold", 1, 1000),
]
@@ -330,38 +342,6 @@ class TestTrustedIpsValidator:
assert _has_error_for(errors, "aws.trusted_ips")
-class TestDetectSecretsEntropyBound:
- """`detect_secrets_plugins[].limit` is Shannon entropy: 0..10."""
-
- @pytest.mark.parametrize("value", [0.0, 3.5, 4.5, 8.0, 10.0])
- def test_valid(self, value):
- assert (
- validate_scan_config(
- {
- "aws": {
- "detect_secrets_plugins": [
- {"name": "Base64HighEntropyString", "limit": value}
- ]
- }
- }
- )
- == []
- )
-
- @pytest.mark.parametrize("value", [-0.1, 10.01, 50])
- def test_invalid(self, value):
- errors = validate_scan_config(
- {
- "aws": {
- "detect_secrets_plugins": [
- {"name": "Base64HighEntropyString", "limit": value}
- ]
- }
- }
- )
- assert _has_error_for(errors, "aws.detect_secrets_plugins")
-
-
class TestAdapterRobustness:
"""Top-level adapter behaviour the Prowler App backend depends on."""
diff --git a/tests/config/schema/exclusions_test.py b/tests/config/schema/exclusions_test.py
new file mode 100644
index 0000000000..a13ed2f786
--- /dev/null
+++ b/tests/config/schema/exclusions_test.py
@@ -0,0 +1,113 @@
+"""Coverage for the ``excluded_checks`` / ``excluded_services`` fields
+added to :class:`prowler.config.schema.base.ProviderConfigBase`.
+
+Because the fields live on the base class, every registered provider
+schema exposes them and every provider must therefore share the same
+whitespace / uniqueness / non-empty guarantees. These tests lock in that
+contract at the base level and at the JSON-Schema level (which the UI
+editor consumes via ``ajv``).
+"""
+
+import pytest
+from pydantic import ValidationError
+
+from prowler.config.scan_config_schema import SCAN_CONFIG_SCHEMA
+from prowler.config.schema.aws import AWSProviderConfig
+from prowler.config.schema.registry import SCHEMAS
+from prowler.config.schema.validator import validate_provider_config
+
+EXCLUSION_FIELDS = ("excluded_checks", "excluded_services")
+
+
+class Test_JSON_Schema_Exposes_Exclusion_Fields:
+ @pytest.mark.parametrize("provider", sorted(SCHEMAS))
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_field_shape(self, provider, field):
+ field_schema = SCAN_CONFIG_SCHEMA["properties"][provider]["properties"][field]
+ assert field_schema["type"] == "array"
+ assert field_schema["items"] == {"type": "string", "minLength": 1}
+ assert field_schema["uniqueItems"] is True
+ assert field_schema["default"] == []
+
+
+class Test_Exclusion_Field_Validation:
+ def _model(self, **kwargs):
+ return AWSProviderConfig.model_validate(kwargs)
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_empty_string_is_rejected(self, field):
+ with pytest.raises(ValidationError):
+ self._model(**{field: [""]})
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_whitespace_only_string_is_rejected(self, field):
+ with pytest.raises(ValidationError):
+ self._model(**{field: [" "]})
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_raw_duplicates_are_rejected(self, field):
+ with pytest.raises(ValidationError):
+ self._model(**{field: ["s3", "s3"]})
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_normalized_duplicates_are_rejected(self, field):
+ # After whitespace normalization ``" s3 "`` collapses to ``"s3"``
+ # and must be caught by the duplicate check.
+ with pytest.raises(ValidationError):
+ self._model(**{field: ["s3", " s3 "]})
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_whitespace_is_stripped(self, field):
+ model = self._model(**{field: [" identifier "]})
+ assert getattr(model, field) == ["identifier"]
+
+ @pytest.mark.parametrize("field", EXCLUSION_FIELDS)
+ def test_non_string_item_is_rejected(self, field):
+ with pytest.raises(ValidationError):
+ self._model(**{field: [123]})
+
+
+class Test_Exclusion_Defaults_Are_Not_Injected:
+ """The strict normalization path uses ``model_dump(exclude_unset=True)``
+ so pre-existing configs that never set an exclusion field must round-trip
+ without the default empty list being materialized."""
+
+ def test_absent_fields_are_not_injected_by_validator(self):
+ # The lenient SDK runtime path also uses ``exclude_unset=True`` under
+ # the hood; asserting on the validator output guards the promise
+ # against future refactors.
+ assert validate_provider_config("aws", {}, SCHEMAS["aws"]) == {}
+
+ def test_absent_fields_are_not_injected_when_other_keys_are_present(self):
+ assert validate_provider_config(
+ "aws",
+ {"max_ec2_instance_age_in_days": 180},
+ SCHEMAS["aws"],
+ ) == {"max_ec2_instance_age_in_days": 180}
+
+ def test_explicit_empty_list_round_trips(self):
+ # Explicitly setting ``excluded_checks: []`` is different from
+ # omitting it — the empty list is user-provided and must be
+ # preserved by the strict-normalization contract.
+ assert validate_provider_config(
+ "aws",
+ {"excluded_checks": []},
+ SCHEMAS["aws"],
+ ) == {"excluded_checks": []}
+
+
+class Test_Extra_Fields_Are_Preserved:
+ """``extra="allow"`` must keep plugin-provided keys around so the
+ ecosystem contract in ``validator_test.py`` still holds after adding
+ the exclusion fields."""
+
+ def test_unknown_keys_are_preserved_alongside_exclusions(self):
+ out = validate_provider_config(
+ "aws",
+ {"excluded_checks": ["s3_bucket_public_access"], "plugin_option": "kept"},
+ SCHEMAS["aws"],
+ )
+ assert out == {
+ "excluded_checks": ["s3_bucket_public_access"],
+ "plugin_option": "kept",
+ }
diff --git a/tests/config/schema/other_providers_schema_test.py b/tests/config/schema/other_providers_schema_test.py
index f4dc5184ab..0406776f57 100644
--- a/tests/config/schema/other_providers_schema_test.py
+++ b/tests/config/schema/other_providers_schema_test.py
@@ -117,6 +117,88 @@ class Test_Cloudflare_Schema:
assert _validate("cloudflare", {"max_retries": -1}) == {}
+class Test_Okta_Schema:
+ def test_valid_values_round_trip(self):
+ raw = {
+ "okta_max_session_idle_minutes": 15,
+ "okta_max_session_lifetime_minutes": 18 * 60,
+ "okta_admin_console_idle_timeout_max_minutes": 15,
+ "okta_user_inactivity_max_days": 35,
+ "okta_dod_approved_ca_issuer_patterns": [r"\bOU=DoD\b", r"\bOU=ECA\b"],
+ }
+ assert _validate("okta", raw) == raw
+
+ def test_zero_idle_minutes_dropped(self):
+ assert _validate("okta", {"okta_max_session_idle_minutes": 0}) == {}
+
+ def test_negative_inactivity_days_dropped(self):
+ assert _validate("okta", {"okta_user_inactivity_max_days": -1}) == {}
+
+ def test_full_rate_limit_config_round_trip(self):
+ raw = {
+ "okta_requests_per_second": 4.0,
+ "okta_max_retries": 5,
+ "okta_request_timeout": 300,
+ }
+ assert _validate("okta", raw) == raw
+
+ def test_requests_per_second_zero_allowed(self):
+ # 0 is documented as "disable throttling" in config.yaml.
+ assert _validate("okta", {"okta_requests_per_second": 0}) == {
+ "okta_requests_per_second": 0
+ }
+
+ def test_requests_per_second_sub_one_allowed(self):
+ assert _validate("okta", {"okta_requests_per_second": 0.5}) == {
+ "okta_requests_per_second": 0.5
+ }
+
+ def test_requests_per_second_floor_allowed(self):
+ # 0.1 is the lowest non-zero rate accepted.
+ assert _validate("okta", {"okta_requests_per_second": 0.1}) == {
+ "okta_requests_per_second": 0.1
+ }
+
+ def test_requests_per_second_below_floor_dropped(self):
+ # A tiny rate (e.g. 0.001 -> ~1000s/request) would make scans take
+ # days or years; it must be rejected, not silently honoured.
+ assert _validate("okta", {"okta_requests_per_second": 0.001}) == {}
+ assert _validate("okta", {"okta_requests_per_second": 0.05}) == {}
+
+ def test_requests_per_second_above_max_dropped(self):
+ assert _validate("okta", {"okta_requests_per_second": 101}) == {}
+
+ def test_requests_per_second_negative_dropped(self):
+ assert _validate("okta", {"okta_requests_per_second": -1}) == {}
+
+ def test_max_retries_zero_allowed(self):
+ assert _validate("okta", {"okta_max_retries": 0}) == {"okta_max_retries": 0}
+
+ def test_max_retries_out_of_range_dropped(self):
+ assert _validate("okta", {"okta_max_retries": -1}) == {}
+ assert _validate("okta", {"okta_max_retries": 11}) == {}
+
+ def test_request_timeout_zero_allowed(self):
+ # 0 is documented as "disable the timeout" in config.yaml.
+ assert _validate("okta", {"okta_request_timeout": 0}) == {
+ "okta_request_timeout": 0
+ }
+
+ def test_request_timeout_in_range_allowed(self):
+ assert _validate("okta", {"okta_request_timeout": 300}) == {
+ "okta_request_timeout": 300
+ }
+
+ def test_request_timeout_out_of_range_dropped(self):
+ assert _validate("okta", {"okta_request_timeout": -1}) == {}
+ assert _validate("okta", {"okta_request_timeout": 3601}) == {}
+
+ def test_non_numeric_value_dropped(self):
+ # A typo'd string must not flow through to the limiter (it would crash
+ # the `> 0` comparison during provider init).
+ assert _validate("okta", {"okta_requests_per_second": "fast"}) == {}
+
+
class Test_Vercel_Schema:
def test_owner_percentage_in_range(self):
assert _validate("vercel", {"max_owner_percentage": 20}) == {
@@ -150,3 +232,45 @@ class Test_Vercel_Schema:
"secret_suffixes": ["_KEY", "_SECRET", "_TOKEN"],
}
assert _validate("vercel", raw) == raw
+
+
+class Test_AlibabaCloud_Schema:
+ def test_valid_values_round_trip(self):
+ raw = {
+ "max_cluster_check_days": 7,
+ "max_console_access_days": 90,
+ "min_log_retention_days": 365,
+ "min_rds_audit_retention_days": 180,
+ }
+ assert _validate("alibabacloud", raw) == raw
+
+ def test_zero_cluster_check_days_dropped(self):
+ assert _validate("alibabacloud", {"max_cluster_check_days": 0}) == {}
+
+ def test_console_access_below_min_dropped(self):
+ # 30 is the documented floor; anything below produces false positives.
+ assert _validate("alibabacloud", {"max_console_access_days": 29}) == {}
+
+
+class Test_OpenStack_Schema:
+ def test_valid_values_round_trip(self):
+ raw = {
+ "image_sharing_threshold": 5,
+ "secrets_ignore_patterns": ["AKIA[0-9A-Z]{16}"],
+ }
+ assert _validate("openstack", raw) == raw
+
+ def test_zero_threshold_dropped(self):
+ assert _validate("openstack", {"image_sharing_threshold": 0}) == {}
+
+
+class Test_E2ENetworks_Schema:
+ def test_valid_values_round_trip(self):
+ raw = {"require_bitninja_on_load_balancers": True}
+ assert _validate("e2enetworks", raw) == raw
+
+ def test_non_bool_value_dropped(self):
+ assert (
+ _validate("e2enetworks", {"require_bitninja_on_load_balancers": "maybe"})
+ == {}
+ )
diff --git a/tests/config/schema/scan_config_schema_test.py b/tests/config/schema/scan_config_schema_test.py
new file mode 100644
index 0000000000..037fcd9501
--- /dev/null
+++ b/tests/config/schema/scan_config_schema_test.py
@@ -0,0 +1,393 @@
+"""Coverage for the strict scan-config validation and normalization
+contract exposed to the Prowler App backend.
+
+Split from :mod:`tests.config.schema.validator_test` because the strict
+API (``validate_and_normalize_scan_config``) has different guarantees:
+it never silently drops keys, and it returns a JSON-serializable payload
+the backend can persist verbatim in a Django ``JSONField``.
+"""
+
+import json
+from unittest.mock import call, patch
+
+import pytest
+
+from prowler.config.scan_config_schema import (
+ _get_provider_check_ids,
+ _get_provider_services,
+ validate_and_normalize_scan_config,
+ validate_scan_config,
+)
+
+
+@pytest.fixture(autouse=True)
+def clear_provider_catalog_caches():
+ """Keep provider catalog cache state isolated between tests."""
+ _get_provider_check_ids.cache_clear()
+ _get_provider_services.cache_clear()
+ yield
+ _get_provider_check_ids.cache_clear()
+ _get_provider_services.cache_clear()
+
+
+class Test_Non_Dict_Root:
+ @pytest.mark.parametrize("payload", [None, "string", 42, [], (1, 2)])
+ def test_non_mapping_root_is_rejected(self, payload):
+ normalized, errors = validate_and_normalize_scan_config(payload)
+ assert normalized == {}
+ assert len(errors) == 1
+ assert errors[0]["path"] == "<root>"
+
+
+class Test_Registered_Provider_Section_Must_Be_Mapping:
+ @pytest.mark.parametrize("section", ["a-string", 42, ["s3"], None])
+ def test_non_mapping_section_reports_provider_path(self, section):
+ normalized, errors = validate_and_normalize_scan_config({"aws": section})
+ assert normalized == {}
+ assert errors == [{"path": "aws", "message": "section must be a mapping."}]
+
+
+class Test_Success_Path:
+ def test_whitespace_is_normalized_in_exclusions(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {
+ "aws": {
+ "excluded_checks": [" s3_bucket_default_encryption "],
+ "excluded_services": [" s3 "],
+ }
+ }
+ )
+ assert errors == []
+ assert normalized == {
+ "aws": {
+ "excluded_checks": ["s3_bucket_default_encryption"],
+ "excluded_services": ["s3"],
+ }
+ }
+
+ def test_plugin_options_are_preserved(self):
+ # Third-party plugins inject arbitrary keys inside a provider
+ # section; ``extra="allow"`` on the schema keeps them alive
+ # through the dump/normalize round-trip.
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"plugin_option": "preserved", "another": 42}}
+ )
+ assert errors == []
+ assert normalized == {"aws": {"plugin_option": "preserved", "another": 42}}
+
+ def test_plugin_catalog_identifiers_are_accepted_and_catalogs_are_cached(self):
+ payload = {
+ "aws": {
+ "excluded_checks": ["plugin_check"],
+ "excluded_services": ["plugin_service"],
+ }
+ }
+ with (
+ patch(
+ "prowler.config.scan_config_schema.CheckMetadata.get_bulk",
+ return_value={"plugin_check": object()},
+ ) as check_catalog,
+ patch(
+ "prowler.config.scan_config_schema.list_services",
+ return_value=["plugin_service"],
+ ) as service_catalog,
+ ):
+ first_result = validate_and_normalize_scan_config(payload)
+ second_result = validate_and_normalize_scan_config(payload)
+
+ normalized, errors = first_result
+ assert errors == []
+ assert normalized == {
+ "aws": {
+ "excluded_checks": ["plugin_check"],
+ "excluded_services": ["plugin_service"],
+ }
+ }
+ assert second_result == first_result
+ check_catalog.assert_called_once_with("aws")
+ service_catalog.assert_called_once_with("aws")
+
+ def test_catalog_caches_are_keyed_by_provider(self):
+ with (
+ patch(
+ "prowler.config.scan_config_schema.CheckMetadata.get_bulk",
+ side_effect=lambda provider: {f"{provider}_plugin_check": object()},
+ ) as check_catalog,
+ patch(
+ "prowler.config.scan_config_schema.list_services",
+ side_effect=lambda provider: [f"{provider}_plugin_service"],
+ ) as service_catalog,
+ ):
+ payload = {
+ "aws": {
+ "excluded_checks": ["aws_plugin_check"],
+ "excluded_services": ["aws_plugin_service"],
+ },
+ "azure": {
+ "excluded_checks": ["azure_plugin_check"],
+ "excluded_services": ["azure_plugin_service"],
+ },
+ }
+ first_result = validate_and_normalize_scan_config(payload)
+ second_result = validate_and_normalize_scan_config(payload)
+
+ assert first_result[1] == []
+ assert second_result == first_result
+ assert check_catalog.call_args_list == [call("aws"), call("azure")]
+ assert service_catalog.call_args_list == [call("aws"), call("azure")]
+
+ def test_omitted_defaults_are_not_injected(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"max_ec2_instance_age_in_days": 90}}
+ )
+ assert errors == []
+ assert normalized == {"aws": {"max_ec2_instance_age_in_days": 90}}
+ assert "excluded_checks" not in normalized["aws"]
+ assert "excluded_services" not in normalized["aws"]
+
+ def test_unknown_provider_sections_are_preserved_verbatim(self):
+ payload = {"future_provider": {"custom_option": True, "nested": {"k": 1}}}
+ normalized, errors = validate_and_normalize_scan_config(payload)
+ assert errors == []
+ assert normalized == payload
+
+ def test_normalized_payload_is_json_serializable(self):
+ normalized, _ = validate_and_normalize_scan_config(
+ {
+ "aws": {
+ "excluded_checks": ["s3_bucket_public_access"],
+ "excluded_services": ["s3"],
+ }
+ }
+ )
+ # If ``model_dump(mode="json", ...)`` is ever dropped this
+ # ``json.dumps`` call is what will notice.
+ json.dumps(normalized)
+
+ def test_input_payload_is_not_mutated(self):
+ payload = {
+ "aws": {
+ "excluded_checks": [" s3_bucket_public_access "],
+ "excluded_services": [" s3 "],
+ }
+ }
+ snapshot = json.loads(json.dumps(payload))
+ validate_and_normalize_scan_config(payload)
+ assert payload == snapshot
+
+
+class Test_Error_Path:
+ def test_unknown_excluded_check_is_rejected(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"excluded_checks": ["aws_check_that_does_not_exist"]}}
+ )
+ assert normalized == {}
+ assert errors == [
+ {
+ "path": "aws.excluded_checks[0]",
+ "message": (
+ "Unknown check 'aws_check_that_does_not_exist' for provider "
+ "'aws'."
+ ),
+ }
+ ]
+
+ def test_unknown_excluded_service_is_rejected(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"excluded_services": ["not_a_real_aws_service"]}}
+ )
+ assert normalized == {}
+ assert errors == [
+ {
+ "path": "aws.excluded_services[0]",
+ "message": (
+ "Unknown service 'not_a_real_aws_service' for provider 'aws'."
+ ),
+ }
+ ]
+
+ def test_multiple_unknown_exclusions_return_deterministic_errors(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {
+ "aws": {
+ "excluded_checks": [
+ "unknown_check_one",
+ "s3_bucket_default_encryption",
+ "unknown_check_two",
+ ],
+ "excluded_services": [
+ "unknown_service_one",
+ "s3",
+ "unknown_service_two",
+ ],
+ }
+ }
+ )
+ assert normalized == {}
+ assert errors == [
+ {
+ "path": "aws.excluded_checks[0]",
+ "message": "Unknown check 'unknown_check_one' for provider 'aws'.",
+ },
+ {
+ "path": "aws.excluded_checks[2]",
+ "message": "Unknown check 'unknown_check_two' for provider 'aws'.",
+ },
+ {
+ "path": "aws.excluded_services[0]",
+ "message": (
+ "Unknown service 'unknown_service_one' for provider 'aws'."
+ ),
+ },
+ {
+ "path": "aws.excluded_services[2]",
+ "message": (
+ "Unknown service 'unknown_service_two' for provider 'aws'."
+ ),
+ },
+ ]
+
+ def test_check_from_another_provider_is_rejected(self):
+ azure_check = "postgresql_flexible_server_allow_access_services_disabled"
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"excluded_checks": [azure_check]}}
+ )
+ assert normalized == {}
+ assert errors == [
+ {
+ "path": "aws.excluded_checks[0]",
+ "message": f"Unknown check '{azure_check}' for provider 'aws'.",
+ }
+ ]
+
+ def test_invalid_input_returns_empty_normalized_and_errors(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {"excluded_services": ["s3", " s3 "]}}
+ )
+ assert normalized == {}
+ assert errors
+ assert any(err["path"].startswith("aws.excluded_services") for err in errors)
+
+ def test_partial_error_zeros_the_normalized_payload(self):
+ # One valid provider + one invalid provider must not leak the
+ # valid section into a partially normalized result.
+ normalized, errors = validate_and_normalize_scan_config(
+ {
+ "aws": {"excluded_services": ["s3", "s3"]},
+ "azure": {"vm_backup_min_daily_retention_days": 7},
+ }
+ )
+ assert normalized == {}
+ assert errors
+ assert any(err["path"].startswith("aws.") for err in errors)
+
+ def test_value_error_prefix_is_stripped_from_user_facing_messages(self):
+ # Pydantic prefixes messages emitted from ``field_validator``
+ # ValueError with ``"Value error, "``. If this test starts to fail
+ # because the prefix reappears, either pydantic changed the format
+ # or the strip in ``validate_and_normalize_scan_config`` was
+ # dropped — either way the UI would render the noisy prefix, so
+ # we lock the cleaned message in explicitly.
+ _, errors = validate_and_normalize_scan_config(
+ {"aws": {"excluded_services": ["s3", "s3"]}}
+ )
+ assert errors
+ message = errors[0]["message"]
+ assert not message.startswith("Value error, ")
+ assert "duplicate values are not allowed" in message
+
+ def test_all_errors_are_reported_not_only_the_first(self):
+ normalized, errors = validate_and_normalize_scan_config(
+ {
+ "aws": {
+ "excluded_checks": ["", ""],
+ "excluded_services": ["", ""],
+ }
+ }
+ )
+ assert normalized == {}
+ # ``excluded_checks`` yields per-item empty-string errors AND a
+ # duplicate error; ``excluded_services`` yields the same set.
+ paths = {err["path"] for err in errors}
+ assert any(p.startswith("aws.excluded_checks") for p in paths)
+ assert any(p.startswith("aws.excluded_services") for p in paths)
+
+
+class Test_Non_String_Provider_Keys:
+ """The normalized payload is later persisted in a Django JSONField
+ keyed by provider. Two entries whose ``str()`` collide (e.g. ``123``
+ and ``"123"``) would silently overwrite each other, so non-string
+ keys are rejected up front instead of silently coerced."""
+
+ def test_non_string_key_is_rejected(self):
+ normalized, errors = validate_and_normalize_scan_config({123: {}})
+ assert normalized == {}
+ assert errors == [{"path": "123", "message": "provider keys must be strings."}]
+
+ def test_string_and_int_collision_does_not_silently_overwrite(self):
+ # If only ``str()`` coercion happened both keys would collapse to
+ # ``"aws"`` in the output — this test guards against that regression.
+ normalized, errors = validate_and_normalize_scan_config(
+ {"aws": {}, 123: {"a": 1}}
+ )
+ assert normalized == {}
+ assert any(err["path"] == "123" for err in errors)
+
+
+class Test_Unknown_Sections_Must_Be_JSON_Serializable:
+ """``normalized`` is persisted by the API in a Django JSONField, so
+ unknown provider sections must fail fast here instead of blowing up
+ at persist time. Registered sections cannot hit this path — they go
+ through ``model_dump(mode="json", ...)`` which already coerces."""
+
+ def test_set_inside_unknown_section_is_rejected(self):
+ # ``set`` is a common trap: ``yaml.safe_load`` never produces it,
+ # but a hand-built dict might.
+ normalized, errors = validate_and_normalize_scan_config(
+ {"future_provider": {"values": {1, 2, 3}}}
+ )
+ assert normalized == {}
+ assert errors
+ assert errors[0]["path"] == "future_provider"
+ assert "JSON-serializable" in errors[0]["message"]
+
+ def test_json_safe_unknown_section_is_still_preserved(self):
+ payload = {"future_provider": {"nested": {"k": [1, 2, 3]}}}
+ normalized, errors = validate_and_normalize_scan_config(payload)
+ assert errors == []
+ assert normalized == payload
+
+
+class Test_Backward_Compatible_Wrapper:
+ def test_valid_payload_yields_no_errors(self):
+ assert (
+ validate_scan_config(
+ {"aws": {"excluded_checks": ["s3_bucket_public_access"]}}
+ )
+ == []
+ )
+
+ def test_invalid_payload_yields_only_the_errors(self):
+ errors = validate_scan_config({"aws": {"excluded_checks": ["", ""]}})
+ assert errors
+ assert all(set(err) == {"path", "message"} for err in errors)
+
+ def test_unknown_exclusion_yields_the_semantic_error(self):
+ assert validate_scan_config(
+ {"aws": {"excluded_services": ["not_a_real_aws_service"]}}
+ ) == [
+ {
+ "path": "aws.excluded_services[0]",
+ "message": (
+ "Unknown service 'not_a_real_aws_service' for provider 'aws'."
+ ),
+ }
+ ]
+
+ def test_non_mapping_root_matches_new_contract(self):
+ assert validate_scan_config(None) == [
+ {
+ "path": "<root>",
+ "message": "Scan config must be a mapping with provider sections.",
+ }
+ ]
diff --git a/tests/github/changelog_attribution_test.py b/tests/github/changelog_attribution_test.py
new file mode 100644
index 0000000000..9cd8d016f0
--- /dev/null
+++ b/tests/github/changelog_attribution_test.py
@@ -0,0 +1,178 @@
+import importlib.util
+import shutil
+import sys
+from pathlib import Path
+
+MODULE_PATH = (
+ Path(__file__).resolve().parents[2]
+ / ".github"
+ / "scripts"
+ / "changelog_attribution.py"
+)
+SPEC = importlib.util.spec_from_file_location("changelog_attribution", MODULE_PATH)
+changelog_attribution = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+SPEC.loader.exec_module(changelog_attribution)
+
+
+def make_component(tmp_path):
+ component = tmp_path / "prowler"
+ fragments_dir = component / "changelog.d"
+ fragments_dir.mkdir(parents=True)
+ return component, fragments_dir
+
+
+def fake_git_mv(*args):
+ if args[0] != "mv":
+ raise AssertionError(f"Unexpected git command: {args}")
+ shutil.move(args[1], args[2])
+ return ""
+
+
+def fail_git(*args):
+ raise AssertionError(f"Unexpected git command: {args}")
+
+
+def fail_api(*args):
+ raise AssertionError(f"Unexpected GitHub API call: {args}")
+
+
+def run_main(monkeypatch, component, *extra_args):
+ monkeypatch.setattr(
+ sys,
+ "argv",
+ ["changelog_attribution.py", str(component), *extra_args],
+ )
+ return changelog_attribution.main()
+
+
+class TestChangelogAttribution:
+ def test_renames_slug_fragment_to_resolved_pr_number(self, tmp_path, monkeypatch):
+ component, fragments_dir = make_component(tmp_path)
+ fragment = fragments_dir / "add-workflow.fixed.md"
+ fragment.write_text("Fix changelog workflow.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution, "find_adding_commit", lambda path: "abc123"
+ )
+ monkeypatch.setattr(
+ changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+ )
+ monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+ assert run_main(monkeypatch, component) == 0
+ assert not fragment.exists()
+ assert (fragments_dir / "11572.fixed.md").read_text() == (
+ "Fix changelog workflow.\n"
+ )
+
+ def test_appends_counter_when_pr_fragment_already_exists(
+ self, tmp_path, monkeypatch
+ ):
+ component, fragments_dir = make_component(tmp_path)
+ (fragments_dir / "11572.fixed.md").write_text("Existing fix.\n")
+ fragment = fragments_dir / "another-fix.fixed.md"
+ fragment.write_text("Another fix.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution, "find_adding_commit", lambda path: "abc123"
+ )
+ monkeypatch.setattr(
+ changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+ )
+ monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+ assert run_main(monkeypatch, component) == 0
+ assert (fragments_dir / "11572.fixed.md").read_text() == "Existing fix.\n"
+ assert (fragments_dir / "11572.fixed.1.md").read_text() == "Another fix.\n"
+
+ def test_uses_subject_fallback_when_api_is_disabled(self, tmp_path, monkeypatch):
+ component, fragments_dir = make_component(tmp_path)
+ fragment = fragments_dir / "fallback.added.md"
+ fragment.write_text("Add fallback behavior.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution, "find_adding_commit", lambda path: "abc123"
+ )
+ monkeypatch.setattr(
+ changelog_attribution,
+ "pr_from_api",
+ fail_api,
+ )
+ monkeypatch.setattr(changelog_attribution, "pr_from_subject", lambda sha: 42)
+ monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+ assert run_main(monkeypatch, component, "--no-api") == 0
+ assert not fragment.exists()
+ assert (fragments_dir / "42.added.md").read_text() == "Add fallback behavior.\n"
+
+ def test_renames_unresolved_fragment_to_orphan(self, tmp_path, monkeypatch, capsys):
+ component, fragments_dir = make_component(tmp_path)
+ fragment = fragments_dir / "manual.changed.md"
+ fragment.write_text("Change manual entry.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution, "find_adding_commit", lambda path: None
+ )
+ monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+ assert run_main(monkeypatch, component) == 0
+ assert not fragment.exists()
+ assert (fragments_dir / "+manual.changed.md").read_text() == (
+ "Change manual entry.\n"
+ )
+ assert "Could not resolve a PR" in capsys.readouterr().out
+
+ def test_rejects_malformed_fragment_names(self, tmp_path, monkeypatch, capsys):
+ component, fragments_dir = make_component(tmp_path)
+ fragment = fragments_dir / "bad.bugfix.md"
+ fragment.write_text("Invalid type.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution,
+ "git",
+ fail_git,
+ )
+
+ assert run_main(monkeypatch, component) == 1
+ assert fragment.exists()
+ assert "Malformed fragment filename" in capsys.readouterr().out
+
+ def test_rejects_malformed_names_before_renaming_any_fragment(
+ self, tmp_path, monkeypatch, capsys
+ ):
+ component, fragments_dir = make_component(tmp_path)
+ valid_fragment = fragments_dir / "valid.fixed.md"
+ malformed_fragment = fragments_dir / "bad.bugfix.md"
+ valid_fragment.write_text("Valid fix.\n")
+ malformed_fragment.write_text("Invalid type.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution, "find_adding_commit", lambda path: "abc123"
+ )
+ monkeypatch.setattr(
+ changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+ )
+ monkeypatch.setattr(changelog_attribution, "git", fail_git)
+
+ assert run_main(monkeypatch, component) == 1
+ assert valid_fragment.read_text() == "Valid fix.\n"
+ assert malformed_fragment.read_text() == "Invalid type.\n"
+ assert not (fragments_dir / "11572.fixed.md").exists()
+ assert "Malformed fragment filename" in capsys.readouterr().out
+
+ def test_skips_fragments_that_already_start_with_pr_number(
+ self, tmp_path, monkeypatch
+ ):
+ component, fragments_dir = make_component(tmp_path)
+ fragment = fragments_dir / "11572.added.md"
+ fragment.write_text("Already attributed.\n")
+
+ monkeypatch.setattr(
+ changelog_attribution,
+ "git",
+ fail_git,
+ )
+
+ assert run_main(monkeypatch, component) == 0
+ assert fragment.read_text() == "Already attributed.\n"
diff --git a/tests/github/changelog_fragments_test.py b/tests/github/changelog_fragments_test.py
new file mode 100644
index 0000000000..05a751125e
--- /dev/null
+++ b/tests/github/changelog_fragments_test.py
@@ -0,0 +1,379 @@
+import re
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+EXPECTED_CHANGELOG_TYPE_ORDER = [
+ "added",
+ "changed",
+ "deprecated",
+ "removed",
+ "fixed",
+ "security",
+]
+EXPECTED_CHANGELOG_SECTION_NAMES = [
+ "🚀 Added",
+ "🔄 Changed",
+ "⚠️ Deprecated",
+ "❌ Removed",
+ "🐞 Fixed",
+ "🔐 Security",
+]
+COMPONENTS = ["prowler", "api", "ui", "mcp_server"]
+
+
+def read_workflow(name):
+ return (REPO_ROOT / ".github" / "workflows" / name).read_text()
+
+
+def render_towncrier(tmp_path, type_definitions, fragments):
+ pytest.importorskip("towncrier")
+
+ fragments_dir = tmp_path / "changelog.d"
+ fragments_dir.mkdir()
+ (tmp_path / "CHANGELOG.md").write_text(
+ "# Changelog\n\n<!-- changelog: release notes start -->\n"
+ )
+ for filename, content in fragments.items():
+ (fragments_dir / filename).write_text(f"{content}\n")
+
+ type_config = "\n".join(
+ "\n".join(
+ [
+ "[[tool.towncrier.type]]",
+ f'directory = "{directory}"',
+ f'name = "{name}"',
+ "showcontent = true",
+ ]
+ )
+ for directory, name in type_definitions
+ )
+ config = "\n".join(
+ [
+ "[tool.towncrier]",
+ 'directory = "changelog.d"',
+ 'filename = "CHANGELOG.md"',
+ 'start_string = "<!-- changelog: release notes start -->\\n"',
+ f'template = "{(REPO_ROOT / ".github/towncrier/template.md.jinja").as_posix()}"',
+ 'title_format = "## [{version}] ({name})"',
+ 'issue_format = "[(#{issue})](https://example.com/pull/{issue})"',
+ 'underlines = ["", "", ""]',
+ type_config,
+ ]
+ )
+ config_path = tmp_path / "towncrier.toml"
+ config_path.write_text(config)
+
+ result = subprocess.run(
+ [
+ sys.executable,
+ "-m",
+ "towncrier",
+ "build",
+ "--config",
+ str(config_path),
+ "--version",
+ "0.1.0",
+ "--name",
+ "Test",
+ "--draft",
+ ],
+ cwd=tmp_path,
+ check=True,
+ capture_output=True,
+ text=True,
+ )
+ return result.stdout.split("## [0.1.0] (Test)", 1)[1]
+
+
+def test_towncrier_template_uses_configured_changelog_section_order(tmp_path):
+ template = (REPO_ROOT / ".github/towncrier/template.md.jinja").read_text()
+
+ assert "{% set category_order = definitions.keys() %}" in template
+ assert (
+ "{% for category in category_order if category in sections[section] %}"
+ in template
+ )
+ assert "definitions.items()" not in template
+ assert (
+ '["added", "changed", "deprecated", "removed", "fixed", "security"]'
+ not in template
+ )
+
+ output = render_towncrier(
+ tmp_path,
+ [("fixed", "Fixed"), ("added", "Added"), ("custom", "Custom")],
+ {
+ "1.added.md": "Entry one",
+ "2.added.md": "Entry two",
+ "3.fixed.md": "Fix entry",
+ "4.custom.md": "Custom entry",
+ },
+ )
+
+ headings = re.findall(r"^### (.+)$", output, re.MULTILINE)
+ assert headings == ["Fixed", "Added", "Custom"]
+ assert (
+ "- Entry one [(#1)](https://example.com/pull/1)\n"
+ "- Entry two [(#2)](https://example.com/pull/2)"
+ ) in output
+ assert (
+ "- Entry one [(#1)](https://example.com/pull/1)\n\n"
+ "- Entry two [(#2)](https://example.com/pull/2)"
+ ) not in output
+
+
+def test_component_towncrier_configs_keep_changelog_section_order():
+ for component in COMPONENTS:
+ config = tomllib.loads((REPO_ROOT / component / "towncrier.toml").read_text())
+ type_definitions = config["tool"]["towncrier"]["type"]
+
+ assert [item["directory"] for item in type_definitions] == (
+ EXPECTED_CHANGELOG_TYPE_ORDER
+ )
+ assert [item["name"] for item in type_definitions] == (
+ EXPECTED_CHANGELOG_SECTION_NAMES
+ )
+
+
+def test_pull_request_template_links_to_all_fragment_locations():
+ template = (REPO_ROOT / ".github/pull_request_template.md").read_text()
+
+ assert "[Prowler Community Slack](https://goto.prowler.com/slack)" in template
+ assert "[Prowler Community Slack](goto.prowler.com/slack)" not in template
+ for component in COMPONENTS:
+ assert f"{component}/changelog.d/" in template
+
+
+def test_changelog_gate_rejects_direct_changelog_edits():
+ workflow = read_workflow("pr-check-changelog.yml")
+ has_update = re.search(
+ r"(?ms)^\s*has_changelog_update\(\) \{\n(?P<body>.*?)^\s*\}\n",
+ workflow,
+ )
+
+ assert has_update is not None
+ assert "CHANGELOG.md" not in has_update.group("body")
+ assert "handwritten_changelogs" in workflow
+ assert "Direct CHANGELOG.md edits are not allowed" in workflow
+ assert "direct CHANGELOG.md edit" not in workflow
+
+
+def test_changelog_gate_tests_compile_workflow_changes():
+ workflow = read_workflow("pr-check-changelog.yml")
+
+ assert ".github/workflows/compile-changelogs.yml" in workflow
+
+
+def test_changelog_attribution_tests_use_pinned_python():
+ workflow = read_workflow("pr-check-changelog.yml")
+ match = re.search(
+ r"(?ms)^ test-changelog-attribution:\n(?P<body>.*?)^ check-changelog:",
+ workflow,
+ )
+
+ assert match is not None
+ job = match.group("body")
+ assert "uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c" in job
+ assert "python-version: '3.12'" in job
+ assert "python3 -m pip install" in job
+ assert "python3 -m pytest tests/github" in job
+ assert "objects.githubusercontent.com:443" in job
+
+
+def test_changelog_gate_rejects_common_manual_pr_link_forms():
+ workflow = read_workflow("pr-check-changelog.yml")
+
+ assert "manual_pr_link_re=" in workflow
+ assert r"\[\(#[0-9]+\)\]" in workflow
+ assert r"\[#[0-9]+\]\(" in workflow
+ assert r"\(#[0-9]+\)" in workflow
+ assert r"github\.com/[^[:space:]/]+/[^[:space:]/]+/(pull|issues)/[0-9]+" in workflow
+
+
+def test_changelog_gate_derives_fragment_paths_from_monitored_folders():
+ workflow = read_workflow("pr-check-changelog.yml")
+
+ assert "folder_alt=$(echo \"$MONITORED_FOLDERS\" | tr ' ' '|')" in workflow
+ assert "^(api|ui|prowler|mcp_server)/changelog\\.d/" not in workflow
+
+
+def test_changelog_gate_lints_renamed_fragments():
+ workflow = read_workflow("pr-check-changelog.yml")
+
+ assert "STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES" in workflow
+ assert "${{ steps.changed-files.outputs.renamed_files }}" in workflow
+ assert "added_or_renamed=" in workflow
+ assert "added_modified_or_renamed=" in workflow
+ assert (
+ 'echo "$added_or_renamed" | grep -E "^(${folder_alt})/changelog\\.d/"'
+ in workflow
+ )
+ assert (
+ 'echo "$added_modified_or_renamed" | grep -E "^(${folder_alt})/changelog\\.d/"'
+ in workflow
+ )
+
+
+def test_changelog_gate_uses_random_github_output_delimiters():
+ workflow = read_workflow("pr-check-changelog.yml")
+
+ assert "write_multiline_output()" in workflow
+ assert "openssl rand -hex 16" in workflow
+ assert '>> "$GITHUB_OUTPUT"' in workflow
+ assert "<<EOF" not in workflow
+
+
+def test_compile_workflow_blocks_egress_for_privileged_job():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert "Harden the runner (Block outbound calls)" in workflow
+ assert "egress-policy: block" in workflow
+ for endpoint in [
+ "api.github.com:443",
+ "github.com:443",
+ "objects.githubusercontent.com:443",
+ "pypi.org:443",
+ "files.pythonhosted.org:443",
+ ]:
+ assert endpoint in workflow
+
+
+def test_forward_sync_inserts_release_blocks_by_prowler_version_order():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert "insert_changelog_block_ordered()" in workflow
+ assert 'incoming_release=$(release_from_heading "$incoming_heading")' in workflow
+ assert 'incoming_key=$(version_key "$incoming_release")' in workflow
+ assert '[[ "$incoming_key" > "$existing_key" ]]' in workflow
+ assert "already contains a block for Prowler v${incoming_release}" in workflow
+ assert 'head -n "$marker_line" "$component/CHANGELOG.md"' not in workflow
+
+
+def test_compile_workflow_rejects_explicit_versions_that_do_not_bump():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert 'current=$(latest_released_version "$component")' in workflow
+ assert 'current_key=$(version_key "$current")' in workflow
+ assert 'effective_key=$(version_key "$effective")' in workflow
+ assert (
+ '[[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]'
+ in workflow
+ )
+ assert (
+ "explicit version '${effective}' must be greater than the latest released version"
+ in workflow
+ )
+
+
+def test_compile_workflow_requires_target_branch_to_match_prowler_version():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert (
+ 'IFS=. read -r prowler_major prowler_minor prowler_patch <<< "$PROWLER_VERSION"'
+ in workflow
+ )
+ assert "prowler_patch=$((10#$prowler_patch))" in workflow
+ assert 'if [ "$prowler_patch" -eq 0 ]; then' in workflow
+ assert "target_branch must be 'master' for Prowler ${PROWLER_VERSION}" in workflow
+ assert 'expected_target_branch="v${prowler_major}.${prowler_minor}"' in workflow
+ assert 'if [ "$TARGET_BRANCH" != "$expected_target_branch" ]; then' in workflow
+ assert (
+ "target_branch must be '${expected_target_branch}' for Prowler ${PROWLER_VERSION}"
+ in workflow
+ )
+
+
+def test_compile_workflow_normalizes_version_segments_before_arithmetic():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert (
+ 'printf \'%06d.%06d.%06d\' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"'
+ in workflow
+ )
+ assert "major=$((10#$major))" in workflow
+ assert "minor=$((10#$minor))" in workflow
+ assert "patch=$((10#$patch))" in workflow
+ assert "current_major=$((10#$current_major))" in workflow
+ assert "effective_major=$((10#$effective_major))" in workflow
+ assert "effective_minor=$((10#$effective_minor))" in workflow
+ assert "effective_patch=$((10#$effective_patch))" in workflow
+
+
+def test_compile_workflow_requires_removed_fragments_in_major_releases():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert "has_removed_fragments" in workflow
+ assert "removed fragments require a major component release" in workflow
+ assert "effective_major" in workflow
+ assert "effective_minor" in workflow
+ assert "effective_patch" in workflow
+
+
+def test_compile_workflow_prs_skip_cloud_sync():
+ workflow = read_workflow("compile-changelogs.yml")
+ labels_blocks = re.findall(r"labels: \|\n((?:\s+[a-z-]+\n)+)", workflow)
+
+ assert len(labels_blocks) == 2
+ for block in labels_blocks:
+ assert "no-changelog" in block.split()
+ assert "skip-sync" in block.split()
+
+
+def test_compile_workflow_auto_derives_versions_by_mirroring_prowler_version():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert 'prowler) effective="$PROWLER_VERSION" ;;' in workflow
+ assert 'ui) effective="1.${prowler_minor}.${prowler_patch}" ;;' in workflow
+ assert 'api) effective="1.$((prowler_minor + 1)).${prowler_patch}" ;;' in workflow
+ assert (
+ "auto-derived version '${effective}' is not greater than the latest released version"
+ in workflow
+ )
+
+
+def test_compile_workflow_auto_derives_mcp_patch_bumps_on_patch_releases():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert "'added'/'deprecated' fragments are shipping in a Prowler patch" in workflow
+ assert (
+ "elif echo \"$fragments\" | grep -qE '\\.(added|changed|deprecated)(\\.[0-9]+)?\\.md$'; then"
+ in workflow
+ )
+
+
+def test_forward_sync_pads_release_blocks_with_blank_lines():
+ workflow = read_workflow("compile-changelogs.yml")
+
+ assert "block-normalized.md" in workflow
+ assert 'total_lines=$(wc -l < "$changelog")' in workflow
+ assert '[ -n "$(sed -n "$((insertion_line - 1))p" "$changelog")" ]' in workflow
+ assert 'if [ "$insertion_line" -le "$total_lines" ]; then' in workflow
+
+
+def test_component_changelogs_separate_release_blocks_with_blank_lines():
+ for component in COMPONENTS:
+ lines = (REPO_ROOT / component / "CHANGELOG.md").read_text().splitlines()
+ marker_line = lines.index("<!-- changelog: release notes start -->")
+
+ assert (
+ lines[marker_line + 1] == ""
+ ), f"{component}/CHANGELOG.md: expected a blank line after the marker"
+ assert (
+ lines[marker_line + 2] != ""
+ ), f"{component}/CHANGELOG.md: expected a single blank line after the marker"
+ for index, line in enumerate(lines):
+ if line == "---" and index + 1 < len(lines):
+ assert lines[index + 1] == "", (
+ f"{component}/CHANGELOG.md line {index + 2}: "
+ "expected a blank line after '---'"
+ )
+ if line.startswith("## ["):
+ assert lines[index - 1] == "", (
+ f"{component}/CHANGELOG.md line {index}: "
+ "expected a blank line before a release heading"
+ )
diff --git a/tests/lib/check/compliance_config_constraint_model_test.py b/tests/lib/check/compliance_config_constraint_model_test.py
new file mode 100644
index 0000000000..48f67fd504
--- /dev/null
+++ b/tests/lib/check/compliance_config_constraint_model_test.py
@@ -0,0 +1,169 @@
+"""Validation coverage for the ConfigRequirements schema.
+
+``Compliance_Requirement_ConfigConstraint`` is the model behind every
+``ConfigRequirements`` entry in the compliance framework JSONs. These tests pin
+the operator vocabulary, the value-typing rules (notably that booleans are not
+coerced to integers), and that constraints survive the legacy → universal
+adaptation used by the App backend and the OCSF/table outputs.
+"""
+
+import json
+import pathlib
+
+import pytest
+from pydantic.v1 import ValidationError
+
+from prowler.lib.check.compliance_models import (
+ Compliance,
+ Compliance_Requirement_ConfigConstraint,
+ adapt_legacy_to_universal,
+)
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+_CIS_6_0 = _REPO_ROOT / "prowler" / "compliance" / "aws" / "cis_6.0_aws.json"
+
+
+def _load_cis():
+ """Load the CIS 6.0 AWS framework JSON via a context manager."""
+ with open(_CIS_6_0, encoding="utf-8") as f:
+ return json.load(f)
+
+
+class Test_Compliance_Requirement_ConfigConstraint:
+ @pytest.mark.parametrize(
+ "operator,value",
+ [
+ ("lte", 45),
+ ("gte", 365),
+ ("eq", False),
+ ("in", [1, 2, 3]),
+ ("subset", ["1.2", "1.3"]),
+ ("superset", ["RSA-1024", "P-192"]),
+ ],
+ )
+ def test_valid_operators(self, operator, value):
+ c = Compliance_Requirement_ConfigConstraint(
+ Check="some_check", ConfigKey="some_key", Operator=operator, Value=value
+ )
+ assert c.Operator == operator
+ assert c.Value == value
+
+ def test_invalid_operator_rejected(self):
+ with pytest.raises(ValidationError):
+ Compliance_Requirement_ConfigConstraint(
+ Check="c", ConfigKey="k", Operator="between", Value=1
+ )
+
+ @pytest.mark.parametrize(
+ "operator,value",
+ [
+ # numeric operators reject non-numeric / boolean values
+ ("gte", [1, 2]),
+ ("lte", ["45"]),
+ ("gte", True),
+ # set/list operators reject scalars
+ ("subset", 5),
+ ("superset", "x"),
+ ("in", 1),
+ # eq rejects lists
+ ("eq", [1, 2]),
+ ],
+ )
+ def test_value_type_inconsistent_with_operator_rejected(self, operator, value):
+ # A mistyped Value would otherwise be silently treated as "not satisfied"
+ # at runtime, forcing a spurious config-not-valid FAIL.
+ with pytest.raises(ValidationError):
+ Compliance_Requirement_ConfigConstraint(
+ Check="c", ConfigKey="k", Operator=operator, Value=value
+ )
+
+ def test_boolean_value_not_coerced_to_int(self):
+ # ``mute_non_default_regions == false`` must stay a bool, not become 0.
+ c = Compliance_Requirement_ConfigConstraint(
+ Check="securityhub_enabled",
+ ConfigKey="mute_non_default_regions",
+ Operator="eq",
+ Value=False,
+ )
+ assert c.Value is False
+ assert isinstance(c.Value, bool)
+
+ def test_list_value_preserved_for_set_operators(self):
+ c = Compliance_Requirement_ConfigConstraint(
+ Check="c", ConfigKey="k", Operator="subset", Value=["1.2", "1.3"]
+ )
+ assert isinstance(c.Value, list)
+ assert c.Value == ["1.2", "1.3"]
+
+ def test_missing_required_fields_rejected(self):
+ with pytest.raises(ValidationError):
+ Compliance_Requirement_ConfigConstraint(Check="c", ConfigKey="k")
+
+ def test_provider_defaults_to_none(self):
+ # Single-provider frameworks omit Provider; it is optional.
+ c = Compliance_Requirement_ConfigConstraint(
+ Check="c", ConfigKey="k", Operator="eq", Value=False
+ )
+ assert c.Provider is None
+
+ def test_provider_scopes_constraint(self):
+ # Universal frameworks tag each constraint with the provider it applies to.
+ c = Compliance_Requirement_ConfigConstraint(
+ Check="securityhub_enabled",
+ Provider="aws",
+ ConfigKey="mute_non_default_regions",
+ Operator="eq",
+ Value=False,
+ )
+ assert c.Provider == "aws"
+
+
+class Test_ConfigRequirements_On_Compliance:
+ def test_requirements_without_constraints_default_to_none(self):
+ compliance = Compliance(**_load_cis())
+ # Requirement without configurable checks → ConfigRequirements is None.
+ no_constraint = [r for r in compliance.Requirements if not r.ConfigRequirements]
+ assert no_constraint
+ assert no_constraint[0].ConfigRequirements is None
+
+ def test_requirement_with_constraints_parses(self):
+ compliance = Compliance(**_load_cis())
+ with_constraint = [r for r in compliance.Requirements if r.ConfigRequirements]
+ assert with_constraint, "cis_6.0_aws should declare ConfigRequirements"
+ constraint = with_constraint[0].ConfigRequirements[0]
+ assert isinstance(constraint, Compliance_Requirement_ConfigConstraint)
+ assert constraint.Check
+ assert constraint.Operator in {"lte", "gte", "eq", "in", "subset", "superset"}
+
+
+class Test_Adapt_Legacy_To_Universal:
+ def test_config_requirements_carried_to_universal(self):
+ legacy = Compliance(**_load_cis())
+ universal = adapt_legacy_to_universal(legacy)
+
+ legacy_with = {r.Id for r in legacy.Requirements if r.ConfigRequirements}
+ universal_with = {r.id for r in universal.requirements if r.config_requirements}
+ assert legacy_with == universal_with
+ assert universal_with, "expected at least one requirement with constraints"
+
+ # The constraint payload survives as the typed constraint model with the
+ # same fields (``Provider`` is carried through too, ``None`` for
+ # single-provider frameworks like CIS AWS).
+ sample = next(r for r in universal.requirements if r.config_requirements)
+ entry = sample.config_requirements[0]
+ assert isinstance(entry, Compliance_Requirement_ConfigConstraint)
+ assert set(entry.dict()) == {
+ "Check",
+ "Provider",
+ "ConfigKey",
+ "Operator",
+ "Value",
+ }
+ assert entry.Provider is None
+
+ def test_requirements_without_constraints_are_none_in_universal(self):
+ legacy = Compliance(**_load_cis())
+ universal = adapt_legacy_to_universal(legacy)
+ without = [r for r in universal.requirements if not r.config_requirements]
+ assert without
+ assert without[0].config_requirements is None
diff --git a/tests/lib/check/compliance_config_eval_test.py b/tests/lib/check/compliance_config_eval_test.py
new file mode 100644
index 0000000000..74537344c4
--- /dev/null
+++ b/tests/lib/check/compliance_config_eval_test.py
@@ -0,0 +1,439 @@
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from prowler.lib.check.compliance_config_eval import (
+ CONFIG_NOT_VALID_PREFIX,
+ accumulate_group_status,
+ accumulate_overview_status,
+ apply_config_status,
+ build_requirement_config_status,
+ evaluate_config_constraints,
+ get_effective_status,
+ get_scan_audit_config,
+ get_scan_provider_type,
+ resolve_requirement_config_status,
+)
+
+CONSTRAINTS = [
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45,
+ }
+]
+
+
+class Test_evaluate_config_constraints:
+ def test_no_constraints_is_compliant(self):
+ assert evaluate_config_constraints(None, {}) == (True, "")
+ assert evaluate_config_constraints([], {"x": 1}) == (True, "")
+
+ def test_config_absent_assumes_default_ok(self):
+ # Key not explicitly set → default assumed adequate.
+ is_ok, reason = evaluate_config_constraints(CONSTRAINTS, {})
+ assert is_ok is True
+ assert reason == ""
+
+ def test_none_audit_config_is_compliant(self):
+ assert evaluate_config_constraints(CONSTRAINTS, None) == (True, "")
+
+ def test_lte_satisfied(self):
+ assert evaluate_config_constraints(
+ CONSTRAINTS, {"max_unused_access_keys_days": 45}
+ ) == (True, "")
+
+ def test_lte_violated(self):
+ is_ok, reason = evaluate_config_constraints(
+ CONSTRAINTS, {"max_unused_access_keys_days": 120}
+ )
+ assert is_ok is False
+ # Product-facing message: names the check, the applied value, what the
+ # requirement needs and how to fix it, in plain language.
+ assert reason.startswith(CONFIG_NOT_VALID_PREFIX)
+ assert "iam_user_accesskey_unused" in reason
+ assert "max_unused_access_keys_days" in reason
+ assert "set to 120" in reason
+ assert "45 or lower" in reason
+
+ def test_gte_operator(self):
+ c = [{"Check": "c", "ConfigKey": "k", "Operator": "gte", "Value": 10}]
+ assert evaluate_config_constraints(c, {"k": 10})[0] is True
+ assert evaluate_config_constraints(c, {"k": 9})[0] is False
+
+ def test_eq_operator(self):
+ c = [{"Check": "c", "ConfigKey": "k", "Operator": "eq", "Value": "HIGH"}]
+ assert evaluate_config_constraints(c, {"k": "HIGH"})[0] is True
+ assert evaluate_config_constraints(c, {"k": "LOW"})[0] is False
+
+ def test_in_operator(self):
+ c = [{"Check": "c", "ConfigKey": "k", "Operator": "in", "Value": [1, 2, 3]}]
+ assert evaluate_config_constraints(c, {"k": 2})[0] is True
+ assert evaluate_config_constraints(c, {"k": 9})[0] is False
+
+ def test_subset_operator_allowlist(self):
+ # Allowlist config: applied list must stay within the secure baseline.
+ c = [
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": ["1.2", "1.3"],
+ }
+ ]
+ assert (
+ evaluate_config_constraints(
+ c, {"recommended_minimal_tls_versions": ["1.2", "1.3"]}
+ )[0]
+ is True
+ )
+ # Stricter (subset) still passes.
+ assert (
+ evaluate_config_constraints(
+ c, {"recommended_minimal_tls_versions": ["1.3"]}
+ )[0]
+ is True
+ )
+ # Widening with a weaker value breaks it.
+ is_ok, reason = evaluate_config_constraints(
+ c, {"recommended_minimal_tls_versions": ["1.0", "1.2", "1.3"]}
+ )
+ assert is_ok is False
+ assert "recommended_minimal_tls_versions" in reason
+
+ def test_superset_operator_denylist(self):
+ # Denylist config: applied list must keep covering the forbidden baseline.
+ c = [
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": ["RSA-1024", "P-192"],
+ }
+ ]
+ assert (
+ evaluate_config_constraints(
+ c, {"insecure_key_algorithms": ["RSA-1024", "P-192"]}
+ )[0]
+ is True
+ )
+ # Extra forbidden values are fine.
+ assert (
+ evaluate_config_constraints(
+ c, {"insecure_key_algorithms": ["RSA-1024", "P-192", "P-224"]}
+ )[0]
+ is True
+ )
+ # Removing a forbidden value breaks it.
+ assert (
+ evaluate_config_constraints(c, {"insecure_key_algorithms": ["P-192"]})[0]
+ is False
+ )
+
+ def test_subset_superset_non_list_not_satisfied(self):
+ sub = [{"Check": "c", "ConfigKey": "k", "Operator": "subset", "Value": ["a"]}]
+ sup = [{"Check": "c", "ConfigKey": "k", "Operator": "superset", "Value": ["a"]}]
+ # A scalar applied value cannot satisfy a set constraint.
+ assert evaluate_config_constraints(sub, {"k": "a"})[0] is False
+ assert evaluate_config_constraints(sup, {"k": "a"})[0] is False
+
+ def test_mismatched_types_not_satisfied(self):
+ assert (
+ evaluate_config_constraints(
+ CONSTRAINTS, {"max_unused_access_keys_days": "x"}
+ )[0]
+ is False
+ )
+
+ def test_multiple_constraints_first_violation_reported(self):
+ constraints = [
+ {"Check": "a", "ConfigKey": "k1", "Operator": "lte", "Value": 45},
+ {"Check": "b", "ConfigKey": "k2", "Operator": "lte", "Value": 45},
+ ]
+ is_ok, reason = evaluate_config_constraints(constraints, {"k1": 45, "k2": 90})
+ assert is_ok is False
+ # The first violation (check "b", key "k2", applied 90) is the one reported.
+ assert "k2" in reason
+ assert "set to 90" in reason
+
+
+class Test_provider_scoping:
+ # An AWS-scoped constraint on a config key whose value is too loose.
+ AWS_CONSTRAINT = [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+ ]
+
+ def test_applies_when_provider_matches(self):
+ is_ok, _ = evaluate_config_constraints(
+ self.AWS_CONSTRAINT, {"mute_non_default_regions": True}, "aws"
+ )
+ assert is_ok is False
+
+ def test_skipped_when_provider_differs(self):
+ # Same loose value, but scanning GCP → the AWS constraint must not fire.
+ is_ok, reason = evaluate_config_constraints(
+ self.AWS_CONSTRAINT, {"mute_non_default_regions": True}, "gcp"
+ )
+ assert is_ok is True
+ assert reason == ""
+
+ def test_none_provider_type_disables_scoping(self):
+ # Without a known provider every constraint is evaluated (legacy default).
+ is_ok, _ = evaluate_config_constraints(
+ self.AWS_CONSTRAINT, {"mute_non_default_regions": True}, None
+ )
+ assert is_ok is False
+
+ def test_provider_match_is_case_insensitive(self):
+ # A constraint authored as "AWS" must still scope to the "aws" scan,
+ # not be silently bypassed by a casing mismatch.
+ constraint = [
+ {
+ "Check": "securityhub_enabled",
+ "Provider": "AWS",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+ ]
+ is_ok, _ = evaluate_config_constraints(
+ constraint, {"mute_non_default_regions": True}, "aws"
+ )
+ assert is_ok is False
+
+ def test_untagged_constraint_applies_to_any_provider(self):
+ # Single-provider frameworks omit Provider → always evaluated.
+ is_ok, _ = evaluate_config_constraints(
+ CONSTRAINTS, {"max_unused_access_keys_days": 120}, "aws"
+ )
+ assert is_ok is False
+
+
+# A constraint forcing FAIL when the applied value is too loose.
+REGION_CONSTRAINT = [
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+]
+
+
+def _legacy_req(req_id, constraints=None):
+ """Fake legacy Compliance_Requirement (``Id`` / ``ConfigRequirements``)."""
+ return SimpleNamespace(Id=req_id, ConfigRequirements=constraints)
+
+
+def _universal_req(req_id, constraints=None):
+ """Fake UniversalComplianceRequirement (``id`` / ``config_requirements``)."""
+ return SimpleNamespace(id=req_id, config_requirements=constraints)
+
+
+class Test_build_requirement_config_status:
+ def test_only_requirements_with_constraints_included(self):
+ reqs = [_legacy_req("1", CONSTRAINTS), _legacy_req("2", None)]
+ status = build_requirement_config_status(
+ reqs, {"max_unused_access_keys_days": 120}
+ )
+ assert set(status) == {"1"}
+ assert status["1"][0] is False
+
+ def test_supports_universal_requirements(self):
+ reqs = [_universal_req("u1", REGION_CONSTRAINT)]
+ status = build_requirement_config_status(
+ reqs, {"mute_non_default_regions": True}
+ )
+ assert status["u1"][0] is False
+
+ def test_compliant_when_config_satisfied(self):
+ reqs = [_legacy_req("1", CONSTRAINTS)]
+ status = build_requirement_config_status(
+ reqs, {"max_unused_access_keys_days": 30}
+ )
+ assert status["1"] == (True, "")
+
+
+class Test_resolve_requirement_config_status:
+ def test_memoises_by_requirement_id(self):
+ cache = {}
+ req = _legacy_req("1", CONSTRAINTS)
+ first = resolve_requirement_config_status(
+ req, {"max_unused_access_keys_days": 120}, cache
+ )
+ assert cache["1"] is first
+ assert first[0] is False
+ # A different audit_config is ignored once cached (intended for one build).
+ second = resolve_requirement_config_status(req, {}, cache)
+ assert second is first
+
+ def test_requirement_without_constraints_is_ok(self):
+ cache = {}
+ req = _legacy_req("1", None)
+ assert resolve_requirement_config_status(req, {}, cache) == (True, "")
+
+
+class Test_accumulate_overview_status:
+ def test_fail_wins_over_earlier_pass(self):
+ p, f, m = set(), set(), set()
+ accumulate_overview_status(0, "PASS", p, f, m)
+ accumulate_overview_status(0, "FAIL", p, f, m)
+ assert (p, f, m) == (set(), {0}, set())
+
+ def test_pass_after_fail_does_not_double_count(self):
+ p, f, m = set(), set(), set()
+ accumulate_overview_status(0, "FAIL", p, f, m)
+ accumulate_overview_status(0, "PASS", p, f, m)
+ assert (p, f, m) == (set(), {0}, set())
+
+ def test_pass_only(self):
+ p, f, m = set(), set(), set()
+ accumulate_overview_status(0, "PASS", p, f, m)
+ assert (p, f, m) == ({0}, set(), set())
+
+ def test_muted(self):
+ p, f, m = set(), set(), set()
+ accumulate_overview_status(0, "Muted", p, f, m)
+ assert (p, f, m) == (set(), set(), {0})
+
+
+class Test_accumulate_group_status:
+ def test_first_status_counted(self):
+ counts = {"FAIL": 0, "PASS": 0, "Muted": 0}
+ seen = {}
+ accumulate_group_status(0, "PASS", counts, seen)
+ assert counts == {"FAIL": 0, "PASS": 1, "Muted": 0}
+ assert seen == {0: "PASS"}
+
+ def test_pass_upgraded_to_fail(self):
+ counts = {"FAIL": 0, "PASS": 0, "Muted": 0}
+ seen = {}
+ accumulate_group_status(0, "PASS", counts, seen)
+ accumulate_group_status(0, "FAIL", counts, seen)
+ assert counts == {"FAIL": 1, "PASS": 0, "Muted": 0}
+ assert seen == {0: "FAIL"}
+
+ def test_fail_not_downgraded_by_later_pass(self):
+ counts = {"FAIL": 0, "PASS": 0, "Muted": 0}
+ seen = {}
+ accumulate_group_status(0, "FAIL", counts, seen)
+ accumulate_group_status(0, "PASS", counts, seen)
+ assert counts == {"FAIL": 1, "PASS": 0, "Muted": 0}
+
+ def test_same_index_not_double_counted(self):
+ counts = {"FAIL": 0, "PASS": 0, "Muted": 0}
+ seen = {}
+ accumulate_group_status(0, "PASS", counts, seen)
+ accumulate_group_status(0, "PASS", counts, seen)
+ assert counts["PASS"] == 1
+
+ def test_works_with_fail_pass_only_counts(self):
+ # Level-style counts (no "Muted" key) used by CIS / split tables.
+ counts = {"FAIL": 0, "PASS": 0}
+ seen = {}
+ accumulate_group_status(0, "PASS", counts, seen)
+ accumulate_group_status(0, "FAIL", counts, seen)
+ assert counts == {"FAIL": 1, "PASS": 0}
+
+ def test_muted_on_fail_pass_only_counts_raises(self):
+ # Level-style callers only ever pass PASS/FAIL (they guard on
+ # ``not finding.muted``). Passing "Muted" to a Muted-less counts must
+ # fail loudly rather than silently create a bogus key.
+ counts = {"FAIL": 0, "PASS": 0}
+ with pytest.raises(KeyError):
+ accumulate_group_status(0, "Muted", counts, {})
+
+ def test_manual_status_is_ignored_not_counted(self):
+ # A MANUAL finding (from a manual, checks-less requirement) has no
+ # PASS/FAIL/Muted column: it must be skipped, not raise KeyError, and
+ # not appear in the tally. Regression test for the M365 CIS compliance
+ # crash "KeyError: 'MANUAL'" (issue #11822).
+ counts = {"FAIL": 0, "PASS": 0}
+ seen = {}
+ accumulate_group_status(0, "MANUAL", counts, seen)
+ assert counts == {"FAIL": 0, "PASS": 0}
+ assert seen == {}
+
+ def test_manual_mixed_with_pass_and_fail(self):
+ # MANUAL findings interleaved with real PASS/FAIL ones only skip
+ # themselves; the PASS/FAIL tally is unaffected.
+ counts = {"FAIL": 0, "PASS": 0}
+ seen = {}
+ accumulate_group_status(0, "MANUAL", counts, seen)
+ accumulate_group_status(1, "PASS", counts, seen)
+ accumulate_group_status(2, "FAIL", counts, seen)
+ accumulate_group_status(3, "MANUAL", counts, seen)
+ assert counts == {"FAIL": 1, "PASS": 1}
+
+ def test_manual_ignored_on_counts_with_muted_key(self):
+ # MANUAL is skipped regardless of the counts shape (e.g. the universal
+ # table's PASS/FAIL/Muted buckets), never creating a "MANUAL" key.
+ counts = {"FAIL": 0, "PASS": 0, "Muted": 0}
+ seen = {}
+ accumulate_group_status(0, "MANUAL", counts, seen)
+ assert counts == {"FAIL": 0, "PASS": 0, "Muted": 0}
+ assert "MANUAL" not in counts
+
+
+class Test_apply_config_status:
+ def test_none_config_status_keeps_finding(self):
+ assert apply_config_status("PASS", "ext", None) == ("PASS", "ext")
+
+ def test_compliant_keeps_finding(self):
+ assert apply_config_status("PASS", "ext", (True, "")) == ("PASS", "ext")
+
+ def test_invalid_config_forces_fail_and_prepends_reason(self):
+ # The reason already carries the full product-facing message; it is
+ # prepended verbatim to the finding's extended status.
+ reason = f"{CONFIG_NOT_VALID_PREFIX} bad config"
+ status, extended = apply_config_status("PASS", "ext", (False, reason))
+ assert status == "FAIL"
+ assert extended.startswith(CONFIG_NOT_VALID_PREFIX)
+ assert reason in extended
+ assert "ext" in extended
+
+
+class Test_get_effective_status:
+ def test_none_and_compliant_keep_status(self):
+ assert get_effective_status("PASS", None) == "PASS"
+ assert get_effective_status("PASS", (True, "")) == "PASS"
+
+ def test_invalid_config_forces_fail(self):
+ assert get_effective_status("PASS", (False, "reason")) == "FAIL"
+
+
+class Test_get_scan_audit_config:
+ def test_returns_empty_without_global_provider(self):
+ # No global provider set → get_global_provider() returns None →
+ # ``None.audit_config`` raises AttributeError → safe empty mapping.
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=None,
+ ):
+ assert get_scan_audit_config() == {}
+
+
+class Test_get_scan_provider_type:
+ def test_returns_empty_when_no_global_provider(self):
+ # No global provider set → get_global_provider() returns None →
+ # ``None.type`` raises AttributeError → scoping disabled (empty string).
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=None,
+ ):
+ assert get_scan_provider_type() == ""
+
+ def test_returns_global_provider_type(self):
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=SimpleNamespace(type="aws"),
+ ):
+ assert get_scan_provider_type() == "aws"
diff --git a/tests/lib/check/compliance_config_requirements_data_test.py b/tests/lib/check/compliance_config_requirements_data_test.py
new file mode 100644
index 0000000000..3b3ba5757f
--- /dev/null
+++ b/tests/lib/check/compliance_config_requirements_data_test.py
@@ -0,0 +1,191 @@
+"""Data-integrity tests for every ``ConfigRequirements`` declared in the shipped
+compliance framework JSONs.
+
+These guard the ~700 constraints added across the frameworks against drift:
+- every constraint is well-formed (valid operator, value typed for its operator),
+- every constraint targets a check the requirement actually maps (no orphans),
+- the region-mute invariant holds (every requirement mapping a region-scoped
+ check carries the ``mute_non_default_regions == false`` constraint),
+- every framework still parses through its model.
+"""
+
+import glob
+import json
+import pathlib
+
+import pytest
+
+from prowler.lib.check.compliance_models import Compliance, ComplianceFramework
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+_COMPLIANCE_DIR = _REPO_ROOT / "prowler" / "compliance"
+
+_VALID_OPERATORS = {"lte", "gte", "eq", "in", "subset", "superset"}
+# Checks whose result is untrustworthy when non-default regions are muted.
+_REGION_CHECKS = {
+ "accessanalyzer_enabled",
+ "config_recorder_all_regions_enabled",
+ "drs_job_exist",
+ "guardduty_delegated_admin_enabled_all_regions",
+ "guardduty_is_enabled",
+ "securityhub_enabled",
+}
+
+_ALL_FILES = sorted(glob.glob(str(_COMPLIANCE_DIR / "**" / "*.json"), recursive=True))
+
+
+def _load(path):
+ with open(path, encoding="utf-8") as f:
+ return json.load(f)
+
+
+def _requirements(data):
+ return data.get("Requirements") or data.get("requirements") or []
+
+
+def _req_id(req):
+ return req.get("Id") or req.get("id")
+
+
+def _req_checks(req):
+ ch = req.get("Checks", req.get("checks"))
+ checks = set()
+ if isinstance(ch, dict):
+ for v in ch.values():
+ checks |= set(v or [])
+ elif isinstance(ch, list):
+ checks |= set(ch)
+ return checks
+
+
+def _req_constraints(req):
+ return req.get("ConfigRequirements") or req.get("config_requirements") or []
+
+
+def _iter_constraints():
+ """Yield (file, req_id, checks, constraint) for every constraint shipped."""
+ for path in _ALL_FILES:
+ data = _load(path)
+ for req in _requirements(data):
+ checks = _req_checks(req)
+ for c in _req_constraints(req):
+ yield pathlib.Path(path).name, _req_id(req), checks, c
+
+
+_ALL_CONSTRAINTS = list(_iter_constraints())
+
+
+def test_there_are_constraints_to_validate():
+ # Guards against the iteration silently finding nothing (e.g. path change).
+ assert len(_ALL_CONSTRAINTS) > 100
+
+
+@pytest.mark.parametrize(
+ "fname,req_id,checks,constraint",
+ _ALL_CONSTRAINTS,
+ ids=[f"{f}:{r}:{c['Check']}" for f, r, _, c in _ALL_CONSTRAINTS],
+)
+class Test_Constraint_Wellformed:
+ def test_has_required_keys(self, fname, req_id, checks, constraint):
+ required = {"Check", "ConfigKey", "Operator", "Value"}
+ # ``Provider`` is optional (universal frameworks set it, single-provider
+ # ones omit it); no other key is allowed.
+ assert required <= set(constraint) <= required | {
+ "Provider"
+ }, f"{fname}:{req_id} malformed constraint {constraint}"
+
+ def test_operator_valid(self, fname, req_id, checks, constraint):
+ assert constraint["Operator"] in _VALID_OPERATORS
+
+ def test_check_is_mapped_by_requirement(self, fname, req_id, checks, constraint):
+ # No orphan constraints: the target check must be one the requirement runs.
+ assert constraint["Check"] in checks, (
+ f"{fname}:{req_id} constraint targets {constraint['Check']} "
+ f"which the requirement does not map"
+ )
+
+ def test_value_type_matches_operator(self, fname, req_id, checks, constraint):
+ op, val = constraint["Operator"], constraint["Value"]
+ if op in ("subset", "superset", "in"):
+ assert isinstance(val, list), f"{fname}:{req_id} {op} needs a list value"
+ elif op in ("lte", "gte"):
+ # Numeric threshold; bool is not a valid threshold even though it is
+ # an int subclass.
+ assert isinstance(val, (int, float)) and not isinstance(
+ val, bool
+ ), f"{fname}:{req_id} {op} needs a numeric value, got {val!r}"
+ elif op == "eq":
+ assert isinstance(
+ val, (bool, int, float, str)
+ ), f"{fname}:{req_id} eq needs a scalar value"
+
+
+class Test_Region_Mute_Invariant:
+ """Every requirement mapping a region-scoped check must carry the
+ ``mute_non_default_regions == false`` constraint for it."""
+
+ def test_region_checks_always_constrained(self):
+ gaps = []
+ for path in _ALL_FILES:
+ data = _load(path)
+ for req in _requirements(data):
+ checks = _req_checks(req)
+ constrained = {
+ c["Check"]
+ for c in _req_constraints(req)
+ if c["ConfigKey"] == "mute_non_default_regions"
+ }
+ for region_check in checks & _REGION_CHECKS:
+ if region_check not in constrained:
+ gaps.append(
+ f"{pathlib.Path(path).name}:{_req_id(req)}:{region_check}"
+ )
+ assert not gaps, f"region-mute constraint missing for: {gaps}"
+
+ def test_region_mute_constraints_use_eq_false(self):
+ for fname, req_id, _checks, c in _ALL_CONSTRAINTS:
+ if c["ConfigKey"] == "mute_non_default_regions":
+ assert (
+ c["Operator"] == "eq" and c["Value"] is False
+ ), f"{fname}:{req_id} region-mute must be eq false"
+
+
+class Test_Universal_Provider_Scoping:
+ """Universal (multi-provider) frameworks map checks per provider, so every
+ constraint must declare which provider it scopes to and that provider must
+ actually map the targeted check. Without this a constraint authored for one
+ provider's check would wrongly apply to scans of every other provider."""
+
+ def test_multiprovider_constraints_declare_consistent_provider(self):
+ gaps = []
+ for path in _ALL_FILES:
+ data = _load(path)
+ for req in _requirements(data):
+ ch = req.get("Checks", req.get("checks"))
+ # Only universal frameworks key their checks by provider.
+ if not isinstance(ch, dict):
+ continue
+ for c in _req_constraints(req):
+ provider = c.get("Provider")
+ if not provider:
+ gaps.append(
+ f"{pathlib.Path(path).name}:{_req_id(req)}:"
+ f"{c['Check']} missing Provider"
+ )
+ elif c["Check"] not in set(ch.get(provider, [])):
+ gaps.append(
+ f"{pathlib.Path(path).name}:{_req_id(req)}:"
+ f"{c['Check']} not mapped under provider {provider}"
+ )
+ assert not gaps, f"universal constraints with bad Provider: {gaps}"
+
+
+@pytest.mark.parametrize(
+ "path", _ALL_FILES, ids=[pathlib.Path(p).name for p in _ALL_FILES]
+)
+def test_every_framework_parses_with_constraints(path):
+ data = _load(path)
+ if "Requirements" in data:
+ Compliance(**data)
+ else:
+ ComplianceFramework.parse_obj(data)
diff --git a/tests/lib/check/mitre_config_requirements_test.py b/tests/lib/check/mitre_config_requirements_test.py
new file mode 100644
index 0000000000..ef3b33a17f
--- /dev/null
+++ b/tests/lib/check/mitre_config_requirements_test.py
@@ -0,0 +1,148 @@
+"""Regression coverage for ConfigRequirements on MITRE requirements.
+
+``mitre_attack_aws.json`` declares ``ConfigRequirements`` on its requirements,
+but ``Mitre_Requirement`` historically did not define the field, so Pydantic
+silently dropped the constraints during MITRE parsing and the config validation
+logic never saw them. These tests prove the constraints survive parsing and that
+a violated MITRE config requirement forces the compliance result to FAIL through
+the universal output path.
+"""
+
+from datetime import datetime, timezone
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from py_ocsf_models.objects.compliance_status import StatusID as ComplianceStatusID
+
+from prowler.lib.check.compliance_models import (
+ Compliance,
+ Mitre_Requirement,
+ adapt_legacy_to_universal,
+)
+from prowler.lib.outputs.compliance.universal.ocsf_compliance import (
+ OCSFComplianceOutput,
+)
+
+_MODULE = "prowler.providers.common.provider.Provider.get_global_provider"
+
+
+def _mitre_compliance(check_id):
+ """A minimal one-requirement MITRE framework with a config constraint."""
+ return Compliance(
+ Framework="MITRE-ATTACK",
+ Name="MITRE ATT&CK",
+ Provider="AWS",
+ Version="",
+ Description="Test MITRE framework",
+ Requirements=[
+ {
+ "Name": "Test Technique",
+ "Id": "T9999",
+ "Tactics": ["initial-access"],
+ "SubTechniques": [],
+ "Platforms": ["AWS"],
+ "Description": "Requirement T9999",
+ "TechniqueURL": "https://attack.mitre.org/techniques/T9999",
+ "Checks": [check_id],
+ "ConfigRequirements": [
+ {
+ "Check": check_id,
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+ ],
+ "Attributes": [
+ {
+ "AWSService": "service",
+ "Category": "category",
+ "Value": "value",
+ "Comment": "comment",
+ }
+ ],
+ }
+ ],
+ )
+
+
+def _finding(check_id, status="PASS", provider="aws"):
+ finding = SimpleNamespace()
+ finding.provider = provider
+ finding.account_uid = "123456789012"
+ finding.account_name = "test-account"
+ finding.account_organization_uid = "org-123"
+ finding.account_organization_name = "test-org"
+ finding.region = "us-east-1"
+ finding.status = status
+ finding.status_extended = f"{check_id} is {status}"
+ finding.resource_uid = f"arn:aws:iam::123456789012:{check_id}"
+ finding.resource_name = check_id
+ finding.resource_details = "details"
+ finding.resource_metadata = {}
+ finding.resource_tags = {"Name": "test"}
+ finding.partition = "aws"
+ finding.muted = False
+ finding.check_id = check_id
+ finding.uid = "test-finding-uid"
+ finding.timestamp = datetime(2025, 1, 15, 12, 0, 0, tzinfo=timezone.utc)
+ finding.prowler_version = "5.0.0"
+ finding.metadata = SimpleNamespace(
+ CheckID=check_id,
+ CheckTitle=f"Title for {check_id}",
+ Description=f"Description for {check_id}",
+ Severity="medium",
+ ServiceName="iam",
+ ResourceType="aws-iam-role",
+ )
+ return finding
+
+
+class Test_Mitre_Config_Requirements:
+ def test_config_requirements_survive_mitre_parsing(self):
+ """Real mitre_attack_aws.json constraints must not be dropped on parse."""
+ compliance = Compliance.parse_file(
+ "prowler/compliance/aws/mitre_attack_aws.json"
+ )
+ requirement = next(r for r in compliance.Requirements if r.Id == "T1190")
+ assert isinstance(requirement, Mitre_Requirement)
+ assert requirement.ConfigRequirements
+ # And they propagate through the legacy -> universal adapter unchanged.
+ universal = adapt_legacy_to_universal(compliance)
+ universal_requirement = next(
+ r for r in universal.requirements if r.id == "T1190"
+ )
+ assert universal_requirement.config_requirements
+ assert len(universal_requirement.config_requirements) == len(
+ requirement.ConfigRequirements
+ )
+
+ def test_violating_mitre_config_forces_fail(self):
+ """A PASS finding becomes FAIL when the MITRE config constraint is violated."""
+ check_id = "drs_job_exist"
+ framework = adapt_legacy_to_universal(_mitre_compliance(check_id))
+ findings = [_finding(check_id, "PASS")]
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = {"mute_non_default_regions": True}
+ out = OCSFComplianceOutput(
+ findings=findings, framework=framework, provider="aws"
+ )
+ event = out.data[0]
+ assert event.compliance.status_id == ComplianceStatusID.Fail
+ assert event.status_code == "FAIL"
+ assert "Configuration not valid" in event.message
+ # The nested Check object keeps the real (raw) finding status.
+ assert event.compliance.checks[0].status == "PASS"
+
+ def test_valid_mitre_config_keeps_pass(self):
+ check_id = "drs_job_exist"
+ framework = adapt_legacy_to_universal(_mitre_compliance(check_id))
+ findings = [_finding(check_id, "PASS")]
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = {"mute_non_default_regions": False}
+ out = OCSFComplianceOutput(
+ findings=findings, framework=framework, provider="aws"
+ )
+ event = out.data[0]
+ assert event.compliance.status_id == ComplianceStatusID.Pass
+ assert event.status_code == "PASS"
+ assert "Configuration not valid" not in event.message
diff --git a/tests/lib/check_test_init_files_test.py b/tests/lib/check_test_init_files_test.py
new file mode 100644
index 0000000000..2dc4d77902
--- /dev/null
+++ b/tests/lib/check_test_init_files_test.py
@@ -0,0 +1,93 @@
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+
+SCRIPT_PATH = (
+ Path(__file__).resolve().parents[2] / "scripts" / "check_test_init_files.py"
+)
+
+
+def load_guard_module():
+ spec = spec_from_file_location("check_test_init_files", SCRIPT_PATH)
+ assert spec is not None
+ assert spec.loader is not None
+
+ module = module_from_spec(spec)
+ spec.loader.exec_module(module)
+ return module
+
+
+def test_find_test_init_files_detects_only_root_test_directories(tmp_path):
+ guard = load_guard_module()
+
+ (tmp_path / "tests" / "providers" / "aws").mkdir(parents=True)
+ (tmp_path / "tests" / "providers" / "aws" / "__init__.py").write_text("")
+ (tmp_path / "api" / "tests" / "performance").mkdir(parents=True)
+ (tmp_path / "api" / "tests" / "performance" / "__init__.py").write_text("")
+ (tmp_path / "mcp_server" / "tests").mkdir(parents=True)
+ (tmp_path / "mcp_server" / "tests" / "__init__.py").write_text("")
+ (tmp_path / "prowler" / "providers" / "aws").mkdir(parents=True)
+ (tmp_path / "prowler" / "providers" / "aws" / "__init__.py").write_text("")
+ (
+ tmp_path / "tests" / "lib" / "check" / "fixtures" / "checks_folder" / "check11"
+ ).mkdir(parents=True)
+ (
+ tmp_path
+ / "tests"
+ / "lib"
+ / "check"
+ / "fixtures"
+ / "checks_folder"
+ / "check11"
+ / "__init__.py"
+ ).write_text("")
+
+ matches = guard.find_test_init_files(tmp_path)
+
+ assert [path.relative_to(tmp_path) for path in matches] == [
+ Path("tests/providers/aws/__init__.py"),
+ ]
+
+
+def test_find_test_init_files_ignores_virtualenv_test_packages(tmp_path):
+ guard = load_guard_module()
+
+ virtualenv_tests = (
+ tmp_path
+ / ".venv"
+ / "lib"
+ / "python3.12"
+ / "site-packages"
+ / "package"
+ / "tests"
+ )
+ virtualenv_tests.mkdir(parents=True)
+ (virtualenv_tests / "__init__.py").write_text("")
+ (tmp_path / "tests" / "providers" / "aws").mkdir(parents=True)
+ (tmp_path / "tests" / "providers" / "aws" / "__init__.py").write_text("")
+
+ matches = guard.find_test_init_files(tmp_path)
+
+ assert [path.relative_to(tmp_path) for path in matches] == [
+ Path("tests/providers/aws/__init__.py"),
+ ]
+
+
+def test_main_returns_error_when_test_init_files_exist(tmp_path, capsys):
+ guard = load_guard_module()
+
+ (tmp_path / "tests" / "config").mkdir(parents=True)
+ (tmp_path / "tests" / "config" / "__init__.py").write_text("")
+
+ assert guard.main([str(tmp_path)]) == 1
+
+ captured = capsys.readouterr()
+ assert "Remove __init__.py files from test directories" in captured.out
+ assert "tests/config/__init__.py" in captured.out
+
+
+def test_repository_has_no_test_init_files():
+ guard = load_guard_module()
+
+ repo_root = Path(__file__).resolve().parents[2]
+
+ assert guard.find_test_init_files(repo_root) == []
diff --git a/tests/lib/cli/parser_test.py b/tests/lib/cli/parser_test.py
index 94b6ad2b4d..549ca17727 100644
--- a/tests/lib/cli/parser_test.py
+++ b/tests/lib/cli/parser_test.py
@@ -17,7 +17,7 @@ prowler_command = "prowler"
# capsys
# https://docs.pytest.org/en/7.1.x/how-to/capture-stdout-stderr.html
-prowler_default_usage_error = "usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,dashboard,iac,image,llm} ..."
+prowler_default_usage_error = "usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,e2enetworks,dashboard,iac,image,llm} ..."
def mock_get_available_providers():
@@ -40,6 +40,7 @@ def mock_get_available_providers():
"openstack",
"stackit",
"linode",
+ "e2enetworks",
]
diff --git a/tests/lib/outputs/compliance/cis/cis_7_0_m365_test.py b/tests/lib/outputs/compliance/cis/cis_7_0_m365_test.py
new file mode 100644
index 0000000000..4fbebb49f6
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_7_0_m365_test.py
@@ -0,0 +1,65 @@
+import json
+from pathlib import Path
+
+from prowler.lib.check.compliance_models import (
+ CIS_Requirement_Attribute_AssessmentStatus,
+ CIS_Requirement_Attribute_Profile,
+ Compliance,
+)
+
+PROWLER_ROOT = Path(__file__).parents[5] / "prowler"
+FRAMEWORK_PATH = PROWLER_ROOT / "compliance" / "m365" / "cis_7.0_m365.json"
+M365_SERVICES_PATH = PROWLER_ROOT / "providers" / "m365" / "services"
+
+VALID_PROFILES = {p.value for p in CIS_Requirement_Attribute_Profile}
+VALID_STATUSES = {s.value for s in CIS_Requirement_Attribute_AssessmentStatus}
+
+
+def _existing_m365_checks() -> set:
+ return {
+ metadata.stem.replace(".metadata", "")
+ for metadata in M365_SERVICES_PATH.rglob("*.metadata.json")
+ }
+
+
+class TestCIS7_0_M365:
+ def test_framework_is_discoverable(self):
+ frameworks = Compliance.get_bulk("m365")
+ assert "cis_7.0_m365" in frameworks
+
+ def test_framework_metadata(self):
+ framework = Compliance.get_bulk("m365")["cis_7.0_m365"]
+ assert framework.Framework == "CIS"
+ assert framework.Provider == "M365"
+ assert framework.Version == "7.0"
+ assert framework.Name == "CIS Microsoft 365 Foundations Benchmark v7.0.0"
+ assert len(framework.Requirements) == 160
+
+ def test_requirement_ids_are_unique(self):
+ framework = Compliance.get_bulk("m365")["cis_7.0_m365"]
+ ids = [req.Id for req in framework.Requirements]
+ assert len(ids) == len(set(ids))
+
+ def test_each_requirement_has_one_attribute_with_section(self):
+ framework = Compliance.get_bulk("m365")["cis_7.0_m365"]
+ for req in framework.Requirements:
+ assert len(req.Attributes) == 1, f"{req.Id} must have exactly one attribute"
+ attribute = req.Attributes[0]
+ assert attribute.Section, f"{req.Id} has an empty Section"
+ assert attribute.Profile in VALID_PROFILES
+ assert attribute.AssessmentStatus in VALID_STATUSES
+
+ def test_all_mapped_checks_exist(self):
+ # Every check referenced by the framework must resolve to a real M365 check,
+ # otherwise the requirement would never be evaluated.
+ existing = _existing_m365_checks()
+ framework = json.loads(FRAMEWORK_PATH.read_text())
+ unknown = {
+ check
+ for req in framework["Requirements"]
+ for check in req["Checks"]
+ if check not in existing
+ }
+ assert (
+ not unknown
+ ), f"Framework references unknown M365 checks: {sorted(unknown)}"
diff --git a/tests/lib/outputs/compliance/cis/cis_aws_config_requirements_test.py b/tests/lib/outputs/compliance/cis/cis_aws_config_requirements_test.py
new file mode 100644
index 0000000000..28cc3d2e1a
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_aws_config_requirements_test.py
@@ -0,0 +1,89 @@
+"""Integration coverage for requirement-level config validation in the CIS AWS
+CSV output. Requirement CIS 6.0 AWS 2.11 maps two configurable checks; when the
+scan config is looser than the requirement demands, the requirement row must be
+FAIL even if the underlying finding is PASS. The applied config is read from the
+active provider's ``audit_config``."""
+
+import json
+import pathlib
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.cis.cis_aws import AWSCIS
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[5]
+_CIS_6_0 = _REPO_ROOT / "prowler" / "compliance" / "aws" / "cis_6.0_aws.json"
+
+
+def _load_cis_60() -> Compliance:
+ return Compliance(**json.load(open(_CIS_6_0)))
+
+
+def _finding(check_id: str, status: str):
+ return SimpleNamespace(
+ provider="aws",
+ account_uid="123456789012",
+ region="us-east-1",
+ check_id=check_id,
+ status=status,
+ status_extended=f"{check_id} {status}",
+ resource_uid="arn:aws:iam::123456789012:user/bob",
+ resource_name="bob",
+ muted=False,
+ )
+
+
+def _rows_for(requirement_id, findings, audit_config):
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider"
+ ) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ out = AWSCIS(findings=findings, compliance=_load_cis_60(), file_path=None)
+ return [r for r in out._data if r.Requirements_Id == requirement_id]
+
+
+class Test_CIS_AWS_Config_Requirements:
+ def test_loose_config_forces_requirement_fail(self):
+ findings = [_finding("iam_user_accesskey_unused", "PASS")]
+ rows = _rows_for("2.11", findings, {"max_unused_access_keys_days": 120})
+ assert rows, "expected a row for requirement 2.11"
+ assert all(r.Status == "FAIL" for r in rows)
+ assert all("Configuration not valid" in r.StatusExtended for r in rows)
+
+ def test_valid_config_keeps_finding_status(self):
+ findings = [_finding("iam_user_accesskey_unused", "PASS")]
+ rows = _rows_for("2.11", findings, {"max_unused_access_keys_days": 45})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
+ assert all("Configuration not valid" not in r.StatusExtended for r in rows)
+
+ def test_absent_config_assumes_default_ok(self):
+ findings = [_finding("iam_user_accesskey_unused", "PASS")]
+ rows = _rows_for("2.11", findings, {})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
+
+ def test_other_requirements_unaffected(self):
+ # A finding for a check without ConfigRequirements keeps its status even
+ # when the config is loose for a different requirement.
+ findings = [_finding("iam_rotate_access_key_90_days", "PASS")]
+ rows = _rows_for("2.13", findings, {"max_unused_access_keys_days": 120})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
+
+ def test_region_mute_constraint_forces_fail(self):
+ # Requirement 5.16 maps securityhub_enabled with a
+ # mute_non_default_regions == false constraint: muting non-default
+ # regions makes the PASS untrustworthy, so the row must be FAIL.
+ findings = [_finding("securityhub_enabled", "PASS")]
+ rows = _rows_for("5.16", findings, {"mute_non_default_regions": True})
+ assert rows, "expected a row for requirement 5.16"
+ assert all(r.Status == "FAIL" for r in rows)
+ assert all("Configuration not valid" in r.StatusExtended for r in rows)
+
+ def test_region_mute_constraint_default_passes(self):
+ findings = [_finding("securityhub_enabled", "PASS")]
+ rows = _rows_for("5.16", findings, {"mute_non_default_regions": False})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
diff --git a/tests/lib/outputs/compliance/cis/cis_azure_config_requirements_test.py b/tests/lib/outputs/compliance/cis/cis_azure_config_requirements_test.py
new file mode 100644
index 0000000000..a34402ec77
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_azure_config_requirements_test.py
@@ -0,0 +1,75 @@
+"""Integration coverage for the ``subset`` set-operator in a CSV output.
+
+CIS Azure 5.0 requirement 9.1.3 maps ``storage_smb_channel_encryption_with_secure_algorithm``
+with a ``recommended_smb_channel_encryption_algorithms subset ["AES-256-GCM"]``
+constraint: widening the allowlist with a weaker algorithm makes the PASS
+untrustworthy, so the requirement row must be FAIL. Exercises the shared override
+path through a per-provider CSV class (not just OCSF)."""
+
+import json
+import pathlib
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.cis.cis_azure import AzureCIS
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[5]
+_CIS_5_0_AZURE = _REPO_ROOT / "prowler" / "compliance" / "azure" / "cis_5.0_azure.json"
+_REQUIREMENT_ID = "9.1.3"
+_CHECK = "storage_smb_channel_encryption_with_secure_algorithm"
+
+
+def _load():
+ return Compliance(**json.load(open(_CIS_5_0_AZURE)))
+
+
+def _finding(check_id, status):
+ return SimpleNamespace(
+ provider="azure",
+ account_uid="00000000-0000-0000-0000-000000000000",
+ region="eastus",
+ check_id=check_id,
+ status=status,
+ status_extended=f"{check_id} {status}",
+ resource_uid="/subscriptions/x/storageAccounts/sa",
+ resource_name="sa",
+ muted=False,
+ )
+
+
+def _rows_for(audit_config):
+ findings = [_finding(_CHECK, "PASS")]
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider"
+ ) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ out = AzureCIS(findings=findings, compliance=_load(), file_path=None)
+ return [r for r in out._data if r.Requirements_Id == _REQUIREMENT_ID]
+
+
+class Test_CIS_Azure_Subset_Constraint:
+ def test_widened_allowlist_forces_fail(self):
+ rows = _rows_for(
+ {
+ "recommended_smb_channel_encryption_algorithms": [
+ "AES-128-CCM",
+ "AES-256-GCM",
+ ]
+ }
+ )
+ assert rows, f"expected a row for requirement {_REQUIREMENT_ID}"
+ assert all(r.Status == "FAIL" for r in rows)
+ assert all("Configuration not valid" in r.StatusExtended for r in rows)
+
+ def test_secure_allowlist_keeps_pass(self):
+ rows = _rows_for(
+ {"recommended_smb_channel_encryption_algorithms": ["AES-256-GCM"]}
+ )
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
+
+ def test_absent_config_keeps_pass(self):
+ rows = _rows_for({})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
diff --git a/tests/lib/outputs/compliance/config_status_dispatch_coverage_test.py b/tests/lib/outputs/compliance/config_status_dispatch_coverage_test.py
new file mode 100644
index 0000000000..a4f09551a5
--- /dev/null
+++ b/tests/lib/outputs/compliance/config_status_dispatch_coverage_test.py
@@ -0,0 +1,168 @@
+"""End-to-end coverage: every shipped framework that declares ``ConfigRequirements``
+must apply the config-status override through the *real* table dispatcher.
+
+The companion ``config_status_renderer_coverage_test`` proves no renderer file
+ignores the override. This test closes the other half of the gap that let
+``okta_idaas_stig`` ship ConfigRequirements its renderers never applied: it walks
+every per-provider compliance JSON that declares constraints, routes a synthetic
+PASS finding through ``display_compliance_table`` exactly as a scan would, and
+asserts the requirement is forced to FAIL when the scan's config is too loose.
+
+It runs each framework twice — once with a config that *violates* the first
+constraint and once with a config that *satisfies* it — and asserts the violating
+run reports strictly more failures. Comparing the two runs is language-neutral
+(only the parenthesised counts are read, never the localized PASS/FAIL labels) and
+self-checking (a renderer that ignored the override would report equal counts).
+
+Universal (multi-provider) frameworks render through a different path and are
+covered by ``universal/universal_table_config_requirements_test.py``.
+"""
+
+import glob
+import io
+import json
+import pathlib
+import re
+import tempfile
+from contextlib import redirect_stdout
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.compliance import display_compliance_table
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[4]
+_COMPLIANCE_DIR = _REPO_ROOT / "prowler" / "compliance"
+
+# Per-provider JSONs live in a provider subdir; top-level files are universal.
+_PROVIDER_JSONS = sorted(glob.glob(str(_COMPLIANCE_DIR / "*" / "*.json")))
+
+
+def _first_constraint(data):
+ """Return ``(check, config_key, operator, value)`` of the first declared
+ constraint, or ``None`` when the framework declares none."""
+ for requirement in data.get("Requirements", []):
+ constraints = requirement.get("ConfigRequirements")
+ if constraints:
+ c = constraints[0]
+ return c["Check"], c["ConfigKey"], c["Operator"], c["Value"]
+ return None
+
+
+def _violating_value(operator, value):
+ """A config value that breaks the constraint (forces the requirement FAIL)."""
+ if operator == "lte":
+ return value + 1
+ if operator == "gte":
+ return value - 1
+ if operator == "eq":
+ if isinstance(value, bool):
+ return not value
+ if isinstance(value, (int, float)):
+ return value + 1
+ return f"{value}__violates__"
+ if operator == "in":
+ return "__not_in_allowed_set__"
+ if operator == "subset":
+ return list(value) + ["__extra_not_allowed__"]
+ if operator == "superset":
+ return []
+ raise AssertionError(f"unhandled operator {operator}")
+
+
+def _satisfying_value(operator, value):
+ """A config value that satisfies the constraint (requirement keeps its status)."""
+ if operator in ("lte", "gte", "eq"):
+ return value
+ if operator == "in":
+ return value[0]
+ if operator == "subset":
+ return list(value)
+ if operator == "superset":
+ return list(value)
+ raise AssertionError(f"unhandled operator {operator}")
+
+
+def _fail_count(findings, bulk, name, provider, applied_config):
+ """Render the framework table with ``applied_config`` and return the FAIL
+ count from the overview, or ``None`` when the table renders nothing."""
+
+ def _not_implemented(*_a, **_k):
+ raise NotImplementedError
+
+ fake_provider = SimpleNamespace(
+ audit_config=applied_config,
+ type=provider,
+ display_compliance_table=_not_implemented,
+ )
+ buffer = io.StringIO()
+ with tempfile.TemporaryDirectory() as tmp:
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=fake_provider,
+ ):
+ with redirect_stdout(buffer):
+ display_compliance_table(findings, bulk, name, "output", tmp, False)
+ plain = re.sub(r"\x1b\[[0-9;]*m", "", buffer.getvalue())
+ # The overview's first parenthesised count is always the FAIL tally, in
+ # every renderer and every locale (only the label is translated).
+ counts = re.findall(r"\(\s*(\d+)\s*\)", plain)
+ return int(counts[0]) if counts else None
+
+
+def _frameworks_with_constraints():
+ for path in _PROVIDER_JSONS:
+ with open(path, encoding="utf-8") as f:
+ data = json.load(f)
+ if _first_constraint(data):
+ name = pathlib.Path(path).stem
+ yield pytest.param(path, data, id=name)
+
+
+@pytest.mark.parametrize("path, data", list(_frameworks_with_constraints()))
+def test_framework_constraints_force_fail_through_dispatcher(path, data):
+ provider = pathlib.Path(path).parent.name
+ name = pathlib.Path(path).stem
+ check, config_key, operator, value = _first_constraint(data)
+ compliance = Compliance(**data)
+
+ def _finding():
+ return SimpleNamespace(
+ check_metadata=SimpleNamespace(CheckID=check),
+ check_id=check,
+ status="PASS",
+ muted=False,
+ )
+
+ # Two findings: the renderers only print the table when more than one
+ # finding maps to the framework.
+ findings = [_finding(), _finding()]
+ bulk = {check: SimpleNamespace(Compliance=[compliance])}
+
+ strict = _fail_count(
+ findings, bulk, name, provider, {config_key: _satisfying_value(operator, value)}
+ )
+ loose = _fail_count(
+ findings, bulk, name, provider, {config_key: _violating_value(operator, value)}
+ )
+
+ if strict is None and loose is None:
+ # The framework's renderer gates rendering on its name/version and does
+ # not paint a table for this framework id. There is no status to assert
+ # here; the renderer itself is still proven config-aware by
+ # config_status_renderer_coverage_test. Surfaced rather than silently
+ # passed so the skip is visible.
+ pytest.skip(f"{name}: renderer paints no table for this framework id")
+
+ assert strict == 0, (
+ f"{name}: PASS findings reported {strict} failures with a compliant "
+ "config; the control run should be clean."
+ )
+ assert loose and loose > 0, (
+ f"{name}: a PASS finding whose requirement maps {check} ran with "
+ f"{config_key} too loose for the constraint ({operator} {value}) was NOT "
+ "forced to FAIL. The framework declares ConfigRequirements its renderer "
+ "fails to apply — wire it through the config-status helpers."
+ )
diff --git a/tests/lib/outputs/compliance/config_status_renderer_coverage_test.py b/tests/lib/outputs/compliance/config_status_renderer_coverage_test.py
new file mode 100644
index 0000000000..ac0981c941
--- /dev/null
+++ b/tests/lib/outputs/compliance/config_status_renderer_coverage_test.py
@@ -0,0 +1,71 @@
+"""Guard that every dedicated compliance renderer applies the config-status rule.
+
+Declaring ``ConfigRequirements`` in a framework JSON is inert unless the renderer
+that builds its output actually evaluates them. A requirement whose configurable
+checks ran with a config too loose to trust must be forced to FAIL; that override
+lives in ``prowler.lib.check.compliance_config_eval`` and every renderer that
+emits a finding's status (CSV transform, CLI table, OCSF) must route through it.
+
+This test statically asserts the invariant: any renderer that reads a finding's
+raw ``status`` must also reference one of the config-status helpers. It mirrors
+the manual audit that caught ``okta_idaas_stig`` shipping ConfigRequirements that
+its CSV and table renderers never applied, so the gap cannot silently reopen.
+"""
+
+import pathlib
+
+import pytest
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[4]
+_RENDERER_DIR = _REPO_ROOT / "prowler" / "lib" / "outputs" / "compliance"
+
+# Base/dispatch modules that orchestrate renderers but never emit a status row.
+_EXCLUDED_BASENAMES = {
+ "__init__.py",
+ "models.py",
+ "compliance.py",
+ "compliance_check.py",
+ "compliance_output.py",
+}
+
+# Any one of these, present in the source, means the renderer wires the override.
+_CONFIG_STATUS_HELPERS = (
+ "apply_config_status",
+ "build_requirement_config_status",
+ "resolve_requirement_config_status",
+ "get_effective_status",
+)
+
+# A renderer builds its output from the finding's raw status via one of these.
+_RAW_STATUS_MARKERS = ("finding.status", "finding.status_extended")
+
+
+def _renderer_sources():
+ for path in sorted(_RENDERER_DIR.glob("**/*.py")):
+ if path.name in _EXCLUDED_BASENAMES or "__pycache__" in path.parts:
+ continue
+ yield path
+
+
+@pytest.mark.parametrize(
+ "renderer_path",
+ [
+ pytest.param(p, id=str(p.relative_to(_RENDERER_DIR)))
+ for p in _renderer_sources()
+ ],
+)
+def test_renderer_emitting_status_applies_config_status(renderer_path):
+ source = renderer_path.read_text(encoding="utf-8")
+
+ uses_raw_status = any(marker in source for marker in _RAW_STATUS_MARKERS)
+ if not uses_raw_status:
+ pytest.skip("renderer does not emit a finding's raw status")
+
+ applies_config_status = any(helper in source for helper in _CONFIG_STATUS_HELPERS)
+ assert applies_config_status, (
+ f"{renderer_path.relative_to(_REPO_ROOT)} emits a finding's raw status but "
+ "never applies the config-status override. Route it through "
+ "apply_config_status / build_requirement_config_status (CSV/OCSF) or "
+ "resolve_requirement_config_status / get_effective_status (CLI table), "
+ "otherwise its ConfigRequirements are silently ignored."
+ )
diff --git a/tests/lib/outputs/compliance/ens/ens_aws_config_requirements_test.py b/tests/lib/outputs/compliance/ens/ens_aws_config_requirements_test.py
new file mode 100644
index 0000000000..b09d9bc0b3
--- /dev/null
+++ b/tests/lib/outputs/compliance/ens/ens_aws_config_requirements_test.py
@@ -0,0 +1,61 @@
+"""Integration coverage proving the shared requirement-level config validation
+is applied beyond CIS. ENS RD2022 AWS requirement ``op.exp.1.aws.cfg.1`` maps
+``config_recorder_all_regions_enabled`` with a ``mute_non_default_regions ==
+false`` constraint; muting non-default regions makes a PASS untrustworthy, so
+the requirement row must be FAIL even when the finding PASSes. The applied
+config is read from the active provider's ``audit_config``."""
+
+import json
+import pathlib
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
+
+_REPO_ROOT = pathlib.Path(__file__).resolve().parents[5]
+_ENS = _REPO_ROOT / "prowler" / "compliance" / "aws" / "ens_rd2022_aws.json"
+_REQUIREMENT_ID = "op.exp.1.aws.cfg.1"
+
+
+def _load_ens() -> Compliance:
+ return Compliance(**json.load(open(_ENS)))
+
+
+def _finding(check_id: str, status: str):
+ return SimpleNamespace(
+ provider="aws",
+ account_uid="123456789012",
+ region="us-east-1",
+ check_id=check_id,
+ status=status,
+ status_extended=f"{check_id} {status}",
+ resource_uid="arn:aws:config:us-east-1:123456789012:recorder/default",
+ resource_name="default",
+ muted=False,
+ )
+
+
+def _rows_for(requirement_id, findings, audit_config):
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider"
+ ) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ out = AWSENS(findings=findings, compliance=_load_ens(), file_path=None)
+ return [r for r in out._data if r.Requirements_Id == requirement_id]
+
+
+class Test_ENS_AWS_Config_Requirements:
+ def test_region_mute_constraint_forces_fail(self):
+ findings = [_finding("config_recorder_all_regions_enabled", "PASS")]
+ rows = _rows_for(_REQUIREMENT_ID, findings, {"mute_non_default_regions": True})
+ assert rows, f"expected a row for requirement {_REQUIREMENT_ID}"
+ assert all(r.Status == "FAIL" for r in rows)
+ assert all("Configuration not valid" in r.StatusExtended for r in rows)
+
+ def test_default_config_keeps_finding_status(self):
+ findings = [_finding("config_recorder_all_regions_enabled", "PASS")]
+ rows = _rows_for(_REQUIREMENT_ID, findings, {})
+ assert rows
+ assert all(r.Status == "PASS" for r in rows)
+ assert all("Configuration not valid" not in r.StatusExtended for r in rows)
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
index fa616c906e..a6a0267851 100644
--- a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
@@ -5,6 +5,10 @@ from unittest import mock
from freezegun import freeze_time
from mock import patch
+from prowler.lib.check.compliance_config_eval import CONFIG_NOT_VALID_PREFIX
+from prowler.lib.check.compliance_models import (
+ Compliance_Requirement_ConfigConstraint,
+)
from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
OktaIDaaSSTIG,
@@ -137,3 +141,52 @@ class TestOktaIDaaSSTIG:
expected_csv = f"PROVIDER;DESCRIPTION;ORGANIZATIONDOMAIN;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_NAME;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SEVERITY;REQUIREMENTS_ATTRIBUTES_RULEID;REQUIREMENTS_ATTRIBUTES_STIGID;REQUIREMENTS_ATTRIBUTES_CCI;REQUIREMENTS_ATTRIBUTES_CHECKTEXT;REQUIREMENTS_ATTRIBUTES_FIXTEXT;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED;FRAMEWORK;NAME\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;{OKTA_ORG_DOMAIN};{datetime.now()};OKTA-APP-000020;Okta must log out a session after a 15-minute period of inactivity.;A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate vicinity of the information system.;CAT II (Medium);medium;SV-273186r1098825_rule;OKTA-APP-000020;['CCI-000057', 'CCI-001133'];Verify the Global Session Policy logs out a session after 15 minutes of inactivity.;From the Admin Console configure the Global Session Policy idle timeout to 15 minutes.;PASS;;okta-global-session-policy;Default Policy;signon_global_session_idle_timeout_15min;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;;{datetime.now()};OKTA-APP-000650;Okta must enforce a minimum 15-character password length.;The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.;CAT II (Medium);medium;SV-273209r1098894_rule;OKTA-APP-000650;['CCI-000205'];Verify the password policy enforces a minimum length of 15 characters.;From the Admin Console set the minimum password length to 15 characters.;MANUAL;Manual check;manual_check;Manual check;manual;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\n"
assert content == expected_csv
+
+ def test_config_status_override_forces_fail(self):
+ """A PASS finding whose requirement declares a ConfigRequirements
+ constraint the scan's config violates must be reported as FAIL in the
+ CSV, with the config-not-valid reason prepended to StatusExtended."""
+ # Inject a config constraint on the first requirement (idle timeout must
+ # be <= 15 minutes) without mutating the shared fixture.
+ compliance = OKTA_IDAAS_STIG_OKTA.copy(deep=True)
+ compliance.Requirements[0].ConfigRequirements = [
+ Compliance_Requirement_ConfigConstraint(
+ Check="signon_global_session_idle_timeout_15min",
+ ConfigKey="okta_max_session_idle_minutes",
+ Operator="lte",
+ Value=15,
+ )
+ ]
+ findings = [
+ generate_finding_output(
+ provider="okta",
+ account_uid=OKTA_ORG_DOMAIN,
+ account_name=OKTA_ORG_DOMAIN,
+ region="global",
+ service_name="signon",
+ status="PASS",
+ status_extended="Idle timeout is configured.",
+ check_id="signon_global_session_idle_timeout_15min",
+ resource_uid="okta-global-session-policy",
+ resource_name="Default Policy",
+ compliance={"Okta-IDaaS-STIG-1R2": ["OKTA-APP-000020"]},
+ )
+ ]
+
+ # The scan applied a 30-minute idle timeout, too loose for the 15-minute
+ # requirement, so the PASS must be overridden to FAIL.
+ with (
+ patch(
+ "prowler.lib.check.compliance_config_eval.get_scan_audit_config",
+ return_value={"okta_max_session_idle_minutes": 30},
+ ),
+ patch(
+ "prowler.lib.check.compliance_config_eval.get_scan_provider_type",
+ return_value="okta",
+ ),
+ ):
+ output = OktaIDaaSSTIG(findings, compliance)
+
+ output_data = output.data[0]
+ assert output_data.Status == "FAIL"
+ assert output_data.StatusExtended.startswith(CONFIG_NOT_VALID_PREFIX)
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
index 3017ea4f92..0dd353760b 100644
--- a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
@@ -1,4 +1,5 @@
from types import SimpleNamespace
+from unittest.mock import patch
from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
get_okta_idaas_stig_table,
@@ -8,18 +9,35 @@ from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
def _make_finding(check_id, status="PASS", muted=False):
return SimpleNamespace(
check_metadata=SimpleNamespace(CheckID=check_id),
+ check_id=check_id,
status=status,
muted=muted,
)
-def _make_compliance(provider, sections, framework="Okta-IDaaS-STIG"):
- """Build a per-check compliance covering the given sections."""
+def _make_compliance(
+ provider,
+ sections,
+ framework="Okta-IDaaS-STIG",
+ checks=None,
+ config_requirements=None,
+):
+ """Build a per-check compliance covering the given sections.
+
+ ``checks`` and ``config_requirements`` let a section's requirement declare
+ the checks it owns and the config constraints that gate it, so the table's
+ config-status override can be exercised.
+ """
return SimpleNamespace(
Framework=framework,
Provider=provider,
Requirements=[
- SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+ SimpleNamespace(
+ Id=f"REQ-{section}",
+ Checks=list(checks or []),
+ ConfigRequirements=list(config_requirements or []),
+ Attributes=[SimpleNamespace(Section=section)],
+ )
for section in sections
],
)
@@ -134,3 +152,60 @@ class TestOktaIDaaSSTIGTable:
# The provider of the unrelated trailing framework must NOT leak into
# the rendered table.
assert "aws" not in captured.out
+
+ def test_config_status_override_forces_fail(self, capsys, tmp_path):
+ """A configurable check that PASSes but ran with a config too loose for
+ its requirement must be forced to FAIL in the table, honouring the
+ requirement's ConfigRequirements. Without the override check_a would be
+ PASS and no results table would render at all."""
+ constraint = {
+ "Check": "check_a",
+ "ConfigKey": "okta_max_session_idle_minutes",
+ "Operator": "lte",
+ "Value": 15,
+ }
+ bulk_metadata = {
+ "check_a": SimpleNamespace(
+ Compliance=[
+ _make_compliance(
+ "okta",
+ ["IAM"],
+ checks=["check_a"],
+ config_requirements=[constraint],
+ )
+ ]
+ ),
+ "check_b": SimpleNamespace(
+ Compliance=[_make_compliance("okta", ["Logging"])]
+ ),
+ }
+ # Both checks PASS on their own; the scan applied a 30-minute idle
+ # timeout, which is too loose for the 15-minute requirement.
+ findings = [
+ _make_finding("check_a", "PASS"),
+ _make_finding("check_b", "PASS"),
+ ]
+
+ with (
+ patch(
+ "prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig.get_scan_audit_config",
+ return_value={"okta_max_session_idle_minutes": 30},
+ ),
+ patch(
+ "prowler.lib.check.compliance_config_eval.get_scan_provider_type",
+ return_value="okta",
+ ),
+ ):
+ get_okta_idaas_stig_table(
+ findings,
+ bulk_metadata,
+ "okta_idaas_stig_1r2",
+ "output",
+ str(tmp_path),
+ False,
+ )
+
+ captured = capsys.readouterr()
+ # check_a was forced to FAIL by the config override, so its section
+ # (IAM) must report FAIL(1).
+ assert "FAIL(1)" in captured.out
diff --git a/tests/lib/outputs/compliance/universal/ocsf_compliance_config_requirements_test.py b/tests/lib/outputs/compliance/universal/ocsf_compliance_config_requirements_test.py
new file mode 100644
index 0000000000..c846385d88
--- /dev/null
+++ b/tests/lib/outputs/compliance/universal/ocsf_compliance_config_requirements_test.py
@@ -0,0 +1,191 @@
+"""Integration coverage for ConfigRequirements in the OCSF compliance output.
+
+OCSF is the universal output path every framework renders through, so it is the
+natural place to exercise the requirement-level config override end to end across
+all operators. When a requirement's configurable check ran with a config too
+loose to trust, the Compliance status must be FAIL (even on a PASS finding) and
+the message must carry the ``Configuration not valid`` marker. The Check status keeps
+the real finding status.
+"""
+
+from datetime import datetime, timezone
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from py_ocsf_models.objects.compliance_status import StatusID as ComplianceStatusID
+
+from prowler.lib.check.compliance_models import (
+ ComplianceFramework,
+ OutputsConfig,
+ TableConfig,
+ UniversalComplianceRequirement,
+)
+from prowler.lib.outputs.compliance.universal.ocsf_compliance import (
+ OCSFComplianceOutput,
+)
+
+_MODULE = "prowler.providers.common.provider.Provider.get_global_provider"
+
+
+def _finding(check_id, status="PASS", provider="aws"):
+ finding = SimpleNamespace()
+ finding.provider = provider
+ finding.account_uid = "123456789012"
+ finding.account_name = "test-account"
+ finding.account_email = ""
+ finding.account_organization_uid = "org-123"
+ finding.account_organization_name = "test-org"
+ finding.account_tags = {"env": "test"}
+ finding.region = "us-east-1"
+ finding.status = status
+ finding.status_extended = f"{check_id} is {status}"
+ finding.resource_uid = f"arn:aws:iam::123456789012:{check_id}"
+ finding.resource_name = check_id
+ finding.resource_details = "details"
+ finding.resource_metadata = {}
+ finding.resource_tags = {"Name": "test"}
+ finding.partition = "aws"
+ finding.muted = False
+ finding.check_id = check_id
+ finding.uid = "test-finding-uid"
+ finding.timestamp = datetime(2025, 1, 15, 12, 0, 0, tzinfo=timezone.utc)
+ finding.prowler_version = "5.0.0"
+ finding.compliance = {}
+ finding.metadata = SimpleNamespace(
+ Provider=provider,
+ CheckID=check_id,
+ CheckTitle=f"Title for {check_id}",
+ CheckType=["test-type"],
+ Description=f"Description for {check_id}",
+ Severity="medium",
+ ServiceName="iam",
+ ResourceType="aws-iam-role",
+ Risk="risk",
+ RelatedUrl="https://example.com",
+ Remediation=SimpleNamespace(
+ Recommendation=SimpleNamespace(Text="Fix", Url="https://fix.com"),
+ ),
+ DependsOn=[],
+ RelatedTo=[],
+ Categories=["test"],
+ Notes="",
+ AdditionalURLs=[],
+ )
+ return finding
+
+
+def _framework(check_id, constraint):
+ req = UniversalComplianceRequirement(
+ id="REQ-1",
+ description="Requirement REQ-1",
+ attributes={},
+ checks={"aws": [check_id]},
+ config_requirements=[constraint],
+ )
+ return ComplianceFramework(
+ framework="TestFW",
+ name="Test Framework",
+ provider="AWS",
+ version="1.0",
+ description="Test framework",
+ requirements=[req],
+ attributes_metadata=None,
+ outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+ )
+
+
+def _run(check_id, constraint, audit_config):
+ fw = _framework(check_id, constraint)
+ findings = [_finding(check_id, "PASS")]
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ out = OCSFComplianceOutput(findings=findings, framework=fw, provider="aws")
+ return out.data[0]
+
+
+# (check, constraint, violating_config, valid_config)
+_CASES = [
+ (
+ "securityhub_enabled",
+ {
+ "Check": "securityhub_enabled",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ },
+ {"mute_non_default_regions": True},
+ {"mute_non_default_regions": False},
+ ),
+ (
+ "iam_user_accesskey_unused",
+ {
+ "Check": "iam_user_accesskey_unused",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45,
+ },
+ {"max_unused_access_keys_days": 120},
+ {"max_unused_access_keys_days": 30},
+ ),
+ (
+ "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ {
+ "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+ "ConfigKey": "log_group_retention_days",
+ "Operator": "gte",
+ "Value": 365,
+ },
+ {"log_group_retention_days": 90},
+ {"log_group_retention_days": 365},
+ ),
+ (
+ "sqlserver_recommended_minimal_tls_version",
+ {
+ "Check": "sqlserver_recommended_minimal_tls_version",
+ "ConfigKey": "recommended_minimal_tls_versions",
+ "Operator": "subset",
+ "Value": ["1.2", "1.3"],
+ },
+ {"recommended_minimal_tls_versions": ["1.0", "1.2", "1.3"]},
+ {"recommended_minimal_tls_versions": ["1.3"]},
+ ),
+ (
+ "acm_certificates_with_secure_key_algorithms",
+ {
+ "Check": "acm_certificates_with_secure_key_algorithms",
+ "ConfigKey": "insecure_key_algorithms",
+ "Operator": "superset",
+ "Value": ["RSA-1024", "P-192"],
+ },
+ {"insecure_key_algorithms": ["P-192"]},
+ {"insecure_key_algorithms": ["RSA-1024", "P-192"]},
+ ),
+]
+
+
+class Test_OCSF_Config_Requirements:
+ @pytest.mark.parametrize(
+ "check,constraint,bad,ok",
+ _CASES,
+ ids=[c[1]["Operator"] for c in _CASES],
+ )
+ def test_violating_config_fails_requirement(self, check, constraint, bad, ok):
+ cf = _run(check, constraint, bad)
+ assert cf.compliance.status_id == ComplianceStatusID.Fail
+ assert "Configuration not valid" in cf.message
+
+ @pytest.mark.parametrize(
+ "check,constraint,bad,ok",
+ _CASES,
+ ids=[c[1]["Operator"] for c in _CASES],
+ )
+ def test_valid_config_keeps_pass(self, check, constraint, bad, ok):
+ cf = _run(check, constraint, ok)
+ assert cf.compliance.status_id == ComplianceStatusID.Pass
+ assert "Configuration not valid" not in cf.message
+
+ def test_absent_config_assumes_default_ok(self):
+ check, constraint, _bad, _ok = _CASES[0]
+ cf = _run(check, constraint, {})
+ assert cf.compliance.status_id == ComplianceStatusID.Pass
diff --git a/tests/lib/outputs/compliance/universal/ocsf_compliance_status_scoping_test.py b/tests/lib/outputs/compliance/universal/ocsf_compliance_status_scoping_test.py
new file mode 100644
index 0000000000..8408868296
--- /dev/null
+++ b/tests/lib/outputs/compliance/universal/ocsf_compliance_status_scoping_test.py
@@ -0,0 +1,129 @@
+"""Top-level status consistency and provider scoping for the OCSF output.
+
+Two regressions are covered here:
+
+1. The event's top-level ``status_code``/``status_detail`` must reflect the
+ effective (config-aware) status, so a config-invalid PASS cannot produce an
+ event where ``compliance.status_id`` says FAIL while ``status_code`` still
+ says PASS. The nested Check object keeps the raw finding status.
+2. Provider scoping: an Azure-scoped constraint must never affect an AWS output
+ even when the global provider would otherwise be relied upon.
+"""
+
+from datetime import datetime, timezone
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from py_ocsf_models.objects.compliance_status import StatusID as ComplianceStatusID
+
+from prowler.lib.check.compliance_models import (
+ ComplianceFramework,
+ OutputsConfig,
+ TableConfig,
+ UniversalComplianceRequirement,
+)
+from prowler.lib.outputs.compliance.universal.ocsf_compliance import (
+ OCSFComplianceOutput,
+)
+
+_MODULE = "prowler.providers.common.provider.Provider.get_global_provider"
+
+
+def _finding(check_id, status="PASS", provider="aws"):
+ finding = SimpleNamespace()
+ finding.provider = provider
+ finding.account_uid = "123456789012"
+ finding.account_name = "test-account"
+ finding.account_organization_uid = "org-123"
+ finding.account_organization_name = "test-org"
+ finding.region = "us-east-1"
+ finding.status = status
+ finding.status_extended = f"{check_id} is {status}"
+ finding.resource_uid = f"arn:aws:iam::123456789012:{check_id}"
+ finding.resource_name = check_id
+ finding.resource_details = "details"
+ finding.resource_metadata = {}
+ finding.resource_tags = {"Name": "test"}
+ finding.partition = "aws"
+ finding.muted = False
+ finding.check_id = check_id
+ finding.uid = "test-finding-uid"
+ finding.timestamp = datetime(2025, 1, 15, 12, 0, 0, tzinfo=timezone.utc)
+ finding.prowler_version = "5.0.0"
+ finding.metadata = SimpleNamespace(
+ CheckID=check_id,
+ CheckTitle=f"Title for {check_id}",
+ Description=f"Description for {check_id}",
+ Severity="medium",
+ ServiceName="iam",
+ ResourceType="aws-iam-role",
+ )
+ return finding
+
+
+def _framework(constraint, provider="AWS", check_provider="aws"):
+ req = UniversalComplianceRequirement(
+ id="REQ-1",
+ description="Requirement REQ-1",
+ attributes={},
+ checks={check_provider: ["check_a"]},
+ config_requirements=[constraint],
+ )
+ return ComplianceFramework(
+ framework="TestFW",
+ name="Test Framework",
+ provider=provider,
+ version="1.0",
+ description="Test framework",
+ requirements=[req],
+ attributes_metadata=None,
+ outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+ )
+
+
+def _run(framework, audit_config, provider="aws", status="PASS"):
+ findings = [_finding("check_a", status, provider)]
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ mock_gp.return_value.type = provider
+ out = OCSFComplianceOutput(
+ findings=findings, framework=framework, provider=provider
+ )
+ return out.data[0]
+
+
+_CONSTRAINT = {
+ "Check": "check_a",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45,
+}
+
+
+class Test_OCSF_TopLevel_Status:
+ def test_config_invalid_pass_forces_toplevel_fail(self):
+ event = _run(_framework(_CONSTRAINT), {"max_unused_access_keys_days": 120})
+ # Top-level and nested compliance status agree: both FAIL.
+ assert event.compliance.status_id == ComplianceStatusID.Fail
+ assert event.status_code == "FAIL"
+ assert "Configuration not valid" in event.status_detail
+ assert event.status_detail == event.message
+ # The nested Check preserves the raw finding result.
+ assert event.compliance.checks[0].status == "PASS"
+
+ def test_valid_config_keeps_toplevel_pass(self):
+ event = _run(_framework(_CONSTRAINT), {"max_unused_access_keys_days": 30})
+ assert event.compliance.status_id == ComplianceStatusID.Pass
+ assert event.status_code == "PASS"
+ assert "Configuration not valid" not in event.status_detail
+
+
+class Test_OCSF_Provider_Scoping:
+ def test_azure_constraint_does_not_affect_aws_output(self):
+ constraint = {**_CONSTRAINT, "Provider": "azure"}
+ event = _run(
+ _framework(constraint), {"max_unused_access_keys_days": 120}, provider="aws"
+ )
+ assert event.compliance.status_id == ComplianceStatusID.Pass
+ assert event.status_code == "PASS"
+ assert "Configuration not valid" not in event.status_detail
diff --git a/tests/lib/outputs/compliance/universal/universal_output_config_requirements_test.py b/tests/lib/outputs/compliance/universal/universal_output_config_requirements_test.py
new file mode 100644
index 0000000000..dd83dad575
--- /dev/null
+++ b/tests/lib/outputs/compliance/universal/universal_output_config_requirements_test.py
@@ -0,0 +1,115 @@
+"""Coverage for ConfigRequirements + provider scoping in the universal CSV.
+
+The universal CSV must apply the same effective-status logic as the OCSF/table
+outputs: a config-invalid PASS is reported as FAIL instead of leaking the raw
+finding status. Provider scoping must also hold, so a constraint scoped to
+another provider (e.g. Azure) never affects this provider's output (e.g. AWS).
+"""
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from prowler.lib.check.compliance_models import (
+ AttributeMetadata,
+ ComplianceFramework,
+ OutputsConfig,
+ TableConfig,
+ UniversalComplianceRequirement,
+)
+from prowler.lib.outputs.compliance.universal.universal_output import (
+ UniversalComplianceOutput,
+)
+
+_MODULE = "prowler.providers.common.provider.Provider.get_global_provider"
+
+
+def _make_finding(check_id, status="PASS", provider="aws"):
+ finding = SimpleNamespace()
+ finding.provider = provider
+ finding.account_uid = "123456789012"
+ finding.account_name = "test-account"
+ finding.region = "us-east-1"
+ finding.status = status
+ finding.status_extended = f"{check_id} is {status}"
+ finding.resource_uid = f"arn:aws:iam::123456789012:{check_id}"
+ finding.resource_name = check_id
+ finding.muted = False
+ finding.check_id = check_id
+ finding.metadata = SimpleNamespace(Provider=provider, CheckID=check_id)
+ finding.compliance = {}
+ return finding
+
+
+def _make_framework(constraint, provider="AWS", check_provider="aws"):
+ req = UniversalComplianceRequirement(
+ id="1.1",
+ description="test requirement",
+ attributes={"Section": "IAM"},
+ checks={check_provider: ["check_a"]},
+ config_requirements=[constraint],
+ )
+ return ComplianceFramework(
+ framework="TestFW",
+ name="Test Framework",
+ provider=provider,
+ version="1.0",
+ description="Test framework",
+ requirements=[req],
+ attributes_metadata=[AttributeMetadata(key="Section", type="str")],
+ outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+ )
+
+
+def _run(framework, audit_config, provider="aws", status="PASS"):
+ findings = [_make_finding("check_a", status, provider)]
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ mock_gp.return_value.type = provider
+ out = UniversalComplianceOutput(
+ findings=findings, framework=framework, provider=provider
+ )
+ return out.data[0].dict()
+
+
+class Test_Universal_CSV_Config_Requirements:
+ _CONSTRAINT = {
+ "Check": "check_a",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45,
+ }
+
+ def test_violating_config_forces_fail(self):
+ fw = _make_framework(self._CONSTRAINT)
+ row = _run(fw, {"max_unused_access_keys_days": 120})
+ assert row["Status"] == "FAIL"
+ assert "Configuration not valid" in row["StatusExtended"]
+
+ def test_valid_config_keeps_pass(self):
+ fw = _make_framework(self._CONSTRAINT)
+ row = _run(fw, {"max_unused_access_keys_days": 30})
+ assert row["Status"] == "PASS"
+ assert "Configuration not valid" not in row["StatusExtended"]
+
+ def test_absent_config_assumes_default_ok(self):
+ fw = _make_framework(self._CONSTRAINT)
+ row = _run(fw, {})
+ assert row["Status"] == "PASS"
+
+
+class Test_Universal_CSV_Provider_Scoping:
+ def test_azure_constraint_does_not_affect_aws_output(self):
+ """An Azure-scoped constraint must not force an AWS output to FAIL."""
+ constraint = {
+ "Check": "check_a",
+ "ConfigKey": "max_unused_access_keys_days",
+ "Operator": "lte",
+ "Value": 45,
+ "Provider": "azure",
+ }
+ fw = _make_framework(constraint)
+ # Even with a config that *would* violate the constraint, the AWS output
+ # must keep PASS because the constraint is scoped to Azure.
+ row = _run(fw, {"max_unused_access_keys_days": 120}, provider="aws")
+ assert row["Status"] == "PASS"
+ assert "Configuration not valid" not in row["StatusExtended"]
diff --git a/tests/lib/outputs/compliance/universal/universal_table_config_requirements_test.py b/tests/lib/outputs/compliance/universal/universal_table_config_requirements_test.py
new file mode 100644
index 0000000000..3ac8dc6d8b
--- /dev/null
+++ b/tests/lib/outputs/compliance/universal/universal_table_config_requirements_test.py
@@ -0,0 +1,155 @@
+"""Integration coverage for ConfigRequirements in the console table generators.
+
+The table generators aggregate pass/fail counts, so a requirement whose config
+is too loose must count its (otherwise PASS) finding as FAIL. Driven through the
+universal table renderer, which backs the table output for every framework using
+the shared ``get_effective_status`` helper."""
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from prowler.lib.check.compliance_models import (
+ ComplianceFramework,
+ OutputsConfig,
+ TableConfig,
+ UniversalComplianceRequirement,
+)
+from prowler.lib.outputs.compliance.universal.universal_table import get_universal_table
+
+_MODULE = "prowler.providers.common.provider.Provider.get_global_provider"
+_CHECK = "securityhub_enabled"
+
+
+def _finding(status="PASS"):
+ return SimpleNamespace(
+ check_metadata=SimpleNamespace(CheckID=_CHECK), status=status, muted=False
+ )
+
+
+# The overview table is only printed when there is more than one finding, so the
+# tests use two PASS findings (both mapping the constrained check).
+_FINDINGS = [_finding("PASS"), _finding("PASS")]
+
+
+def _framework():
+ req = UniversalComplianceRequirement(
+ id="1.1",
+ description="region check",
+ attributes={"Section": "Monitoring"},
+ checks={"aws": [_CHECK]},
+ config_requirements=[
+ {
+ "Check": _CHECK,
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+ ],
+ )
+ return ComplianceFramework(
+ framework="TestFW",
+ name="Test Framework",
+ provider="AWS",
+ version="1.0",
+ description="Test",
+ requirements=[req],
+ outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+ )
+
+
+def _render(audit_config, capsys, output_directory):
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = audit_config
+ get_universal_table(
+ findings=_FINDINGS,
+ bulk_checks_metadata={},
+ compliance_framework_name="testfw_1.0_aws",
+ output_filename="out",
+ output_directory=str(output_directory),
+ compliance_overview=False,
+ framework=_framework(),
+ provider="aws",
+ )
+ return capsys.readouterr().out
+
+
+class Test_Universal_Table_Config_Requirements:
+ def test_violating_config_counts_pass_finding_as_fail(self, capsys, tmp_path):
+ out = _render({"mute_non_default_regions": True}, capsys, tmp_path)
+ assert "FAIL(2)" in out
+ assert "PASS(2)" not in out
+
+ def test_valid_config_keeps_pass_count(self, capsys, tmp_path):
+ out = _render({"mute_non_default_regions": False}, capsys, tmp_path)
+ assert "PASS(2)" in out
+ assert "FAIL(2)" not in out
+
+ def test_absent_config_keeps_pass_count(self, capsys, tmp_path):
+ out = _render({}, capsys, tmp_path)
+ assert "PASS(2)" in out
+ assert "FAIL(2)" not in out
+
+
+def _framework_two_requirements():
+ """Same check evidences two requirements; only one carries a guardrail.
+
+ Drives the double-count scenario: with the config violated, the shared
+ finding is FAIL for the constrained requirement and PASS for the other, so
+ its index would land in both pass and fail counts without FAIL precedence.
+ """
+ constrained = UniversalComplianceRequirement(
+ id="1.1",
+ description="region check",
+ attributes={"Section": "Monitoring"},
+ checks={"aws": [_CHECK]},
+ config_requirements=[
+ {
+ "Check": _CHECK,
+ "Provider": "aws",
+ "ConfigKey": "mute_non_default_regions",
+ "Operator": "eq",
+ "Value": False,
+ }
+ ],
+ )
+ unconstrained = UniversalComplianceRequirement(
+ id="2.1",
+ description="other check",
+ attributes={"Section": "Logging"},
+ checks={"aws": [_CHECK]},
+ )
+ return ComplianceFramework(
+ framework="TestFW",
+ name="Test Framework",
+ provider="AWS",
+ version="1.0",
+ description="Test",
+ requirements=[constrained, unconstrained],
+ outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+ )
+
+
+class Test_Universal_Table_Multi_Requirement_Dedup:
+ def test_finding_in_two_requirements_counted_once_with_fail_precedence(
+ self, capsys, tmp_path
+ ):
+ # mute=True violates the constrained requirement → each shared PASS
+ # finding must be counted once as FAIL in the overview, not double
+ # counted as both PASS and FAIL across the two requirements it maps.
+ with patch(_MODULE) as mock_gp:
+ mock_gp.return_value.audit_config = {"mute_non_default_regions": True}
+ mock_gp.return_value.type = "aws"
+ get_universal_table(
+ findings=_FINDINGS,
+ bulk_checks_metadata={},
+ compliance_framework_name="testfw_1.0_aws",
+ output_filename="out",
+ output_directory=str(tmp_path),
+ compliance_overview=True,
+ framework=_framework_two_requirements(),
+ provider="aws",
+ )
+ out = capsys.readouterr().out
+ # Two findings, each counted once as FAIL → 100% FAIL, 0 PASS.
+ assert "(2) FAIL" in out
+ assert "(0) PASS" in out
diff --git a/tests/lib/outputs/finding_test.py b/tests/lib/outputs/finding_test.py
index f843cb8f00..1315970201 100644
--- a/tests/lib/outputs/finding_test.py
+++ b/tests/lib/outputs/finding_test.py
@@ -1627,6 +1627,40 @@ class TestFinding:
assert finding_output.status == Status.PASS
assert finding_output.muted is False
+ @patch(
+ "prowler.lib.outputs.finding.get_check_compliance",
+ new=mock_get_check_compliance,
+ )
+ def test_generate_output_e2enetworks(self):
+ provider = MagicMock()
+ provider.type = "e2enetworks"
+ provider.identity.project_id = 12345
+
+ check_output = MagicMock()
+ check_output.resource_id = "test_resource_id"
+ check_output.resource_name = "test_resource_name"
+ check_output.resource_details = ""
+ check_output.location = "Delhi"
+ check_output.status = Status.PASS
+ check_output.status_extended = "mock_status_extended"
+ check_output.muted = False
+ check_output.check_metadata = mock_check_metadata(provider="e2enetworks")
+ check_output.resource = {}
+ check_output.compliance = {}
+
+ output_options = MagicMock()
+ output_options.unix_timestamp = True
+
+ finding_output = Finding.generate_output(provider, check_output, output_options)
+
+ assert isinstance(finding_output, Finding)
+ assert finding_output.auth_method == "api_key_and_bearer_token"
+ assert finding_output.account_uid == "12345"
+ assert finding_output.account_name == "12345"
+ assert finding_output.resource_name == "test_resource_name"
+ assert finding_output.resource_uid == "test_resource_id"
+ assert finding_output.region == "Delhi"
+
def test_transform_api_finding_stackit(self):
provider = MagicMock()
provider.type = "stackit"
diff --git a/tests/lib/outputs/html/html_test.py b/tests/lib/outputs/html/html_test.py
index 536e40f808..3eccc8ba8d 100644
--- a/tests/lib/outputs/html/html_test.py
+++ b/tests/lib/outputs/html/html_test.py
@@ -999,6 +999,38 @@ class TestHTML:
assert "<b>Project ID:</b> f033ea6d-8697-40eb-a60e-acfa9128480d" in summary
assert "<b>Project Name:</b>" not in summary
+ def test_e2enetworks_get_assessment_summary(self):
+ """Test E2E Networks HTML assessment summary shows project and locations."""
+ findings = [generate_finding_output()]
+ output = HTML(findings)
+
+ provider = MagicMock()
+ provider.type = "e2enetworks"
+ provider.identity.project_id = 12345
+ provider.identity.locations = ["Delhi", "Chennai"]
+
+ summary = output.get_assessment_summary(provider)
+
+ assert "E2E Networks Assessment Summary" in summary
+ assert "<b>Project ID:</b> 12345" in summary
+ assert "<b>Locations:</b> Delhi, Chennai" in summary
+ assert "API Key + Bearer Token" in summary
+
+ def test_e2enetworks_get_assessment_summary_escapes_locations(self):
+ """Test E2E Networks HTML assessment summary escapes user-controlled locations."""
+ findings = [generate_finding_output()]
+ output = HTML(findings)
+
+ provider = MagicMock()
+ provider.type = "e2enetworks"
+ provider.identity.project_id = 12345
+ provider.identity.locations = ['Delhi"><script>alert(1)</script>']
+
+ summary = output.get_assessment_summary(provider)
+
+ assert "<script>alert(1)</script>" not in summary
+ assert "Delhi"><script>alert(1)</script>" in summary
+
def test_process_markdown_bold_text(self):
"""Test that **text** is converted to <strong>text</strong>"""
test_text = "This is **bold text** and this is **also bold**"
diff --git a/tests/lib/outputs/jira/jira_test.py b/tests/lib/outputs/jira/jira_test.py
index 76352cb297..f38c1ba376 100644
--- a/tests/lib/outputs/jira/jira_test.py
+++ b/tests/lib/outputs/jira/jira_test.py
@@ -16,8 +16,11 @@ from prowler.lib.outputs.jira.exceptions.exceptions import (
JiraGetProjectsError,
JiraGetProjectsResponseError,
JiraNoProjectsError,
+ JiraNoTokenError,
JiraRefreshTokenError,
+ JiraRefreshTokenResponseError,
JiraRequiredCustomFieldsError,
+ JiraSendFindingsResponseError,
JiraTestConnectionError,
)
from prowler.lib.outputs.jira.jira import Jira
@@ -53,7 +56,7 @@ class TestJiraIntegration:
self.user_mail = "test_user_mail"
self.api_token = "test_api_token"
- self.domain = "test_domain"
+ self.domain = "test-domain"
self.jira_integration_basic_auth = Jira(
user_mail=self.user_mail,
@@ -95,6 +98,41 @@ class TestJiraIntegration:
return found
return None
+ @staticmethod
+ def _find_link_mark_by_href(nodes: List[dict], href: str) -> Optional[dict]:
+ for node in nodes:
+ if node.get("type") == "text":
+ for mark in node.get("marks", []):
+ if (
+ mark.get("type") == "link"
+ and mark.get("attrs", {}).get("href") == href
+ ):
+ return mark
+ found = TestJiraIntegration._find_link_mark_by_href(
+ node.get("content", []), href
+ )
+ if found:
+ return found
+ return None
+
+ @staticmethod
+ def _collect_link_texts_by_href(nodes: List[dict], href: str) -> List[str]:
+ link_texts: List[str] = []
+
+ for node in nodes:
+ if node.get("type") == "text" and any(
+ mark.get("type") == "link" and mark.get("attrs", {}).get("href") == href
+ for mark in node.get("marks", [])
+ ):
+ link_texts.append(node.get("text", ""))
+ link_texts.extend(
+ TestJiraIntegration._collect_link_texts_by_href(
+ node.get("content", []), href
+ )
+ )
+
+ return link_texts
+
@staticmethod
def _find_table_row(rows: List[dict], header: str) -> dict:
for row in rows:
@@ -383,6 +421,35 @@ class TestJiraIntegration:
assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+ @pytest.mark.parametrize(
+ "domain",
+ (
+ "169.254.169.254#",
+ "internal/service",
+ "internal?target",
+ "internal\\target",
+ "internal:8000",
+ "user@internal",
+ ),
+ )
+ @patch("prowler.lib.outputs.jira.jira.requests.get")
+ def test_get_cloud_id_basic_auth_rejects_invalid_domain(self, mock_get, domain):
+ with pytest.raises(JiraGetCloudIDError):
+ self.jira_integration_basic_auth.get_cloud_id(domain=domain)
+
+ mock_get.assert_not_called()
+
+ @patch("prowler.lib.outputs.jira.jira.requests.get")
+ def test_get_cloud_id_basic_auth_disables_redirects(self, mock_get):
+ mock_response = MagicMock()
+ mock_response.status_code = 200
+ mock_response.json.return_value = {"cloudId": "test_cloud_id"}
+ mock_get.return_value = mock_response
+
+ self.jira_integration_basic_auth.get_cloud_id(domain=self.domain)
+
+ assert mock_get.call_args.kwargs["allow_redirects"] is False
+
@patch("prowler.lib.outputs.jira.jira.requests.post")
def test_refresh_access_token_sends_timeout(self, mock_post):
"""refresh_access_token must pass a request timeout."""
@@ -886,6 +953,12 @@ class TestJiraIntegration:
intro_text = intro_paragraph["content"][0]
assert intro_text["type"] == "text"
assert intro_text["text"] == "Prowler has discovered the following finding:"
+ assert all(
+ self._collect_text_from_cell({"content": node.get("content", [])})
+ != "Summary"
+ for node in description_content
+ if node.get("type") == "heading"
+ )
table = description_content[1]
assert table["type"] == "table"
@@ -1169,6 +1242,218 @@ class TestJiraIntegration:
value_cell = row["content"][1]
assert self._collect_text_from_cell(value_cell) == "-"
+ def test_get_grouped_adf_description_uses_capped_finding_group_link_copy(self):
+ finding_group_url = (
+ "https://security.example.com/findings?"
+ "filter%5Bcheck_id%5D=admincenter_users_admins_reduced_license_footprint&"
+ "expandedCheckId=admincenter_users_admins_reduced_license_footprint"
+ )
+ finding_group_link_text = "View the remaining grouped findings."
+ recommendation_url = (
+ "https://hub.prowler.com/check/"
+ "admincenter_users_admins_reduced_license_footprint"
+ )
+ adf_description = self.jira_integration.get_grouped_adf_description(
+ check_id="admincenter_users_admins_reduced_license_footprint",
+ check_title="Administrative user has no license or an allowed license",
+ check_description="Administrative users are assigned productivity licenses.",
+ severity="HIGH",
+ status="FAIL",
+ provider="m365",
+ service="exchange",
+ affected_failing_resources=123,
+ last_seen="Jul 09, 2026 11:38AM UTC",
+ failing_for="< 1 day",
+ grouped_resources=[
+ {
+ "resource_name": "rich@prowler.com",
+ "resource_uid": "3f9a216b-b66b-4d5d-a812-2ad538732cfb",
+ "provider": "m365",
+ "service": "exchange",
+ "provider_account": "ProwlerPro.onmicrosoft.com",
+ "status": "FAIL",
+ "severity": "high",
+ "region": "global",
+ "last_seen": "Jul 09, 2026 11:38AM UTC",
+ "failing_for": "< 1 day",
+ "triage": "Open",
+ }
+ ],
+ resources_total=123,
+ resources_shown=100,
+ finding_group_url=finding_group_url,
+ finding_group_link_text=finding_group_link_text,
+ risk="Productivity licenses on privileged identities create risk.",
+ recommendation_text="Maintain dedicated admin accounts.",
+ recommendation_url=recommendation_url,
+ )
+
+ assert adf_description["type"] == "doc"
+ assert self._find_empty_text_nodes(adf_description) == []
+
+ main_table = adf_description["content"][1]
+ main_rows = {}
+ for row in main_table["content"]:
+ key_cell, value_cell = row["content"]
+ main_rows[self._collect_text_from_cell(key_cell)] = (
+ self._collect_text_from_cell(value_cell)
+ )
+
+ assert (
+ main_rows["Check Id"]
+ == "admincenter_users_admins_reduced_license_footprint"
+ )
+ assert main_rows["Service"] == "exchange"
+ assert main_rows["Affected Failing Resources"] == "123"
+ assert (
+ main_rows["Risk"]
+ == "Productivity licenses on privileged identities create risk."
+ )
+ assert main_rows["Recommendation"] == (
+ "Maintain dedicated admin accounts. " + recommendation_url
+ )
+ assert "Finding Group Link" not in main_rows
+ assert "Region" not in main_rows
+
+ top_level_headings = [
+ self._collect_text_from_cell({"content": node.get("content", [])})
+ for node in adf_description["content"]
+ if node.get("type") == "heading"
+ ]
+ assert "Risk" not in top_level_headings
+ assert "Recommendation" not in top_level_headings
+ assert "Summary" not in top_level_headings
+
+ def text_marks(cell: dict) -> list[dict]:
+ return cell["content"][0]["content"][0]["marks"]
+
+ severity_marks = text_marks(
+ self._find_table_row(main_table["content"], "Severity")["content"][1]
+ )
+ status_marks = text_marks(
+ self._find_table_row(main_table["content"], "Status")["content"][1]
+ )
+ assert {
+ "type": "backgroundColor",
+ "attrs": {"color": "#FFA500"},
+ } in severity_marks
+ assert {"type": "textColor", "attrs": {"color": "#FF0000"}} in status_marks
+
+ resource_table = next(
+ node
+ for node in adf_description["content"]
+ if node.get("type") == "table"
+ and self._collect_text_from_cell(node["content"][0]["content"][0])
+ == "Resource"
+ )
+ resource_cells = resource_table["content"][1]["content"]
+ assert {"type": "textColor", "attrs": {"color": "#FF0000"}} in text_marks(
+ resource_cells[5]
+ )
+ assert {
+ "type": "backgroundColor",
+ "attrs": {"color": "#FFA500"},
+ } in text_marks(resource_cells[6])
+
+ document_text = self._collect_text_from_cell(
+ {"content": adf_description["content"]}
+ )
+ assert (
+ "Administrative users are assigned productivity licenses."
+ not in document_text
+ )
+ assert "Affected failing resources" in document_text
+ capped_link_copy = (
+ f"Showing 100 of 123 Findings in this Jira issue. {finding_group_link_text}"
+ )
+ assert document_text.count(capped_link_copy) == 1
+ assert "Finding Group Link" not in document_text
+ assert recommendation_url in document_text
+ recommendation_link_mark = self._find_link_mark_by_href(
+ adf_description["content"], recommendation_url
+ )
+ assert recommendation_link_mark is not None
+ link_mark = self._find_link_mark_by_href(
+ adf_description["content"], finding_group_url
+ )
+ assert link_mark is not None
+ assert link_mark["attrs"]["href"] == finding_group_url
+ assert self._collect_link_texts_by_href(
+ adf_description["content"], finding_group_url
+ ) == [finding_group_link_text]
+ assert (
+ len(
+ self._collect_link_texts_by_href(
+ adf_description["content"], finding_group_url
+ )
+ )
+ == 1
+ )
+ assert "filter%5Bcheck_id%5D=" in link_mark["attrs"]["href"]
+ assert "expandedCheckId=" in link_mark["attrs"]["href"]
+
+ def test_get_grouped_adf_description_includes_link_when_not_capped(self):
+ finding_group_url = (
+ "https://security.example.com/findings?"
+ "filter%5Bcheck_id%5D=s3_bucket_public_access&"
+ "expandedCheckId=s3_bucket_public_access"
+ )
+ finding_group_link_text = "View this grouped finding."
+ adf_description = self.jira_integration.get_grouped_adf_description(
+ check_id="s3_bucket_public_access",
+ check_title="S3 bucket public access",
+ severity="HIGH",
+ status="FAIL",
+ provider="aws",
+ service="s3",
+ affected_failing_resources=1,
+ grouped_resources=[
+ {
+ "resource_name": "bucket-a",
+ "resource_uid": "arn:aws:s3:::bucket-a",
+ "provider": "aws",
+ "service": "s3",
+ "provider_account": "production (123456789012)",
+ "status": "FAIL",
+ "severity": "high",
+ "region": "us-east-1",
+ "last_seen": "Jul 09, 2026 11:38AM UTC",
+ "failing_for": "< 1 day",
+ "triage": "Open",
+ }
+ ],
+ resources_total=1,
+ resources_shown=1,
+ finding_group_url=finding_group_url,
+ finding_group_link_text=finding_group_link_text,
+ )
+
+ document_text = self._collect_text_from_cell(
+ {"content": adf_description["content"]}
+ )
+ assert "Showing 1 of 1 Findings." not in document_text
+ assert "remaining Findings" not in document_text
+ assert document_text.count(finding_group_link_text) == 1
+ assert "Finding Group Link" not in document_text
+ main_table = adf_description["content"][1]
+ main_row_headers = [
+ self._collect_text_from_cell(row["content"][0])
+ for row in main_table["content"]
+ ]
+ assert "Finding Group Link" not in main_row_headers
+ link_mark = self._find_link_mark_by_href(
+ adf_description["content"], finding_group_url
+ )
+ assert link_mark is not None
+ assert link_mark["attrs"]["href"] == finding_group_url
+ assert self._collect_link_texts_by_href(
+ adf_description["content"], finding_group_url
+ ) == [finding_group_link_text]
+ assert (
+ "filter%5Bcheck_id%5D=s3_bucket_public_access" in link_mark["attrs"]["href"]
+ )
+ assert "expandedCheckId=s3_bucket_public_access" in link_mark["attrs"]["href"]
+
@patch.object(Jira, "get_access_token", return_value="valid_access_token")
@patch.object(
Jira, "get_available_issue_types", return_value=["Bug", "Task", "Story"]
@@ -1677,6 +1962,54 @@ class TestJiraIntegration:
assert result is True
mock_post.assert_called_once()
+ @patch.object(Jira, "get_access_token", return_value="valid_access_token")
+ @patch.object(
+ Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
+ )
+ @patch.object(Jira, "get_projects", return_value={"TEST": {"name": "Test Project"}})
+ @patch.object(Jira, "get_available_issue_types", return_value=["Bug"])
+ @patch("prowler.lib.outputs.jira.jira.requests.post")
+ def test_send_finding_sanitizes_summary_control_characters(
+ self,
+ mock_post,
+ mock_get_issue_types,
+ mock_get_projects,
+ mock_cloud_id,
+ mock_get_access_token,
+ ):
+ """Test that Jira summary is sent as one line."""
+ # To disable vulture
+ mock_cloud_id = mock_cloud_id
+ mock_get_access_token = mock_get_access_token
+ mock_get_projects = mock_get_projects
+ mock_get_issue_types = mock_get_issue_types
+
+ mock_response = MagicMock()
+ mock_response.status_code = 201
+ mock_response.json.return_value = {"id": "ISSUE-123", "key": "TEST-123"}
+ mock_post.return_value = mock_response
+ long_check_id = "check\nwith\rcontrol\tcharacters " + "x" * 260
+
+ result = self.jira_integration.send_finding(
+ check_id=long_check_id,
+ check_title="Test Finding",
+ severity="High\n",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ affected_failing_resources=2,
+ grouped_resources=[],
+ )
+
+ assert result is True
+ payload = mock_post.call_args.kwargs["json"]
+ expected_summary = (
+ f"[Prowler] HIGH - {' '.join(long_check_id.split())} - "
+ "2 affected failing resources"
+ )[:255]
+ assert payload["fields"]["summary"] == expected_summary
+ assert len(payload["fields"]["summary"]) == 255
+
@patch.object(Jira, "get_access_token", return_value="valid_access_token")
@patch.object(
Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
@@ -1692,7 +2025,7 @@ class TestJiraIntegration:
mock_cloud_id,
mock_get_access_token,
):
- """Test that send_finding returns False when the request fails."""
+ """Test that send_finding raises with Jira JSON error details."""
# To disable vulture
mock_cloud_id = mock_cloud_id
mock_get_access_token = mock_get_access_token
@@ -1702,19 +2035,66 @@ class TestJiraIntegration:
# Mock failed response
mock_response = MagicMock()
mock_response.status_code = 400
- mock_response.json.return_value = {"errors": {"summary": "Required field"}}
+ mock_response.json.return_value = {
+ "errors": {"Team": "Team is required."},
+ "errorMessages": ["Field 'Team' cannot be set."],
+ }
mock_post.return_value = mock_response
- result = self.jira_integration.send_finding(
- check_id="test-check",
- check_title="Test Finding",
- severity="High",
- status="FAIL",
- project_key="TEST",
- issue_type="Bug",
- )
+ with pytest.raises(JiraSendFindingsResponseError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
- assert result is False
+ assert "Failed to create Jira issue" in str(error.value)
+ assert "'Team': 'Team is required.'" in str(error.value)
+ assert "Field 'Team' cannot be set." in str(error.value)
+ mock_post.assert_called_once()
+
+ @patch.object(Jira, "get_access_token", return_value="valid_access_token")
+ @patch.object(
+ Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
+ )
+ @patch.object(Jira, "get_projects", return_value={"TEST": {"name": "Test Project"}})
+ @patch.object(Jira, "get_available_issue_types", return_value=["Bug"])
+ @patch("prowler.lib.outputs.jira.jira.requests.post")
+ def test_send_finding_response_error_without_json_body(
+ self,
+ mock_post,
+ mock_get_issue_types,
+ mock_get_projects,
+ mock_cloud_id,
+ mock_get_access_token,
+ ):
+ """Test send_finding raises with status-code context for non-JSON errors."""
+ # To disable vulture
+ mock_cloud_id = mock_cloud_id
+ mock_get_access_token = mock_get_access_token
+ mock_get_projects = mock_get_projects
+ mock_get_issue_types = mock_get_issue_types
+
+ mock_response = MagicMock()
+ mock_response.status_code = 502
+ mock_response.json.side_effect = ValueError("No JSON body")
+ mock_post.return_value = mock_response
+
+ with pytest.raises(JiraSendFindingsResponseError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
+
+ assert "Failed to create Jira issue" in str(error.value)
+ assert "Jira returned status code 502" in str(error.value)
mock_post.assert_called_once()
@patch.object(Jira, "get_access_token", return_value="valid_access_token")
@@ -1732,7 +2112,7 @@ class TestJiraIntegration:
mock_cloud_id,
mock_get_access_token,
):
- """Test that send_finding returns False when custom fields cause an error."""
+ """Test that send_finding raises when custom fields cause an error."""
# To disable vulture
mock_cloud_id = mock_cloud_id
mock_get_access_token = mock_get_access_token
@@ -1750,18 +2130,89 @@ class TestJiraIntegration:
}
mock_post.return_value = mock_response
- result = self.jira_integration.send_finding(
- check_id="test-check",
- check_title="Test Finding",
- severity="High",
- status="FAIL",
- project_key="TEST",
- issue_type="Bug",
- )
+ with pytest.raises(JiraRequiredCustomFieldsError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
- assert result is False
+ assert "Jira project requires custom fields" in str(error.value)
+ assert "customfield_10001" in str(error.value)
mock_post.assert_called_once()
+ @patch.object(
+ Jira,
+ "get_access_token",
+ side_effect=JiraRefreshTokenError(message="Failed to refresh the access token"),
+ )
+ def test_send_finding_reraises_refresh_token_error(self, mock_get_access_token):
+ """Test send_finding re-raises refresh token errors for API propagation."""
+ # To disable vulture
+ mock_get_access_token = mock_get_access_token
+
+ with pytest.raises(JiraRefreshTokenError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
+
+ assert error.value.message == "Failed to refresh the access token"
+
+ @patch.object(Jira, "get_access_token", return_value=None)
+ def test_send_finding_reraises_no_token_error(self, mock_get_access_token):
+ """Test send_finding re-raises missing token errors for API propagation."""
+ # To disable vulture
+ mock_get_access_token = mock_get_access_token
+
+ with pytest.raises(JiraNoTokenError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
+
+ assert error.value.message == "No token was found"
+
+ @patch.object(
+ Jira,
+ "get_access_token",
+ side_effect=JiraRefreshTokenResponseError(
+ message="Failed to refresh the access token, response code did not match 200"
+ ),
+ )
+ def test_send_finding_reraises_refresh_token_response_error(
+ self, mock_get_access_token
+ ):
+ """Test send_finding re-raises refresh token response errors for API propagation."""
+ # To disable vulture
+ mock_get_access_token = mock_get_access_token
+
+ with pytest.raises(JiraRefreshTokenResponseError) as error:
+ self.jira_integration.send_finding(
+ check_id="test-check",
+ check_title="Test Finding",
+ severity="High",
+ status="FAIL",
+ project_key="TEST",
+ issue_type="Bug",
+ )
+
+ assert (
+ error.value.message
+ == "Failed to refresh the access token, response code did not match 200"
+ )
+
def test_get_headers_oauth_with_access_token(self):
"""Test get_headers returns correct OAuth headers with access token."""
self.jira_integration._using_basic_auth = False
diff --git a/tests/lib/outputs/outputs_test.py b/tests/lib/outputs/outputs_test.py
index ca18717847..fad6f4d286 100644
--- a/tests/lib/outputs/outputs_test.py
+++ b/tests/lib/outputs/outputs_test.py
@@ -1293,3 +1293,23 @@ class TestReport:
with mock.patch("builtins.print") as mocked_print:
report([finding], provider, output_options)
mocked_print.assert_called()
+
+ def test_report_with_e2enetworks_provider(self):
+ finding = MagicMock()
+ finding.status = "PASS"
+ finding.muted = False
+ finding.location = "Delhi"
+ finding.check_metadata.Provider = "e2enetworks"
+ finding.status_extended = "Node has no public IP assigned"
+
+ output_options = MagicMock()
+ output_options.verbose = True
+ output_options.status = ["PASS", "FAIL"]
+ output_options.fixer = False
+
+ provider = MagicMock()
+ provider.type = "e2enetworks"
+
+ with mock.patch("builtins.print") as mocked_print:
+ report([finding], provider, output_options)
+ mocked_print.assert_called()
diff --git a/tests/lib/outputs/summary_table_test.py b/tests/lib/outputs/summary_table_test.py
index 0c842225cc..57e39efb94 100644
--- a/tests/lib/outputs/summary_table_test.py
+++ b/tests/lib/outputs/summary_table_test.py
@@ -72,6 +72,34 @@ class TestDisplaySummaryTable:
assert "Project" in captured.out
assert "my-prod-env" in captured.out
+ def test_e2enetworks_summary(self, capsys):
+ provider = SimpleNamespace(
+ type="e2enetworks",
+ identity=SimpleNamespace(project_id=12345),
+ )
+ output_options = SimpleNamespace(
+ output_directory="out",
+ output_filename="report",
+ output_modes=[],
+ )
+ findings = [
+ SimpleNamespace(
+ status="PASS",
+ muted=False,
+ check_metadata=SimpleNamespace(
+ ServiceName="node",
+ Provider="e2enetworks",
+ Severity="high",
+ ),
+ )
+ ]
+
+ display_summary_table(findings, provider, output_options)
+
+ captured = capsys.readouterr()
+ assert "Project" in captured.out
+ assert "12345" in captured.out
+
def test_stackit_summary_with_project_id_only(self, capsys):
provider = SimpleNamespace(
type="stackit",
diff --git a/tests/lib/resource_limit_test.py b/tests/lib/resource_limit_test.py
new file mode 100644
index 0000000000..ad2f3a292f
--- /dev/null
+++ b/tests/lib/resource_limit_test.py
@@ -0,0 +1,156 @@
+from prowler.lib.resource_limit import (
+ get_resource_scan_limit,
+ iter_limited_paginator_items,
+ limit_resources,
+)
+
+
+class FakePaginator:
+ def __init__(self, pages):
+ self.pages = pages
+ self.paginate_calls = []
+ self.pages_requested = 0
+
+ def paginate(self, **kwargs):
+ self.paginate_calls.append(kwargs)
+ for page in self.pages:
+ self.pages_requested += 1
+ yield page
+
+
+class Test_limit_resources:
+ def test_no_limit_returns_all_in_order(self):
+ resources = ["PASS", "FAIL", "PASS"]
+
+ result = list(limit_resources(iter(resources), None))
+
+ assert result == ["PASS", "FAIL", "PASS"]
+
+
+class Test_iter_limited_paginator_items:
+ def test_positive_limit_stops_without_page_size(self):
+ paginator = FakePaginator(
+ [
+ {"Items": [1, 2]},
+ {"Items": [3, 4]},
+ {"Items": [5]},
+ ]
+ )
+
+ result = list(iter_limited_paginator_items(paginator, "Items", 3))
+
+ assert result == [1, 2, 3]
+ assert paginator.paginate_calls == [{}]
+ assert paginator.pages_requested == 2
+
+ def test_absurd_limit_is_not_sent_as_page_size(self):
+ paginator = FakePaginator([{"Items": [1, 2]}])
+
+ result = list(iter_limited_paginator_items(paginator, "Items", 200000))
+
+ assert result == [1, 2]
+ assert paginator.paginate_calls == [{}]
+
+ def test_operation_parameters_are_forwarded_unchanged(self):
+ paginator = FakePaginator([{"Snapshots": ["snapshot"]}])
+
+ result = list(
+ iter_limited_paginator_items(
+ paginator,
+ "Snapshots",
+ 1,
+ OwnerIds=["self"],
+ )
+ )
+
+ assert result == ["snapshot"]
+ assert paginator.paginate_calls == [{"OwnerIds": ["self"]}]
+
+ def test_item_filter_limits_selected_items_only(self):
+ paginator = FakePaginator(
+ [
+ {"Items": [{"arn": "skip"}, {"arn": "first"}]},
+ {"Items": [{"arn": "second"}, {"arn": "third"}]},
+ ]
+ )
+
+ result = list(
+ iter_limited_paginator_items(
+ paginator,
+ "Items",
+ 2,
+ item_filter=lambda item: item["arn"] != "skip",
+ )
+ )
+
+ assert result == [{"arn": "first"}, {"arn": "second"}]
+ assert paginator.pages_requested == 2
+
+ def test_limit_zero_or_negative_is_unlimited(self):
+ resources = list(range(5))
+
+ assert list(limit_resources(iter(resources), 0)) == resources
+ assert list(limit_resources(iter(resources), -3)) == resources
+
+ def test_positive_limit_stops_after_selected_resources(self):
+ pulled = []
+
+ def gen():
+ for i in range(1000):
+ pulled.append(i)
+ yield i
+
+ result = list(limit_resources(gen(), 100))
+
+ assert result == list(range(100))
+ assert len(pulled) == 100
+
+ def test_does_not_reorder_or_inspect_resource_status(self):
+ resources = ["PASS", "FAIL", "PASS", "FAIL"]
+
+ result = list(limit_resources(iter(resources), 3))
+
+ assert result == ["PASS", "FAIL", "PASS"]
+
+
+class Test_get_resource_scan_limit:
+ def test_per_service_override_wins(self):
+ config = {
+ "max_scanned_resources_per_service": 100,
+ "max_ecs_task_definitions": 25,
+ }
+ assert get_resource_scan_limit(config, "max_ecs_task_definitions") == 25
+
+ def test_falls_back_to_global_default(self):
+ config = {"max_scanned_resources_per_service": 50}
+ assert get_resource_scan_limit(config, "max_ecs_task_definitions") == 50
+
+ def test_null_per_service_override_falls_back_to_global_default(self):
+ config = {
+ "max_scanned_resources_per_service": 50,
+ "max_ecs_task_definitions": None,
+ }
+
+ assert get_resource_scan_limit(config, "max_ecs_task_definitions") == 50
+
+ def test_default_is_unlimited_when_unset(self):
+ assert get_resource_scan_limit({}, "max_ecs_task_definitions") is None
+
+ def test_null_per_service_override_falls_back_to_unlimited_global_default(self):
+ config = {"max_ecs_task_definitions": None}
+
+ assert get_resource_scan_limit(config, "max_ecs_task_definitions") is None
+
+ def test_non_positive_means_unlimited(self):
+ assert (
+ get_resource_scan_limit(
+ {"max_scanned_resources_per_service": 0}, "max_lambda_functions"
+ )
+ is None
+ )
+ assert (
+ get_resource_scan_limit(
+ {"max_lambda_functions": -1}, "max_lambda_functions"
+ )
+ is None
+ )
diff --git a/tests/lib/scan/scan_exclusions_test.py b/tests/lib/scan/scan_exclusions_test.py
new file mode 100644
index 0000000000..2c8f260c20
--- /dev/null
+++ b/tests/lib/scan/scan_exclusions_test.py
@@ -0,0 +1,178 @@
+"""Coverage for ``Scan`` constructor exclusion semantics.
+
+The Scan class is the single execution entry point used by both the CLI
+and the API worker. Its exclusion validation must:
+
+- Reject duplicates and unknown identifiers with actionable errors.
+- Validate excluded checks against the FULL provider catalog so a global
+ configuration can exclude a valid check that is not part of a scoped
+ run (see the SDK acceptance criteria for scan-configuration exclusions).
+- Refuse a configuration that would leave nothing to execute.
+- Produce a deterministic, sorted final scope.
+
+The catalog dependencies (``CheckMetadata.get_bulk``, ``Compliance.get_bulk``,
+``list_services``, ``load_checks_to_execute``) are patched so tests stay
+focused on the exclusion logic and avoid walking the provider package tree.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from prowler.lib.scan.exceptions.exceptions import (
+ ScanInvalidCheckError,
+ ScanInvalidServiceError,
+)
+from prowler.lib.scan.scan import Scan
+from tests.providers.aws.utils import set_mocked_aws_provider
+
+# The provider catalog for these tests: three checks spread across two
+# services (``accessanalyzer`` and ``s3``). Keeps assertions readable.
+PROVIDER_CATALOG = {
+ "accessanalyzer_enabled",
+ "s3_bucket_encryption_enabled",
+ "s3_bucket_public_access",
+}
+PROVIDER_SERVICES = ["accessanalyzer", "s3"]
+
+
+@pytest.fixture
+def scan_provider():
+ provider = set_mocked_aws_provider()
+ metadata = MagicMock()
+ metadata.Categories = []
+ bulk = {check: metadata for check in PROVIDER_CATALOG}
+
+ with (
+ patch(
+ "prowler.lib.scan.scan.CheckMetadata.get_bulk",
+ return_value=bulk,
+ ),
+ patch("prowler.lib.scan.scan.Compliance.get_bulk", return_value={}),
+ patch(
+ "prowler.lib.scan.scan.update_checks_metadata_with_compliance",
+ side_effect=lambda _compliance, checks: checks,
+ ),
+ patch(
+ "prowler.lib.scan.scan.load_checks_to_execute",
+ side_effect=lambda **kwargs: set(kwargs["check_list"] or PROVIDER_CATALOG),
+ ),
+ patch(
+ "prowler.lib.scan.scan.list_services",
+ return_value=PROVIDER_SERVICES,
+ ),
+ ):
+ yield provider
+
+
+class Test_Exclusion_No_Ops:
+ def test_none_lists_are_no_ops(self, scan_provider):
+ scan = Scan(scan_provider, excluded_checks=None, excluded_services=None)
+ assert scan.checks_to_execute == sorted(PROVIDER_CATALOG)
+
+ def test_empty_lists_are_no_ops(self, scan_provider):
+ scan = Scan(scan_provider, excluded_checks=[], excluded_services=[])
+ assert scan.checks_to_execute == sorted(PROVIDER_CATALOG)
+
+
+class Test_Excluded_Checks:
+ def test_valid_check_is_removed_from_the_scope(self, scan_provider):
+ scan = Scan(
+ scan_provider,
+ excluded_checks=["s3_bucket_public_access"],
+ )
+ assert scan.checks_to_execute == sorted(
+ PROVIDER_CATALOG - {"s3_bucket_public_access"}
+ )
+
+ def test_excluded_check_may_be_outside_the_selected_scope(self, scan_provider):
+ # ``s3_bucket_public_access`` is not in the explicitly selected
+ # ``checks`` list but is still a valid provider check, so the
+ # global exclusion must be accepted and be a no-op for this run.
+ scan = Scan(
+ scan_provider,
+ checks=["accessanalyzer_enabled"],
+ excluded_checks=["s3_bucket_public_access"],
+ )
+ assert scan.checks_to_execute == ["accessanalyzer_enabled"]
+
+ def test_unknown_check_is_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidCheckError):
+ Scan(scan_provider, excluded_checks=["not_a_real_check"])
+
+ def test_duplicate_checks_are_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidCheckError):
+ Scan(
+ scan_provider,
+ excluded_checks=[
+ "s3_bucket_public_access",
+ "s3_bucket_public_access",
+ ],
+ )
+
+
+class Test_Excluded_Services:
+ def test_service_exclusion_removes_every_check_in_the_service(self, scan_provider):
+ scan = Scan(scan_provider, excluded_services=["s3"])
+ assert scan.checks_to_execute == ["accessanalyzer_enabled"]
+
+ def test_unknown_service_is_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidServiceError):
+ Scan(scan_provider, excluded_services=["not_a_real_service"])
+
+ def test_duplicate_services_are_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidServiceError):
+ Scan(scan_provider, excluded_services=["s3", "s3"])
+
+
+class Test_Combined_Exclusions:
+ def test_selected_checks_plus_excluded_checks_and_services(self, scan_provider):
+ scan = Scan(
+ scan_provider,
+ checks=["accessanalyzer_enabled", "s3_bucket_encryption_enabled"],
+ excluded_checks=["s3_bucket_public_access"],
+ excluded_services=["s3"],
+ )
+ # The explicit ``checks`` selection is narrowed by both the
+ # excluded_checks (drops nothing extra here) and excluded_services
+ # (drops every s3 check), leaving accessanalyzer alone.
+ assert scan.checks_to_execute == ["accessanalyzer_enabled"]
+
+ def test_result_is_sorted_and_deterministic(self, scan_provider):
+ scan = Scan(
+ scan_provider,
+ excluded_checks=["s3_bucket_public_access"],
+ )
+ assert scan.checks_to_execute == sorted(scan.checks_to_execute)
+
+
+class Test_Empty_Final_Scope_Is_Rejected:
+ def test_excluding_every_service_is_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidCheckError):
+ Scan(scan_provider, excluded_services=PROVIDER_SERVICES)
+
+ def test_excluding_every_check_is_rejected(self, scan_provider):
+ with pytest.raises(ScanInvalidCheckError):
+ Scan(scan_provider, excluded_checks=sorted(PROVIDER_CATALOG))
+
+
+class Test_Already_Empty_Scope_Does_Not_Blame_Exclusions:
+ """When a positive filter (severity, categories, checks that resolve
+ to nothing) leaves the scope empty *before* exclusions run, the
+ exclusion pass must not falsely claim to be the cause. Otherwise the
+ real reason (empty selection) is masked by a misleading error."""
+
+ def test_empty_initial_scope_with_valid_exclusions_does_not_raise(
+ self, scan_provider
+ ):
+ # Force ``load_checks_to_execute`` to return an empty scope while
+ # keeping the exclusion inputs valid against the provider catalog.
+ with patch(
+ "prowler.lib.scan.scan.load_checks_to_execute",
+ return_value=set(),
+ ):
+ scan = Scan(
+ scan_provider,
+ excluded_checks=["s3_bucket_public_access"],
+ )
+ assert scan.checks_to_execute == []
diff --git a/tests/lib/timeline/models_test.py b/tests/lib/timeline/timeline_models_test.py
similarity index 100%
rename from tests/lib/timeline/models_test.py
rename to tests/lib/timeline/timeline_models_test.py
diff --git a/tests/lib/utils/utils_test.py b/tests/lib/utils/utils_test.py
index c8db5a62d0..c3340704de 100644
--- a/tests/lib/utils/utils_test.py
+++ b/tests/lib/utils/utils_test.py
@@ -1,4 +1,5 @@
import os
+import subprocess
import tempfile
from datetime import datetime
from time import mktime
@@ -7,7 +8,8 @@ import pytest
from mock import patch
from prowler.lib.utils.utils import (
- detect_secrets_scan,
+ SecretsScanError,
+ detect_secrets_scan_batch,
file_exists,
get_file_permissions,
hash_sha512,
@@ -20,6 +22,95 @@ from prowler.lib.utils.utils import (
)
+def _fake_kingfisher_run(output_content=None, returncode=0, stderr=""):
+ """Build a ``subprocess.run`` replacement that mimics a Kingfisher call.
+
+ When ``output_content`` is given it is written to the ``--output`` path from
+ the command (so the reader sees realistic file content); the call returns a
+ CompletedProcess with the requested ``returncode``/``stderr``.
+ """
+
+ def _run(command, *_args, **_kwargs):
+ if output_content is not None:
+ output_path = command[command.index("--output") + 1]
+ with open(output_path, "w") as output_file:
+ output_file.write(output_content)
+ return subprocess.CompletedProcess(
+ command, returncode, stdout="", stderr=stderr
+ )
+
+ return _run
+
+
+def _fake_kingfisher_run_with_findings(findings):
+ """Build a ``subprocess.run`` replacement that emits crafted findings.
+
+ Each entry in ``findings`` is a ``(payload_index, line)`` pair: the finding
+ is mapped back to the temp file named ``str(payload_index)`` (the basename
+ ``_scan_batch_chunk`` writes per payload) and given the requested ``line``
+ value (omitted entirely when ``line`` is the sentinel ``_OMIT``). Returns a
+ success exit code so only the finding shape is under test.
+ """
+
+ def _run(command, *_args, **_kwargs):
+ output_path = command[command.index("--output") + 1]
+ entries = []
+ for payload_index, line in findings:
+ finding = {"path": str(payload_index), "snippet": "secret"}
+ if line is not _OMIT:
+ finding["line"] = line
+ entries.append({"finding": finding, "rule": {"name": "Generic Secret"}})
+ import json as _json
+
+ with open(output_path, "w") as output_file:
+ output_file.write(_json.dumps({"findings": entries}))
+ return subprocess.CompletedProcess(command, 200, stdout="", stderr="")
+
+ return _run
+
+
+_OMIT = object()
+
+
+class Test_detect_secrets_scan_batch_invalid_line:
+ """Kingfisher's ``line`` is consumed as a trusted 1-based index by checks
+ (e.g. CloudWatch ``events[line_number - 1]``). A malformed line must fail
+ closed as SecretsScanError, never return a finding with a bad index."""
+
+ @pytest.mark.parametrize(
+ "line",
+ [_OMIT, None, "2", 0, -1, 5, True],
+ ids=["missing", "none", "string", "zero", "negative", "out_of_range", "bool"],
+ )
+ def test_invalid_line_raises(self, line):
+ # Payload "data" is a single line, so any line other than 1 is invalid.
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run_with_findings([(0, line)]),
+ ):
+ with pytest.raises(SecretsScanError) as exc:
+ detect_secrets_scan_batch({"a": "data"})
+ assert "invalid line number" in str(exc.value)
+
+ def test_valid_line_is_returned(self):
+ # A valid in-range line must still pass through to the caller.
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run_with_findings([(0, 1)]),
+ ):
+ results = detect_secrets_scan_batch({"a": "data"})
+ assert results["a"][0]["line_number"] == 1
+
+ def test_one_invalid_line_aborts_the_whole_scan(self):
+ # Even mixed with a valid finding, a single invalid line fails closed.
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run_with_findings([(0, 1), (1, 0)]),
+ ):
+ with pytest.raises(SecretsScanError):
+ detect_secrets_scan_batch({"a": "data", "b": "data"})
+
+
class Test_utils_open_file:
def test_open_read_file(self):
temp_data_file = tempfile.NamedTemporaryFile(delete=False)
@@ -108,75 +199,108 @@ class Test_utils_validate_ip_address:
assert not validate_ip_address("Not an IP")
-class Test_detect_secrets_scan:
- def test_detect_secrets_scan_data(self):
- data = "password=password"
- secrets_detected = detect_secrets_scan(data=data, excluded_secrets=[])
- assert type(secrets_detected) is list
- assert len(secrets_detected) == 1
- assert "filename" in secrets_detected[0]
- assert "hashed_secret" in secrets_detected[0]
- assert "is_verified" in secrets_detected[0]
- assert secrets_detected[0]["line_number"] == 1
- assert secrets_detected[0]["type"] == "Secret Keyword"
-
- def test_detect_secrets_scan_no_secrets_data(self):
- data = ""
- assert detect_secrets_scan(data=data) is None
-
- def test_detect_secrets_scan_file_with_secrets(self):
- temp_data_file = tempfile.NamedTemporaryFile(delete=False)
- temp_data_file.write(b"password=password")
- temp_data_file.seek(0)
- secrets_detected = detect_secrets_scan(
- file=temp_data_file.name, excluded_secrets=[]
+class Test_detect_secrets_scan_batch:
+ def test_batch_returns_findings_per_key(self):
+ results = detect_secrets_scan_batch(
+ {
+ "a": 'password = "Tr0ub4dor3xKq9vLmZ"',
+ "b": "just a normal config = value",
+ }
)
- assert type(secrets_detected) is list
- assert len(secrets_detected) == 1
- assert "filename" in secrets_detected[0]
- assert "hashed_secret" in secrets_detected[0]
- assert "is_verified" in secrets_detected[0]
- assert secrets_detected[0]["line_number"] == 1
- assert secrets_detected[0]["type"] == "Secret Keyword"
- os.remove(temp_data_file.name)
+ assert "a" in results
+ assert results["a"][0]["type"] == "Generic Password"
+ # keys without findings are omitted
+ assert "b" not in results
- def test_detect_secrets_scan_file_no_secrets(self):
- temp_data_file = tempfile.NamedTemporaryFile(delete=False)
- temp_data_file.write(b"no secrets")
- temp_data_file.seek(0)
- assert detect_secrets_scan(file=temp_data_file.name) is None
- os.remove(temp_data_file.name)
+ def test_batch_no_dedup_reports_identical_secret_in_each_key(self):
+ # The same secret in two payloads must be reported for both (matches
+ # scanning each payload individually).
+ secret = "token = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ results = detect_secrets_scan_batch({"a": secret, "b": secret})
+ assert "a" in results
+ assert "b" in results
- def test_detect_secrets_using_regex(self):
- data = "MYSQL_ALLOW_EMPTY_PASSWORD=password"
- secrets_detected = detect_secrets_scan(
- data=data, excluded_secrets=[".*password"]
+ def test_batch_excluded_secrets_filters(self):
+ results = detect_secrets_scan_batch(
+ {"a": 'DB_ALLOW_EMPTY_PASSWORD = "Tr0ub4dor3xKq9vLmZ"'},
+ excluded_secrets=[".*ALLOW_EMPTY_PASSWORD.*"],
)
- assert secrets_detected is None
+ assert results == {}
- def test_detect_secrets_using_regex_file(self):
- temp_data_file = tempfile.NamedTemporaryFile(delete=False)
- temp_data_file.write(b"MYSQL_ALLOW_EMPTY_PASSWORD=password")
- temp_data_file.seek(0)
- secrets_detected = detect_secrets_scan(
- file=temp_data_file.name, excluded_secrets=[".*password"]
- )
- assert secrets_detected is None
- os.remove(temp_data_file.name)
+ def test_batch_chunking_maps_all_keys(self):
+ payloads = {f"k{i}": f'password = "S3cr3tV4lu3xy{i}z"' for i in range(5)}
+ results = detect_secrets_scan_batch(payloads, chunk_size=2)
+ assert sorted(results.keys()) == ["k0", "k1", "k2", "k3", "k4"]
- def test_detect_secrets_secrets_using_regex(self):
- data = "MYSQL_ALLOW_EMPTY_PASSWORD=password, MYSQL_PASSWORD=password"
- # Update the regex to exclude only the exact key "MYSQL_ALLOW_EMPTY_PASSWORD"
- secrets_detected = detect_secrets_scan(
- data=data, excluded_secrets=["^MYSQL_ALLOW_EMPTY_PASSWORD$"]
+ def test_batch_empty_payloads(self):
+ assert detect_secrets_scan_batch({}) == {}
+
+ def test_batch_accepts_iterable_of_pairs(self):
+ results = detect_secrets_scan_batch(
+ iter([("x", 'password = "Tr0ub4dor3xKq9vLmZ"')])
)
- assert type(secrets_detected) is list
- assert len(secrets_detected) == 1
- assert "filename" in secrets_detected[0]
- assert "hashed_secret" in secrets_detected[0]
- assert "is_verified" in secrets_detected[0]
- assert secrets_detected[0]["line_number"] == 1
- assert secrets_detected[0]["type"] == "Secret Keyword"
+ assert "x" in results
+
+
+class Test_detect_secrets_scan_batch_failures:
+ """A scanner failure must surface as SecretsScanError, never as empty
+ results (which a caller would read as 'no secrets found')."""
+
+ def test_non_zero_exit_code_raises(self):
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run(returncode=1, stderr="boom"),
+ ):
+ with pytest.raises(SecretsScanError) as exc:
+ detect_secrets_scan_batch({"a": "data"})
+ assert "exited with code 1" in str(exc.value)
+ assert "boom" in str(exc.value)
+
+ def test_timeout_raises(self):
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=subprocess.TimeoutExpired(cmd="kingfisher", timeout=300),
+ ):
+ with pytest.raises(SecretsScanError) as exc:
+ detect_secrets_scan_batch({"a": "data"})
+ assert "timed out" in str(exc.value)
+
+ def test_malformed_json_output_raises(self):
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run(
+ output_content="{not valid json", returncode=0
+ ),
+ ):
+ with pytest.raises(SecretsScanError):
+ detect_secrets_scan_batch({"a": "data"})
+
+ def test_missing_binary_raises(self):
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=FileNotFoundError("kingfisher binary not found"),
+ ):
+ with pytest.raises(SecretsScanError):
+ detect_secrets_scan_batch({"a": "data"})
+
+ def test_empty_output_is_not_a_failure(self):
+ # Empty output means the scan ran and found nothing; it must NOT raise.
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run(output_content="", returncode=0),
+ ):
+ assert detect_secrets_scan_batch({"a": "data"}) == {}
+
+ def test_failure_in_any_chunk_aborts_the_whole_scan(self):
+ # A failure in any chunk must abort the whole scan, not silently return
+ # partial results from the chunks that happened to succeed first.
+ payloads = {f"k{i}": "data" for i in range(4)}
+ with patch(
+ "prowler.lib.utils.utils.subprocess.run",
+ side_effect=_fake_kingfisher_run(returncode=2, stderr="boom"),
+ ):
+ with pytest.raises(SecretsScanError):
+ detect_secrets_scan_batch(payloads, chunk_size=2)
class Test_hash_sha512:
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_tde_key_custom/__init__.py b/tests/providers/alibabacloud/services/rds/rds_instance_tde_key_custom/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/securitycenter/__init__.py b/tests/providers/alibabacloud/services/securitycenter/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/securitycenter/securitycenter_all_assets_agent_installed/__init__.py b/tests/providers/alibabacloud/services/securitycenter/securitycenter_all_assets_agent_installed/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/securitycenter/securitycenter_vulnerability_scan_enabled/__init__.py b/tests/providers/alibabacloud/services/securitycenter/securitycenter_vulnerability_scan_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/__init__.py b/tests/providers/alibabacloud/services/sls/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/sls_logstore_retention_period/__init__.py b/tests/providers/alibabacloud/services/sls/sls_logstore_retention_period/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/sls_management_console_authentication_failures_alert_enabled/__init__.py b/tests/providers/alibabacloud/services/sls/sls_management_console_authentication_failures_alert_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/sls_management_console_signin_without_mfa_alert_enabled/__init__.py b/tests/providers/alibabacloud/services/sls/sls_management_console_signin_without_mfa_alert_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/sls_root_account_usage_alert_enabled/__init__.py b/tests/providers/alibabacloud/services/sls/sls_root_account_usage_alert_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/sls/sls_unauthorized_api_calls_alert_enabled/__init__.py b/tests/providers/alibabacloud/services/sls/sls_unauthorized_api_calls_alert_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/vpc/__init__.py b/tests/providers/alibabacloud/services/vpc/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/alibabacloud/services/vpc/vpc_flow_logs_enabled/__init__.py b/tests/providers/alibabacloud/services/vpc/vpc_flow_logs_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/aws_regions_by_service.json b/tests/providers/aws/aws_regions_by_service.json
index e7eb2e28f6..6d53a88d8c 100644
--- a/tests/providers/aws/aws_regions_by_service.json
+++ b/tests/providers/aws/aws_regions_by_service.json
@@ -5916,4 +5916,4 @@
}
}
}
-}
\ No newline at end of file
+}
diff --git a/tests/providers/aws/lib/cloudtrail_timeline/__init__.py b/tests/providers/aws/lib/cloudtrail_timeline/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment_test.py b/tests/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment_test.py
new file mode 100644
index 0000000000..e78bf364d3
--- /dev/null
+++ b/tests/providers/aws/services/amplify/amplify_app_no_secrets_in_environment/amplify_app_no_secrets_in_environment_test.py
@@ -0,0 +1,194 @@
+from unittest import mock
+
+from prowler.lib.utils.utils import SecretsScanError
+from prowler.providers.aws.services.amplify.amplify_service import App, Branch
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+
+class Test_amplify_app_no_secrets_in_environment:
+ def test_no_apps(self):
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(amplify_client)
+
+ assert len(result) == 0
+
+ def test_app_with_no_secrets(self):
+ app = _build_app(
+ environment_variables={"key1": "val1"},
+ build_spec="version: 1\nfrontend:\n phases:\n build:\n commands:\n - echo hello",
+ branches=[
+ Branch(
+ name="main",
+ arn=f"arn:aws:amplify:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:apps/app-12345/branches/main",
+ environment_variables={"branch_key": "branch_val"},
+ )
+ ],
+ )
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {app.arn: app}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(amplify_client)
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "No secrets found in Amplify app test-app environment variables or build settings."
+ )
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "app-12345"
+ assert result[0].resource_arn == app.arn
+
+ def test_app_with_secrets_in_app_variables(self):
+ app = _build_app(
+ environment_variables={
+ "db_pass": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
+ build_spec="",
+ branches=[],
+ )
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {app.arn: app}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(amplify_client)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "app environment variable 'db_pass'" in result[0].status_extended
+
+ def test_app_with_secrets_in_branch_variables(self):
+ app = _build_app(
+ environment_variables={},
+ build_spec="",
+ branches=[
+ Branch(
+ name="dev",
+ arn=f"arn:aws:amplify:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:apps/app-12345/branches/dev",
+ environment_variables={
+ "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
+ )
+ ],
+ )
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {app.arn: app}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(amplify_client)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ "branch 'dev' environment variable 'api_key'" in result[0].status_extended
+ )
+
+ def test_app_with_secrets_in_build_spec(self):
+ app = _build_app(
+ environment_variables={},
+ build_spec="version: 1\nfrontend:\n phases:\n build:\n commands:\n - export JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
+ branches=[],
+ )
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {app.arn: app}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(amplify_client)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "app buildSpec line 6" in result[0].status_extended
+
+ def test_app_scan_error_marks_manual(self):
+ app = _build_app(
+ environment_variables={"key1": "val1"},
+ build_spec="version: 1",
+ branches=[],
+ )
+ amplify_client = mock.MagicMock()
+ amplify_client.apps = {app.arn: app}
+ amplify_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check_with_mocked_scan(
+ amplify_client,
+ side_effect=SecretsScanError("Scanner failure"),
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert (
+ "Could not scan Amplify app test-app environment variables for secrets: Scanner failure"
+ in result[0].status_extended
+ )
+
+
+def _build_app(environment_variables: dict, build_spec: str, branches: list) -> App:
+ app_id = "app-12345"
+ app_name = "test-app"
+ app_arn = (
+ f"arn:aws:amplify:{AWS_REGION_US_EAST_1}:" f"{AWS_ACCOUNT_NUMBER}:apps/{app_id}"
+ )
+ return App(
+ id=app_id,
+ name=app_name,
+ arn=app_arn,
+ region=AWS_REGION_US_EAST_1,
+ environment_variables=environment_variables,
+ build_spec=build_spec,
+ branches=branches,
+ tags=[],
+ )
+
+
+def _execute_check(amplify_client):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.amplify.amplify_app_no_secrets_in_environment.amplify_app_no_secrets_in_environment.amplify_client",
+ amplify_client,
+ ),
+ ):
+ from prowler.providers.aws.services.amplify.amplify_app_no_secrets_in_environment.amplify_app_no_secrets_in_environment import (
+ amplify_app_no_secrets_in_environment,
+ )
+
+ check = amplify_app_no_secrets_in_environment()
+ return check.execute()
+
+
+def _execute_check_with_mocked_scan(
+ amplify_client, return_value=None, side_effect=None
+):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.amplify.amplify_app_no_secrets_in_environment.amplify_app_no_secrets_in_environment.amplify_client",
+ amplify_client,
+ ),
+ ):
+ import prowler.providers.aws.services.amplify.amplify_app_no_secrets_in_environment.amplify_app_no_secrets_in_environment as check_module
+
+ with mock.patch.object(
+ check_module,
+ "detect_secrets_scan_batch",
+ return_value=return_value,
+ side_effect=side_effect,
+ ):
+ check = check_module.amplify_app_no_secrets_in_environment()
+ return check.execute()
diff --git a/tests/providers/aws/services/amplify/amplify_service_test.py b/tests/providers/aws/services/amplify/amplify_service_test.py
new file mode 100644
index 0000000000..90ff5b67ab
--- /dev/null
+++ b/tests/providers/aws/services/amplify/amplify_service_test.py
@@ -0,0 +1,91 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from prowler.providers.aws.services.amplify.amplify_service import Amplify, App, Branch
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+app_id = "app-12345"
+app_name = "test-app"
+app_arn = f"arn:aws:amplify:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:apps/{app_id}"
+branch_name = "main"
+branch_arn = f"{app_arn}/branches/{branch_name}"
+
+app_environment_variables = {"app_key": "app_val"}
+branch_environment_variables = {"branch_key": "branch_val"}
+build_spec = "version: 1"
+app_tags = {"tag_key": "tag_val"}
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+ if operation_name == "ListApps":
+ return {
+ "apps": [
+ {
+ "appId": app_id,
+ "name": app_name,
+ "appArn": app_arn,
+ "environmentVariables": app_environment_variables,
+ "buildSpec": build_spec,
+ "tags": app_tags,
+ }
+ ]
+ }
+ if operation_name == "ListBranches":
+ return {
+ "branches": [
+ {
+ "branchArn": branch_arn,
+ "branchName": branch_name,
+ "environmentVariables": branch_environment_variables,
+ }
+ ]
+ }
+ return make_api_call(self, operation_name, kwarg)
+
+
+def mock_generate_regional_clients(provider, service):
+ regional_client = provider._session.current_session.client(
+ service, region_name=AWS_REGION_US_EAST_1
+ )
+ regional_client.region = AWS_REGION_US_EAST_1
+ return {AWS_REGION_US_EAST_1: regional_client}
+
+
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+@patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_regional_clients,
+)
+class TestAmplifyService:
+ @mock_aws
+ def test_amplify_service(self):
+ amplify = Amplify(set_mocked_aws_provider([AWS_REGION_US_EAST_1]))
+
+ assert amplify.session.__class__.__name__ == "Session"
+ assert amplify.service == "amplify"
+ assert len(amplify.apps) == 1
+ assert isinstance(amplify.apps[app_arn], App)
+
+ app = amplify.apps[app_arn]
+ assert app.id == app_id
+ assert app.name == app_name
+ assert app.arn == app_arn
+ assert app.region == AWS_REGION_US_EAST_1
+ assert app.environment_variables == app_environment_variables
+ assert app.build_spec == build_spec
+ assert app.tags == [app_tags]
+
+ assert len(app.branches) == 1
+ branch = app.branches[0]
+ assert isinstance(branch, Branch)
+ assert branch.name == branch_name
+ assert branch.arn == branch_arn
+ assert branch.environment_variables == branch_environment_variables
diff --git a/tests/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables_test.py b/tests/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables_test.py
new file mode 100644
index 0000000000..8afb7b4fc8
--- /dev/null
+++ b/tests/providers/aws/services/apigateway/apigateway_restapi_no_secrets_in_stage_variables/apigateway_restapi_no_secrets_in_stage_variables_test.py
@@ -0,0 +1,325 @@
+from unittest import mock
+
+from boto3 import client
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+ AWS_REGION_EU_WEST_1,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+
+class Test_apigateway_restapi_no_secrets_in_stage_variables:
+ @mock_aws
+ def test_no_rest_apis(self):
+ from prowler.providers.aws.services.apigateway.apigateway_service import (
+ APIGateway,
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.apigateway_client",
+ new=APIGateway(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables import (
+ apigateway_restapi_no_secrets_in_stage_variables,
+ )
+
+ check = apigateway_restapi_no_secrets_in_stage_variables()
+ result = check.execute()
+
+ assert len(result) == 0
+
+ @mock_aws
+ def test_stage_with_no_variables(self):
+ apigw = client("apigateway", region_name=AWS_REGION_US_EAST_1)
+ rest_api = apigw.create_rest_api(name="test-api")
+ api_id = rest_api["id"]
+
+ root_id = apigw.get_resources(restApiId=api_id)["items"][0]["id"]
+ resource = apigw.create_resource(
+ restApiId=api_id, parentId=root_id, pathPart="test"
+ )
+ apigw.put_method(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ authorizationType="NONE",
+ )
+ apigw.put_integration(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ type="HTTP",
+ integrationHttpMethod="POST",
+ uri="http://test.com",
+ )
+ apigw.create_deployment(restApiId=api_id, stageName="prod")
+
+ from prowler.providers.aws.services.apigateway.apigateway_service import (
+ APIGateway,
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.apigateway_client",
+ new=APIGateway(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables import (
+ apigateway_restapi_no_secrets_in_stage_variables,
+ )
+
+ check = apigateway_restapi_no_secrets_in_stage_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == (
+ "No secrets found in stage variables of API Gateway "
+ "REST API test-api stage prod."
+ )
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "test-api/prod"
+
+ @mock_aws
+ def test_stage_with_safe_variables(self):
+ apigw = client("apigateway", region_name=AWS_REGION_US_EAST_1)
+ rest_api = apigw.create_rest_api(name="test-api")
+ api_id = rest_api["id"]
+
+ root_id = apigw.get_resources(restApiId=api_id)["items"][0]["id"]
+ resource = apigw.create_resource(
+ restApiId=api_id, parentId=root_id, pathPart="test"
+ )
+ apigw.put_method(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ authorizationType="NONE",
+ )
+ apigw.put_integration(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ type="HTTP",
+ integrationHttpMethod="POST",
+ uri="http://test.com",
+ )
+ apigw.create_deployment(restApiId=api_id, stageName="prod")
+ apigw.update_stage(
+ restApiId=api_id,
+ stageName="prod",
+ patchOperations=[
+ {
+ "op": "replace",
+ "path": "/variables/environment",
+ "value": "production",
+ },
+ {"op": "replace", "path": "/variables/region", "value": "us-east-1"},
+ ],
+ )
+
+ from prowler.providers.aws.services.apigateway.apigateway_service import (
+ APIGateway,
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.apigateway_client",
+ new=APIGateway(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables import (
+ apigateway_restapi_no_secrets_in_stage_variables,
+ )
+
+ check = apigateway_restapi_no_secrets_in_stage_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == (
+ "No secrets found in stage variables of API Gateway "
+ "REST API test-api stage prod."
+ )
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "test-api/prod"
+
+ @mock_aws
+ def test_stage_with_secrets_in_variables(self):
+ apigw = client("apigateway", region_name=AWS_REGION_US_EAST_1)
+ rest_api = apigw.create_rest_api(name="test-api")
+ api_id = rest_api["id"]
+
+ root_id = apigw.get_resources(restApiId=api_id)["items"][0]["id"]
+ resource = apigw.create_resource(
+ restApiId=api_id, parentId=root_id, pathPart="test"
+ )
+ apigw.put_method(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ authorizationType="NONE",
+ )
+ apigw.put_integration(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ type="HTTP",
+ integrationHttpMethod="POST",
+ uri="http://test.com",
+ )
+ apigw.create_deployment(restApiId=api_id, stageName="prod")
+ # A safe variable is added alongside the secret so the secret is not the
+ # only variable present. This guards the line-number -> variable-name
+ # mapping against an off-by-one that would otherwise still point at the
+ # single variable and pass unnoticed.
+ # A syntactically valid JSON Web Token that Kingfisher flags as a secret.
+ apigw.update_stage(
+ restApiId=api_id,
+ stageName="prod",
+ patchOperations=[
+ {
+ "op": "replace",
+ "path": "/variables/environment",
+ "value": "production",
+ },
+ {
+ "op": "replace",
+ "path": "/variables/api_token",
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
+ },
+ ],
+ )
+
+ from prowler.providers.aws.services.apigateway.apigateway_service import (
+ APIGateway,
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.apigateway_client",
+ new=APIGateway(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables import (
+ apigateway_restapi_no_secrets_in_stage_variables,
+ )
+
+ check = apigateway_restapi_no_secrets_in_stage_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "test-api" in result[0].status_extended
+ assert "prod" in result[0].status_extended
+ assert "in variable api_token" in result[0].status_extended
+ # The secret must be attributed to the correct variable, not the
+ # safe one that precedes it.
+ assert "in variable environment" not in result[0].status_extended
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "test-api/prod"
+
+ @mock_aws
+ def test_stage_with_variables_scan_error(self):
+ apigw = client("apigateway", region_name=AWS_REGION_US_EAST_1)
+ rest_api = apigw.create_rest_api(name="test-api")
+ api_id = rest_api["id"]
+
+ root_id = apigw.get_resources(restApiId=api_id)["items"][0]["id"]
+ resource = apigw.create_resource(
+ restApiId=api_id, parentId=root_id, pathPart="test"
+ )
+ apigw.put_method(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ authorizationType="NONE",
+ )
+ apigw.put_integration(
+ restApiId=api_id,
+ resourceId=resource["id"],
+ httpMethod="GET",
+ type="HTTP",
+ integrationHttpMethod="POST",
+ uri="http://test.com",
+ )
+ apigw.create_deployment(restApiId=api_id, stageName="prod")
+ apigw.update_stage(
+ restApiId=api_id,
+ stageName="prod",
+ patchOperations=[
+ {"op": "replace", "path": "/variables/api_token", "value": "value"},
+ ],
+ )
+
+ from prowler.lib.utils.utils import SecretsScanError
+ from prowler.providers.aws.services.apigateway.apigateway_service import (
+ APIGateway,
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.apigateway_client",
+ new=APIGateway(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher failed"),
+ ),
+ ):
+ from prowler.providers.aws.services.apigateway.apigateway_restapi_no_secrets_in_stage_variables.apigateway_restapi_no_secrets_in_stage_variables import (
+ apigateway_restapi_no_secrets_in_stage_variables,
+ )
+
+ check = apigateway_restapi_no_secrets_in_stage_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "manual review is required" in result[0].status_extended
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "test-api/prod"
diff --git a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration_test.py b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration_test.py
index 1005761834..ec45b89a49 100644
--- a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration_test.py
+++ b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/autoscaling_find_secrets_ec2_launch_configuration_test.py
@@ -104,7 +104,7 @@ class Test_autoscaling_find_secrets_ec2_launch_configuration:
InstanceType="t1.micro",
KeyName="the_keys",
SecurityGroups=["default", "default2"],
- UserData="DB_PASSWORD=foobar123",
+ UserData='DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"',
)
launch_configuration_arn = autoscaling_client.describe_launch_configurations(
LaunchConfigurationNames=[launch_configuration_name]
@@ -341,7 +341,9 @@ class Test_autoscaling_find_secrets_ec2_launch_configuration:
check = autoscaling_find_secrets_ec2_launch_configuration()
result = check.execute()
- assert len(result) == 0
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not decode User Data" in result[0].status_extended
@mock_aws
def test_one_autoscaling_file_invalid_gzip_error(self):
@@ -381,4 +383,6 @@ class Test_autoscaling_find_secrets_ec2_launch_configuration:
check = autoscaling_find_secrets_ec2_launch_configuration()
result = check.execute()
- assert len(result) == 0
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not decode User Data" in result[0].status_extended
diff --git a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture
index 2fb5138932..c591954ab4 100644
--- a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture
+++ b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture
@@ -1,4 +1,4 @@
-DB_PASSWORD=foobar123
+DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"
DB_USER=foo
-API_KEY=12345abcd
-SERVICE_PASSWORD=bbaabb45
+API_KEY=s3rv1c3Acc0untS3cr3tV4lu3x9
+SERVICE_PASSWORD="Xy9zPq2wKmRtVbN4"
diff --git a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture.gz b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture.gz
index 6120fcfbc4..15e68af70e 100644
Binary files a/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture.gz and b/tests/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture.gz differ
diff --git a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py
index 5f97082c1b..a68724da7f 100644
--- a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py
+++ b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py
@@ -1,3 +1,4 @@
+import os
import zipfile
from unittest import mock
@@ -19,7 +20,7 @@ LAMBDA_FUNCTION_RUNTIME = "nodejs4.3"
LAMBDA_FUNCTION_ARN = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:function/{LAMBDA_FUNCTION_NAME}"
LAMBDA_FUNCTION_CODE_WITH_SECRETS = """
def lambda_handler(event, context):
- db_password = "test-password"
+ db_password = "Tr0ub4dor3xKq9vLmZ"
print("custom log event")
return event
"""
@@ -53,6 +54,57 @@ def get_lambda_code_with_secrets(code):
)
+LAMBDA_DEPS_JSON_WITH_SECRET = """
+{
+ "runtimeTarget": { "name": ".NETCoreApp,Version=v8.0" },
+ "libraries": {
+ "AWSSDK.SecretsManager/3.7.0": {
+ "type": "package",
+ "password": "test-deps-json-password"
+ }
+ }
+}
+"""
+
+LAMBDA_VENDOR_JS_WITH_SECRET = """
+const dbPassword = "test-vendor-password";
+"""
+
+
+def get_lambda_code_from_files(files: dict) -> LambdaCode:
+ # The check only calls code_zip.extractall(dir); mock it to drop the
+ # given files into the temporary directory the check creates, so no
+ # real archive needs to be built.
+ code_zip = mock.MagicMock()
+
+ def _extractall(path):
+ for name, content in files.items():
+ os.makedirs(os.path.dirname(f"{path}/{name}"), exist_ok=True)
+ with open(f"{path}/{name}", "w") as fd:
+ fd.write(content)
+
+ code_zip.extractall.side_effect = _extractall
+ return LambdaCode(location="", code_zip=code_zip)
+
+
+def mock_get_function_code_with_deps_json_secret():
+ yield create_lambda_function(), get_lambda_code_from_files(
+ {
+ "lambda_function.py": LAMBDA_FUNCTION_CODE_WITHOUT_SECRETS,
+ "myapp.deps.json": LAMBDA_DEPS_JSON_WITH_SECRET,
+ }
+ )
+
+
+def mock_get_function_code_with_nested_vendor_secret():
+ yield create_lambda_function(), get_lambda_code_from_files(
+ {
+ "lambda_function.py": LAMBDA_FUNCTION_CODE_WITHOUT_SECRETS,
+ "vendor/package.js": LAMBDA_VENDOR_JS_WITH_SECRET,
+ }
+ )
+
+
def mock_get_function_codewith_secrets():
yield create_lambda_function(), get_lambda_code_with_secrets(
LAMBDA_FUNCTION_CODE_WITH_SECRETS
@@ -126,7 +178,7 @@ class Test_awslambda_function_no_secrets_in_code:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in Lambda function {LAMBDA_FUNCTION_NAME} code -> lambda_function.py: Secret Keyword on line 3."
+ == f"Potential secret found in Lambda function {LAMBDA_FUNCTION_NAME} code -> lambda_function.py: Generic Password on line 3."
)
assert result[0].resource_tags == []
@@ -201,3 +253,163 @@ class Test_awslambda_function_no_secrets_in_code:
== f"No secrets found in Lambda function {LAMBDA_FUNCTION_NAME} code."
)
assert result[0].resource_tags == []
+
+ def test_function_code_deps_json_secret_not_ignored(self):
+ lambda_client = mock.MagicMock
+ lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()}
+ lambda_client._get_function_code = mock_get_function_code_with_deps_json_secret
+ lambda_client.audit_config = {
+ "secrets_ignore_patterns": [],
+ "secrets_ignore_files": None,
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client",
+ new=lambda_client,
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+ awslambda_function_no_secrets_in_code,
+ )
+
+ check = awslambda_function_no_secrets_in_code()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "myapp.deps.json" in result[0].status_extended
+
+ def test_function_code_nested_vendor_secret_not_ignored(self):
+ lambda_client = mock.MagicMock
+ lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()}
+ lambda_client._get_function_code = (
+ mock_get_function_code_with_nested_vendor_secret
+ )
+ lambda_client.audit_config = {"secrets_ignore_patterns": []}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client",
+ new=lambda_client,
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+ awslambda_function_no_secrets_in_code,
+ )
+
+ check = awslambda_function_no_secrets_in_code()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "vendor/package.js" in result[0].status_extended
+
+ def test_function_code_nested_vendor_secret_ignored_by_file_pattern(self):
+ lambda_client = mock.MagicMock
+ lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()}
+ lambda_client._get_function_code = (
+ mock_get_function_code_with_nested_vendor_secret
+ )
+ lambda_client.audit_config = {
+ "secrets_ignore_patterns": [],
+ "secrets_ignore_files": ["vendor/*.js"],
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client",
+ new=lambda_client,
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+ awslambda_function_no_secrets_in_code,
+ )
+
+ check = awslambda_function_no_secrets_in_code()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_function_code_deps_json_secret_ignored_by_file_pattern(self):
+ lambda_client = mock.MagicMock
+ lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()}
+ lambda_client._get_function_code = mock_get_function_code_with_deps_json_secret
+ lambda_client.audit_config = {
+ "secrets_ignore_patterns": [],
+ "secrets_ignore_files": ["*.deps.json"],
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client",
+ new=lambda_client,
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+ awslambda_function_no_secrets_in_code,
+ )
+
+ check = awslambda_function_no_secrets_in_code()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == LAMBDA_FUNCTION_NAME
+ assert result[0].resource_arn == LAMBDA_FUNCTION_ARN
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"No secrets found in Lambda function {LAMBDA_FUNCTION_NAME} code."
+ )
+ assert result[0].resource_tags == []
+
+ def test_scan_failure_reports_manual_not_pass(self):
+ from prowler.lib.utils.utils import SecretsScanError
+
+ lambda_client = mock.MagicMock
+ lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()}
+ lambda_client._get_function_code = mock_get_function_codewith_secrets
+ lambda_client.audit_config = {"secrets_ignore_patterns": []}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client",
+ new=lambda_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+ awslambda_function_no_secrets_in_code,
+ )
+
+ check = awslambda_function_no_secrets_in_code()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
diff --git a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py
index 6ae517dfe2..f7ba14a7d3 100644
--- a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py
+++ b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py
@@ -97,7 +97,7 @@ class Test_awslambda_function_no_secrets_in_variables:
arn=function_arn,
region=AWS_REGION_US_EAST_1,
runtime=function_runtime,
- environment={"db_password": "test-password"},
+ environment={"db_password": "Tr0ub4dor3xKq9vLmZ"},
)
}
@@ -126,7 +126,7 @@ class Test_awslambda_function_no_secrets_in_variables:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in Lambda function {function_name} variables -> Secret Keyword in variable db_password."
+ == f"Potential secret found in Lambda function {function_name} variables -> Generic Password in variable db_password."
)
assert result[0].resource_tags == []
@@ -145,7 +145,69 @@ class Test_awslambda_function_no_secrets_in_variables:
arn=function_arn,
region=AWS_REGION_US_EAST_1,
runtime=function_runtime,
- environment={"db_password": "srv://admin:pass@db"},
+ environment={
+ "db_password": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client",
+ new=lambda_client,
+ ),
+ ):
+ # Test Check
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+ awslambda_function_no_secrets_in_variables,
+ )
+
+ check = awslambda_function_no_secrets_in_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == function_name
+ assert result[0].resource_arn == function_arn
+ assert result[0].status == "FAIL"
+ # Kingfisher reports both the generic keyword rule and the JWT rule
+ # for the same value; their order is not guaranteed, so assert on
+ # presence rather than a fixed concatenation order.
+ assert result[0].status_extended.startswith(
+ f"Potential secret found in Lambda function {function_name} variables -> "
+ )
+ assert (
+ "Generic Password in variable db_password" in result[0].status_extended
+ )
+ assert (
+ "JSON Web Token (base64url-encoded) in variable db_password"
+ in result[0].status_extended
+ )
+ assert result[0].resource_tags == []
+
+ def test_function_secrets_in_variables_telegram_token(self):
+ lambda_client = mock.MagicMock
+ function_name = "test-lambda"
+ function_runtime = "nodejs4.3"
+ function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:function/{function_name}"
+ lambda_client.audit_config = {"secrets_ignore_patterns": []}
+ lambda_client.functions = {
+ "function_name": Function(
+ name=function_name,
+ security_groups=[],
+ arn=function_arn,
+ region=AWS_REGION_US_EAST_1,
+ runtime=function_runtime,
+ environment={
+ # The Telegram bot-token rule is no longer enabled in
+ # Kingfisher's built-in ruleset, so a detectable JWT
+ # is used to keep this token-in-variable case meaningful.
+ "TELEGRAM_BOT_TOKEN": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
)
}
@@ -174,16 +236,22 @@ class Test_awslambda_function_no_secrets_in_variables:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in Lambda function {function_name} variables -> Secret Keyword in variable db_password, Basic Auth Credentials in variable db_password."
+ == f"Potential secret found in Lambda function {function_name} variables -> JSON Web Token (base64url-encoded) in variable TELEGRAM_BOT_TOKEN."
)
assert result[0].resource_tags == []
- def test_function_secrets_in_variables_telegram_token(self):
+ def test_function_with_verified_secret(self):
+ from prowler.lib.check.models import Severity
+
lambda_client = mock.MagicMock
function_name = "test-lambda"
function_runtime = "nodejs4.3"
function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:function/{function_name}"
- lambda_client.audit_config = {"secrets_ignore_patterns": []}
+ lambda_client.audit_config = {
+ "secrets_ignore_patterns": [],
+ "secrets_validate": True,
+ }
+
lambda_client.functions = {
"function_name": Function(
name=function_name,
@@ -191,19 +259,35 @@ class Test_awslambda_function_no_secrets_in_variables:
arn=function_arn,
region=AWS_REGION_US_EAST_1,
runtime=function_runtime,
- environment={"TELEGRAM_BOT_TOKEN": "telegram-token"},
+ environment={"db_password": "test-value"},
)
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
- return_value=set_mocked_aws_provider(),
+ return_value=set_mocked_aws_provider(
+ audit_config={"secrets_validate": True}
+ ),
),
mock.patch(
"prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client",
new=lambda_client,
),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
):
# Test Check
from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
@@ -213,16 +297,13 @@ class Test_awslambda_function_no_secrets_in_variables:
check = awslambda_function_no_secrets_in_variables()
result = check.execute()
+ # The check must forward secrets_validate from the config to the scan.
+ assert mock_scan.call_args.kwargs.get("validate") is True
assert len(result) == 1
- assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
assert result[0].resource_id == function_name
- assert result[0].resource_arn == function_arn
- assert result[0].status == "PASS"
- assert (
- result[0].status_extended
- == f"No secrets found in Lambda function {function_name} variables."
- )
- assert result[0].resource_tags == []
def test_function_no_secrets_in_variables(self):
lambda_client = mock.MagicMock
@@ -270,3 +351,48 @@ class Test_awslambda_function_no_secrets_in_variables:
== f"No secrets found in Lambda function {function_name} variables."
)
assert result[0].resource_tags == []
+
+ def test_scan_failure_reports_manual_not_pass(self):
+ # A scanner failure must not be treated as "no secrets found".
+ from prowler.lib.utils.utils import SecretsScanError
+
+ lambda_client = mock.MagicMock
+ function_name = "test-lambda"
+ function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:function/{function_name}"
+ lambda_client.audit_config = {"secrets_ignore_patterns": []}
+ lambda_client.functions = {
+ "function_name": Function(
+ name=function_name,
+ security_groups=[],
+ arn=function_arn,
+ region=AWS_REGION_US_EAST_1,
+ runtime="nodejs4.3",
+ environment={"db_password": "test-value"},
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client",
+ new=lambda_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+ awslambda_function_no_secrets_in_variables,
+ )
+
+ check = awslambda_function_no_secrets_in_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
+ assert "manual review is required" in result[0].status_extended
diff --git a/tests/providers/aws/services/awslambda/awslambda_service_test.py b/tests/providers/aws/services/awslambda/awslambda_service_test.py
index 412c944d8b..302b99d109 100644
--- a/tests/providers/aws/services/awslambda/awslambda_service_test.py
+++ b/tests/providers/aws/services/awslambda/awslambda_service_test.py
@@ -6,10 +6,16 @@ from re import search
from unittest.mock import patch
import mock
+import pytest
from boto3 import client, resource
+from botocore.client import ClientError
from moto import mock_aws
-from prowler.providers.aws.services.awslambda.awslambda_service import AuthType, Lambda
+from prowler.providers.aws.services.awslambda.awslambda_service import (
+ AuthType,
+ Function,
+ Lambda,
+)
from tests.providers.aws.utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
@@ -85,6 +91,367 @@ class Test_Lambda_Service:
awslambda = Lambda(set_mocked_aws_provider([AWS_REGION_US_EAST_1]))
assert awslambda.service == "lambda"
+ def test_function_limit_selects_latest_functions_for_analysis(self):
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.functions = {
+ "old": Function(
+ name="old",
+ arn="old",
+ security_groups=[],
+ last_modified="2024-01-01T00:00:00.000+0000",
+ region=AWS_REGION_EU_WEST_1,
+ ),
+ "new": Function(
+ name="new",
+ arn="new",
+ security_groups=[],
+ last_modified="2024-01-02T00:00:00.000+0000",
+ region=AWS_REGION_EU_WEST_1,
+ ),
+ }
+ awslambda.function_limit = 1
+
+ awslambda._select_functions_for_analysis()
+
+ assert list(awslambda.functions) == ["new"]
+
+ def test_function_limit_selects_global_latest_across_regions(self):
+ class FakePaginator:
+ def __init__(self, functions):
+ self.functions = functions
+
+ def paginate(self, **kwargs):
+ assert "PageSize" not in kwargs
+ return [{"Functions": self.functions}]
+
+ class FakeLambdaClient:
+ def __init__(self, region, functions):
+ self.region = region
+ self.functions = functions
+
+ def get_paginator(self, name):
+ assert name == "list_functions"
+ return FakePaginator(self.functions)
+
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.functions = {}
+ awslambda.security_groups_in_use = set()
+ awslambda.regions_with_functions = set()
+ awslambda.function_limit = 1
+ awslambda.audit_resources = []
+ old_client = FakeLambdaClient(
+ AWS_REGION_EU_WEST_1,
+ [
+ {
+ "FunctionName": "old",
+ "FunctionArn": "arn:aws:lambda:eu-west-1:123456789012:function:old",
+ "LastModified": "2024-01-01T00:00:00.000+0000",
+ }
+ ],
+ )
+ new_client = FakeLambdaClient(
+ AWS_REGION_US_EAST_1,
+ [
+ {
+ "FunctionName": "new",
+ "FunctionArn": "arn:aws:lambda:us-east-1:123456789012:function:new",
+ "LastModified": "2024-01-02T00:00:00.000+0000",
+ }
+ ],
+ )
+
+ awslambda._list_functions(old_client)
+ awslambda._list_functions(new_client)
+ awslambda._select_functions_for_analysis()
+
+ assert [function.name for function in awslambda.functions.values()] == ["new"]
+
+ def test_function_limit_keeps_complete_auxiliary_indexes(self):
+ class FakePaginator:
+ def __init__(self, functions):
+ self.functions = functions
+
+ def paginate(self, **kwargs):
+ assert "PageSize" not in kwargs
+ return [{"Functions": self.functions}]
+
+ class FakeLambdaClient:
+ region = AWS_REGION_US_EAST_1
+
+ def get_paginator(self, name):
+ assert name == "list_functions"
+ return FakePaginator(
+ [
+ {
+ "FunctionName": "old",
+ "FunctionArn": (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:old"
+ ),
+ "LastModified": "2024-01-01T00:00:00.000+0000",
+ "VpcConfig": {"SecurityGroupIds": ["sg-old"]},
+ },
+ {
+ "FunctionName": "new",
+ "FunctionArn": (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:new"
+ ),
+ "LastModified": "2024-01-02T00:00:00.000+0000",
+ "VpcConfig": {"SecurityGroupIds": ["sg-new"]},
+ },
+ ]
+ )
+
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.functions = {}
+ awslambda.security_groups_in_use = set()
+ awslambda.regions_with_functions = set()
+ awslambda.function_limit = 1
+ awslambda.audit_resources = []
+
+ awslambda._list_functions(FakeLambdaClient())
+ awslambda._select_functions_for_analysis()
+
+ assert [function.name for function in awslambda.functions.values()] == ["new"]
+ assert awslambda.security_groups_in_use == {"sg-old", "sg-new"}
+ assert awslambda.regions_with_functions == {AWS_REGION_US_EAST_1}
+
+ def test_list_event_source_mappings_uses_selected_functions_as_api_scope(self):
+ class FakePaginator:
+ def __init__(self):
+ self.paginate_calls = []
+
+ def paginate(self, **kwargs):
+ self.paginate_calls.append(kwargs)
+ function_name = kwargs["FunctionName"]
+ return [
+ {
+ "EventSourceMappings": [
+ {
+ "UUID": f"{function_name}-mapping",
+ "FunctionArn": (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:{function_name}:1"
+ ),
+ "EventSourceArn": "arn:aws:sqs:queue",
+ "State": "Enabled",
+ "BatchSize": 10,
+ }
+ ]
+ }
+ ]
+
+ class FakeLambdaClient:
+ region = AWS_REGION_US_EAST_1
+
+ def __init__(self):
+ self.paginator = FakePaginator()
+
+ def get_paginator(self, name):
+ assert name == "list_event_source_mappings"
+ return self.paginator
+
+ selected_arn = (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:selected"
+ )
+ other_region_arn = (
+ f"arn:aws:lambda:{AWS_REGION_EU_WEST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:other-region"
+ )
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.function_limit = 1
+ awslambda.functions = {
+ selected_arn: Function(
+ name="selected",
+ arn=selected_arn,
+ security_groups=[],
+ region=AWS_REGION_US_EAST_1,
+ ),
+ other_region_arn: Function(
+ name="other-region",
+ arn=other_region_arn,
+ security_groups=[],
+ region=AWS_REGION_EU_WEST_1,
+ ),
+ }
+ regional_client = FakeLambdaClient()
+
+ awslambda._list_event_source_mappings(regional_client)
+
+ assert regional_client.paginator.paginate_calls == [
+ {"FunctionName": "selected"}
+ ]
+ assert len(awslambda.functions[selected_arn].event_source_mappings) == 1
+ assert (
+ awslambda.functions[selected_arn].event_source_mappings[0].uuid
+ == "selected-mapping"
+ )
+ assert not awslambda.functions[other_region_arn].event_source_mappings
+
+ def test_list_event_source_mappings_keeps_unlimited_regional_api_scope(self):
+ class FakePaginator:
+ def __init__(self):
+ self.paginate_calls = []
+
+ def paginate(self, **kwargs):
+ self.paginate_calls.append(kwargs)
+ return [
+ {
+ "EventSourceMappings": [
+ {
+ "UUID": "selected-mapping",
+ "FunctionArn": selected_arn,
+ "EventSourceArn": "arn:aws:sqs:queue",
+ "State": "Enabled",
+ }
+ ]
+ }
+ ]
+
+ class FakeLambdaClient:
+ region = AWS_REGION_US_EAST_1
+
+ def __init__(self):
+ self.paginator = FakePaginator()
+
+ def get_paginator(self, name):
+ assert name == "list_event_source_mappings"
+ return self.paginator
+
+ selected_arn = (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:selected"
+ )
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.function_limit = None
+ awslambda.functions = {
+ selected_arn: Function(
+ name="selected",
+ arn=selected_arn,
+ security_groups=[],
+ region=AWS_REGION_US_EAST_1,
+ )
+ }
+ regional_client = FakeLambdaClient()
+
+ awslambda._list_event_source_mappings(regional_client)
+
+ assert regional_client.paginator.paginate_calls == [{}]
+ assert len(awslambda.functions[selected_arn].event_source_mappings) == 1
+
+ def test_list_event_source_mappings_continues_after_invalid_parameter_value(self):
+ class FakePaginator:
+ def paginate(self, **kwargs):
+ function_name = kwargs["FunctionName"]
+ if function_name == "deleted":
+ raise ClientError(
+ {
+ "Error": {
+ "Code": "InvalidParameterValueException",
+ "Message": "Function no longer exists",
+ }
+ },
+ "ListEventSourceMappings",
+ )
+ return [
+ {
+ "EventSourceMappings": [
+ {
+ "UUID": f"{function_name}-mapping",
+ "FunctionArn": (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:{function_name}"
+ ),
+ "EventSourceArn": "arn:aws:sqs:queue",
+ "State": "Enabled",
+ }
+ ]
+ }
+ ]
+
+ class FakeLambdaClient:
+ region = AWS_REGION_US_EAST_1
+
+ def get_paginator(self, name):
+ assert name == "list_event_source_mappings"
+ return FakePaginator()
+
+ deleted_arn = (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:deleted"
+ )
+ remaining_arn = (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:remaining"
+ )
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.function_limit = 2
+ awslambda.functions = {
+ deleted_arn: Function(
+ name="deleted",
+ arn=deleted_arn,
+ security_groups=[],
+ region=AWS_REGION_US_EAST_1,
+ ),
+ remaining_arn: Function(
+ name="remaining",
+ arn=remaining_arn,
+ security_groups=[],
+ region=AWS_REGION_US_EAST_1,
+ ),
+ }
+
+ awslambda._list_event_source_mappings(FakeLambdaClient())
+
+ assert not awslambda.functions[deleted_arn].event_source_mappings
+ assert len(awslambda.functions[remaining_arn].event_source_mappings) == 1
+ assert (
+ awslambda.functions[remaining_arn].event_source_mappings[0].uuid
+ == "remaining-mapping"
+ )
+
+ def test_list_event_source_mappings_raises_non_transient_client_error(self):
+ class FakePaginator:
+ def paginate(self, **kwargs):
+ raise ClientError(
+ {
+ "Error": {
+ "Code": "AccessDeniedException",
+ "Message": "Access denied",
+ }
+ },
+ "ListEventSourceMappings",
+ )
+
+ class FakeLambdaClient:
+ region = AWS_REGION_US_EAST_1
+
+ def get_paginator(self, name):
+ assert name == "list_event_source_mappings"
+ return FakePaginator()
+
+ function_arn = (
+ f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:function:selected"
+ )
+ awslambda = Lambda.__new__(Lambda)
+ awslambda.function_limit = 1
+ awslambda.functions = {
+ function_arn: Function(
+ name="selected",
+ arn=function_arn,
+ security_groups=[],
+ region=AWS_REGION_US_EAST_1,
+ )
+ }
+
+ with pytest.raises(ClientError) as error:
+ awslambda._list_event_source_mappings(FakeLambdaClient())
+
+ assert error.value.response["Error"]["Code"] == "AccessDeniedException"
+
@mock_aws
def test_list_functions(self):
# Create IAM Lambda Role
@@ -253,3 +620,63 @@ class Test_Lambda_Service:
f"{tmp_dir_name}/{files_in_zip[0]}", "r"
) as lambda_code_file:
assert lambda_code_file.read() == LAMBDA_FUNCTION_CODE
+
+ @mock_aws
+ def test_function_limit_exposes_only_selected_functions(self):
+ lambda_client = client("lambda", region_name=AWS_REGION_US_EAST_1)
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ iam_role = iam_client.create_role(
+ RoleName="test-role",
+ AssumeRolePolicyDocument="{}",
+ )["Role"]["Arn"]
+ for name in ("function-1", "function-2"):
+ lambda_client.create_function(
+ FunctionName=name,
+ Runtime="python3.7",
+ Role=iam_role,
+ Handler="lambda_function.lambda_handler",
+ Code={"ZipFile": create_zip_file().read()},
+ PackageType="ZIP",
+ )
+ awslambda = Lambda(
+ set_mocked_aws_provider(
+ audited_regions=[AWS_REGION_US_EAST_1],
+ audit_config={"max_lambda_functions": 1},
+ )
+ )
+
+ assert len(awslambda.functions) == 1
+
+ @mock_aws
+ def test_get_function_code_fetches_only_selected_functions(self):
+ lambda_client = client("lambda", region_name=AWS_REGION_US_EAST_1)
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ iam_role = iam_client.create_role(
+ RoleName="test-role",
+ AssumeRolePolicyDocument="{}",
+ )["Role"]["Arn"]
+ for name in ("function-1", "function-2"):
+ lambda_client.create_function(
+ FunctionName=name,
+ Runtime="python3.7",
+ Role=iam_role,
+ Handler="lambda_function.lambda_handler",
+ Code={"ZipFile": create_zip_file().read()},
+ PackageType="ZIP",
+ )
+ awslambda = Lambda(
+ set_mocked_aws_provider(
+ audited_regions=[AWS_REGION_US_EAST_1],
+ audit_config={"max_lambda_functions": 1},
+ )
+ )
+ fetched = []
+
+ def fetch_function_code(function_name, _function_region):
+ fetched.append(function_name)
+ return mock.MagicMock()
+
+ awslambda._fetch_function_code = fetch_function_code
+
+ assert len(list(awslambda._get_function_code())) == 1
+ assert len(fetched) == 1
diff --git a/tests/providers/aws/services/backup/backup_service_test.py b/tests/providers/aws/services/backup/backup_service_test.py
index d4a7be392f..5894a62bda 100644
--- a/tests/providers/aws/services/backup/backup_service_test.py
+++ b/tests/providers/aws/services/backup/backup_service_test.py
@@ -1,11 +1,16 @@
from datetime import datetime
+from types import SimpleNamespace
from unittest.mock import patch
import botocore
from boto3 import client
from moto import mock_aws
-from prowler.providers.aws.services.backup.backup_service import Backup
+from prowler.providers.aws.services.backup.backup_service import (
+ Backup,
+ BackupVault,
+ RecoveryPoint,
+)
from tests.providers.aws.utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
@@ -292,3 +297,248 @@ class TestBackupService:
assert backup.recovery_points[0].backup_vault_region == "eu-west-1"
assert backup.recovery_points[0].tags == []
assert backup.recovery_points[0].encrypted is True
+
+ def test_recovery_point_limit_bounds_tag_calls_to_selected_points(self):
+ class FakePaginator:
+ def paginate(self, **kwargs):
+ return [
+ {
+ "RecoveryPoints": [
+ {
+ "RecoveryPointArn": "arn:aws:backup:eu-west-1:123456789012:recovery-point:new",
+ "IsEncrypted": True,
+ "CreationDate": datetime(2024, 1, 2),
+ },
+ {
+ "RecoveryPointArn": "arn:aws:backup:eu-west-1:123456789012:recovery-point:old",
+ "IsEncrypted": True,
+ "CreationDate": datetime(2024, 1, 1),
+ },
+ ]
+ }
+ ]
+
+ class FakeBackupClient:
+ def __init__(self):
+ self.tag_calls = []
+
+ def get_paginator(self, name):
+ assert name == "list_recovery_points_by_backup_vault"
+ return FakePaginator()
+
+ def list_tags(self, **kwargs):
+ self.tag_calls.append(kwargs["ResourceArn"])
+ return {"Tags": {}}
+
+ regional_client = FakeBackupClient()
+ backup = Backup.__new__(Backup)
+ backup.backup_vaults = [
+ BackupVault(
+ arn="arn:aws:backup:eu-west-1:123456789012:backup-vault:vault",
+ name="vault",
+ region=AWS_REGION_EU_WEST_1,
+ encryption="",
+ recovery_points=2,
+ locked=False,
+ )
+ ]
+ backup.recovery_points = []
+ backup.recovery_point_limit = 1
+ backup.regional_clients = {AWS_REGION_EU_WEST_1: regional_client}
+
+ backup._list_recovery_points()
+ backup._select_recovery_points_for_analysis()
+ for recovery_point in backup.recovery_points:
+ backup._list_tags(recovery_point)
+
+ assert [rp.id for rp in backup.recovery_points] == ["new"]
+ assert regional_client.tag_calls == [
+ "arn:aws:backup:eu-west-1:123456789012:recovery-point:new"
+ ]
+
+ def test_recovery_point_limit_selects_global_newest_across_vaults(self):
+ class FakePaginator:
+ def __init__(self, recovery_points_by_vault):
+ self.recovery_points_by_vault = recovery_points_by_vault
+
+ def paginate(self, **kwargs):
+ assert "PageSize" not in kwargs
+ return [
+ {
+ "RecoveryPoints": self.recovery_points_by_vault[
+ kwargs["BackupVaultName"]
+ ]
+ }
+ ]
+
+ class FakeBackupClient:
+ def __init__(self, recovery_points_by_vault):
+ self.recovery_points_by_vault = recovery_points_by_vault
+
+ def get_paginator(self, name):
+ assert name == "list_recovery_points_by_backup_vault"
+ return FakePaginator(self.recovery_points_by_vault)
+
+ backup = Backup.__new__(Backup)
+ backup.recovery_point_limit = 1
+ backup.recovery_points = []
+ backup.backup_vaults = [
+ BackupVault(
+ arn="arn:aws:backup:eu-west-1:123456789012:backup-vault:old-vault",
+ name="old-vault",
+ region=AWS_REGION_EU_WEST_1,
+ encryption="",
+ recovery_points=1,
+ locked=False,
+ ),
+ BackupVault(
+ arn="arn:aws:backup:eu-west-1:123456789012:backup-vault:new-vault",
+ name="new-vault",
+ region=AWS_REGION_EU_WEST_1,
+ encryption="",
+ recovery_points=1,
+ locked=False,
+ ),
+ ]
+ backup.regional_clients = {
+ AWS_REGION_EU_WEST_1: FakeBackupClient(
+ {
+ "old-vault": [
+ {
+ "RecoveryPointArn": "arn:aws:backup:eu-west-1:123456789012:recovery-point:old",
+ "IsEncrypted": True,
+ "CreationDate": datetime(2024, 1, 1),
+ }
+ ],
+ "new-vault": [
+ {
+ "RecoveryPointArn": "arn:aws:backup:eu-west-1:123456789012:recovery-point:new",
+ "IsEncrypted": True,
+ "CreationDate": datetime(2024, 1, 2),
+ }
+ ],
+ }
+ )
+ }
+
+ backup._list_recovery_points()
+ backup._select_recovery_points_for_analysis()
+
+ assert [rp.id for rp in backup.recovery_points] == ["new"]
+
+ def test_recovery_point_limit_exposes_only_selected_resources(self):
+ backup = Backup.__new__(Backup)
+ backup.recovery_point_limit = 2
+ backup.recovery_points = []
+ backup.backup_vaults = [
+ BackupVault(
+ arn="arn",
+ name="vault",
+ region="eu-west-1",
+ encryption="",
+ recovery_points=3,
+ locked=False,
+ )
+ ]
+
+ class Paginator:
+ def paginate(self, **_kwargs):
+ return [
+ {
+ "RecoveryPoints": [
+ {
+ "RecoveryPointArn": f"arn:aws:backup:eu-west-1:123456789012:recovery-point:{i}",
+ "IsEncrypted": True,
+ }
+ for i in range(3)
+ ]
+ }
+ ]
+
+ backup.regional_clients = {
+ "eu-west-1": SimpleNamespace(get_paginator=lambda _: Paginator())
+ }
+ tagged = []
+
+ def list_tags(recovery_point):
+ tagged.append(recovery_point.arn)
+
+ backup._list_tags = list_tags
+
+ backup._list_recovery_points()
+ backup._select_recovery_points_for_analysis()
+ for recovery_point in backup.recovery_points:
+ backup._list_tags(recovery_point)
+
+ assert len(backup.recovery_points) == 2
+ assert len(tagged) == 2
+
+ def test_recovery_point_limit_uses_deterministic_tie_breaker(self):
+ backup = Backup.__new__(Backup)
+ backup.recovery_point_limit = 2
+ backup.recovery_points = [
+ RecoveryPoint(
+ arn="arn:aws:backup:us-east-1:123456789012:recovery-point:z",
+ id="z",
+ region="us-east-1",
+ backup_vault_name="vault-b",
+ encrypted=True,
+ backup_vault_region="us-east-1",
+ ),
+ RecoveryPoint(
+ arn="arn:aws:backup:eu-west-1:123456789012:recovery-point:b",
+ id="b",
+ region="eu-west-1",
+ backup_vault_name="vault-b",
+ encrypted=True,
+ backup_vault_region="eu-west-1",
+ ),
+ RecoveryPoint(
+ arn="arn:aws:backup:eu-west-1:123456789012:recovery-point:a",
+ id="a",
+ region="eu-west-1",
+ backup_vault_name="vault-a",
+ encrypted=True,
+ backup_vault_region="eu-west-1",
+ ),
+ ]
+
+ backup._select_recovery_points_for_analysis()
+
+ assert [rp.id for rp in backup.recovery_points] == ["a", "b"]
+
+ def test_recovery_point_limit_keeps_newest_before_tie_breaker(self):
+ backup = Backup.__new__(Backup)
+ backup.recovery_point_limit = 2
+ backup.recovery_points = [
+ RecoveryPoint(
+ arn="arn:aws:backup:eu-west-1:123456789012:recovery-point:older-a",
+ id="older-a",
+ region="eu-west-1",
+ backup_vault_name="vault-a",
+ encrypted=True,
+ backup_vault_region="eu-west-1",
+ creation_date=datetime(2024, 1, 1),
+ ),
+ RecoveryPoint(
+ arn="arn:aws:backup:us-east-1:123456789012:recovery-point:newer-z",
+ id="newer-z",
+ region="us-east-1",
+ backup_vault_name="vault-z",
+ encrypted=True,
+ backup_vault_region="us-east-1",
+ creation_date=datetime(2024, 1, 2),
+ ),
+ RecoveryPoint(
+ arn="arn:aws:backup:eu-west-1:123456789012:recovery-point:missing-date",
+ id="missing-date",
+ region="eu-west-1",
+ backup_vault_name="vault-a",
+ encrypted=True,
+ backup_vault_region="eu-west-1",
+ ),
+ ]
+
+ backup._select_recovery_points_for_analysis()
+
+ assert [rp.id for rp in backup.recovery_points] == ["newer-z", "older-a"]
diff --git a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py
index 4630ad25a0..8c45a9d56b 100644
--- a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py
+++ b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py
@@ -227,6 +227,72 @@ class Test_bedrock_model_invocation_logs_encryption_enabled:
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
+ def test_cloudwatch_logging_uses_complete_log_group_index(self):
+ from prowler.providers.aws.services.bedrock.bedrock_service import (
+ LoggingConfiguration,
+ )
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+ LogGroup,
+ )
+
+ bedrock_client = mock.MagicMock()
+ bedrock_client.logging_configurations = {
+ AWS_REGION_US_EAST_1: LoggingConfiguration(
+ enabled=True,
+ cloudwatch_log_group="Test",
+ )
+ }
+ bedrock_client._get_model_invocation_logging_arn_template.return_value = (
+ "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging"
+ )
+
+ logs_client = mock.MagicMock()
+ logs_client.audited_partition = "aws"
+ logs_client.audited_account = "123456789012"
+ logs_client.log_groups = {}
+ logs_client.all_log_groups = {
+ "arn:aws:logs:us-east-1:123456789012:log-group:Test:*": LogGroup(
+ arn="arn:aws:logs:us-east-1:123456789012:log-group:Test:*",
+ name="Test",
+ retention_days=30,
+ never_expire=False,
+ kms_id=None,
+ region=AWS_REGION_US_EAST_1,
+ )
+ }
+
+ s3_client = mock.MagicMock()
+ s3_client.audited_partition = "aws"
+ s3_client.buckets = {}
+
+ with (
+ mock.patch(
+ "prowler.providers.aws.services.bedrock.bedrock_model_invocation_logs_encryption_enabled.bedrock_model_invocation_logs_encryption_enabled.bedrock_client",
+ new=bedrock_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.bedrock.bedrock_model_invocation_logs_encryption_enabled.bedrock_model_invocation_logs_encryption_enabled.logs_client",
+ new=logs_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.bedrock.bedrock_model_invocation_logs_encryption_enabled.bedrock_model_invocation_logs_encryption_enabled.s3_client",
+ new=s3_client,
+ ),
+ ):
+ from prowler.providers.aws.services.bedrock.bedrock_model_invocation_logs_encryption_enabled.bedrock_model_invocation_logs_encryption_enabled import (
+ bedrock_model_invocation_logs_encryption_enabled,
+ )
+
+ check = bedrock_model_invocation_logs_encryption_enabled()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Bedrock Model Invocation logs are not encrypted in CloudWatch Log Group: Test."
+ )
+
@mock_aws
def test_s3_and_cloudwatch_logging_encrypted(self):
logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
diff --git a/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py b/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py
index 6b8d0d9b15..ad9d277788 100644
--- a/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py
+++ b/tests/providers/aws/services/cloudformation/cloudformation_stack_outputs_find_secrets/cloudformation_stack_outputs_find_secrets_test.py
@@ -38,7 +38,10 @@ class Test_cloudformation_stack_outputs_find_secrets:
Stack(
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
- outputs=["DB_PASSWORD:foobar123", "ENV:DEV"],
+ outputs=[
+ "DB_KEY:eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
+ "ENV:DEV",
+ ],
region=AWS_REGION,
)
]
@@ -66,7 +69,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in CloudFormation Stack {stack_name} Outputs -> Secret Keyword in Output 1."
+ == f"Potential secret found in CloudFormation Stack {stack_name} Outputs -> JSON Web Token (base64url-encoded) in Output 1."
)
assert result[0].resource_id == "Test-Stack"
assert (
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs_test.py
index e9eb00175b..afa082b35d 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs_test.py
@@ -132,7 +132,7 @@ class Test_cloudwatch_log_group_no_secrets_in_logs:
logEvents=[
{
"timestamp": timestamp,
- "message": "password = password123",
+ "message": 'password = "Tr0ub4dor3xKq9vLmZ"',
}
],
)
@@ -174,7 +174,7 @@ class Test_cloudwatch_log_group_no_secrets_in_logs:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secrets found in log group test in log stream test stream at {dttimestamp} - Secret Keyword on line 1."
+ == f"Potential secrets found in log group test in log stream test stream at {dttimestamp} - Generic Password on line 1."
)
assert result[0].resource_id == "test"
assert (
@@ -222,3 +222,323 @@ class Test_cloudwatch_log_group_no_secrets_in_logs:
result = check.execute()
assert len(result) == 0
+
+ @mock_aws
+ def test_cloudwatch_multiline_event_all_secrets_ignored_is_pass(self):
+ # Regression: a multiline event whose secrets are all dropped by the
+ # rescan (e.g. filtered by secrets_ignore_patterns) must NOT produce a
+ # FAIL with no actual secret evidence.
+ logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+ logs_client.create_log_group(logGroupName="test", tags={"test": "test"})
+ logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
+ logs_client.put_log_events(
+ logGroupName="test",
+ logStreamName="test stream",
+ logEvents=[
+ {
+ "timestamp": timestamp,
+ # Valid JSON so the rescan expands it to multiple lines.
+ "message": '{"api_key": "AKIAIOSFODNN7EXAMPLE", "note": "x"}',
+ }
+ ],
+ )
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ from prowler.providers.common.models import Audit_Metadata
+
+ aws_provider.audit_metadata = Audit_Metadata(
+ services_scanned=0,
+ expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+ completed_checks=0,
+ audit_progress=0,
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.logs_client",
+ new=Logs(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.detect_secrets_scan_batch",
+ side_effect=[
+ # Phase 1: stream flagged on its single (multiline) event.
+ {
+ ("test", "test stream"): [
+ {
+ "type": "AWS Access Key",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": False,
+ }
+ ]
+ },
+ # Phase 3: rescan drops everything (all secrets ignored).
+ {},
+ ],
+ ),
+ ):
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs import (
+ cloudwatch_log_group_no_secrets_in_logs,
+ )
+
+ check = cloudwatch_log_group_no_secrets_in_logs()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == "No secrets found in test log group."
+
+ @mock_aws
+ def test_cloudwatch_scan_failure_reports_manual(self):
+ # A scanner failure on the stream scan must surface as MANUAL, not PASS.
+ from prowler.lib.utils.utils import SecretsScanError
+
+ logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+ logs_client.create_log_group(logGroupName="test", tags={"test": "test"})
+ logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
+ logs_client.put_log_events(
+ logGroupName="test",
+ logStreamName="test stream",
+ logEvents=[{"timestamp": timestamp, "message": "some log line"}],
+ )
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ from prowler.providers.common.models import Audit_Metadata
+
+ aws_provider.audit_metadata = Audit_Metadata(
+ services_scanned=0,
+ expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+ completed_checks=0,
+ audit_progress=0,
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.logs_client",
+ new=Logs(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs import (
+ cloudwatch_log_group_no_secrets_in_logs,
+ )
+
+ check = cloudwatch_log_group_no_secrets_in_logs()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
+
+ @mock_aws
+ def test_two_multiline_events_same_timestamp_do_not_collide(self):
+ # Regression: a CloudWatch stream can hold several events sharing one
+ # millisecond timestamp. The multiline rescan must be keyed per event
+ # (not only per timestamp), otherwise the later event's payload
+ # overwrites the earlier one and secret evidence is lost.
+ log_group_arn = (
+ f"arn:aws:logs:{AWS_REGION_US_EAST_1}:123456789012:log-group:test:*"
+ )
+ logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+ logs_client.create_log_group(logGroupName="test", tags={"test": "test"})
+ logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
+ # Two distinct multiline (valid JSON) events at the same timestamp.
+ logs_client.put_log_events(
+ logGroupName="test",
+ logStreamName="test stream",
+ logEvents=[
+ {
+ "timestamp": timestamp,
+ "message": '{"api_key": "AKIAIOSFODNN7EXAMPLE", "note": "a"}',
+ },
+ {
+ "timestamp": timestamp,
+ "message": '{"secret": "AKIAI44QH8DHBEXAMPLE", "note": "b"}',
+ },
+ ],
+ )
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ from prowler.providers.common.models import Audit_Metadata
+
+ aws_provider.audit_metadata = Audit_Metadata(
+ services_scanned=0,
+ expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+ completed_checks=0,
+ audit_progress=0,
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.logs_client",
+ new=Logs(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.detect_secrets_scan_batch",
+ side_effect=[
+ # Phase 1: both events flagged (one secret on each line).
+ {
+ (log_group_arn, "test stream"): [
+ {
+ "type": "AWS Access Key",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "a",
+ "is_verified": False,
+ },
+ {
+ "type": "AWS Access Key",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "b",
+ "is_verified": False,
+ },
+ ]
+ },
+ # Phase 3: each event is rescanned under its own key. If the
+ # keys collided, only one of these would survive.
+ {
+ (
+ log_group_arn,
+ "test stream",
+ dttimestamp,
+ 0,
+ ): [
+ {
+ "type": "AWS Access Key",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "a",
+ "is_verified": False,
+ }
+ ],
+ (
+ log_group_arn,
+ "test stream",
+ dttimestamp,
+ 1,
+ ): [
+ {
+ "type": "AWS Access Key",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "b",
+ "is_verified": False,
+ }
+ ],
+ },
+ ],
+ ),
+ ):
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs import (
+ cloudwatch_log_group_no_secrets_in_logs,
+ )
+
+ check = cloudwatch_log_group_no_secrets_in_logs()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ # Both events' secrets must be reported, not just the last one.
+ assert (
+ result[0].status_extended
+ == f"Potential secrets found in log group test in log stream test stream at {dttimestamp} - AWS Access Key on line 2."
+ )
+
+ @mock_aws
+ def test_same_group_and_stream_names_in_two_regions_do_not_collide(self):
+ # Regression: log group and stream names are not unique across regions,
+ # so the per-stream key must be region-aware (ARN-based). Otherwise the
+ # secret found in one region would be reused for the same-named group in
+ # another region, producing a false FAIL.
+ group_name = "shared-name"
+ stream_name = "shared stream"
+
+ us_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+ us_client.create_log_group(logGroupName=group_name)
+ us_client.create_log_stream(logGroupName=group_name, logStreamName=stream_name)
+ us_client.put_log_events(
+ logGroupName=group_name,
+ logStreamName=stream_name,
+ logEvents=[
+ {
+ "timestamp": timestamp,
+ "message": 'password = "Tr0ub4dor3xKq9vLmZ"',
+ }
+ ],
+ )
+
+ eu_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
+ eu_client.create_log_group(logGroupName=group_name)
+ eu_client.create_log_stream(logGroupName=group_name, logStreamName=stream_name)
+ eu_client.put_log_events(
+ logGroupName=group_name,
+ logStreamName=stream_name,
+ logEvents=[{"timestamp": timestamp, "message": "just a normal log line"}],
+ )
+
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ from prowler.providers.common.models import Audit_Metadata
+
+ aws_provider.audit_metadata = Audit_Metadata(
+ services_scanned=0,
+ expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+ completed_checks=0,
+ audit_progress=0,
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs.logs_client",
+ new=Logs(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_secrets_in_logs.cloudwatch_log_group_no_secrets_in_logs import (
+ cloudwatch_log_group_no_secrets_in_logs,
+ )
+
+ check = cloudwatch_log_group_no_secrets_in_logs()
+ result = check.execute()
+
+ assert len(result) == 2
+ by_region = {report.region: report for report in result}
+ # Only the region with the real secret must FAIL.
+ assert by_region[AWS_REGION_US_EAST_1].status == "FAIL"
+ assert by_region[AWS_REGION_EU_WEST_1].status == "PASS"
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
index 33d4bde7d7..3d2d53ffa0 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
@@ -4,6 +4,7 @@ from moto import mock_aws
from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
CloudWatch,
+ LogGroup,
Logs,
)
from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
@@ -188,7 +189,9 @@ class Test_CloudWatch_Service:
arn = f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
logs = Logs(aws_provider)
assert len(logs.log_groups) == 1
+ assert len(logs.all_log_groups) == 1
assert arn in logs.log_groups
+ assert arn in logs.all_log_groups
assert logs.log_groups[arn].name == "/log-group/test"
assert logs.log_groups[arn].retention_days == 400
assert logs.log_groups[arn].kms_id == "test_kms_id"
@@ -212,7 +215,9 @@ class Test_CloudWatch_Service:
arn = f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
logs = Logs(aws_provider)
assert len(logs.log_groups) == 1
+ assert len(logs.all_log_groups) == 1
assert arn in logs.log_groups
+ assert arn in logs.all_log_groups
assert logs.log_groups[arn].name == "/log-group/test"
assert logs.log_groups[arn].never_expire
# Since it never expires we don't use the retention_days
@@ -221,6 +226,190 @@ class Test_CloudWatch_Service:
assert logs.log_groups[arn].region == AWS_REGION_US_EAST_1
assert logs.log_groups[arn].tags == [{}]
+ def test_log_group_limit_exposes_only_selected_resources(self):
+ class FakeLogsClient:
+ def __init__(self):
+ self.filter_calls = []
+
+ def filter_log_events(self, **kwargs):
+ self.filter_calls.append(kwargs["logGroupName"])
+ return {"events": []}
+
+ regional_client = FakeLogsClient()
+ logs = Logs.__new__(Logs)
+ logs.log_group_limit = 1
+ logs._log_groups_hydrated = set()
+ logs.regional_clients = {AWS_REGION_US_EAST_1: regional_client}
+ logs.events_per_log_group_threshold = 1000
+ logs.log_groups = {
+ f"arn:{i}": LogGroup(
+ arn=f"arn:{i}",
+ name=f"log-{i}",
+ retention_days=30,
+ never_expire=False,
+ kms_id=None,
+ creation_time=i,
+ region=AWS_REGION_US_EAST_1,
+ )
+ for i in range(3)
+ }
+ tagged = []
+
+ def list_tags(log_group):
+ tagged.append(log_group.arn)
+
+ logs._list_tags_for_resource = list_tags
+
+ logs._select_log_groups_for_analysis()
+ for log_group in logs.log_groups.values():
+ logs._list_tags_for_resource(log_group)
+ logs._get_log_events(log_group)
+
+ assert list(logs.log_groups) == ["arn:2"]
+ assert tagged == ["arn:2"]
+ assert regional_client.filter_calls == ["log-2"]
+
+ def test_log_group_limit_selects_global_newest_across_regions(self):
+ class FakePaginator:
+ def __init__(self, log_groups):
+ self.log_groups = log_groups
+
+ def paginate(self, **kwargs):
+ assert "PageSize" not in kwargs
+ return [{"logGroups": self.log_groups}]
+
+ class FakeLogsClient:
+ def __init__(self, region, log_groups):
+ self.region = region
+ self.log_groups = log_groups
+
+ def get_paginator(self, name):
+ assert name == "describe_log_groups"
+ return FakePaginator(self.log_groups)
+
+ logs = Logs.__new__(Logs)
+ logs.all_log_groups = {}
+ logs.log_groups = {}
+ logs.log_group_limit = 1
+ logs.audit_resources = []
+
+ logs._describe_log_groups(
+ FakeLogsClient(
+ "eu-west-1",
+ [
+ {
+ "arn": "arn:aws:logs:eu-west-1:123456789012:log-group:old:*",
+ "logGroupName": "old",
+ "creationTime": 1,
+ }
+ ],
+ )
+ )
+ logs._describe_log_groups(
+ FakeLogsClient(
+ AWS_REGION_US_EAST_1,
+ [
+ {
+ "arn": "arn:aws:logs:us-east-1:123456789012:log-group:new:*",
+ "logGroupName": "new",
+ "creationTime": 2,
+ }
+ ],
+ )
+ )
+ logs._select_log_groups_for_analysis()
+
+ assert [log_group.name for log_group in logs.log_groups.values()] == ["new"]
+ assert [log_group.name for log_group in logs.all_log_groups.values()] == [
+ "old",
+ "new",
+ ]
+
+ def test_metric_filters_use_complete_log_group_index(self):
+ class FakePaginator:
+ def paginate(self):
+ return [
+ {
+ "metricFilters": [
+ {
+ "filterName": "test-filter",
+ "filterPattern": "test-pattern",
+ "logGroupName": "old",
+ "metricTransformations": [
+ {"metricName": "test-metric"}
+ ],
+ }
+ ]
+ }
+ ]
+
+ class FakeLogsClient:
+ region = AWS_REGION_US_EAST_1
+
+ def get_paginator(self, name):
+ assert name == "describe_metric_filters"
+ return FakePaginator()
+
+ logs = Logs.__new__(Logs)
+ old_log_group = LogGroup(
+ arn="arn:old",
+ name="old",
+ retention_days=30,
+ never_expire=False,
+ kms_id=None,
+ creation_time=1,
+ region=AWS_REGION_US_EAST_1,
+ )
+ logs.audited_partition = "aws"
+ logs.audited_account = AWS_ACCOUNT_NUMBER
+ logs.audit_resources = []
+ logs.metric_filters = []
+ logs.log_groups = {}
+ logs.all_log_groups = {old_log_group.arn: old_log_group}
+ logs._log_groups_hydrated = set()
+ logs._list_tags_for_resource = lambda log_group: None
+
+ logs._describe_metric_filters(FakeLogsClient())
+
+ assert len(logs.metric_filters) == 1
+ assert logs.metric_filters[0].log_group == old_log_group
+
+ def test_log_group_collection_recovers_all_log_groups_after_access_denied(self):
+ class FakePaginator:
+ def paginate(self):
+ return [
+ {
+ "logGroups": [
+ {
+ "arn": "arn:aws:logs:us-east-1:123456789012:log-group:success:*",
+ "logGroupName": "success",
+ "creationTime": 1,
+ }
+ ]
+ }
+ ]
+
+ class FakeLogsClient:
+ region = AWS_REGION_US_EAST_1
+
+ def get_paginator(self, name):
+ assert name == "describe_log_groups"
+ return FakePaginator()
+
+ logs = Logs.__new__(Logs)
+ logs.all_log_groups = None
+ logs.log_groups = None
+ logs.audit_resources = []
+
+ logs._describe_log_groups(FakeLogsClient())
+
+ assert list(logs.all_log_groups) == [
+ "arn:aws:logs:us-east-1:123456789012:log-group:success:*"
+ ]
+ assert list(logs.log_groups) == [
+ "arn:aws:logs:us-east-1:123456789012:log-group:success:*"
+ ]
+
class Test_build_metric_filter_pattern:
@pytest.mark.parametrize("bad_operator", ["==", "~=", "<", "<>", ">=", ""])
diff --git a/tests/providers/aws/services/codeartifact/codeartifact_service_test.py b/tests/providers/aws/services/codeartifact/codeartifact_service_test.py
index 99325dd2ea..50af85b767 100644
--- a/tests/providers/aws/services/codeartifact/codeartifact_service_test.py
+++ b/tests/providers/aws/services/codeartifact/codeartifact_service_test.py
@@ -1,3 +1,4 @@
+from types import SimpleNamespace
from unittest.mock import patch
import botocore
@@ -6,6 +7,7 @@ from prowler.providers.aws.services.codeartifact.codeartifact_service import (
CodeArtifact,
LatestPackageVersionStatus,
OriginInformationValues,
+ Repository,
RestrictionValues,
)
from tests.providers.aws.utils import (
@@ -208,6 +210,104 @@ class Test_CodeArtifact_Service:
== OriginInformationValues.INTERNAL
)
+ def test_package_limit_bounds_package_version_lookups_to_selected_packages(self):
+ class FakePaginator:
+ def paginate(self, **kwargs):
+ return [
+ {
+ "packages": [
+ {
+ "format": "pypi",
+ "package": "first-package",
+ "originConfiguration": {
+ "restrictions": {
+ "publish": "ALLOW",
+ "upstream": "ALLOW",
+ }
+ },
+ },
+ {
+ "format": "pypi",
+ "package": "second-package",
+ "originConfiguration": {
+ "restrictions": {
+ "publish": "ALLOW",
+ "upstream": "ALLOW",
+ }
+ },
+ },
+ ]
+ }
+ ]
+
+ class FakeCodeArtifactClient:
+ def __init__(self):
+ self.version_calls = []
+
+ def get_paginator(self, name):
+ assert name == "list_packages"
+ return FakePaginator()
+
+ def list_package_versions(self, **kwargs):
+ self.version_calls.append(kwargs["package"])
+ return {
+ "versions": [
+ {
+ "version": "1.0.0",
+ "status": "Published",
+ "origin": {"originType": "INTERNAL"},
+ }
+ ]
+ }
+
+ regional_client = FakeCodeArtifactClient()
+ codeartifact = CodeArtifact.__new__(CodeArtifact)
+ codeartifact.repositories = {
+ TEST_REPOSITORY_ARN: Repository(
+ name="test-repository",
+ arn=TEST_REPOSITORY_ARN,
+ domain_name="test-domain",
+ domain_owner=AWS_ACCOUNT_NUMBER,
+ region=AWS_REGION_EU_WEST_1,
+ )
+ }
+ codeartifact._packages_listed = set()
+ codeartifact.package_limit = 1
+ codeartifact.regional_clients = {AWS_REGION_EU_WEST_1: regional_client}
+
+ pairs = list(codeartifact._load_packages_for_analysis())
+
+ assert [package.name for _, package in pairs] == ["first-package"]
+ assert regional_client.version_calls == ["first-package"]
+
+ def test_package_limit_exposes_only_selected_packages(self):
+ codeartifact = CodeArtifact.__new__(CodeArtifact)
+ codeartifact.package_limit = 2
+ codeartifact._packages_listed = set()
+ repository = Repository(
+ name="repository",
+ arn="repo",
+ domain_name="domain",
+ domain_owner=AWS_ACCOUNT_NUMBER,
+ region=AWS_REGION_EU_WEST_1,
+ )
+ codeartifact.repositories = {repository.arn: repository}
+ enriched = []
+
+ def iter_repository_packages(repository, limit=None):
+ for index in range(3):
+ if limit is not None and index >= limit:
+ return
+ enriched.append(index)
+ yield SimpleNamespace(name=f"package-{index}")
+
+ codeartifact._iter_repository_packages = iter_repository_packages
+
+ packages = list(codeartifact._load_packages_for_analysis())
+
+ assert [package.name for _, package in packages] == ["package-0", "package-1"]
+ assert enriched == [0, 1]
+
def mock_make_api_call_no_namespace(self, operation_name, kwarg):
"""Mock for packages without a namespace to exercise the else branch"""
diff --git a/tests/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables_test.py b/tests/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables_test.py
index c08d1c8bb3..8060f7db59 100644
--- a/tests/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables_test.py
+++ b/tests/providers/aws/services/codebuild/codebuild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables_test.py
@@ -1,6 +1,10 @@
from unittest import mock
-from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_US_EAST_1
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
class Test_codebuild_project_no_secrets_in_variables:
@@ -202,7 +206,11 @@ class Test_codebuild_project_no_secrets_in_variables:
environment_variables=[
{
"name": "AWS_ACCESS_KEY_ID",
- "value": "AKIAIOSFODNN7EXAMPLE",
+ # Realistic fake secret that Kingfisher detects. The classic
+ # "AKIAIOSFODNN7EXAMPLE" placeholder is suppressed by
+ # Kingfisher and its AWS Access Key rule is not enabled, so a
+ # detectable provider secret is used instead.
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"type": "PLAINTEXT",
}
],
@@ -231,15 +239,100 @@ class Test_codebuild_project_no_secrets_in_variables:
assert len(result) == 1
assert result[0].status == "FAIL"
+ # The JWT paired with a "KEY" variable name yields both a
+ # JWT and a Generic API Key finding; order is non-deterministic.
+ assert result[0].status_extended.startswith(
+ "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables:"
+ )
assert (
- result[0].status_extended
- == "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables: AWS Access Key in variable AWS_ACCESS_KEY_ID."
+ "JSON Web Token (base64url-encoded) in variable AWS_ACCESS_KEY_ID"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic API Key in variable AWS_ACCESS_KEY_ID"
+ in result[0].status_extended
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_id == "SensitiveProject"
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
+ def test_project_with_verified_secret(self):
+ from prowler.lib.check.models import Severity
+
+ codebuild_client = mock.MagicMock()
+
+ from prowler.providers.aws.services.codebuild.codebuild_service import Project
+
+ project_arn = f"arn:aws:codebuild:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:project/SensitiveProject"
+ codebuild_client.projects = {
+ project_arn: Project(
+ name="SensitiveProject",
+ arn=project_arn,
+ region=AWS_REGION_US_EAST_1,
+ last_invoked_time=None,
+ buildspec=None,
+ environment_variables=[
+ {
+ "name": "EXAMPLE_VAR",
+ "value": "ExampleValue",
+ "type": "PLAINTEXT",
+ }
+ ],
+ tags=[],
+ )
+ }
+
+ codebuild_client.audit_config = {
+ "excluded_sensitive_environment_variables": [],
+ "secrets_validate": True,
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(
+ audit_config={"secrets_validate": True}
+ ),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_service.Codebuild",
+ codebuild_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables.codebuild_client",
+ codebuild_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables.detect_secrets_scan_batch",
+ return_value={
+ (0, 0): [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables import (
+ codebuild_project_no_secrets_in_variables,
+ )
+
+ check = codebuild_project_no_secrets_in_variables()
+ result = check.execute()
+
+ # The check must forward secrets_validate from the config to the scan.
+ assert mock_scan.call_args.kwargs.get("validate") is True
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert result[0].resource_id == "SensitiveProject"
+
def test_project_with_sensitive_plaintext_credentials_exluded(self):
codebuild_client = mock.MagicMock
@@ -373,12 +466,12 @@ class Test_codebuild_project_no_secrets_in_variables:
environment_variables=[
{
"name": "AWS_DUMB_ACCESS_KEY",
- "value": "AKIAIOSFODNN7EXAMPLE",
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"type": "PLAINTEXT",
},
{
"name": "AWS_ACCESS_KEY_ID",
- "value": "AKIAIOSFODNN7EXAMPLE",
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"type": "PLAINTEXT",
},
],
@@ -409,10 +502,21 @@ class Test_codebuild_project_no_secrets_in_variables:
assert len(result) == 1
assert result[0].status == "FAIL"
- assert (
- result[0].status_extended
- == "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables: AWS Access Key in variable AWS_ACCESS_KEY_ID."
+ # AWS_DUMB_ACCESS_KEY is excluded, so only AWS_ACCESS_KEY_ID is
+ # scanned; its JWT + "KEY" name yields both a JWT and a
+ # Generic API Key finding with non-deterministic order.
+ assert result[0].status_extended.startswith(
+ "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables:"
)
+ assert (
+ "JSON Web Token (base64url-encoded) in variable AWS_ACCESS_KEY_ID"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic API Key in variable AWS_ACCESS_KEY_ID"
+ in result[0].status_extended
+ )
+ assert "AWS_DUMB_ACCESS_KEY" not in result[0].status_extended
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_id == "SensitiveProject"
assert result[0].resource_arn == project_arn
@@ -434,12 +538,12 @@ class Test_codebuild_project_no_secrets_in_variables:
environment_variables=[
{
"name": "AWS_DUMB_ACCESS_KEY",
- "value": "AKIAIOSFODNN7EXAMPLE",
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"type": "PLAINTEXT",
},
{
"name": "AWS_ACCESS_KEY_ID",
- "value": "AKIAIOSFODNN7EXAMPLE",
+ "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"type": "PLAINTEXT",
},
],
@@ -468,11 +572,80 @@ class Test_codebuild_project_no_secrets_in_variables:
assert len(result) == 1
assert result[0].status == "FAIL"
- assert (
- result[0].status_extended
- == "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables: AWS Access Key in variable AWS_DUMB_ACCESS_KEY, AWS Access Key in variable AWS_ACCESS_KEY_ID."
+ # Both variables hold a JWT and have "KEY" in their name, so
+ # each yields a JWT and a Generic API Key finding; order is
+ # non-deterministic.
+ assert result[0].status_extended.startswith(
+ "CodeBuild project SensitiveProject has sensitive environment plaintext credentials in variables:"
)
+ for var_name in ("AWS_DUMB_ACCESS_KEY", "AWS_ACCESS_KEY_ID"):
+ assert (
+ f"JSON Web Token (base64url-encoded) in variable {var_name}"
+ in result[0].status_extended
+ )
+ assert (
+ f"Generic API Key in variable {var_name}"
+ in result[0].status_extended
+ )
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_id == "SensitiveProject"
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
+
+ def test_scan_failure_reports_manual(self):
+ from prowler.lib.utils.utils import SecretsScanError
+
+ codebuild_client = mock.MagicMock()
+ from prowler.providers.aws.services.codebuild.codebuild_service import Project
+
+ project_arn = f"arn:aws:codebuild:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:project/SensitiveProject"
+ codebuild_client.projects = {
+ project_arn: Project(
+ name="SensitiveProject",
+ arn=project_arn,
+ region=AWS_REGION_US_EAST_1,
+ last_invoked_time=None,
+ buildspec=None,
+ environment_variables=[
+ {
+ "name": "EXAMPLE_VAR",
+ "value": "ExampleValue",
+ "type": "PLAINTEXT",
+ }
+ ],
+ tags=[],
+ )
+ }
+ codebuild_client.audit_config = {
+ "excluded_sensitive_environment_variables": [],
+ "secrets_ignore_patterns": [],
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_service.Codebuild",
+ codebuild_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables.codebuild_client",
+ codebuild_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.aws.services.codebuild.codebuild_project_no_secrets_in_variables.codebuild_project_no_secrets_in_variables import (
+ codebuild_project_no_secrets_in_variables,
+ )
+
+ check = codebuild_project_no_secrets_in_variables()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
diff --git a/tests/providers/aws/services/codebuild/codebuild_project_not_publicly_accessible/__init__.py b/tests/providers/aws/services/codebuild/codebuild_project_not_publicly_accessible/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition_test.py b/tests/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition_test.py
new file mode 100644
index 0000000000..fb550efbf3
--- /dev/null
+++ b/tests/providers/aws/services/datapipeline/datapipeline_pipeline_no_secrets_in_definition/datapipeline_pipeline_no_secrets_in_definition_test.py
@@ -0,0 +1,254 @@
+from unittest import mock
+
+from prowler.lib.utils.utils import SecretsScanError
+from prowler.providers.aws.services.datapipeline.datapipeline_service import Pipeline
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+
+class Test_datapipeline_pipeline_no_secrets_in_definition:
+ def test_no_pipelines(self):
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {}
+ datapipeline_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(datapipeline_client)
+
+ assert len(result) == 0
+
+ def test_pipeline_with_no_secrets_in_definition(self):
+ pipeline = _build_pipeline(
+ definition={
+ "pipelineObjects": [
+ {
+ "id": "Default",
+ "name": "Default",
+ "fields": [
+ {"key": "type", "stringValue": "Default"},
+ {"key": "scheduleType", "stringValue": "cron"},
+ ],
+ }
+ ]
+ }
+ )
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {pipeline.arn: pipeline}
+ datapipeline_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(datapipeline_client)
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "No secrets found in Data Pipeline test-pipeline definition."
+ )
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "df-1234567890"
+ assert result[0].resource_arn == pipeline.arn
+
+ def test_pipeline_with_secrets_in_object_field(self):
+ pipeline = _build_pipeline(
+ definition={
+ "pipelineObjects": [
+ {
+ "id": "SqlActivity",
+ "name": "SqlActivity",
+ "fields": [
+ {"key": "type", "stringValue": "SqlActivity"},
+ {
+ "key": "script",
+ "stringValue": "select * from users where token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U'",
+ },
+ ],
+ }
+ ]
+ }
+ )
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {pipeline.arn: pipeline}
+ datapipeline_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(datapipeline_client)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "test-pipeline" in result[0].status_extended
+ assert "object SqlActivity field script" in result[0].status_extended
+ assert "eyJhbGciOiJIUzI1Ni" not in result[0].status_extended
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_id == "df-1234567890"
+ assert result[0].resource_arn == pipeline.arn
+
+ def test_pipeline_with_secrets_in_parameter_value(self):
+ pipeline = _build_pipeline(
+ definition={
+ "parameterValues": [
+ {
+ "id": "databasePassword",
+ "stringValue": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXNzd29yZCI6InN1cGVyLXNlY3JldCJ9.zZ7_9wzLQfPy4TAAkpS6I8nRcEvuTnbwN7gGr1pH5fQ",
+ }
+ ]
+ }
+ )
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {pipeline.arn: pipeline}
+ datapipeline_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result = _execute_check(datapipeline_client)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "parameter value databasePassword" in result[0].status_extended
+ assert "super-secret" not in result[0].status_extended
+
+ def test_pipeline_with_verified_secret_escalates_severity(self):
+ from prowler.lib.check.models import Severity
+
+ pipeline = _build_pipeline(
+ definition={
+ "parameterValues": [
+ {
+ "id": "databasePassword",
+ "stringValue": "verified-secret-value",
+ }
+ ]
+ }
+ )
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {pipeline.arn: pipeline}
+ datapipeline_client.audit_config = {
+ "secrets_ignore_patterns": [],
+ "secrets_validate": True,
+ }
+
+ result, scan_batch = _execute_check_with_mocked_scan(
+ datapipeline_client,
+ return_value={
+ 0: [
+ {
+ "type": "Generic Password",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ )
+
+ assert scan_batch.call_args.kwargs.get("validate") is True
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+
+ def test_scan_error_marks_all_scannable_pipelines_manual(self):
+ first_pipeline = _build_pipeline(
+ pipeline_id="df-first",
+ pipeline_name="first-pipeline",
+ definition={
+ "pipelineObjects": [
+ {
+ "id": "Default",
+ "name": "Default",
+ "fields": [{"key": "type", "stringValue": "Default"}],
+ }
+ ]
+ },
+ )
+ second_pipeline = _build_pipeline(
+ pipeline_id="df-second",
+ pipeline_name="second-pipeline",
+ definition={
+ "parameterValues": [
+ {"id": "databasePassword", "stringValue": "secret-value"}
+ ]
+ },
+ )
+ datapipeline_client = mock.MagicMock()
+ datapipeline_client.pipelines = {
+ first_pipeline.arn: first_pipeline,
+ second_pipeline.arn: second_pipeline,
+ }
+ datapipeline_client.audit_config = {"secrets_ignore_patterns": []}
+
+ result, scan_batch = _execute_check_with_mocked_scan(
+ datapipeline_client,
+ side_effect=SecretsScanError("scanner unavailable"),
+ )
+
+ scan_payloads = scan_batch.call_args.args[0]
+ assert len(scan_payloads) == 2
+ assert len(result) == 2
+ assert {report.status for report in result} == {"MANUAL"}
+ assert all(
+ "manual review is required" in report.status_extended for report in result
+ )
+
+
+def _build_pipeline(
+ definition: dict,
+ pipeline_id: str = "df-1234567890",
+ pipeline_name: str = "test-pipeline",
+) -> Pipeline:
+ pipeline_arn = (
+ f"arn:aws:datapipeline:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_id}"
+ )
+ return Pipeline(
+ id=pipeline_id,
+ name=pipeline_name,
+ arn=pipeline_arn,
+ region=AWS_REGION_US_EAST_1,
+ definition=definition,
+ )
+
+
+def _execute_check(datapipeline_client):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.datapipeline.datapipeline_pipeline_no_secrets_in_definition.datapipeline_pipeline_no_secrets_in_definition.datapipeline_client",
+ datapipeline_client,
+ ),
+ ):
+ from prowler.providers.aws.services.datapipeline.datapipeline_pipeline_no_secrets_in_definition.datapipeline_pipeline_no_secrets_in_definition import (
+ datapipeline_pipeline_no_secrets_in_definition,
+ )
+
+ check = datapipeline_pipeline_no_secrets_in_definition()
+ return check.execute()
+
+
+def _execute_check_with_mocked_scan(
+ datapipeline_client, return_value=None, side_effect=None
+):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.datapipeline.datapipeline_pipeline_no_secrets_in_definition.datapipeline_pipeline_no_secrets_in_definition.datapipeline_client",
+ datapipeline_client,
+ ),
+ ):
+ import prowler.providers.aws.services.datapipeline.datapipeline_pipeline_no_secrets_in_definition.datapipeline_pipeline_no_secrets_in_definition as check_module
+
+ with mock.patch.object(
+ check_module,
+ "detect_secrets_scan_batch",
+ return_value=return_value,
+ side_effect=side_effect,
+ ) as scan_batch:
+ check = check_module.datapipeline_pipeline_no_secrets_in_definition()
+ return check.execute(), scan_batch
diff --git a/tests/providers/aws/services/datapipeline/datapipeline_service_test.py b/tests/providers/aws/services/datapipeline/datapipeline_service_test.py
new file mode 100644
index 0000000000..12637d11d9
--- /dev/null
+++ b/tests/providers/aws/services/datapipeline/datapipeline_service_test.py
@@ -0,0 +1,121 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from prowler.providers.aws.services.datapipeline.datapipeline_service import (
+ DataPipeline,
+ Pipeline,
+)
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+pipeline_id = "df-1234567890"
+pipeline_name = "test-pipeline"
+pipeline_arn = (
+ f"arn:aws:datapipeline:{AWS_REGION_US_EAST_1}:"
+ f"{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_id}"
+)
+pipeline_definition = {
+ "pipelineObjects": [
+ {
+ "id": "Default",
+ "name": "Default",
+ "fields": [{"key": "type", "stringValue": "Default"}],
+ }
+ ],
+ "parameterObjects": [],
+ "parameterValues": [],
+}
+pipeline_tags = [{"key": "Environment", "value": "test"}]
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+ if operation_name == "ListPipelines":
+ return {"pipelineIdList": [{"id": pipeline_id, "name": pipeline_name}]}
+ if operation_name == "DescribePipelines":
+ return {
+ "pipelineDescriptionList": [
+ {
+ "pipelineId": pipeline_id,
+ "name": pipeline_name,
+ "tags": pipeline_tags,
+ }
+ ]
+ }
+ if operation_name == "GetPipelineDefinition":
+ return pipeline_definition
+ return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_describe_fails(self, operation_name, kwarg):
+ if operation_name == "ListPipelines":
+ return {"pipelineIdList": [{"id": pipeline_id, "name": pipeline_name}]}
+ if operation_name == "DescribePipelines":
+ raise botocore.exceptions.ClientError(
+ {
+ "Error": {
+ "Code": "AccessDeniedException",
+ "Message": "Access denied",
+ }
+ },
+ operation_name,
+ )
+ if operation_name == "GetPipelineDefinition":
+ return pipeline_definition
+ return make_api_call(self, operation_name, kwarg)
+
+
+def mock_generate_regional_clients(provider, service):
+ regional_client = provider._session.current_session.client(
+ service, region_name=AWS_REGION_US_EAST_1
+ )
+ regional_client.region = AWS_REGION_US_EAST_1
+ return {AWS_REGION_US_EAST_1: regional_client}
+
+
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+@patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_regional_clients,
+)
+class TestDataPipelineService:
+ @mock_aws
+ def test_datapipeline_service(self):
+ datapipeline = DataPipeline(set_mocked_aws_provider([AWS_REGION_US_EAST_1]))
+
+ assert datapipeline.session.__class__.__name__ == "Session"
+ assert datapipeline.service == "datapipeline"
+ assert len(datapipeline.pipelines) == 1
+ assert isinstance(datapipeline.pipelines[pipeline_arn], Pipeline)
+
+ pipeline = datapipeline.pipelines[pipeline_arn]
+ assert pipeline.id == pipeline_id
+ assert pipeline.name == pipeline_name
+ assert pipeline.arn == pipeline_arn
+ assert pipeline.region == AWS_REGION_US_EAST_1
+ assert pipeline.definition == pipeline_definition
+ assert pipeline.tags == pipeline_tags
+
+
+@patch(
+ "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_describe_fails
+)
+@patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_regional_clients,
+)
+class TestDataPipelineServiceDescribeFailure:
+ @mock_aws
+ def test_datapipeline_service_gets_definition_when_describe_fails(self):
+ datapipeline = DataPipeline(set_mocked_aws_provider([AWS_REGION_US_EAST_1]))
+
+ assert len(datapipeline.pipelines) == 1
+ pipeline = datapipeline.pipelines[pipeline_arn]
+ assert pipeline.definition == pipeline_definition
+ assert pipeline.tags == []
diff --git a/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py b/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py
index 3412aead68..47950ab33f 100644
--- a/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py
+++ b/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py
@@ -1,3 +1,5 @@
+import builtins
+import sys
from unittest import mock
from boto3 import client, resource
@@ -12,38 +14,42 @@ from tests.providers.aws.utils import (
)
LIFECYCLE_POLICY_ID = "policy-XXXXXXXXXXXX"
+CHECK_MODULE = (
+ "prowler.providers.aws.services.dlm."
+ "dlm_ebs_snapshot_lifecycle_policy_exists."
+ "dlm_ebs_snapshot_lifecycle_policy_exists"
+)
+DLM_CLIENT_MODULE = "prowler.providers.aws.services.dlm.dlm_client"
+EC2_CLIENT_MODULE = "prowler.providers.aws.services.ec2.ec2_client"
+
+
+def unload_dlm_check_modules():
+ sys.modules.pop(CHECK_MODULE, None)
+ sys.modules.pop(DLM_CLIENT_MODULE, None)
class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
@mock_aws
def test_no_ebs_snapshot_no_lifecycle_policies(self):
# DLM Mock Client
- dlm_client = mock.MagicMock
+ dlm_client = mock.MagicMock()
dlm_client.audited_account = AWS_ACCOUNT_NUMBER
dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
dlm_client.lifecycle_policies = {}
+ dlm_client.regions_with_snapshots = {}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
- from prowler.providers.aws.services.ec2.ec2_service import EC2
+ unload_dlm_check_modules()
with (
mock.patch(
"prowler.providers.aws.services.dlm.dlm_service.DLM",
- new=dlm_client,
+ new=mock.MagicMock(return_value=dlm_client),
),
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
),
- mock.patch(
- "prowler.providers.aws.services.ec2.ec2_service.EC2",
- return_value=EC2(aws_provider),
- ) as ec2_client,
- mock.patch(
- "prowler.providers.aws.services.ec2.ec2_client.ec2_client",
- new=ec2_client,
- ),
):
from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
dlm_ebs_snapshot_lifecycle_policy_exists,
@@ -92,22 +98,22 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
)
}
}
+ dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
dlm_client.lifecycle_policy_arn_template = f"arn:{dlm_client.audited_partition}:dlm:{dlm_client.region}:{dlm_client.audited_account}:policy"
dlm_client._get_lifecycle_policy_arn_template = mock.MagicMock(
return_value=dlm_client.lifecycle_policy_arn_template
)
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
- from prowler.providers.aws.services.ec2.ec2_service import EC2
+ unload_dlm_check_modules()
with (
mock.patch(
- "prowler.providers.common.provider.Provider.get_global_provider",
- return_value=aws_provider,
+ "prowler.providers.aws.services.dlm.dlm_service.DLM",
+ new=mock.MagicMock(return_value=dlm_client),
),
mock.patch(
- "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
- new=EC2(aws_provider),
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
),
mock.patch(
"prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
@@ -154,25 +160,23 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
)["SnapshotId"]
# DLM Mock Client
- dlm_client = mock.MagicMock
+ dlm_client = mock.MagicMock()
dlm_client.audited_account = AWS_ACCOUNT_NUMBER
dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
dlm_client.lifecycle_policies = {}
-
- # from prowler.providers.aws.services.ec2.ec2_service import EC2
+ dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
- from prowler.providers.aws.services.ec2.ec2_service import EC2
+ unload_dlm_check_modules()
with (
mock.patch(
- "prowler.providers.common.provider.Provider.get_global_provider",
- return_value=aws_provider,
+ "prowler.providers.aws.services.dlm.dlm_service.DLM",
+ new=mock.MagicMock(return_value=dlm_client),
),
mock.patch(
- "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
- new=EC2(aws_provider),
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
),
mock.patch(
"prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
@@ -190,7 +194,7 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
@mock_aws
def test_no_ebs_snapshot_and_dlm_lifecycle_policy(self):
# DLM Mock Client
- dlm_client = mock.MagicMock
+ dlm_client = mock.MagicMock()
dlm_client.audited_account = AWS_ACCOUNT_NUMBER
dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
dlm_client.lifecycle_policies = {
@@ -203,30 +207,25 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
)
}
}
-
- # from prowler.providers.aws.services.ec2.ec2_service import EC2
+ dlm_client.regions_with_snapshots = {}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
- from prowler.providers.aws.services.ec2.ec2_service import EC2
+ unload_dlm_check_modules()
with (
+ mock.patch(
+ "prowler.providers.aws.services.dlm.dlm_service.DLM",
+ new=mock.MagicMock(return_value=dlm_client),
+ ),
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=aws_provider,
),
- mock.patch(
- "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
- new=EC2(aws_provider),
- ) as ec2_client,
mock.patch(
"prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
new=dlm_client,
),
):
- # Remove all snapshots
- ec2_client.regions_with_snapshots = {}
-
from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
dlm_ebs_snapshot_lifecycle_policy_exists,
)
@@ -234,3 +233,45 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
check = dlm_ebs_snapshot_lifecycle_policy_exists()
result = check.execute()
assert len(result) == 0
+
+ @mock_aws
+ def test_check_does_not_import_ec2_service_client(self):
+ dlm_client = mock.MagicMock()
+ dlm_client.audited_account = AWS_ACCOUNT_NUMBER
+ dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
+ dlm_client.audited_partition = "aws"
+ dlm_client.lifecycle_policies = {AWS_REGION_US_EAST_1: {}}
+ dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
+ dlm_client._get_lifecycle_policy_arn_template = mock.MagicMock(
+ return_value=f"arn:aws:dlm:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:policy"
+ )
+
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ unload_dlm_check_modules()
+ sys.modules.pop(EC2_CLIENT_MODULE, None)
+ real_import = builtins.__import__
+
+ def guarded_import(name, *args, **kwargs):
+ if name == EC2_CLIENT_MODULE:
+ raise AssertionError("DLM check must not import the EC2 service client")
+ return real_import(name, *args, **kwargs)
+
+ with (
+ mock.patch(
+ "prowler.providers.aws.services.dlm.dlm_service.DLM",
+ new=mock.MagicMock(return_value=dlm_client),
+ ),
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch("builtins.__import__", side_effect=guarded_import),
+ ):
+ from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
+ dlm_ebs_snapshot_lifecycle_policy_exists,
+ )
+
+ result = dlm_ebs_snapshot_lifecycle_policy_exists().execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
diff --git a/tests/providers/aws/services/dlm/dlm_service_test.py b/tests/providers/aws/services/dlm/dlm_service_test.py
index 38307c508c..b5b64322de 100644
--- a/tests/providers/aws/services/dlm/dlm_service_test.py
+++ b/tests/providers/aws/services/dlm/dlm_service_test.py
@@ -34,6 +34,8 @@ def mock_make_api_call(self, operation_name, kwargs):
}
]
}
+ if operation_name == "DescribeSnapshots":
+ return {"Snapshots": [{"SnapshotId": "snap-1234567890abcdef0"}]}
return make_api_call(self, operation_name, kwargs)
@@ -46,6 +48,13 @@ def mock_generate_regional_clients(provider, service):
return {AWS_REGION_US_EAST_1: regional_client}
+def mock_generate_regional_clients_without_ec2(provider, service):
+ if service == "ec2":
+ return None
+
+ return mock_generate_regional_clients(provider, service)
+
+
@patch(
"prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
new=mock_generate_regional_clients,
@@ -92,3 +101,62 @@ class Test_DLM_Service:
)
}
}
+
+ def test_get_regions_with_snapshots(self):
+ aws_provider = set_mocked_aws_provider()
+ dlm = DLM(aws_provider)
+ assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: True}
+
+
+@patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_regional_clients_without_ec2,
+)
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+class Test_DLM_Service_Without_EC2_Regional_Clients:
+ def test_service_handles_missing_ec2_regional_clients(self):
+ aws_provider = set_mocked_aws_provider()
+ dlm = DLM(aws_provider)
+
+ assert dlm.regions_with_snapshots == {}
+
+
+class FakeEC2RegionalClient:
+ def __init__(self, responses):
+ self.region = AWS_REGION_US_EAST_1
+ self.requests = []
+ self.responses = list(responses)
+
+ def describe_snapshots(self, **kwargs):
+ self.requests.append(kwargs)
+ return self.responses.pop(0)
+
+
+class Test_DLM_Regions_With_Snapshots:
+ def test_get_regions_without_snapshots(self):
+ dlm = DLM.__new__(DLM)
+ dlm.regions_with_snapshots = {}
+ regional_client = FakeEC2RegionalClient([{"Snapshots": []}])
+
+ dlm._get_regions_with_snapshots(regional_client)
+
+ assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: False}
+ assert regional_client.requests == [{"OwnerIds": ["self"], "MaxResults": 5}]
+
+ def test_get_regions_with_snapshots_after_pagination(self):
+ dlm = DLM.__new__(DLM)
+ dlm.regions_with_snapshots = {}
+ regional_client = FakeEC2RegionalClient(
+ [
+ {"Snapshots": [], "NextToken": "next-page"},
+ {"Snapshots": [{"SnapshotId": "snap-1234567890abcdef0"}]},
+ ]
+ )
+
+ dlm._get_regions_with_snapshots(regional_client)
+
+ assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: True}
+ assert regional_client.requests == [
+ {"OwnerIds": ["self"], "MaxResults": 5},
+ {"OwnerIds": ["self"], "MaxResults": 5, "NextToken": "next-page"},
+ ]
diff --git a/tests/providers/aws/services/dms/dms_instance_no_public_access/dms_no_public_access_test.py b/tests/providers/aws/services/dms/dms_instance_no_public_access/dms_no_public_access_test.py
index c8a99a0a82..4cc0f955d4 100644
--- a/tests/providers/aws/services/dms/dms_instance_no_public_access/dms_no_public_access_test.py
+++ b/tests/providers/aws/services/dms/dms_instance_no_public_access/dms_no_public_access_test.py
@@ -1,3 +1,5 @@
+import ast
+from pathlib import Path
from unittest import mock
import botocore
@@ -61,6 +63,42 @@ def mock_make_api_call_private(self, operation_name, kwargs):
class Test_dms_instance_no_public_access:
+ def test_ec2_client_is_not_imported_at_module_level(self):
+ repo_root = Path(__file__).parents[6]
+ check_source = repo_root / (
+ "prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py"
+ )
+ check_tree = ast.parse(check_source.read_text())
+
+ top_level_imports = [
+ node
+ for node in check_tree.body
+ if isinstance(node, (ast.Import, ast.ImportFrom))
+ ]
+
+ top_level_ec2_client_imports = [
+ node
+ for node in top_level_imports
+ if (
+ isinstance(node, ast.ImportFrom)
+ and node.module == "prowler.providers.aws.services.ec2.ec2_client"
+ )
+ or (
+ isinstance(node, ast.ImportFrom)
+ and node.module == "prowler.providers.aws.services.ec2"
+ and any(alias.name == "ec2_client" for alias in node.names)
+ )
+ or (
+ isinstance(node, ast.Import)
+ and any(
+ alias.name == "prowler.providers.aws.services.ec2.ec2_client"
+ for alias in node.names
+ )
+ )
+ ]
+
+ assert top_level_ec2_client_imports == []
+
@mock_aws
def test_dms_no_instances(self):
dms_client = client("dms", region_name=AWS_REGION_US_EAST_1)
@@ -79,6 +117,10 @@ class Test_dms_instance_no_public_access:
"prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
new=DMS(aws_provider),
),
+ mock.patch(
+ "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+ side_effect=AssertionError("EC2 client should not be loaded"),
+ ) as get_ec2_client_mock,
):
from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
dms_instance_no_public_access,
@@ -87,6 +129,7 @@ class Test_dms_instance_no_public_access:
check = dms_instance_no_public_access()
result = check.execute()
assert len(result) == 0
+ get_ec2_client_mock.assert_not_called()
@mock_aws
def test_dms_private(self):
@@ -108,6 +151,10 @@ class Test_dms_instance_no_public_access:
"prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
new=DMS(aws_provider),
),
+ mock.patch(
+ "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+ side_effect=AssertionError("EC2 client should not be loaded"),
+ ) as get_ec2_client_mock,
):
from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
dms_instance_no_public_access,
@@ -125,6 +172,7 @@ class Test_dms_instance_no_public_access:
assert result[0].resource_id == DMS_INSTANCE_NAME
assert result[0].resource_arn == DMS_INSTANCE_ARN
assert result[0].resource_tags == []
+ get_ec2_client_mock.assert_not_called()
@mock_aws
def test_dms_public(self):
@@ -146,6 +194,10 @@ class Test_dms_instance_no_public_access:
"prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
new=DMS(aws_provider),
),
+ mock.patch(
+ "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+ side_effect=AssertionError("EC2 client should not be loaded"),
+ ) as get_ec2_client_mock,
):
from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
dms_instance_no_public_access,
@@ -163,6 +215,7 @@ class Test_dms_instance_no_public_access:
assert result[0].resource_id == DMS_INSTANCE_NAME
assert result[0].resource_arn == DMS_INSTANCE_ARN
assert result[0].resource_tags == []
+ get_ec2_client_mock.assert_not_called()
@mock_aws
def test_dms_public_with_public_sg(self):
@@ -218,8 +271,8 @@ class Test_dms_instance_no_public_access:
new=dms_client,
),
mock.patch(
- "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.ec2_client",
- new=EC2(aws_provider),
+ "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+ return_value=EC2(aws_provider),
),
):
# Test Check
@@ -298,8 +351,8 @@ class Test_dms_instance_no_public_access:
new=dms_client,
),
mock.patch(
- "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.ec2_client",
- new=EC2(aws_provider),
+ "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+ return_value=EC2(aws_provider),
),
):
# Test Check
diff --git a/tests/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access_test.py b/tests/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access_test.py
new file mode 100644
index 0000000000..225a12348a
--- /dev/null
+++ b/tests/providers/aws/services/ec2/ec2_ami_account_block_public_access/ec2_ami_account_block_public_access_test.py
@@ -0,0 +1,133 @@
+from unittest import mock
+
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+
+class Test_ec2_ami_account_block_public_access:
+ @mock_aws
+ def test_ec2_ami_block_public_access_state_unblocked(self):
+ from prowler.providers.aws.services.ec2.ec2_service import AmiBlockPublicAccess
+
+ ec2_client = mock.MagicMock()
+ ec2_client.ami_block_public_access_states = [
+ AmiBlockPublicAccess(status="unblocked", region=AWS_REGION_US_EAST_1)
+ ]
+ ec2_client.audited_account = AWS_ACCOUNT_NUMBER
+ ec2_client.region = AWS_REGION_US_EAST_1
+ ec2_client.account_arn_template = (
+ f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access.ec2_client",
+ new=ec2_client,
+ ),
+ ):
+ # Test Check
+ from prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access import (
+ ec2_ami_account_block_public_access,
+ )
+
+ check = ec2_ami_account_block_public_access()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"AMI Block Public Access is disabled in {AWS_REGION_US_EAST_1}."
+ )
+ assert (
+ result[0].resource_arn
+ == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
+ )
+ assert result[0].resource_id == AWS_ACCOUNT_NUMBER
+ assert result[0].region == AWS_REGION_US_EAST_1
+
+ @mock_aws
+ def test_ec2_ami_block_public_access_state_block_new_sharing(self):
+ from prowler.providers.aws.services.ec2.ec2_service import AmiBlockPublicAccess
+
+ ec2_client = mock.MagicMock()
+ ec2_client.ami_block_public_access_states = [
+ AmiBlockPublicAccess(
+ status="block-new-sharing", region=AWS_REGION_US_EAST_1
+ )
+ ]
+ ec2_client.audited_account = AWS_ACCOUNT_NUMBER
+ ec2_client.region = AWS_REGION_US_EAST_1
+ ec2_client.account_arn_template = (
+ f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access.ec2_client",
+ new=ec2_client,
+ ),
+ ):
+ # Test Check
+ from prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access import (
+ ec2_ami_account_block_public_access,
+ )
+
+ check = ec2_ami_account_block_public_access()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"AMI Block Public Access is enabled in {AWS_REGION_US_EAST_1}."
+ )
+ assert (
+ result[0].resource_arn
+ == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
+ )
+ assert result[0].resource_id == AWS_ACCOUNT_NUMBER
+ assert result[0].region == AWS_REGION_US_EAST_1
+
+ @mock_aws
+ def test_ec2_ami_block_public_access_no_resources(self):
+ ec2_client = mock.MagicMock()
+ ec2_client.ami_block_public_access_states = []
+ ec2_client.audited_account = AWS_ACCOUNT_NUMBER
+ ec2_client.region = AWS_REGION_US_EAST_1
+ ec2_client.account_arn_template = (
+ f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access.ec2_client",
+ new=ec2_client,
+ ),
+ ):
+ # Test Check
+ from prowler.providers.aws.services.ec2.ec2_ami_account_block_public_access.ec2_ami_account_block_public_access import (
+ ec2_ami_account_block_public_access,
+ )
+
+ check = ec2_ami_account_block_public_access()
+ result = check.execute()
+
+ assert len(result) == 0
diff --git a/tests/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public_test.py b/tests/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public_test.py
index aace181328..b6465cde60 100644
--- a/tests/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public_test.py
+++ b/tests/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public_test.py
@@ -141,3 +141,86 @@ class Test_ec2_ami_public:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == []
+
+ @mock_aws
+ def test_multiple_self_owned_amis_mixed_public_and_private(self):
+ ec2 = client("ec2", region_name=AWS_REGION_US_EAST_1)
+
+ reservation = ec2.run_instances(ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1)
+ instance = reservation["Instances"][0]
+ instance_id = instance["InstanceId"]
+
+ private_image_id = ec2.create_image(
+ InstanceId=instance_id,
+ Name="test-private-ami",
+ Description="this is a private test ami",
+ )["ImageId"]
+ public_image_id = ec2.create_image(
+ InstanceId=instance_id,
+ Name="test-public-ami",
+ Description="this is a public test ami",
+ )["ImageId"]
+
+ image = resource("ec2", region_name=AWS_REGION_US_EAST_1).Image(public_image_id)
+ image.modify_attribute(
+ ImageId=public_image_id,
+ Attribute="launchPermission",
+ OperationType="add",
+ UserGroups=["all"],
+ )
+
+ from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_ami_public.ec2_ami_public.ec2_client",
+ new=EC2(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.ec2.ec2_ami_public.ec2_ami_public import (
+ ec2_ami_public,
+ )
+
+ check = ec2_ami_public()
+ result = check.execute()
+
+ findings_by_resource_id = {
+ finding.resource_id: finding for finding in result
+ }
+
+ assert len(result) == 2
+ assert set(findings_by_resource_id) == {private_image_id, public_image_id}
+
+ private_finding = findings_by_resource_id[private_image_id]
+ assert private_finding.status == "PASS"
+ assert (
+ private_finding.status_extended
+ == "EC2 AMI test-private-ami is not public."
+ )
+ assert (
+ private_finding.resource_arn
+ == f"arn:{aws_provider.identity.partition}:ec2:{AWS_REGION_US_EAST_1}:{aws_provider.identity.account}:image/{private_image_id}"
+ )
+ assert private_finding.region == AWS_REGION_US_EAST_1
+ assert private_finding.resource_tags == []
+
+ public_finding = findings_by_resource_id[public_image_id]
+ assert public_finding.status == "FAIL"
+ assert (
+ public_finding.status_extended
+ == "EC2 AMI test-public-ami is currently public."
+ )
+ assert (
+ public_finding.resource_arn
+ == f"arn:{aws_provider.identity.partition}:ec2:{AWS_REGION_US_EAST_1}:{aws_provider.identity.account}:image/{public_image_id}"
+ )
+ assert public_finding.region == AWS_REGION_US_EAST_1
+ assert public_finding.resource_tags == []
diff --git a/tests/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled_test.py b/tests/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled_test.py
index 8a1f323409..9d19211ca8 100644
--- a/tests/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled_test.py
+++ b/tests/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled_test.py
@@ -1,15 +1,64 @@
+from types import SimpleNamespace
from unittest import mock
from moto import mock_aws
from tests.providers.aws.utils import (
AWS_ACCOUNT_NUMBER,
+ AWS_COMMERCIAL_PARTITION,
+ AWS_REGION_EU_WEST_1,
AWS_REGION_US_EAST_1,
set_mocked_aws_provider,
)
class Test_ec2_instance_account_imdsv2_enabled:
+ @mock_aws
+ def test_ec2_imdsv2_uses_region_in_resource_arn(self):
+ from prowler.providers.aws.services.ec2.ec2_service import (
+ InstanceMetadataDefaults,
+ )
+
+ ec2_client = SimpleNamespace(
+ instance_metadata_defaults=[
+ InstanceMetadataDefaults(
+ http_tokens=None,
+ instances=True,
+ region=AWS_REGION_US_EAST_1,
+ ),
+ InstanceMetadataDefaults(
+ http_tokens=None,
+ instances=True,
+ region=AWS_REGION_EU_WEST_1,
+ ),
+ ],
+ audited_account=AWS_ACCOUNT_NUMBER,
+ audited_partition=AWS_COMMERCIAL_PARTITION,
+ provider=SimpleNamespace(scan_unused_services=False),
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_instance_account_imdsv2_enabled.ec2_instance_account_imdsv2_enabled.ec2_client",
+ new=ec2_client,
+ ),
+ ):
+ from prowler.providers.aws.services.ec2.ec2_instance_account_imdsv2_enabled.ec2_instance_account_imdsv2_enabled import (
+ ec2_instance_account_imdsv2_enabled,
+ )
+
+ result = ec2_instance_account_imdsv2_enabled().execute()
+
+ assert len(result) == 2
+ assert {report.resource_arn for report in result} == {
+ f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account",
+ f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account",
+ }
+
@mock_aws
def test_ec2_imdsv2_required(self):
from prowler.providers.aws.services.ec2.ec2_service import (
@@ -23,10 +72,8 @@ class Test_ec2_instance_account_imdsv2_enabled:
)
]
ec2_client.audited_account = AWS_ACCOUNT_NUMBER
+ ec2_client.audited_partition = AWS_COMMERCIAL_PARTITION
ec2_client.region = AWS_REGION_US_EAST_1
- ec2_client.account_arn_template = (
- f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
- )
with (
mock.patch(
@@ -71,12 +118,9 @@ class Test_ec2_instance_account_imdsv2_enabled:
)
]
ec2_client.audited_account = AWS_ACCOUNT_NUMBER
+ ec2_client.audited_partition = AWS_COMMERCIAL_PARTITION
ec2_client.region = AWS_REGION_US_EAST_1
- ec2_client.account_arn_template = (
- f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
- )
-
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
index 0e8d303fe0..a2f2dc705a 100644
--- a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
+++ b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
@@ -100,7 +100,7 @@ class Test_ec2_instance_secrets_user_data:
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
MaxCount=1,
- UserData="DB_PASSWORD=foobar123",
+ UserData='DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"',
)[0]
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -130,7 +130,7 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in EC2 instance {instance.id} User Data -> Secret Keyword on line 1."
+ == f"Potential secret found in EC2 instance {instance.id} User Data -> Generic Password on line 1."
)
assert result[0].resource_id == instance.id
assert (
@@ -233,7 +233,7 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in EC2 instance {instance.id} User Data -> Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in EC2 instance {instance.id} User Data -> Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == instance.id
assert (
@@ -327,7 +327,7 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in EC2 instance {instance.id} User Data -> Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in EC2 instance {instance.id} User Data -> Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == instance.id
assert (
@@ -337,6 +337,64 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION_US_EAST_1
+ @mock_aws
+ def test_one_ec2_with_verified_secret(self):
+ from prowler.lib.check.models import Severity
+
+ ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+ instance = ec2.create_instances(
+ ImageId=EXAMPLE_AMI_ID,
+ MinCount=1,
+ MaxCount=1,
+ UserData='STRIPE_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"',
+ )[0]
+
+ from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ audit_config={"secrets_validate": True},
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data.ec2_client",
+ new=EC2(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data import (
+ ec2_instance_secrets_user_data,
+ )
+
+ check = ec2_instance_secrets_user_data()
+ result = check.execute()
+
+ # The check must forward secrets_validate from the config to the scan.
+ assert mock_scan.call_args.kwargs.get("validate") is True
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert result[0].resource_id == instance.id
+
@mock_aws
def test_one_secrets_with_unicode_error(self):
invalid_utf8_bytes = b"\xc0\xaf"
@@ -368,4 +426,50 @@ class Test_ec2_instance_secrets_user_data:
check = ec2_instance_secrets_user_data()
result = check.execute()
- assert len(result) == 0
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not decode User Data" in result[0].status_extended
+
+ @mock_aws
+ def test_scan_failure_reports_manual(self):
+ from prowler.lib.utils.utils import SecretsScanError
+
+ ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+ instance = ec2.create_instances(
+ ImageId=EXAMPLE_AMI_ID,
+ MinCount=1,
+ MaxCount=1,
+ UserData='password = "Tr0ub4dor3xKq9vLmZ"',
+ )[0]
+
+ from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data.ec2_client",
+ new=EC2(aws_provider),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data import (
+ ec2_instance_secrets_user_data,
+ )
+
+ check = ec2_instance_secrets_user_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
+ assert result[0].resource_id == instance.id
diff --git a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture
index 2fb5138932..528ff40f8f 100644
--- a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture
+++ b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture
@@ -1,4 +1,4 @@
-DB_PASSWORD=foobar123
+DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"
DB_USER=foo
-API_KEY=12345abcd
-SERVICE_PASSWORD=bbaabb45
+STRIPE_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U
+SERVICE_PASSWORD="Xy9zPq2wKmRtVbN4"
diff --git a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture.gz b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture.gz
index 6120fcfbc4..859b38cb62 100644
Binary files a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture.gz and b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture.gz differ
diff --git a/tests/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami_test.py b/tests/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami_test.py
index bcf8a80f98..c90756a77a 100644
--- a/tests/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami_test.py
+++ b/tests/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami_test.py
@@ -1,11 +1,17 @@
from unittest import mock
import botocore
-from moto import mock_aws
+import pytest
from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
make_api_call = botocore.client.BaseClient._make_api_call
+describe_images_calls = []
+
+
+@pytest.fixture(autouse=True)
+def clear_describe_images_calls():
+ describe_images_calls.clear()
def mock_make_api_call(self, operation_name, kwarg):
@@ -27,16 +33,25 @@ def mock_make_api_call(self, operation_name, kwarg):
]
}
elif operation_name == "DescribeImages":
- if "Owners" in kwarg and kwarg["Owners"] == ["amazon"]:
+ describe_images_calls.append(kwarg)
+ if kwarg.get("Owners") == ["self"]:
+ return {"Images": []}
+ if kwarg.get("Owners") == ["amazon"]:
+ raise AssertionError(
+ "Amazon AMIs must not be fetched with a broad owner lookup"
+ )
+ if kwarg.get("ImageIds") == ["ami-12345678"]:
return {
"Images": [
{
"ImageId": "ami-12345678",
"DeprecationTime": "2050-01-01T00:00:00.000Z",
"Public": True,
+ "ImageOwnerAlias": "amazon",
}
]
}
+ return {"Images": []}
return make_api_call(self, operation_name, kwarg)
@@ -59,6 +74,13 @@ def mock_make_api_call_private(self, operation_name, kwarg):
]
}
elif operation_name == "DescribeImages":
+ describe_images_calls.append(kwarg)
+ if kwarg.get("Owners") == ["amazon"]:
+ raise AssertionError(
+ "Amazon AMIs must not be fetched with a broad owner lookup"
+ )
+ if kwarg.get("Owners") == ["self"]:
+ return {"Images": []}
return {
"Images": [
{
@@ -90,16 +112,25 @@ def mock_make_api_call_outdated_ami(self, operation_name, kwarg):
]
}
elif operation_name == "DescribeImages":
- if "Owners" in kwarg and kwarg["Owners"] == ["amazon"]:
+ describe_images_calls.append(kwarg)
+ if kwarg.get("Owners") == ["self"]:
+ return {"Images": []}
+ if kwarg.get("Owners") == ["amazon"]:
+ raise AssertionError(
+ "Amazon AMIs must not be fetched with a broad owner lookup"
+ )
+ if kwarg.get("ImageIds") == ["ami-87654321"]:
return {
"Images": [
{
"ImageId": "ami-87654321",
"DeprecationTime": "2022-01-01T00:00:00.000Z",
"Public": True,
+ "ImageOwnerAlias": "amazon",
}
]
}
+ return {"Images": []}
return make_api_call(self, operation_name, kwarg)
@@ -122,12 +153,32 @@ def mock_make_api_call_missing_ami(self, operation_name, kwarg):
]
}
elif operation_name == "DescribeImages":
+ describe_images_calls.append(kwarg)
+ if kwarg.get("Owners") == ["amazon"]:
+ raise AssertionError(
+ "Amazon AMIs must not be fetched with a broad owner lookup"
+ )
+ return {"Images": []}
+ return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_no_instances(self, operation_name, kwarg):
+ if operation_name == "DescribeInstances":
+ return {"Reservations": []}
+ elif operation_name == "DescribeImages":
+ describe_images_calls.append(kwarg)
+ if kwarg.get("Owners") == ["amazon"]:
+ raise AssertionError(
+ "Amazon AMIs must not be fetched with a broad owner lookup"
+ )
return {"Images": []}
return make_api_call(self, operation_name, kwarg)
class Test_ec2_instance_with_outdated_ami:
- @mock_aws
+ @mock.patch(
+ "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_no_instances
+ )
def test_ec2_no_instances(self):
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -151,6 +202,7 @@ class Test_ec2_instance_with_outdated_ami:
result = check.execute()
assert len(result) == 0
+ assert not any("ImageIds" in call for call in describe_images_calls)
@mock.patch(
"botocore.client.BaseClient._make_api_call", new=mock_make_api_call_private
@@ -178,6 +230,13 @@ class Test_ec2_instance_with_outdated_ami:
result = check.execute()
assert len(result) == 0
+ assert not any(
+ call.get("Owners") == ["amazon"] for call in describe_images_calls
+ )
+ assert any(
+ call.get("ImageIds") == ["ami-12345678"]
+ for call in describe_images_calls
+ )
@mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
def test_instance_ami_not_outdated(self):
@@ -209,6 +268,13 @@ class Test_ec2_instance_with_outdated_ami:
result[0].status_extended
== "EC2 Instance i-0123456789abcdef0 is not using an outdated AMI."
)
+ assert not any(
+ call.get("Owners") == ["amazon"] for call in describe_images_calls
+ )
+ assert any(
+ call.get("ImageIds") == ["ami-12345678"]
+ for call in describe_images_calls
+ )
@mock.patch(
"botocore.client.BaseClient._make_api_call", new=mock_make_api_call_outdated_ami
@@ -242,6 +308,13 @@ class Test_ec2_instance_with_outdated_ami:
result[0].status_extended
== "EC2 Instance i-0123456789abcdef0 is using outdated AMI ami-87654321."
)
+ assert not any(
+ call.get("Owners") == ["amazon"] for call in describe_images_calls
+ )
+ assert any(
+ call.get("ImageIds") == ["ami-87654321"]
+ for call in describe_images_calls
+ )
@mock.patch(
"botocore.client.BaseClient._make_api_call", new=mock_make_api_call_missing_ami
@@ -269,3 +342,10 @@ class Test_ec2_instance_with_outdated_ami:
result = check.execute()
assert result == []
+ assert not any(
+ call.get("Owners") == ["amazon"] for call in describe_images_calls
+ )
+ assert any(
+ call.get("ImageIds") == ["ami-missing"]
+ for call in describe_images_calls
+ )
diff --git a/tests/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip_test.py b/tests/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip_test.py
index f0c6eb13e7..d435d971d8 100644
--- a/tests/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip_test.py
+++ b/tests/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip_test.py
@@ -39,6 +39,12 @@ def mock_make_api_call(self, operation_name, kwarg):
return make_api_call(self, operation_name, kwarg)
+def get_mocked_ec2_client():
+ ec2_client = mock.MagicMock()
+ ec2_client.audit_config = {}
+ return ec2_client
+
+
class Test_ec2_launch_template_no_public_ip:
@mock_aws
def test_no_launch_templates(self):
@@ -124,7 +130,7 @@ class Test_ec2_launch_template_no_public_ip:
assert result[0].resource_tags == []
def test_launch_template_public_ip_auto_assign(self):
- ec2_client = mock.MagicMock()
+ ec2_client = get_mocked_ec2_client()
launch_template_name = "tester"
launch_template_id = "lt-1234567890"
launch_template_arn = (
@@ -190,7 +196,7 @@ class Test_ec2_launch_template_no_public_ip:
def test_network_interface_with_public_ipv4_network_interface_autoassign_true_and_false(
self,
):
- ec2_client = mock.MagicMock()
+ ec2_client = get_mocked_ec2_client()
launch_template_name = "tester"
launch_template_id = "lt-1234567890"
launch_template_arn = (
@@ -290,7 +296,7 @@ class Test_ec2_launch_template_no_public_ip:
def test_network_interface_with_public_ipv6_network_interface_autoassign_true_and_false(
self,
):
- ec2_client = mock.MagicMock()
+ ec2_client = get_mocked_ec2_client()
launch_template_name = "tester"
launch_template_id = "lt-1234567890"
launch_template_arn = (
diff --git a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets_test.py b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets_test.py
index 0430ca5cae..dab6debb6b 100644
--- a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets_test.py
+++ b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets_test.py
@@ -29,7 +29,9 @@ def mock_make_api_call(self, operation_name, kwarg):
"VersionNumber": 123,
"LaunchTemplateData": {
"UserData": b64encode(
- "DB_PASSWORD=foobar123".encode(encoding_format_utf_8)
+ 'DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"'.encode(
+ encoding_format_utf_8
+ )
).decode(encoding_format_utf_8),
"NetworkInterfaces": [{"AssociatePublicIpAddress": True}],
},
@@ -164,7 +166,7 @@ class Test_ec2_launch_template_no_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == "Potential secret found in User Data for EC2 Launch Template tester1 in template versions: Version 123: Secret Keyword on line 1."
+ == "Potential secret found in User Data for EC2 Launch Template tester1 in template versions: Version 123: Generic Password on line 1."
)
assert result[0].resource_id == "lt-1234567890"
assert result[0].region == AWS_REGION_US_EAST_1
@@ -212,7 +214,7 @@ class Test_ec2_launch_template_no_secrets:
)
ec2_client.launch_templates = [launch_template]
- ec2_client.audit_config = {"detect_secrets_plugins": None}
+ ec2_client.audit_config = {}
with (
mock.patch(
@@ -236,7 +238,7 @@ class Test_ec2_launch_template_no_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4, Version 2: Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4, Version 2: Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == launch_template_id
assert result[0].region == AWS_REGION_US_EAST_1
@@ -290,7 +292,7 @@ class Test_ec2_launch_template_no_secrets:
)
ec2_client.launch_templates = [launch_template]
- ec2_client.audit_config = {"detect_secrets_plugins": None}
+ ec2_client.audit_config = {}
with (
mock.patch(
@@ -314,7 +316,7 @@ class Test_ec2_launch_template_no_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == launch_template_id
assert result[0].region == AWS_REGION_US_EAST_1
@@ -358,7 +360,7 @@ class Test_ec2_launch_template_no_secrets:
)
ec2_client.launch_templates = [launch_template]
- ec2_client.audit_config = {"detect_secrets_plugins": None}
+ ec2_client.audit_config = {}
with (
mock.patch(
@@ -382,7 +384,7 @@ class Test_ec2_launch_template_no_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name} in template versions: Version 1: Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == launch_template_id
assert result[0].region == AWS_REGION_US_EAST_1
@@ -391,6 +393,81 @@ class Test_ec2_launch_template_no_secrets:
)
assert result[0].resource_tags == []
+ def test_one_launch_template_with_verified_secret(self):
+ from prowler.lib.check.models import Severity
+
+ ec2_client = mock.MagicMock()
+ launch_template_name = "tester"
+ launch_template_id = "lt-1234567890"
+ launch_template_arn = (
+ f"arn:aws:ec2:us-east-1:123456789012:launch-template/{launch_template_id}"
+ )
+
+ launch_template_data = TemplateData(
+ user_data=b64encode(
+ "This is some user_data".encode(encoding_format_utf_8)
+ ).decode(encoding_format_utf_8),
+ associate_public_ip_address=True,
+ )
+
+ launch_template_versions = [
+ LaunchTemplateVersion(
+ version_number=1,
+ template_data=launch_template_data,
+ ),
+ ]
+
+ launch_template = LaunchTemplate(
+ name=launch_template_name,
+ id=launch_template_id,
+ arn=launch_template_arn,
+ region=AWS_REGION_US_EAST_1,
+ versions=launch_template_versions,
+ )
+
+ ec2_client.launch_templates = [launch_template]
+ ec2_client.audit_config = {"secrets_validate": True}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=ec2_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_launch_template_no_secrets.ec2_launch_template_no_secrets.ec2_client",
+ new=ec2_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_launch_template_no_secrets.ec2_launch_template_no_secrets.detect_secrets_scan_batch",
+ return_value={
+ (0, 0): [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 1,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ # Test Check
+ from prowler.providers.aws.services.ec2.ec2_launch_template_no_secrets.ec2_launch_template_no_secrets import (
+ ec2_launch_template_no_secrets,
+ )
+
+ check = ec2_launch_template_no_secrets()
+ result = check.execute()
+
+ # The check must forward secrets_validate from the config to the scan.
+ assert mock_scan.call_args.kwargs.get("validate") is True
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert result[0].resource_id == launch_template_id
+
@mock_aws
def test_one_launch_template_without_user_data(self):
launch_template_name = "tester"
@@ -506,7 +583,7 @@ class Test_ec2_launch_template_no_secrets:
launch_template_secrets,
launch_template_no_secrets,
]
- ec2_client.audit_config = {"detect_secrets_plugins": None}
+ ec2_client.audit_config = {}
with (
mock.patch(
@@ -530,7 +607,7 @@ class Test_ec2_launch_template_no_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name1} in template versions: Version 1: Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
+ == f"Potential secret found in User Data for EC2 Launch Template {launch_template_name1} in template versions: Version 1: Generic Password on line 1, JSON Web Token (base64url-encoded) on line 3, Generic Password on line 4."
)
assert result[0].resource_id == launch_template_id1
assert result[0].region == AWS_REGION_US_EAST_1
@@ -593,10 +670,10 @@ class Test_ec2_launch_template_no_secrets:
result = check.execute()
assert len(result) == 1
- assert result[0].status == "PASS"
+ assert result[0].status == "MANUAL"
assert (
- result[0].status_extended
- == f"No secrets found in User Data of any version for EC2 Launch Template {launch_template_name}."
+ f"Could not decode User Data for EC2 Launch Template {launch_template_name}"
+ in result[0].status_extended
)
assert result[0].resource_id == launch_template_id
assert result[0].region == AWS_REGION_US_EAST_1
diff --git a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture
index 2fb5138932..528ff40f8f 100644
--- a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture
+++ b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture
@@ -1,4 +1,4 @@
-DB_PASSWORD=foobar123
+DB_PASSWORD="Tr0ub4dor3xKq9vLmZ"
DB_USER=foo
-API_KEY=12345abcd
-SERVICE_PASSWORD=bbaabb45
+STRIPE_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U
+SERVICE_PASSWORD="Xy9zPq2wKmRtVbN4"
diff --git a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture.gz b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture.gz
index 6120fcfbc4..859b38cb62 100644
Binary files a/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture.gz and b/tests/providers/aws/services/ec2/ec2_launch_template_no_secrets/fixtures/fixture.gz differ
diff --git a/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip/__init__.py b/tests/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py b/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py
index d1b77b9f8b..b959f4b257 100644
--- a/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py
+++ b/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py
@@ -14,6 +14,57 @@ EXAMPLE_AMI_ID = "ami-12c6146b"
class Test_ec2_securitygroup_not_used:
+ def test_ec2_sg_used_by_lambda_outside_selected_analysis_limit(self):
+ from prowler.providers.aws.services.ec2.ec2_service import SecurityGroup
+
+ sg_id = "sg-limited-out"
+ sg_name = "lambda-sg"
+ security_group = SecurityGroup(
+ name=sg_name,
+ region=AWS_REGION_US_EAST_1,
+ arn=f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:security-group/{sg_id}",
+ id=sg_id,
+ vpc_id="vpc-test",
+ associated_sgs=[],
+ network_interfaces=[],
+ ingress_rules=[],
+ egress_rules=[],
+ tags=[],
+ )
+ ec2_client = mock.MagicMock()
+ ec2_client.security_groups = {security_group.arn: security_group}
+ awslambda_client = mock.MagicMock()
+ awslambda_client.functions = {}
+ awslambda_client.security_groups_in_use = {sg_id}
+ aws_provider = set_mocked_aws_provider()
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.ec2_client",
+ new=ec2_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.awslambda_client",
+ new=awslambda_client,
+ ),
+ ):
+ from prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used import (
+ ec2_securitygroup_not_used,
+ )
+
+ result = ec2_securitygroup_not_used().execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"Security group {sg_name} ({sg_id}) it is being used."
+ )
+
@mock_aws
def test_ec2_default_sgs(self):
# Create EC2 Mocked Resources
diff --git a/tests/providers/aws/services/ec2/ec2_service_test.py b/tests/providers/aws/services/ec2/ec2_service_test.py
index aca200dd61..3fe154b536 100644
--- a/tests/providers/aws/services/ec2/ec2_service_test.py
+++ b/tests/providers/aws/services/ec2/ec2_service_test.py
@@ -6,12 +6,17 @@ from datetime import datetime
import botocore
import mock
from boto3 import client, resource
+from botocore.exceptions import ClientError
from dateutil.tz import tzutc
from freezegun import freeze_time
from moto import mock_aws
from prowler.config.config import encoding_format_utf_8
-from prowler.providers.aws.services.ec2.ec2_service import EC2
+from prowler.providers.aws.services.ec2.ec2_service import (
+ DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE,
+ EC2,
+ Snapshot,
+)
from tests.providers.aws.utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
@@ -103,6 +108,216 @@ class Test_EC2_Service:
ec2 = EC2(aws_provider)
assert ec2.audited_account == AWS_ACCOUNT_NUMBER
+ def test_snapshot_limit_bounds_public_attribute_calls_to_latest_selected(self):
+ class FakeEC2Client:
+ def __init__(self):
+ self.calls = []
+
+ def describe_snapshot_attribute(self, **kwargs):
+ self.calls.append(kwargs["SnapshotId"])
+ return {"CreateVolumePermissions": []}
+
+ regional_client = FakeEC2Client()
+ ec2 = EC2.__new__(EC2)
+ ec2.snapshots = [
+ Snapshot(
+ id="snap-old",
+ arn="arn:aws:ec2:eu-west-1:123456789012:snapshot/snap-old",
+ region=AWS_REGION_EU_WEST_1,
+ encrypted=True,
+ start_time=datetime(2024, 1, 1),
+ volume="vol-old",
+ ),
+ Snapshot(
+ id="snap-new",
+ arn="arn:aws:ec2:eu-west-1:123456789012:snapshot/snap-new",
+ region=AWS_REGION_EU_WEST_1,
+ encrypted=True,
+ start_time=datetime(2024, 1, 2),
+ volume="vol-new",
+ ),
+ ]
+ ec2.snapshot_limit = 1
+ ec2.regional_clients = {AWS_REGION_EU_WEST_1: regional_client}
+
+ ec2._select_snapshots_for_analysis()
+ for snapshot in ec2.snapshots:
+ ec2._determine_public_snapshots(snapshot)
+
+ assert [snapshot.id for snapshot in ec2.snapshots] == ["snap-new"]
+ assert regional_client.calls == ["snap-new"]
+
+ def test_snapshot_limit_preserves_volume_index_and_selects_global_latest(self):
+ class FakePaginator:
+ def __init__(self, snapshots):
+ self.snapshots = snapshots
+
+ def paginate(self, **kwargs):
+ assert "PageSize" not in kwargs
+ return [{"Snapshots": self.snapshots}]
+
+ class FakeEC2Client:
+ def __init__(self, region, snapshots):
+ self.region = region
+ self.snapshots = snapshots
+
+ def get_paginator(self, name):
+ assert name == "describe_snapshots"
+ return FakePaginator(self.snapshots)
+
+ ec2 = EC2.__new__(EC2)
+ ec2.snapshots = []
+ ec2.volumes_with_snapshots = {}
+ ec2.regions_with_snapshots = {}
+ ec2.snapshot_limit = 1
+ ec2.audit_resources = []
+ ec2.audited_partition = "aws"
+ ec2.audited_account = AWS_ACCOUNT_NUMBER
+ old_client = FakeEC2Client(
+ AWS_REGION_EU_WEST_1,
+ [
+ {
+ "SnapshotId": "snap-old",
+ "VolumeId": "vol-old",
+ "StartTime": datetime(2024, 1, 1),
+ }
+ ],
+ )
+ new_client = FakeEC2Client(
+ AWS_REGION_US_EAST_1,
+ [
+ {
+ "SnapshotId": "snap-new",
+ "VolumeId": "vol-new",
+ "StartTime": datetime(2024, 1, 2),
+ }
+ ],
+ )
+
+ ec2._describe_snapshots(old_client)
+ ec2._describe_snapshots(new_client)
+ ec2._select_snapshots_for_analysis()
+
+ assert ec2.volumes_with_snapshots == {"vol-old": True, "vol-new": True}
+ assert [snapshot.id for snapshot in ec2.snapshots] == ["snap-new"]
+
+ def test_describe_images_by_id_preserves_valid_amis_when_batch_has_missing_ids(
+ self,
+ ):
+ missing_image_id = "ami-0000-missing"
+ valid_image_ids = [
+ f"ami-{index:04d}"
+ for index in range(1, DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE + 1)
+ ]
+ instance_image_ids = valid_image_ids + [missing_image_id]
+
+ class FakeInstance:
+ def __init__(self, image_id):
+ self.region = AWS_REGION_US_EAST_1
+ self.image_id = image_id
+
+ class FakeEC2Client:
+ region = AWS_REGION_US_EAST_1
+
+ def __init__(self):
+ self.image_id_calls = []
+
+ def describe_images(self, **kwargs):
+ if kwargs.get("Owners") == ["self"]:
+ return {"Images": []}
+
+ image_ids = kwargs["ImageIds"]
+ self.image_id_calls.append(image_ids)
+ if missing_image_id in image_ids:
+ raise ClientError(
+ {
+ "Error": {
+ "Code": "InvalidAMIID.NotFound",
+ "Message": "The image id does not exist",
+ }
+ },
+ "DescribeImages",
+ )
+
+ return {
+ "Images": [
+ {
+ "ImageId": image_id,
+ "Public": True,
+ "ImageOwnerAlias": "amazon",
+ }
+ for image_id in image_ids
+ ]
+ }
+
+ regional_client = FakeEC2Client()
+ ec2 = EC2.__new__(EC2)
+ ec2.instances = [FakeInstance(image_id) for image_id in instance_image_ids]
+ ec2.images = []
+ ec2.images_by_id = {}
+ ec2.audit_resources = []
+ ec2.audited_partition = "aws"
+ ec2.audited_account = AWS_ACCOUNT_NUMBER
+
+ ec2._describe_images(regional_client)
+
+ assert (
+ len(regional_client.image_id_calls[0])
+ == DESCRIBE_IMAGES_IMAGE_IDS_BATCH_SIZE
+ )
+ assert regional_client.image_id_calls[-1] == [valid_image_ids[-1]]
+ assert missing_image_id not in ec2.images_by_id
+ assert set(ec2.images_by_id) == set(valid_image_ids)
+ assert {image.owner for image in ec2.images} == {"amazon"}
+
+ def test_describe_images_ignores_non_amazon_public_images_returned_by_image_id(
+ self,
+ ):
+ marketplace_image_id = "ami-marketplace-public"
+ vendor_image_id = "ami-vendor-public"
+
+ class FakeInstance:
+ def __init__(self, image_id):
+ self.region = AWS_REGION_US_EAST_1
+ self.image_id = image_id
+
+ class FakeEC2Client:
+ region = AWS_REGION_US_EAST_1
+
+ def describe_images(self, **kwargs):
+ if kwargs.get("Owners") == ["self"]:
+ return {"Images": []}
+
+ return {
+ "Images": [
+ {
+ "ImageId": marketplace_image_id,
+ "Public": True,
+ "ImageOwnerAlias": "aws-marketplace",
+ },
+ {
+ "ImageId": vendor_image_id,
+ "Public": True,
+ },
+ ]
+ }
+
+ ec2 = EC2.__new__(EC2)
+ ec2.instances = [
+ FakeInstance(marketplace_image_id),
+ FakeInstance(vendor_image_id),
+ ]
+ ec2.images = []
+ ec2.images_by_id = {}
+ ec2.audit_resources = []
+ ec2.audited_partition = "aws"
+ ec2.audited_account = AWS_ACCOUNT_NUMBER
+
+ ec2._describe_images(FakeEC2Client())
+
+ assert ec2.images == []
+ assert ec2.images_by_id == {}
+
# Test EC2 Describe Instances
@mock_aws
@freeze_time(MOCK_DATETIME)
@@ -346,6 +561,24 @@ class Test_EC2_Service:
assert not snapshot.encrypted
assert snapshot.public
+ @mock_aws
+ def test_snapshot_limit_exposes_only_selected_snapshots(self):
+ ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1)
+ ec2_resource = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+ volume_id = ec2_resource.create_volume(
+ AvailabilityZone="us-east-1a",
+ Size=80,
+ VolumeType="gp2",
+ ).id
+ for _ in range(3):
+ ec2_client.create_snapshot(VolumeId=volume_id)
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config={"max_ebs_snapshots": 1}
+ )
+ ec2 = EC2(aws_provider)
+
+ assert len(ec2.snapshots) == 1
+
# Test EC2 Instance User Data
@mock_aws
def test_get_instance_user_data(self):
@@ -632,9 +865,10 @@ class Test_EC2_Service:
{"Key": "OS_Version", "Value": "AWS Linux 2"},
]
- # Verify that Amazon images are also present
- amazon_images = [img for img in ec2.images if img.owner == "amazon"]
- assert len(amazon_images) > 0 # Should have Amazon AMIs
+ # Amazon public AMIs are fetched by targeted instance ImageIds only when
+ # AWS identifies them as Amazon-owned. Moto does not expose that owner
+ # alias for its fixture AMIs, so this service test only verifies the
+ # self-owned AMI behavior used by ec2_ami_public.
# Test EC2 Describe Volumes
@mock_aws
diff --git a/tests/providers/aws/services/ecs/ecs_service_test.py b/tests/providers/aws/services/ecs/ecs_service_test.py
index b472e94b88..75ce812c32 100644
--- a/tests/providers/aws/services/ecs/ecs_service_test.py
+++ b/tests/providers/aws/services/ecs/ecs_service_test.py
@@ -1,9 +1,14 @@
+from datetime import datetime, timezone
from unittest.mock import patch
import botocore
from prowler.providers.aws.services.ecs.ecs_service import ECS
-from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider
+from tests.providers.aws.utils import (
+ AWS_REGION_EU_WEST_1,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
make_api_call = botocore.client.BaseClient._make_api_call
@@ -115,6 +120,127 @@ def mock_generate_regional_clients(provider, service):
return {AWS_REGION_EU_WEST_1: regional_client}
+def mock_generate_multi_region_clients(provider, service):
+ eu_west_1_client = provider._session.current_session.client(
+ service, region_name=AWS_REGION_EU_WEST_1
+ )
+ eu_west_1_client.region = AWS_REGION_EU_WEST_1
+
+ us_east_1_client = provider._session.current_session.client(
+ service, region_name=AWS_REGION_US_EAST_1
+ )
+ us_east_1_client.region = AWS_REGION_US_EAST_1
+
+ return {
+ AWS_REGION_EU_WEST_1: eu_west_1_client,
+ AWS_REGION_US_EAST_1: us_east_1_client,
+ }
+
+
+def mock_make_api_call_task_definitions_by_registration_date(
+ self, operation_name, kwarg
+):
+ task_definition_dates = {
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-old:1": datetime(
+ 2024, 1, 1, tzinfo=timezone.utc
+ ),
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-second-newest:1": datetime(
+ 2024, 5, 1, tzinfo=timezone.utc
+ ),
+ f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-newest:1": datetime(
+ 2024, 6, 1, tzinfo=timezone.utc
+ ),
+ f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-old:1": datetime(
+ 2024, 2, 1, tzinfo=timezone.utc
+ ),
+ }
+ task_definitions_by_region = {
+ AWS_REGION_EU_WEST_1: [
+ task_definition
+ for task_definition in task_definition_dates
+ if f":{AWS_REGION_EU_WEST_1}:" in task_definition
+ ],
+ AWS_REGION_US_EAST_1: [
+ task_definition
+ for task_definition in task_definition_dates
+ if f":{AWS_REGION_US_EAST_1}:" in task_definition
+ ],
+ }
+
+ if operation_name == "ListTaskDefinitions":
+ return {"taskDefinitionArns": task_definitions_by_region[self.region]}
+ if operation_name == "DescribeTaskDefinition":
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+ },
+ "tags": [],
+ }
+ if operation_name == "ListClusters":
+ return {"clusterArns": []}
+ return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_task_definitions_with_equal_registration_dates(
+ self, operation_name, kwarg
+):
+ registered_at = datetime(2024, 1, 1, tzinfo=timezone.utc)
+ task_definition_dates = {
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/zzz-task:1": registered_at,
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/aaa-task:1": registered_at,
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/mmm-task:1": registered_at,
+ }
+
+ if operation_name == "ListTaskDefinitions":
+ return {"taskDefinitionArns": list(task_definition_dates)}
+ if operation_name == "DescribeTaskDefinition":
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+ },
+ "tags": [],
+ }
+ if operation_name == "ListClusters":
+ return {"clusterArns": []}
+ return make_api_call(self, operation_name, kwarg)
+
+
+DESCRIBED_TASK_DEFINITIONS = []
+
+
+def mock_make_api_call_task_definitions_with_audit_resources(
+ self, operation_name, kwarg
+):
+ task_definition_dates = {
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/audited-older:1": datetime(
+ 2024, 1, 1, tzinfo=timezone.utc
+ ),
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/audited-newer:1": datetime(
+ 2024, 2, 1, tzinfo=timezone.utc
+ ),
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/unaudited-newest:1": datetime(
+ 2024, 3, 1, tzinfo=timezone.utc
+ ),
+ }
+
+ if operation_name == "ListTaskDefinitions":
+ return {"taskDefinitionArns": list(task_definition_dates)}
+ if operation_name == "DescribeTaskDefinition":
+ DESCRIBED_TASK_DEFINITIONS.append(kwarg["taskDefinition"])
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+ },
+ "tags": [],
+ }
+ if operation_name == "ListClusters":
+ return {"clusterArns": []}
+ return make_api_call(self, operation_name, kwarg)
+
+
@patch(
"prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
new=mock_generate_regional_clients,
@@ -139,7 +265,6 @@ class Test_ECS_Service:
ecs = ECS(aws_provider)
assert ecs.session.__class__.__name__ == "Session"
- # Test list ECS task definitions
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
def test_list_task_definitions(self):
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
@@ -201,6 +326,244 @@ class Test_ECS_Service:
.readonly_rootfilesystem
)
+ def test_task_definitions_are_loaded_once_for_analysis(self):
+ describe_calls = []
+ list_calls = []
+
+ def counting_make_api_call(self, operation_name, kwarg):
+ if operation_name == "ListTaskDefinitions":
+ list_calls.append(kwarg)
+ return {
+ "taskDefinitionArns": [
+ f"arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:{i}"
+ for i in (3, 2, 1)
+ ]
+ }
+ if operation_name == "DescribeTaskDefinition":
+ describe_calls.append(kwarg["taskDefinition"])
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "networkMode": "bridge",
+ "pidMode": "",
+ "tags": [],
+ }
+ }
+ return make_api_call(self, operation_name, kwarg)
+
+ with patch(
+ "botocore.client.BaseClient._make_api_call", new=counting_make_api_call
+ ):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+ ecs = ECS(aws_provider)
+
+ assert [td.revision for td in ecs.task_definitions.values()] == [
+ "3",
+ "2",
+ "1",
+ ]
+ assert list_calls == [{"sort": "DESC"}]
+ assert len(describe_calls) == 3
+
+ def test_task_definition_limit_exposes_only_selected_resources(self):
+ describe_calls = []
+
+ def counting_make_api_call(self, operation_name, kwarg):
+ if operation_name == "ListTaskDefinitions":
+ return {
+ "taskDefinitionArns": [
+ f"arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:{i}"
+ for i in (3, 2, 1)
+ ]
+ }
+ if operation_name == "DescribeTaskDefinition":
+ describe_calls.append(kwarg["taskDefinition"])
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "networkMode": "bridge",
+ "pidMode": "",
+ "tags": [],
+ }
+ }
+ return make_api_call(self, operation_name, kwarg)
+
+ with patch(
+ "botocore.client.BaseClient._make_api_call", new=counting_make_api_call
+ ):
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 2}
+ )
+ ecs = ECS(aws_provider)
+
+ assert [td.revision for td in ecs.task_definitions.values()] == ["3", "2"]
+ assert len(describe_calls) == 3
+
+ def test_task_definition_limit_describes_candidates_before_exposing_limit(self):
+ describe_calls = []
+
+ def counting_make_api_call(self, operation_name, kwarg):
+ if operation_name == "ListTaskDefinitions":
+ return {
+ "taskDefinitionArns": [
+ f"arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:{i}"
+ for i in (3, 2, 1)
+ ]
+ }
+ if operation_name == "DescribeTaskDefinition":
+ describe_calls.append(kwarg["taskDefinition"])
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "networkMode": "bridge",
+ "pidMode": "",
+ "tags": [],
+ }
+ }
+ return mock_make_api_call(self, operation_name, kwarg)
+
+ with patch(
+ "botocore.client.BaseClient._make_api_call", new=counting_make_api_call
+ ):
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 1}
+ )
+ ecs = ECS(aws_provider)
+
+ assert [td.revision for td in ecs.task_definitions.values()] == ["3"]
+ assert sorted(describe_calls) == sorted(
+ [
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:3",
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:2",
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:1",
+ ]
+ )
+
+ @patch(
+ "botocore.client.BaseClient._make_api_call",
+ new=mock_make_api_call_task_definitions_by_registration_date,
+ )
+ def test_task_definition_limit_uses_global_latest_registration_dates(self):
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ audit_config={"max_ecs_task_definitions": 2},
+ )
+ with patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_multi_region_clients,
+ ):
+ ecs = ECS(aws_provider)
+
+ assert list(ecs.task_definitions) == [
+ f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-newest:1",
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-second-newest:1",
+ ]
+
+ @patch(
+ "botocore.client.BaseClient._make_api_call",
+ new=mock_make_api_call_task_definitions_with_equal_registration_dates,
+ )
+ def test_task_definition_limit_uses_arn_order_for_equal_registration_dates(self):
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 2}
+ )
+ ecs = ECS(aws_provider)
+
+ assert list(ecs.task_definitions) == [
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/aaa-task:1",
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/mmm-task:1",
+ ]
+
+ @patch(
+ "botocore.client.BaseClient._make_api_call",
+ new=mock_make_api_call_task_definitions_with_audit_resources,
+ )
+ def test_task_definition_limit_applies_after_audit_resources_filter(self):
+ DESCRIBED_TASK_DEFINITIONS.clear()
+ audited_older_task_definition = (
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+ "task-definition/audited-older:1"
+ )
+ audited_newer_task_definition = (
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+ "task-definition/audited-newer:1"
+ )
+ unaudited_newest_task_definition = (
+ f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+ "task-definition/unaudited-newest:1"
+ )
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 1}
+ )
+ aws_provider._audit_resources = [
+ audited_older_task_definition,
+ audited_newer_task_definition,
+ ]
+
+ ecs = ECS(aws_provider)
+
+ assert sorted(DESCRIBED_TASK_DEFINITIONS) == sorted(
+ [audited_older_task_definition, audited_newer_task_definition]
+ )
+ assert list(ecs.task_definitions) == [audited_newer_task_definition]
+ assert unaudited_newest_task_definition not in ecs.task_definitions
+
+ def test_task_definition_limit_does_not_starve_later_regions(self):
+ describe_calls = []
+
+ def counting_make_api_call(self, operation_name, kwarg):
+ region = self.meta.region_name
+ if operation_name == "ListTaskDefinitions":
+ task_definition_revisions = {
+ AWS_REGION_EU_WEST_1: (3, 2, 1),
+ AWS_REGION_US_EAST_1: (9,),
+ }[region]
+ return {
+ "taskDefinitionArns": [
+ f"arn:aws:ecs:{region}:123456789012:task-definition/fam:{revision}"
+ for revision in task_definition_revisions
+ ]
+ }
+ if operation_name == "DescribeTaskDefinition":
+ describe_calls.append(kwarg["taskDefinition"])
+ return {
+ "taskDefinition": {
+ "containerDefinitions": [],
+ "networkMode": "bridge",
+ "pidMode": "",
+ "tags": [],
+ }
+ }
+ if operation_name == "ListClusters":
+ return {"clusterArns": []}
+ return mock_make_api_call(self, operation_name, kwarg)
+
+ with (
+ patch(
+ "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+ new=mock_generate_multi_region_clients,
+ ),
+ patch(
+ "botocore.client.BaseClient._make_api_call", new=counting_make_api_call
+ ),
+ ):
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ audit_config={"max_ecs_task_definitions": 2},
+ )
+ ecs = ECS(aws_provider)
+
+ assert [td.region for td in ecs.task_definitions.values()] == [
+ AWS_REGION_EU_WEST_1,
+ AWS_REGION_US_EAST_1,
+ ]
+ assert set(describe_calls) == {
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:3",
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:2",
+ "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:1",
+ "arn:aws:ecs:us-east-1:123456789012:task-definition/fam:9",
+ }
+
# Test list ECS clusters
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
def test_list_clusters(self):
diff --git a/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py b/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
index 24c27ccf0b..753c00b0ef 100644
--- a/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
+++ b/tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
@@ -11,9 +11,17 @@ CONTAINER_NAME = "test-container"
ENV_VAR_NAME_NO_SECRETS = "host"
ENV_VAR_VALUE_NO_SECRETS = "localhost:1234"
ENV_VAR_NAME_WITH_KEYWORD = "DB_PASSWORD"
-ENV_VAR_VALUE_WITH_SECRETS = "srv://admin:pass@db"
+# Realistic fake secrets that Kingfisher actually detects (placeholders such as
+# the previous "srv://admin:pass@db" basic-auth URL are no longer flagged).
+# A JWT fires on any line of the dumped JSON (even when followed by a
+# trailing comma); a keyword-named variable additionally fires the generic
+# keyword rule when it is the last entry in the dump.
+ENV_VAR_VALUE_WITH_SECRETS = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
ENV_VAR_NAME_WITH_KEYWORD2 = "DATABASE_PASSWORD"
-ENV_VAR_VALUE_WITH_SECRETS2 = "srv://admin:password@database"
+ENV_VAR_VALUE_WITH_SECRETS2 = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5ODc2NTQzMjEwIiwibmFtZSI6IkphbmUifQ.s5LqY8mC2pX1vN0bQwReTyUiOpAsDfGhJkLzXcVbNm0"
+# Generic password/secret assignment value (detected only on the last entry of
+# the JSON dump, where there is no trailing comma after the value).
+ENV_VAR_VALUE_GENERIC_SECRET = "Tr0ub4dor3xKq9vLmZ"
class Test_ecs_task_definitions_no_environment_secrets:
@@ -143,7 +151,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Basic Auth Credentials on the environment variable host."
+ == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> JSON Web Token (base64url-encoded) on the environment variable host."
)
assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
assert result[0].resource_arn == task_arn
@@ -167,7 +175,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
"environment": [
{
"name": ENV_VAR_NAME_WITH_KEYWORD,
- "value": ENV_VAR_VALUE_NO_SECRETS,
+ "value": ENV_VAR_VALUE_GENERIC_SECRET,
}
],
}
@@ -198,7 +206,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on the environment variable DB_PASSWORD."
+ == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Generic Password on the environment variable DB_PASSWORD."
)
assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
assert result[0].resource_arn == task_arn
@@ -251,9 +259,20 @@ class Test_ecs_task_definitions_no_environment_secrets:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
+ # The keyword-named variable holding a real secret triggers both the
+ # generic keyword rule and the JWT rule on the same line.
+ # Kingfisher emits same-line findings in a non-deterministic order, so
+ # assert both are present without pinning their order.
+ assert result[0].status_extended.startswith(
+ f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> "
+ )
assert (
- result[0].status_extended
- == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on the environment variable DB_PASSWORD, Basic Auth Credentials on the environment variable DB_PASSWORD."
+ "JSON Web Token (base64url-encoded) on the environment variable DB_PASSWORD"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic Password on the environment variable DB_PASSWORD"
+ in result[0].status_extended
)
assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
assert result[0].resource_arn == task_arn
@@ -310,9 +329,23 @@ class Test_ecs_task_definitions_no_environment_secrets:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
+ # DB_PASSWORD holds a JWT under a keyword name, so it fires
+ # both the JWT rule and the generic keyword rule on the
+ # same line (non-deterministic order); host holds a second JWT.
+ assert result[0].status_extended.startswith(
+ f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> "
+ )
assert (
- result[0].status_extended
- == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on the environment variable DB_PASSWORD, Basic Auth Credentials on the environment variable DB_PASSWORD, Basic Auth Credentials on the environment variable host."
+ "JSON Web Token (base64url-encoded) on the environment variable DB_PASSWORD"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic Password on the environment variable DB_PASSWORD"
+ in result[0].status_extended
+ )
+ assert (
+ "JSON Web Token (base64url-encoded) on the environment variable host"
+ in result[0].status_extended
)
assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
assert result[0].resource_arn == task_arn
@@ -340,7 +373,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
},
{
"name": ENV_VAR_NAME_WITH_KEYWORD2,
- "value": ENV_VAR_VALUE_WITH_SECRETS2,
+ "value": ENV_VAR_VALUE_GENERIC_SECRET,
},
],
}
@@ -369,9 +402,24 @@ class Test_ecs_task_definitions_no_environment_secrets:
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
+ # DB_PASSWORD holds a JWT under a keyword name, so it fires
+ # both the JWT and the generic keyword rule on the same line
+ # (non-deterministic order); DATABASE_PASSWORD fires the generic
+ # keyword rule on its own line.
+ assert result[0].status_extended.startswith(
+ f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> "
+ )
assert (
- result[0].status_extended
- == f"Potential secrets found in ECS task definition {TASK_NAME} with revision {TASK_REVISION}: Secrets in container test-container -> Secret Keyword on the environment variable DB_PASSWORD, Basic Auth Credentials on the environment variable DB_PASSWORD, Basic Auth Credentials on the environment variable DATABASE_PASSWORD, Secret Keyword on the environment variable DATABASE_PASSWORD."
+ "JSON Web Token (base64url-encoded) on the environment variable DB_PASSWORD"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic Password on the environment variable DB_PASSWORD"
+ in result[0].status_extended
+ )
+ assert (
+ "Generic Password on the environment variable DATABASE_PASSWORD"
+ in result[0].status_extended
)
assert result[0].resource_id == f"{TASK_NAME}:{TASK_REVISION}"
assert result[0].resource_arn == task_arn
diff --git a/tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py b/tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
new file mode 100644
index 0000000000..12f4d5a4dd
--- /dev/null
+++ b/tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
@@ -0,0 +1,673 @@
+"""Tests for elbv2_listener_pqc_tls_enabled check."""
+
+from unittest import mock
+
+import pytest
+from boto3 import client, resource
+from botocore.exceptions import ClientError
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+ AWS_REGION_EU_WEST_1,
+ AWS_REGION_EU_WEST_1_AZA,
+ AWS_REGION_EU_WEST_1_AZB,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+
+class Test_elbv2_listener_pqc_tls_enabled:
+ """Test cases for the elbv2_listener_pqc_tls_enabled check."""
+
+ def _create_alb_infrastructure(self, region=AWS_REGION_EU_WEST_1):
+ """Helper to create VPC, subnets, security group, target group, and ALB.
+
+ Returns a tuple of (elbv2_client, lb_response, target_group_arn).
+ """
+ conn = client("elbv2", region_name=region)
+ ec2 = resource("ec2", region_name=region)
+
+ security_group = ec2.create_security_group(
+ GroupName="a-security-group", Description="First One"
+ )
+ vpc = ec2.create_vpc(CidrBlock="172.28.7.0/24", InstanceTenancy="default")
+ subnet1 = ec2.create_subnet(
+ VpcId=vpc.id,
+ CidrBlock="172.28.7.192/26",
+ AvailabilityZone=f"{region}a",
+ )
+ subnet2 = ec2.create_subnet(
+ VpcId=vpc.id,
+ CidrBlock="172.28.7.0/26",
+ AvailabilityZone=f"{region}b",
+ )
+
+ lb = conn.create_load_balancer(
+ Name="my-lb",
+ Subnets=[subnet1.id, subnet2.id],
+ SecurityGroups=[security_group.id],
+ Scheme="internal",
+ Type="application",
+ )["LoadBalancers"][0]
+
+ response = conn.create_target_group(
+ Name="a-target",
+ Protocol="HTTP",
+ Port=8080,
+ VpcId=vpc.id,
+ HealthCheckProtocol="HTTP",
+ HealthCheckPort="8080",
+ HealthCheckPath="/",
+ HealthCheckIntervalSeconds=5,
+ HealthCheckTimeoutSeconds=3,
+ HealthyThresholdCount=5,
+ UnhealthyThresholdCount=2,
+ Matcher={"HttpCode": "200"},
+ )
+ target_group_arn = response["TargetGroups"][0]["TargetGroupArn"]
+
+ return conn, lb, target_group_arn
+
+ def _create_nlb_infrastructure(self, region=AWS_REGION_EU_WEST_1):
+ """Helper to create VPC, subnets, target group, and NLB.
+
+ Returns a tuple of (elbv2_client, lb_response, target_group_arn).
+ """
+ conn = client("elbv2", region_name=region)
+ ec2 = resource("ec2", region_name=region)
+
+ vpc = ec2.create_vpc(CidrBlock="172.28.7.0/24", InstanceTenancy="default")
+ subnet1 = ec2.create_subnet(
+ VpcId=vpc.id,
+ CidrBlock="172.28.7.192/26",
+ AvailabilityZone=AWS_REGION_EU_WEST_1_AZA,
+ )
+ subnet2 = ec2.create_subnet(
+ VpcId=vpc.id,
+ CidrBlock="172.28.7.0/26",
+ AvailabilityZone=AWS_REGION_EU_WEST_1_AZB,
+ )
+
+ lb = conn.create_load_balancer(
+ Name="my-nlb",
+ Subnets=[subnet1.id, subnet2.id],
+ Scheme="internal",
+ Type="network",
+ )["LoadBalancers"][0]
+
+ response = conn.create_target_group(
+ Name="a-target",
+ Protocol="TCP",
+ Port=8080,
+ VpcId=vpc.id,
+ )
+ target_group_arn = response["TargetGroups"][0]["TargetGroupArn"]
+
+ return conn, lb, target_group_arn
+
+ def _mock_and_execute(self, audit_config=None):
+ """Helper to set up mocks and execute the check.
+
+ Must be called inside a @mock_aws decorated method, after AWS
+ resources have been created with moto.
+ """
+ from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+ audit_config = audit_config or {}
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ create_default_organization=False,
+ audit_config=audit_config,
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ audit_config=audit_config,
+ ),
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled.elbv2_client",
+ new=ELBv2(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled import (
+ elbv2_listener_pqc_tls_enabled,
+ )
+
+ check = elbv2_listener_pqc_tls_enabled()
+ return check.execute()
+
+ def _assert_listener_arn_in_status(self, result, listener_arn):
+ """Assert that remediation details identify the affected listener ARN."""
+ assert listener_arn in result[0].status_extended
+
+ # ------------------------------------------------------------------
+ # No-resource scenarios
+ # ------------------------------------------------------------------
+
+ @mock_aws
+ def test_no_load_balancers(self):
+ """Test that no findings are returned when there are no load balancers."""
+ result = self._mock_and_execute()
+ assert len(result) == 0
+
+ @mock_aws
+ def test_lb_with_http_listener_only(self):
+ """Test PASS when a load balancer has no HTTPS/TLS listeners."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTP",
+ Port=80,
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == "ELBv2 my-lb has no HTTPS/TLS listeners."
+ assert result[0].resource_id == "my-lb"
+
+ # ------------------------------------------------------------------
+ # PASS scenarios
+ # ------------------------------------------------------------------
+
+ @pytest.mark.parametrize(
+ "ssl_policy",
+ [
+ "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+ ],
+ )
+ @mock_aws
+ def test_listener_with_pq_policy_pass(self, ssl_policy):
+ """Test PASS when HTTPS listener uses an allowed PQ TLS policy."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy=ssl_policy,
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "ELBv2 my-lb has all HTTPS/TLS listeners using a post-quantum TLS policy."
+ )
+ assert result[0].resource_id == "my-lb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+ assert result[0].region == AWS_REGION_EU_WEST_1
+
+ @mock_aws
+ def test_multiple_https_listeners_all_pq_pass(self):
+ """Test PASS when a LB has multiple HTTPS listeners all using PQ policies."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=8443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "ELBv2 my-lb has all HTTPS/TLS listeners using a post-quantum TLS policy."
+ )
+ assert result[0].resource_id == "my-lb"
+
+ @mock_aws
+ def test_mixed_http_and_pq_https_listeners_pass(self):
+ """Test PASS when LB has both HTTP and HTTPS listeners, HTTPS using PQ policy."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ # HTTP listener (out of scope)
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTP",
+ Port=80,
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+ # HTTPS listener with PQ policy
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].resource_id == "my-lb"
+
+ # ------------------------------------------------------------------
+ # FAIL scenarios
+ # ------------------------------------------------------------------
+
+ @mock_aws
+ def test_listener_with_classical_tls_policy_fail(self):
+ """Test FAIL when HTTPS listener uses a classical (non-PQ) TLS policy."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ listener = conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )["Listeners"][0]
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"ELBv2 my-lb has HTTPS/TLS listeners without post-quantum TLS policy: HTTPS:443 ({listener['ListenerArn']}) uses ELBSecurityPolicy-TLS13-1-2-2021-06."
+ )
+ self._assert_listener_arn_in_status(result, listener["ListenerArn"])
+ assert result[0].resource_id == "my-lb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+ assert result[0].region == AWS_REGION_EU_WEST_1
+
+ @mock_aws
+ def test_listener_with_tls_1_0_pq_policy_fails_by_default(self):
+ """Test FAIL when HTTPS listener uses a TLS 1.0-minimum PQ policy by default."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ listener = conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-0-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )["Listeners"][0]
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"ELBv2 my-lb has HTTPS/TLS listeners without post-quantum TLS policy: HTTPS:443 ({listener['ListenerArn']}) uses ELBSecurityPolicy-TLS13-1-0-PQ-2025-09."
+ )
+ assert result[0].resource_id == "my-lb"
+
+ @mock_aws
+ def test_listener_with_empty_ssl_policy_fail(self):
+ """Test FAIL when an HTTPS listener has no SSL policy value."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ listener = conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )["Listeners"][0]
+
+ from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ create_default_organization=False,
+ )
+ service = ELBv2(aws_provider)
+ service.loadbalancersv2[lb["LoadBalancerArn"]].listeners[
+ listener["ListenerArn"]
+ ].ssl_policy = ""
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled.elbv2_client",
+ new=service,
+ ),
+ ):
+ from prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled import (
+ elbv2_listener_pqc_tls_enabled,
+ )
+
+ result = elbv2_listener_pqc_tls_enabled().execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"ELBv2 my-lb has HTTPS/TLS listeners without post-quantum TLS policy: HTTPS:443 ({listener['ListenerArn']}) uses <none>."
+ )
+ assert result[0].resource_id == "my-lb"
+
+ @mock_aws
+ def test_listener_with_legacy_policy_fail(self):
+ """Test FAIL when HTTPS listener uses a legacy TLS policy."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ listener = conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS-1-1-2017-01",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )["Listeners"][0]
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"ELBv2 my-lb has HTTPS/TLS listeners without post-quantum TLS policy: HTTPS:443 ({listener['ListenerArn']}) uses ELBSecurityPolicy-TLS-1-1-2017-01."
+ )
+ self._assert_listener_arn_in_status(result, listener["ListenerArn"])
+ assert result[0].resource_id == "my-lb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+ @mock_aws
+ def test_mixed_pq_and_non_pq_listeners_fail(self):
+ """Test FAIL when LB has one PQ listener and one non-PQ listener."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ # PQ listener
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+ # Non-PQ listener
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=8443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "ELBSecurityPolicy-TLS13-1-2-2021-06" in result[0].status_extended
+ assert result[0].resource_id == "my-lb"
+
+ @mock_aws
+ def test_multiple_non_pq_listeners_lists_all_policies_fail(self):
+ """Test FAIL lists all non-PQ policies when multiple listeners are non-compliant."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS-1-1-2017-01",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=8443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ # Both non-PQ policies should be mentioned
+ assert "ELBSecurityPolicy-TLS-1-1-2017-01" in result[0].status_extended
+ assert "ELBSecurityPolicy-TLS13-1-2-2021-06" in result[0].status_extended
+ assert result[0].resource_id == "my-lb"
+
+ # ------------------------------------------------------------------
+ # Custom audit_config scenario
+ # ------------------------------------------------------------------
+
+ @mock_aws
+ def test_custom_audit_config_narrows_allowlist(self):
+ """Test that a custom audit_config allowlist is honoured.
+
+ When elbv2_listener_pqc_tls_allowed_policies is overridden to only
+ allow FIPS PQ policies, a non-FIPS PQ policy should FAIL.
+ """
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ # Use a PQ policy that is in the default list but NOT in our custom list
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ custom_config = {
+ "elbv2_listener_pqc_tls_allowed_policies": [
+ "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+ ]
+ }
+
+ result = self._mock_and_execute(audit_config=custom_config)
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09" in result[0].status_extended
+
+ @mock_aws
+ def test_custom_audit_config_fips_policy_pass(self):
+ """Test PASS when listener uses a FIPS PQ policy and custom config allows it."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ custom_config = {
+ "elbv2_listener_pqc_tls_allowed_policies": [
+ "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+ "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+ ]
+ }
+
+ result = self._mock_and_execute(audit_config=custom_config)
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "ELBv2 my-lb has all HTTPS/TLS listeners using a post-quantum TLS policy."
+ )
+
+ @mock_aws
+ def test_custom_audit_config_allows_tls_1_0_pq_policy(self):
+ """Test PASS when custom config explicitly allows a TLS 1.0-minimum PQ policy."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-0-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute(
+ audit_config={
+ "elbv2_listener_pqc_tls_allowed_policies": [
+ "ELBSecurityPolicy-TLS13-1-0-PQ-2025-09"
+ ]
+ }
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "ELBv2 my-lb has all HTTPS/TLS listeners using a post-quantum TLS policy."
+ )
+
+ @mock_aws
+ def test_empty_audit_config_allowlist_fails_tls_listener(self):
+ """Test an intentionally empty allowlist is honoured."""
+ conn, lb, target_group_arn = self._create_alb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="HTTPS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute(
+ audit_config={"elbv2_listener_pqc_tls_allowed_policies": []}
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == "my-lb"
+ assert "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09" in result[0].status_extended
+
+ @mock_aws
+ def test_tls_listener_with_pq_policy_pass(self):
+ """Test PASS when a TLS listener uses an allowed PQ TLS policy."""
+ conn, lb, target_group_arn = self._create_nlb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="TLS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].resource_id == "my-nlb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+ @mock_aws
+ def test_nlb_with_tcp_listener_only(self):
+ """Test PASS when an NLB has no HTTPS/TLS listeners."""
+ conn, lb, target_group_arn = self._create_nlb_infrastructure()
+ conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="TCP",
+ Port=80,
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == "ELBv2 my-nlb has no HTTPS/TLS listeners."
+ assert result[0].resource_id == "my-nlb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+ @mock_aws
+ def test_tls_listener_with_non_pq_policy_fail(self):
+ """Test FAIL when a TLS listener uses a non-PQ TLS policy."""
+ conn, lb, target_group_arn = self._create_nlb_infrastructure()
+ listener = conn.create_listener(
+ LoadBalancerArn=lb["LoadBalancerArn"],
+ Protocol="TLS",
+ Port=443,
+ SslPolicy="ELBSecurityPolicy-TLS13-1-2-2021-06",
+ DefaultActions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+ )["Listeners"][0]
+
+ result = self._mock_and_execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"ELBv2 my-nlb has HTTPS/TLS listeners without post-quantum TLS policy: TLS:443 ({listener['ListenerArn']}) uses ELBSecurityPolicy-TLS13-1-2-2021-06."
+ )
+ self._assert_listener_arn_in_status(result, listener["ListenerArn"])
+ assert result[0].resource_id == "my-nlb"
+ assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+ @mock_aws
+ def test_listener_discovery_failure_returns_no_findings(self):
+ """Test no findings when listeners cannot be retrieved for a load balancer."""
+ conn, lb, _ = self._create_alb_infrastructure()
+
+ from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+ create_default_organization=False,
+ )
+
+ service = ELBv2(aws_provider)
+ error = ClientError(
+ {
+ "Error": {
+ "Code": "AccessDenied",
+ "Message": "User is not authorized to perform: elasticloadbalancing:DescribeListeners",
+ }
+ },
+ "DescribeListeners",
+ )
+ service.loadbalancersv2[lb["LoadBalancerArn"]].listeners = {}
+ service.regional_clients[AWS_REGION_EU_WEST_1] = mock.MagicMock(
+ region=AWS_REGION_EU_WEST_1,
+ get_paginator=mock.MagicMock(side_effect=error),
+ )
+ service._describe_listeners(
+ (lb["LoadBalancerArn"], service.loadbalancersv2[lb["LoadBalancerArn"]])
+ )
+
+ assert service.loadbalancersv2[lb["LoadBalancerArn"]].listener_discovery_failed
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled.elbv2_client",
+ new=service,
+ ),
+ ):
+ from prowler.providers.aws.services.elbv2.elbv2_listener_pqc_tls_enabled.elbv2_listener_pqc_tls_enabled import (
+ elbv2_listener_pqc_tls_enabled,
+ )
+
+ result = elbv2_listener_pqc_tls_enabled().execute()
+
+ assert len(result) == 0
diff --git a/tests/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation_test.py b/tests/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation_test.py
index 176942ea0b..eda9588aef 100644
--- a/tests/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation_test.py
+++ b/tests/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation_test.py
@@ -1239,6 +1239,7 @@ class Test_iam_inline_policy_allows_privilege_escalation:
"Action": [
"iam:PassRole",
"bedrock-agentcore:CreateCodeInterpreter",
+ "bedrock-agentcore:StartCodeInterpreterSession",
"bedrock-agentcore:InvokeCodeInterpreter",
],
"Resource": "*",
@@ -1286,6 +1287,10 @@ class Test_iam_inline_policy_allows_privilege_escalation:
assert search(
"bedrock-agentcore:CreateCodeInterpreter", result[0].status_extended
)
+ assert search(
+ "bedrock-agentcore:StartCodeInterpreterSession",
+ result[0].status_extended,
+ )
assert search(
"bedrock-agentcore:InvokeCodeInterpreter", result[0].status_extended
)
diff --git a/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py b/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
index 850a5ba2cb..35f0fd1f0e 100644
--- a/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
+++ b/tests/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation_test.py
@@ -928,6 +928,7 @@ class Test_iam_policy_allows_privilege_escalation:
"Action": [
"iam:PassRole",
"bedrock-agentcore:CreateCodeInterpreter",
+ "bedrock-agentcore:StartCodeInterpreterSession",
"bedrock-agentcore:InvokeCodeInterpreter",
],
"Resource": "*",
@@ -973,10 +974,391 @@ class Test_iam_policy_allows_privilege_escalation:
assert search(
"bedrock-agentcore:CreateCodeInterpreter", result[0].status_extended
)
+ assert search(
+ "bedrock-agentcore:StartCodeInterpreterSession",
+ result[0].status_extended,
+ )
assert search(
"bedrock-agentcore:InvokeCodeInterpreter", result[0].status_extended
)
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_invoke_runtime_command(
+ self,
+ ):
+ """Test detection of AgentCore Runtime/Harness privilege escalation via InvokeAgentRuntimeCommand on an existing resource."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_invoke_runtime_command_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert result[0].region == AWS_REGION_US_EAST_1
+ assert result[0].resource_tags == []
+ assert search(
+ f"Custom Policy {policy_arn} allows privilege escalation using the following actions: ",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ result[0].status_extended,
+ )
+
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_passrole_create_runtime(
+ self,
+ ):
+ """Test detection of AgentCore Runtime privilege escalation by creating a new runtime with a passed role."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_create_runtime_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "iam:PassRole",
+ "bedrock-agentcore:CreateAgentRuntime",
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert search("iam:PassRole", result[0].status_extended)
+ assert search(
+ "bedrock-agentcore:CreateAgentRuntime",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ result[0].status_extended,
+ )
+
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_passrole_create_harness(
+ self,
+ ):
+ """Test detection of AgentCore Harness privilege escalation by creating a new harness with a passed role."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_create_harness_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "iam:PassRole",
+ "bedrock-agentcore:CreateHarness",
+ "bedrock-agentcore:CreateAgentRuntime",
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ "bedrock-agentcore:GetAgentRuntime",
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert search("iam:PassRole", result[0].status_extended)
+ assert search("bedrock-agentcore:CreateHarness", result[0].status_extended)
+ assert search(
+ "bedrock-agentcore:CreateAgentRuntime",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:CreateAgentRuntimeEndpoint",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:CreateWorkloadIdentity",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:GetAgentRuntime", result[0].status_extended
+ )
+ assert search(
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ result[0].status_extended,
+ )
+
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_browser_session_connect(
+ self,
+ ):
+ """Test detection of AgentCore Custom Browser privilege escalation via an existing browser session."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_browser_session_connect_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "bedrock-agentcore:StartBrowserSession",
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert search(
+ "bedrock-agentcore:StartBrowserSession", result[0].status_extended
+ )
+ assert search(
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ result[0].status_extended,
+ )
+
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_passrole_create_browser(
+ self,
+ ):
+ """Test detection of AgentCore Custom Browser privilege escalation by creating a new browser with a passed role."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_create_browser_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "iam:PassRole",
+ "bedrock-agentcore:CreateBrowser",
+ "bedrock-agentcore:StartBrowserSession",
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert search("iam:PassRole", result[0].status_extended)
+ assert search("bedrock-agentcore:CreateBrowser", result[0].status_extended)
+ assert search(
+ "bedrock-agentcore:StartBrowserSession", result[0].status_extended
+ )
+ assert search(
+ "bedrock-agentcore:ConnectBrowserAutomationStream",
+ result[0].status_extended,
+ )
+
+ @mock_aws
+ def test_iam_policy_allows_privilege_escalation_agentcore_wildcard(
+ self,
+ ):
+ """Test detection of AgentCore privilege escalation when the policy grants the bedrock-agentcore:* namespace wildcard."""
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ iam_client = client("iam", region_name=AWS_REGION_US_EAST_1)
+ policy_name = "agentcore_wildcard_policy"
+ policy_document = {
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "bedrock-agentcore:*",
+ ],
+ "Resource": "*",
+ }
+ ],
+ }
+
+ policy_arn = iam_client.create_policy(
+ PolicyName=policy_name, PolicyDocument=dumps(policy_document)
+ )["Policy"]["Arn"]
+
+ from prowler.providers.aws.services.iam.iam_service import IAM
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation.iam_client",
+ new=IAM(aws_provider),
+ ),
+ ):
+ from prowler.providers.aws.services.iam.iam_policy_allows_privilege_escalation.iam_policy_allows_privilege_escalation import (
+ iam_policy_allows_privilege_escalation,
+ )
+
+ check = iam_policy_allows_privilege_escalation()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == policy_name
+ assert result[0].resource_arn == policy_arn
+ assert search(
+ "bedrock-agentcore:InvokeAgentRuntimeCommand",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:StartCodeInterpreterSession",
+ result[0].status_extended,
+ )
+ assert search(
+ "bedrock-agentcore:StartBrowserSession", result[0].status_extended
+ )
+
@mock_aws
def test_iam_policy_allows_privilege_escalation_iam_put(
self,
diff --git a/tests/providers/aws/services/iam/iam_role_access_not_stale_to_bedrock/__init__.py b/tests/providers/aws/services/iam/iam_role_access_not_stale_to_bedrock/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/iam/iam_user_access_not_stale_to_bedrock/__init__.py b/tests/providers/aws/services/iam/iam_user_access_not_stale_to_bedrock/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled_test.py b/tests/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled_test.py
index 2ea7702cd3..66eb2ceaa3 100644
--- a/tests/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled_test.py
+++ b/tests/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled_test.py
@@ -1,3 +1,4 @@
+from types import SimpleNamespace
from unittest import mock
from prowler.providers.aws.services.inspector2.inspector2_service import Inspector
@@ -13,6 +14,65 @@ FINDING_ARN = (
class Test_inspector2_is_enabled:
+ def test_lambda_disabled_with_region_hidden_by_function_analysis_limit(self):
+ inspector2_client = mock.MagicMock()
+ inspector2_client.provider = SimpleNamespace(scan_unused_services=False)
+ inspector2_client.inspectors = [
+ Inspector(
+ id=AWS_ACCOUNT_NUMBER,
+ arn=f"arn:aws:inspector2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:inspector2",
+ status="ENABLED",
+ ec2_status="ENABLED",
+ ecr_status="ENABLED",
+ lambda_status="DISABLED",
+ lambda_code_status="ENABLED",
+ region=AWS_REGION_EU_WEST_1,
+ )
+ ]
+ awslambda_client = mock.MagicMock()
+ awslambda_client.functions = {}
+ awslambda_client.regions_with_functions = {AWS_REGION_EU_WEST_1}
+ ec2_client = mock.MagicMock()
+ ec2_client.instances = []
+ ecr_client = mock.MagicMock()
+ ecr_client.registries = {AWS_REGION_EU_WEST_1: SimpleNamespace(repositories=[])}
+ aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.inspector2.inspector2_is_enabled.inspector2_is_enabled.inspector2_client",
+ new=inspector2_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.inspector2.inspector2_is_enabled.inspector2_is_enabled.awslambda_client",
+ new=awslambda_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.inspector2.inspector2_is_enabled.inspector2_is_enabled.ec2_client",
+ new=ec2_client,
+ ),
+ mock.patch(
+ "prowler.providers.aws.services.inspector2.inspector2_is_enabled.inspector2_is_enabled.ecr_client",
+ new=ecr_client,
+ ),
+ ):
+ from prowler.providers.aws.services.inspector2.inspector2_is_enabled.inspector2_is_enabled import (
+ inspector2_is_enabled,
+ )
+
+ result = inspector2_is_enabled().execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Inspector2 is not enabled for the following services: Lambda."
+ )
+
def test_inspector2_disabled(self):
# Mock the inspector2 client
inspector2_client = mock.MagicMock
diff --git a/tests/providers/aws/services/kms/kms_cmk_not_multi_region/__init__.py b/tests/providers/aws/services/kms/kms_cmk_not_multi_region/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py b/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py
index d6d9941960..3d5bb16aba 100644
--- a/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py
+++ b/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py
@@ -17,6 +17,10 @@ def scp_restrict_regions_with_deny():
return '{"Version":"2012-10-17","Statement":{"Effect":"Deny","NotAction":"s3:*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":["eu-central-1","eu-west-1"]}}}}'
+def scp_restrict_regions_with_allow():
+ return '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"*","Resource":"*","Condition":{"StringEquals":{"aws:RequestedRegion":["eu-central-1","eu-west-1"]}}}}'
+
+
def scp_restrict_regions_without_statement():
return '{"Version":"2012-10-17"}'
@@ -352,3 +356,137 @@ class Test_organizations_scp_check_deny_regions:
== f"AWS Organization {org_id} has SCP policies but don't restrict AWS Regions."
)
assert result[0].region == AWS_REGION_EU_WEST_1
+
+ @mock_aws
+ def test_organization_with_scp_allow_regions_valid(self):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+ conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+ response = conn.describe_organization()
+ response_policy = conn.create_policy(
+ Content=scp_restrict_regions_with_allow(),
+ Description="Test",
+ Name="Test",
+ Type="SERVICE_CONTROL_POLICY",
+ )
+ org_id = response["Organization"]["Id"]
+ policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+ aws_provider._audit_config = {"organizations_enabled_regions": ["eu-central-1"]}
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+ new=Organizations(aws_provider),
+ ):
+ from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+ organizations_scp_check_deny_regions,
+ )
+
+ check = organizations_scp_check_deny_regions()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].resource_id == response["Organization"]["Id"]
+ assert result[0].resource_arn == response["Organization"]["Arn"]
+ assert (
+ result[0].status_extended
+ == f"AWS Organization {org_id} has SCP policy {policy_id} restricting all configured regions found."
+ )
+ assert result[0].region == AWS_REGION_EU_WEST_1
+
+ @mock_aws
+ def test_organization_with_scp_allow_regions_not_valid(self):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+ conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+ response = conn.describe_organization()
+ response_policy = conn.create_policy(
+ Content=scp_restrict_regions_with_allow(),
+ Description="Test",
+ Name="Test",
+ Type="SERVICE_CONTROL_POLICY",
+ )
+ org_id = response["Organization"]["Id"]
+ policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+ aws_provider._audit_config = {"organizations_enabled_regions": ["us-east-1"]}
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+ new=Organizations(aws_provider),
+ ):
+ from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+ organizations_scp_check_deny_regions,
+ )
+
+ check = organizations_scp_check_deny_regions()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == response["Organization"]["Id"]
+ assert (
+ "arn:aws:organizations::123456789012:organization/o-"
+ in result[0].resource_arn
+ )
+ assert (
+ result[0].status_extended
+ == f"AWS Organization {org_id} has SCP policies {policy_id} restricting some AWS Regions, but not all the configured ones, please check config."
+ )
+ assert result[0].region == AWS_REGION_EU_WEST_1
+
+ @mock_aws
+ def test_organization_with_scp_allow_all_regions_valid(self):
+ aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+ conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+ response = conn.describe_organization()
+ response_policy = conn.create_policy(
+ Content=scp_restrict_regions_with_allow(),
+ Description="Test",
+ Name="Test",
+ Type="SERVICE_CONTROL_POLICY",
+ )
+ org_id = response["Organization"]["Id"]
+ policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+ aws_provider._audit_config = {
+ "organizations_enabled_regions": [
+ AWS_REGION_EU_WEST_1,
+ AWS_REGION_EU_CENTRAL_1,
+ ]
+ }
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+ new=Organizations(aws_provider),
+ ):
+ from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+ organizations_scp_check_deny_regions,
+ )
+
+ check = organizations_scp_check_deny_regions()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].resource_id == response["Organization"]["Id"]
+ assert result[0].resource_arn == response["Organization"]["Arn"]
+ assert (
+ result[0].status_extended
+ == f"AWS Organization {org_id} has SCP policy {policy_id} restricting all configured regions found."
+ )
+ assert result[0].region == AWS_REGION_EU_WEST_1
diff --git a/tests/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public_test.py b/tests/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public_test.py
new file mode 100644
index 0000000000..2ac143ff47
--- /dev/null
+++ b/tests/providers/aws/services/s3/s3_bucket_object_public/s3_bucket_object_public_test.py
@@ -0,0 +1,302 @@
+from unittest import mock
+
+from boto3 import client
+from botocore.exceptions import ClientError
+from moto import mock_aws
+
+from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
+
+CHECK_MODULE = (
+ "prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public"
+)
+
+ENABLED_CONFIG = {
+ "s3_bucket_object_public_enabled": True,
+ "s3_bucket_object_public_max_objects": 100,
+ "s3_bucket_object_public_sample_size": 3,
+}
+
+
+class Test_s3_bucket_object_public:
+ @mock_aws
+ def test_check_disabled_by_default_returns_no_findings(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ s3_client_us_east_1.create_bucket(Bucket="bucket-disabled")
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ # No audit_config -> check disabled by default
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert result == []
+
+ @mock_aws
+ def test_no_buckets_returns_no_findings(self):
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert result == []
+
+ @mock_aws
+ def test_bucket_empty_passes(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-empty"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].status_extended == (
+ f"S3 Bucket {bucket_name} is empty."
+ )
+ assert result[0].resource_id == bucket_name
+ assert result[0].region == AWS_REGION_US_EAST_1
+
+ @mock_aws
+ def test_bucket_with_only_private_objects_passes(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-private-objects"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+ s3_client_us_east_1.put_object(
+ Bucket=bucket_name, Key="private-1.txt", Body=b"x"
+ )
+ s3_client_us_east_1.put_object(
+ Bucket=bucket_name, Key="private-2.txt", Body=b"x"
+ )
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert "No public objects detected in spot-check sample of" in (
+ result[0].status_extended
+ )
+ assert bucket_name in result[0].status_extended
+ assert (
+ "For complete assurance, ensure ACLs are disabled via "
+ "Object Ownership settings."
+ ) in result[0].status_extended
+
+ @mock_aws
+ def test_bucket_with_public_object_fails(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-public-object"
+ public_key = "public.txt"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+ s3_client_us_east_1.put_object(Bucket=bucket_name, Key=public_key, Body=b"x")
+ s3_client_us_east_1.put_object_acl(
+ Bucket=bucket_name, Key=public_key, ACL="public-read"
+ )
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert public_key in result[0].status_extended
+ assert (
+ f"S3 Bucket {bucket_name} has public objects detected in "
+ "spot-check sample of"
+ ) in result[0].status_extended
+
+ @mock_aws
+ def test_bucket_with_authenticated_users_object_fails(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-authenticated-object"
+ public_key = "authenticated.txt"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+ s3_client_us_east_1.put_object(Bucket=bucket_name, Key=public_key, Body=b"x")
+ s3_client_us_east_1.put_object_acl(
+ Bucket=bucket_name, Key=public_key, ACL="authenticated-read"
+ )
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert public_key in result[0].status_extended
+
+ @mock_aws
+ def test_access_denied_on_list_objects_reports_manual(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-access-denied"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+
+ # Simulate AccessDenied when sampling and re-run sampling for the bucket
+ regional_client = mock.MagicMock()
+ regional_client.region = AWS_REGION_US_EAST_1
+ regional_client.list_objects_v2.side_effect = ClientError(
+ {"Error": {"Code": "AccessDenied", "Message": "denied"}},
+ "ListObjectsV2",
+ )
+ s3_service.regional_clients[AWS_REGION_US_EAST_1] = regional_client
+ bucket = next(iter(s3_service.buckets.values()))
+ bucket.object_sampling = None
+ s3_service._get_public_objects(bucket)
+
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert result[0].status_extended == (
+ f"Access Denied when spot-checking objects in bucket "
+ f"{bucket_name}."
+ )
+
+ @mock_aws
+ def test_other_client_error_reports_manual(self):
+ s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "bucket-other-error"
+ s3_client_us_east_1.create_bucket(Bucket=bucket_name)
+
+ from prowler.providers.aws.services.s3.s3_service import S3
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1], audit_config=ENABLED_CONFIG
+ )
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ s3_service = S3(aws_provider)
+
+ regional_client = mock.MagicMock()
+ regional_client.region = AWS_REGION_US_EAST_1
+ regional_client.list_objects_v2.side_effect = ClientError(
+ {"Error": {"Code": "InternalError", "Message": "boom"}},
+ "ListObjectsV2",
+ )
+ s3_service.regional_clients[AWS_REGION_US_EAST_1] = regional_client
+ bucket = next(iter(s3_service.buckets.values()))
+ bucket.object_sampling = None
+ s3_service._get_public_objects(bucket)
+
+ with mock.patch(f"{CHECK_MODULE}.s3_client", new=s3_service):
+ from prowler.providers.aws.services.s3.s3_bucket_object_public.s3_bucket_object_public import (
+ s3_bucket_object_public,
+ )
+
+ check = s3_bucket_object_public()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert (
+ f"Could not spot-check objects in bucket {bucket_name}"
+ ) in result[0].status_extended
diff --git a/tests/providers/aws/services/s3/s3_service_test.py b/tests/providers/aws/services/s3/s3_service_test.py
index 7dec192f2e..d6d9575a11 100644
--- a/tests/providers/aws/services/s3/s3_service_test.py
+++ b/tests/providers/aws/services/s3/s3_service_test.py
@@ -642,3 +642,47 @@ class Test_S3_Service:
assert s3control.access_points[arn].public_access_block.ignore_public_acls
assert s3control.access_points[arn].public_access_block.block_public_policy
assert s3control.access_points[arn].public_access_block.restrict_public_buckets
+
+ # Test S3 object ACL sampling is skipped unless the check is enabled
+ @mock_aws
+ def test_get_public_objects_disabled_by_default(self):
+ s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "test-bucket"
+ bucket_arn = f"arn:aws:s3:::{bucket_name}"
+ s3_client.create_bucket(Bucket=bucket_name)
+ s3_client.put_object(Bucket=bucket_name, Key="a.txt", Body=b"x")
+
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+ s3 = S3(aws_provider)
+
+ assert s3.buckets[bucket_arn].object_sampling is None
+
+ # Test S3 object ACL sampling detects a public object when enabled
+ @mock_aws
+ def test_get_public_objects_detects_public_acl(self):
+ s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+ bucket_name = "test-bucket"
+ bucket_arn = f"arn:aws:s3:::{bucket_name}"
+ s3_client.create_bucket(Bucket=bucket_name)
+ s3_client.put_object(Bucket=bucket_name, Key="public.txt", Body=b"x")
+ s3_client.put_object_acl(
+ Bucket=bucket_name, Key="public.txt", ACL="public-read"
+ )
+
+ aws_provider = set_mocked_aws_provider(
+ [AWS_REGION_US_EAST_1],
+ audit_config={"s3_bucket_object_public_enabled": True},
+ )
+ s3 = S3(aws_provider)
+
+ sampling = s3.buckets[bucket_arn].object_sampling
+ assert sampling is not None
+ assert sampling.performed is True
+ assert sampling.is_empty is False
+ assert len(sampling.objects) == 1
+ assert sampling.objects[0].key == "public.txt"
+ assert any(
+ grantee.type == "Group"
+ and grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers"
+ for grantee in sampling.objects[0].grantees
+ )
diff --git a/tests/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets_test.py b/tests/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets_test.py
index 24f0a1fdd1..9fc6de4762 100644
--- a/tests/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets_test.py
+++ b/tests/providers/aws/services/ssm/ssm_document_secrets/ssm_document_secrets_test.py
@@ -27,13 +27,13 @@ class Test_ssm_documents_secrets:
document_name = "test-document"
document_arn = f"arn:aws:ssm:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:document/{document_name}"
ssm_client.audited_account = AWS_ACCOUNT_NUMBER
- ssm_client.audit_config = {"detect_secrets_plugins": None}
+ ssm_client.audit_config = {}
ssm_client.documents = {
document_name: Document(
arn=document_arn,
name=document_name,
region=AWS_REGION_US_EAST_1,
- content={"db_password": "test-password"},
+ content={"db_password": "Tr0ub4dor3xKq9vLmZ"},
account_owners=[],
)
}
@@ -56,7 +56,7 @@ class Test_ssm_documents_secrets:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
- == f"Potential secret found in SSM Document {document_name} -> Secret Keyword on line 2."
+ == f"Potential secret found in SSM Document {document_name} -> Generic Password on line 2."
)
def test_document_no_secrets(self):
diff --git a/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk_test.py b/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk_test.py
new file mode 100644
index 0000000000..44ec8f03c9
--- /dev/null
+++ b/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_encrypted_with_cmk/stepfunctions_statemachine_encrypted_with_cmk_test.py
@@ -0,0 +1,142 @@
+from datetime import datetime
+from unittest.mock import patch
+
+import pytest
+from moto import mock_aws
+
+from prowler.providers.aws.services.stepfunctions.stepfunctions_service import (
+ EncryptionConfiguration,
+ EncryptionType,
+ StateMachine,
+ StepFunctions,
+)
+from tests.providers.aws.utils import set_mocked_aws_provider
+
+AWS_REGION_EU_WEST_1 = "eu-west-1"
+STATE_MACHINE_ID = "state-machine-12345"
+STATE_MACHINE_ARN = f"arn:aws:states:{AWS_REGION_EU_WEST_1}:123456789012:stateMachine:{STATE_MACHINE_ID}"
+KMS_KEY_ARN = "arn:aws:kms:eu-west-1:123456789012:key/some-key-id"
+
+
+def create_state_machine(name, encryption_configuration):
+ """Create a mock StateMachine instance for use in tests.
+
+ Args:
+ name (str): The display name of the state machine.
+ encryption_configuration (Optional[EncryptionConfiguration]): The encryption
+ configuration to assign to the state machine, or None.
+
+ Returns:
+ StateMachine: A StateMachine instance pre-populated with test constants.
+ """
+ return StateMachine(
+ id=STATE_MACHINE_ID,
+ arn=STATE_MACHINE_ARN,
+ name=name,
+ region=AWS_REGION_EU_WEST_1,
+ encryption_configuration=encryption_configuration,
+ tags=[],
+ status="ACTIVE",
+ definition="{}",
+ role_arn="arn:aws:iam::123456789012:role/step-functions-role",
+ type="STANDARD",
+ creation_date=datetime.now(),
+ )
+
+
+@pytest.mark.parametrize(
+ "state_machines, expected_count, expected_status, expected_status_extended",
+ [
+ # No state machines , no findings
+ ({}, 0, None, None),
+ # AWS-owned key (default) , FAIL
+ (
+ {
+ STATE_MACHINE_ARN: create_state_machine(
+ "TestStateMachine",
+ EncryptionConfiguration(
+ type=EncryptionType.AWS_OWNED_KEY,
+ kms_key_id=None,
+ kms_data_key_reuse_period_seconds=None,
+ ),
+ )
+ },
+ 1,
+ "FAIL",
+ "Step Functions state machine TestStateMachine is not encrypted at rest with a customer-managed KMS key.",
+ ),
+ # No encryption configuration (None) , FAIL
+ (
+ {
+ STATE_MACHINE_ARN: create_state_machine(
+ "TestStateMachine",
+ None,
+ )
+ },
+ 1,
+ "FAIL",
+ "Step Functions state machine TestStateMachine is not encrypted at rest with a customer-managed KMS key.",
+ ),
+ # Customer-managed KMS key , PASS
+ (
+ {
+ STATE_MACHINE_ARN: create_state_machine(
+ "TestStateMachine",
+ EncryptionConfiguration(
+ type=EncryptionType.CUSTOMER_MANAGED_KMS_KEY,
+ kms_key_id=KMS_KEY_ARN,
+ kms_data_key_reuse_period_seconds=300,
+ ),
+ )
+ },
+ 1,
+ "PASS",
+ "Step Functions state machine TestStateMachine is encrypted at rest with a customer-managed KMS key.",
+ ),
+ ],
+)
+@mock_aws(config={"stepfunctions": {"execute_state_machine": True}})
+def test_stepfunctions_statemachine_encrypted_with_cmk(
+ state_machines,
+ expected_count,
+ expected_status,
+ expected_status_extended,
+):
+ """Test stepfunctions_statemachine_encrypted_with_cmk check across multiple scenarios.
+
+ Parametrized test cases cover:
+ - No state machines present (empty findings).
+ - State machine using the default AWS-owned key (FAIL).
+ - State machine with no encryption configuration set (FAIL).
+ - State machine using a customer-managed KMS key (PASS).
+
+ Args:
+ state_machines (dict): Mapping of ARN to StateMachine used to mock the service client.
+ expected_count (int): Expected number of findings returned by the check.
+ expected_status (Optional[str]): Expected status of the finding, or None if no findings.
+ expected_status_extended (Optional[str]): Expected status_extended message, or None.
+ """
+ mocked_aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+ stepfunctions_client = StepFunctions(mocked_aws_provider)
+ stepfunctions_client.state_machines = state_machines
+
+ with patch(
+ "prowler.providers.aws.services.stepfunctions.stepfunctions_statemachine_encrypted_with_cmk.stepfunctions_statemachine_encrypted_with_cmk.stepfunctions_client",
+ new=stepfunctions_client,
+ ):
+ from prowler.providers.aws.services.stepfunctions.stepfunctions_statemachine_encrypted_with_cmk.stepfunctions_statemachine_encrypted_with_cmk import (
+ stepfunctions_statemachine_encrypted_with_cmk,
+ )
+
+ check = stepfunctions_statemachine_encrypted_with_cmk()
+ result = check.execute()
+
+ assert len(result) == expected_count
+
+ if expected_count == 1:
+ assert result[0].status == expected_status
+ assert result[0].status_extended == expected_status_extended
+ assert result[0].resource_id == STATE_MACHINE_ID
+ assert result[0].resource_arn == STATE_MACHINE_ARN
+ assert result[0].region == AWS_REGION_EU_WEST_1
+ assert result[0].resource == state_machines[STATE_MACHINE_ARN]
diff --git a/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/__init__.py b/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition_test.py b/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition_test.py
index 628525e542..1b1fa1bfca 100644
--- a/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition_test.py
+++ b/tests/providers/aws/services/stepfunctions/stepfunctions_statemachine_no_secrets_in_definition/stepfunctions_statemachine_no_secrets_in_definition_test.py
@@ -147,7 +147,7 @@ class Test_stepfunctions_statemachine_no_secrets_in_definition:
arn=statemachine_arn,
name="TestStateMachine",
status=StateMachineStatus.ACTIVE,
- definition='{"Comment": "Example with secret", "StartAt": "MyTask", "States": {"MyTask": {"Type": "Task", "Parameters": {"api_key": "AKIAIOSFODNN7EXAMPLE"}, "End": true}}}',
+ definition='{"Comment": "Example with secret", "StartAt": "MyTask", "States": {"MyTask": {"Type": "Task", "Parameters": {"api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"}, "End": true}}}',
region=AWS_REGION_US_EAST_1,
type=StateMachineType.STANDARD,
creation_date=datetime.now(),
diff --git a/tests/providers/aws/services/storagegateway/__init__.py b/tests/providers/aws/services/storagegateway/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled_test.py b/tests/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled_test.py
new file mode 100644
index 0000000000..14b71e8f52
--- /dev/null
+++ b/tests/providers/aws/services/waf/waf_regional_webacl_logging_enabled/waf_regional_webacl_logging_enabled_test.py
@@ -0,0 +1,199 @@
+from unittest import mock
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+ AWS_ACCOUNT_NUMBER,
+ AWS_REGION_US_EAST_1,
+ set_mocked_aws_provider,
+)
+
+WEB_ACL_ID = "test-web-acl-id"
+WEB_ACL_NAME = "test-web-acl-name"
+WEB_ACL_ARN = f"arn:aws:waf-regional:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:webacl/{WEB_ACL_ID}"
+FIREHOSE_ARN = f"arn:aws:firehose:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:deliverystream/aws-waf-logs-regional"
+
+# Original botocore _make_api_call function
+orig = botocore.client.BaseClient._make_api_call
+
+
+def _base_waf_regional_calls(operation_name, kwarg):
+ """Return responses for WAFRegional API calls that are common across all test scenarios.
+
+ Args:
+ operation_name (str): The name of the botocore operation being called.
+ kwarg (dict): The keyword arguments passed to the API call.
+
+ Returns:
+ dict or None: The mocked API response if the operation is handled, otherwise None.
+ """
+ unused_operations = [
+ "ListRules",
+ "GetRule",
+ "ListRuleGroups",
+ "ListActivatedRulesInRuleGroup",
+ "ListResourcesForWebACL",
+ ]
+ if operation_name in unused_operations:
+ return {}
+ if operation_name == "GetChangeToken":
+ return {"ChangeToken": "my-change-token"}
+ if operation_name == "ListWebACLs":
+ return {"WebACLs": [{"WebACLId": WEB_ACL_ID, "Name": WEB_ACL_NAME}]}
+ if operation_name == "GetWebACL":
+ return {"WebACL": {"Rules": []}}
+ return None
+
+
+def mock_make_api_call_logging_enabled(self, operation_name, kwarg):
+ """Mock botocore API calls with logging enabled on the Regional Web ACL.
+
+ Args:
+ self: The botocore client instance.
+ operation_name (str): The name of the botocore operation being called.
+ kwarg (dict): The keyword arguments passed to the API call.
+
+ Returns:
+ dict: The mocked API response.
+ """
+ base = _base_waf_regional_calls(operation_name, kwarg)
+ if base is not None:
+ return base
+ if operation_name == "GetLoggingConfiguration":
+ return {
+ "LoggingConfiguration": {
+ "ResourceArn": WEB_ACL_ARN,
+ "LogDestinationConfigs": [FIREHOSE_ARN],
+ "RedactedFields": [],
+ "ManagedByFirewallManager": False,
+ }
+ }
+ return orig(self, operation_name, kwarg)
+
+
+def mock_make_api_call_logging_disabled(self, operation_name, kwarg):
+ """Mock botocore API calls with logging disabled on the Regional Web ACL.
+
+ Args:
+ self: The botocore client instance.
+ operation_name (str): The name of the botocore operation being called.
+ kwarg (dict): The keyword arguments passed to the API call.
+
+ Returns:
+ dict: The mocked API response.
+ """
+ base = _base_waf_regional_calls(operation_name, kwarg)
+ if base is not None:
+ return base
+ if operation_name == "GetLoggingConfiguration":
+ return {
+ "LoggingConfiguration": {
+ "ResourceArn": WEB_ACL_ARN,
+ "LogDestinationConfigs": [],
+ "RedactedFields": [],
+ "ManagedByFirewallManager": False,
+ }
+ }
+ return orig(self, operation_name, kwarg)
+
+
+class Test_waf_regional_webacl_logging_enabled:
+ """Tests for the waf_regional_webacl_logging_enabled check."""
+
+ @mock_aws
+ def test_no_waf(self):
+ """Test that no findings are returned when no Regional Web ACLs exist."""
+ from prowler.providers.aws.services.waf.waf_service import WAFRegional
+
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled.wafregional_client",
+ new=WAFRegional(aws_provider),
+ ):
+ from prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled import (
+ waf_regional_webacl_logging_enabled,
+ )
+
+ check = waf_regional_webacl_logging_enabled()
+ result = check.execute()
+
+ assert len(result) == 0
+
+ @patch(
+ "botocore.client.BaseClient._make_api_call",
+ new=mock_make_api_call_logging_disabled,
+ )
+ @mock_aws
+ def test_waf_regional_webacl_logging_disabled(self):
+ """Test that a FAIL finding is returned when logging is disabled on a Regional Web ACL."""
+ from prowler.providers.aws.services.waf.waf_service import WAFRegional
+
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled.wafregional_client",
+ new=WAFRegional(aws_provider),
+ ):
+ from prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled import (
+ waf_regional_webacl_logging_enabled,
+ )
+
+ check = waf_regional_webacl_logging_enabled()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"AWS WAF Regional Web ACL {WEB_ACL_NAME} does not have logging enabled."
+ )
+ assert result[0].resource_id == WEB_ACL_ID
+ assert result[0].resource_arn == WEB_ACL_ARN
+ assert result[0].region == AWS_REGION_US_EAST_1
+
+ @patch(
+ "botocore.client.BaseClient._make_api_call",
+ new=mock_make_api_call_logging_enabled,
+ )
+ @mock_aws
+ def test_waf_regional_webacl_logging_enabled(self):
+ """Test that a PASS finding is returned when logging is enabled on a Regional Web ACL."""
+ from prowler.providers.aws.services.waf.waf_service import WAFRegional
+
+ aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+ with mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=aws_provider,
+ ):
+ with mock.patch(
+ "prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled.wafregional_client",
+ new=WAFRegional(aws_provider),
+ ):
+ from prowler.providers.aws.services.waf.waf_regional_webacl_logging_enabled.waf_regional_webacl_logging_enabled import (
+ waf_regional_webacl_logging_enabled,
+ )
+
+ check = waf_regional_webacl_logging_enabled()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"AWS WAF Regional Web ACL {WEB_ACL_NAME} does have logging enabled."
+ )
+ assert result[0].resource_id == WEB_ACL_ID
+ assert result[0].resource_arn == WEB_ACL_ARN
+ assert result[0].region == AWS_REGION_US_EAST_1
diff --git a/tests/providers/azure/azure_fixtures.py b/tests/providers/azure/azure_fixtures.py
index 84d43fd2c3..d095645e1f 100644
--- a/tests/providers/azure/azure_fixtures.py
+++ b/tests/providers/azure/azure_fixtures.py
@@ -9,6 +9,8 @@ from prowler.providers.azure.models import AzureIdentityInfo, AzureRegionConfig
AZURE_SUBSCRIPTION_ID = str(uuid4())
AZURE_SUBSCRIPTION_NAME = "Subscription Name"
AZURE_SUBSCRIPTION_DISPLAY = f"{AZURE_SUBSCRIPTION_NAME} ({AZURE_SUBSCRIPTION_ID})"
+RESOURCE_GROUP = "rg"
+RESOURCE_GROUP_LIST = [RESOURCE_GROUP, "rg2"]
# Azure Identity
IDENTITY_ID = "00000000-0000-0000-0000-000000000000"
@@ -30,6 +32,7 @@ def set_mocked_azure_provider(
audit_config: dict = None,
azure_region_config: AzureRegionConfig = AzureRegionConfig(),
locations: list = None,
+ resource_groups: dict = None,
) -> AzureProvider:
provider = MagicMock()
@@ -39,5 +42,6 @@ def set_mocked_azure_provider(
provider.identity = identity
provider.audit_config = audit_config
provider.region_config = azure_region_config
+ provider.resource_groups = resource_groups
return provider
diff --git a/tests/providers/azure/azure_provider_test.py b/tests/providers/azure/azure_provider_test.py
index 1d9aa97e6b..5e493a90c7 100644
--- a/tests/providers/azure/azure_provider_test.py
+++ b/tests/providers/azure/azure_provider_test.py
@@ -552,6 +552,128 @@ class TestAzureProvider:
assert regions == expected_regions
+class TestAzureProviderValidateResourceGroups:
+ @patch(
+ "prowler.providers.azure.azure_provider.AzureProvider.__init__",
+ return_value=None,
+ )
+ def _make_provider(self, _mock_init, subscriptions=None):
+ provider = AzureProvider()
+ provider._identity = MagicMock()
+ provider._identity.subscriptions = subscriptions or {str(uuid4()): "Sub"}
+ provider._session = MagicMock()
+ provider._region_config = MagicMock()
+ return provider
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_exact_match(self, mock_rm_client):
+ provider = self._make_provider()
+ sub_name = list(provider._identity.subscriptions.keys())[0]
+
+ mock_rg = MagicMock()
+ mock_rg.name = "mygroup"
+ mock_resource_groups = MagicMock()
+ mock_resource_groups.list.return_value = [mock_rg]
+ mock_rm_client.return_value.resource_groups = mock_resource_groups
+
+ result = provider.validate_resource_groups(["mygroup"])
+
+ assert result[sub_name] == ["mygroup"]
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_mixed_case(self, mock_rm_client):
+ provider = self._make_provider()
+ sub_name = list(provider._identity.subscriptions.keys())[0]
+
+ mock_rg = MagicMock()
+ mock_rg.name = "MyGroup"
+ mock_resource_groups = MagicMock()
+ mock_resource_groups.list.return_value = [mock_rg]
+ mock_rm_client.return_value.resource_groups = mock_resource_groups
+
+ result = provider.validate_resource_groups(["mygroup"])
+
+ assert result[sub_name] == ["MyGroup"]
+ mock_resource_groups.list.assert_called_once()
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_multiple_rgs(self, mock_rm_client):
+ provider = self._make_provider()
+ sub_name = list(provider._identity.subscriptions.keys())[0]
+
+ rg1, rg2 = MagicMock(), MagicMock()
+ rg1.name = "rg1"
+ rg2.name = "rg2"
+ mock_resource_groups = MagicMock()
+ mock_resource_groups.list.return_value = [rg1, rg2]
+ mock_rm_client.return_value.resource_groups = mock_resource_groups
+
+ result = provider.validate_resource_groups(["rg1", "rg2"])
+
+ assert set(result[sub_name]) == {"rg1", "rg2"}
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_not_found(self, mock_rm_client):
+ provider = self._make_provider()
+ sub_name = list(provider._identity.subscriptions.keys())[0]
+
+ mock_rg = MagicMock()
+ mock_rg.name = "existing"
+ mock_resource_groups = MagicMock()
+ mock_resource_groups.list.return_value = [mock_rg]
+ mock_rm_client.return_value.resource_groups = mock_resource_groups
+
+ result = provider.validate_resource_groups(["nonexistent"])
+
+ assert result[sub_name] == []
+
+ def test_validate_resource_groups_empty_input(self):
+ provider = self._make_provider()
+ result = provider.validate_resource_groups([])
+ assert result == {}
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_strips_whitespace(self, mock_rm_client):
+ provider = self._make_provider()
+ sub_name = list(provider._identity.subscriptions.keys())[0]
+
+ mock_rg = MagicMock()
+ mock_rg.name = "rg-prod"
+ mock_resource_groups = MagicMock()
+ mock_resource_groups.list.return_value = [mock_rg]
+ mock_rm_client.return_value.resource_groups = mock_resource_groups
+
+ result = provider.validate_resource_groups([" rg-prod "])
+
+ assert result[sub_name] == ["rg-prod"]
+
+ @patch("prowler.providers.azure.azure_provider.ResourceManagementClient")
+ def test_validate_resource_groups_skips_subscription_when_listing_fails(
+ self, mock_rm_client
+ ):
+ accessible_subscription = str(uuid4())
+ failing_subscription = str(uuid4())
+ provider = self._make_provider(
+ subscriptions={
+ accessible_subscription: "Accessible Sub",
+ failing_subscription: "Failing Sub",
+ }
+ )
+
+ mock_rg = MagicMock()
+ mock_rg.name = "rg-prod"
+ accessible_client = MagicMock()
+ accessible_client.resource_groups.list.return_value = [mock_rg]
+ failing_client = MagicMock()
+ failing_client.resource_groups.list.side_effect = Exception("Forbidden")
+ mock_rm_client.side_effect = [accessible_client, failing_client]
+
+ result = provider.validate_resource_groups(["rg-prod"])
+
+ assert result[accessible_subscription] == ["rg-prod"]
+ assert result[failing_subscription] == []
+
+
class TestAzureProviderSetupIdentitySubscriptions:
"""Regression tests ensuring identity.subscriptions preserves every
subscription even when multiple Azure subscriptions share the same
diff --git a/tests/providers/azure/services/aisearch/aisearch_service_test.py b/tests/providers/azure/services/aisearch/aisearch_service_test.py
index ff041e7eab..e8bc94675f 100644
--- a/tests/providers/azure/services/aisearch/aisearch_service_test.py
+++ b/tests/providers/azure/services/aisearch/aisearch_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.aisearch.aisearch_service import (
AISearch,
@@ -6,9 +6,13 @@ from prowler.providers.azure.services.aisearch.aisearch_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
+AISEARCH_SERVICE_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Search/searchServices/search1"
+
def mock_storage_get_aisearch_services(_):
return {
@@ -58,3 +62,121 @@ class Test_AISearch_Service:
assert aisearch.aisearch_services[AZURE_SUBSCRIPTION_ID][
"aisearch_service_id-1"
].public_network_access
+
+
+class Test_AISearch_Service_get_aisearch_services:
+ def test_get_aisearch_services_no_resource_groups(self):
+ mock_service = MagicMock()
+ mock_service.id = AISEARCH_SERVICE_ID
+ mock_service.name = "search1"
+ mock_service.location = "westeurope"
+ mock_service.public_network_access = "Enabled"
+
+ mock_client = MagicMock()
+ mock_client.services.list_by_subscription.return_value = [mock_service]
+
+ with patch(
+ "prowler.providers.azure.services.aisearch.aisearch_service.AISearch._get_aisearch_services",
+ return_value={},
+ ):
+ aisearch = AISearch(set_mocked_azure_provider())
+
+ aisearch.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aisearch.resource_groups = None
+
+ result = aisearch._get_aisearch_services()
+
+ mock_client.services.list_by_subscription.assert_called_once()
+ mock_client.services.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert (
+ result[AZURE_SUBSCRIPTION_ID][AISEARCH_SERVICE_ID].public_network_access
+ is True
+ )
+
+ def test_get_aisearch_services_with_resource_group(self):
+ mock_service = MagicMock()
+ mock_service.id = AISEARCH_SERVICE_ID
+ mock_service.name = "search1"
+ mock_service.location = "westeurope"
+ mock_service.public_network_access = "Disabled"
+
+ mock_client = MagicMock()
+ mock_client.services.list_by_resource_group.return_value = [mock_service]
+
+ with patch(
+ "prowler.providers.azure.services.aisearch.aisearch_service.AISearch._get_aisearch_services",
+ return_value={},
+ ):
+ aisearch = AISearch(set_mocked_azure_provider())
+
+ aisearch.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aisearch.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = aisearch._get_aisearch_services()
+
+ mock_client.services.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.services.list_by_subscription.assert_not_called()
+ assert (
+ result[AZURE_SUBSCRIPTION_ID][AISEARCH_SERVICE_ID].public_network_access
+ is False
+ )
+
+ def test_get_aisearch_services_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.aisearch.aisearch_service.AISearch._get_aisearch_services",
+ return_value={},
+ ):
+ aisearch = AISearch(set_mocked_azure_provider())
+
+ aisearch.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aisearch.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = aisearch._get_aisearch_services()
+
+ mock_client.services.list_by_resource_group.assert_not_called()
+ mock_client.services.list_by_subscription.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_aisearch_services_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.services = MagicMock()
+ mock_client.services.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.aisearch.aisearch_service.AISearch._get_aisearch_services",
+ return_value={},
+ ):
+ aisearch = AISearch(set_mocked_azure_provider())
+
+ aisearch.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aisearch.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = aisearch._get_aisearch_services()
+
+ assert mock_client.services.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_aisearch_services_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.services = MagicMock()
+ mock_client.services.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.aisearch.aisearch_service.AISearch._get_aisearch_services",
+ return_value={},
+ ):
+ aisearch = AISearch(set_mocked_azure_provider())
+
+ aisearch.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aisearch.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ aisearch._get_aisearch_services()
+
+ mock_client.services.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/aks/aks_service_test.py b/tests/providers/azure/services/aks/aks_service_test.py
index 8644dcb03b..494c224b6b 100644
--- a/tests/providers/azure/services/aks/aks_service_test.py
+++ b/tests/providers/azure/services/aks/aks_service_test.py
@@ -1,8 +1,10 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.aks.aks_service import AKS, Cluster
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -66,3 +68,128 @@ class Test_AKS_Service:
aks.clusters[AZURE_SUBSCRIPTION_ID]["cluster_id-1"].location == "westeurope"
)
assert aks.clusters[AZURE_SUBSCRIPTION_ID]["cluster_id-1"].rbac_enabled
+
+
+class Test_AKS_get_clusters:
+ def test_get_clusters_no_resource_groups(self):
+ mock_cluster = MagicMock()
+ mock_cluster.id = "cluster_id-1"
+ mock_cluster.name = "cluster_name"
+ mock_cluster.fqdn = "public_fqdn"
+ mock_cluster.private_fqdn = "private_fqdn"
+ mock_cluster.location = "westeurope"
+ mock_cluster.kubernetes_version = "1.28.0"
+ mock_cluster.network_profile = None
+ mock_cluster.agent_pool_profiles = []
+ mock_cluster.enable_rbac = False
+
+ mock_client = MagicMock()
+ mock_client.managed_clusters.list.return_value = [mock_cluster]
+
+ with patch(
+ "prowler.providers.azure.services.aks.aks_service.AKS._get_clusters",
+ return_value={},
+ ):
+ aks = AKS(set_mocked_azure_provider())
+
+ aks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aks.resource_groups = None
+
+ result = aks._get_clusters()
+
+ mock_client.managed_clusters.list.assert_called_once()
+ mock_client.managed_clusters.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "cluster_id-1" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_clusters_with_resource_group(self):
+ mock_cluster = MagicMock()
+ mock_cluster.id = "cluster_id-1"
+ mock_cluster.name = "cluster_name"
+ mock_cluster.fqdn = "public_fqdn"
+ mock_cluster.private_fqdn = "private_fqdn"
+ mock_cluster.location = "westeurope"
+ mock_cluster.kubernetes_version = "1.28.0"
+ mock_cluster.network_profile = None
+ mock_cluster.agent_pool_profiles = []
+ mock_cluster.enable_rbac = False
+
+ mock_client = MagicMock()
+ mock_client.managed_clusters.list_by_resource_group.return_value = [
+ mock_cluster
+ ]
+
+ with patch(
+ "prowler.providers.azure.services.aks.aks_service.AKS._get_clusters",
+ return_value={},
+ ):
+ aks = AKS(set_mocked_azure_provider())
+
+ aks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aks.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = aks._get_clusters()
+
+ mock_client.managed_clusters.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.managed_clusters.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "cluster_id-1" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_clusters_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.aks.aks_service.AKS._get_clusters",
+ return_value={},
+ ):
+ aks = AKS(set_mocked_azure_provider())
+
+ aks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aks.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = aks._get_clusters()
+
+ mock_client.managed_clusters.list_by_resource_group.assert_not_called()
+ mock_client.managed_clusters.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_clusters_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.managed_clusters = MagicMock()
+ mock_client.managed_clusters.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.aks.aks_service.AKS._get_clusters",
+ return_value={},
+ ):
+ aks = AKS(set_mocked_azure_provider())
+
+ aks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aks.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = aks._get_clusters()
+
+ assert mock_client.managed_clusters.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_clusters_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.managed_clusters = MagicMock()
+ mock_client.managed_clusters.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.aks.aks_service.AKS._get_clusters",
+ return_value={},
+ ):
+ aks = AKS(set_mocked_azure_provider())
+
+ aks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ aks.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ aks._get_clusters()
+
+ mock_client.managed_clusters.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/apim/__init__.py b/tests/providers/azure/services/apim/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/azure/services/apim/apim_service_test.py b/tests/providers/azure/services/apim/apim_service_test.py
index f2141aee6b..cb78225e99 100644
--- a/tests/providers/azure/services/apim/apim_service_test.py
+++ b/tests/providers/azure/services/apim/apim_service_test.py
@@ -1,6 +1,6 @@
from datetime import timedelta
from unittest import TestCase, mock
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from azure.mgmt.loganalytics.models import Workspace
from azure.mgmt.monitor.models import DiagnosticSettingsResource
@@ -9,6 +9,8 @@ from azure.monitor.query import LogsQueryResult
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -16,7 +18,6 @@ from tests.providers.azure.azure_fixtures import (
APIM_INSTANCE_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg/providers/Microsoft.ApiManagement/service/apim1"
APIM_INSTANCE_NAME = "apim1"
LOCATION = "West US"
-RESOURCE_GROUP = "rg"
WORKSPACE_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourcegroups/rg/providers/microsoft.operationalinsights/workspaces/loganalytics"
WORKSPACE_CUSTOMER_ID = "12345678-1234-1234-1234-1234567890ab"
@@ -323,3 +324,168 @@ class Test_APIM_Service(TestCase):
instance = apim.instances[AZURE_SUBSCRIPTION_ID][0]
result = apim.get_llm_operations_logs(AZURE_SUBSCRIPTION_ID, instance)
self.assertEqual(result, [{"log": "data"}])
+
+
+class Test_APIM_get_instances:
+ def test_get_instances_no_resource_groups(self):
+ mock_instance = MagicMock()
+ mock_instance.id = APIM_INSTANCE_ID
+ mock_instance.name = APIM_INSTANCE_NAME
+ mock_instance.location = LOCATION
+
+ mock_client = MagicMock()
+ mock_client.api_management_service.list.return_value = [mock_instance]
+
+ mock_provider = mock.MagicMock()
+ mock_provider.identity = mock.MagicMock()
+ with (
+ patch(
+ "prowler.providers.azure.azure_provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.apim.apim_service.APIM._get_instances",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.apim.apim_service import APIM
+
+ apim = APIM(set_mocked_azure_provider())
+
+ apim.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ apim.resource_groups = None
+
+ with patch.object(apim, "_get_log_analytics_workspace_id", return_value=None):
+ result = apim._get_instances()
+
+ mock_client.api_management_service.list.assert_called_once()
+ mock_client.api_management_service.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert len(result[AZURE_SUBSCRIPTION_ID]) == 1
+ assert result[AZURE_SUBSCRIPTION_ID][0].id == APIM_INSTANCE_ID
+
+ def test_get_instances_with_resource_group(self):
+ mock_instance = MagicMock()
+ mock_instance.id = APIM_INSTANCE_ID
+ mock_instance.name = APIM_INSTANCE_NAME
+ mock_instance.location = LOCATION
+
+ mock_client = MagicMock()
+ mock_client.api_management_service.list_by_resource_group.return_value = [
+ mock_instance
+ ]
+
+ mock_provider = mock.MagicMock()
+ mock_provider.identity = mock.MagicMock()
+ with (
+ patch(
+ "prowler.providers.azure.azure_provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.apim.apim_service.APIM._get_instances",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.apim.apim_service import APIM
+
+ apim = APIM(set_mocked_azure_provider())
+
+ apim.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ apim.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ with patch.object(apim, "_get_log_analytics_workspace_id", return_value=None):
+ result = apim._get_instances()
+
+ mock_client.api_management_service.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.api_management_service.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert len(result[AZURE_SUBSCRIPTION_ID]) == 1
+ assert result[AZURE_SUBSCRIPTION_ID][0].name == APIM_INSTANCE_NAME
+
+ def test_get_instances_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ mock_provider = mock.MagicMock()
+ mock_provider.identity = mock.MagicMock()
+ with (
+ patch(
+ "prowler.providers.azure.azure_provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.apim.apim_service.APIM._get_instances",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.apim.apim_service import APIM
+
+ apim = APIM(set_mocked_azure_provider())
+
+ apim.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ apim.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = apim._get_instances()
+
+ mock_client.api_management_service.list_by_resource_group.assert_not_called()
+ mock_client.api_management_service.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_instances_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+
+ mock_provider = mock.MagicMock()
+ mock_provider.identity = mock.MagicMock()
+ with (
+ patch(
+ "prowler.providers.azure.azure_provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.apim.apim_service.APIM._get_instances",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.apim.apim_service import APIM
+
+ apim = APIM(set_mocked_azure_provider())
+
+ apim.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ apim.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ with patch.object(apim, "_get_log_analytics_workspace_id", return_value=None):
+ result = apim._get_instances()
+
+ assert mock_client.api_management_service.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_instances_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+
+ mock_provider = mock.MagicMock()
+ mock_provider.identity = mock.MagicMock()
+ with (
+ patch(
+ "prowler.providers.azure.azure_provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.apim.apim_service.APIM._get_instances",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.apim.apim_service import APIM
+
+ apim = APIM(set_mocked_azure_provider())
+
+ apim.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ apim.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ with patch.object(apim, "_get_log_analytics_workspace_id", return_value=None):
+ apim._get_instances()
+
+ mock_client.api_management_service.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/apim/apim_threat_detection_llm_jacking/__init__.py b/tests/providers/azure/services/apim/apim_threat_detection_llm_jacking/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured_test.py b/tests/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured_test.py
index 770ca07b2b..803ba7bd75 100644
--- a/tests/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured_test.py
+++ b/tests/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured_test.py
@@ -87,7 +87,7 @@ class Test_app_function_access_keys_configured:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -143,7 +143,7 @@ class Test_app_function_access_keys_configured:
"default": "key1",
"key2": "key2",
},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py b/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py
index 4a55b1e108..b113d96e50 100644
--- a/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py
+++ b/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py
@@ -87,7 +87,7 @@ class Test_app_function_application_insights_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -138,7 +138,9 @@ class Test_app_function_application_insights_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={"APPINSIGHTS_INSTRUMENTATIONKEY": "1234"},
+ environment_variables={
+ "APPINSIGHTS_INSTRUMENTATIONKEY": "1234"
+ },
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -189,7 +191,9 @@ class Test_app_function_application_insights_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={"APPINSIGHTS_INSTRUMENTATIONKEY": "1234"},
+ environment_variables={
+ "APPINSIGHTS_INSTRUMENTATIONKEY": "1234"
+ },
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -240,7 +244,7 @@ class Test_app_function_application_insights_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https_test.py b/tests/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https_test.py
new file mode 100644
index 0000000000..c4b5c7266a
--- /dev/null
+++ b/tests/providers/azure/services/app/app_function_ensure_http_is_redirected_to_https/app_function_ensure_http_is_redirected_to_https_test.py
@@ -0,0 +1,157 @@
+from unittest import mock
+from uuid import uuid4
+
+from tests.providers.azure.azure_fixtures import (
+ AZURE_SUBSCRIPTION_DISPLAY,
+ AZURE_SUBSCRIPTION_ID,
+ AZURE_SUBSCRIPTION_NAME,
+ set_mocked_azure_provider,
+)
+
+
+class Test_app_function_ensure_http_is_redirected_to_https:
+ def test_function_no_subscriptions(self):
+ app_client = mock.MagicMock
+ app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+ app_client.functions = {}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https.app_client",
+ new=app_client,
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https import (
+ app_function_ensure_http_is_redirected_to_https,
+ )
+
+ check = app_function_ensure_http_is_redirected_to_https()
+ result = check.execute()
+ assert len(result) == 0
+
+ def test_function_subscriptions_empty(self):
+ app_client = mock.MagicMock
+ app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+ app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https.app_client",
+ new=app_client,
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https import (
+ app_function_ensure_http_is_redirected_to_https,
+ )
+
+ check = app_function_ensure_http_is_redirected_to_https()
+ result = check.execute()
+ assert len(result) == 0
+
+ def test_function_http_not_redirected(self):
+ resource_id = f"/subscriptions/{uuid4()}"
+ app_client = mock.MagicMock
+ app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https.app_client",
+ new=app_client,
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https import (
+ app_function_ensure_http_is_redirected_to_https,
+ )
+ from prowler.providers.azure.services.app.app_service import FunctionApp
+
+ app_client.functions = {
+ AZURE_SUBSCRIPTION_ID: {
+ resource_id: FunctionApp(
+ id=resource_id,
+ name="function-1",
+ location="West Europe",
+ kind="functionapp",
+ function_keys=None,
+ environment_variables=None,
+ identity=None,
+ public_access=True,
+ vnet_subnet_id="",
+ ftps_state="Disabled",
+ https_only=False,
+ )
+ }
+ }
+ check = app_function_ensure_http_is_redirected_to_https()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"HTTP is not redirected to HTTPS for Function app 'function-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
+ )
+ assert result[0].resource_name == "function-1"
+ assert result[0].resource_id == resource_id
+ assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+ assert result[0].location == "West Europe"
+
+ def test_function_http_redirected(self):
+ resource_id = f"/subscriptions/{uuid4()}"
+ app_client = mock.MagicMock
+ app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https.app_client",
+ new=app_client,
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_function_ensure_http_is_redirected_to_https.app_function_ensure_http_is_redirected_to_https import (
+ app_function_ensure_http_is_redirected_to_https,
+ )
+ from prowler.providers.azure.services.app.app_service import FunctionApp
+
+ app_client.functions = {
+ AZURE_SUBSCRIPTION_ID: {
+ resource_id: FunctionApp(
+ id=resource_id,
+ name="function-1",
+ location="West Europe",
+ kind="functionapp",
+ function_keys=None,
+ environment_variables=None,
+ identity=None,
+ public_access=True,
+ vnet_subnet_id="",
+ ftps_state="Disabled",
+ https_only=True,
+ )
+ }
+ }
+ check = app_function_ensure_http_is_redirected_to_https()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"HTTP is redirected to HTTPS for Function app 'function-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
+ )
+ assert result[0].resource_name == "function-1"
+ assert result[0].resource_id == resource_id
+ assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+ assert result[0].location == "West Europe"
diff --git a/tests/providers/azure/services/app/app_function_ftps_deployment_disabled/app_function_ftps_deployment_disabled_test.py b/tests/providers/azure/services/app/app_function_ftps_deployment_disabled/app_function_ftps_deployment_disabled_test.py
index b08c712da1..fb20317347 100644
--- a/tests/providers/azure/services/app/app_function_ftps_deployment_disabled/app_function_ftps_deployment_disabled_test.py
+++ b/tests/providers/azure/services/app/app_function_ftps_deployment_disabled/app_function_ftps_deployment_disabled_test.py
@@ -87,7 +87,7 @@ class Test_app_function_ftps_deployment_disabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=False,
vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_ftps_deployment_disabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=False,
vnet_subnet_id=None,
@@ -189,7 +189,7 @@ class Test_app_function_ftps_deployment_disabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_identity_is_configured/app_function_identity_is_configured_test.py b/tests/providers/azure/services/app/app_function_identity_is_configured/app_function_identity_is_configured_test.py
index 84dbece6d2..5a770a196c 100644
--- a/tests/providers/azure/services/app/app_function_identity_is_configured/app_function_identity_is_configured_test.py
+++ b/tests/providers/azure/services/app/app_function_identity_is_configured/app_function_identity_is_configured_test.py
@@ -87,7 +87,7 @@ class Test_app_function_identity_is_configured:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_identity_is_configured:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_identity_without_admin_privileges/app_function_identity_without_admin_privileges_test.py b/tests/providers/azure/services/app/app_function_identity_without_admin_privileges/app_function_identity_without_admin_privileges_test.py
index 9c7f074c3b..ef42098847 100644
--- a/tests/providers/azure/services/app/app_function_identity_without_admin_privileges/app_function_identity_without_admin_privileges_test.py
+++ b/tests/providers/azure/services/app/app_function_identity_without_admin_privileges/app_function_identity_without_admin_privileges_test.py
@@ -88,7 +88,7 @@ class Test_app_function_identity_without_admin_privileges:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -140,7 +140,7 @@ class Test_app_function_identity_without_admin_privileges:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(principal_id="123"),
public_access=False,
vnet_subnet_id=None,
@@ -228,7 +228,7 @@ class Test_app_function_identity_without_admin_privileges:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(principal_id="123"),
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version_test.py b/tests/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version_test.py
index 89bfc642b0..597335bc39 100644
--- a/tests/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version_test.py
+++ b/tests/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version_test.py
@@ -87,7 +87,7 @@ class Test_app_function_latest_runtime_version:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={"FUNCTIONS_EXTENSION_VERSION": "~4"},
+ environment_variables={"FUNCTIONS_EXTENSION_VERSION": "~4"},
identity=None,
public_access=False,
vnet_subnet_id=None,
@@ -137,7 +137,7 @@ class Test_app_function_latest_runtime_version:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={"FUNCTIONS_EXTENSION_VERSION": "2"},
+ environment_variables={"FUNCTIONS_EXTENSION_VERSION": "2"},
identity=None,
public_access=False,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_not_publicly_accessible/app_function_not_publicly_accessible_test.py b/tests/providers/azure/services/app/app_function_not_publicly_accessible/app_function_not_publicly_accessible_test.py
index 3c60aebc20..f8f36af8f4 100644
--- a/tests/providers/azure/services/app/app_function_not_publicly_accessible/app_function_not_publicly_accessible_test.py
+++ b/tests/providers/azure/services/app/app_function_not_publicly_accessible/app_function_not_publicly_accessible_test.py
@@ -87,7 +87,7 @@ class Test_app_function_not_publicly_accessible:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=False,
vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_not_publicly_accessible:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=mock.MagicMock(type="SystemAssigned"),
public_access=True,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_function_vnet_integration_enabled/app_function_vnet_integration_enabled_test.py b/tests/providers/azure/services/app/app_function_vnet_integration_enabled/app_function_vnet_integration_enabled_test.py
index f12422f1da..c12b14de7c 100644
--- a/tests/providers/azure/services/app/app_function_vnet_integration_enabled/app_function_vnet_integration_enabled_test.py
+++ b/tests/providers/azure/services/app/app_function_vnet_integration_enabled/app_function_vnet_integration_enabled_test.py
@@ -87,7 +87,7 @@ class Test_app_function_vnet_integration_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=True,
vnet_subnet_id="vnet_subnet_id",
@@ -138,7 +138,7 @@ class Test_app_function_vnet_integration_enabled:
location="West Europe",
kind="functionapp,linux",
function_keys={},
- enviroment_variables={},
+ environment_variables={},
identity=None,
public_access=True,
vnet_subnet_id=None,
diff --git a/tests/providers/azure/services/app/app_service_test.py b/tests/providers/azure/services/app/app_service_test.py
index cc33c662a1..f517f39d34 100644
--- a/tests/providers/azure/services/app/app_service_test.py
+++ b/tests/providers/azure/services/app/app_service_test.py
@@ -5,6 +5,8 @@ from azure.mgmt.web.models import ManagedServiceIdentity, SiteConfigResource
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -220,7 +222,7 @@ class Test_App_Service:
location="West Europe",
kind="functionapp",
function_keys=None,
- enviroment_variables=None,
+ environment_variables=None,
identity=ManagedServiceIdentity(type="SystemAssigned"),
public_access=True,
vnet_subnet_id="",
@@ -244,3 +246,362 @@ class Test_App_Service:
].name
== "functionapp-1"
)
+
+ def test_get_function_host_keys_logs_warning_on_optional_failure(self):
+ from prowler.providers.azure.services.app.app_service import App
+
+ mock_client = MagicMock()
+ mock_client.web_apps.list_host_keys.side_effect = Exception("Forbidden")
+ app = object.__new__(App)
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+
+ with (
+ patch(
+ "prowler.providers.azure.services.app.app_service.logger.warning"
+ ) as mock_warning,
+ patch(
+ "prowler.providers.azure.services.app.app_service.logger.error"
+ ) as mock_error,
+ ):
+ result = app._get_function_host_keys(
+ AZURE_SUBSCRIPTION_ID, RESOURCE_GROUP, "functionapp-1"
+ )
+
+ assert result is None
+ mock_warning.assert_called_once()
+ mock_error.assert_not_called()
+
+ def test_list_application_settings_logs_warning_on_optional_failure(self):
+ from prowler.providers.azure.services.app.app_service import App
+
+ mock_client = MagicMock()
+ mock_client.web_apps.list_application_settings.side_effect = Exception(
+ "Forbidden"
+ )
+ app = object.__new__(App)
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+
+ with (
+ patch(
+ "prowler.providers.azure.services.app.app_service.logger.warning"
+ ) as mock_warning,
+ patch(
+ "prowler.providers.azure.services.app.app_service.logger.error"
+ ) as mock_error,
+ ):
+ result = app._list_application_settings(
+ AZURE_SUBSCRIPTION_ID, RESOURCE_GROUP, "functionapp-1"
+ )
+
+ assert result is None
+ mock_warning.assert_called_once()
+ mock_error.assert_not_called()
+
+
+class Test_App_get_apps:
+ def test_get_apps_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = None
+
+ result = app._get_apps()
+
+ mock_client.web_apps.list.assert_called_once()
+ mock_client.web_apps.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_apps_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = app._get_apps()
+
+ mock_client.web_apps.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.web_apps.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_apps_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = app._get_apps()
+
+ mock_client.web_apps.list_by_resource_group.assert_not_called()
+ mock_client.web_apps.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_apps_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = app._get_apps()
+
+ assert mock_client.web_apps.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_apps_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ app._get_apps()
+
+ mock_client.web_apps.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_App_get_functions:
+ def test_get_functions_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = None
+
+ result = app._get_functions()
+
+ mock_client.web_apps.list.assert_called_once()
+ mock_client.web_apps.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_functions_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = app._get_functions()
+
+ mock_client.web_apps.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.web_apps.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_functions_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = app._get_functions()
+
+ mock_client.web_apps.list_by_resource_group.assert_not_called()
+ mock_client.web_apps.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_functions_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = app._get_functions()
+
+ assert mock_client.web_apps.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_functions_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.web_apps.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ ):
+ from prowler.providers.azure.services.app.app_service import App
+
+ app = App(set_mocked_azure_provider())
+
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ app._get_functions()
+
+ mock_client.web_apps.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+ def test_get_functions_sets_https_only(self):
+ from prowler.providers.azure.services.app.app_service import App
+
+ mock_client = MagicMock()
+ mock_function = MagicMock()
+ mock_function.id = "/subscriptions/resource_id"
+ mock_function.name = "functionapp-1"
+ mock_function.location = "West Europe"
+ mock_function.kind = "functionapp"
+ mock_function.resource_group = RESOURCE_GROUP
+ mock_function.identity = None
+ mock_function.public_network_access = "Enabled"
+ mock_function.virtual_network_subnet_id = ""
+ mock_function.https_only = True
+ mock_client.web_apps.list.return_value = [mock_function]
+
+ app = object.__new__(App)
+ app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app.resource_groups = None
+ app._get_function_host_keys = MagicMock(return_value=None)
+ app._list_application_settings = MagicMock(
+ return_value=MagicMock(properties={})
+ )
+ app._get_function_config = MagicMock(
+ return_value=MagicMock(ftps_state="FtpsOnly")
+ )
+
+ result = app._get_functions()
+
+ function = result[AZURE_SUBSCRIPTION_ID][mock_function.id]
+ assert function.https_only is True
+ app._get_function_host_keys.assert_called_once_with(
+ AZURE_SUBSCRIPTION_ID, RESOURCE_GROUP, "functionapp-1"
+ )
diff --git a/tests/providers/azure/services/appinsights/appinsights_service_test.py b/tests/providers/azure/services/appinsights/appinsights_service_test.py
index 6d821ff3e6..7a0c80acc6 100644
--- a/tests/providers/azure/services/appinsights/appinsights_service_test.py
+++ b/tests/providers/azure/services/appinsights/appinsights_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.appinsights.appinsights_service import (
AppInsights,
@@ -6,6 +6,8 @@ from prowler.providers.azure.services.appinsights.appinsights_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -54,3 +56,121 @@ class Test_AppInsights_Service:
appinsights.components[AZURE_SUBSCRIPTION_ID]["app_id-1"].location
== "westeurope"
)
+
+
+class Test_AppInsights_get_components:
+ def test_get_components_no_resource_groups(self):
+ mock_component = MagicMock()
+ mock_component.app_id = "comp-app-id"
+ mock_component.id = "/subscriptions/sub/rg/appinsights"
+ mock_component.name = "ai-component"
+ mock_component.location = "westeurope"
+ mock_component.instrumentation_key = "ikey-123"
+
+ mock_client = MagicMock()
+ mock_client.components = MagicMock()
+ mock_client.components.list.return_value = [mock_component]
+
+ with patch(
+ "prowler.providers.azure.services.appinsights.appinsights_service.AppInsights._get_components",
+ return_value={},
+ ):
+ app_insights = AppInsights(set_mocked_azure_provider())
+
+ app_insights.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app_insights.resource_groups = None
+
+ result = app_insights._get_components()
+
+ mock_client.components.list.assert_called_once()
+ mock_client.components.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "comp-app-id" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_components_with_resource_group(self):
+ mock_component = MagicMock()
+ mock_component.app_id = "comp-app-id"
+ mock_component.id = "/subscriptions/sub/rg/appinsights"
+ mock_component.name = "ai-component"
+ mock_component.location = "westeurope"
+ mock_component.instrumentation_key = "ikey-123"
+
+ mock_client = MagicMock()
+ mock_client.components = MagicMock()
+ mock_client.components.list_by_resource_group.return_value = [mock_component]
+
+ with patch(
+ "prowler.providers.azure.services.appinsights.appinsights_service.AppInsights._get_components",
+ return_value={},
+ ):
+ app_insights = AppInsights(set_mocked_azure_provider())
+
+ app_insights.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app_insights.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = app_insights._get_components()
+
+ mock_client.components.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.components.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "comp-app-id" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_components_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.components = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.appinsights.appinsights_service.AppInsights._get_components",
+ return_value={},
+ ):
+ app_insights = AppInsights(set_mocked_azure_provider())
+
+ app_insights.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app_insights.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = app_insights._get_components()
+
+ mock_client.components.list_by_resource_group.assert_not_called()
+ mock_client.components.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_components_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.components = MagicMock()
+ mock_client.components.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.appinsights.appinsights_service.AppInsights._get_components",
+ return_value={},
+ ):
+ app_insights = AppInsights(set_mocked_azure_provider())
+
+ app_insights.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app_insights.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = app_insights._get_components()
+
+ assert mock_client.components.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_components_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.components = MagicMock()
+ mock_client.components.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.appinsights.appinsights_service.AppInsights._get_components",
+ return_value={},
+ ):
+ app_insights = AppInsights(set_mocked_azure_provider())
+
+ app_insights.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ app_insights.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ app_insights._get_components()
+
+ mock_client.components.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/containerregistry/containerregistry_service_test.py b/tests/providers/azure/services/containerregistry/containerregistry_service_test.py
index 3e4a02406e..36883f97d9 100644
--- a/tests/providers/azure/services/containerregistry/containerregistry_service_test.py
+++ b/tests/providers/azure/services/containerregistry/containerregistry_service_test.py
@@ -3,6 +3,8 @@ from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -89,3 +91,198 @@ class TestContainerRegistryService:
assert monitor_setting["logs"][0]["enabled"] is True
assert monitor_setting["logs"][1]["category"] == "AdminLogs"
assert monitor_setting["logs"][1]["enabled"] is False
+
+
+class Test_ContainerRegistry_get_registries:
+ def test_get_container_registries_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.registries.list.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.ContainerRegistry._get_container_registries",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.containerregistry.containerregistry_service import (
+ ContainerRegistry,
+ )
+
+ cr = ContainerRegistry(set_mocked_azure_provider())
+
+ cr.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cr.resource_groups = None
+
+ with patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.monitor_client"
+ ):
+ result = cr._get_container_registries()
+
+ mock_client.registries.list.assert_called_once()
+ mock_client.registries.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_container_registries_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.registries.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.ContainerRegistry._get_container_registries",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.containerregistry.containerregistry_service import (
+ ContainerRegistry,
+ )
+
+ cr = ContainerRegistry(set_mocked_azure_provider())
+
+ cr.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cr.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ with patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.monitor_client"
+ ):
+ result = cr._get_container_registries()
+
+ mock_client.registries.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.registries.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_container_registries_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.ContainerRegistry._get_container_registries",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.containerregistry.containerregistry_service import (
+ ContainerRegistry,
+ )
+
+ cr = ContainerRegistry(set_mocked_azure_provider())
+
+ cr.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cr.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ with patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.monitor_client"
+ ):
+ result = cr._get_container_registries()
+
+ mock_client.registries.list_by_resource_group.assert_not_called()
+ mock_client.registries.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_container_registries_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.registries.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.ContainerRegistry._get_container_registries",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.containerregistry.containerregistry_service import (
+ ContainerRegistry,
+ )
+
+ cr = ContainerRegistry(set_mocked_azure_provider())
+
+ cr.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cr.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ with patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.monitor_client"
+ ):
+ result = cr._get_container_registries()
+
+ assert mock_client.registries.list_by_resource_group.call_count == len(
+ RESOURCE_GROUP_LIST
+ )
+ mock_client.registries.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_container_registries_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.registries.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.ContainerRegistry._get_container_registries",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.containerregistry.containerregistry_service import (
+ ContainerRegistry,
+ )
+
+ cr = ContainerRegistry(set_mocked_azure_provider())
+
+ cr.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cr.resource_groups = {AZURE_SUBSCRIPTION_ID: ["MyRegistry-RG"]}
+
+ with patch(
+ "prowler.providers.azure.services.containerregistry.containerregistry_service.monitor_client"
+ ):
+ cr._get_container_registries()
+
+ mock_client.registries.list_by_resource_group.assert_called_once_with(
+ resource_group_name="MyRegistry-RG"
+ )
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_service_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_service_test.py
index 09293d7dcd..b1cc8d0e1b 100644
--- a/tests/providers/azure/services/cosmosdb/cosmosdb_service_test.py
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_service_test.py
@@ -1,8 +1,10 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account, CosmosDB
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -133,3 +135,114 @@ class Test_CosmosDB_Service_None_Handling:
== "Microsoft.Network/privateEndpoints"
)
assert account.disable_local_auth is True
+
+
+class Test_CosmosDB_get_accounts:
+ def test_get_accounts_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.database_accounts.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.cosmosdb.cosmosdb_service.CosmosDB._get_accounts",
+ return_value={},
+ ):
+ cosmosdb = CosmosDB(set_mocked_azure_provider())
+
+ cosmosdb.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cosmosdb.resource_groups = None
+
+ result = cosmosdb._get_accounts()
+
+ mock_client.database_accounts.list.assert_called_once()
+ mock_client.database_accounts.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_accounts_with_resource_group(self):
+ mock_account = MagicMock()
+ mock_account.id = "account-id"
+ mock_account.name = "my-cosmos"
+ mock_account.kind = "GlobalDocumentDB"
+ mock_account.location = "eastus"
+ mock_account.type = "Microsoft.DocumentDB/databaseAccounts"
+ mock_account.tags = {}
+ mock_account.is_virtual_network_filter_enabled = False
+ mock_account.private_endpoint_connections = []
+ mock_account.disable_local_auth = False
+
+ mock_client = MagicMock()
+ mock_client.database_accounts.list_by_resource_group.return_value = [
+ mock_account
+ ]
+
+ with patch(
+ "prowler.providers.azure.services.cosmosdb.cosmosdb_service.CosmosDB._get_accounts",
+ return_value={},
+ ):
+ cosmosdb = CosmosDB(set_mocked_azure_provider())
+
+ cosmosdb.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cosmosdb.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = cosmosdb._get_accounts()
+
+ mock_client.database_accounts.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.database_accounts.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert len(result[AZURE_SUBSCRIPTION_ID]) == 1
+
+ def test_get_accounts_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.cosmosdb.cosmosdb_service.CosmosDB._get_accounts",
+ return_value={},
+ ):
+ cosmosdb = CosmosDB(set_mocked_azure_provider())
+
+ cosmosdb.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cosmosdb.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = cosmosdb._get_accounts()
+
+ mock_client.database_accounts.list_by_resource_group.assert_not_called()
+ mock_client.database_accounts.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_accounts_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.database_accounts.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.cosmosdb.cosmosdb_service.CosmosDB._get_accounts",
+ return_value={},
+ ):
+ cosmosdb = CosmosDB(set_mocked_azure_provider())
+
+ cosmosdb.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cosmosdb.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = cosmosdb._get_accounts()
+
+ assert mock_client.database_accounts.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_accounts_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.database_accounts.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.cosmosdb.cosmosdb_service.CosmosDB._get_accounts",
+ return_value={},
+ ):
+ cosmosdb = CosmosDB(set_mocked_azure_provider())
+
+ cosmosdb.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ cosmosdb.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ cosmosdb._get_accounts()
+
+ mock_client.database_accounts.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/databricks/databricks_service_test.py b/tests/providers/azure/services/databricks/databricks_service_test.py
index f663d81fe2..669558f0e0 100644
--- a/tests/providers/azure/services/databricks/databricks_service_test.py
+++ b/tests/providers/azure/services/databricks/databricks_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.databricks.databricks_service import (
Databricks,
@@ -7,6 +7,8 @@ from prowler.providers.azure.services.databricks.databricks_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -94,3 +96,123 @@ class Test_Databricks_Service_No_Encryption:
assert workspace.location == "eastus"
assert workspace.custom_managed_vnet_id == "test-vnet-id"
assert workspace.managed_disk_encryption is None
+
+
+class Test_Databricks_get_workspaces:
+ def test_get_workspaces_no_resource_groups(self):
+ mock_workspace = MagicMock()
+ mock_workspace.id = "ws-id-1"
+ mock_workspace.name = "my-workspace"
+ mock_workspace.location = "eastus"
+ mock_workspace.parameters = None
+ mock_workspace.encryption = None
+ mock_workspace.public_network_access = None
+
+ mock_client = MagicMock()
+ mock_client.workspaces = MagicMock()
+ mock_client.workspaces.list_by_subscription.return_value = [mock_workspace]
+
+ with patch(
+ "prowler.providers.azure.services.databricks.databricks_service.Databricks._get_workspaces",
+ return_value={},
+ ):
+ databricks = Databricks(set_mocked_azure_provider())
+
+ databricks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ databricks.resource_groups = None
+
+ result = databricks._get_workspaces()
+
+ mock_client.workspaces.list_by_subscription.assert_called_once()
+ mock_client.workspaces.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "ws-id-1" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_workspaces_with_resource_group(self):
+ mock_workspace = MagicMock()
+ mock_workspace.id = "ws-id-1"
+ mock_workspace.name = "my-workspace"
+ mock_workspace.location = "eastus"
+ mock_workspace.parameters = None
+ mock_workspace.encryption = None
+ mock_workspace.public_network_access = None
+
+ mock_client = MagicMock()
+ mock_client.workspaces = MagicMock()
+ mock_client.workspaces.list_by_resource_group.return_value = [mock_workspace]
+
+ with patch(
+ "prowler.providers.azure.services.databricks.databricks_service.Databricks._get_workspaces",
+ return_value={},
+ ):
+ databricks = Databricks(set_mocked_azure_provider())
+
+ databricks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ databricks.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = databricks._get_workspaces()
+
+ mock_client.workspaces.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.workspaces.list_by_subscription.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "ws-id-1" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_workspaces_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.workspaces = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.databricks.databricks_service.Databricks._get_workspaces",
+ return_value={},
+ ):
+ databricks = Databricks(set_mocked_azure_provider())
+
+ databricks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ databricks.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = databricks._get_workspaces()
+
+ mock_client.workspaces.list_by_resource_group.assert_not_called()
+ mock_client.workspaces.list_by_subscription.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_workspaces_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.workspaces = MagicMock()
+ mock_client.workspaces.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.databricks.databricks_service.Databricks._get_workspaces",
+ return_value={},
+ ):
+ databricks = Databricks(set_mocked_azure_provider())
+
+ databricks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ databricks.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = databricks._get_workspaces()
+
+ assert mock_client.workspaces.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_workspaces_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.workspaces = MagicMock()
+ mock_client.workspaces.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.databricks.databricks_service.Databricks._get_workspaces",
+ return_value={},
+ ):
+ databricks = Databricks(set_mocked_azure_provider())
+
+ databricks.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ databricks.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ databricks._get_workspaces()
+
+ mock_client.workspaces.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/defender/defender_additional_email_configured_with_a_security_contact/defender_additional_email_configured_with_a_security_contact_test.py b/tests/providers/azure/services/defender/defender_additional_email_configured_with_a_security_contact/defender_additional_email_configured_with_a_security_contact_test.py
index 75f3d5014a..8a57fa0fcb 100644
--- a/tests/providers/azure/services/defender/defender_additional_email_configured_with_a_security_contact/defender_additional_email_configured_with_a_security_contact_test.py
+++ b/tests/providers/azure/services/defender/defender_additional_email_configured_with_a_security_contact/defender_additional_email_configured_with_a_security_contact_test.py
@@ -16,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
@@ -40,6 +41,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_no_additional_emails(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -87,6 +89,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_additional_email_configured(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_assessments_vm_endpoint_protection_installed/defender_assessments_vm_endpoint_protection_installed_test.py b/tests/providers/azure/services/defender/defender_assessments_vm_endpoint_protection_installed/defender_assessments_vm_endpoint_protection_installed_test.py
index 1e567ac153..e9030a2a52 100644
--- a/tests/providers/azure/services/defender/defender_assessments_vm_endpoint_protection_installed/defender_assessments_vm_endpoint_protection_installed_test.py
+++ b/tests/providers/azure/services/defender/defender_assessments_vm_endpoint_protection_installed/defender_assessments_vm_endpoint_protection_installed_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
@@ -36,6 +37,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_subscriptions_with_no_assessments(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
@@ -59,6 +61,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_subscriptions_with_healthy_assessments(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
resource_id = str(uuid4())
defender_client.assessments = {
@@ -98,6 +101,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_subscriptions_with_unhealthy_assessments(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
resource_id = str(uuid4())
defender_client.assessments = {
diff --git a/tests/providers/azure/services/defender/defender_attack_path_notifications_properly_configured/defender_attack_path_notifications_properly_configured_test.py b/tests/providers/azure/services/defender/defender_attack_path_notifications_properly_configured/defender_attack_path_notifications_properly_configured_test.py
index ebece2e029..220fbbf4bf 100644
--- a/tests/providers/azure/services/defender/defender_attack_path_notifications_properly_configured/defender_attack_path_notifications_properly_configured_test.py
+++ b/tests/providers/azure/services/defender/defender_attack_path_notifications_properly_configured/defender_attack_path_notifications_properly_configured_test.py
@@ -16,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_attack_path_notifications_properly_configured:
def test_no_subscriptions(self):
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
defender_client.audit_config = {}
@@ -41,6 +42,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -89,6 +91,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -139,6 +142,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -189,6 +193,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -237,6 +242,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -285,6 +291,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -333,6 +340,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_auto_provisioning_log_analytics_agent_vms_on/defender_auto_provisioning_log_analytics_agent_vms_on_test.py b/tests/providers/azure/services/defender/defender_auto_provisioning_log_analytics_agent_vms_on/defender_auto_provisioning_log_analytics_agent_vms_on_test.py
index 9a99281e94..bfc540f0eb 100644
--- a/tests/providers/azure/services/defender/defender_auto_provisioning_log_analytics_agent_vms_on/defender_auto_provisioning_log_analytics_agent_vms_on_test.py
+++ b/tests/providers/azure/services/defender/defender_auto_provisioning_log_analytics_agent_vms_on/defender_auto_provisioning_log_analytics_agent_vms_on_test.py
@@ -15,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {}
@@ -39,6 +40,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -80,6 +82,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_on(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -121,6 +124,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_on_and_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_auto_provisioning_vulnerabilty_assessments_machines_on/defender_auto_provisioning_vulnerabilty_assessments_machines_on_test.py b/tests/providers/azure/services/defender/defender_auto_provisioning_vulnerabilty_assessments_machines_on/defender_auto_provisioning_vulnerabilty_assessments_machines_on_test.py
index eeddb61012..b5cf053127 100644
--- a/tests/providers/azure/services/defender/defender_auto_provisioning_vulnerabilty_assessments_machines_on/defender_auto_provisioning_vulnerabilty_assessments_machines_on_test.py
+++ b/tests/providers/azure/services/defender/defender_auto_provisioning_vulnerabilty_assessments_machines_on/defender_auto_provisioning_vulnerabilty_assessments_machines_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
@@ -37,6 +38,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_machines_no_vulnerability_assessment_solution(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -77,6 +79,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_machines_vulnerability_assessment_solution(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_container_images_resolved_vulnerabilities/defender_container_images_resolved_vulnerabilities_test.py b/tests/providers/azure/services/defender/defender_container_images_resolved_vulnerabilities/defender_container_images_resolved_vulnerabilities_test.py
index 510a995692..3eb5ffd4a5 100644
--- a/tests/providers/azure/services/defender/defender_container_images_resolved_vulnerabilities/defender_container_images_resolved_vulnerabilities_test.py
+++ b/tests/providers/azure/services/defender/defender_container_images_resolved_vulnerabilities/defender_container_images_resolved_vulnerabilities_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
@@ -36,6 +37,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_empty(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
@@ -59,6 +61,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_no_assesment(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -90,6 +93,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_assesment_unhealthy(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -139,6 +143,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_assesment_healthy(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -188,6 +193,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_assesment_not_applicable(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_container_images_scan_enabled/defender_container_images_scan_enabled_test.py b/tests/providers/azure/services/defender/defender_container_images_scan_enabled/defender_container_images_scan_enabled_test.py
index 977ee8acdb..63e89a844a 100644
--- a/tests/providers/azure/services/defender/defender_container_images_scan_enabled/defender_container_images_scan_enabled_test.py
+++ b/tests/providers/azure/services/defender/defender_container_images_scan_enabled/defender_container_images_scan_enabled_test.py
@@ -14,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_container_images_scan_enabled:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_empty(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {AZURE_SUBSCRIPTION_ID: {}}
@@ -60,6 +62,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_no_containers(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -92,6 +95,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_no_extensions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -137,6 +141,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_container_images_scan_off(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -182,6 +187,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_container_images_scan_on(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_app_services_is_on/defender_ensure_defender_for_app_services_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_app_services_is_on/defender_ensure_defender_for_app_services_is_on_test.py
index b2528e28e7..9164b7dfdb 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_app_services_is_on/defender_ensure_defender_for_app_services_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_app_services_is_on/defender_ensure_defender_for_app_services_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_app_services_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_app_services_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_arm_is_on/defender_ensure_defender_for_arm_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_arm_is_on/defender_ensure_defender_for_arm_is_on_test.py
index 357e3ca9e7..2c83113dc6 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_arm_is_on/defender_ensure_defender_for_arm_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_arm_is_on/defender_ensure_defender_for_arm_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_no_arm(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_arm_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_arm_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_azure_sql_databases_is_on/defender_ensure_defender_for_azure_sql_databases_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_azure_sql_databases_is_on/defender_ensure_defender_for_azure_sql_databases_is_on_test.py
index c10314042b..f4ff5f6471 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_azure_sql_databases_is_on/defender_ensure_defender_for_azure_sql_databases_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_azure_sql_databases_is_on/defender_ensure_defender_for_azure_sql_databases_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_no_sql_databases(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_sql_databases_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_sql_databases_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_containers_is_on/defender_ensure_defender_for_containers_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_containers_is_on/defender_ensure_defender_for_containers_is_on_test.py
index 7ff728add9..02563454a5 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_containers_is_on/defender_ensure_defender_for_containers_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_containers_is_on/defender_ensure_defender_for_containers_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_no_container_registries(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_container_registries_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_container_registries_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_cosmosdb_is_on/defender_ensure_defender_for_cosmosdb_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_cosmosdb_is_on/defender_ensure_defender_for_cosmosdb_is_on_test.py
index 351f38d97f..a48b3678fe 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_cosmosdb_is_on/defender_ensure_defender_for_cosmosdb_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_cosmosdb_is_on/defender_ensure_defender_for_cosmosdb_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_no_cosmosdb(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_cosmosdb_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_cosmosdb_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_databases_is_on/defender_ensure_defender_for_databases_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_databases_is_on/defender_ensure_defender_for_databases_is_on_test.py
index 48cbc57ad1..8cde319553 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_databases_is_on/defender_ensure_defender_for_databases_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_databases_is_on/defender_ensure_defender_for_databases_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_no_databases(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_sql_servers(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -70,6 +72,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_sql_server_virtual_machines(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -103,6 +106,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_open_source_relation_databases(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -136,6 +140,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_cosmosdbs(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -169,6 +174,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_all_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -228,6 +234,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_cosmosdb_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_dns_is_on/defender_ensure_defender_for_dns_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_dns_is_on/defender_ensure_defender_for_dns_is_on_test.py
index 6b50ea4c5f..e41f6499d8 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_dns_is_on/defender_ensure_defender_for_dns_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_dns_is_on/defender_ensure_defender_for_dns_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_no_dns(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_dns_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_dns_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_keyvault_is_on/defender_ensure_defender_for_keyvault_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_keyvault_is_on/defender_ensure_defender_for_keyvault_is_on_test.py
index f587a92961..e32d7b6b24 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_keyvault_is_on/defender_ensure_defender_for_keyvault_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_keyvault_is_on/defender_ensure_defender_for_keyvault_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_no_keyvaults(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_keyvaults_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_keyvaults_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_os_relational_databases_is_on/defender_ensure_defender_for_os_relational_databases_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_os_relational_databases_is_on/defender_ensure_defender_for_os_relational_databases_is_on_test.py
index dc28fb3bb2..7d74712097 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_os_relational_databases_is_on/defender_ensure_defender_for_os_relational_databases_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_os_relational_databases_is_on/defender_ensure_defender_for_os_relational_databases_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_no_os_relational_databases(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_os_relational_databases_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -81,6 +83,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_os_relational_databases_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_server_is_on/defender_ensure_defender_for_server_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_server_is_on/defender_ensure_defender_for_server_is_on_test.py
index 226b26ad3a..d8d60d0507 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_server_is_on/defender_ensure_defender_for_server_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_server_is_on/defender_ensure_defender_for_server_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_server_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_server_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_server_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_sql_servers_is_on/defender_ensure_defender_for_sql_servers_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_sql_servers_is_on/defender_ensure_defender_for_sql_servers_is_on_test.py
index 1907cdbb6c..1f63aed4c8 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_sql_servers_is_on/defender_ensure_defender_for_sql_servers_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_sql_servers_is_on/defender_ensure_defender_for_sql_servers_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_for_storage_is_on/defender_ensure_defender_for_storage_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_for_storage_is_on/defender_ensure_defender_for_storage_is_on_test.py
index f5eee6879a..d534db195f 100644
--- a/tests/providers/azure/services/defender/defender_ensure_defender_for_storage_is_on/defender_ensure_defender_for_storage_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_for_storage_is_on/defender_ensure_defender_for_storage_is_on_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
@@ -78,6 +80,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on_test.py
index f4ac17c5ae..54b8f17f9a 100644
--- a/tests/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on_test.py
@@ -15,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {}
@@ -38,6 +39,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_no_iot_hub_solutions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.iot_security_solutions = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
@@ -69,6 +71,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_iot_hub_solution_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
@@ -106,6 +109,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_iot_hub_solution_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
@@ -145,6 +149,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
resource_id_enabled = str(uuid4())
resource_id_disabled = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_mcas_is_enabled/defender_ensure_mcas_is_enabled_test.py b/tests/providers/azure/services/defender/defender_ensure_mcas_is_enabled/defender_ensure_mcas_is_enabled_test.py
index 7770ab0baf..23abc7beb2 100644
--- a/tests/providers/azure/services/defender/defender_ensure_mcas_is_enabled/defender_ensure_mcas_is_enabled_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_mcas_is_enabled/defender_ensure_mcas_is_enabled_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_mcas_is_enabled:
def test_defender_no_settings(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -79,6 +81,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -120,6 +123,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_no_settings(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
diff --git a/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py b/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py
index 8d2a3a05f7..b5c3508016 100644
--- a/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py
@@ -16,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
@@ -40,6 +41,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_critical(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -87,6 +89,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_high(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -135,6 +138,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_low(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -182,6 +186,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_default_security_contact_not_found(self):
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_notify_emails_to_owners/defender_ensure_notify_emails_to_owners_test.py b/tests/providers/azure/services/defender/defender_ensure_notify_emails_to_owners/defender_ensure_notify_emails_to_owners_test.py
index b125320764..d95712806f 100644
--- a/tests/providers/azure/services/defender/defender_ensure_notify_emails_to_owners/defender_ensure_notify_emails_to_owners_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_notify_emails_to_owners/defender_ensure_notify_emails_to_owners_test.py
@@ -16,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_notify_emails_to_owners:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
@@ -40,6 +41,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_no_notify_emails_to_owners(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -80,6 +82,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_notify_emails_to_owners_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
@@ -127,6 +130,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_notify_emails_to_owners(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_system_updates_are_applied/defender_ensure_system_updates_are_applied_test.py b/tests/providers/azure/services/defender/defender_ensure_system_updates_are_applied/defender_ensure_system_updates_are_applied_test.py
index e6a80853dd..4d98db1939 100644
--- a/tests/providers/azure/services/defender/defender_ensure_system_updates_are_applied/defender_ensure_system_updates_are_applied_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_system_updates_are_applied/defender_ensure_system_updates_are_applied_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_system_updates_are_applied:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_system_updates_are_applied:
def test_defender_machines_no_log_analytics_installed(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -89,6 +91,7 @@ class Test_defender_ensure_system_updates_are_applied:
):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -139,6 +142,7 @@ class Test_defender_ensure_system_updates_are_applied:
def test_defender_machines_no_system_updates_installed(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -191,6 +195,7 @@ class Test_defender_ensure_system_updates_are_applied:
):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
diff --git a/tests/providers/azure/services/defender/defender_ensure_wdatp_is_enabled/defender_ensure_wdatp_is_enabled_test.py b/tests/providers/azure/services/defender/defender_ensure_wdatp_is_enabled/defender_ensure_wdatp_is_enabled_test.py
index 202e332b3f..2c045b6e49 100644
--- a/tests/providers/azure/services/defender/defender_ensure_wdatp_is_enabled/defender_ensure_wdatp_is_enabled_test.py
+++ b/tests/providers/azure/services/defender/defender_ensure_wdatp_is_enabled/defender_ensure_wdatp_is_enabled_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_wdatp_is_enabled:
def test_defender_no_settings(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {}
@@ -37,6 +38,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -79,6 +81,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
@@ -120,6 +123,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_no_settings(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
diff --git a/tests/providers/azure/services/defender/defender_service_test.py b/tests/providers/azure/services/defender/defender_service_test.py
index 4308467263..b50ddd26c9 100644
--- a/tests/providers/azure/services/defender/defender_service_test.py
+++ b/tests/providers/azure/services/defender/defender_service_test.py
@@ -1,5 +1,5 @@
from datetime import timedelta
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.defender.defender_service import (
Assesment,
@@ -13,6 +13,8 @@ from prowler.providers.azure.services.defender.defender_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -56,7 +58,7 @@ def mock_defender_get_assessments(_):
}
-def mock_defender_get_security_contacts(*args, **kwargs):
+def mock_defender_get_security_contacts(*_args, **_kwargs):
from prowler.providers.azure.services.defender.defender_service import (
NotificationsByRole,
)
@@ -358,3 +360,261 @@ class Test_Defender_Service_Assessments_None_Handling:
"Assessment Unhealthy"
]
assert assessment_unhealthy.status == "Unhealthy"
+
+
+DEFENDER_INIT_PATCHES = [
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_pricings",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_auto_provisioning_settings",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_assessments",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_settings",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_security_contacts",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_iot_security_solutions",
+ "prowler.providers.azure.services.defender.defender_service.Defender._get_jit_policies",
+]
+
+
+class Test_Defender_get_iot_security_solutions:
+ def test_get_iot_security_solutions_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.iot_security_solution.list_by_subscription.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = None
+
+ result = defender._get_iot_security_solutions()
+
+ mock_client.iot_security_solution.list_by_subscription.assert_called_once()
+ mock_client.iot_security_solution.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_iot_security_solutions_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.iot_security_solution.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = defender._get_iot_security_solutions()
+
+ mock_client.iot_security_solution.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.iot_security_solution.list_by_subscription.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_iot_security_solutions_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = defender._get_iot_security_solutions()
+
+ mock_client.iot_security_solution.list_by_resource_group.assert_not_called()
+ mock_client.iot_security_solution.list_by_subscription.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_iot_security_solutions_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.iot_security_solution.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = defender._get_iot_security_solutions()
+
+ assert mock_client.iot_security_solution.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_iot_security_solutions_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.iot_security_solution.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ defender._get_iot_security_solutions()
+
+ mock_client.iot_security_solution.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_Defender_get_jit_policies:
+ def test_get_jit_policies_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.jit_network_access_policies.list.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = None
+
+ result = defender._get_jit_policies()
+
+ mock_client.jit_network_access_policies.list.assert_called_once()
+ mock_client.jit_network_access_policies.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_jit_policies_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.jit_network_access_policies.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = defender._get_jit_policies()
+
+ mock_client.jit_network_access_policies.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.jit_network_access_policies.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_jit_policies_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = defender._get_jit_policies()
+
+ mock_client.jit_network_access_policies.list_by_resource_group.assert_not_called()
+ mock_client.jit_network_access_policies.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_jit_policies_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.jit_network_access_policies.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = defender._get_jit_policies()
+
+ assert (
+ mock_client.jit_network_access_policies.list_by_resource_group.call_count
+ == 2
+ )
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_jit_policies_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.jit_network_access_policies.list_by_resource_group.return_value = []
+
+ with (
+ patch(DEFENDER_INIT_PATCHES[0], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[1], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[2], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[3], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[4], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[5], return_value={}),
+ patch(DEFENDER_INIT_PATCHES[6], return_value={}),
+ ):
+ defender = Defender(set_mocked_azure_provider())
+
+ defender.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ defender.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ defender._get_jit_policies()
+
+ mock_client.jit_network_access_policies.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_admin_portals/entra_conditional_access_policy_require_mfa_for_admin_portals_test.py b/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_admin_portals/entra_conditional_access_policy_require_mfa_for_admin_portals_test.py
index 3909b80568..aa572cffb6 100644
--- a/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_admin_portals/entra_conditional_access_policy_require_mfa_for_admin_portals_test.py
+++ b/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_admin_portals/entra_conditional_access_policy_require_mfa_for_admin_portals_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_no_subscriptions(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_no_policies(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -61,6 +61,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_policy_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -105,6 +106,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_policy_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -149,6 +151,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_policy_mfa_disabled(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -193,6 +196,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_policy_mfa_no_target(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -237,6 +241,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_admin_portals:
def test_entra_tenant_policy_mfa_no_users(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_management_api/entra_conditional_access_policy_require_mfa_for_management_api_test.py b/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_management_api/entra_conditional_access_policy_require_mfa_for_management_api_test.py
index 3c880886ee..82362135a9 100644
--- a/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_management_api/entra_conditional_access_policy_require_mfa_for_management_api_test.py
+++ b/tests/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_management_api/entra_conditional_access_policy_require_mfa_for_management_api_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_no_subscriptions(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_no_policies(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -61,6 +61,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_policy_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -105,6 +106,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_policy_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -149,6 +151,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_policy_mfa_disabled(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -193,6 +196,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_policy_mfa_no_target(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
@@ -237,6 +241,7 @@ class Test_entra_conditional_access_policy_require_mfa_for_management_api:
def test_entra_tenant_policy_mfa_no_users(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
policy_id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_global_admin_in_less_than_five_users/entra_global_admin_in_less_than_five_users_test.py b/tests/providers/azure/services/entra/entra_global_admin_in_less_than_five_users/entra_global_admin_in_less_than_five_users_test.py
index 4820f13ad9..4270f485f3 100644
--- a/tests/providers/azure/services/entra/entra_global_admin_in_less_than_five_users/entra_global_admin_in_less_than_five_users_test.py
+++ b/tests/providers/azure/services/entra/entra_global_admin_in_less_than_five_users/entra_global_admin_in_less_than_five_users_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_global_admin_in_less_than_five_users:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -32,7 +32,7 @@ class Test_entra_global_admin_in_less_than_five_users:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,7 +57,7 @@ class Test_entra_global_admin_in_less_than_five_users:
def test_entra_less_than_five_global_admins(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -110,7 +110,7 @@ class Test_entra_global_admin_in_less_than_five_users:
def test_entra_more_than_five_global_admins(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -178,7 +178,7 @@ class Test_entra_global_admin_in_less_than_five_users:
def test_entra_exactly_five_global_admins(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_non_privileged_user_has_mfa/entra_non_privileged_user_has_mfa_test.py b/tests/providers/azure/services/entra/entra_non_privileged_user_has_mfa/entra_non_privileged_user_has_mfa_test.py
index 4d2f289a90..04d838a2c0 100644
--- a/tests/providers/azure/services/entra/entra_non_privileged_user_has_mfa/entra_non_privileged_user_has_mfa_test.py
+++ b/tests/providers/azure/services/entra/entra_non_privileged_user_has_mfa/entra_non_privileged_user_has_mfa_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_non_privileged_user_has_mfa:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_tenant_no_users(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -53,6 +53,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_user_no_privileged_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -100,6 +101,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_user_no_privileged_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -144,6 +146,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_disabled_user_no_privileged_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -184,6 +187,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_disabled_user_no_privileged_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -224,6 +228,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_user_privileged_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -265,6 +270,7 @@ class Test_entra_non_privileged_user_has_mfa:
def test_entra_user_privileged_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_policy_default_users_cannot_create_security_groups/entra_policy_default_users_cannot_create_security_groups_test.py b/tests/providers/azure/services/entra/entra_policy_default_users_cannot_create_security_groups/entra_policy_default_users_cannot_create_security_groups_test.py
index 603fae5863..df614a06e4 100644
--- a/tests/providers/azure/services/entra/entra_policy_default_users_cannot_create_security_groups/entra_policy_default_users_cannot_create_security_groups_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_default_users_cannot_create_security_groups/entra_policy_default_users_cannot_create_security_groups_test.py
@@ -7,6 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_default_users_cannot_create_security_groups:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.authorization_policy = {}
with (
@@ -29,6 +30,7 @@ class Test_entra_policy_default_users_cannot_create_security_groups:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -75,6 +77,7 @@ class Test_entra_policy_default_users_cannot_create_security_groups:
self,
):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -124,6 +127,7 @@ class Test_entra_policy_default_users_cannot_create_security_groups:
self,
):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_apps/entra_policy_ensure_default_user_cannot_create_apps_test.py b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_apps/entra_policy_ensure_default_user_cannot_create_apps_test.py
index d62941388c..5bfa9b2b4b 100644
--- a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_apps/entra_policy_ensure_default_user_cannot_create_apps_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_apps/entra_policy_ensure_default_user_cannot_create_apps_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_ensure_default_user_cannot_create_apps:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,6 +30,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -75,7 +76,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
def test_entra_default_user_role_permissions_not_allowed_to_create_apps(self):
id = str(uuid4())
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -122,7 +123,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
def test_entra_default_user_role_permissions_allowed_to_create_apps(self):
id = str(uuid4())
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py
index b9a678bc08..391c3f424f 100644
--- a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py
@@ -7,6 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_ensure_default_user_cannot_create_tenants:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.authorization_policy = {}
with (
@@ -29,6 +30,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
def test_entra_empty_tenant(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -74,7 +76,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self):
id = str(uuid4())
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -121,7 +123,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
def test_entra_default_user_role_permissions_allowed_to_create_tenants(self):
id = str(uuid4())
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_policy_guest_invite_only_for_admin_roles/entra_policy_guest_invite_only_for_admin_roles_test.py b/tests/providers/azure/services/entra/entra_policy_guest_invite_only_for_admin_roles/entra_policy_guest_invite_only_for_admin_roles_test.py
index a59c84b6b3..e844b900f1 100644
--- a/tests/providers/azure/services/entra/entra_policy_guest_invite_only_for_admin_roles/entra_policy_guest_invite_only_for_admin_roles_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_guest_invite_only_for_admin_roles/entra_policy_guest_invite_only_for_admin_roles_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_guest_invite_only_for_admin_roles:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,6 +30,7 @@ class Test_entra_policy_guest_invite_only_for_admin_roles:
def test_entra_empty_tenant(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -76,6 +77,7 @@ class Test_entra_policy_guest_invite_only_for_admin_roles:
def test_entra_tenant_policy_allow_invites_from_everyone(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -120,6 +122,7 @@ class Test_entra_policy_guest_invite_only_for_admin_roles:
def test_entra_tenant_policy_allow_invites_from_admins(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -164,6 +167,7 @@ class Test_entra_policy_guest_invite_only_for_admin_roles:
def test_entra_tenant_policy_allow_invites_from_none(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_policy_guest_users_access_restrictions/entra_policy_guest_users_access_restrictions_test.py b/tests/providers/azure/services/entra/entra_policy_guest_users_access_restrictions/entra_policy_guest_users_access_restrictions_test.py
index 4f70895846..9b7aecf053 100644
--- a/tests/providers/azure/services/entra/entra_policy_guest_users_access_restrictions/entra_policy_guest_users_access_restrictions_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_guest_users_access_restrictions/entra_policy_guest_users_access_restrictions_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_guest_users_access_restrictions:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,6 +30,7 @@ class Test_entra_policy_guest_users_access_restrictions:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -74,6 +75,7 @@ class Test_entra_policy_guest_users_access_restrictions:
def test_entra_tenant_policy_access_same_as_member(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -117,6 +119,7 @@ class Test_entra_policy_guest_users_access_restrictions:
def test_entra_tenant_policy_limited_access(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -160,6 +163,7 @@ class Test_entra_policy_guest_users_access_restrictions:
def test_entra_tenant_policy_access_restricted(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_policy_restricts_user_consent_for_apps/entra_policy_restricts_user_consent_for_apps_test.py b/tests/providers/azure/services/entra/entra_policy_restricts_user_consent_for_apps/entra_policy_restricts_user_consent_for_apps_test.py
index 36a03cab1d..bf4c43b2c2 100644
--- a/tests/providers/azure/services/entra/entra_policy_restricts_user_consent_for_apps/entra_policy_restricts_user_consent_for_apps_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_restricts_user_consent_for_apps/entra_policy_restricts_user_consent_for_apps_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_restricts_user_consent_for_apps:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,6 +30,7 @@ class Test_entra_policy_restricts_user_consent_for_apps:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
id = str(uuid4())
with (
@@ -74,7 +75,7 @@ class Test_entra_policy_restricts_user_consent_for_apps:
def test_entra_tenant_no_default_user_role_permissions(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -116,7 +117,7 @@ class Test_entra_policy_restricts_user_consent_for_apps:
def test_entra_tenant_no_consent(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -162,7 +163,7 @@ class Test_entra_policy_restricts_user_consent_for_apps:
def test_entra_tenant_legacy_consent(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_policy_user_consent_for_verified_apps/entra_policy_user_consent_for_verified_apps_test.py b/tests/providers/azure/services/entra/entra_policy_user_consent_for_verified_apps/entra_policy_user_consent_for_verified_apps_test.py
index 02bd0a2220..74dc98fd2a 100644
--- a/tests/providers/azure/services/entra/entra_policy_user_consent_for_verified_apps/entra_policy_user_consent_for_verified_apps_test.py
+++ b/tests/providers/azure/services/entra/entra_policy_user_consent_for_verified_apps/entra_policy_user_consent_for_verified_apps_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_policy_user_consent_for_verified_apps:
def test_entra_no_subscriptions(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_policy_user_consent_for_verified_apps:
def test_entra_tenant_no_consent(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -76,7 +76,7 @@ class Test_entra_policy_user_consent_for_verified_apps:
def test_entra_tenant_legacy_consent(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_privileged_user_has_mfa/entra_privileged_user_has_mfa_test.py b/tests/providers/azure/services/entra/entra_privileged_user_has_mfa/entra_privileged_user_has_mfa_test.py
index 31e0a57bff..3475baf592 100644
--- a/tests/providers/azure/services/entra/entra_privileged_user_has_mfa/entra_privileged_user_has_mfa_test.py
+++ b/tests/providers/azure/services/entra/entra_privileged_user_has_mfa/entra_privileged_user_has_mfa_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_privileged_user_has_mfa:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_privileged_user_has_mfa:
def test_entra_tenant_no_users(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -53,6 +53,7 @@ class Test_entra_privileged_user_has_mfa:
def test_entra_user_no_privileged_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -92,6 +93,7 @@ class Test_entra_privileged_user_has_mfa:
def test_entra_user_no_privileged_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -131,6 +133,7 @@ class Test_entra_privileged_user_has_mfa:
def test_entra_user_privileged_no_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
@@ -177,6 +180,7 @@ class Test_entra_privileged_user_has_mfa:
def test_entra_user_privileged_mfa(self):
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
user_id = str(uuid4())
with (
diff --git a/tests/providers/azure/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled_test.py b/tests/providers/azure/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled_test.py
index 562c008c52..11d6d8ff8e 100644
--- a/tests/providers/azure/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled_test.py
+++ b/tests/providers/azure/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled_test.py
@@ -7,7 +7,7 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provid
class Test_entra_security_defaults_enabled:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -30,7 +30,7 @@ class Test_entra_security_defaults_enabled:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -58,7 +58,7 @@ class Test_entra_security_defaults_enabled:
def test_entra_security_default_enabled(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -93,7 +93,7 @@ class Test_entra_security_defaults_enabled:
def test_entra_security_default_disabled(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_trusted_named_locations_exists/entra_trusted_named_locations_exists_test.py b/tests/providers/azure/services/entra/entra_trusted_named_locations_exists/entra_trusted_named_locations_exists_test.py
index 2af5c975cb..89a8ba7f07 100644
--- a/tests/providers/azure/services/entra/entra_trusted_named_locations_exists/entra_trusted_named_locations_exists_test.py
+++ b/tests/providers/azure/services/entra/entra_trusted_named_locations_exists/entra_trusted_named_locations_exists_test.py
@@ -10,7 +10,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_entra_trusted_named_locations_exists:
def test_entra_no_tenants(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -34,7 +34,7 @@ class Test_entra_trusted_named_locations_exists:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -67,7 +67,7 @@ class Test_entra_trusted_named_locations_exists:
def test_entra_named_location_with_ip_ranges(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -111,7 +111,7 @@ class Test_entra_trusted_named_locations_exists:
def test_entra_named_location_without_ip_ranges(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -156,7 +156,7 @@ class Test_entra_trusted_named_locations_exists:
def test_entra_new_named_location_with_ip_ranges_not_trusted(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/entra/entra_user_with_vm_access_has_mfa/entra_user_with_vm_access_has_mfa_test.py b/tests/providers/azure/services/entra/entra_user_with_vm_access_has_mfa/entra_user_with_vm_access_has_mfa_test.py
index 46dc9389af..83c06ea5b6 100644
--- a/tests/providers/azure/services/entra/entra_user_with_vm_access_has_mfa/entra_user_with_vm_access_has_mfa_test.py
+++ b/tests/providers/azure/services/entra/entra_user_with_vm_access_has_mfa/entra_user_with_vm_access_has_mfa_test.py
@@ -14,10 +14,11 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_iam_no_roles(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
-
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -41,9 +42,11 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
@@ -112,9 +115,11 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_mfa(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
@@ -183,9 +188,11 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_user(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
@@ -237,9 +244,11 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_role(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
+ entra_client.resource_groups = {}
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
diff --git a/tests/providers/azure/services/entra/entra_users_cannot_create_microsoft_365_groups/entra_users_cannot_create_microsoft_365_groups_test.py b/tests/providers/azure/services/entra/entra_users_cannot_create_microsoft_365_groups/entra_users_cannot_create_microsoft_365_groups_test.py
index ee82e9a07a..eb7269f6f2 100644
--- a/tests/providers/azure/services/entra/entra_users_cannot_create_microsoft_365_groups/entra_users_cannot_create_microsoft_365_groups_test.py
+++ b/tests/providers/azure/services/entra/entra_users_cannot_create_microsoft_365_groups/entra_users_cannot_create_microsoft_365_groups_test.py
@@ -11,7 +11,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_entra_users_cannot_create_microsoft_365_groups:
def test_entra_no_tenant(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -35,7 +35,7 @@ class Test_entra_users_cannot_create_microsoft_365_groups:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -65,7 +65,7 @@ class Test_entra_users_cannot_create_microsoft_365_groups:
def test_entra_users_cannot_create_microsoft_365_groups(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -114,7 +114,7 @@ class Test_entra_users_cannot_create_microsoft_365_groups:
def test_entra_users_can_create_microsoft_365_groups(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -161,7 +161,7 @@ class Test_entra_users_cannot_create_microsoft_365_groups:
def test_entra_users_can_create_microsoft_365_groups_no_setting(self):
entra_client = mock.MagicMock
-
+ entra_client.resource_groups = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
diff --git a/tests/providers/azure/services/iam/azure_iam_service_test.py b/tests/providers/azure/services/iam/azure_iam_service_test.py
new file mode 100644
index 0000000000..27004ae512
--- /dev/null
+++ b/tests/providers/azure/services/iam/azure_iam_service_test.py
@@ -0,0 +1,174 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.azure.services.iam.iam_service import IAM
+from tests.providers.azure.azure_fixtures import (
+ AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ set_mocked_azure_provider,
+)
+
+
+class Test_IAM_get_roles:
+ def test_get_roles_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.role_definitions.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = None
+
+ builtin, custom = iam._get_roles()
+
+ mock_client.role_definitions.list.assert_called_once_with(
+ scope=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
+ )
+ assert AZURE_SUBSCRIPTION_ID in builtin
+ assert AZURE_SUBSCRIPTION_ID in custom
+
+ def test_get_roles_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.role_definitions.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ builtin, custom = iam._get_roles()
+
+ mock_client.role_definitions.list.assert_called_once_with(
+ scope=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
+ )
+ assert AZURE_SUBSCRIPTION_ID in builtin
+ assert AZURE_SUBSCRIPTION_ID in custom
+
+ def test_get_roles_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.role_definitions.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ builtin, custom = iam._get_roles()
+
+ mock_client.role_definitions.list.assert_called_once_with(
+ scope=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
+ )
+ assert AZURE_SUBSCRIPTION_ID in builtin
+ assert AZURE_SUBSCRIPTION_ID in custom
+
+
+class Test_IAM_get_role_assignments:
+ def test_get_role_assignments_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.role_assignments = MagicMock()
+ mock_client.role_assignments.list_for_subscription.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = None
+
+ result = iam._get_role_assignments()
+
+ mock_client.role_assignments.list_for_subscription.assert_called_once_with(
+ filter="atScope()"
+ )
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_role_assignments_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.role_assignments = MagicMock()
+ mock_client.role_assignments.list_for_subscription.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = iam._get_role_assignments()
+
+ mock_client.role_assignments.list_for_subscription.assert_called_once_with(
+ filter="atScope()"
+ )
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_role_assignments_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.role_assignments = MagicMock()
+ mock_client.role_assignments.list_for_subscription.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_roles",
+ return_value=({}, {}),
+ ),
+ patch(
+ "prowler.providers.azure.services.iam.iam_service.IAM._get_role_assignments",
+ return_value={},
+ ),
+ ):
+ iam = IAM(set_mocked_azure_provider())
+
+ iam.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ iam.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = iam._get_role_assignments()
+
+ mock_client.role_assignments.list_for_subscription.assert_called_once_with(
+ filter="atScope()"
+ )
+ assert AZURE_SUBSCRIPTION_ID in result
diff --git a/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py b/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
index 5125130871..2d808c7102 100644
--- a/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
+++ b/tests/providers/azure/services/iam/iam_custom_role_has_permissions_to_administer_resource_locks/iam_custom_role_has_permissions_to_administer_resource_locks_test.py
@@ -14,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
def test_iam_no_roles(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {}
@@ -39,6 +40,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
@@ -95,6 +97,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
@@ -144,6 +147,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
role_name2 = "test-role2"
@@ -212,6 +216,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
def test_iam_custom_roles_empty_list_but_with_key(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {AZURE_SUBSCRIPTION_ID: {}}
diff --git a/tests/providers/azure/services/iam/iam_role_user_access_admin_restricted/iam_role_user_access_admin_restricted_test.py b/tests/providers/azure/services/iam/iam_role_user_access_admin_restricted/iam_role_user_access_admin_restricted_test.py
index 8ccf6e6f64..3ead279d6b 100644
--- a/tests/providers/azure/services/iam/iam_role_user_access_admin_restricted/iam_role_user_access_admin_restricted_test.py
+++ b/tests/providers/azure/services/iam/iam_role_user_access_admin_restricted/iam_role_user_access_admin_restricted_test.py
@@ -13,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_role_user_access_admin_restricted:
def test_iam_no_role_assignments(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
iam_client.role_assignments = {}
iam_client.roles = {}
@@ -37,6 +38,7 @@ class Test_iam_role_user_access_admin_restricted:
def test_iam_user_access_administrator_role_assigned(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
role_id = str(uuid4())
role_assignment_id = str(uuid4())
agent_id = str(uuid4())
@@ -97,6 +99,7 @@ class Test_iam_role_user_access_admin_restricted:
def test_iam_non_user_access_administrator_role_assigned(self):
iam_client = mock.MagicMock
+ iam_client.resource_groups = {}
role_id = str(uuid4())
role_assignment_id = str(uuid4())
agent_id = str(uuid4())
diff --git a/tests/providers/azure/services/iam/iam_subscription_roles_owner_custom_not_created/iam_subscription_roles_owner_custom_not_created_test.py b/tests/providers/azure/services/iam/iam_subscription_roles_owner_custom_not_created/iam_subscription_roles_owner_custom_not_created_test.py
index 1d2d37ee11..2687cb75a9 100644
--- a/tests/providers/azure/services/iam/iam_subscription_roles_owner_custom_not_created/iam_subscription_roles_owner_custom_not_created_test.py
+++ b/tests/providers/azure/services/iam/iam_subscription_roles_owner_custom_not_created/iam_subscription_roles_owner_custom_not_created_test.py
@@ -14,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_no_roles(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {}
@@ -37,6 +38,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_custom_owner_role_created_with_all(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
@@ -84,6 +86,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_custom_owner_role_created_with_no_permissions(self):
defender_client = mock.MagicMock
+ defender_client.resource_groups = {}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
diff --git a/tests/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled_test.py b/tests/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled_test.py
index 2fff845a7d..6050263af3 100644
--- a/tests/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled_test.py
+++ b/tests/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled_test.py
@@ -244,6 +244,158 @@ class Test_keyvault_logging_enabled:
assert result[0].resource_name == "name_keyvault"
assert result[0].resource_id == "id"
+ def test_diagnostic_setting_with_audit_event_category_logging(self):
+ keyvault_client = mock.MagicMock
+ keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=mock.MagicMock(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.keyvault.keyvault_logging_enabled.keyvault_logging_enabled.keyvault_client",
+ new=keyvault_client,
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_logging_enabled.keyvault_logging_enabled import (
+ keyvault_logging_enabled,
+ )
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVaultInfo,
+ )
+ from prowler.providers.azure.services.monitor.monitor_service import (
+ DiagnosticSetting,
+ )
+
+ keyvault_client.key_vaults = {
+ AZURE_SUBSCRIPTION_ID: [
+ KeyVaultInfo(
+ id="id",
+ name="name_keyvault",
+ location="westeurope",
+ resource_group="resource_group",
+ properties=VaultProperties(
+ tenant_id="tenantid",
+ sku="sku",
+ enable_rbac_authorization=False,
+ ),
+ keys=[],
+ secrets=[],
+ monitor_diagnostic_settings=[
+ DiagnosticSetting(
+ id="id/ds1",
+ logs=[
+ mock.MagicMock(
+ category_group=None,
+ category="AuditEvent",
+ enabled=True,
+ ),
+ mock.MagicMock(
+ category_group=None,
+ category="AzurePolicyEvaluationDetails",
+ enabled=False,
+ ),
+ ],
+ storage_account_name="sa1",
+ storage_account_id="sa_id1",
+ name="ds_audit_event",
+ ),
+ ],
+ ),
+ ]
+ }
+ check = keyvault_logging_enabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} has a diagnostic setting with audit logging."
+ )
+ assert result[0].resource_name == "name_keyvault"
+ assert result[0].resource_id == "id"
+
+ def test_diagnostic_setting_with_audit_event_category_disabled(self):
+ keyvault_client = mock.MagicMock
+ keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_azure_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=mock.MagicMock(),
+ ),
+ mock.patch(
+ "prowler.providers.azure.services.keyvault.keyvault_logging_enabled.keyvault_logging_enabled.keyvault_client",
+ new=keyvault_client,
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_logging_enabled.keyvault_logging_enabled import (
+ keyvault_logging_enabled,
+ )
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVaultInfo,
+ )
+ from prowler.providers.azure.services.monitor.monitor_service import (
+ DiagnosticSetting,
+ )
+
+ keyvault_client.key_vaults = {
+ AZURE_SUBSCRIPTION_ID: [
+ KeyVaultInfo(
+ id="id",
+ name="name_keyvault",
+ location="westeurope",
+ resource_group="resource_group",
+ properties=VaultProperties(
+ tenant_id="tenantid",
+ sku="sku",
+ enable_rbac_authorization=False,
+ ),
+ keys=[],
+ secrets=[],
+ monitor_diagnostic_settings=[
+ DiagnosticSetting(
+ id="id/ds1",
+ logs=[
+ mock.MagicMock(
+ category_group=None,
+ category="AuditEvent",
+ enabled=False,
+ ),
+ mock.MagicMock(
+ category_group=None,
+ category="AzurePolicyEvaluationDetails",
+ enabled=False,
+ ),
+ ],
+ storage_account_name="sa1",
+ storage_account_id="sa_id1",
+ name="ds_audit_event_disabled",
+ ),
+ ],
+ ),
+ ]
+ }
+ check = keyvault_logging_enabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a diagnostic setting with audit logging."
+ )
+ assert result[0].resource_name == "name_keyvault"
+ assert result[0].resource_id == "id"
+
def test_multiple_diagnostic_settings_one_compliant(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
diff --git a/tests/providers/azure/services/keyvault/keyvault_service_test.py b/tests/providers/azure/services/keyvault/keyvault_service_test.py
index f0a73d9081..e43b7a9fff 100644
--- a/tests/providers/azure/services/keyvault/keyvault_service_test.py
+++ b/tests/providers/azure/services/keyvault/keyvault_service_test.py
@@ -3,6 +3,8 @@ from unittest.mock import MagicMock, patch
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -263,3 +265,208 @@ class Test_keyvault_service:
.storage_account_name
== "storage_account_name"
)
+
+
+class Test_KeyVault_get_key_vaults:
+ def test_get_key_vaults_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_subscription.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.KeyVault._get_key_vaults",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVault,
+ )
+
+ keyvault = KeyVault(set_mocked_azure_provider())
+
+ keyvault.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ keyvault.resource_groups = None
+
+ provider = set_mocked_azure_provider()
+ with patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.monitor_client"
+ ):
+ result = keyvault._get_key_vaults(provider)
+
+ mock_client.vaults.list_by_subscription.assert_called_once()
+ mock_client.vaults.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_key_vaults_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.KeyVault._get_key_vaults",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVault,
+ )
+
+ keyvault = KeyVault(set_mocked_azure_provider())
+
+ keyvault.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ keyvault.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ provider = set_mocked_azure_provider()
+ with patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.monitor_client"
+ ):
+ result = keyvault._get_key_vaults(provider)
+
+ mock_client.vaults.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.vaults.list_by_subscription.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_key_vaults_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.KeyVault._get_key_vaults",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVault,
+ )
+
+ keyvault = KeyVault(set_mocked_azure_provider())
+
+ keyvault.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ keyvault.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ provider = set_mocked_azure_provider()
+ with patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.monitor_client"
+ ):
+ result = keyvault._get_key_vaults(provider)
+
+ mock_client.vaults.list_by_resource_group.assert_not_called()
+ mock_client.vaults.list_by_subscription.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_key_vaults_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.KeyVault._get_key_vaults",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVault,
+ )
+
+ keyvault = KeyVault(set_mocked_azure_provider())
+
+ keyvault.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ keyvault.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ provider = set_mocked_azure_provider()
+ with patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.monitor_client"
+ ):
+ result = keyvault._get_key_vaults(provider)
+
+ assert mock_client.vaults.list_by_resource_group.call_count == len(
+ RESOURCE_GROUP_LIST
+ )
+ mock_client.vaults.list_by_subscription.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_key_vaults_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = []
+
+ mock_provider = MagicMock()
+ mock_provider.identity = MagicMock()
+ with (
+ patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=mock_provider,
+ ),
+ patch(
+ "prowler.providers.azure.services.monitor.monitor_service.Monitor",
+ new=MagicMock(),
+ ),
+ patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.KeyVault._get_key_vaults",
+ return_value={},
+ ),
+ ):
+ from prowler.providers.azure.services.keyvault.keyvault_service import (
+ KeyVault,
+ )
+
+ keyvault = KeyVault(set_mocked_azure_provider())
+
+ keyvault.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ keyvault.resource_groups = {AZURE_SUBSCRIPTION_ID: ["MyRG"]}
+
+ provider = set_mocked_azure_provider()
+ with patch(
+ "prowler.providers.azure.services.keyvault.keyvault_service.monitor_client"
+ ):
+ keyvault._get_key_vaults(provider)
+
+ mock_client.vaults.list_by_resource_group.assert_called_once_with(
+ resource_group_name="MyRG"
+ )
diff --git a/tests/providers/azure/services/mysql/mysql_service_test.py b/tests/providers/azure/services/mysql/mysql_service_test.py
index 24364f175a..728e50610b 100644
--- a/tests/providers/azure/services/mysql/mysql_service_test.py
+++ b/tests/providers/azure/services/mysql/mysql_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.mysql.mysql_service import (
Configuration,
@@ -7,6 +7,8 @@ from prowler.providers.azure.services.mysql.mysql_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -117,3 +119,131 @@ class Test_MySQL_Service:
assert configurations["test"].resource_id == "/subscriptions/resource_id"
assert configurations["test"].description == "description"
assert configurations["test"].value == "value"
+
+
+class Test_MySQL_get_flexible_servers:
+ def test_get_flexible_servers_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_flexible_servers",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_configurations",
+ return_value={},
+ ),
+ ):
+ mysql = MySQL(set_mocked_azure_provider())
+
+ mysql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ mysql.resource_groups = None
+
+ result = mysql._get_flexible_servers()
+
+ mock_client.servers.list.assert_called_once()
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_flexible_servers",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_configurations",
+ return_value={},
+ ),
+ ):
+ mysql = MySQL(set_mocked_azure_provider())
+
+ mysql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ mysql.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = mysql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.servers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_flexible_servers",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_configurations",
+ return_value={},
+ ),
+ ):
+ mysql = MySQL(set_mocked_azure_provider())
+
+ mysql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ mysql.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = mysql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ mock_client.servers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_flexible_servers_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_flexible_servers",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_configurations",
+ return_value={},
+ ),
+ ):
+ mysql = MySQL(set_mocked_azure_provider())
+
+ mysql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ mysql.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = mysql._get_flexible_servers()
+
+ assert mock_client.servers.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_flexible_servers",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.mysql.mysql_service.MySQL._get_configurations",
+ return_value={},
+ ),
+ ):
+ mysql = MySQL(set_mocked_azure_provider())
+
+ mysql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ mysql.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ mysql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/network/network_service_test.py b/tests/providers/azure/services/network/network_service_test.py
index 8a0e72542f..3239666b44 100644
--- a/tests/providers/azure/services/network/network_service_test.py
+++ b/tests/providers/azure/services/network/network_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from azure.mgmt.network.models import FlowLog
@@ -8,9 +8,12 @@ from prowler.providers.azure.services.network.network_service import (
NetworkWatcher,
PublicIp,
SecurityGroup,
+ VirtualNetwork,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -66,6 +69,20 @@ def mock_network_get_public_ip_addresses(_):
}
+def mock_network_get_virtual_networks(_):
+ return {
+ AZURE_SUBSCRIPTION_ID: [
+ VirtualNetwork(
+ id="id",
+ name="name",
+ location="location",
+ enable_ddos_protection=False,
+ subnets=[],
+ )
+ ]
+ }
+
+
@patch(
"prowler.providers.azure.services.network.network_service.Network._get_security_groups",
new=mock_network_get_security_groups,
@@ -82,6 +99,10 @@ def mock_network_get_public_ip_addresses(_):
"prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
new=mock_network_get_public_ip_addresses,
)
+@patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+)
class Test_Network_Service:
def test_get_client(self):
network = Network(set_mocked_azure_provider())
@@ -162,3 +183,905 @@ class Test_Network_Service:
network.public_ip_addresses[AZURE_SUBSCRIPTION_ID][0].ip_address
== "ip_address"
)
+
+
+class Test_Network_get_security_groups:
+ def test_get_security_groups_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.network_security_groups.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = None
+
+ result = network._get_security_groups()
+
+ mock_client.network_security_groups.list_all.assert_called_once()
+ mock_client.network_security_groups.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_security_groups_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.network_security_groups.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = network._get_security_groups()
+
+ mock_client.network_security_groups.list.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.network_security_groups.list_all.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_security_groups_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = network._get_security_groups()
+
+ mock_client.network_security_groups.list.assert_not_called()
+ mock_client.network_security_groups.list_all.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_security_groups_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.network_security_groups = MagicMock()
+ mock_client.network_security_groups.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = network._get_security_groups()
+
+ assert mock_client.network_security_groups.list.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_security_groups_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.network_security_groups = MagicMock()
+ mock_client.network_security_groups.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ network._get_security_groups()
+
+ mock_client.network_security_groups.list.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_Network_get_network_watchers:
+ def test_get_network_watchers_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.network_watchers = MagicMock()
+ mock_client.network_watchers.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = None
+
+ result = network._get_network_watchers()
+
+ mock_client.network_watchers.list_all.assert_called_once()
+ mock_client.network_watchers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_network_watchers_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.network_watchers = MagicMock()
+ mock_client.network_watchers.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = network._get_network_watchers()
+
+ mock_client.network_watchers.list_all.assert_called_once()
+ mock_client.network_watchers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_network_watchers_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.network_watchers = MagicMock()
+ mock_client.network_watchers.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = network._get_network_watchers()
+
+ mock_client.network_watchers.list_all.assert_called_once()
+ mock_client.network_watchers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+
+class Test_Network_get_bastion_hosts:
+ def test_get_bastion_hosts_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.bastion_hosts = MagicMock()
+ mock_client.bastion_hosts.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = None
+
+ result = network._get_bastion_hosts()
+
+ mock_client.bastion_hosts.list.assert_called_once()
+ mock_client.bastion_hosts.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_bastion_hosts_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.bastion_hosts = MagicMock()
+ mock_client.bastion_hosts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = network._get_bastion_hosts()
+
+ mock_client.bastion_hosts.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.bastion_hosts.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_bastion_hosts_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.bastion_hosts = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = network._get_bastion_hosts()
+
+ mock_client.bastion_hosts.list_by_resource_group.assert_not_called()
+ mock_client.bastion_hosts.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+
+class Test_Network_get_public_ip_addresses:
+ def test_get_public_ip_addresses_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.public_ip_addresses = MagicMock()
+ mock_client.public_ip_addresses.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = None
+
+ result = network._get_public_ip_addresses()
+
+ mock_client.public_ip_addresses.list_all.assert_called_once()
+ mock_client.public_ip_addresses.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_public_ip_addresses_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.public_ip_addresses = MagicMock()
+ mock_client.public_ip_addresses.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = network._get_public_ip_addresses()
+
+ mock_client.public_ip_addresses.list.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.public_ip_addresses.list_all.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_public_ip_addresses_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.public_ip_addresses = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = network._get_public_ip_addresses()
+
+ mock_client.public_ip_addresses.list.assert_not_called()
+ mock_client.public_ip_addresses.list_all.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+
+class Test_Network_get_network_watchers_extra:
+ def test_get_network_watchers_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.network_watchers = MagicMock()
+ mock_client.network_watchers.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = network._get_network_watchers()
+
+ mock_client.network_watchers.list_all.assert_called_once()
+ mock_client.network_watchers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_network_watchers_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.network_watchers = MagicMock()
+ mock_client.network_watchers.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ network._get_network_watchers()
+
+ mock_client.network_watchers.list_all.assert_called_once()
+ mock_client.network_watchers.list.assert_not_called()
+
+
+class Test_Network_get_bastion_hosts_extra:
+ def test_get_bastion_hosts_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.bastion_hosts = MagicMock()
+ mock_client.bastion_hosts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = network._get_bastion_hosts()
+
+ assert mock_client.bastion_hosts.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_bastion_hosts_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.bastion_hosts = MagicMock()
+ mock_client.bastion_hosts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ network._get_bastion_hosts()
+
+ mock_client.bastion_hosts.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_Network_get_public_ip_addresses_extra:
+ def test_get_public_ip_addresses_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.public_ip_addresses = MagicMock()
+ mock_client.public_ip_addresses.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = network._get_public_ip_addresses()
+
+ assert mock_client.public_ip_addresses.list.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_public_ip_addresses_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.public_ip_addresses = MagicMock()
+ mock_client.public_ip_addresses.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ network._get_public_ip_addresses()
+
+ mock_client.public_ip_addresses.list.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_Network_get_virtual_networks_extra:
+ def _ctx(self):
+ return (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ )
+
+ def test_get_virtual_networks_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.virtual_networks = MagicMock()
+ mock_client.virtual_networks.list_all.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = None
+
+ result = network._get_virtual_networks()
+
+ mock_client.virtual_networks.list_all.assert_called_once()
+ mock_client.virtual_networks.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_networks_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.virtual_networks = MagicMock()
+ mock_client.virtual_networks.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = network._get_virtual_networks()
+
+ mock_client.virtual_networks.list.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.virtual_networks.list_all.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_networks_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.virtual_networks = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = network._get_virtual_networks()
+
+ mock_client.virtual_networks.list.assert_not_called()
+ mock_client.virtual_networks.list_all.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_virtual_networks_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.virtual_networks = MagicMock()
+ mock_client.virtual_networks.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = network._get_virtual_networks()
+
+ assert mock_client.virtual_networks.list.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_networks_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.virtual_networks = MagicMock()
+ mock_client.virtual_networks.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_security_groups",
+ new=mock_network_get_security_groups,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_bastion_hosts",
+ new=mock_network_get_bastion_hosts,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_network_watchers",
+ new=mock_network_get_network_watchers,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_public_ip_addresses",
+ new=mock_network_get_public_ip_addresses,
+ ),
+ patch(
+ "prowler.providers.azure.services.network.network_service.Network._get_virtual_networks",
+ new=mock_network_get_virtual_networks,
+ ),
+ ):
+ network = Network(set_mocked_azure_provider())
+
+ network.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ network.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ network._get_virtual_networks()
+
+ mock_client.virtual_networks.list.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/policy/policy_service_test.py b/tests/providers/azure/services/policy/policy_service_test.py
index 381ab82466..5a983d8610 100644
--- a/tests/providers/azure/services/policy/policy_service_test.py
+++ b/tests/providers/azure/services/policy/policy_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.policy.policy_service import (
Policy,
@@ -6,6 +6,8 @@ from prowler.providers.azure.services.policy.policy_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -52,3 +54,99 @@ class Test_Policy_Service:
policy.policy_assigments[AZURE_SUBSCRIPTION_ID]["policy-1"].enforcement_mode
== "Default"
)
+
+
+class Test_Policy_get_policy_assigments:
+ def test_get_policy_assigments_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.policy_assignments.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.policy.policy_service.Policy._get_policy_assigments",
+ return_value={},
+ ):
+ policy = Policy(set_mocked_azure_provider())
+
+ policy.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ policy.resource_groups = None
+
+ result = policy._get_policy_assigments()
+
+ mock_client.policy_assignments.list.assert_called_once()
+ mock_client.policy_assignments.list_for_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_policy_assigments_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.policy_assignments.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.policy.policy_service.Policy._get_policy_assigments",
+ return_value={},
+ ):
+ policy = Policy(set_mocked_azure_provider())
+
+ policy.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ policy.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = policy._get_policy_assigments()
+
+ mock_client.policy_assignments.list.assert_called_once()
+ mock_client.policy_assignments.list_for_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_policy_assigments_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.policy_assignments.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.policy.policy_service.Policy._get_policy_assigments",
+ return_value={},
+ ):
+ policy = Policy(set_mocked_azure_provider())
+
+ policy.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ policy.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = policy._get_policy_assigments()
+
+ mock_client.policy_assignments.list.assert_called_once()
+ mock_client.policy_assignments.list_for_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_policy_assigments_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.policy_assignments.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.policy.policy_service.Policy._get_policy_assigments",
+ return_value={},
+ ):
+ policy = Policy(set_mocked_azure_provider())
+
+ policy.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ policy.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = policy._get_policy_assigments()
+
+ mock_client.policy_assignments.list.assert_called_once()
+ mock_client.policy_assignments.list_for_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_policy_assigments_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.policy_assignments.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.policy.policy_service.Policy._get_policy_assigments",
+ return_value={},
+ ):
+ policy = Policy(set_mocked_azure_provider())
+
+ policy.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ policy.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ policy._get_policy_assigments()
+
+ mock_client.policy_assignments.list.assert_called_once()
+ mock_client.policy_assignments.list_for_resource_group.assert_not_called()
diff --git a/tests/providers/azure/services/postgresql/postgresql_service_test.py b/tests/providers/azure/services/postgresql/postgresql_service_test.py
index c0b8bca6c4..2e002bcfde 100644
--- a/tests/providers/azure/services/postgresql/postgresql_service_test.py
+++ b/tests/providers/azure/services/postgresql/postgresql_service_test.py
@@ -1,5 +1,8 @@
from unittest.mock import MagicMock, patch
+import pytest
+from azure.core.exceptions import HttpResponseError, ResourceNotFoundError
+
from prowler.providers.azure.services.postgresql.postgresql_service import (
EntraIdAdmin,
Firewall,
@@ -8,6 +11,8 @@ from prowler.providers.azure.services.postgresql.postgresql_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -116,12 +121,13 @@ class Test_SqlServer_Service:
)
def test_get_connection_throttling_missing_parameter_returns_none(self):
- # PostgreSQL v18 removed the "connection_throttle.enable" parameter; the
- # service must degrade gracefully (quiet None) instead of raising and
+ # PostgreSQL v18 removed the "connection_throttle.enable" parameter; when
+ # it is genuinely absent the Azure SDK raises ResourceNotFoundError, and
+ # the service treats that as "not enabled" (quiet None) instead of
# aborting the whole subscription's server inventory.
postgresql = PostgreSQL(set_mocked_azure_provider())
mock_client = MagicMock()
- mock_client.configurations.get.side_effect = Exception(
+ mock_client.configurations.get.side_effect = ResourceNotFoundError(
"The configuration 'connection_throttle.enable' does not exist for "
"server version 18."
)
@@ -135,23 +141,22 @@ class Test_SqlServer_Service:
assert result is None
mock_logger.error.assert_not_called()
- def test_get_connection_throttling_unexpected_error_logs_error(self):
+ def test_get_connection_throttling_unexpected_error_propagates(self):
# Any other failure (permissions, throttling, transient API errors) must
- # still be logged as an error, while keeping the scan resilient (None).
+ # NOT be swallowed into None: that would make the downstream check report
+ # the server as having throttling disabled, hiding a collection failure
+ # as a security finding. The error propagates so the per-server handler
+ # in _get_flexible_servers can record it as a collection failure.
postgresql = PostgreSQL(set_mocked_azure_provider())
mock_client = MagicMock()
- mock_client.configurations.get.side_effect = Exception(
- "Some unexpected failure"
+ mock_client.configurations.get.side_effect = HttpResponseError(
+ "(AuthorizationFailed) permission denied"
)
postgresql.clients[AZURE_SUBSCRIPTION_ID] = mock_client
- with patch(
- "prowler.providers.azure.services.postgresql.postgresql_service.logger"
- ) as mock_logger:
- result = postgresql._get_connection_throttling(
+ with pytest.raises(HttpResponseError):
+ postgresql._get_connection_throttling(
AZURE_SUBSCRIPTION_ID, "resource_group", "server_name"
)
- assert result is None
- mock_logger.error.assert_called_once()
def test_get_log_retention_days(self):
postgesql = PostgreSQL(set_mocked_azure_provider())
@@ -238,3 +243,259 @@ class Test_SqlServer_Service:
postgesql.flexible_servers[AZURE_SUBSCRIPTION_ID][0].firewall[0].end_ip
== "end_ip"
)
+
+
+class Test_PostgreSQL_get_flexible_servers:
+ def test_get_flexible_servers_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.postgresql.postgresql_service.PostgreSQL._get_flexible_servers",
+ return_value={},
+ ):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ postgresql.resource_groups = None
+
+ result = postgresql._get_flexible_servers()
+
+ mock_client.servers.list.assert_called_once()
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.postgresql.postgresql_service.PostgreSQL._get_flexible_servers",
+ return_value={},
+ ):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ postgresql.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = postgresql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.servers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.postgresql.postgresql_service.PostgreSQL._get_flexible_servers",
+ return_value={},
+ ):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ postgresql.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = postgresql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ mock_client.servers.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_flexible_servers_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.postgresql.postgresql_service.PostgreSQL._get_flexible_servers",
+ return_value={},
+ ):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ postgresql.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = postgresql._get_flexible_servers()
+
+ assert mock_client.servers.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_flexible_servers_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.postgresql.postgresql_service.PostgreSQL._get_flexible_servers",
+ return_value={},
+ ):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ postgresql.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ postgresql._get_flexible_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+def _make_server(name):
+ server = MagicMock()
+ server.id = (
+ f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg/providers/"
+ f"Microsoft.DBforPostgreSQL/flexibleServers/{name}"
+ )
+ server.name = name
+ return server
+
+
+class Test_PostgreSQL_Service_Resilience:
+ """Collecting one flexible server must never abort collection of the rest of
+ the subscription (regression: a missing/failing per-server configuration
+ lookup silently dropped every remaining server)."""
+
+ def _build_service_with_client(self, mock_client):
+ # Skip the real network call during construction, then run the real
+ # collection against the mocked management client.
+ with patch.object(PostgreSQL, "_get_flexible_servers", return_value={}):
+ postgresql = PostgreSQL(set_mocked_azure_provider())
+ postgresql.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ return postgresql
+
+ def test_missing_connection_throttle_config_still_collects_server(self):
+ # The "connection_throttle.enable" parameter was removed in PostgreSQL
+ # 16+, so the lookup raises ConfigurationNotExists on newer servers.
+ dev = _make_server("dev")
+ prd = _make_server("prd")
+
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = [dev, prd]
+ server_details = MagicMock()
+ server_details.location = "westeurope"
+ mock_client.servers.get.return_value = server_details
+ mock_client.administrators.list_by_server.return_value = []
+ mock_client.firewall_rules.list_by_server.return_value = []
+
+ def configurations_get(resource_group, server_name, key):
+ if key == "connection_throttle.enable" and server_name == "prd":
+ # Azure raises ResourceNotFoundError (ConfigurationNotExists)
+ # when the parameter does not exist on the server.
+ raise ResourceNotFoundError(
+ "(ConfigurationNotExists) The configuration "
+ "'connection_throttle.enable' does not exist for prd server "
+ "version 18."
+ )
+ return MagicMock(value="ON")
+
+ mock_client.configurations.get.side_effect = configurations_get
+
+ postgresql = self._build_service_with_client(mock_client)
+ servers = postgresql._get_flexible_servers()
+
+ names = sorted(server.name for server in servers[AZURE_SUBSCRIPTION_ID])
+ assert names == ["dev", "prd"]
+ prd_server = next(s for s in servers[AZURE_SUBSCRIPTION_ID] if s.name == "prd")
+ assert prd_server.connection_throttling is None
+ dev_server = next(s for s in servers[AZURE_SUBSCRIPTION_ID] if s.name == "dev")
+ assert dev_server.connection_throttling == "ON"
+
+ def test_log_retention_reads_flexible_server_parameter_name(self):
+ # Azure Flexible Server exposes log retention under the parameter
+ # "logfiles.retention_days". The legacy Single Server name
+ # "log_retention_days" does not exist on Flexible Server (Azure raises
+ # ConfigurationNotExists), which previously left log_retention_days=None
+ # and made postgresql_flexible_server_log_retention_days_greater_3 always
+ # FAIL. Regression test for #11757.
+ dev = _make_server("dev")
+
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = [dev]
+ server_details = MagicMock()
+ server_details.location = "westeurope"
+ mock_client.servers.get.return_value = server_details
+ mock_client.administrators.list_by_server.return_value = []
+ mock_client.firewall_rules.list_by_server.return_value = []
+
+ def configurations_get(resource_group, server_name, key):
+ if key == "log_retention_days":
+ raise ResourceNotFoundError(
+ "(ConfigurationNotExists) The configuration "
+ "'log_retention_days' does not exist for dev server "
+ "version 18."
+ )
+ if key == "logfiles.retention_days":
+ return MagicMock(value="5")
+ return MagicMock(value="ON")
+
+ mock_client.configurations.get.side_effect = configurations_get
+
+ postgresql = self._build_service_with_client(mock_client)
+ servers = postgresql._get_flexible_servers()
+
+ dev_server = servers[AZURE_SUBSCRIPTION_ID][0]
+ assert dev_server.log_retention_days == "5"
+
+ def test_unexpected_throttling_error_is_not_silently_collected(self):
+ # An unexpected failure reading "connection_throttle.enable" (e.g. a
+ # permission, throttling, or transient SDK error) must NOT be turned
+ # into connection_throttling=None: that would make the downstream check
+ # report the server as having throttling disabled, hiding a collection
+ # failure as a security finding. Only ResourceNotFoundError (the
+ # parameter genuinely missing) is treated as "not enabled"; anything
+ # else isolates to that server, which is dropped rather than fabricated.
+ ok = _make_server("ok")
+ denied = _make_server("denied")
+
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = [ok, denied]
+ server_details = MagicMock()
+ server_details.location = "westeurope"
+ mock_client.servers.get.return_value = server_details
+ mock_client.administrators.list_by_server.return_value = []
+ mock_client.firewall_rules.list_by_server.return_value = []
+
+ def configurations_get(resource_group, server_name, key):
+ if key == "connection_throttle.enable" and server_name == "denied":
+ raise HttpResponseError("(AuthorizationFailed) permission denied")
+ return MagicMock(value="ON")
+
+ mock_client.configurations.get.side_effect = configurations_get
+
+ postgresql = self._build_service_with_client(mock_client)
+ servers = postgresql._get_flexible_servers()
+
+ collected = servers[AZURE_SUBSCRIPTION_ID]
+ # The server whose throttling lookup failed unexpectedly is dropped,
+ # not collected with a fabricated connection_throttling=None.
+ assert [server.name for server in collected] == ["ok"]
+ assert all(server.connection_throttling is not None for server in collected)
+
+ def test_one_server_hard_failure_does_not_drop_others(self):
+ # A failure unrelated to a guarded getter (here, fetching the server
+ # details) must isolate to that server, not the whole subscription.
+ ok = _make_server("ok")
+ broken = _make_server("broken")
+
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = [broken, ok]
+ mock_client.administrators.list_by_server.return_value = []
+ mock_client.firewall_rules.list_by_server.return_value = []
+ mock_client.configurations.get.return_value = MagicMock(value="ON")
+
+ def servers_get(resource_group, server_name):
+ if server_name == "broken":
+ raise Exception("boom: transient failure fetching server details")
+ details = MagicMock()
+ details.location = "westeurope"
+ return details
+
+ mock_client.servers.get.side_effect = servers_get
+
+ postgresql = self._build_service_with_client(mock_client)
+ servers = postgresql._get_flexible_servers()
+
+ names = [server.name for server in servers[AZURE_SUBSCRIPTION_ID]]
+ assert names == ["ok"]
diff --git a/tests/providers/azure/services/recovery/recovery_service_test.py b/tests/providers/azure/services/recovery/recovery_service_test.py
index 93dcad1e38..96c358b7d2 100644
--- a/tests/providers/azure/services/recovery/recovery_service_test.py
+++ b/tests/providers/azure/services/recovery/recovery_service_test.py
@@ -1,11 +1,18 @@
from types import SimpleNamespace
from unittest import mock
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.recovery.recovery_service import (
BackupVault,
+ Recovery,
RecoveryBackup,
)
-from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION_ID
+from tests.providers.azure.azure_fixtures import (
+ AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
+ set_mocked_azure_provider,
+)
VAULT_ID = (
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/"
@@ -20,6 +27,139 @@ class BackupClientFake:
self.backup_policies.list.return_value = policies
+class Test_Recovery_get_vaults:
+ def test_get_vaults_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_subscription_id.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.Recovery._get_vaults",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.RecoveryBackup",
+ ),
+ ):
+ recovery = Recovery(set_mocked_azure_provider())
+
+ recovery.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ recovery.resource_groups = None
+
+ result = recovery._get_vaults()
+
+ mock_client.vaults.list_by_subscription_id.assert_called_once()
+ mock_client.vaults.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_vaults_with_resource_group(self):
+ mock_vault = MagicMock()
+ mock_vault.id = "vault-id-1"
+ mock_vault.name = "my-vault"
+ mock_vault.location = "eastus"
+
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = [mock_vault]
+
+ with (
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.Recovery._get_vaults",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.RecoveryBackup",
+ ),
+ ):
+ recovery = Recovery(set_mocked_azure_provider())
+
+ recovery.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ recovery.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = recovery._get_vaults()
+
+ mock_client.vaults.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.vaults.list_by_subscription_id.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+ assert "vault-id-1" in result[AZURE_SUBSCRIPTION_ID]
+
+ def test_get_vaults_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.Recovery._get_vaults",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.RecoveryBackup",
+ ),
+ ):
+ recovery = Recovery(set_mocked_azure_provider())
+
+ recovery.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ recovery.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = recovery._get_vaults()
+
+ mock_client.vaults.list_by_resource_group.assert_not_called()
+ mock_client.vaults.list_by_subscription_id.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_vaults_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.Recovery._get_vaults",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.RecoveryBackup",
+ ),
+ ):
+ recovery = Recovery(set_mocked_azure_provider())
+
+ recovery.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ recovery.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = recovery._get_vaults()
+
+ assert mock_client.vaults.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_vaults_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.vaults = MagicMock()
+ mock_client.vaults.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.Recovery._get_vaults",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.recovery.recovery_service.RecoveryBackup",
+ ),
+ ):
+ recovery = Recovery(set_mocked_azure_provider())
+
+ recovery.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ recovery.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ recovery._get_vaults()
+
+ mock_client.vaults.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
class Test_RecoveryBackup_Service:
def test_get_backup_policies_lists_unprotected_vault_policies(self):
policy = SimpleNamespace(
diff --git a/tests/providers/azure/services/sqlserver/sqlserver_service_test.py b/tests/providers/azure/services/sqlserver/sqlserver_service_test.py
index 4fc4f073fe..7da2fe8b58 100644
--- a/tests/providers/azure/services/sqlserver/sqlserver_service_test.py
+++ b/tests/providers/azure/services/sqlserver/sqlserver_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from azure.mgmt.sql.models import (
EncryptionProtector,
@@ -16,6 +16,8 @@ from prowler.providers.azure.services.sqlserver.sqlserver_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -245,3 +247,100 @@ class Test_SqlServer_Service:
].security_alert_policies.state
== "Disabled"
)
+
+
+class Test_SQLServer_get_sql_servers:
+ def test_get_sql_servers_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.sqlserver.sqlserver_service.SQLServer._get_sql_servers",
+ return_value={},
+ ):
+ sql_server = SQLServer(set_mocked_azure_provider())
+
+ sql_server.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ sql_server.resource_groups = None
+
+ result = sql_server._get_sql_servers()
+
+ mock_client.servers.list.assert_called_once()
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_sql_servers_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.sqlserver.sqlserver_service.SQLServer._get_sql_servers",
+ return_value={},
+ ):
+ sql_server = SQLServer(set_mocked_azure_provider())
+
+ sql_server.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ sql_server.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = sql_server._get_sql_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.servers.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_sql_servers_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+
+ with patch(
+ "prowler.providers.azure.services.sqlserver.sqlserver_service.SQLServer._get_sql_servers",
+ return_value={},
+ ):
+ sql_server = SQLServer(set_mocked_azure_provider())
+
+ sql_server.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ sql_server.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = sql_server._get_sql_servers()
+
+ mock_client.servers.list_by_resource_group.assert_not_called()
+ mock_client.servers.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_sql_servers_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.sqlserver.sqlserver_service.SQLServer._get_sql_servers",
+ return_value={},
+ ):
+ sql_server = SQLServer(set_mocked_azure_provider())
+
+ sql_server.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ sql_server.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = sql_server._get_sql_servers()
+
+ assert mock_client.servers.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_sql_servers_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.servers.list_by_resource_group.return_value = []
+
+ with patch(
+ "prowler.providers.azure.services.sqlserver.sqlserver_service.SQLServer._get_sql_servers",
+ return_value={},
+ ):
+ sql_server = SQLServer(set_mocked_azure_provider())
+
+ sql_server.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ sql_server.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ sql_server._get_sql_servers()
+
+ mock_client.servers.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/storage/storage_service_test.py b/tests/providers/azure/services/storage/storage_service_test.py
index 67fba33877..563b1b6a21 100644
--- a/tests/providers/azure/services/storage/storage_service_test.py
+++ b/tests/providers/azure/services/storage/storage_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
from prowler.providers.azure.services.storage.storage_service import (
Account,
@@ -11,6 +11,8 @@ from prowler.providers.azure.services.storage.storage_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -387,3 +389,155 @@ class Test_Storage_Service_Retention_Policy_None_Handling:
is False
)
assert account.file_service_properties.share_delete_retention_policy.days == 0
+
+
+class Test_Storage_get_storage_accounts:
+ def test_get_storage_accounts_no_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.storage_accounts = MagicMock()
+ mock_client.storage_accounts.list.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_storage_accounts",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_blob_properties",
+ return_value=None,
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_file_share_properties",
+ return_value=None,
+ ),
+ ):
+ storage = Storage(set_mocked_azure_provider())
+
+ storage.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ storage.resource_groups = None
+
+ result = storage._get_storage_accounts()
+
+ mock_client.storage_accounts.list.assert_called_once()
+ mock_client.storage_accounts.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_storage_accounts_with_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.storage_accounts = MagicMock()
+ mock_client.storage_accounts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_storage_accounts",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_blob_properties",
+ return_value=None,
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_file_share_properties",
+ return_value=None,
+ ),
+ ):
+ storage = Storage(set_mocked_azure_provider())
+
+ storage.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ storage.resource_groups = {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+
+ result = storage._get_storage_accounts()
+
+ mock_client.storage_accounts.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.storage_accounts.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_storage_accounts_empty_resource_group_for_subscription(self):
+ mock_client = MagicMock()
+ mock_client.storage_accounts = MagicMock()
+
+ with (
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_storage_accounts",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_blob_properties",
+ return_value=None,
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_file_share_properties",
+ return_value=None,
+ ),
+ ):
+ storage = Storage(set_mocked_azure_provider())
+
+ storage.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ storage.resource_groups = {AZURE_SUBSCRIPTION_ID: []}
+
+ result = storage._get_storage_accounts()
+
+ mock_client.storage_accounts.list_by_resource_group.assert_not_called()
+ mock_client.storage_accounts.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == []
+
+ def test_get_storage_accounts_with_multiple_resource_groups(self):
+ mock_client = MagicMock()
+ mock_client.storage_accounts = MagicMock()
+ mock_client.storage_accounts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_storage_accounts",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_blob_properties",
+ return_value=None,
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_file_share_properties",
+ return_value=None,
+ ),
+ ):
+ storage = Storage(set_mocked_azure_provider())
+
+ storage.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ storage.resource_groups = {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+
+ result = storage._get_storage_accounts()
+
+ assert mock_client.storage_accounts.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_storage_accounts_with_mixed_case_resource_group(self):
+ mock_client = MagicMock()
+ mock_client.storage_accounts = MagicMock()
+ mock_client.storage_accounts.list_by_resource_group.return_value = []
+
+ with (
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_storage_accounts",
+ return_value={},
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_blob_properties",
+ return_value=None,
+ ),
+ patch(
+ "prowler.providers.azure.services.storage.storage_service.Storage._get_file_share_properties",
+ return_value=None,
+ ),
+ ):
+ storage = Storage(set_mocked_azure_provider())
+
+ storage.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ storage.resource_groups = {AZURE_SUBSCRIPTION_ID: ["RG"]}
+
+ storage._get_storage_accounts()
+
+ mock_client.storage_accounts.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/azure/services/vm/vm_service_test.py b/tests/providers/azure/services/vm/vm_service_test.py
index 49b8045cf8..b6bb583fbf 100644
--- a/tests/providers/azure/services/vm/vm_service_test.py
+++ b/tests/providers/azure/services/vm/vm_service_test.py
@@ -1,5 +1,7 @@
from unittest.mock import MagicMock, patch
+import pytest
+
from prowler.providers.azure.services.vm.vm_service import (
Disk,
LinuxConfiguration,
@@ -14,6 +16,8 @@ from prowler.providers.azure.services.vm.vm_service import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
+ RESOURCE_GROUP,
+ RESOURCE_GROUP_LIST,
set_mocked_azure_provider,
)
@@ -110,6 +114,23 @@ def mock_vm_get_virtual_machines_with_linux(_):
}
+@pytest.fixture
+def vm_service_factory():
+ def _build(mock_client, resource_groups):
+ with (
+ patch.object(VirtualMachines, "_get_virtual_machines", return_value={}),
+ patch.object(VirtualMachines, "_get_disks", return_value={}),
+ patch.object(VirtualMachines, "_get_vm_scale_sets", return_value={}),
+ ):
+ vm_service = VirtualMachines(set_mocked_azure_provider())
+
+ vm_service.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+ vm_service.resource_groups = resource_groups
+ return vm_service
+
+ return _build
+
+
@patch(
"prowler.providers.azure.services.vm.vm_service.VirtualMachines._get_virtual_machines",
new=mock_vm_get_virtual_machines,
@@ -401,7 +422,7 @@ class Test_VirtualMachine_SecurityProfile_Validation:
This tests the actual scenario where Azure SDK objects are converted
"""
- def mock_list_vms(*args, **kwargs):
+ def mock_list_vms(*_args, **_kwargs):
# Simulate Azure SDK VM object with security_profile
mock_vm = MagicMock()
mock_vm.id = "/subscriptions/test/resourceGroups/test-rg/providers/Microsoft.Compute/virtualMachines/test-vm"
@@ -465,3 +486,228 @@ class Test_VirtualMachine_SecurityProfile_Validation:
assert isinstance(vm.security_profile.uefi_settings, UefiSettings)
assert vm.security_profile.uefi_settings.secure_boot_enabled is True
assert vm.security_profile.uefi_settings.v_tpm_enabled is True
+
+
+class Test_VM_get_virtual_machines:
+ def test_get_virtual_machines_no_resource_groups(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machines = MagicMock()
+ mock_client.virtual_machines.list_all.return_value = []
+
+ vm_service = vm_service_factory(mock_client, None)
+
+ result = vm_service._get_virtual_machines()
+
+ mock_client.virtual_machines.list_all.assert_called_once()
+ mock_client.virtual_machines.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_machines_with_resource_group(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machines = MagicMock()
+ mock_client.virtual_machines.list.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+ )
+
+ result = vm_service._get_virtual_machines()
+
+ mock_client.virtual_machines.list.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.virtual_machines.list_all.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_machines_empty_resource_group_for_subscription(
+ self, vm_service_factory
+ ):
+ mock_client = MagicMock()
+ mock_client.virtual_machines = MagicMock()
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: []})
+
+ result = vm_service._get_virtual_machines()
+
+ mock_client.virtual_machines.list.assert_not_called()
+ mock_client.virtual_machines.list_all.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+ def test_get_virtual_machines_with_multiple_resource_groups(
+ self, vm_service_factory
+ ):
+ mock_client = MagicMock()
+ mock_client.virtual_machines = MagicMock()
+ mock_client.virtual_machines.list.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+ )
+
+ result = vm_service._get_virtual_machines()
+
+ assert mock_client.virtual_machines.list.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_virtual_machines_with_mixed_case_resource_group(
+ self, vm_service_factory
+ ):
+ mock_client = MagicMock()
+ mock_client.virtual_machines = MagicMock()
+ mock_client.virtual_machines.list.return_value = []
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: ["RG"]})
+
+ vm_service._get_virtual_machines()
+
+ mock_client.virtual_machines.list.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_VM_get_disks:
+ def test_get_disks_no_resource_groups(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.disks = MagicMock()
+ mock_client.disks.list.return_value = []
+
+ vm_service = vm_service_factory(mock_client, None)
+
+ result = vm_service._get_disks()
+
+ mock_client.disks.list.assert_called_once()
+ mock_client.disks.list_by_resource_group.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_disks_with_resource_group(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.disks = MagicMock()
+ mock_client.disks.list_by_resource_group.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+ )
+
+ result = vm_service._get_disks()
+
+ mock_client.disks.list_by_resource_group.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.disks.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_disks_empty_resource_group_for_subscription(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.disks = MagicMock()
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: []})
+
+ result = vm_service._get_disks()
+
+ mock_client.disks.list_by_resource_group.assert_not_called()
+ mock_client.disks.list.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+
+class Test_VM_get_vm_scale_sets:
+ def test_get_vm_scale_sets_no_resource_groups(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machine_scale_sets = MagicMock()
+ mock_client.virtual_machine_scale_sets.list_all.return_value = []
+
+ vm_service = vm_service_factory(mock_client, None)
+
+ result = vm_service._get_vm_scale_sets()
+
+ mock_client.virtual_machine_scale_sets.list_all.assert_called_once()
+ mock_client.virtual_machine_scale_sets.list.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_vm_scale_sets_with_resource_group(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machine_scale_sets = MagicMock()
+ mock_client.virtual_machine_scale_sets.list.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: [RESOURCE_GROUP]}
+ )
+
+ result = vm_service._get_vm_scale_sets()
+
+ mock_client.virtual_machine_scale_sets.list.assert_called_once_with(
+ resource_group_name=RESOURCE_GROUP
+ )
+ mock_client.virtual_machine_scale_sets.list_all.assert_not_called()
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_vm_scale_sets_empty_resource_group_for_subscription(
+ self, vm_service_factory
+ ):
+ mock_client = MagicMock()
+ mock_client.virtual_machine_scale_sets = MagicMock()
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: []})
+
+ result = vm_service._get_vm_scale_sets()
+
+ mock_client.virtual_machine_scale_sets.list.assert_not_called()
+ mock_client.virtual_machine_scale_sets.list_all.assert_not_called()
+ assert result[AZURE_SUBSCRIPTION_ID] == {}
+
+
+class Test_VM_get_disks_extra:
+ def test_get_disks_with_multiple_resource_groups(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.disks = MagicMock()
+ mock_client.disks.list_by_resource_group.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+ )
+
+ result = vm_service._get_disks()
+
+ assert mock_client.disks.list_by_resource_group.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_disks_with_mixed_case_resource_group(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.disks = MagicMock()
+ mock_client.disks.list_by_resource_group.return_value = []
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: ["RG"]})
+
+ vm_service._get_disks()
+
+ mock_client.disks.list_by_resource_group.assert_called_once_with(
+ resource_group_name="RG"
+ )
+
+
+class Test_VM_get_vm_scale_sets_extra:
+ def test_get_vm_scale_sets_with_multiple_resource_groups(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machine_scale_sets = MagicMock()
+ mock_client.virtual_machine_scale_sets.list.return_value = []
+
+ vm_service = vm_service_factory(
+ mock_client, {AZURE_SUBSCRIPTION_ID: RESOURCE_GROUP_LIST}
+ )
+
+ result = vm_service._get_vm_scale_sets()
+
+ assert mock_client.virtual_machine_scale_sets.list.call_count == 2
+ assert AZURE_SUBSCRIPTION_ID in result
+
+ def test_get_vm_scale_sets_with_mixed_case_resource_group(self, vm_service_factory):
+ mock_client = MagicMock()
+ mock_client.virtual_machine_scale_sets = MagicMock()
+ mock_client.virtual_machine_scale_sets.list.return_value = []
+
+ vm_service = vm_service_factory(mock_client, {AZURE_SUBSCRIPTION_ID: ["RG"]})
+
+ vm_service._get_vm_scale_sets()
+
+ mock_client.virtual_machine_scale_sets.list.assert_called_once_with(
+ resource_group_name="RG"
+ )
diff --git a/tests/providers/e2enetworks/e2enetworks_fixtures.py b/tests/providers/e2enetworks/e2enetworks_fixtures.py
new file mode 100644
index 0000000000..1f493d3bb8
--- /dev/null
+++ b/tests/providers/e2enetworks/e2enetworks_fixtures.py
@@ -0,0 +1,55 @@
+import importlib
+import sys
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.e2enetworks_provider import E2enetworksProvider
+from prowler.providers.e2enetworks.models import (
+ E2eNetworksIdentityInfo,
+ E2eNetworksSession,
+)
+
+
+def run_e2enetworks_check(
+ check_module_path: str, client_patch_path: str, client_attr: str, resources: list
+):
+ """Execute an E2E check with mocked client resources."""
+ check_class_name = check_module_path.rsplit(".", 1)[-1]
+ client = MagicMock()
+ setattr(client, client_attr, resources)
+
+ with patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ):
+ if check_module_path in sys.modules:
+ module = importlib.reload(sys.modules[check_module_path])
+ else:
+ module = importlib.import_module(check_module_path)
+
+ with patch(client_patch_path, new=client):
+ return getattr(module, check_class_name)().execute()
+
+
+def set_mocked_e2enetworks_provider(
+ project_id: int = 12345,
+ locations: list[str] | None = None,
+ audit_config: dict | None = None,
+ fixer_config: dict | None = None,
+):
+ """Create a mocked E2E provider for tests without network calls."""
+ provider = MagicMock(spec=E2enetworksProvider)
+ provider.type = "e2enetworks"
+ provider.audit_config = audit_config or {}
+ provider.fixer_config = fixer_config or {}
+ provider.identity = E2eNetworksIdentityInfo(
+ project_id=project_id,
+ locations=locations or ["Delhi"],
+ )
+ provider.session = E2eNetworksSession(
+ api_key="test-api-key",
+ auth_token="test-auth-token",
+ project_id=project_id,
+ locations=locations or ["Delhi"],
+ http_session=MagicMock(),
+ )
+ return provider
diff --git a/tests/providers/e2enetworks/e2enetworks_metadata_test.py b/tests/providers/e2enetworks/e2enetworks_metadata_test.py
new file mode 100644
index 0000000000..54639bbf2c
--- /dev/null
+++ b/tests/providers/e2enetworks/e2enetworks_metadata_test.py
@@ -0,0 +1,37 @@
+from pathlib import Path
+
+import pytest
+
+from prowler.lib.check.models import CheckMetadata
+
+EXPECTED_SERVICE_NAMES = {
+ "database": "database",
+ "loadbalancer": "loadbalancer",
+ "network": "network",
+ "node": "node",
+ "securitygroup": "securitygroup",
+ "storage": "storage",
+}
+
+
+@pytest.mark.parametrize(
+ "metadata_file",
+ sorted(Path("prowler/providers/e2enetworks").glob("services/**/*.metadata.json")),
+)
+def test_e2enetworks_check_metadata_is_valid(metadata_file):
+ metadata = CheckMetadata.parse_file(metadata_file)
+ assert metadata.Provider == "e2enetworks"
+ assert metadata.CheckID == metadata_file.stem.replace(".metadata", "")
+
+
+@pytest.mark.parametrize(
+ "metadata_file",
+ sorted(Path("prowler/providers/e2enetworks").glob("services/**/*.metadata.json")),
+)
+def test_e2enetworks_check_metadata_uses_service_folder_names(metadata_file):
+ metadata = CheckMetadata.parse_file(metadata_file)
+ service_folder = metadata_file.relative_to(
+ Path("prowler/providers/e2enetworks/services")
+ ).parts[0]
+
+ assert metadata.ServiceName == EXPECTED_SERVICE_NAMES[service_folder]
diff --git a/tests/providers/e2enetworks/e2enetworks_provider_test.py b/tests/providers/e2enetworks/e2enetworks_provider_test.py
new file mode 100644
index 0000000000..a8743f38d8
--- /dev/null
+++ b/tests/providers/e2enetworks/e2enetworks_provider_test.py
@@ -0,0 +1,93 @@
+import os
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from prowler.providers.common.models import Connection
+from prowler.providers.e2enetworks.e2enetworks_provider import E2enetworksProvider
+from prowler.providers.e2enetworks.exceptions.exceptions import (
+ E2eNetworksCredentialsError,
+)
+
+
+class TestE2enetworksProvider:
+ @patch(
+ "prowler.providers.e2enetworks.e2enetworks_provider.load_and_validate_config_file"
+ )
+ def test_e2enetworks_provider_init_success(self, mock_load_config):
+ mock_load_config.return_value = {}
+
+ provider = E2enetworksProvider(
+ api_key="test-api-key",
+ auth_token="test-auth-token",
+ project_id="12345",
+ locations=["Delhi"],
+ )
+
+ assert provider.session.api_key == "test-api-key"
+ assert provider.session.auth_token == "test-auth-token"
+ assert provider.session.project_id == 12345
+ assert provider.identity.project_id == 12345
+ assert provider.session.locations == ["Delhi"]
+ assert provider.session.http_session.headers["Authorization"] == (
+ "Bearer test-auth-token"
+ )
+
+ @patch(
+ "prowler.providers.e2enetworks.e2enetworks_provider.load_and_validate_config_file"
+ )
+ def test_e2enetworks_provider_init_missing_credentials(self, mock_load_config):
+ mock_load_config.return_value = {}
+
+ with pytest.raises(E2eNetworksCredentialsError):
+ E2enetworksProvider(api_key="", auth_token="token", project_id="1")
+
+ @patch.dict(
+ os.environ,
+ {
+ "E2E_NETWORKS_API_KEY": "env-api-key",
+ "E2E_NETWORKS_AUTH_TOKEN": "env-auth-token",
+ "E2E_NETWORKS_PROJECT_ID": "99",
+ "E2E_NETWORKS_REGION": "Chennai",
+ },
+ clear=False,
+ )
+ @patch(
+ "prowler.providers.e2enetworks.e2enetworks_provider.load_and_validate_config_file"
+ )
+ def test_e2enetworks_provider_init_from_env(self, mock_load_config):
+ mock_load_config.return_value = {}
+
+ provider = E2enetworksProvider()
+
+ assert provider.session.api_key == "env-api-key"
+ assert provider.session.project_id == 99
+ assert provider.session.locations == ["Chennai"]
+
+ @patch(
+ "prowler.providers.e2enetworks.e2enetworks_provider.E2enetworksProvider.setup_session"
+ )
+ def test_e2enetworks_test_connection_success(self, mock_setup_session):
+ mock_session = MagicMock()
+ mock_response = MagicMock()
+ mock_response.status_code = 200
+ mock_session.http_session.get.return_value = mock_response
+ mock_session.api_key = "key"
+ mock_session.project_id = 1
+ mock_session.base_url = "https://api.e2enetworks.com/myaccount/api/v1"
+ mock_setup_session.return_value = mock_session
+
+ result = E2enetworksProvider.test_connection(
+ api_key="key",
+ auth_token="token",
+ project_id=1,
+ locations=["Delhi"],
+ )
+
+ assert result == Connection(is_connected=True)
+
+ def test_e2enetworks_test_connection_missing_credentials(self):
+ with pytest.raises(E2eNetworksCredentialsError):
+ E2enetworksProvider.test_connection(
+ api_key="", auth_token="", project_id=None
+ )
diff --git a/tests/providers/e2enetworks/lib/api/e2enetworks_api_client_test.py b/tests/providers/e2enetworks/lib/api/e2enetworks_api_client_test.py
new file mode 100644
index 0000000000..e9a3f960e7
--- /dev/null
+++ b/tests/providers/e2enetworks/lib/api/e2enetworks_api_client_test.py
@@ -0,0 +1,43 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+import requests
+
+from prowler.providers.e2enetworks.exceptions.exceptions import E2eNetworksAPIError
+from prowler.providers.e2enetworks.lib.api.client import E2eNetworksAPIClient
+from prowler.providers.e2enetworks.models import E2eNetworksSession
+
+
+class TestE2eNetworksAPIClient:
+ def test_get_redacts_api_key_from_errors(self):
+ session = E2eNetworksSession(
+ api_key="secret-api-key",
+ auth_token="secret-auth-token",
+ project_id=123,
+ locations=["Delhi"],
+ http_session=MagicMock(),
+ )
+ session.http_session.get.side_effect = requests.exceptions.HTTPError(
+ "404 Client Error: Not Found for url: "
+ "https://api.e2enetworks.com/myaccount/api/v1/nodes/"
+ "?apikey=secret-api-key&project_id=123&location=Delhi "
+ "Authorization: Bearer secret-auth-token"
+ )
+
+ client = E2eNetworksAPIClient(session)
+
+ with patch(
+ "prowler.providers.e2enetworks.lib.api.client.logger.error"
+ ) as mock_logger:
+ with pytest.raises(E2eNetworksAPIError) as error:
+ client.get("/nodes/", location="Delhi")
+
+ logged_message = mock_logger.call_args.args[0]
+ assert "secret-api-key" not in logged_message
+ assert "secret-auth-token" not in logged_message
+ assert "apikey=REDACTED" in logged_message
+ assert "Bearer REDACTED" in logged_message
+ assert "secret-api-key" not in str(error.value)
+ assert "secret-auth-token" not in str(error.value)
+ assert "apikey=REDACTED" in str(error.value)
+ assert "Bearer REDACTED" in str(error.value)
diff --git a/tests/providers/e2enetworks/lib/arguments/e2enetworks_arguments_test.py b/tests/providers/e2enetworks/lib/arguments/e2enetworks_arguments_test.py
new file mode 100644
index 0000000000..22fa0beb46
--- /dev/null
+++ b/tests/providers/e2enetworks/lib/arguments/e2enetworks_arguments_test.py
@@ -0,0 +1,44 @@
+from unittest.mock import MagicMock
+
+from prowler.providers.e2enetworks.lib.arguments.arguments import validate_arguments
+
+
+class TestE2eArguments:
+ def test_validate_arguments_success(self):
+ arguments = MagicMock()
+ arguments.e2e_networks_api_key = "key"
+ arguments.e2e_networks_auth_token = "token"
+ arguments.e2e_networks_project_id = "123"
+
+ valid, message = validate_arguments(arguments)
+
+ assert valid is True
+ assert message == ""
+
+ def test_validate_arguments_missing_credentials_allowed(self, monkeypatch):
+ # Listing operations must work without credentials; presence is enforced
+ # later at provider initialization, not here.
+ monkeypatch.delenv("E2E_NETWORKS_API_KEY", raising=False)
+ monkeypatch.delenv("E2E_NETWORKS_AUTH_TOKEN", raising=False)
+ monkeypatch.delenv("E2E_NETWORKS_PROJECT_ID", raising=False)
+
+ arguments = MagicMock()
+ arguments.e2e_networks_api_key = None
+ arguments.e2e_networks_auth_token = None
+ arguments.e2e_networks_project_id = None
+
+ valid, message = validate_arguments(arguments)
+
+ assert valid is True
+ assert message == ""
+
+ def test_validate_arguments_invalid_project_id(self):
+ arguments = MagicMock()
+ arguments.e2e_networks_api_key = "key"
+ arguments.e2e_networks_auth_token = "token"
+ arguments.e2e_networks_project_id = "abc"
+
+ valid, message = validate_arguments(arguments)
+
+ assert valid is False
+ assert "integer" in message
diff --git a/tests/providers/e2enetworks/lib/mutelist/e2enetworks_mutelist_test.py b/tests/providers/e2enetworks/lib/mutelist/e2enetworks_mutelist_test.py
new file mode 100644
index 0000000000..968822c253
--- /dev/null
+++ b/tests/providers/e2enetworks/lib/mutelist/e2enetworks_mutelist_test.py
@@ -0,0 +1,65 @@
+from unittest.mock import MagicMock
+
+from prowler.providers.e2enetworks.lib.mutelist.mutelist import E2eNetworksMutelist
+
+
+def _build_finding(check_id: str, location: str, resource_id: str, resource_name: str):
+ finding = MagicMock()
+ finding.check_metadata = MagicMock()
+ finding.check_metadata.CheckID = check_id
+ finding.status = "FAIL"
+ finding.location = location
+ finding.resource_id = resource_id
+ finding.resource_name = resource_name
+ finding.resource_tags = []
+ return finding
+
+
+class Test_e2enetworks_mutelist:
+ def test_is_finding_muted(self):
+ mutelist_content = {
+ "Accounts": {
+ "*": {
+ "Checks": {
+ "node_public_ip_not_assigned": {
+ "Regions": ["Delhi"],
+ "Resources": ["example-node-id"],
+ }
+ }
+ }
+ }
+ }
+
+ mutelist = E2eNetworksMutelist(mutelist_content=mutelist_content)
+ finding = _build_finding(
+ "node_public_ip_not_assigned",
+ "Delhi",
+ "example-node-id",
+ "example-node-id",
+ )
+
+ assert mutelist.is_finding_muted(finding=finding) is True
+
+ def test_is_finding_not_muted_wrong_location(self):
+ mutelist_content = {
+ "Accounts": {
+ "*": {
+ "Checks": {
+ "node_public_ip_not_assigned": {
+ "Regions": ["Delhi"],
+ "Resources": ["example-node-id"],
+ }
+ }
+ }
+ }
+ }
+
+ mutelist = E2eNetworksMutelist(mutelist_content=mutelist_content)
+ finding = _build_finding(
+ "node_public_ip_not_assigned",
+ "Mumbai",
+ "example-node-id",
+ "example-node-id",
+ )
+
+ assert mutelist.is_finding_muted(finding=finding) is False
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled_test.py b/tests/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled_test.py
new file mode 100644
index 0000000000..acfa9e85ed
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_backup_enabled/database_cluster_backup_enabled_test.py
@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_backup_enabled.database_cluster_backup_enabled.database_client"
+
+
+class Test_database_cluster_backup_enabled:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_backup_enabled.database_cluster_backup_enabled import (
+ database_cluster_backup_enabled,
+ )
+
+ assert database_cluster_backup_enabled().execute() == []
+
+ def test_database_cluster_backup_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(id="1", name="ok", location="Delhi", backup_enabled=True),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_backup_enabled.database_cluster_backup_enabled import (
+ database_cluster_backup_enabled,
+ )
+
+ findings = database_cluster_backup_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_backup_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(id="2", name="bad", location="Delhi", backup_enabled=False),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_backup_enabled.database_cluster_backup_enabled import (
+ database_cluster_backup_enabled,
+ )
+
+ findings = database_cluster_backup_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username_test.py b/tests/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username_test.py
new file mode 100644
index 0000000000..80a37f4d97
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_default_admin_username/database_cluster_default_admin_username_test.py
@@ -0,0 +1,72 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_default_admin_username.database_cluster_default_admin_username.database_client"
+
+
+class Test_database_cluster_default_admin_username:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_default_admin_username.database_cluster_default_admin_username import (
+ database_cluster_default_admin_username,
+ )
+
+ assert database_cluster_default_admin_username().execute() == []
+
+ def test_database_cluster_default_admin_username_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="1", name="ok", location="Delhi", master_username="dbadmin"
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_default_admin_username.database_cluster_default_admin_username import (
+ database_cluster_default_admin_username,
+ )
+
+ findings = database_cluster_default_admin_username().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_default_admin_username_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="2", name="bad", location="Delhi", master_username="admin"
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_default_admin_username.database_cluster_default_admin_username import (
+ database_cluster_default_admin_username,
+ )
+
+ findings = database_cluster_default_admin_username().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured_test.py b/tests/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured_test.py
new file mode 100644
index 0000000000..76adbbc5c2
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_ip_whitelist_configured/database_cluster_ip_whitelist_configured_test.py
@@ -0,0 +1,80 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_ip_whitelist_configured.database_cluster_ip_whitelist_configured.database_client"
+
+
+class Test_database_cluster_ip_whitelist_configured:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ip_whitelist_configured.database_cluster_ip_whitelist_configured import (
+ database_cluster_ip_whitelist_configured,
+ )
+
+ assert database_cluster_ip_whitelist_configured().execute() == []
+
+ def test_database_cluster_ip_whitelist_configured_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="1",
+ name="ok",
+ location="Delhi",
+ master_has_public_ip=True,
+ whitelisted_ips=["203.0.113.0/24"],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ip_whitelist_configured.database_cluster_ip_whitelist_configured import (
+ database_cluster_ip_whitelist_configured,
+ )
+
+ findings = database_cluster_ip_whitelist_configured().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_ip_whitelist_configured_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="2",
+ name="bad",
+ location="Delhi",
+ master_has_public_ip=True,
+ whitelisted_ips=[],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ip_whitelist_configured.database_cluster_ip_whitelist_configured import (
+ database_cluster_ip_whitelist_configured,
+ )
+
+ findings = database_cluster_ip_whitelist_configured().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned_test.py b/tests/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned_test.py
new file mode 100644
index 0000000000..4d8e4cbb27
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_public_ip_not_assigned/database_cluster_public_ip_not_assigned_test.py
@@ -0,0 +1,72 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_public_ip_not_assigned.database_cluster_public_ip_not_assigned.database_client"
+
+
+class Test_database_cluster_public_ip_not_assigned:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_public_ip_not_assigned.database_cluster_public_ip_not_assigned import (
+ database_cluster_public_ip_not_assigned,
+ )
+
+ assert database_cluster_public_ip_not_assigned().execute() == []
+
+ def test_database_cluster_public_ip_not_assigned_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="1", name="ok", location="Delhi", master_has_public_ip=False
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_public_ip_not_assigned.database_cluster_public_ip_not_assigned import (
+ database_cluster_public_ip_not_assigned,
+ )
+
+ findings = database_cluster_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_public_ip_not_assigned_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="2", name="bad", location="Delhi", master_has_public_ip=True
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_public_ip_not_assigned.database_cluster_public_ip_not_assigned import (
+ database_cluster_public_ip_not_assigned,
+ )
+
+ findings = database_cluster_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running_test.py b/tests/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running_test.py
new file mode 100644
index 0000000000..c76b4cb7bd
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_running/database_cluster_running_test.py
@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_running.database_cluster_running.database_client"
+
+
+class Test_database_cluster_running:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_running.database_cluster_running import (
+ database_cluster_running,
+ )
+
+ assert database_cluster_running().execute() == []
+
+ def test_database_cluster_running_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(id="1", name="ok", location="Delhi", status="RUNNING"),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_running.database_cluster_running import (
+ database_cluster_running,
+ )
+
+ findings = database_cluster_running().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_running_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(id="2", name="bad", location="Delhi", status="STOPPED"),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_running.database_cluster_running import (
+ database_cluster_running,
+ )
+
+ findings = database_cluster_running().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled_test.py b/tests/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled_test.py
new file mode 100644
index 0000000000..e1e247fa48
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_cluster_ssl_enabled/database_cluster_ssl_enabled_test.py
@@ -0,0 +1,72 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseCluster,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_cluster_ssl_enabled.database_cluster_ssl_enabled.database_client"
+
+
+class Test_database_cluster_ssl_enabled:
+ def test_no_clusters(self):
+ client = mock.MagicMock()
+ client.clusters = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ssl_enabled.database_cluster_ssl_enabled import (
+ database_cluster_ssl_enabled,
+ )
+
+ assert database_cluster_ssl_enabled().execute() == []
+
+ def test_database_cluster_ssl_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="1", name="ok", location="Delhi", master_ssl_enabled=True
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ssl_enabled.database_cluster_ssl_enabled import (
+ database_cluster_ssl_enabled,
+ )
+
+ findings = database_cluster_ssl_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_cluster_ssl_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.clusters = [
+ DatabaseCluster(
+ id="2", name="bad", location="Delhi", master_ssl_enabled=False
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_cluster_ssl_enabled.database_cluster_ssl_enabled import (
+ database_cluster_ssl_enabled,
+ )
+
+ findings = database_cluster_ssl_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned_test.py b/tests/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned_test.py
new file mode 100644
index 0000000000..068dd857b7
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/database_replica_public_ip_not_assigned/database_replica_public_ip_not_assigned_test.py
@@ -0,0 +1,84 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.database.database_service import (
+ DatabaseInstance,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.database.database_replica_public_ip_not_assigned.database_replica_public_ip_not_assigned.database_client"
+
+
+class Test_database_replica_public_ip_not_assigned:
+ def test_no_instances(self):
+ client = mock.MagicMock()
+ client.instances = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_replica_public_ip_not_assigned.database_replica_public_ip_not_assigned import (
+ database_replica_public_ip_not_assigned,
+ )
+
+ assert database_replica_public_ip_not_assigned().execute() == []
+
+ def test_database_replica_public_ip_not_assigned_compliant(self):
+ client = mock.MagicMock()
+ client.instances = [
+ DatabaseInstance(
+ id="1",
+ name="ok",
+ cluster_id="c1",
+ cluster_name="cluster",
+ location="Delhi",
+ role="replica",
+ has_public_ip=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_replica_public_ip_not_assigned.database_replica_public_ip_not_assigned import (
+ database_replica_public_ip_not_assigned,
+ )
+
+ findings = database_replica_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_database_replica_public_ip_not_assigned_non_compliant(self):
+ client = mock.MagicMock()
+ client.instances = [
+ DatabaseInstance(
+ id="2",
+ name="bad",
+ cluster_id="c1",
+ cluster_name="cluster",
+ location="Delhi",
+ role="replica",
+ has_public_ip=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.database.database_replica_public_ip_not_assigned.database_replica_public_ip_not_assigned import (
+ database_replica_public_ip_not_assigned,
+ )
+
+ findings = database_replica_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/database/e2enetworks_database_service_test.py b/tests/providers/e2enetworks/services/database/e2enetworks_database_service_test.py
new file mode 100644
index 0000000000..58697e86c8
--- /dev/null
+++ b/tests/providers/e2enetworks/services/database/e2enetworks_database_service_test.py
@@ -0,0 +1,70 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.services.database.database_service import Database
+
+
+class TestDatabaseService:
+ @patch(
+ "prowler.providers.e2enetworks.services.database.database_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_clusters_enriches_detail(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = Database.__new__(Database)
+ service.provider = provider
+ service.client = MagicMock()
+ service.clusters = []
+ service.instances = []
+
+ service.client.get_data.side_effect = [
+ [
+ {
+ "id": 5276,
+ "name": "E2E-DBaaS-1",
+ "status": "RUNNING",
+ "software": {"name": "MySQL", "version": "8.0"},
+ "master_node": {
+ "instance_id": 10650,
+ "node_name": "E2E-DBaaS-1-Node-1",
+ "public_ip_address": "164.52.1.1",
+ "ssl": True,
+ "database": {"username": "dbadmin"},
+ },
+ }
+ ],
+ {
+ "id": 5276,
+ "name": "E2E-DBaaS-1",
+ "status": "RUNNING",
+ "backup_enabled": True,
+ "whitelisted_ips": ["203.0.113.0/24"],
+ "master_node": {
+ "instance_id": 10650,
+ "node_name": "E2E-DBaaS-1-Node-1",
+ "public_ip_address": "164.52.1.1",
+ "ssl": True,
+ "database": {"username": "dbadmin"},
+ },
+ "slave_nodes": [
+ {
+ "instance_id": 10651,
+ "node_name": "E2E-DBaaS-1-Replica-1",
+ "public_ip_address": None,
+ "database": {"username": "dbadmin"},
+ }
+ ],
+ },
+ ]
+
+ service._fetch_clusters()
+
+ assert len(service.clusters) == 1
+ cluster = service.clusters[0]
+ assert cluster.backup_enabled is True
+ assert cluster.master_ssl_enabled is True
+ assert cluster.master_has_public_ip is True
+ assert cluster.master_username == "dbadmin"
+ assert len(service.instances) == 2
+ assert service.instances[1].role == "replica"
diff --git a/tests/providers/e2enetworks/services/loadbalancer/e2enetworks_loadbalancer_service_test.py b/tests/providers/e2enetworks/services/loadbalancer/e2enetworks_loadbalancer_service_test.py
new file mode 100644
index 0000000000..6f7885c48d
--- /dev/null
+++ b/tests/providers/e2enetworks/services/loadbalancer/e2enetworks_loadbalancer_service_test.py
@@ -0,0 +1,81 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service import (
+ LoadBalancers,
+)
+
+
+class TestLoadBalancerService:
+ @patch(
+ "prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_loadbalancers_parses_context(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = LoadBalancers.__new__(LoadBalancers)
+ service.provider = provider
+ service.client = MagicMock()
+ service.load_balancers = []
+
+ service.client.paginate.return_value = [
+ {
+ "id": 42,
+ "name": "web-alb",
+ "status": "running",
+ "node_detail": {"public_ip": "164.52.2.2"},
+ "appliance_instance": [
+ {
+ "context": {
+ "lb_mode": "HTTPS",
+ "lb_port": 443,
+ "enable_bitninja": True,
+ "ssl_context": {"ssl_certificate_id": 7},
+ "backends": [{"http_check": True}],
+ }
+ }
+ ],
+ }
+ ]
+
+ service._fetch_loadbalancers()
+
+ assert len(service.load_balancers) == 1
+ lb = service.load_balancers[0]
+ assert lb.id == "42"
+ assert lb.name == "web-alb"
+ assert lb.location == "Delhi"
+ assert lb.lb_mode == "HTTPS"
+ assert lb.enable_bitninja is True
+ assert lb.ssl_certificate_id == "7"
+ assert lb.public_ip == "164.52.2.2"
+ assert lb.is_alb is True
+ assert lb.is_alb_https is True
+ assert lb.has_backend_health_check is True
+
+ @patch(
+ "prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_loadbalancers_handles_missing_context(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = LoadBalancers.__new__(LoadBalancers)
+ service.provider = provider
+ service.client = MagicMock()
+ service.load_balancers = []
+
+ service.client.paginate.return_value = [
+ {"id": 1, "name": "tcp-lb", "status": "running"}
+ ]
+
+ service._fetch_loadbalancers()
+
+ assert len(service.load_balancers) == 1
+ lb = service.load_balancers[0]
+ assert lb.enable_bitninja is False
+ assert lb.ssl_certificate_id is None
+ assert lb.is_alb is False
+ assert lb.has_backend_health_check is False
diff --git a/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate_test.py b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate_test.py
new file mode 100644
index 0000000000..58c5469ec3
--- /dev/null
+++ b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_alb_https_uses_ssl_certificate/loadbalancer_alb_https_uses_ssl_certificate_test.py
@@ -0,0 +1,80 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service import (
+ LoadBalancer,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_alb_https_uses_ssl_certificate.loadbalancer_alb_https_uses_ssl_certificate.loadbalancer_client"
+
+
+class Test_loadbalancer_alb_https_uses_ssl_certificate:
+ def test_no_load_balancers(self):
+ client = mock.MagicMock()
+ client.load_balancers = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_alb_https_uses_ssl_certificate.loadbalancer_alb_https_uses_ssl_certificate import (
+ loadbalancer_alb_https_uses_ssl_certificate,
+ )
+
+ assert loadbalancer_alb_https_uses_ssl_certificate().execute() == []
+
+ def test_loadbalancer_alb_https_uses_ssl_certificate_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(
+ id="1",
+ name="ok",
+ location="Delhi",
+ lb_mode="HTTPS",
+ ssl_certificate_id="cert-1",
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_alb_https_uses_ssl_certificate.loadbalancer_alb_https_uses_ssl_certificate import (
+ loadbalancer_alb_https_uses_ssl_certificate,
+ )
+
+ findings = loadbalancer_alb_https_uses_ssl_certificate().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_loadbalancer_alb_https_uses_ssl_certificate_non_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(
+ id="2",
+ name="bad",
+ location="Delhi",
+ lb_mode="HTTPS",
+ ssl_certificate_id=None,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_alb_https_uses_ssl_certificate.loadbalancer_alb_https_uses_ssl_certificate import (
+ loadbalancer_alb_https_uses_ssl_certificate,
+ )
+
+ findings = loadbalancer_alb_https_uses_ssl_certificate().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled_test.py b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled_test.py
new file mode 100644
index 0000000000..5fc23155a3
--- /dev/null
+++ b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_backend_health_check_enabled/loadbalancer_backend_health_check_enabled_test.py
@@ -0,0 +1,76 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service import (
+ LoadBalancer,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_backend_health_check_enabled.loadbalancer_backend_health_check_enabled.loadbalancer_client"
+
+
+class Test_loadbalancer_backend_health_check_enabled:
+ def test_no_load_balancers(self):
+ client = mock.MagicMock()
+ client.load_balancers = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_backend_health_check_enabled.loadbalancer_backend_health_check_enabled import (
+ loadbalancer_backend_health_check_enabled,
+ )
+
+ assert loadbalancer_backend_health_check_enabled().execute() == []
+
+ def test_loadbalancer_backend_health_check_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(
+ id="1",
+ name="ok",
+ location="Delhi",
+ lb_mode="HTTP",
+ backends=[{"http_check": True}],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_backend_health_check_enabled.loadbalancer_backend_health_check_enabled import (
+ loadbalancer_backend_health_check_enabled,
+ )
+
+ findings = loadbalancer_backend_health_check_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_loadbalancer_backend_health_check_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(
+ id="2", name="bad", location="Delhi", lb_mode="HTTP", backends=[{}]
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_backend_health_check_enabled.loadbalancer_backend_health_check_enabled import (
+ loadbalancer_backend_health_check_enabled,
+ )
+
+ findings = loadbalancer_backend_health_check_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled_test.py b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled_test.py
new file mode 100644
index 0000000000..f521ec4397
--- /dev/null
+++ b/tests/providers/e2enetworks/services/loadbalancer/loadbalancer_bitninja_enabled/loadbalancer_bitninja_enabled_test.py
@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_service import (
+ LoadBalancer,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_bitninja_enabled.loadbalancer_bitninja_enabled.loadbalancer_client"
+
+
+class Test_loadbalancer_bitninja_enabled:
+ def test_no_load_balancers(self):
+ client = mock.MagicMock()
+ client.load_balancers = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_bitninja_enabled.loadbalancer_bitninja_enabled import (
+ loadbalancer_bitninja_enabled,
+ )
+
+ assert loadbalancer_bitninja_enabled().execute() == []
+
+ def test_loadbalancer_bitninja_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(id="1", name="ok", location="Delhi", enable_bitninja=True),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_bitninja_enabled.loadbalancer_bitninja_enabled import (
+ loadbalancer_bitninja_enabled,
+ )
+
+ findings = loadbalancer_bitninja_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_loadbalancer_bitninja_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.load_balancers = [
+ LoadBalancer(id="2", name="bad", location="Delhi", enable_bitninja=False),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_bitninja_enabled.loadbalancer_bitninja_enabled import (
+ loadbalancer_bitninja_enabled,
+ )
+
+ findings = loadbalancer_bitninja_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/network/e2enetworks_network_service_test.py b/tests/providers/e2enetworks/services/network/e2enetworks_network_service_test.py
new file mode 100644
index 0000000000..29a3ab1e5e
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/e2enetworks_network_service_test.py
@@ -0,0 +1,74 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.services.network.network_service import Network, Vpc
+
+
+class TestNetworkService:
+ @patch(
+ "prowler.providers.e2enetworks.services.network.network_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_vpcs_and_tunnels(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = Network.__new__(Network)
+ service.provider = provider
+ service.client = MagicMock()
+ service.vpcs = []
+ service.reserved_ips = []
+ service.vpc_tunnels = []
+
+ service.client.paginate.return_value = [
+ {
+ "network_id": 100,
+ "name": "VPC-100",
+ "is_active": True,
+ "state": "Active",
+ "ipv4_cidr": "10.0.0.0/23",
+ "vm_count": 2,
+ "gateway_node": {"node_id": 1, "ip_address_public": "1.2.3.4"},
+ }
+ ]
+ service.client.get_data.side_effect = [
+ [
+ {
+ "reserve_id": 10,
+ "ip_address": "164.52.1.1",
+ "status": "Attached",
+ "reserved_type": "FloatingIP",
+ "vm_id": 55,
+ "floating_ip_attached_nodes": [{"id": 1}],
+ }
+ ],
+ [
+ {
+ "id": 5,
+ "name": "peer-tunnel",
+ "status": "ACTIVE",
+ "is_peer_vpc_external": True,
+ }
+ ],
+ ]
+
+ service._fetch_vpcs()
+ service._fetch_reserved_ips()
+ service._fetch_vpc_tunnels()
+
+ assert len(service.vpcs) == 1
+ assert service.vpcs[0].vm_count == 2
+ assert len(service.reserved_ips) == 1
+ assert service.reserved_ips[0].floating_ip_attached_nodes_count == 1
+ assert len(service.vpc_tunnels) == 1
+ assert service.vpc_tunnels[0].is_peer_vpc_external is True
+
+
+class TestVpcModel:
+ def test_resource_properties(self):
+ vpc = Vpc(
+ network_id="100",
+ name="VPC-100",
+ location="Delhi",
+ )
+ assert vpc.resource_id == "100"
+ assert vpc.resource_name == "VPC-100"
diff --git a/tests/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached_test.py b/tests/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached_test.py
new file mode 100644
index 0000000000..b3624b72c6
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/network_reserveip_floating_ip_unattached/network_reserveip_floating_ip_unattached_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.network.network_service import (
+ ReservedIp,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.network.network_reserveip_floating_ip_unattached.network_reserveip_floating_ip_unattached.network_client"
+
+
+class Test_network_reserveip_floating_ip_unattached:
+ def test_no_reserved_ips(self):
+ client = mock.MagicMock()
+ client.reserved_ips = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_floating_ip_unattached.network_reserveip_floating_ip_unattached import (
+ network_reserveip_floating_ip_unattached,
+ )
+
+ assert network_reserveip_floating_ip_unattached().execute() == []
+
+ def test_network_reserveip_floating_ip_unattached_compliant(self):
+ client = mock.MagicMock()
+ client.reserved_ips = [
+ ReservedIp(
+ reserve_id="1",
+ ip_address="1.2.3.4",
+ location="Delhi",
+ reserved_type="FloatingIP",
+ status="Attached",
+ floating_ip_attached_nodes_count=1,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_floating_ip_unattached.network_reserveip_floating_ip_unattached import (
+ network_reserveip_floating_ip_unattached,
+ )
+
+ findings = network_reserveip_floating_ip_unattached().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_network_reserveip_floating_ip_unattached_non_compliant(self):
+ client = mock.MagicMock()
+ client.reserved_ips = [
+ ReservedIp(
+ reserve_id="2",
+ ip_address="5.6.7.8",
+ location="Delhi",
+ reserved_type="FloatingIP",
+ status="Available",
+ floating_ip_attached_nodes_count=0,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_floating_ip_unattached.network_reserveip_floating_ip_unattached import (
+ network_reserveip_floating_ip_unattached,
+ )
+
+ findings = network_reserveip_floating_ip_unattached().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip_test.py b/tests/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip_test.py
new file mode 100644
index 0000000000..48cbed3691
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/network_reserveip_orphaned_public_ip/network_reserveip_orphaned_public_ip_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.network.network_service import (
+ ReservedIp,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.network.network_reserveip_orphaned_public_ip.network_reserveip_orphaned_public_ip.network_client"
+
+
+class Test_network_reserveip_orphaned_public_ip:
+ def test_no_reserved_ips(self):
+ client = mock.MagicMock()
+ client.reserved_ips = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_orphaned_public_ip.network_reserveip_orphaned_public_ip import (
+ network_reserveip_orphaned_public_ip,
+ )
+
+ assert network_reserveip_orphaned_public_ip().execute() == []
+
+ def test_network_reserveip_orphaned_public_ip_compliant(self):
+ client = mock.MagicMock()
+ client.reserved_ips = [
+ ReservedIp(
+ reserve_id="1",
+ ip_address="1.2.3.4",
+ location="Delhi",
+ reserved_type="PublicIP",
+ status="Attached",
+ vm_id=123,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_orphaned_public_ip.network_reserveip_orphaned_public_ip import (
+ network_reserveip_orphaned_public_ip,
+ )
+
+ findings = network_reserveip_orphaned_public_ip().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_network_reserveip_orphaned_public_ip_non_compliant(self):
+ client = mock.MagicMock()
+ client.reserved_ips = [
+ ReservedIp(
+ reserve_id="2",
+ ip_address="5.6.7.8",
+ location="Delhi",
+ reserved_type="PublicIP",
+ status="Available",
+ vm_id=None,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_reserveip_orphaned_public_ip.network_reserveip_orphaned_public_ip import (
+ network_reserveip_orphaned_public_ip,
+ )
+
+ findings = network_reserveip_orphaned_public_ip().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes_test.py b/tests/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes_test.py
new file mode 100644
index 0000000000..5e677a3c11
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/network_vpc_has_attached_nodes/network_vpc_has_attached_nodes_test.py
@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.network.network_service import (
+ Vpc,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.network.network_vpc_has_attached_nodes.network_vpc_has_attached_nodes.network_client"
+
+
+class Test_network_vpc_has_attached_nodes:
+ def test_no_vpcs(self):
+ client = mock.MagicMock()
+ client.vpcs = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_has_attached_nodes.network_vpc_has_attached_nodes import (
+ network_vpc_has_attached_nodes,
+ )
+
+ assert network_vpc_has_attached_nodes().execute() == []
+
+ def test_network_vpc_has_attached_nodes_compliant(self):
+ client = mock.MagicMock()
+ client.vpcs = [
+ Vpc(network_id="1", name="ok", location="Delhi", vm_count=2),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_has_attached_nodes.network_vpc_has_attached_nodes import (
+ network_vpc_has_attached_nodes,
+ )
+
+ findings = network_vpc_has_attached_nodes().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_network_vpc_has_attached_nodes_non_compliant(self):
+ client = mock.MagicMock()
+ client.vpcs = [
+ Vpc(network_id="2", name="bad", location="Delhi", vm_count=0),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_has_attached_nodes.network_vpc_has_attached_nodes import (
+ network_vpc_has_attached_nodes,
+ )
+
+ findings = network_vpc_has_attached_nodes().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active_test.py b/tests/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active_test.py
new file mode 100644
index 0000000000..d38d4802ab
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/network_vpc_is_active/network_vpc_is_active_test.py
@@ -0,0 +1,80 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.network.network_service import (
+ Vpc,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.network.network_vpc_is_active.network_vpc_is_active.network_client"
+
+
+class Test_network_vpc_is_active:
+ def test_no_vpcs(self):
+ client = mock.MagicMock()
+ client.vpcs = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_is_active.network_vpc_is_active import (
+ network_vpc_is_active,
+ )
+
+ assert network_vpc_is_active().execute() == []
+
+ def test_network_vpc_is_active_compliant(self):
+ client = mock.MagicMock()
+ client.vpcs = [
+ Vpc(
+ network_id="1",
+ name="ok",
+ location="Delhi",
+ is_active=True,
+ state="Active",
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_is_active.network_vpc_is_active import (
+ network_vpc_is_active,
+ )
+
+ findings = network_vpc_is_active().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_network_vpc_is_active_non_compliant(self):
+ client = mock.MagicMock()
+ client.vpcs = [
+ Vpc(
+ network_id="2",
+ name="bad",
+ location="Delhi",
+ is_active=False,
+ state="Inactive",
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_is_active.network_vpc_is_active import (
+ network_vpc_is_active,
+ )
+
+ findings = network_vpc_is_active().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled_test.py b/tests/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled_test.py
new file mode 100644
index 0000000000..eb7503c419
--- /dev/null
+++ b/tests/providers/e2enetworks/services/network/network_vpc_peering_external_peer_disabled/network_vpc_peering_external_peer_disabled_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.network.network_service import (
+ VpcTunnel,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.network.network_vpc_peering_external_peer_disabled.network_vpc_peering_external_peer_disabled.network_client"
+
+
+class Test_network_vpc_peering_external_peer_disabled:
+ def test_no_vpc_tunnels(self):
+ client = mock.MagicMock()
+ client.vpc_tunnels = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_peering_external_peer_disabled.network_vpc_peering_external_peer_disabled import (
+ network_vpc_peering_external_peer_disabled,
+ )
+
+ assert network_vpc_peering_external_peer_disabled().execute() == []
+
+ def test_network_vpc_peering_external_peer_disabled_compliant(self):
+ client = mock.MagicMock()
+ client.vpc_tunnels = [
+ VpcTunnel(
+ id="1",
+ name="ok",
+ location="Delhi",
+ local_vpc_network_id="vpc-1",
+ local_vpc_name="vpc",
+ is_peer_vpc_external=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_peering_external_peer_disabled.network_vpc_peering_external_peer_disabled import (
+ network_vpc_peering_external_peer_disabled,
+ )
+
+ findings = network_vpc_peering_external_peer_disabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_network_vpc_peering_external_peer_disabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.vpc_tunnels = [
+ VpcTunnel(
+ id="2",
+ name="bad",
+ location="Delhi",
+ local_vpc_network_id="vpc-2",
+ local_vpc_name="vpc",
+ is_peer_vpc_external=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.network.network_vpc_peering_external_peer_disabled.network_vpc_peering_external_peer_disabled import (
+ network_vpc_peering_external_peer_disabled,
+ )
+
+ findings = network_vpc_peering_external_peer_disabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/e2enetworks_node_service_test.py b/tests/providers/e2enetworks/services/node/e2enetworks_node_service_test.py
new file mode 100644
index 0000000000..84bbb576ef
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/e2enetworks_node_service_test.py
@@ -0,0 +1,94 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from prowler.providers.e2enetworks.services.node.node_service import Node, Nodes
+
+
+class TestNodesService:
+ @patch(
+ "prowler.providers.e2enetworks.services.node.node_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_nodes_enriches_detail(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = Nodes.__new__(Nodes)
+ service.provider = provider
+ service.client = MagicMock()
+ service.nodes = []
+
+ service.client.get_data.side_effect = [
+ [
+ {
+ "id": 101,
+ "name": "node-1",
+ "status": "Running",
+ "public_ip_address": "1.2.3.4",
+ "is_accidental_protection": True,
+ "isEncryptionEnabled": True,
+ "is_locked": False,
+ "rescue_mode_status": "Disabled",
+ }
+ ],
+ {
+ "vm_id": 555,
+ "is_node_compliance": True,
+ "is_vpc_attached": True,
+ },
+ ]
+
+ service._fetch_nodes()
+
+ assert len(service.nodes) == 1
+ node = service.nodes[0]
+ assert node.id == "101"
+ assert node.vm_id == "555"
+ assert node.has_public_ip is True
+ assert node.is_node_compliance is True
+ assert node.is_vpc_attached is True
+
+
+class TestNodeCheckLogic:
+ def test_node_public_ip_detection(self):
+ public_node = Node(
+ id="1",
+ name="public",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ has_public_ip=True,
+ )
+ private_node = Node(
+ id="2",
+ name="private",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ has_public_ip=False,
+ )
+
+ assert public_node.has_public_ip is True
+ assert private_node.has_public_ip is False
+
+
+class TestHasPublicIp:
+ @pytest.mark.parametrize(
+ "public_ip_address,expected",
+ [
+ (None, False),
+ ("", False),
+ ("[]", False),
+ ("null", False),
+ ("None", False),
+ ("1.2.3.4", True),
+ (" 10.0.0.1 ", True),
+ ],
+ )
+ def test_has_public_ip_normalization(self, public_ip_address, expected):
+ from prowler.providers.e2enetworks.services.node.node_service import (
+ _has_public_ip,
+ )
+
+ assert _has_public_ip(public_ip_address) is expected
diff --git a/tests/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled_test.py b/tests/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled_test.py
new file mode 100644
index 0000000000..4335c8fa6a
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_accidental_protection_enabled/node_accidental_protection_enabled_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_accidental_protection_enabled.node_accidental_protection_enabled.node_client"
+
+
+class Test_node_accidental_protection_enabled:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_accidental_protection_enabled.node_accidental_protection_enabled import (
+ node_accidental_protection_enabled,
+ )
+
+ assert node_accidental_protection_enabled().execute() == []
+
+ def test_node_accidental_protection_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ is_accidental_protection=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_accidental_protection_enabled.node_accidental_protection_enabled import (
+ node_accidental_protection_enabled,
+ )
+
+ findings = node_accidental_protection_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_accidental_protection_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ is_accidental_protection=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_accidental_protection_enabled.node_accidental_protection_enabled import (
+ node_accidental_protection_enabled,
+ )
+
+ findings = node_accidental_protection_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled_test.py b/tests/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled_test.py
new file mode 100644
index 0000000000..b6f8a7a9ae
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_compliance_enabled/node_compliance_enabled_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_compliance_enabled.node_compliance_enabled.node_client"
+
+
+class Test_node_compliance_enabled:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_compliance_enabled.node_compliance_enabled import (
+ node_compliance_enabled,
+ )
+
+ assert node_compliance_enabled().execute() == []
+
+ def test_node_compliance_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ is_node_compliance=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_compliance_enabled.node_compliance_enabled import (
+ node_compliance_enabled,
+ )
+
+ findings = node_compliance_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_compliance_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ is_node_compliance=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_compliance_enabled.node_compliance_enabled import (
+ node_compliance_enabled,
+ )
+
+ findings = node_compliance_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled_test.py b/tests/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled_test.py
new file mode 100644
index 0000000000..698cfe008f
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_encryption_enabled/node_encryption_enabled_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_encryption_enabled.node_encryption_enabled.node_client"
+
+
+class Test_node_encryption_enabled:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_encryption_enabled.node_encryption_enabled import (
+ node_encryption_enabled,
+ )
+
+ assert node_encryption_enabled().execute() == []
+
+ def test_node_encryption_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ is_encryption_enabled=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_encryption_enabled.node_encryption_enabled import (
+ node_encryption_enabled,
+ )
+
+ findings = node_encryption_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_encryption_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ is_encryption_enabled=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_encryption_enabled.node_encryption_enabled import (
+ node_encryption_enabled,
+ )
+
+ findings = node_encryption_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned_test.py b/tests/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned_test.py
new file mode 100644
index 0000000000..ea7d8a3ccb
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_public_ip_not_assigned/node_public_ip_not_assigned_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_public_ip_not_assigned.node_public_ip_not_assigned.node_client"
+
+
+class Test_node_public_ip_not_assigned:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_public_ip_not_assigned.node_public_ip_not_assigned import (
+ node_public_ip_not_assigned,
+ )
+
+ assert node_public_ip_not_assigned().execute() == []
+
+ def test_node_public_ip_not_assigned_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ has_public_ip=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_public_ip_not_assigned.node_public_ip_not_assigned import (
+ node_public_ip_not_assigned,
+ )
+
+ findings = node_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_public_ip_not_assigned_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ has_public_ip=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_public_ip_not_assigned.node_public_ip_not_assigned import (
+ node_public_ip_not_assigned,
+ )
+
+ findings = node_public_ip_not_assigned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled_test.py b/tests/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled_test.py
new file mode 100644
index 0000000000..8c4887a85d
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_rescue_mode_disabled/node_rescue_mode_disabled_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_rescue_mode_disabled.node_rescue_mode_disabled.node_client"
+
+
+class Test_node_rescue_mode_disabled:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_rescue_mode_disabled.node_rescue_mode_disabled import (
+ node_rescue_mode_disabled,
+ )
+
+ assert node_rescue_mode_disabled().execute() == []
+
+ def test_node_rescue_mode_disabled_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ rescue_mode_status="Disabled",
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_rescue_mode_disabled.node_rescue_mode_disabled import (
+ node_rescue_mode_disabled,
+ )
+
+ findings = node_rescue_mode_disabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_rescue_mode_disabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ rescue_mode_status="Enabled",
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_rescue_mode_disabled.node_rescue_mode_disabled import (
+ node_rescue_mode_disabled,
+ )
+
+ findings = node_rescue_mode_disabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached_test.py b/tests/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached_test.py
new file mode 100644
index 0000000000..283fbddfc6
--- /dev/null
+++ b/tests/providers/e2enetworks/services/node/node_vpc_attached/node_vpc_attached_test.py
@@ -0,0 +1,82 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.node.node_service import (
+ Node,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.node.node_vpc_attached.node_vpc_attached.node_client"
+
+
+class Test_node_vpc_attached:
+ def test_no_nodes(self):
+ client = mock.MagicMock()
+ client.nodes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_vpc_attached.node_vpc_attached import (
+ node_vpc_attached,
+ )
+
+ assert node_vpc_attached().execute() == []
+
+ def test_node_vpc_attached_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="1",
+ name="ok",
+ status="Running",
+ location="Delhi",
+ vm_id="1",
+ is_vpc_attached=True,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_vpc_attached.node_vpc_attached import (
+ node_vpc_attached,
+ )
+
+ findings = node_vpc_attached().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_node_vpc_attached_non_compliant(self):
+ client = mock.MagicMock()
+ client.nodes = [
+ Node(
+ id="2",
+ name="bad",
+ status="Running",
+ location="Delhi",
+ vm_id="2",
+ is_vpc_attached=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.node.node_vpc_attached.node_vpc_attached import (
+ node_vpc_attached,
+ )
+
+ findings = node_vpc_attached().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/securitygroup/e2enetworks_securitygroup_service_test.py b/tests/providers/e2enetworks/services/securitygroup/e2enetworks_securitygroup_service_test.py
new file mode 100644
index 0000000000..f9ad45d732
--- /dev/null
+++ b/tests/providers/e2enetworks/services/securitygroup/e2enetworks_securitygroup_service_test.py
@@ -0,0 +1,71 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_service import (
+ SecurityGroups,
+)
+
+
+class TestSecurityGroupService:
+ @patch(
+ "prowler.providers.e2enetworks.services.securitygroup.securitygroup_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_security_groups_parses_rules(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = SecurityGroups.__new__(SecurityGroups)
+ service.provider = provider
+ service.client = MagicMock()
+ service.security_groups = []
+
+ service.client.get_data.return_value = [
+ {
+ "id": 10,
+ "name": "default",
+ "description": "Default security group",
+ "is_default": True,
+ "is_all_traffic_rule": True,
+ "rules": [
+ {
+ "id": 1,
+ "rule_type": "Inbound",
+ "protocol_name": "All",
+ "port_range": "1-65535",
+ "network": "0.0.0.0",
+ "network_cidr": "0",
+ }
+ ],
+ }
+ ]
+
+ service._fetch_security_groups()
+
+ assert len(service.security_groups) == 1
+ group = service.security_groups[0]
+ assert group.id == "10"
+ assert group.name == "default"
+ assert group.location == "Delhi"
+ assert group.is_default is True
+ assert group.is_all_traffic_rule is True
+ assert len(group.rules) == 1
+ assert group.rules[0].rule_type == "Inbound"
+
+ @patch(
+ "prowler.providers.e2enetworks.services.securitygroup.securitygroup_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_security_groups_ignores_non_list_response(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = SecurityGroups.__new__(SecurityGroups)
+ service.provider = provider
+ service.client = MagicMock()
+ service.security_groups = []
+
+ service.client.get_data.return_value = {"error": "unexpected"}
+
+ service._fetch_security_groups()
+
+ assert service.security_groups == []
diff --git a/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule_test.py b/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule_test.py
new file mode 100644
index 0000000000..e992bc1a3c
--- /dev/null
+++ b/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_all_traffic_rule/securitygroup_no_all_traffic_rule_test.py
@@ -0,0 +1,72 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_service import (
+ SecurityGroupResource,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_all_traffic_rule.securitygroup_no_all_traffic_rule.securitygroup_client"
+
+
+class Test_securitygroup_no_all_traffic_rule:
+ def test_no_security_groups(self):
+ client = mock.MagicMock()
+ client.security_groups = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_all_traffic_rule.securitygroup_no_all_traffic_rule import (
+ securitygroup_no_all_traffic_rule,
+ )
+
+ assert securitygroup_no_all_traffic_rule().execute() == []
+
+ def test_securitygroup_no_all_traffic_rule_compliant(self):
+ client = mock.MagicMock()
+ client.security_groups = [
+ SecurityGroupResource(
+ id="1", name="ok", location="Delhi", is_all_traffic_rule=False
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_all_traffic_rule.securitygroup_no_all_traffic_rule import (
+ securitygroup_no_all_traffic_rule,
+ )
+
+ findings = securitygroup_no_all_traffic_rule().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_securitygroup_no_all_traffic_rule_non_compliant(self):
+ client = mock.MagicMock()
+ client.security_groups = [
+ SecurityGroupResource(
+ id="2", name="bad", location="Delhi", is_all_traffic_rule=True
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_all_traffic_rule.securitygroup_no_all_traffic_rule import (
+ securitygroup_no_all_traffic_rule,
+ )
+
+ findings = securitygroup_no_all_traffic_rule().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports_test.py b/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports_test.py
new file mode 100644
index 0000000000..3634aa8aec
--- /dev/null
+++ b/tests/providers/e2enetworks/services/securitygroup/securitygroup_no_inbound_any_all_ports/securitygroup_no_inbound_any_all_ports_test.py
@@ -0,0 +1,97 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_service import (
+ SecurityGroupResource,
+ SecurityGroupRule,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_inbound_any_all_ports.securitygroup_no_inbound_any_all_ports.securitygroup_client"
+
+
+class Test_securitygroup_no_inbound_any_all_ports:
+ def test_no_security_groups(self):
+ client = mock.MagicMock()
+ client.security_groups = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_inbound_any_all_ports.securitygroup_no_inbound_any_all_ports import (
+ securitygroup_no_inbound_any_all_ports,
+ )
+
+ assert securitygroup_no_inbound_any_all_ports().execute() == []
+
+ def test_securitygroup_no_inbound_any_all_ports_compliant(self):
+ client = mock.MagicMock()
+ client.security_groups = [
+ SecurityGroupResource(
+ id="1",
+ name="ok",
+ location="Delhi",
+ rules=[
+ SecurityGroupRule(
+ id="2",
+ rule_type="inbound",
+ protocol_name="tcp",
+ port_range="443",
+ network="203.0.113.0/24",
+ network_cidr="203.0.113.0/24",
+ )
+ ],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_inbound_any_all_ports.securitygroup_no_inbound_any_all_ports import (
+ securitygroup_no_inbound_any_all_ports,
+ )
+
+ findings = securitygroup_no_inbound_any_all_ports().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_securitygroup_no_inbound_any_all_ports_non_compliant(self):
+ client = mock.MagicMock()
+ client.security_groups = [
+ SecurityGroupResource(
+ id="2",
+ name="bad",
+ location="Delhi",
+ rules=[
+ SecurityGroupRule(
+ id="1",
+ rule_type="inbound",
+ protocol_name="all",
+ port_range="",
+ network="any",
+ network_cidr="",
+ )
+ ],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_no_inbound_any_all_ports.securitygroup_no_inbound_any_all_ports import (
+ securitygroup_no_inbound_any_all_ports,
+ )
+
+ findings = securitygroup_no_inbound_any_all_ports().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default_test.py b/tests/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default_test.py
new file mode 100644
index 0000000000..fdb35608df
--- /dev/null
+++ b/tests/providers/e2enetworks/services/securitygroup/securitygroup_restrictive_default/securitygroup_restrictive_default_test.py
@@ -0,0 +1,96 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.securitygroup.securitygroup_service import (
+ NodeSecurityGroup,
+ SecurityGroupRule,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.securitygroup.securitygroup_restrictive_default.securitygroup_restrictive_default.securitygroup_client"
+
+
+class Test_securitygroup_restrictive_default:
+ def test_no_node_security_groups(self):
+ client = mock.MagicMock()
+ client.node_security_groups = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_restrictive_default.securitygroup_restrictive_default import (
+ securitygroup_restrictive_default,
+ )
+
+ assert securitygroup_restrictive_default().execute() == []
+
+ def test_securitygroup_restrictive_default_compliant(self):
+ client = mock.MagicMock()
+ client.node_security_groups = [
+ NodeSecurityGroup(
+ node_id="1",
+ node_name="ok-node",
+ vm_id="vm-1",
+ location="Delhi",
+ security_group_id="sg-1",
+ name="custom",
+ is_default=False,
+ rules=[],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_restrictive_default.securitygroup_restrictive_default import (
+ securitygroup_restrictive_default,
+ )
+
+ findings = securitygroup_restrictive_default().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_securitygroup_restrictive_default_non_compliant(self):
+ client = mock.MagicMock()
+ client.node_security_groups = [
+ NodeSecurityGroup(
+ node_id="2",
+ node_name="bad-node",
+ vm_id="vm-2",
+ location="Delhi",
+ security_group_id="sg-2",
+ name="default",
+ is_default=True,
+ rules=[
+ SecurityGroupRule(
+ id="1",
+ rule_type="inbound",
+ protocol_name="all",
+ port_range="",
+ network="any",
+ network_cidr="",
+ )
+ ],
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.securitygroup.securitygroup_restrictive_default.securitygroup_restrictive_default import (
+ securitygroup_restrictive_default,
+ )
+
+ findings = securitygroup_restrictive_default().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/storage/e2enetworks_storage_service_test.py b/tests/providers/e2enetworks/services/storage/e2enetworks_storage_service_test.py
new file mode 100644
index 0000000000..9c30d2e2c7
--- /dev/null
+++ b/tests/providers/e2enetworks/services/storage/e2enetworks_storage_service_test.py
@@ -0,0 +1,50 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.e2enetworks.services.storage.storage_service import Storage
+
+
+class TestStorageService:
+ @patch(
+ "prowler.providers.e2enetworks.services.storage.storage_service.E2eNetworksService.__init__"
+ )
+ def test_fetch_efs_and_epfs(self, mock_super_init):
+ mock_super_init.return_value = None
+
+ provider = MagicMock()
+ provider.session.locations = ["Delhi"]
+ service = Storage.__new__(Storage)
+ service.provider = provider
+ service.client = MagicMock()
+ service.block_volumes = []
+ service.efs_volumes = []
+ service.epfs_volumes = []
+
+ service.client.paginate.return_value = [
+ {
+ "id": 1396,
+ "name": "sfs-993",
+ "status": "Available",
+ "vpc_id": 6882,
+ "is_backup_enabled": True,
+ "is_all_vpc_resources_allowed": False,
+ }
+ ]
+ service.client.get.return_value = {
+ "data": [
+ {
+ "id": 145,
+ "name": "epfs-1",
+ "deleted": False,
+ "vpc": {"network_id": 34872, "name": "VPC-717"},
+ }
+ ],
+ "total_page_number": 1,
+ }
+
+ service._fetch_efs_volumes()
+ service._fetch_epfs_volumes()
+
+ assert len(service.efs_volumes) == 1
+ assert service.efs_volumes[0].is_backup_enabled is True
+ assert len(service.epfs_volumes) == 1
+ assert service.epfs_volumes[0].vpc_network_id == "34872"
diff --git a/tests/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned_test.py b/tests/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned_test.py
new file mode 100644
index 0000000000..85c51fcd73
--- /dev/null
+++ b/tests/providers/e2enetworks/services/storage/storage_block_volume_not_orphaned/storage_block_volume_not_orphaned_test.py
@@ -0,0 +1,74 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.storage.storage_service import (
+ BlockVolume,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.storage.storage_block_volume_not_orphaned.storage_block_volume_not_orphaned.storage_client"
+
+
+class Test_storage_block_volume_not_orphaned:
+ def test_no_block_volumes(self):
+ client = mock.MagicMock()
+ client.block_volumes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_block_volume_not_orphaned.storage_block_volume_not_orphaned import (
+ storage_block_volume_not_orphaned,
+ )
+
+ assert storage_block_volume_not_orphaned().execute() == []
+
+ def test_storage_block_volume_not_orphaned_compliant(self):
+ client = mock.MagicMock()
+ client.block_volumes = [
+ BlockVolume(id="1", name="ok", location="Delhi", is_attached=True),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_block_volume_not_orphaned.storage_block_volume_not_orphaned import (
+ storage_block_volume_not_orphaned,
+ )
+
+ findings = storage_block_volume_not_orphaned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_storage_block_volume_not_orphaned_non_compliant(self):
+ client = mock.MagicMock()
+ client.block_volumes = [
+ BlockVolume(
+ id="2",
+ name="bad",
+ location="Delhi",
+ status="Available",
+ is_attached=False,
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_block_volume_not_orphaned.storage_block_volume_not_orphaned import (
+ storage_block_volume_not_orphaned,
+ )
+
+ findings = storage_block_volume_not_orphaned().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled_test.py b/tests/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled_test.py
new file mode 100644
index 0000000000..7606097ca7
--- /dev/null
+++ b/tests/providers/e2enetworks/services/storage/storage_efs_backup_enabled/storage_efs_backup_enabled_test.py
@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.storage.storage_service import (
+ EfsVolume,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.storage.storage_efs_backup_enabled.storage_efs_backup_enabled.storage_client"
+
+
+class Test_storage_efs_backup_enabled:
+ def test_no_efs_volumes(self):
+ client = mock.MagicMock()
+ client.efs_volumes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_backup_enabled.storage_efs_backup_enabled import (
+ storage_efs_backup_enabled,
+ )
+
+ assert storage_efs_backup_enabled().execute() == []
+
+ def test_storage_efs_backup_enabled_compliant(self):
+ client = mock.MagicMock()
+ client.efs_volumes = [
+ EfsVolume(id="1", name="ok", location="Delhi", is_backup_enabled=True),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_backup_enabled.storage_efs_backup_enabled import (
+ storage_efs_backup_enabled,
+ )
+
+ findings = storage_efs_backup_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_storage_efs_backup_enabled_non_compliant(self):
+ client = mock.MagicMock()
+ client.efs_volumes = [
+ EfsVolume(id="2", name="bad", location="Delhi", is_backup_enabled=False),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_backup_enabled.storage_efs_backup_enabled import (
+ storage_efs_backup_enabled,
+ )
+
+ findings = storage_efs_backup_enabled().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted_test.py b/tests/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted_test.py
new file mode 100644
index 0000000000..b0c06bcf65
--- /dev/null
+++ b/tests/providers/e2enetworks/services/storage/storage_efs_vpc_access_restricted/storage_efs_vpc_access_restricted_test.py
@@ -0,0 +1,72 @@
+from unittest import mock
+
+from prowler.providers.e2enetworks.services.storage.storage_service import (
+ EfsVolume,
+)
+from tests.providers.e2enetworks.e2enetworks_fixtures import (
+ set_mocked_e2enetworks_provider,
+)
+
+CLIENT_PATH = "prowler.providers.e2enetworks.services.storage.storage_efs_vpc_access_restricted.storage_efs_vpc_access_restricted.storage_client"
+
+
+class Test_storage_efs_vpc_access_restricted:
+ def test_no_efs_volumes(self):
+ client = mock.MagicMock()
+ client.efs_volumes = []
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_vpc_access_restricted.storage_efs_vpc_access_restricted import (
+ storage_efs_vpc_access_restricted,
+ )
+
+ assert storage_efs_vpc_access_restricted().execute() == []
+
+ def test_storage_efs_vpc_access_restricted_compliant(self):
+ client = mock.MagicMock()
+ client.efs_volumes = [
+ EfsVolume(
+ id="1", name="ok", location="Delhi", is_all_vpc_resources_allowed=False
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_vpc_access_restricted.storage_efs_vpc_access_restricted import (
+ storage_efs_vpc_access_restricted,
+ )
+
+ findings = storage_efs_vpc_access_restricted().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "PASS"
+
+ def test_storage_efs_vpc_access_restricted_non_compliant(self):
+ client = mock.MagicMock()
+ client.efs_volumes = [
+ EfsVolume(
+ id="2", name="bad", location="Delhi", is_all_vpc_resources_allowed=True
+ ),
+ ]
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_e2enetworks_provider(),
+ ),
+ mock.patch(CLIENT_PATH, new=client),
+ ):
+ from prowler.providers.e2enetworks.services.storage.storage_efs_vpc_access_restricted.storage_efs_vpc_access_restricted import (
+ storage_efs_vpc_access_restricted,
+ )
+
+ findings = storage_efs_vpc_access_restricted().execute()
+ assert len(findings) == 1
+ assert findings[0].status == "FAIL"
diff --git a/tests/providers/external/__init__.py b/tests/providers/external/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/external/test_dynamic_provider_loading.py b/tests/providers/external/test_dynamic_provider_loading.py
index 78e308597d..ed367ad518 100644
--- a/tests/providers/external/test_dynamic_provider_loading.py
+++ b/tests/providers/external/test_dynamic_provider_loading.py
@@ -344,6 +344,84 @@ class TestProviderDiscovery:
assert help_text["nohelptext"] == ""
+class TestSdkOnly:
+ """The ``sdk_only`` flag (default True) and Provider.get_app_providers."""
+
+ def test_base_contract_defaults_to_sdk_only(self):
+ # The default must be True so nothing leaks into the app implicitly.
+ assert Provider.sdk_only is True
+
+ def test_external_provider_without_flag_is_sdk_only(self):
+ # FakeExternalProvider does not override the flag -> inherits True.
+ assert FakeExternalProvider.sdk_only is True
+
+ @patch("prowler.providers.common.provider.Provider.get_class")
+ @patch("prowler.providers.common.provider.Provider.get_available_providers")
+ def test_get_app_providers_filters_out_sdk_only(
+ self, mock_available, mock_get_class
+ ):
+ app_cls = type("AppProvider", (Provider,), {"sdk_only": False})
+ sdk_cls = type("SdkProvider", (Provider,), {"sdk_only": True})
+ mock_available.return_value = ["appone", "sdkone", "apptwo"]
+ mock_get_class.side_effect = lambda name: {
+ "appone": app_cls,
+ "sdkone": sdk_cls,
+ "apptwo": app_cls,
+ }[name]
+
+ app_providers = Provider.get_app_providers()
+
+ assert app_providers == ["appone", "apptwo"]
+
+ @patch("prowler.providers.common.provider.Provider.get_class")
+ @patch("prowler.providers.common.provider.Provider.get_available_providers")
+ def test_get_app_providers_excludes_provider_that_fails_to_load(
+ self, mock_available, mock_get_class
+ ):
+ # A provider whose class cannot be imported is treated as sdk_only
+ # (excluded) so a broken plug-in never leaks into the app.
+ app_cls = type("AppProvider", (Provider,), {"sdk_only": False})
+ mock_available.return_value = ["appone", "broken"]
+
+ def _get_class(name):
+ if name == "broken":
+ raise ImportError("missing transitive dep")
+ return app_cls
+
+ mock_get_class.side_effect = _get_class
+
+ assert Provider.get_app_providers() == ["appone"]
+
+ def test_app_exposed_builtins_declare_sdk_only_false(self):
+ # The providers implemented end-to-end in the API/UI must opt in.
+ app_providers = set(Provider.get_app_providers())
+ for name in (
+ "aws",
+ "azure",
+ "gcp",
+ "kubernetes",
+ "m365",
+ "github",
+ "mongodbatlas",
+ "iac",
+ "oraclecloud",
+ "alibabacloud",
+ "cloudflare",
+ "openstack",
+ "image",
+ "googleworkspace",
+ "vercel",
+ "okta",
+ ):
+ assert name in app_providers, f"{name} should be exposed to the app"
+
+ def test_sdk_only_builtins_are_hidden_from_app(self):
+ # Built-ins not implemented in the API stay SDK-only via the default.
+ app_providers = set(Provider.get_app_providers())
+ for name in ("llm", "nhn", "scaleway", "stackit"):
+ assert name not in app_providers, f"{name} must be hidden from the app"
+
+
class TestIsToolWrapperProvider:
"""Tests for Provider.is_tool_wrapper_provider — the helper that combines the
built-in EXTERNAL_TOOL_PROVIDERS frozenset with the is_external_tool_provider
@@ -1456,7 +1534,7 @@ class TestCompliance:
dirs = _get_ep_compliance_dirs()
- assert dirs["fakeexternal"] == "/path/to/compliance"
+ assert dirs["fakeexternal"] == ["/path/to/compliance"]
@patch("prowler.config.config.importlib.metadata.entry_points")
def test_get_ep_compliance_dirs_file_fallback(self, mock_ep):
@@ -1472,7 +1550,7 @@ class TestCompliance:
dirs = _get_ep_compliance_dirs()
- assert dirs["ext"] == "/path/to/compliance"
+ assert dirs["ext"] == ["/path/to/compliance"]
@patch("prowler.config.config.importlib.metadata.entry_points")
def test_get_ep_compliance_dirs_handles_load_exception(self, mock_ep):
@@ -1502,7 +1580,7 @@ class TestCompliance:
with open(json_path, "w") as f:
json.dump({"Framework": "Custom", "Provider": "ext"}, f)
- mock_dirs.return_value = {"ext": tmpdir}
+ mock_dirs.return_value = {"ext": [tmpdir]}
frameworks = get_available_compliance_frameworks("ext")
@@ -2168,6 +2246,37 @@ class TestDispatchFallbacks:
class TestBaseContractDefaults:
"""Tests for Provider base class default implementations."""
+ def test_get_scan_arguments_passes_secret_through(self):
+ """Base get_scan_arguments returns the secret unchanged when no mutelist."""
+ kwargs = FakeProviderNoHelpText.get_scan_arguments("uid", {"token": "x"})
+
+ assert kwargs == {"token": "x"}
+
+ def test_get_scan_arguments_adds_mutelist_content(self):
+ """Base get_scan_arguments adds mutelist_content when provided."""
+ kwargs = FakeProviderNoHelpText.get_scan_arguments(
+ "uid", {"token": "x"}, {"Mutelist": {}}
+ )
+
+ assert kwargs == {"token": "x", "mutelist_content": {"Mutelist": {}}}
+
+ def test_get_scan_arguments_preserves_empty_mutelist_content(self):
+ """Base get_scan_arguments passes an explicit empty mutelist through so it
+ is not mistaken for an absent mutelist that triggers provider defaults."""
+ kwargs = FakeProviderNoHelpText.get_scan_arguments("uid", {"token": "x"}, {})
+
+ assert kwargs == {"token": "x", "mutelist_content": {}}
+
+ def test_get_connection_arguments_passes_secret_through(self):
+ """Base get_connection_arguments returns the secret unchanged."""
+ kwargs = FakeProviderNoHelpText.get_connection_arguments("uid", {"token": "x"})
+
+ assert kwargs == {"token": "x"}
+
+ def test_get_credentials_schema_defaults_to_empty(self):
+ """Base get_credentials_schema declares no schema by default."""
+ assert FakeProviderNoHelpText.get_credentials_schema() == {}
+
def test_from_cli_args_raises_not_implemented(self):
"""Base Provider.from_cli_args raises NotImplementedError."""
with pytest.raises(NotImplementedError):
diff --git a/tests/providers/gcp/services/cloudfunction/__init__.py b/tests/providers/gcp/services/cloudfunction/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudstorage/cloudstorage_audit_logs_enabled/__init__.py b/tests/providers/gcp/services/cloudstorage/cloudstorage_audit_logs_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/cloudstorage/cloudstorage_uses_vpc_service_controls/__init__.py b/tests/providers/gcp/services/cloudstorage/cloudstorage_uses_vpc_service_controls/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/compute/compute_automatic_restart_enabled/__init__.py b/tests/providers/gcp/services/compute/compute_automatic_restart_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/compute/compute_instance_group_multiple_zones/__init__.py b/tests/providers/gcp/services/compute/compute_instance_group_multiple_zones/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/secretmanager/__init__.py b/tests/providers/gcp/services/secretmanager/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py b/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/gcp/services/secretmanager/secretmanager_secret_rotation_enabled/__init__.py b/tests/providers/gcp/services/secretmanager/secretmanager_secret_rotation_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py
index b4d385fdf1..c57393b314 100644
--- a/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py
@@ -155,3 +155,123 @@ class Test_repository_default_branch_deletion_disabled_test:
result[0].status_extended
== f"Repository {repo_name} does deny default branch deletion."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = Branch(
+ name="main",
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=False,
+ branch_deletion_source="ruleset",
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ )
+ now = datetime.now(timezone.utc)
+
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=default_branch,
+ private=False,
+ archived=False,
+ pushed_at=now,
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled import (
+ repository_default_branch_deletion_disabled,
+ )
+
+ check = repository_default_branch_deletion_disabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = Branch(
+ name="main",
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ branch_deletion_source="ruleset_not_active",
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ )
+ now = datetime.now(timezone.utc)
+
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=default_branch,
+ private=False,
+ archived=False,
+ pushed_at=now,
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_deletion_disabled.repository_default_branch_deletion_disabled import (
+ repository_default_branch_deletion_disabled,
+ )
+
+ check = repository_default_branch_deletion_disabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has default branch deletion disabled in a ruleset, but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py
index b35393764e..81ab6bf0cc 100644
--- a/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_disallows_force_push_test:
result[0].status_extended
== f"Repository {repo_name} does deny force pushes on default branch ({default_branch})."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ allow_force_pushes_source="ruleset",
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push import (
+ repository_default_branch_disallows_force_push,
+ )
+
+ check = repository_default_branch_disallows_force_push()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ allow_force_pushes_source="ruleset_not_active",
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_disallows_force_push.repository_default_branch_disallows_force_push import (
+ repository_default_branch_disallows_force_push,
+ )
+
+ check = repository_default_branch_disallows_force_push()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has force pushes disallowed in a ruleset on default branch ({default_branch}), but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py
index 296c3d78e5..fbc7e22d68 100644
--- a/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_protection_applies_to_admins_test:
result[0].status_extended
== f"Repository {repo_name} does enforce administrators to be subject to the same branch protection rules as other users."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ enforce_admins_source="ruleset",
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins import (
+ repository_default_branch_protection_applies_to_admins,
+ )
+
+ check = repository_default_branch_protection_applies_to_admins()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ enforce_admins_source="ruleset_not_active",
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_protection_applies_to_admins.repository_default_branch_protection_applies_to_admins import (
+ repository_default_branch_protection_applies_to_admins,
+ )
+
+ check = repository_default_branch_protection_applies_to_admins()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has a ruleset that would apply to administrators, but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
index 67bce91575..5fce4e7553 100644
--- a/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_protection_enabled_test:
result[0].status_extended
== f"Repository {repo_name} does enforce branch protection on default branch ({default_branch})."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ protected_source="ruleset",
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
+ repository_default_branch_protection_enabled,
+ )
+
+ check = repository_default_branch_protection_enabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ protected_source="ruleset_not_active",
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
+ repository_default_branch_protection_enabled,
+ )
+
+ check = repository_default_branch_protection_enabled()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has a ruleset configured on default branch ({default_branch}), but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py
index ab3d579b75..fc52676845 100644
--- a/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py
@@ -147,3 +147,117 @@ class Test_repository_default_branch_requires_codeowners_review:
result[0].status_extended
== f"Repository {repo_name} requires code owner approval for changes to owned code."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name="main",
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_code_owner_reviews_source="ruleset",
+ require_signed_commits=True,
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_codeowners_review.repository_default_branch_requires_codeowners_review.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_codeowners_review.repository_default_branch_requires_codeowners_review import (
+ repository_default_branch_requires_codeowners_review,
+ )
+
+ check = repository_default_branch_requires_codeowners_review()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name="main",
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_code_owner_reviews_source="ruleset_not_active",
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_codeowners_review.repository_default_branch_requires_codeowners_review.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_codeowners_review.repository_default_branch_requires_codeowners_review import (
+ repository_default_branch_requires_codeowners_review,
+ )
+
+ check = repository_default_branch_requires_codeowners_review()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has code owner approval configured in a ruleset, but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py
index 8f5a82bbd8..d283fd1b26 100644
--- a/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_requires_conversation_resolution_test:
result[0].status_extended
== f"Repository {repo_name} does require conversation resolution on default branch ({default_branch})."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ conversation_resolution=True,
+ conversation_resolution_source="ruleset",
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution import (
+ repository_default_branch_requires_conversation_resolution,
+ )
+
+ check = repository_default_branch_requires_conversation_resolution()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ conversation_resolution_source="ruleset_not_active",
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_conversation_resolution.repository_default_branch_requires_conversation_resolution import (
+ repository_default_branch_requires_conversation_resolution,
+ )
+
+ check = repository_default_branch_requires_conversation_resolution()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has conversation resolution configured in a ruleset on default branch ({default_branch}), but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py
index b072396804..99c6abcd29 100644
--- a/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_requires_linear_history_test:
result[0].status_extended
== f"Repository {repo_name} does require linear history on default branch ({default_branch})."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ required_linear_history_source="ruleset",
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history import (
+ repository_default_branch_requires_linear_history,
+ )
+
+ check = repository_default_branch_requires_linear_history()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ required_linear_history_source="ruleset_not_active",
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_linear_history.repository_default_branch_requires_linear_history import (
+ repository_default_branch_requires_linear_history,
+ )
+
+ check = repository_default_branch_requires_linear_history()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has linear history configured in a ruleset on default branch ({default_branch}), but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py
index ddb9e89df6..72fb5470a8 100644
--- a/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py
@@ -207,3 +207,117 @@ class Test_repository_default_branch_requires_multiple_approvals:
result[0].status_extended
== f"Repository {repo_name} does enforce at least 2 approvals for code changes."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name="main",
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=2,
+ approval_count_source="ruleset",
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+ repository_default_branch_requires_multiple_approvals,
+ )
+
+ check = repository_default_branch_requires_multiple_approvals()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name="main",
+ protected=False,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=0,
+ approval_count_source="ruleset_not_active",
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_multiple_approvals.repository_default_branch_requires_multiple_approvals import (
+ repository_default_branch_requires_multiple_approvals,
+ )
+
+ check = repository_default_branch_requires_multiple_approvals()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has at least 2 approvals configured in a ruleset, but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py
index 5785dd2a14..0f6f0112a7 100644
--- a/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py
@@ -149,3 +149,119 @@ class Test_repository_default_branch_requires_signed_commits:
result[0].status_extended
== f"Repository {repo_name} does require signed commits on default branch ({default_branch})."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=True,
+ default_branch=True,
+ require_pull_request=True,
+ approval_count=1,
+ required_linear_history=True,
+ allow_force_pushes=False,
+ branch_deletion=False,
+ status_checks=True,
+ enforce_admins=True,
+ require_code_owner_reviews=True,
+ require_signed_commits=True,
+ require_signed_commits_source="ruleset",
+ conversation_resolution=True,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=True,
+ secret_scanning_enabled=True,
+ dependabot_alerts_enabled=True,
+ delete_branch_on_merge=True,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_signed_commits.repository_default_branch_requires_signed_commits.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_signed_commits.repository_default_branch_requires_signed_commits import (
+ repository_default_branch_requires_signed_commits,
+ )
+
+ check = repository_default_branch_requires_signed_commits()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ require_signed_commits_source="ruleset_not_active",
+ conversation_resolution=False,
+ ),
+ private=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_requires_signed_commits.repository_default_branch_requires_signed_commits.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_requires_signed_commits.repository_default_branch_requires_signed_commits import (
+ repository_default_branch_requires_signed_commits,
+ )
+
+ check = repository_default_branch_requires_signed_commits()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has signed commits configured in a ruleset on default branch ({default_branch}), but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py
index 1ec8acc3e0..da36b36865 100644
--- a/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py
+++ b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py
@@ -151,3 +151,121 @@ class Test_repository_default_branch_status_checks_required_test:
result[0].status_extended
== f"Repository {repo_name} does enforce status checks."
)
+
+ def test_active_ruleset_passes(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ private=False,
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=True,
+ status_checks_source="ruleset",
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ status_checks=True,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ securitymd=True,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required import (
+ repository_default_branch_status_checks_required,
+ )
+
+ check = repository_default_branch_status_checks_required()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+
+ def test_inactive_ruleset_fails(self):
+ repository_client = mock.MagicMock
+ repo_name = "repo1"
+ default_branch = "main"
+ repository_client.repositories = {
+ 1: Repo(
+ id=1,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/repo1",
+ default_branch=Branch(
+ name=default_branch,
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ status_checks_source="ruleset_not_active",
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ status_checks=False,
+ archived=False,
+ pushed_at=datetime.now(timezone.utc),
+ private=False,
+ securitymd=False,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ dependabot_alerts_enabled=False,
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_default_branch_status_checks_required.repository_default_branch_status_checks_required import (
+ repository_default_branch_status_checks_required,
+ )
+
+ check = repository_default_branch_status_checks_required()
+ result = check.execute()
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == f"Repository {repo_name} has status checks configured in a ruleset, but the ruleset is not active."
+ )
diff --git a/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py b/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py
index a181ec8404..d56aed307e 100644
--- a/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py
+++ b/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py
@@ -145,3 +145,55 @@ class Test_repository_has_codeowners_file:
result[0].status_extended
== f"Repository {repo_name} does have a CODEOWNERS file."
)
+
+ def test_archived_repository_no_codeowners_is_skipped(self):
+ repository_client = mock.MagicMock
+ repo_name = "archived-repo"
+ repository_client.repositories = {
+ 3: Repo(
+ id=3,
+ name=repo_name,
+ owner="account-name",
+ full_name="account-name/archived-repo",
+ default_branch=Branch(
+ name="main",
+ protected=False,
+ default_branch=True,
+ require_pull_request=False,
+ approval_count=0,
+ required_linear_history=False,
+ allow_force_pushes=True,
+ branch_deletion=True,
+ status_checks=False,
+ enforce_admins=False,
+ require_code_owner_reviews=False,
+ require_signed_commits=False,
+ conversation_resolution=False,
+ ),
+ private=False,
+ securitymd=True,
+ codeowners_exists=False,
+ secret_scanning_enabled=False,
+ archived=True,
+ pushed_at=datetime.now(timezone.utc),
+ delete_branch_on_merge=False,
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_github_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.github.services.repository.repository_has_codeowners_file.repository_has_codeowners_file.repository_client",
+ new=repository_client,
+ ),
+ ):
+ from prowler.providers.github.services.repository.repository_has_codeowners_file.repository_has_codeowners_file import (
+ repository_has_codeowners_file,
+ )
+
+ check = repository_has_codeowners_file()
+ result = check.execute()
+ assert len(result) == 0
diff --git a/tests/providers/github/services/repository/repository_service_test.py b/tests/providers/github/services/repository/repository_service_test.py
index 97924cbbd8..d0f3573e49 100644
--- a/tests/providers/github/services/repository/repository_service_test.py
+++ b/tests/providers/github/services/repository/repository_service_test.py
@@ -464,7 +464,7 @@ class Test_Repository_ErrorHandling:
assert "Rate limit exceeded" in str(mock_logger.error.call_args)
-class Test_Repository_DismissStaleReviewsRulesets:
+class Test_Repository_BranchProtectionRulesets:
def setup_method(self):
self.repository_service = Repository.__new__(Repository)
self.repository_service.provider = set_mocked_github_provider()
@@ -550,6 +550,27 @@ class Test_Repository_DismissStaleReviewsRulesets:
],
}
+ def _build_ruleset(
+ self,
+ *,
+ enforcement,
+ include,
+ rules,
+ bypass_actors=None,
+ ruleset_id=201,
+ ):
+ return {
+ "id": ruleset_id,
+ "name": "Branch protection ruleset",
+ "target": "branch",
+ "source_type": "Repository",
+ "source": "owner1/repo1",
+ "enforcement": enforcement,
+ "bypass_actors": bypass_actors or [],
+ "conditions": {"ref_name": {"include": include, "exclude": []}},
+ "rules": rules,
+ }
+
def test_process_repository_uses_classic_branch_protection(self):
repo = self._build_repo(branch_protected=True, dismiss_stale_reviews=True)
repos = {}
@@ -606,3 +627,320 @@ class Test_Repository_DismissStaleReviewsRulesets:
assert (
repos[1].default_branch.dismiss_stale_reviews_source == "ruleset_not_active"
)
+
+ def test_ruleset_non_fast_forward_disallows_force_push(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.allow_force_pushes is False
+ assert repos[1].default_branch.allow_force_pushes_source == "ruleset"
+
+ def test_ruleset_non_fast_forward_inactive_keeps_force_push_allowed(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="disabled",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.allow_force_pushes is True
+ assert repos[1].default_branch.allow_force_pushes_source == "ruleset_not_active"
+
+ def test_classic_protection_takes_precedence_over_inactive_ruleset(self):
+ # Classic protection already disallows force pushes, so an inactive ruleset
+ # must not downgrade the result.
+ repo = self._build_repo(
+ branch_protected=True,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="disabled",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.allow_force_pushes is False
+ assert repos[1].default_branch.allow_force_pushes_source == "classic"
+
+ def test_ruleset_required_signatures_requires_signed_commits(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "required_signatures"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.require_signed_commits is True
+ assert repos[1].default_branch.require_signed_commits_source == "ruleset"
+
+ def test_ruleset_required_linear_history(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "required_linear_history"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.required_linear_history is True
+ assert repos[1].default_branch.required_linear_history_source == "ruleset"
+
+ def test_ruleset_required_status_checks(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[
+ {
+ "type": "required_status_checks",
+ "parameters": {
+ "required_status_checks": [{"context": "ci/build"}],
+ "strict_required_status_checks_policy": True,
+ },
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.status_checks is True
+ assert repos[1].default_branch.status_checks_source == "ruleset"
+
+ def test_ruleset_required_status_checks_without_configured_checks(self):
+ # A required_status_checks rule with an empty list enforces nothing, so it
+ # must not be treated as a passing status-checks requirement.
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[
+ {
+ "type": "required_status_checks",
+ "parameters": {
+ "required_status_checks": [],
+ "strict_required_status_checks_policy": True,
+ },
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.status_checks is False
+ assert repos[1].default_branch.status_checks_source is None
+
+ def test_ruleset_deletion_disables_branch_deletion(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "deletion"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.branch_deletion is False
+ assert repos[1].default_branch.branch_deletion_source == "ruleset"
+
+ def test_active_ruleset_marks_default_branch_protected(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.protected is True
+ assert repos[1].default_branch.protected_source == "ruleset"
+
+ def test_ruleset_pull_request_parameters_map_to_attributes(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[
+ {
+ "type": "pull_request",
+ "parameters": {
+ "dismiss_stale_reviews_on_push": False,
+ "require_code_owner_review": True,
+ "require_last_push_approval": False,
+ "required_approving_review_count": 2,
+ "required_review_thread_resolution": True,
+ },
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ branch = repos[1].default_branch
+ assert branch.require_pull_request is True
+ assert branch.require_pull_request_source == "ruleset"
+ assert branch.require_code_owner_reviews is True
+ assert branch.require_code_owner_reviews_source == "ruleset"
+ assert branch.conversation_resolution is True
+ assert branch.conversation_resolution_source == "ruleset"
+ assert branch.approval_count == 2
+ assert branch.approval_count_source == "ruleset"
+
+ def test_inactive_ruleset_approval_count_is_fail_signal(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="disabled",
+ include=["~DEFAULT_BRANCH"],
+ rules=[
+ {
+ "type": "pull_request",
+ "parameters": {
+ "required_approving_review_count": 2,
+ },
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.approval_count == 0
+ assert repos[1].default_branch.approval_count_source == "ruleset_not_active"
+
+ def test_active_ruleset_without_bypass_actors_applies_to_admins(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ bypass_actors=[],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.enforce_admins is True
+ assert repos[1].default_branch.enforce_admins_source == "ruleset"
+
+ def test_active_ruleset_with_bypass_actors_does_not_apply_to_admins(self):
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="active",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ bypass_actors=[
+ {
+ "actor_id": 1,
+ "actor_type": "RepositoryRole",
+ "bypass_mode": "always",
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ # Admins can bypass, so the rulesets do not enforce protection for them.
+ assert repos[1].default_branch.enforce_admins is False
+ assert repos[1].default_branch.enforce_admins_source is None
+
+ def test_inactive_ruleset_with_bypass_actors_is_not_admin_fail_signal(self):
+ # A disabled ruleset that has bypass actors would not apply to admins even if
+ # activated, so it must not raise the enforce-admins ruleset_not_active signal.
+ repo = self._build_repo(
+ branch_protected=False,
+ ruleset_details=[
+ self._build_ruleset(
+ enforcement="disabled",
+ include=["~DEFAULT_BRANCH"],
+ rules=[{"type": "non_fast_forward"}],
+ bypass_actors=[
+ {
+ "actor_id": 1,
+ "actor_type": "RepositoryRole",
+ "bypass_mode": "always",
+ }
+ ],
+ )
+ ],
+ )
+ repos = {}
+
+ self.repository_service._process_repository(repo, repos)
+
+ assert repos[1].default_branch.enforce_admins is False
+ assert repos[1].default_branch.enforce_admins_source is None
+ # The branch is still reported as protected-but-inactive regardless of bypass.
+ assert repos[1].default_branch.protected_source == "ruleset_not_active"
diff --git a/tests/providers/image/lib/__init__.py b/tests/providers/image/lib/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/image/lib/registry/__init__.py b/tests/providers/image/lib/registry/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/kubernetes/services/core/conftest.py b/tests/providers/kubernetes/services/core/conftest.py
index 9b0becd33c..89add32aa9 100644
--- a/tests/providers/kubernetes/services/core/conftest.py
+++ b/tests/providers/kubernetes/services/core/conftest.py
@@ -13,6 +13,7 @@ def make_container(
resources=None,
liveness_probe=None,
readiness_probe=None,
+ security_context=None,
):
return Container(
name=name,
@@ -20,7 +21,7 @@ def make_container(
command=None,
ports=None,
env=None,
- security_context={},
+ security_context=security_context if security_context is not None else {},
resources=resources,
liveness_probe=liveness_probe,
readiness_probe=readiness_probe,
@@ -31,6 +32,7 @@ def make_pod(
containers=None,
init_containers=None,
ephemeral_containers=None,
+ volumes=None,
name="test-pod",
uid="test-pod-uid",
):
@@ -52,6 +54,7 @@ def make_pod(
containers=containers or {},
init_containers=init_containers or {},
ephemeral_containers=ephemeral_containers or {},
+ volumes=volumes,
)
diff --git a/tests/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts_test.py b/tests/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts_test.py
new file mode 100644
index 0000000000..586abac5ec
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_minimize_hostpath_volume_mounts/core_minimize_hostpath_volume_mounts_test.py
@@ -0,0 +1,91 @@
+from kubernetes import client
+from prowler.providers.kubernetes.services.core.core_service import Core
+from tests.providers.kubernetes.services.core.conftest import (
+ make_core_client,
+ make_pod,
+ run_check,
+)
+
+MODULE = (
+ "prowler.providers.kubernetes.services.core."
+ "core_minimize_hostpath_volume_mounts.core_minimize_hostpath_volume_mounts"
+)
+CLASS = "core_minimize_hostpath_volume_mounts"
+
+
+class TestCoreMinimizeHostpathVolumeMounts:
+ def test_build_volumes_maps_kubernetes_hostpath_volume(self):
+ volumes = Core._build_volumes(
+ [
+ client.V1Volume(
+ name="host-logs",
+ host_path=client.V1HostPathVolumeSource(
+ path="/var/log",
+ type="Directory",
+ ),
+ )
+ ]
+ )
+
+ assert volumes == [
+ {
+ "name": "host-logs",
+ "host_path": {"path": "/var/log", "type": "Directory"},
+ }
+ ]
+
+ def test_no_resources(self):
+ result = run_check(MODULE, CLASS, make_core_client({}))
+
+ assert len(result) == 0
+
+ def test_no_hostpath_volumes_pass(self):
+ pod = make_pod(
+ volumes=[
+ {"name": "config", "host_path": None},
+ {"name": "scratch", "host_path": None},
+ ]
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended == "Pod test-pod does not use hostPath volumes."
+ )
+
+ def test_hostpath_volume_fails(self):
+ pod = make_pod(
+ volumes=[
+ {
+ "name": "host-logs",
+ "host_path": {"path": "/var/log", "type": "Directory"},
+ }
+ ]
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended == "Pod test-pod uses hostPath volume host-logs."
+ )
+
+ def test_mixed_volumes_fail_on_hostpath(self):
+ pod = make_pod(
+ volumes=[
+ {"name": "config", "host_path": None},
+ {
+ "name": "host-socket",
+ "host_path": {"path": "/var/run/docker.sock", "type": "Socket"},
+ },
+ ]
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod uses hostPath volume host-socket."
+ )
diff --git a/tests/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled_test.py b/tests/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled_test.py
new file mode 100644
index 0000000000..352c08dc85
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_readonly_root_filesystem_enabled/core_readonly_root_filesystem_enabled_test.py
@@ -0,0 +1,126 @@
+from tests.providers.kubernetes.services.core.conftest import (
+ make_container,
+ make_core_client,
+ make_pod,
+ run_check,
+)
+
+MODULE = "prowler.providers.kubernetes.services.core.core_readonly_root_filesystem_enabled.core_readonly_root_filesystem_enabled"
+CLASS = "core_readonly_root_filesystem_enabled"
+
+
+class TestCoreReadonlyRootFilesystemEnabled:
+ def test_no_resources(self):
+ result = run_check(MODULE, CLASS, make_core_client({}))
+
+ assert len(result) == 0
+
+ def test_readonly_root_filesystem_enabled_pass(self):
+ pod = make_pod(
+ containers={
+ "app": make_container(
+ security_context={"read_only_root_filesystem": True}
+ )
+ }
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod has read-only root filesystem enabled for all containers."
+ )
+
+ def test_readonly_root_filesystem_false_fail(self):
+ pod = make_pod(
+ containers={
+ "app": make_container(
+ security_context={"read_only_root_filesystem": False}
+ )
+ }
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod container app does not have readOnlyRootFilesystem set to true."
+ )
+
+ def test_readonly_root_filesystem_unset_fail(self):
+ pod = make_pod(containers={"app": make_container(security_context={})})
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod container app does not have readOnlyRootFilesystem set to true."
+ )
+
+ def test_mixed_containers_fail(self):
+ pod = make_pod(
+ containers={
+ "app": make_container(
+ name="app",
+ security_context={"read_only_root_filesystem": True},
+ ),
+ "sidecar": make_container(
+ name="sidecar",
+ security_context={"read_only_root_filesystem": False},
+ ),
+ }
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod container sidecar does not have readOnlyRootFilesystem set to true."
+ )
+
+ def test_init_container_missing_readonly_root_filesystem_fails(self):
+ pod = make_pod(
+ containers={
+ "app": make_container(
+ security_context={"read_only_root_filesystem": True}
+ )
+ },
+ init_containers={
+ "init": make_container(name="init", security_context=None)
+ },
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod container init does not have readOnlyRootFilesystem set to true."
+ )
+
+ def test_ephemeral_container_missing_readonly_root_filesystem_fails(self):
+ pod = make_pod(
+ containers={
+ "app": make_container(
+ security_context={"read_only_root_filesystem": True}
+ )
+ },
+ ephemeral_containers={
+ "debug": make_container(name="debug", security_context={})
+ },
+ )
+
+ result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+ assert result[0].status == "FAIL"
+ assert (
+ result[0].status_extended
+ == "Pod test-pod container debug does not have readOnlyRootFilesystem set to true."
+ )
diff --git a/tests/providers/kubernetes/services/core/core_service_test.py b/tests/providers/kubernetes/services/core/core_service_test.py
new file mode 100644
index 0000000000..5fef91159c
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_service_test.py
@@ -0,0 +1,64 @@
+from kubernetes import client
+from prowler.providers.kubernetes.services.core.core_service import Core, Pod
+
+
+def test_pod_model_preserves_core_service_container_groups():
+ containers = Core._build_containers(
+ [
+ client.V1Container(
+ name="app",
+ image="nginx:1.25",
+ security_context=client.V1SecurityContext(
+ read_only_root_filesystem=True
+ ),
+ )
+ ]
+ )
+ init_containers = Core._build_containers(
+ [
+ client.V1Container(
+ name="init",
+ image="busybox:1.36",
+ security_context=client.V1SecurityContext(
+ read_only_root_filesystem=True
+ ),
+ )
+ ]
+ )
+ ephemeral_containers = Core._build_containers(
+ [
+ client.V1EphemeralContainer(
+ name="debug",
+ image="busybox:1.36",
+ security_context=client.V1SecurityContext(
+ read_only_root_filesystem=True
+ ),
+ )
+ ]
+ )
+
+ pod = Pod(
+ name="test-pod",
+ uid="test-pod-uid",
+ namespace="default",
+ labels=None,
+ annotations=None,
+ node_name=None,
+ service_account=None,
+ status_phase="Running",
+ pod_ip="10.0.0.1",
+ host_ip="192.168.1.1",
+ host_pid=False,
+ host_ipc=False,
+ host_network=False,
+ security_context={},
+ containers=containers,
+ init_containers=init_containers,
+ ephemeral_containers=ephemeral_containers,
+ )
+
+ assert list(pod.containers) == ["app"]
+ assert list(pod.init_containers) == ["init"]
+ assert list(pod.ephemeral_containers) == ["debug"]
+ assert "init" not in pod.containers
+ assert "debug" not in pod.containers
diff --git a/tests/providers/m365/services/defenderidentity/__init__.py b/tests/providers/m365/services/defenderidentity/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/m365/services/defenderidentity/defenderidentity_health_issues_no_open/__init__.py b/tests/providers/m365/services/defenderidentity/defenderidentity_health_issues_no_open/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/m365/services/defenderxdr/__init__.py b/tests/providers/m365/services/defenderxdr/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/m365/services/defenderxdr/defenderxdr_endpoint_privileged_user_exposed_credentials/__init__.py b/tests/providers/m365/services/defenderxdr/defenderxdr_endpoint_privileged_user_exposed_credentials/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted_test.py b/tests/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted_test.py
new file mode 100644
index 0000000000..db2c68be69
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_conditional_access_policy_groups_management_restricted/entra_conditional_access_policy_groups_management_restricted_test.py
@@ -0,0 +1,269 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.m365.services.entra.entra_service import (
+ ApplicationEnforcedRestrictions,
+ ApplicationsConditions,
+ ConditionalAccessGrantControl,
+ ConditionalAccessPolicy,
+ ConditionalAccessPolicyState,
+ Conditions,
+ GrantControlOperator,
+ GrantControls,
+ Group,
+ PersistentBrowser,
+ SessionControls,
+ SignInFrequency,
+ SignInFrequencyInterval,
+ UsersConditions,
+)
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+CHECK_MODULE = (
+ "prowler.providers.m365.services.entra."
+ "entra_conditional_access_policy_groups_management_restricted."
+ "entra_conditional_access_policy_groups_management_restricted.entra_client"
+)
+
+
+def _make_policy(
+ included_groups=None,
+ excluded_groups=None,
+ state=ConditionalAccessPolicyState.ENABLED,
+ display_name="Conditional Access Policy",
+):
+ return ConditionalAccessPolicy(
+ id=str(uuid4()),
+ display_name=display_name,
+ conditions=Conditions(
+ application_conditions=ApplicationsConditions(
+ included_applications=["All"],
+ excluded_applications=[],
+ included_user_actions=[],
+ ),
+ user_conditions=UsersConditions(
+ included_groups=included_groups or [],
+ excluded_groups=excluded_groups or [],
+ included_users=["All"],
+ excluded_users=[],
+ included_roles=[],
+ excluded_roles=[],
+ ),
+ client_app_types=[],
+ user_risk_levels=[],
+ ),
+ grant_controls=GrantControls(
+ built_in_controls=[ConditionalAccessGrantControl.MFA],
+ operator=GrantControlOperator.OR,
+ authentication_strength=None,
+ ),
+ session_controls=SessionControls(
+ persistent_browser=PersistentBrowser(is_enabled=False, mode="always"),
+ sign_in_frequency=SignInFrequency(
+ is_enabled=False,
+ frequency=None,
+ type=None,
+ interval=SignInFrequencyInterval.EVERY_TIME,
+ ),
+ application_enforced_restrictions=ApplicationEnforcedRestrictions(
+ is_enabled=False
+ ),
+ ),
+ state=state,
+ )
+
+
+def _entra_client_mock():
+ client = mock.MagicMock()
+ client.audited_tenant = "audited_tenant"
+ client.audited_domain = DOMAIN
+ client.groups = []
+ client.conditional_access_policies = {}
+ return client
+
+
+class Test_entra_conditional_access_policy_groups_management_restricted:
+ def test_no_enabled_or_report_only_policy_references_groups(self):
+ entra_client = _entra_client_mock()
+ entra_client.conditional_access_policies = {
+ "policy-1": _make_policy(state=ConditionalAccessPolicyState.DISABLED)
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(CHECK_MODULE, new=entra_client),
+ ):
+ from prowler.providers.m365.services.entra.entra_conditional_access_policy_groups_management_restricted.entra_conditional_access_policy_groups_management_restricted import (
+ entra_conditional_access_policy_groups_management_restricted,
+ )
+
+ check = entra_conditional_access_policy_groups_management_restricted()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "No enabled or report-only Conditional Access Policy references groups."
+ )
+ assert result[0].resource_id == "conditionalAccessPolicies"
+ assert result[0].resource_name == "Conditional Access Policies"
+ assert result[0].location == "global"
+
+ def test_policy_without_user_conditions_is_treated_as_no_referenced_groups(self):
+ entra_client = _entra_client_mock()
+ policy = _make_policy(display_name="Policy Without User Conditions")
+ policy.conditions.user_conditions = None
+ entra_client.conditional_access_policies = {"policy-1": policy}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(CHECK_MODULE, new=entra_client),
+ ):
+ from prowler.providers.m365.services.entra.entra_conditional_access_policy_groups_management_restricted.entra_conditional_access_policy_groups_management_restricted import (
+ entra_conditional_access_policy_groups_management_restricted,
+ )
+
+ check = entra_conditional_access_policy_groups_management_restricted()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == "No enabled or report-only Conditional Access Policy references groups."
+ )
+
+ def test_all_referenced_groups_are_protected(self):
+ entra_client = _entra_client_mock()
+ entra_client.groups = [
+ Group(
+ id="group-1",
+ name="Restricted Group",
+ groupTypes=[],
+ membershipRule=None,
+ is_management_restricted=True,
+ ),
+ Group(
+ id="group-2",
+ name="Role Assignable Group",
+ groupTypes=[],
+ membershipRule=None,
+ is_assignable_to_role=True,
+ ),
+ ]
+ entra_client.conditional_access_policies = {
+ "policy-1": _make_policy(
+ included_groups=["group-1"],
+ excluded_groups=["group-2"],
+ display_name="Protected Policy",
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(CHECK_MODULE, new=entra_client),
+ ):
+ from prowler.providers.m365.services.entra.entra_conditional_access_policy_groups_management_restricted.entra_conditional_access_policy_groups_management_restricted import (
+ entra_conditional_access_policy_groups_management_restricted,
+ )
+
+ check = entra_conditional_access_policy_groups_management_restricted()
+ result = check.execute()
+
+ assert len(result) == 2
+ assert {report.status for report in result} == {"PASS"}
+ assert {report.resource_id for report in result} == {"group-1", "group-2"}
+ for report in result:
+ assert "is management-restricted or role-assignable" in (
+ report.status_extended
+ )
+
+ def test_unprotected_group_fails_with_include_and_exclude_usage(self):
+ entra_client = _entra_client_mock()
+ entra_client.groups = [
+ Group(
+ id="group-1",
+ name="Unprotected Group",
+ groupTypes=[],
+ membershipRule=None,
+ )
+ ]
+ entra_client.conditional_access_policies = {
+ "policy-1": _make_policy(
+ included_groups=["group-1"],
+ display_name="Include Policy",
+ ),
+ "policy-2": _make_policy(
+ excluded_groups=["group-1"],
+ state=ConditionalAccessPolicyState.ENABLED_FOR_REPORTING,
+ display_name="Report Only Exclusion Policy",
+ ),
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(CHECK_MODULE, new=entra_client),
+ ):
+ from prowler.providers.m365.services.entra.entra_conditional_access_policy_groups_management_restricted.entra_conditional_access_policy_groups_management_restricted import (
+ entra_conditional_access_policy_groups_management_restricted,
+ )
+
+ check = entra_conditional_access_policy_groups_management_restricted()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == "group-1"
+ assert result[0].resource_name == "Unprotected Group"
+ assert "Group Unprotected Group (group-1)" in result[0].status_extended
+ assert (
+ "neither management-restricted nor role-assignable"
+ in result[0].status_extended
+ )
+ assert "include policies: Include Policy" in result[0].status_extended
+ assert (
+ "exclude policies: Report Only Exclusion Policy"
+ in result[0].status_extended
+ )
+
+ def test_unresolved_group_reference_is_manual(self):
+ entra_client = _entra_client_mock()
+ entra_client.conditional_access_policies = {
+ "policy-1": _make_policy(
+ excluded_groups=["deleted-group"],
+ display_name="Policy With Stale Group",
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(CHECK_MODULE, new=entra_client),
+ ):
+ from prowler.providers.m365.services.entra.entra_conditional_access_policy_groups_management_restricted.entra_conditional_access_policy_groups_management_restricted import (
+ entra_conditional_access_policy_groups_management_restricted,
+ )
+
+ check = entra_conditional_access_policy_groups_management_restricted()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert result[0].resource_id == "deleted-group"
+ assert "could not be resolved" in result[0].status_extended
+ assert "exclude policies: Policy With Stale Group" in result[0].status_extended
diff --git a/tests/providers/m365/services/entra/entra_conditional_access_policy_mdm_compliant_device_required/__init__.py b/tests/providers/m365/services/entra/entra_conditional_access_policy_mdm_compliant_device_required/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
index ba6247c7bd..fb8a5e5e82 100644
--- a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
+++ b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
@@ -1,40 +1,41 @@
import asyncio
+import importlib
from datetime import datetime, timezone
from types import SimpleNamespace
from unittest.mock import AsyncMock, MagicMock, patch
from prowler.providers.m365.models import M365IdentityInfo
-from prowler.providers.m365.services.entra.entra_service import (
- AdminConsentPolicy,
- AdminRoles,
- ApplicationEnforcedRestrictions,
- ApplicationsConditions,
- AppManagementRestrictions,
- AuthorizationPolicy,
- AuthPolicyRoles,
- ConditionalAccessGrantControl,
- ConditionalAccessPolicy,
- ConditionalAccessPolicyState,
- Conditions,
- CredentialRestriction,
- DefaultAppManagementPolicy,
- DefaultUserRolePermissions,
- Entra,
- GrantControlOperator,
- GrantControls,
- InvitationsFrom,
- Organization,
- PersistentBrowser,
- SessionControls,
- SignInFrequency,
- SignInFrequencyInterval,
- SignInFrequencyType,
- User,
- UserAction,
- UsersConditions,
-)
+from prowler.providers.m365.services.entra import entra_service
from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+AdminConsentPolicy = entra_service.AdminConsentPolicy
+AdminRoles = entra_service.AdminRoles
+ApplicationEnforcedRestrictions = entra_service.ApplicationEnforcedRestrictions
+ApplicationsConditions = entra_service.ApplicationsConditions
+AppManagementRestrictions = entra_service.AppManagementRestrictions
+AuthorizationPolicy = entra_service.AuthorizationPolicy
+AuthPolicyRoles = entra_service.AuthPolicyRoles
+ConditionalAccessGrantControl = entra_service.ConditionalAccessGrantControl
+ConditionalAccessPolicy = entra_service.ConditionalAccessPolicy
+ConditionalAccessPolicyState = entra_service.ConditionalAccessPolicyState
+Conditions = entra_service.Conditions
+CredentialRestriction = entra_service.CredentialRestriction
+DefaultAppManagementPolicy = entra_service.DefaultAppManagementPolicy
+DefaultUserRolePermissions = entra_service.DefaultUserRolePermissions
+Entra = entra_service.Entra
+GrantControlOperator = entra_service.GrantControlOperator
+GrantControls = entra_service.GrantControls
+InvitationsFrom = entra_service.InvitationsFrom
+Organization = entra_service.Organization
+PersistentBrowser = entra_service.PersistentBrowser
+SessionControls = entra_service.SessionControls
+SignInFrequency = entra_service.SignInFrequency
+SignInFrequencyInterval = entra_service.SignInFrequencyInterval
+SignInFrequencyType = entra_service.SignInFrequencyType
+User = entra_service.User
+UserAction = entra_service.UserAction
+UsersConditions = entra_service.UsersConditions
+
async def mock_entra_get_authorization_policy(_):
return AuthorizationPolicy(
@@ -697,9 +698,12 @@ class Test_Entra_Service:
a descriptive error message naming the missing AuditLog.Read.All permission.
"""
from msgraph.generated.models.o_data_errors.main_error import MainError
- from msgraph.generated.models.o_data_errors.o_data_error import ODataError
- odata_error = ODataError()
+ o_data_error = importlib.import_module(
+ "msgraph.generated.models.o_data_errors.o_data_error"
+ )
+
+ odata_error = o_data_error.ODataError()
odata_error.error = MainError()
odata_error.error.code = "Authorization_RequestDenied"
@@ -879,6 +883,134 @@ class Test_Entra_Service:
assert merged.password_credentials[0].display_name == "app-level-secret"
assert merged.password_credentials[0].is_active()
+ def test__get_exchange_mailbox_permission_service_principals(self):
+ """Service principals with Exchange Graph application roles are returned."""
+ graph_sp_id = "graph-sp-id"
+ mail_read_role_id = "11111111-1111-1111-1111-111111111111"
+ user_read_role_id = "22222222-2222-2222-2222-222222222222"
+
+ graph_sp = SimpleNamespace(
+ id=graph_sp_id,
+ display_name="Microsoft Graph",
+ app_id="00000003-0000-0000-c000-000000000000",
+ app_owner_organization_id="f8cdef31-a31e-4b4a-93e4-5f571e91255a",
+ app_roles=[
+ SimpleNamespace(
+ id=mail_read_role_id,
+ value="Mail.Read",
+ allowed_member_types=["Application"],
+ ),
+ SimpleNamespace(
+ id=user_read_role_id,
+ value="User.Read.All",
+ allowed_member_types=["Application"],
+ ),
+ ],
+ account_enabled=True,
+ service_principal_type="Application",
+ )
+ mailbox_app = SimpleNamespace(
+ id="sp-mailbox",
+ display_name="Mailbox App",
+ app_id="app-mailbox",
+ app_owner_organization_id="33333333-3333-3333-3333-333333333333",
+ app_roles=[],
+ account_enabled=True,
+ service_principal_type="Application",
+ )
+ disabled_app = SimpleNamespace(
+ id="sp-disabled",
+ display_name="Disabled App",
+ app_id="app-disabled",
+ app_owner_organization_id="33333333-3333-3333-3333-333333333333",
+ app_roles=[],
+ account_enabled=False,
+ service_principal_type="Application",
+ )
+ first_party_app = SimpleNamespace(
+ id="sp-first-party",
+ display_name="Microsoft App",
+ app_id="app-first-party",
+ app_owner_organization_id="f8cdef31-a31e-4b4a-93e4-5f571e91255a",
+ app_roles=[],
+ account_enabled=True,
+ service_principal_type="Application",
+ )
+
+ app_role_assignments = {
+ "sp-mailbox": SimpleNamespace(
+ value=[
+ SimpleNamespace(
+ resource_id=graph_sp_id,
+ app_role_id=mail_read_role_id,
+ ),
+ SimpleNamespace(
+ resource_id=graph_sp_id,
+ app_role_id=user_read_role_id,
+ ),
+ ],
+ odata_next_link=None,
+ )
+ }
+
+ def by_service_principal_id(service_principal_id):
+ return SimpleNamespace(
+ app_role_assignments=SimpleNamespace(
+ get=AsyncMock(
+ return_value=app_role_assignments.get(
+ service_principal_id,
+ SimpleNamespace(value=[], odata_next_link=None),
+ )
+ ),
+ with_url=MagicMock(),
+ )
+ )
+
+ entra_service = Entra.__new__(Entra)
+ entra_service.client = SimpleNamespace(
+ service_principals=SimpleNamespace(
+ get=AsyncMock(
+ return_value=SimpleNamespace(
+ value=[graph_sp, mailbox_app, disabled_app, first_party_app],
+ odata_next_link=None,
+ )
+ ),
+ with_url=MagicMock(),
+ by_service_principal_id=MagicMock(side_effect=by_service_principal_id),
+ )
+ )
+
+ result = asyncio.run(
+ entra_service._get_exchange_mailbox_permission_service_principals()
+ )
+
+ assert set(result.keys()) == {"sp-mailbox"}
+ assert result["sp-mailbox"].app_id == "app-mailbox"
+ assert result["sp-mailbox"].exchange_mailbox_permissions == ["Mail.Read"]
+
+ def test__get_exchange_mailbox_permission_service_principals_records_error(self):
+ """
+ Graph collection failures preserve unavailable state separately from empty results.
+ """
+ entra_service = Entra.__new__(Entra)
+ entra_service.client = SimpleNamespace(
+ service_principals=SimpleNamespace(
+ get=AsyncMock(side_effect=RuntimeError("Graph unavailable"))
+ )
+ )
+
+ result = asyncio.run(
+ entra_service._get_exchange_mailbox_permission_service_principals()
+ )
+
+ assert result == {}
+ assert "RuntimeError" in (
+ entra_service.exchange_mailbox_permission_service_principals_error
+ )
+ assert "Graph unavailable" in (
+ entra_service.exchange_mailbox_permission_service_principals_error
+ )
+
def test__resolve_identifiers_for_type_flags_only_404(self):
"""Only HTTP 404 / Request_ResourceNotFound mark an id as deleted.
diff --git a/tests/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps_test.py b/tests/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps_test.py
new file mode 100644
index 0000000000..dc61d32ffb
--- /dev/null
+++ b/tests/providers/m365/services/exchange/exchange_application_access_policy_restricts_mailbox_apps/exchange_application_access_policy_restricts_mailbox_apps_test.py
@@ -0,0 +1,271 @@
+import importlib
+from unittest import mock
+
+from prowler.providers.m365.services.entra import entra_service
+from prowler.providers.m365.services.exchange import exchange_service
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+CHECK_MODULE = (
+ "prowler.providers.m365.services.exchange."
+ "exchange_application_access_policy_restricts_mailbox_apps."
+ "exchange_application_access_policy_restricts_mailbox_apps"
+)
+
+
+class Test_exchange_application_access_policy_restricts_mailbox_apps:
+ def test_powershell_unavailable_returns_manual(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = None
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert result[0].resource_id == "ExchangeOnlineTenant"
+ assert "Exchange Online PowerShell is unavailable" in result[0].status_extended
+
+ def test_no_resources(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = []
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {}
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 0
+
+ def test_graph_collection_unavailable_returns_manual(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = []
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {}
+ entra_client.exchange_mailbox_permission_service_principals_error = (
+ "RuntimeError: Graph unavailable"
+ )
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert result[0].resource_id == "ExchangeOnlineTenant"
+ assert (
+ "Microsoft Graph mailbox permission collection failed"
+ in result[0].status_extended
+ )
+
+ def test_service_principal_without_policy_fails(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = []
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {
+ "sp-id": entra_service.ServicePrincipal(
+ id="sp-id",
+ name="Mailbox App",
+ app_id="app-id",
+ exchange_mailbox_permissions=["Mail.Read", "Mail.Send"],
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == "sp-id"
+ assert result[0].resource_name == "Mailbox App"
+ assert "app-id" in result[0].status_extended
+ assert "Mail.Read, Mail.Send" in result[0].status_extended
+
+ def test_service_principal_with_policy_passes(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = [
+ exchange_service.ApplicationAccessPolicy(
+ identity="policy-id",
+ app_id="app-id",
+ access_right="RestrictAccess",
+ description="Restrict mailbox access",
+ )
+ ]
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {
+ "sp-id": entra_service.ServicePrincipal(
+ id="sp-id",
+ name="Mailbox App",
+ app_id="app-id",
+ exchange_mailbox_permissions=["Mail.Read"],
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert result[0].resource_id == "sp-id"
+ assert (
+ "is restricted using an Application Access Policy"
+ in result[0].status_extended
+ )
+
+ def test_service_principal_with_deny_access_policy_fails(self):
+ exchange_client = mock.MagicMock()
+ exchange_client.audited_tenant = "audited_tenant"
+ exchange_client.audited_domain = DOMAIN
+ exchange_client.organization_config = None
+ exchange_client.application_access_policies = [
+ exchange_service.ApplicationAccessPolicy(
+ identity="policy-id",
+ app_id="app-id",
+ access_right="DenyAccess",
+ description="Deny mailbox access",
+ )
+ ]
+
+ entra_client = mock.MagicMock()
+ entra_client.exchange_mailbox_permission_service_principals = {
+ "sp-id": entra_service.ServicePrincipal(
+ id="sp-id",
+ name="Mailbox App",
+ app_id="app-id",
+ exchange_mailbox_permissions=["Mail.Read"],
+ )
+ }
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_m365_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.exchange_client",
+ new=exchange_client,
+ ),
+ mock.patch(
+ "prowler.providers.m365.services.exchange.exchange_application_access_policy_restricts_mailbox_apps.exchange_application_access_policy_restricts_mailbox_apps.entra_client",
+ new=entra_client,
+ ),
+ ):
+ check_module = importlib.import_module(CHECK_MODULE)
+
+ result = (
+ check_module.exchange_application_access_policy_restricts_mailbox_apps().execute()
+ )
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].resource_id == "sp-id"
+ assert result[0].resource_name == "Mailbox App"
+ assert (
+ "is not restricted using an Application Access Policy"
+ in result[0].status_extended
+ )
diff --git a/tests/providers/m365/services/intune/__init__.py b/tests/providers/m365/services/intune/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/nhn/lib/mutelist/fixtures/nhn_mutelist.yaml b/tests/providers/nhn/lib/mutelist/fixtures/nhn_mutelist.yaml
index 6a4be42b4b..7fc22acedb 100644
--- a/tests/providers/nhn/lib/mutelist/fixtures/nhn_mutelist.yaml
+++ b/tests/providers/nhn/lib/mutelist/fixtures/nhn_mutelist.yaml
@@ -13,4 +13,4 @@ Mutelist:
- "*"
Resources:
- "resource_1"
- - "resource_2"
\ No newline at end of file
+ - "resource_2"
diff --git a/tests/providers/okta/lib/arguments/okta_arguments_test.py b/tests/providers/okta/lib/arguments/okta_arguments_test.py
index 0e3fb9c1a1..b8d6456bb7 100644
--- a/tests/providers/okta/lib/arguments/okta_arguments_test.py
+++ b/tests/providers/okta/lib/arguments/okta_arguments_test.py
@@ -40,6 +40,8 @@ class TestOktaArguments:
"--okta-org-domain",
"--okta-client-id",
"--okta-scopes",
+ "--okta-retries-max-attempts",
+ "--okta-requests-per-second",
}
def test_secret_flags_not_registered(self):
diff --git a/tests/providers/okta/lib/service/okta_service_test.py b/tests/providers/okta/lib/service/okta_service_test.py
new file mode 100644
index 0000000000..fb58a80104
--- /dev/null
+++ b/tests/providers/okta/lib/service/okta_service_test.py
@@ -0,0 +1,79 @@
+from unittest import mock
+
+from okta.http_client import HTTPClient
+
+from prowler.providers.okta.lib.service.rate_limiter import OktaRateLimiter
+from prowler.providers.okta.lib.service.service import (
+ DEFAULT_MAX_RETRIES,
+ DEFAULT_REQUEST_TIMEOUT,
+ OktaService,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _build_service(audit_config: dict = None, rate_limiter=None):
+ """Instantiate OktaService with the SDK client patched, returning the
+ config dict that was handed to ``OktaSDKClient``."""
+ provider = set_mocked_okta_provider(
+ audit_config=audit_config, rate_limiter=rate_limiter
+ )
+ with mock.patch(
+ "prowler.providers.okta.lib.service.service.OktaSDKClient"
+ ) as mocked_client_cls:
+ OktaService("test", provider)
+ return mocked_client_cls.call_args.args[0]
+
+
+class Test_OktaService_set_client:
+ def test_defaults_applied_when_audit_config_empty(self):
+ config = _build_service(audit_config={})
+
+ assert config["rateLimit"] == {"maxRetries": DEFAULT_MAX_RETRIES}
+ assert config["requestTimeout"] == DEFAULT_REQUEST_TIMEOUT
+
+ def test_defaults_applied_when_audit_config_none(self):
+ # set_mocked_okta_provider coerces None to {}, but the helper also
+ # guards against a None audit_config defensively.
+ config = _build_service(audit_config=None)
+
+ assert config["rateLimit"] == {"maxRetries": DEFAULT_MAX_RETRIES}
+ assert config["requestTimeout"] == DEFAULT_REQUEST_TIMEOUT
+
+ def test_audit_config_values_override_defaults(self):
+ config = _build_service(
+ audit_config={"okta_max_retries": 9, "okta_request_timeout": 120}
+ )
+
+ assert config["rateLimit"] == {"maxRetries": 9}
+ assert config["requestTimeout"] == 120
+
+ def test_retries_disabled_with_zero(self):
+ config = _build_service(audit_config={"okta_max_retries": 0})
+
+ assert config["rateLimit"] == {"maxRetries": 0}
+
+ def test_preserves_session_sdk_config_keys(self):
+ config = _build_service(audit_config={})
+
+ # The rate-limit settings are layered on top of the shared session
+ # config, so the credential keys must remain intact.
+ assert config["orgUrl"] == "https://acme.okta.com"
+ assert config["authorizationMode"] == "PrivateKey"
+ assert config["clientId"]
+ assert config["privateKey"]
+ assert config["dpopEnabled"] is True
+
+ def test_no_http_client_injected_without_limiter(self):
+ config = _build_service(audit_config={})
+
+ assert "httpClient" not in config
+
+ def test_throttled_http_client_injected_with_limiter(self):
+ limiter = OktaRateLimiter(4)
+ config = _build_service(audit_config={}, rate_limiter=limiter)
+
+ # The SDK instantiates the class itself, so a throttled HTTPClient
+ # subclass must be injected (not an instance).
+ http_client_cls = config["httpClient"]
+ assert isinstance(http_client_cls, type)
+ assert issubclass(http_client_cls, HTTPClient)
diff --git a/tests/providers/okta/lib/service/rate_limiter_test.py b/tests/providers/okta/lib/service/rate_limiter_test.py
new file mode 100644
index 0000000000..266cb6d085
--- /dev/null
+++ b/tests/providers/okta/lib/service/rate_limiter_test.py
@@ -0,0 +1,99 @@
+import asyncio
+from unittest import mock
+
+import pytest
+
+from prowler.providers.okta.lib.service.rate_limiter import (
+ OktaRateLimiter,
+ build_throttled_http_client,
+)
+
+
+class FakeClock:
+ """Deterministic clock whose `sleep` advances time instead of waiting."""
+
+ def __init__(self):
+ self.now = 0.0
+ self.sleeps = []
+
+ def __call__(self):
+ return self.now
+
+ async def sleep(self, seconds):
+ self.sleeps.append(seconds)
+ self.now += seconds
+
+
+def _limiter(rate, clock):
+ return OktaRateLimiter(rate, clock=clock, sleep=clock.sleep)
+
+
+class Test_OktaRateLimiter:
+ def test_rejects_non_positive_rate(self):
+ with pytest.raises(ValueError):
+ OktaRateLimiter(0)
+ with pytest.raises(ValueError):
+ OktaRateLimiter(-1)
+
+ def test_initial_burst_does_not_sleep(self):
+ clock = FakeClock()
+ # capacity == rate == 2, so the first two tokens are free.
+ limiter = _limiter(2, clock)
+
+ asyncio.run(limiter.acquire())
+ asyncio.run(limiter.acquire())
+
+ assert clock.sleeps == []
+
+ def test_sleeps_to_maintain_rate_once_bucket_drained(self):
+ clock = FakeClock()
+ limiter = _limiter(2, clock) # capacity 2, refill 2/s
+
+ # Drain the burst, then the third call must wait one refill interval.
+ asyncio.run(limiter.acquire())
+ asyncio.run(limiter.acquire())
+ asyncio.run(limiter.acquire())
+
+ assert clock.sleeps == [pytest.approx(0.5)]
+ assert clock.now == pytest.approx(0.5)
+
+ def test_elapsed_time_refills_tokens_without_sleeping(self):
+ clock = FakeClock()
+ limiter = _limiter(2, clock)
+
+ asyncio.run(limiter.acquire())
+ asyncio.run(limiter.acquire())
+ # Enough wall-clock passes to fully refill the bucket.
+ clock.now += 1.0
+ asyncio.run(limiter.acquire())
+
+ assert clock.sleeps == []
+
+ def test_rate_below_one_per_second(self):
+ clock = FakeClock()
+ limiter = _limiter(0.5, clock) # capacity floored to 1.0
+
+ asyncio.run(limiter.acquire()) # free initial token
+ asyncio.run(limiter.acquire()) # must wait 1 / 0.5 = 2s
+
+ assert clock.sleeps == [pytest.approx(2.0)]
+
+
+class Test_build_throttled_http_client:
+ def test_acquires_before_delegating_to_super(self):
+ limiter = mock.MagicMock()
+ limiter.acquire = mock.AsyncMock()
+
+ throttled_cls = build_throttled_http_client(limiter)
+ client = throttled_cls({"headers": {}})
+
+ with mock.patch.object(
+ throttled_cls.__bases__[0],
+ "send_request",
+ new=mock.AsyncMock(return_value="response"),
+ ) as base_send:
+ result = asyncio.run(client.send_request({"method": "GET"}))
+
+ limiter.acquire.assert_awaited_once()
+ base_send.assert_awaited_once_with({"method": "GET"})
+ assert result == "response"
diff --git a/tests/providers/okta/okta_fixtures.py b/tests/providers/okta/okta_fixtures.py
index 5c3d0e43c3..4113a2fdfb 100644
--- a/tests/providers/okta/okta_fixtures.py
+++ b/tests/providers/okta/okta_fixtures.py
@@ -11,6 +11,7 @@ def set_mocked_okta_provider(
session: OktaSession = None,
identity: OktaIdentityInfo = None,
audit_config: dict = None,
+ rate_limiter=None,
):
if session is None:
session = OktaSession(
@@ -54,4 +55,7 @@ def set_mocked_okta_provider(
provider.session = session
provider.identity = identity
provider.audit_config = audit_config or {}
+ # Default to no throttling so service tests build a plain SDK client; tests
+ # that exercise the limiter pass one explicitly.
+ provider.rate_limiter = rate_limiter
return provider
diff --git a/tests/providers/okta/okta_provider_test.py b/tests/providers/okta/okta_provider_test.py
index 5f2757edae..91d5607fdd 100644
--- a/tests/providers/okta/okta_provider_test.py
+++ b/tests/providers/okta/okta_provider_test.py
@@ -497,6 +497,85 @@ class Test_OktaProvider_init:
assert provider.audit_config is not None
assert provider.mutelist is not None
+ def test_default_max_retries_from_config_file(self, _clear_okta_env, tmp_path):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ )
+
+ # No CLI override: value comes from the bundled config.yaml default.
+ assert provider.audit_config["okta_max_retries"] == 5
+
+ def test_cli_retries_override_config_file(self, _clear_okta_env, tmp_path):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ okta_retries_max_attempts=9,
+ )
+
+ assert provider.audit_config["okta_max_retries"] == 9
+
+ def test_cli_retries_override_accepts_zero(self, _clear_okta_env, tmp_path):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ okta_retries_max_attempts=0,
+ )
+
+ # 0 disables retries and must not be treated as "unset".
+ assert provider.audit_config["okta_max_retries"] == 0
+
+ def test_rate_limiter_built_from_config_file_default(
+ self, _clear_okta_env, tmp_path
+ ):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ )
+
+ # Bundled config.yaml enables throttling at 4 req/s.
+ assert provider.rate_limiter is not None
+ assert provider.audit_config["okta_requests_per_second"] == 4
+
+ def test_cli_requests_per_second_override(self, _clear_okta_env, tmp_path):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ okta_requests_per_second=10,
+ )
+
+ assert provider.audit_config["okta_requests_per_second"] == 10
+ assert provider.rate_limiter is not None
+
+ def test_requests_per_second_zero_disables_throttling(
+ self, _clear_okta_env, tmp_path
+ ):
+ validate_p, session_p, identity_p = _mock_setup_paths()
+ with validate_p, session_p, identity_p:
+ provider = OktaProvider(
+ okta_org_domain=OKTA_ORG_DOMAIN,
+ okta_client_id=OKTA_CLIENT_ID,
+ okta_private_key_file="/tmp/key.pem",
+ okta_requests_per_second=0,
+ )
+
+ assert provider.rate_limiter is None
+
class Test_OktaProvider_test_connection:
def test_success(self, _clear_okta_env, tmp_path):
diff --git a/tests/providers/openstack/lib/__init__.py b/tests/providers/openstack/lib/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/openstack/lib/arguments/__init__.py b/tests/providers/openstack/lib/arguments/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/openstack/lib/mutelist/__init__.py b/tests/providers/openstack/lib/mutelist/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/openstack/lib/mutelist/fixtures/__init__.py b/tests/providers/openstack/lib/mutelist/fixtures/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data_test.py b/tests/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data_test.py
index 6be9ac48f5..85b97da0a2 100644
--- a/tests/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data_test.py
+++ b/tests/providers/openstack/services/blockstorage/blockstorage_snapshot_metadata_sensitive_data/blockstorage_snapshot_metadata_sensitive_data_test.py
@@ -2,6 +2,7 @@
from unittest import mock
+from prowler.lib.check.models import Severity
from prowler.providers.openstack.services.blockstorage.blockstorage_service import (
SnapshotResource,
)
@@ -141,7 +142,7 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
status="available",
size=50,
volume_id="vol-1",
- metadata={"db_password": "supersecret123"},
+ metadata={"db_password": "Tr0ub4dor3xKq9vLmZ"},
project_id=OPENSTACK_PROJECT_ID,
region=OPENSTACK_REGION,
)
@@ -179,7 +180,9 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
status="available",
size=50,
volume_id="vol-1",
- metadata={"api_key": "sk-1234567890"},
+ metadata={
+ "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
project_id=OPENSTACK_PROJECT_ID,
region=OPENSTACK_REGION,
)
@@ -223,7 +226,9 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
status="available",
size=50,
volume_id="vol-1",
- metadata={"ssh_key": "-----BEGIN RSA PRIVATE KEY-----"},
+ metadata={
+ "ssh_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUzlT9QGi8ZSr5\nk+LTRz/1TaiCCs6o1icW4cur0Q0hdBnbRJXUdjlQsgzmBvCBNkGHI8hb/RUPssvc\nDLU5kOQ3Wp2KgtbphhZ2PfpuJrzwHL1ejcJkRxegm/aTdmpoQKcxGeehAfHbmlLA\nxdfn6wPDfGji973yiRH56JRukJAaqF50HC2a/AVNC5HtZoVlbQ+WvVbYVUnPxNkv\nPpc53PjrBgWiTtdMONEqJ3jDiaqfUBt+TZYF0CFc9HgjnUniRX28OukDyLu+idOz\nFKyZxMXtqexkAvQLDW1PATpZgVQ7hJoCD8UVTXAtcgzPq5fA6AR2URiECHI6ZyL0\nUmixKfMNAgMBAAECggEAJRzp5wjdpmEgDQOkjpfGXJ6sAJUD8mmI8cTKeJWIzhdo\nDH8oVEdRJ65kl6lS6hMXWEZlJgYyrsnj3MPBnjQkKycbRCy6P59s8jwmfbsFI+iz\nFUZLXZm6i5jicGhYBRzc5hrlIYu73863RXOClAnSFDsu6K6rzfYASQFIJeRBwJfs\njqXinuun/h2zGjpiY+TtNsa8c+nC7f3sGsTzNJugDvBPWQzsnAMzXJqiyharre4V\no157XIOvdC0joIp8j/Ib1ZtMfz1K1LcgBgw0szSieIw0Rq8yQ0Ek7GtLh43jG+ap\nvcSEesTD1p4mjPXoWkPG8KYd4iwGedZaePfheVcKKQKBgQDNE03SWv18AH0d4fpB\nlFAtRybCfSvMORzBrt2oilz8wDmK+Zga5o+phCnM8v3eJy1v8BvIQ9RvwQA2uVgZ\nr701wNMpVrTsMujk83oVRhimZLk6Hyw07wmMgEHX7+izkm2Lk4Lk7Zol3VRfnWG6\nmIcUk7xB1yAs3mudsfx0VO0QyQKBgQC5wfdqCLj2hZk4sMZu8Bth+BHKChGItmDk\nAW7aNt+gaPyoryOJoi2OUO8ud8EyuqXiuslSk2pPtjvLhCppkoq6V8kmPAUzaxFk\n4nDEAxT9Un8IJ0j2ebv+koQKsBWjssbVSjrZgIcYIDK1QblgbCp2FSE3ima+V8ip\nOdNjiatWJQKBgEX8lox5nRSanhh6rIuA8DPjmmi5ix7xRs0avm7seXuQppK1R6G2\nmcTCY/mb2+Pa/vi6uuCHtZJGDaqfal+pyCr2GZp8CtapMS4hocJs37C5ozUguld+\nVIXsp4voRkQybsw5lWxHYloVxNu0vEuQDlmJabAWmNZ3OcbhnUSeTyFxAoGAFtkZ\n0owCHChwoT11Gt4jsBgwL/avE27DWigm92Y6eWOQeDsalupAyjmAQenu9Itqrgml\ni6egMu/KSQ0Xnmas86CqmC5XwWxQ9mS31BRA96u2/ky+t7pfej+RSDNCZiEuPbvk\noy4g78G+GvdbktWbH20X6dn3K0Bm6RG4w4yCa5UCgYBs0zAVs0DZmM8SUZJA/HuQ\nN6a1vKKns7xKw5N3SmX1KbDhx5LSZXfbUo2+QktE7iRf9G2f1o0q8kz9l/4AGXi1\nKJNUHupWoaQzGNrzAb27TUtFA0ocMG8KnqxjANWox5oPJS9OU5tw5H5dxeI/Senc\nkYW6eCnRzPcmBqex6Vuw4w==\n-----END PRIVATE KEY-----\n"
+ },
project_id=OPENSTACK_PROJECT_ID,
region=OPENSTACK_REGION,
)
@@ -277,7 +282,7 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
status="available",
size=50,
volume_id="vol-2",
- metadata={"admin_password": "secret123"},
+ metadata={"admin_password": "Tr0ub4dor3xKq9vLmZ"},
project_id=OPENSTACK_PROJECT_ID,
region=OPENSTACK_REGION,
),
@@ -318,7 +323,7 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
metadata={
"environment": "production",
"application": "web-app",
- "db_password": "supersecret123",
+ "db_password": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"region": "us-east",
},
project_id=OPENSTACK_PROJECT_ID,
@@ -348,3 +353,57 @@ class Test_blockstorage_snapshot_metadata_sensitive_data:
# Verify the secret is correctly attributed to 'db_password' key
assert "in metadata key 'db_password'" in result[0].status_extended
assert result[0].resource_id == "snap-6"
+
+ def test_snapshot_verified_secret_escalates_to_critical(self):
+ """Test that a confirmed live secret escalates the finding to CRITICAL (FAIL)."""
+ blockstorage_client = mock.MagicMock()
+ blockstorage_client.audit_config = {"secrets_validate": True}
+ blockstorage_client.snapshots = [
+ SnapshotResource(
+ id="snap-verified",
+ name="Verified Secret",
+ status="available",
+ size=50,
+ volume_id="vol-1",
+ metadata={"api_key": "placeholder"},
+ project_id=OPENSTACK_PROJECT_ID,
+ region=OPENSTACK_REGION,
+ )
+ ]
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_openstack_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.blockstorage.blockstorage_snapshot_metadata_sensitive_data.blockstorage_snapshot_metadata_sensitive_data.blockstorage_client",
+ new=blockstorage_client,
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.blockstorage.blockstorage_snapshot_metadata_sensitive_data.blockstorage_snapshot_metadata_sensitive_data.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.openstack.services.blockstorage.blockstorage_snapshot_metadata_sensitive_data.blockstorage_snapshot_metadata_sensitive_data import (
+ blockstorage_snapshot_metadata_sensitive_data,
+ )
+
+ check = blockstorage_snapshot_metadata_sensitive_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert mock_scan.call_args.kwargs.get("validate") is True
diff --git a/tests/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data_test.py b/tests/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data_test.py
index e12babb23c..80927e2f9d 100644
--- a/tests/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data_test.py
+++ b/tests/providers/openstack/services/blockstorage/blockstorage_volume_metadata_sensitive_data/blockstorage_volume_metadata_sensitive_data_test.py
@@ -2,6 +2,7 @@
from unittest import mock
+from prowler.lib.check.models import Severity
from prowler.providers.openstack.services.blockstorage.blockstorage_service import (
VolumeResource,
)
@@ -159,7 +160,7 @@ class Test_blockstorage_volume_metadata_sensitive_data:
is_bootable=False,
is_multiattach=False,
attachments=[],
- metadata={"db_password": "supersecret123"},
+ metadata={"db_password": "Tr0ub4dor3xKq9vLmZ"},
availability_zone="nova",
snapshot_id="",
source_volume_id="",
@@ -204,7 +205,9 @@ class Test_blockstorage_volume_metadata_sensitive_data:
is_bootable=False,
is_multiattach=False,
attachments=[],
- metadata={"api_key": "sk-1234567890"},
+ metadata={
+ "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
availability_zone="nova",
snapshot_id="",
source_volume_id="",
@@ -255,7 +258,9 @@ class Test_blockstorage_volume_metadata_sensitive_data:
is_bootable=False,
is_multiattach=False,
attachments=[],
- metadata={"ssh_key": "-----BEGIN RSA PRIVATE KEY-----"},
+ metadata={
+ "ssh_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUzlT9QGi8ZSr5\nk+LTRz/1TaiCCs6o1icW4cur0Q0hdBnbRJXUdjlQsgzmBvCBNkGHI8hb/RUPssvc\nDLU5kOQ3Wp2KgtbphhZ2PfpuJrzwHL1ejcJkRxegm/aTdmpoQKcxGeehAfHbmlLA\nxdfn6wPDfGji973yiRH56JRukJAaqF50HC2a/AVNC5HtZoVlbQ+WvVbYVUnPxNkv\nPpc53PjrBgWiTtdMONEqJ3jDiaqfUBt+TZYF0CFc9HgjnUniRX28OukDyLu+idOz\nFKyZxMXtqexkAvQLDW1PATpZgVQ7hJoCD8UVTXAtcgzPq5fA6AR2URiECHI6ZyL0\nUmixKfMNAgMBAAECggEAJRzp5wjdpmEgDQOkjpfGXJ6sAJUD8mmI8cTKeJWIzhdo\nDH8oVEdRJ65kl6lS6hMXWEZlJgYyrsnj3MPBnjQkKycbRCy6P59s8jwmfbsFI+iz\nFUZLXZm6i5jicGhYBRzc5hrlIYu73863RXOClAnSFDsu6K6rzfYASQFIJeRBwJfs\njqXinuun/h2zGjpiY+TtNsa8c+nC7f3sGsTzNJugDvBPWQzsnAMzXJqiyharre4V\no157XIOvdC0joIp8j/Ib1ZtMfz1K1LcgBgw0szSieIw0Rq8yQ0Ek7GtLh43jG+ap\nvcSEesTD1p4mjPXoWkPG8KYd4iwGedZaePfheVcKKQKBgQDNE03SWv18AH0d4fpB\nlFAtRybCfSvMORzBrt2oilz8wDmK+Zga5o+phCnM8v3eJy1v8BvIQ9RvwQA2uVgZ\nr701wNMpVrTsMujk83oVRhimZLk6Hyw07wmMgEHX7+izkm2Lk4Lk7Zol3VRfnWG6\nmIcUk7xB1yAs3mudsfx0VO0QyQKBgQC5wfdqCLj2hZk4sMZu8Bth+BHKChGItmDk\nAW7aNt+gaPyoryOJoi2OUO8ud8EyuqXiuslSk2pPtjvLhCppkoq6V8kmPAUzaxFk\n4nDEAxT9Un8IJ0j2ebv+koQKsBWjssbVSjrZgIcYIDK1QblgbCp2FSE3ima+V8ip\nOdNjiatWJQKBgEX8lox5nRSanhh6rIuA8DPjmmi5ix7xRs0avm7seXuQppK1R6G2\nmcTCY/mb2+Pa/vi6uuCHtZJGDaqfal+pyCr2GZp8CtapMS4hocJs37C5ozUguld+\nVIXsp4voRkQybsw5lWxHYloVxNu0vEuQDlmJabAWmNZ3OcbhnUSeTyFxAoGAFtkZ\n0owCHChwoT11Gt4jsBgwL/avE27DWigm92Y6eWOQeDsalupAyjmAQenu9Itqrgml\ni6egMu/KSQ0Xnmas86CqmC5XwWxQ9mS31BRA96u2/ky+t7pfej+RSDNCZiEuPbvk\noy4g78G+GvdbktWbH20X6dn3K0Bm6RG4w4yCa5UCgYBs0zAVs0DZmM8SUZJA/HuQ\nN6a1vKKns7xKw5N3SmX1KbDhx5LSZXfbUo2+QktE7iRf9G2f1o0q8kz9l/4AGXi1\nKJNUHupWoaQzGNrzAb27TUtFA0ocMG8KnqxjANWox5oPJS9OU5tw5H5dxeI/Senc\nkYW6eCnRzPcmBqex6Vuw4w==\n-----END PRIVATE KEY-----\n"
+ },
availability_zone="nova",
snapshot_id="",
source_volume_id="",
@@ -323,7 +328,7 @@ class Test_blockstorage_volume_metadata_sensitive_data:
is_bootable=False,
is_multiattach=False,
attachments=[],
- metadata={"admin_password": "secret123"},
+ metadata={"admin_password": "Tr0ub4dor3xKq9vLmZ"},
availability_zone="nova",
snapshot_id="",
source_volume_id="",
@@ -371,7 +376,7 @@ class Test_blockstorage_volume_metadata_sensitive_data:
metadata={
"environment": "production",
"application": "web-app",
- "db_password": "supersecret123",
+ "db_password": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"region": "us-east",
},
availability_zone="nova",
@@ -404,3 +409,64 @@ class Test_blockstorage_volume_metadata_sensitive_data:
# Verify the secret is correctly attributed to 'db_password' key
assert "in metadata key 'db_password'" in result[0].status_extended
assert result[0].resource_id == "vol-6"
+
+ def test_volume_verified_secret_escalates_to_critical(self):
+ """Test that a confirmed live secret escalates the finding to CRITICAL (FAIL)."""
+ blockstorage_client = mock.MagicMock()
+ blockstorage_client.audit_config = {"secrets_validate": True}
+ blockstorage_client.volumes = [
+ VolumeResource(
+ id="vol-verified",
+ name="Verified Secret",
+ status="in-use",
+ size=100,
+ volume_type="standard",
+ is_encrypted=False,
+ is_bootable=False,
+ is_multiattach=False,
+ attachments=[],
+ metadata={"api_key": "placeholder"},
+ availability_zone="nova",
+ snapshot_id="",
+ source_volume_id="",
+ project_id=OPENSTACK_PROJECT_ID,
+ region=OPENSTACK_REGION,
+ )
+ ]
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_openstack_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.blockstorage.blockstorage_volume_metadata_sensitive_data.blockstorage_volume_metadata_sensitive_data.blockstorage_client",
+ new=blockstorage_client,
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.blockstorage.blockstorage_volume_metadata_sensitive_data.blockstorage_volume_metadata_sensitive_data.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.openstack.services.blockstorage.blockstorage_volume_metadata_sensitive_data.blockstorage_volume_metadata_sensitive_data import (
+ blockstorage_volume_metadata_sensitive_data,
+ )
+
+ check = blockstorage_volume_metadata_sensitive_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert mock_scan.call_args.kwargs.get("validate") is True
diff --git a/tests/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data_test.py b/tests/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data_test.py
index 174a8ab83f..daaffffb1f 100644
--- a/tests/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data_test.py
+++ b/tests/providers/openstack/services/compute/compute_instance_metadata_sensitive_data/compute_instance_metadata_sensitive_data_test.py
@@ -2,6 +2,7 @@
from unittest import mock
+from prowler.lib.check.models import Severity
from prowler.providers.openstack.services.compute.compute_service import ComputeInstance
from tests.providers.openstack.openstack_fixtures import (
OPENSTACK_PROJECT_ID,
@@ -181,7 +182,7 @@ class Test_compute_instance_metadata_sensitive_data:
private_v6="",
networks={},
has_config_drive=False,
- metadata={"db_password": "supersecret123"},
+ metadata={"db_password": "Tr0ub4dor3xKq9vLmZ"},
user_data="",
trusted_image_certificates=[],
)
@@ -233,7 +234,9 @@ class Test_compute_instance_metadata_sensitive_data:
private_v6="",
networks={},
has_config_drive=False,
- metadata={"api_key": "sk-1234567890"},
+ metadata={
+ "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+ },
user_data="",
trusted_image_certificates=[],
)
@@ -349,7 +352,9 @@ class Test_compute_instance_metadata_sensitive_data:
private_v6="",
networks={},
has_config_drive=False,
- metadata={"ssh_key": "-----BEGIN RSA PRIVATE KEY-----"},
+ metadata={
+ "ssh_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUzlT9QGi8ZSr5\nk+LTRz/1TaiCCs6o1icW4cur0Q0hdBnbRJXUdjlQsgzmBvCBNkGHI8hb/RUPssvc\nDLU5kOQ3Wp2KgtbphhZ2PfpuJrzwHL1ejcJkRxegm/aTdmpoQKcxGeehAfHbmlLA\nxdfn6wPDfGji973yiRH56JRukJAaqF50HC2a/AVNC5HtZoVlbQ+WvVbYVUnPxNkv\nPpc53PjrBgWiTtdMONEqJ3jDiaqfUBt+TZYF0CFc9HgjnUniRX28OukDyLu+idOz\nFKyZxMXtqexkAvQLDW1PATpZgVQ7hJoCD8UVTXAtcgzPq5fA6AR2URiECHI6ZyL0\nUmixKfMNAgMBAAECggEAJRzp5wjdpmEgDQOkjpfGXJ6sAJUD8mmI8cTKeJWIzhdo\nDH8oVEdRJ65kl6lS6hMXWEZlJgYyrsnj3MPBnjQkKycbRCy6P59s8jwmfbsFI+iz\nFUZLXZm6i5jicGhYBRzc5hrlIYu73863RXOClAnSFDsu6K6rzfYASQFIJeRBwJfs\njqXinuun/h2zGjpiY+TtNsa8c+nC7f3sGsTzNJugDvBPWQzsnAMzXJqiyharre4V\no157XIOvdC0joIp8j/Ib1ZtMfz1K1LcgBgw0szSieIw0Rq8yQ0Ek7GtLh43jG+ap\nvcSEesTD1p4mjPXoWkPG8KYd4iwGedZaePfheVcKKQKBgQDNE03SWv18AH0d4fpB\nlFAtRybCfSvMORzBrt2oilz8wDmK+Zga5o+phCnM8v3eJy1v8BvIQ9RvwQA2uVgZ\nr701wNMpVrTsMujk83oVRhimZLk6Hyw07wmMgEHX7+izkm2Lk4Lk7Zol3VRfnWG6\nmIcUk7xB1yAs3mudsfx0VO0QyQKBgQC5wfdqCLj2hZk4sMZu8Bth+BHKChGItmDk\nAW7aNt+gaPyoryOJoi2OUO8ud8EyuqXiuslSk2pPtjvLhCppkoq6V8kmPAUzaxFk\n4nDEAxT9Un8IJ0j2ebv+koQKsBWjssbVSjrZgIcYIDK1QblgbCp2FSE3ima+V8ip\nOdNjiatWJQKBgEX8lox5nRSanhh6rIuA8DPjmmi5ix7xRs0avm7seXuQppK1R6G2\nmcTCY/mb2+Pa/vi6uuCHtZJGDaqfal+pyCr2GZp8CtapMS4hocJs37C5ozUguld+\nVIXsp4voRkQybsw5lWxHYloVxNu0vEuQDlmJabAWmNZ3OcbhnUSeTyFxAoGAFtkZ\n0owCHChwoT11Gt4jsBgwL/avE27DWigm92Y6eWOQeDsalupAyjmAQenu9Itqrgml\ni6egMu/KSQ0Xnmas86CqmC5XwWxQ9mS31BRA96u2/ky+t7pfej+RSDNCZiEuPbvk\noy4g78G+GvdbktWbH20X6dn3K0Bm6RG4w4yCa5UCgYBs0zAVs0DZmM8SUZJA/HuQ\nN6a1vKKns7xKw5N3SmX1KbDhx5LSZXfbUo2+QktE7iRf9G2f1o0q8kz9l/4AGXi1\nKJNUHupWoaQzGNrzAb27TUtFA0ocMG8KnqxjANWox5oPJS9OU5tw5H5dxeI/Senc\nkYW6eCnRzPcmBqex6Vuw4w==\n-----END PRIVATE KEY-----\n"
+ },
user_data="",
trusted_image_certificates=[],
)
@@ -431,7 +436,7 @@ class Test_compute_instance_metadata_sensitive_data:
private_v6="",
networks={},
has_config_drive=False,
- metadata={"admin_password": "secret123"},
+ metadata={"admin_password": "Tr0ub4dor3xKq9vLmZ"},
user_data="",
trusted_image_certificates=[],
),
@@ -486,7 +491,7 @@ class Test_compute_instance_metadata_sensitive_data:
metadata={
"environment": "production",
"application": "web-app",
- "db_password": "supersecret123",
+ "db_password": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"region": "us-east",
},
user_data="",
@@ -544,7 +549,7 @@ class Test_compute_instance_metadata_sensitive_data:
has_config_drive=False,
metadata={
"first_key": "safe_value",
- "api_key": "sk-1234567890abcdef",
+ "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
"third_key": "also_safe",
},
user_data="",
@@ -574,3 +579,128 @@ class Test_compute_instance_metadata_sensitive_data:
# Verify the secret is correctly attributed to 'api_key' key (second in order)
assert "in metadata key 'api_key'" in result[0].status_extended
assert result[0].resource_id == "instance-8"
+
+ def test_instance_verified_secret_escalates_to_critical(self):
+ """Test that a confirmed live secret escalates the finding to CRITICAL (FAIL)."""
+ compute_client = mock.MagicMock()
+ compute_client.audit_config = {"secrets_validate": True}
+ compute_client.instances = [
+ ComputeInstance(
+ id="instance-verified",
+ name="Verified Secret",
+ status="ACTIVE",
+ flavor_id="flavor-1",
+ security_groups=["default"],
+ region=OPENSTACK_REGION,
+ project_id=OPENSTACK_PROJECT_ID,
+ is_locked=False,
+ locked_reason="",
+ key_name="",
+ user_id="",
+ access_ipv4="",
+ access_ipv6="",
+ public_v4="",
+ public_v6="",
+ private_v4="",
+ private_v6="",
+ networks={},
+ has_config_drive=False,
+ metadata={"api_key": "placeholder"},
+ user_data="",
+ trusted_image_certificates=[],
+ )
+ ]
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_openstack_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data.compute_client",
+ new=compute_client,
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data import (
+ compute_instance_metadata_sensitive_data,
+ )
+
+ check = compute_instance_metadata_sensitive_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert mock_scan.call_args.kwargs.get("validate") is True
+
+ def test_scan_failure_reports_manual(self):
+ from prowler.lib.utils.utils import SecretsScanError
+
+ compute_client = mock.MagicMock()
+ compute_client.audit_config = {"secrets_ignore_patterns": []}
+ compute_client.instances = [
+ ComputeInstance(
+ id="instance-scan-fail",
+ name="Scan Fail",
+ status="ACTIVE",
+ flavor_id="flavor-1",
+ security_groups=["default"],
+ region=OPENSTACK_REGION,
+ project_id=OPENSTACK_PROJECT_ID,
+ is_locked=False,
+ locked_reason="",
+ key_name="",
+ user_id="",
+ access_ipv4="",
+ access_ipv6="",
+ public_v4="",
+ public_v6="",
+ private_v4="",
+ private_v6="",
+ networks={},
+ has_config_drive=False,
+ metadata={"api_key": "placeholder"},
+ user_data="",
+ trusted_image_certificates=[],
+ )
+ ]
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_openstack_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data.compute_client",
+ new=compute_client,
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data.detect_secrets_scan_batch",
+ side_effect=SecretsScanError("Kingfisher exited with code 1"),
+ ),
+ ):
+ from prowler.providers.openstack.services.compute.compute_instance_metadata_sensitive_data.compute_instance_metadata_sensitive_data import (
+ compute_instance_metadata_sensitive_data,
+ )
+
+ check = compute_instance_metadata_sensitive_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "MANUAL"
+ assert "Could not scan" in result[0].status_extended
diff --git a/tests/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data_test.py b/tests/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data_test.py
index 6cae6432c7..eb92274232 100644
--- a/tests/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data_test.py
+++ b/tests/providers/openstack/services/objectstorage/objectstorage_container_metadata_sensitive_data/objectstorage_container_metadata_sensitive_data_test.py
@@ -2,6 +2,7 @@
from unittest import mock
+from prowler.lib.check.models import Severity
from prowler.providers.openstack.services.objectstorage.objectstorage_service import (
ObjectStorageContainer,
)
@@ -157,7 +158,7 @@ class Test_objectstorage_container_metadata_sensitive_data:
history_location="",
sync_to="",
sync_key="",
- metadata={"db_password": "supersecret123"},
+ metadata={"db_password": "Tr0ub4dor3xKq9vLmZ"},
)
]
@@ -217,7 +218,7 @@ class Test_objectstorage_container_metadata_sensitive_data:
history_location="",
sync_to="",
sync_key="",
- metadata={"admin_password": "secret123"},
+ metadata={"admin_password": "Tr0ub4dor3xKq9vLmZ"},
),
]
@@ -241,3 +242,63 @@ class Test_objectstorage_container_metadata_sensitive_data:
assert len(result) == 2
assert len([r for r in result if r.status == "PASS"]) == 1
assert len([r for r in result if r.status == "FAIL"]) == 1
+
+ def test_container_verified_secret_escalates_to_critical(self):
+ """Test that a confirmed live secret escalates the finding to CRITICAL (FAIL)."""
+ objectstorage_client = mock.MagicMock()
+ objectstorage_client.audit_config = {"secrets_validate": True}
+ objectstorage_client.containers = [
+ ObjectStorageContainer(
+ id="container-verified",
+ name="verified-secret",
+ region=OPENSTACK_REGION,
+ project_id=OPENSTACK_PROJECT_ID,
+ object_count=0,
+ bytes_used=0,
+ read_ACL="",
+ write_ACL="",
+ versioning_enabled=False,
+ versions_location="",
+ history_location="",
+ sync_to="",
+ sync_key="",
+ metadata={"api_key": "placeholder"},
+ )
+ ]
+
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_openstack_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.objectstorage.objectstorage_container_metadata_sensitive_data.objectstorage_container_metadata_sensitive_data.objectstorage_client",
+ new=objectstorage_client,
+ ),
+ mock.patch(
+ "prowler.providers.openstack.services.objectstorage.objectstorage_container_metadata_sensitive_data.objectstorage_container_metadata_sensitive_data.detect_secrets_scan_batch",
+ return_value={
+ 0: [
+ {
+ "type": "JSON Web Token (base64url-encoded)",
+ "line_number": 2,
+ "filename": "data",
+ "hashed_secret": "x",
+ "is_verified": True,
+ }
+ ]
+ },
+ ) as mock_scan,
+ ):
+ from prowler.providers.openstack.services.objectstorage.objectstorage_container_metadata_sensitive_data.objectstorage_container_metadata_sensitive_data import (
+ objectstorage_container_metadata_sensitive_data,
+ )
+
+ check = objectstorage_container_metadata_sensitive_data()
+ result = check.execute()
+
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert result[0].check_metadata.Severity == Severity.critical
+ assert "confirmed to be live" in result[0].status_extended
+ assert mock_scan.call_args.kwargs.get("validate") is True
diff --git a/tests/providers/oraclecloud/__init__.py b/tests/providers/oraclecloud/__init__.py
deleted file mode 100644
index 45e52625a3..0000000000
--- a/tests/providers/oraclecloud/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-# OCI Provider Tests
diff --git a/tests/providers/oraclecloud/lib/__init__.py b/tests/providers/oraclecloud/lib/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/lib/mutelist/__init__.py b/tests/providers/oraclecloud/lib/mutelist/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/oraclecloud_provider_test.py b/tests/providers/oraclecloud/oraclecloud_provider_test.py
index 7c437a35ac..7deb649d8e 100644
--- a/tests/providers/oraclecloud/oraclecloud_provider_test.py
+++ b/tests/providers/oraclecloud/oraclecloud_provider_test.py
@@ -5,6 +5,7 @@ import pytest
from prowler.providers.oraclecloud.exceptions.exceptions import (
OCIAuthenticationError,
OCIInvalidConfigError,
+ OCISetUpSessionError,
)
from prowler.providers.oraclecloud.models import OCIIdentityInfo, OCIRegion, OCISession
from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
@@ -200,6 +201,129 @@ MIIEpQIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8n0sMcD/QHWCJ7yGSEtLN2T
assert connection.is_connected is True
+ def test_test_connection_direct_credentials_without_region_uses_bootstrap_region(
+ self,
+ ):
+ """Direct API key auth should not fall back to config-file auth without a region."""
+ import base64
+
+ valid_key = (
+ "-----BEGIN RSA PRIVATE KEY-----\nfake\n-----END RSA PRIVATE KEY-----"
+ )
+ encoded_key = base64.b64encode(valid_key.encode("utf-8")).decode("utf-8")
+
+ with (
+ patch("oci.config.validate_config") as mock_validate_config,
+ patch("oci.identity.IdentityClient") as mock_identity_client,
+ ):
+ mock_tenancy = MagicMock()
+ mock_tenancy.name = "test-tenancy"
+ mock_response = MagicMock()
+ mock_response.data = mock_tenancy
+ mock_client_instance = MagicMock()
+ mock_client_instance.get_tenancy.return_value = mock_response
+ mock_identity_client.return_value = mock_client_instance
+
+ connection = OraclecloudProvider.test_connection(
+ key_content=encoded_key,
+ user="ocid1.user.oc1..aaaaaaaexample",
+ fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+ provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ raise_on_exception=False,
+ )
+
+ assert connection.is_connected is True
+ assert (
+ mock_validate_config.call_args.args[0]["region"]
+ == OraclecloudProvider._bootstrap_region
+ )
+
+
+class TestTestConnectionRegionHandling:
+ """Tests for region handling in test_connection()."""
+
+ def test_config_file_auth_without_region_preserves_session_region_for_identity(
+ self,
+ ):
+ mock_session = OCISession(
+ config={
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ "user": "ocid1.user.oc1..aaaaaaaexample",
+ "region": "eu-frankfurt-1",
+ },
+ signer=None,
+ profile="DEFAULT",
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="eu-frankfurt-1",
+ profile="DEFAULT",
+ audited_regions={"eu-frankfurt-1"},
+ audited_compartments=[],
+ )
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ),
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ) as mock_set_identity,
+ ):
+ connection = OraclecloudProvider.test_connection(
+ oci_config_file="/tmp/config",
+ profile="DEFAULT",
+ raise_on_exception=False,
+ )
+
+ assert connection.is_connected is True
+ mock_set_identity.assert_called_once_with(session=mock_session, region=None)
+
+ def test_instance_principal_auth_without_region_preserves_session_region_for_identity(
+ self,
+ ):
+ mock_signer = MagicMock()
+ mock_session = OCISession(
+ config={
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ "region": "uk-london-1",
+ },
+ signer=mock_signer,
+ profile=None,
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="instance-principal",
+ region="uk-london-1",
+ profile=None,
+ audited_regions={"uk-london-1"},
+ audited_compartments=[],
+ )
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ),
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ) as mock_set_identity,
+ ):
+ connection = OraclecloudProvider.test_connection(
+ use_instance_principal=True,
+ raise_on_exception=False,
+ )
+
+ assert connection.is_connected is True
+ mock_set_identity.assert_called_once_with(session=mock_session, region=None)
+
class TestOraclecloudProviderInit:
"""Tests for OraclecloudProvider initialization"""
@@ -256,6 +380,271 @@ class TestOraclecloudProviderInit:
assert provider.home_region == "us-ashburn-1"
mock_set_global.assert_called_once_with(provider)
+ def test_init_with_multiple_regions_does_not_use_legacy_single_region_fallback(
+ self,
+ ):
+ mock_session = OCISession(
+ config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="us-ashburn-1",
+ profile="DEFAULT",
+ audited_regions=set(),
+ audited_compartments=[],
+ )
+ audited_regions = [
+ OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
+ OCIRegion(key="us-phoenix-1", name="us-phoenix-1", is_home_region=False),
+ ]
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ) as mock_setup_session,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ) as mock_set_identity,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
+ return_value=audited_regions,
+ ) as mock_get_regions_to_audit,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ provider = OraclecloudProvider(
+ region={"us-phoenix-1", "us-ashburn-1"},
+ user="ocid1.user.oc1..aaaaaaaexample",
+ fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert (
+ mock_setup_session.call_args.kwargs["region"]
+ == OraclecloudProvider._bootstrap_region
+ )
+ assert mock_set_identity.call_args.kwargs["region"] is None
+ assert mock_get_regions_to_audit.call_args_list[0].args == (
+ {"us-phoenix-1", "us-ashburn-1"},
+ )
+ assert provider.regions == audited_regions
+
+ def test_init_with_legacy_region_string_uses_full_region_for_identity(self):
+ mock_session = OCISession(
+ config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="us-ashburn-1",
+ profile="DEFAULT",
+ audited_regions=set(),
+ audited_compartments=[],
+ )
+ audited_regions = [
+ OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
+ ]
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ) as mock_setup_session,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ) as mock_set_identity,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
+ return_value=audited_regions,
+ ),
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ OraclecloudProvider(
+ region="us-ashburn-1",
+ user="ocid1.user.oc1..aaaaaaaexample",
+ fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert mock_setup_session.call_args.kwargs["region"] == "us-ashburn-1"
+ assert mock_set_identity.call_args.kwargs["region"] == "us-ashburn-1"
+
+ def test_init_without_region_uses_direct_credentials_bootstrap_without_scan_filter(
+ self,
+ ):
+ mock_session = OCISession(
+ config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="us-ashburn-1",
+ profile="DEFAULT",
+ audited_regions=set(),
+ audited_compartments=[],
+ )
+ all_subscribed_regions = [
+ OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
+ OCIRegion(key="us-phoenix-1", name="us-phoenix-1", is_home_region=False),
+ ]
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ) as mock_setup_session,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ) as mock_set_identity,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
+ return_value=all_subscribed_regions,
+ ) as mock_get_regions_to_audit,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ provider = OraclecloudProvider(
+ user="ocid1.user.oc1..aaaaaaaexample",
+ fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+ key_content="fake-base64-key-content",
+ tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert (
+ mock_setup_session.call_args.kwargs["region"]
+ == OraclecloudProvider._bootstrap_region
+ )
+ assert mock_set_identity.call_args.kwargs["region"] is None
+ assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
+ assert provider.regions == all_subscribed_regions
+
+ def test_init_with_config_file_auth_without_region_uses_session_config_region_for_identity(
+ self,
+ ):
+ mock_session = OCISession(
+ config={
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ "user": "ocid1.user.oc1..aaaaaaaexample",
+ "region": "eu-frankfurt-1",
+ },
+ signer=None,
+ profile="DEFAULT",
+ )
+ all_subscribed_regions = [
+ OCIRegion(key="eu-frankfurt-1", name="eu-frankfurt-1", is_home_region=True),
+ OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=False),
+ ]
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ) as mock_setup_session,
+ patch("oci.identity.IdentityClient") as mock_identity_client,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
+ return_value=all_subscribed_regions,
+ ) as mock_get_regions_to_audit,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ mock_tenancy = MagicMock()
+ mock_tenancy.name = "test-tenancy"
+ mock_identity_client.return_value.get_tenancy.return_value.data = (
+ mock_tenancy
+ )
+
+ provider = OraclecloudProvider(
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert mock_setup_session.call_args.kwargs["region"] is None
+ assert provider.identity.region == "eu-frankfurt-1"
+ assert provider.identity.audited_regions == {"eu-frankfurt-1"}
+ assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
+ assert provider.regions == all_subscribed_regions
+
+ def test_init_with_instance_principal_without_region_uses_session_config_region_for_identity(
+ self,
+ ):
+ mock_signer = MagicMock()
+ mock_session = OCISession(
+ config={
+ "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+ "region": "uk-london-1",
+ },
+ signer=mock_signer,
+ profile=None,
+ )
+ all_subscribed_regions = [
+ OCIRegion(key="uk-london-1", name="uk-london-1", is_home_region=True),
+ OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=False),
+ ]
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ) as mock_setup_session,
+ patch("oci.identity.IdentityClient") as mock_identity_client,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
+ return_value=all_subscribed_regions,
+ ) as mock_get_regions_to_audit,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ mock_tenancy = MagicMock()
+ mock_tenancy.name = "test-tenancy"
+ mock_identity_client.return_value.get_tenancy.return_value.data = (
+ mock_tenancy
+ )
+
+ provider = OraclecloudProvider(
+ use_instance_principal=True,
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert mock_setup_session.call_args.kwargs["region"] is None
+ assert provider.identity.region == "uk-london-1"
+ assert provider.identity.user_id == "instance-principal"
+ assert provider.identity.audited_regions == {"uk-london-1"}
+ assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
+ assert provider.regions == all_subscribed_regions
+
def test_home_region_uses_full_subscription_list_not_region_filter(self):
"""Home region must come from the full subscription list, not the --region filter.
@@ -313,3 +702,105 @@ class TestOraclecloudProviderInit:
assert provider.regions == audited_regions
assert provider.home_region == "us-ashburn-1"
+
+ def test_init_with_legacy_single_region_preserves_fallback_for_home_region(self):
+ mock_session = OCISession(
+ config={"region": "us-phoenix-1"}, signer=None, profile="DEFAULT"
+ )
+ mock_identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="us-phoenix-1",
+ profile="DEFAULT",
+ audited_regions=set(),
+ audited_compartments=[],
+ )
+
+ with (
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
+ return_value=mock_session,
+ ),
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
+ return_value=mock_identity,
+ ),
+ patch("oci.identity.IdentityClient") as mock_identity_client,
+ patch(
+ "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
+ return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
+ ),
+ patch("prowler.providers.common.provider.Provider.set_global_provider"),
+ ):
+ mock_identity_client.return_value.list_region_subscriptions.side_effect = (
+ Exception("discovery failed")
+ )
+
+ provider = OraclecloudProvider(
+ region="us-phoenix-1",
+ config_content={"dummy": True},
+ mutelist_content={"Accounts": {}},
+ )
+
+ assert [region.key for region in provider.regions] == ["us-phoenix-1"]
+ assert provider.home_region == "us-phoenix-1"
+
+
+class TestGetRegionsToAudit:
+ def _provider_with_identity(self):
+ provider = OraclecloudProvider.__new__(OraclecloudProvider)
+ provider._session = OCISession(
+ config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
+ )
+ provider._identity = OCIIdentityInfo(
+ tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
+ tenancy_name="test-tenancy",
+ user_id="ocid1.user.oc1..aaaaaaaexample",
+ region="us-ashburn-1",
+ profile="DEFAULT",
+ audited_regions=set(),
+ audited_compartments=[],
+ )
+ return provider
+
+ def test_regionless_scan_raises_when_region_subscription_discovery_fails(self):
+ provider = self._provider_with_identity()
+
+ with patch("oci.identity.IdentityClient") as mock_identity_client:
+ mock_identity_client.return_value.list_region_subscriptions.side_effect = (
+ Exception("discovery failed")
+ )
+
+ with pytest.raises(OCISetUpSessionError) as exc_info:
+ provider.get_regions_to_audit()
+
+ assert "Could not retrieve OCI subscribed regions" in str(exc_info.value)
+
+ def test_single_explicit_region_falls_back_when_region_subscription_discovery_fails(
+ self,
+ ):
+ provider = self._provider_with_identity()
+
+ with patch("oci.identity.IdentityClient") as mock_identity_client:
+ mock_identity_client.return_value.list_region_subscriptions.side_effect = (
+ Exception("discovery failed")
+ )
+
+ regions = provider.get_regions_to_audit("us-phoenix-1")
+
+ assert len(regions) == 1
+ assert regions[0].key == "us-phoenix-1"
+
+ def test_multiple_explicit_regions_raise_when_region_subscription_discovery_fails(
+ self,
+ ):
+ provider = self._provider_with_identity()
+
+ with patch("oci.identity.IdentityClient") as mock_identity_client:
+ mock_identity_client.return_value.list_region_subscriptions.side_effect = (
+ Exception("discovery failed")
+ )
+
+ with pytest.raises(OCISetUpSessionError):
+ provider.get_regions_to_audit({"us-ashburn-1", "us-phoenix-1"})
diff --git a/tests/providers/oraclecloud/services/__init__.py b/tests/providers/oraclecloud/services/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/analytics/__init__.py b/tests/providers/oraclecloud/services/analytics/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/analytics/analytics_instance_access_restricted/__init__.py b/tests/providers/oraclecloud/services/analytics/analytics_instance_access_restricted/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/audit/__init__.py b/tests/providers/oraclecloud/services/audit/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/__init__.py b/tests/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/blockstorage/__init__.py b/tests/providers/oraclecloud/services/blockstorage/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/__init__.py b/tests/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/__init__.py b/tests/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/cloudguard/__init__.py b/tests/providers/oraclecloud/services/cloudguard/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/cloudguard/cloudguard_enabled/__init__.py b/tests/providers/oraclecloud/services/cloudguard/cloudguard_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/compute/__init__.py b/tests/providers/oraclecloud/services/compute/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/compute/compute_instance_in_transit_encryption_enabled/__init__.py b/tests/providers/oraclecloud/services/compute/compute_instance_in_transit_encryption_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/compute/compute_instance_legacy_metadata_endpoint_disabled/__init__.py b/tests/providers/oraclecloud/services/compute/compute_instance_legacy_metadata_endpoint_disabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/compute/compute_instance_secure_boot_enabled/__init__.py b/tests/providers/oraclecloud/services/compute/compute_instance_secure_boot_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/database/__init__.py b/tests/providers/oraclecloud/services/database/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/database/database_autonomous_database_access_restricted/__init__.py b/tests/providers/oraclecloud/services/database/database_autonomous_database_access_restricted/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/__init__.py b/tests/providers/oraclecloud/services/events/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_notification_topic_and_subscription_exists/__init__.py b/tests/providers/oraclecloud/services/events/events_notification_topic_and_subscription_exists/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_cloudguard_problems/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_cloudguard_problems/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_iam_group_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_iam_group_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_iam_policy_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_iam_policy_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_identity_provider_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_identity_provider_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_idp_group_mapping_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_idp_group_mapping_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_local_user_authentication/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_local_user_authentication/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_network_gateway_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_network_gateway_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_network_security_group_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_network_security_group_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_route_table_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_route_table_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_security_list_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_security_list_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_user_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_user_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/events/events_rule_vcn_changes/__init__.py b/tests/providers/oraclecloud/services/events/events_rule_vcn_changes/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/filestorage/__init__.py b/tests/providers/oraclecloud/services/filestorage/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/filestorage/filestorage_file_system_encrypted_with_cmk/__init__.py b/tests/providers/oraclecloud/services/filestorage/filestorage_file_system_encrypted_with_cmk/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/__init__.py b/tests/providers/oraclecloud/services/identity/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_iam_admins_cannot_update_tenancy_admins/__init__.py b/tests/providers/oraclecloud/services/identity/identity_iam_admins_cannot_update_tenancy_admins/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_instance_principal_used/__init__.py b/tests/providers/oraclecloud/services/identity/identity_instance_principal_used/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_no_resources_in_root_compartment/__init__.py b/tests/providers/oraclecloud/services/identity/identity_no_resources_in_root_compartment/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_non_root_compartment_exists/__init__.py b/tests/providers/oraclecloud/services/identity/identity_non_root_compartment_exists/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_password_policy_expires_within_365_days/__init__.py b/tests/providers/oraclecloud/services/identity/identity_password_policy_expires_within_365_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_password_policy_minimum_length_14/__init__.py b/tests/providers/oraclecloud/services/identity/identity_password_policy_minimum_length_14/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_password_policy_prevents_reuse/__init__.py b/tests/providers/oraclecloud/services/identity/identity_password_policy_prevents_reuse/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_service_level_admins_exist/__init__.py b/tests/providers/oraclecloud/services/identity/identity_service_level_admins_exist/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_tenancy_admin_permissions_limited/__init__.py b/tests/providers/oraclecloud/services/identity/identity_tenancy_admin_permissions_limited/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_tenancy_admin_users_no_api_keys/__init__.py b/tests/providers/oraclecloud/services/identity/identity_tenancy_admin_users_no_api_keys/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_api_keys_rotated_90_days/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_api_keys_rotated_90_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_auth_tokens_rotated_90_days/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_auth_tokens_rotated_90_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_customer_secret_keys_rotated_90_days/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_customer_secret_keys_rotated_90_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_db_passwords_rotated_90_days/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_db_passwords_rotated_90_days/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_mfa_enabled_console_access/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_mfa_enabled_console_access/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/identity/identity_user_valid_email_address/__init__.py b/tests/providers/oraclecloud/services/identity/identity_user_valid_email_address/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/integration/__init__.py b/tests/providers/oraclecloud/services/integration/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/integration/integration_instance_access_restricted/__init__.py b/tests/providers/oraclecloud/services/integration/integration_instance_access_restricted/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/kms/__init__.py b/tests/providers/oraclecloud/services/kms/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/kms/kms_key_rotation_enabled/__init__.py b/tests/providers/oraclecloud/services/kms/kms_key_rotation_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/logging/__init__.py b/tests/providers/oraclecloud/services/logging/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/__init__.py b/tests/providers/oraclecloud/services/network/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_default_security_list_restricts_traffic/__init__.py b/tests/providers/oraclecloud/services/network/network_default_security_list_restricts_traffic/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_rdp_port/__init__.py b/tests/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_rdp_port/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_ssh_port/__init__.py b/tests/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_ssh_port/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_rdp_port/__init__.py b/tests/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_rdp_port/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_ssh_port/__init__.py b/tests/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_ssh_port/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/network/network_vcn_subnet_flow_logs_enabled/__init__.py b/tests/providers/oraclecloud/services/network/network_vcn_subnet_flow_logs_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/objectstorage/__init__.py b/tests/providers/oraclecloud/services/objectstorage/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_encrypted_with_cmk/__init__.py b/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_encrypted_with_cmk/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_logging_enabled/__init__.py b/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_logging_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_not_publicly_accessible/__init__.py b/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_not_publicly_accessible/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_versioning_enabled/__init__.py b/tests/providers/oraclecloud/services/objectstorage/objectstorage_bucket_versioning_enabled/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/tests/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached_test.py b/tests/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached_test.py
new file mode 100644
index 0000000000..7d9094e72c
--- /dev/null
+++ b/tests/providers/stackit/services/iaas/iaas_server_public_ip_attached/iaas_server_public_ip_attached_test.py
@@ -0,0 +1,117 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.stackit.services.iaas.iaas_service import Server
+from tests.providers.stackit.stackit_fixtures import (
+ STACKIT_PROJECT_ID,
+ set_mocked_stackit_provider,
+)
+
+
+class Test_iaas_server_public_ip_attached:
+ def _run_check(self, iaas_client):
+ with (
+ mock.patch(
+ "prowler.providers.common.provider.Provider.get_global_provider",
+ return_value=set_mocked_stackit_provider(),
+ ),
+ mock.patch(
+ "prowler.providers.stackit.services.iaas.iaas_service.IaaSService",
+ new=iaas_client,
+ ) as service_client,
+ mock.patch(
+ "prowler.providers.stackit.services.iaas.iaas_client.iaas_client",
+ new=service_client,
+ ),
+ ):
+ from prowler.providers.stackit.services.iaas.iaas_server_public_ip_attached.iaas_server_public_ip_attached import (
+ iaas_server_public_ip_attached,
+ )
+
+ check = iaas_server_public_ip_attached()
+ return check.execute()
+
+ def test_no_servers(self):
+ iaas_client = mock.MagicMock
+ iaas_client.servers = []
+
+ result = self._run_check(iaas_client)
+ assert len(result) == 0
+
+ def test_server_without_public_ip(self):
+ iaas_client = mock.MagicMock
+ server_id = str(uuid4())
+ server_name = "private-server"
+
+ iaas_client.servers = [
+ Server(
+ id=server_id,
+ name=server_name,
+ project_id=STACKIT_PROJECT_ID,
+ region="eu01",
+ has_public_ip=False,
+ )
+ ]
+
+ result = self._run_check(iaas_client)
+ assert len(result) == 1
+ assert result[0].status == "PASS"
+ assert (
+ result[0].status_extended
+ == f"Server {server_name} does not have a public IP address attached."
+ )
+ assert result[0].resource_id == server_id
+ assert result[0].resource_name == server_name
+ assert result[0].location == "eu01"
+
+ def test_server_with_public_ip(self):
+ iaas_client = mock.MagicMock
+ server_id = str(uuid4())
+ server_name = "public-server"
+
+ iaas_client.servers = [
+ Server(
+ id=server_id,
+ name=server_name,
+ project_id=STACKIT_PROJECT_ID,
+ region="eu01",
+ has_public_ip=True,
+ )
+ ]
+
+ result = self._run_check(iaas_client)
+ assert len(result) == 1
+ assert result[0].status == "FAIL"
+ assert "has a public IP address directly attached" in result[0].status_extended
+ assert result[0].resource_id == server_id
+ assert result[0].resource_name == server_name
+ assert result[0].location == "eu01"
+
+ def test_multiple_servers_mixed(self):
+ iaas_client = mock.MagicMock
+ private_id = str(uuid4())
+ public_id = str(uuid4())
+
+ iaas_client.servers = [
+ Server(
+ id=private_id,
+ name="private-server",
+ project_id=STACKIT_PROJECT_ID,
+ region="eu01",
+ has_public_ip=False,
+ ),
+ Server(
+ id=public_id,
+ name="public-server",
+ project_id=STACKIT_PROJECT_ID,
+ region="eu01",
+ has_public_ip=True,
+ ),
+ ]
+
+ result = self._run_check(iaas_client)
+ assert len(result) == 2
+
+ by_id = {r.resource_id: r for r in result}
+ assert by_id[private_id].status == "PASS"
+ assert by_id[public_id].status == "FAIL"
diff --git a/tests/providers/stackit/services/iaas/iaas_service_test.py b/tests/providers/stackit/services/iaas/iaas_service_test.py
index 79ea0c33de..41f5a4e601 100644
--- a/tests/providers/stackit/services/iaas/iaas_service_test.py
+++ b/tests/providers/stackit/services/iaas/iaas_service_test.py
@@ -1,4 +1,5 @@
from unittest.mock import MagicMock, patch
+from uuid import UUID
import pytest
@@ -32,6 +33,9 @@ class Test_IaaS_Service:
assert isinstance(iaas_service.server_nics, list)
assert isinstance(iaas_service.in_use_sg_ids, set)
assert iaas_service.scan_unused_services is False
+ assert isinstance(iaas_service.servers, list)
+ assert isinstance(iaas_service._nic_device_index, dict)
+ assert isinstance(iaas_service._public_ip_server_ids, set)
def test_service_project_id(self):
"""Test that the service correctly extracts project_id from provider."""
@@ -63,6 +67,8 @@ class Test_IaaS_Service:
("_list_server_nics", "list_project_nics"),
("_list_security_groups", "list_security_groups"),
("_list_security_group_rules", "list_security_group_rules"),
+ ("_list_public_ips", "list_public_ips"),
+ ("_list_servers", "list_servers"),
],
)
def test_list_methods_propagate_api_errors(self, method_name, client_method_name):
@@ -432,6 +438,9 @@ class Test_IaaS_Service_Fetch_All_Regions:
service.security_groups = []
service.server_nics = []
service.in_use_sg_ids = set()
+ service.servers = []
+ service._nic_device_index = {}
+ service._public_ip_server_ids = set()
return service
def _good_client(self, sg_id="sg-eu01"):
@@ -439,6 +448,8 @@ class Test_IaaS_Service_Fetch_All_Regions:
client.list_project_nics.return_value = {"items": []}
client.list_security_groups.return_value = {"items": [{"id": sg_id}]}
client.list_security_group_rules.return_value = {"items": []}
+ client.list_public_ips.return_value = {"items": []}
+ client.list_servers.return_value = {"items": []}
return client
def _missing_region_client(self):
@@ -513,3 +524,336 @@ class Test_IaaS_Service_Log_Skipped_Security_Groups:
with caplog.at_level(logging.INFO):
service._log_skipped_security_groups()
assert "scan-unused-services" not in caplog.text
+
+
+class Test_IaaS_Service_NIC_Device_Index:
+ """NIC device index is built during _list_server_nics to enable
+ public IP → server cross-reference.
+ """
+
+ def _service(self):
+ from prowler.providers.stackit.stackit_provider import StackitProvider
+
+ service = object.__new__(IaaSService)
+ service.provider = MagicMock()
+ service.provider.handle_api_error = StackitProvider.handle_api_error
+ service.project_id = STACKIT_PROJECT_ID
+ service.server_nics = []
+ service.in_use_sg_ids = set()
+ service._nic_device_index = {}
+ return service
+
+ def test_nic_with_id_and_device_is_indexed(self):
+ service = self._service()
+ nic_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ device_id = UUID("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")
+ nic = MagicMock()
+ nic.id = nic_id
+ nic.device = device_id
+ nic.security_groups = []
+ client = MagicMock()
+ client.list_project_nics.return_value = {"items": [nic]}
+
+ service._list_server_nics(client, "eu01")
+
+ assert str(nic_id) in service._nic_device_index
+ assert service._nic_device_index[str(nic_id)] == str(device_id)
+
+ def test_nic_without_device_is_not_indexed(self):
+ service = self._service()
+ nic = MagicMock()
+ nic.id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ nic.device = None
+ nic.security_groups = []
+ client = MagicMock()
+ client.list_project_nics.return_value = {"items": [nic]}
+
+ service._list_server_nics(client, "eu01")
+
+ assert service._nic_device_index == {}
+
+ def test_nic_indexing_error_is_skipped(self):
+ """A NIC that raises while reading its id is skipped, not fatal."""
+
+ class MalformedNIC:
+ @property
+ def id(self):
+ raise ValueError("malformed nic")
+
+ service = self._service()
+ client = MagicMock()
+ client.list_project_nics.return_value = {"items": [MalformedNIC()]}
+
+ service._list_server_nics(client, "eu01")
+
+ assert service._nic_device_index == {}
+
+ def test_dict_shaped_nic_is_indexed(self):
+ """Raw dict NICs are indexed the same as SDK model NICs."""
+ service = self._service()
+ client = MagicMock()
+ client.list_project_nics.return_value = {
+ "items": [{"id": "nic-1", "device": "server-1", "security_groups": []}]
+ }
+
+ service._list_server_nics(client, "eu01")
+
+ assert service._nic_device_index == {"nic-1": "server-1"}
+
+
+class Test_IaaS_Service_PublicIps:
+ """Tests for _list_public_ips."""
+
+ def _service(self):
+ from prowler.providers.stackit.stackit_provider import StackitProvider
+
+ service = object.__new__(IaaSService)
+ service.provider = MagicMock()
+ service.provider.handle_api_error = StackitProvider.handle_api_error
+ service.project_id = STACKIT_PROJECT_ID
+ service._nic_device_index = {}
+ service._public_ip_server_ids = set()
+ return service
+
+ def test_unattached_ip_is_ignored(self):
+ service = self._service()
+ ip = MagicMock()
+ ip.network_interface = None
+ client = MagicMock()
+ client.list_public_ips.return_value = {"items": [ip]}
+
+ service._list_public_ips(client, "eu01")
+
+ assert service._public_ip_server_ids == set()
+
+ def test_attached_ip_with_known_nic_marks_server(self):
+ nic_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ server_id = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
+ service = self._service()
+ service._nic_device_index = {str(nic_id): server_id}
+ ip = MagicMock()
+ ip.network_interface = nic_id
+ client = MagicMock()
+ client.list_public_ips.return_value = {"items": [ip]}
+
+ service._list_public_ips(client, "eu01")
+
+ assert server_id in service._public_ip_server_ids
+
+ def test_attached_ip_with_unknown_nic_is_ignored(self):
+ service = self._service()
+ service._nic_device_index = {}
+ ip = MagicMock()
+ ip.network_interface = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ client = MagicMock()
+ client.list_public_ips.return_value = {"items": [ip]}
+
+ service._list_public_ips(client, "eu01")
+
+ assert service._public_ip_server_ids == set()
+
+ def test_list_public_ips_without_client_is_noop(self):
+ """A missing regional client is logged and skipped, not fatal."""
+ service = self._service()
+
+ service._list_public_ips(None, "eu01")
+
+ assert service._public_ip_server_ids == set()
+
+ def test_public_ip_processing_error_is_skipped(self):
+ """A public IP that raises while being read is skipped, not fatal."""
+
+ class MalformedIP:
+ @property
+ def network_interface(self):
+ raise ValueError("malformed public ip")
+
+ service = self._service()
+ client = MagicMock()
+ client.list_public_ips.return_value = {"items": [MalformedIP()]}
+
+ service._list_public_ips(client, "eu01")
+
+ assert service._public_ip_server_ids == set()
+
+ def test_dict_shaped_public_ip_marks_server(self):
+ """Raw dict public IPs (camelCase networkInterface) mark the server."""
+ service = self._service()
+ service._nic_device_index = {"nic-1": "server-1"}
+ client = MagicMock()
+ client.list_public_ips.return_value = {"items": [{"networkInterface": "nic-1"}]}
+
+ service._list_public_ips(client, "eu01")
+
+ assert "server-1" in service._public_ip_server_ids
+
+
+class Test_IaaS_Service_Servers:
+ """Tests for _list_servers."""
+
+ def _service(self):
+ from prowler.providers.stackit.stackit_provider import StackitProvider
+
+ service = object.__new__(IaaSService)
+ service.provider = MagicMock()
+ service.provider.handle_api_error = StackitProvider.handle_api_error
+ service.project_id = STACKIT_PROJECT_ID
+ service.servers = []
+ service._public_ip_server_ids = set()
+ return service
+
+ def test_server_without_public_ip(self):
+ server_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ service = self._service()
+ server_data = MagicMock()
+ server_data.id = server_id
+ server_data.name = "my-server"
+ client = MagicMock()
+ client.list_servers.return_value = {"items": [server_data]}
+
+ service._list_servers(client, "eu01")
+
+ assert len(service.servers) == 1
+ assert service.servers[0].has_public_ip is False
+
+ def test_server_with_public_ip(self):
+ server_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+ service = self._service()
+ service._public_ip_server_ids = {str(server_id)}
+ server_data = MagicMock()
+ server_data.id = server_id
+ server_data.name = "my-server"
+ client = MagicMock()
+ client.list_servers.return_value = {"items": [server_data]}
+
+ service._list_servers(client, "eu01")
+
+ assert len(service.servers) == 1
+ assert service.servers[0].has_public_ip is True
+
+ def test_empty_response(self):
+ service = self._service()
+ client = MagicMock()
+ client.list_servers.return_value = {"items": []}
+
+ service._list_servers(client, "eu01")
+
+ assert service.servers == []
+
+ def test_server_public_ip_detected_end_to_end(self):
+ """Full cross-reference: NIC → public IP → server flagged has_public_ip."""
+ from prowler.providers.stackit.stackit_provider import StackitProvider
+
+ nic_id = UUID("cccccccc-cccc-cccc-cccc-cccccccccccc")
+ server_id = UUID("dddddddd-dddd-dddd-dddd-dddddddddddd")
+
+ nic = MagicMock()
+ nic.id = nic_id
+ nic.device = server_id
+ nic.security_groups = []
+
+ ip = MagicMock()
+ ip.network_interface = nic_id
+
+ server_data = MagicMock()
+ server_data.id = server_id
+ server_data.name = "internet-server"
+
+ client = MagicMock()
+ client.list_project_nics.return_value = {"items": [nic]}
+ client.list_security_groups.return_value = {"items": []}
+ client.list_public_ips.return_value = {"items": [ip]}
+ client.list_servers.return_value = {"items": [server_data]}
+
+ service = object.__new__(IaaSService)
+ service.provider = MagicMock()
+ service.provider.handle_api_error = StackitProvider.handle_api_error
+ service.project_id = STACKIT_PROJECT_ID
+ service.scan_unused_services = False
+ service.regional_clients = {"eu01": client}
+ service.security_groups = []
+ service.server_nics = []
+ service.in_use_sg_ids = set()
+ service.servers = []
+ service._nic_device_index = {}
+ service._public_ip_server_ids = set()
+
+ service._fetch_all_regions()
+
+ assert len(service.servers) == 1
+ assert service.servers[0].has_public_ip is True
+
+ def test_list_servers_without_client_is_noop(self):
+ """A missing regional client is logged and skipped, not fatal."""
+ service = self._service()
+
+ service._list_servers(None, "eu01")
+
+ assert service.servers == []
+
+ def test_server_processing_error_is_skipped(self):
+ """A server that raises while being read is skipped, not fatal."""
+
+ class MalformedServer:
+ @property
+ def id(self):
+ raise ValueError("malformed server")
+
+ service = self._service()
+ client = MagicMock()
+ client.list_servers.return_value = {"items": [MalformedServer()]}
+
+ service._list_servers(client, "eu01")
+
+ assert service.servers == []
+
+ def test_dict_shaped_server_is_created(self):
+ """Raw dict servers are created and flagged from _public_ip_server_ids."""
+ service = self._service()
+ service._public_ip_server_ids = {"server-1"}
+ client = MagicMock()
+ client.list_servers.return_value = {
+ "items": [{"id": "server-1", "name": "dict-server"}]
+ }
+
+ service._list_servers(client, "eu01")
+
+ assert len(service.servers) == 1
+ assert service.servers[0].name == "dict-server"
+ assert service.servers[0].has_public_ip is True
+
+ def test_dict_shaped_public_ip_detected_end_to_end(self):
+ """Dict-shaped NIC/IP/server still correlate to has_public_ip=True.
+
+ Regression for the getattr-only correlation path: a dict-shaped
+ response must not silently report a PASS for an exposed server.
+ """
+ from prowler.providers.stackit.stackit_provider import StackitProvider
+
+ client = MagicMock()
+ client.list_project_nics.return_value = {
+ "items": [{"id": "nic-1", "device": "server-1", "security_groups": []}]
+ }
+ client.list_security_groups.return_value = {"items": []}
+ client.list_public_ips.return_value = {"items": [{"networkInterface": "nic-1"}]}
+ client.list_servers.return_value = {
+ "items": [{"id": "server-1", "name": "dict-server"}]
+ }
+
+ service = object.__new__(IaaSService)
+ service.provider = MagicMock()
+ service.provider.handle_api_error = StackitProvider.handle_api_error
+ service.project_id = STACKIT_PROJECT_ID
+ service.scan_unused_services = False
+ service.regional_clients = {"eu01": client}
+ service.security_groups = []
+ service.server_nics = []
+ service.in_use_sg_ids = set()
+ service.servers = []
+ service._nic_device_index = {}
+ service._public_ip_server_ids = set()
+
+ service._fetch_all_regions()
+
+ assert len(service.servers) == 1
+ assert service.servers[0].has_public_ip is True
diff --git a/ui/.vitest-attachments/10e901bc49347998108ddd603b413d594a3921f3.png b/ui/.vitest-attachments/10e901bc49347998108ddd603b413d594a3921f3.png
new file mode 100644
index 0000000000..1bf6ac5bd6
Binary files /dev/null and b/ui/.vitest-attachments/10e901bc49347998108ddd603b413d594a3921f3.png differ
diff --git a/ui/.vitest-attachments/e6f22611d8493abc2bfeaeb5808f35df7eabcb6d.png b/ui/.vitest-attachments/e6f22611d8493abc2bfeaeb5808f35df7eabcb6d.png
new file mode 100644
index 0000000000..54e4f258ce
Binary files /dev/null and b/ui/.vitest-attachments/e6f22611d8493abc2bfeaeb5808f35df7eabcb6d.png differ
diff --git a/ui/AGENTS.md b/ui/AGENTS.md
index 7c06cc56b1..5939d11394 100644
--- a/ui/AGENTS.md
+++ b/ui/AGENTS.md
@@ -40,6 +40,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
| Restructuring routes or layouts covered by a tour | `prowler-tour` |
| Review changelog format and conventions | `prowler-changelog` |
+| Reviewing Prowler UI components | `prowler-ui` |
| Testing hooks or utilities | `vitest` |
| Update CHANGELOG.md in any component | `prowler-changelog` |
| Using Zustand stores | `zustand-5` |
@@ -96,8 +97,8 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
### Component Placement
```text
-New/Existing UI? → shadcn/ui + Tailwind (NEVER HeroUI for new code)
-Used 1 feature? → features/{feature}/components | Used 2+? → components/{domain}/
+New UI primitive? → components/shadcn/ (shadcn/ui + Tailwind)
+Used by 1 domain? → components/{domain}/ | Used by 2+ domains? → components/shared/
Needs state/hooks? → "use client" | Server component? → No directive
```
@@ -193,7 +194,7 @@ test("action works", { tag: ["@critical", "@feature"] }, async ({ page }) => {
Next.js 16.2.3 | React 19.2.5 | Tailwind 4.1.18 | shadcn/ui
Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8 | NextAuth 5.0.0-beta.30 | Recharts 2.15.4
-> **Note**: HeroUI exists in `components/ui/` as legacy code. Do NOT add new components there.
+> **Note**: `components/ui/` only holds temporary re-export shims for the prowler-cloud overlay. Do NOT add new components there.
---
@@ -204,7 +205,7 @@ ui/
├── app/(auth)/ # Auth pages
├── app/(prowler)/ # Main app: compliance, findings, providers, scans
├── components/shadcn/ # shadcn/ui components (USE THIS)
-├── components/ui/ # HeroUI (LEGACY - do not add here)
+├── components/ui/ # Cloud-overlay re-export shims (do not add here)
├── actions/ # Server actions
├── types/ # Shared types
├── hooks/ # Shared hooks
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 7d76c8a27f..40cb61691f 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,6 +2,98 @@
All notable changes to the **Prowler UI** are documented in this file.
+<!-- changelog: release notes start -->
+
+## [1.35.0] (Prowler v5.35.0)
+
+### 🔄 Changed
+
+- AWS Organizations onboarding now deploys the management account role and the member-account StackSet from a single CloudFormation stack, replacing the manual StackSet console step [(#11927)](https://github.com/prowler-cloud/prowler/pull/11927)
+- Dynamic providers can now be renamed and deleted from the Providers table [(#11957)](https://github.com/prowler-cloud/prowler/pull/11957)
+- Sidebar navigation with grouped sections, clearer active states, and a responsive mobile overlay [(#11994)](https://github.com/prowler-cloud/prowler/pull/11994)
+- Core Prowler tools in Lighthouse use the `prowler_*` namespace while preserving legacy `prowler_app_*` compatibility [(#12017)](https://github.com/prowler-cloud/prowler/pull/12017)
+
+### 🐞 Fixed
+
+- The AWS S3 integration CloudFormation quick-create link now sets the bucket owner account ID, preventing a stack validation error when S3 integration is enabled [(#11927)](https://github.com/prowler-cloud/prowler/pull/11927)
+- `Scan ID` filter on the Findings page now shows the active scan when opening findings from a scan's `View Findings` action [(#11997)](https://github.com/prowler-cloud/prowler/pull/11997)
+
+### 🔐 Security
+
+- `js-yaml` to 4.3.0, `@sentry/nextjs` to 10.65.0 with `import-in-the-middle` 3.3.1, and transitive `hono`, `dompurify`, `ws`, `vite`, `@babel/core` and `@opentelemetry/core` to patched versions, resolving 13 npm audit advisories (3 high, 9 moderate, 1 low) plus `hono` CVE-2026-59896, published on NVD but not yet in the npm audit feed [(#12029)](https://github.com/prowler-cloud/prowler/pull/12029)
+
+---
+
+## [1.34.0] (Prowler v5.34.0)
+
+### 🚀 Added
+
+- Dynamically registered providers are now listed, filtered, and rendered across the UI, using a generic icon and humanized label when no bespoke assets exist, a "Custom" badge, and read-only handling for non-configurable providers [(#11869)](https://github.com/prowler-cloud/prowler/pull/11869)
+- Prowler Local Server branding and contextual Prowler Cloud upgrade prompts across navigation, scans, providers, compliance, findings, alerts, and Lighthouse AI [(#11982)](https://github.com/prowler-cloud/prowler/pull/11982)
+
+### 🔄 Changed
+
+- UI components migrated from HeroUI to shared shadcn primitives [(#11532)](https://github.com/prowler-cloud/prowler/pull/11532)
+- UI integration enable flags renamed to past tense — `UI_SENTRY_ENABLE` → `UI_SENTRY_ENABLED`, `UI_GOOGLE_TAG_MANAGER_ENABLE` → `UI_GOOGLE_TAG_MANAGER_ENABLED`, `UI_POSTHOG_ENABLE` → `UI_POSTHOG_ENABLED`; deployments that set the former names must update them [(#11917)](https://github.com/prowler-cloud/prowler/pull/11917)
+
+### 🐞 Fixed
+
+- Fixed metronome billing failing to start when PostHog was enabled, caused by a stale reference to the renamed UI_POSTHOG_ENABLED flag [(#11938)](https://github.com/prowler-cloud/prowler/pull/11938)
+- Lighthouse AI overview entry now starts a new remediation conversation, and returning to Overview restores app navigation mode [(#11955)](https://github.com/prowler-cloud/prowler/pull/11955)
+
+---
+
+## [1.33.1] (Prowler v5.33.1)
+
+### 🔄 Changed
+
+- RBAC role forms now explain Unlimited Visibility inside the Visibility section and keep the setting visible while group selection is hidden [(#11890)](https://github.com/prowler-cloud/prowler/pull/11890)
+
+### 🐞 Fixed
+
+- CIS Level 1 and Level 2 compliance filters now match profiles prefixed with a license tier (e.g. "E3 Level 1"), so M365 CIS requirements are no longer hidden [(#11924)](https://github.com/prowler-cloud/prowler/pull/11924)
+- Jira dispatch polling now reports failed issue creation tasks instead of treating partial failures as successful [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+
+---
+
+## [1.33.0] (Prowler v5.33.0)
+
+### 🚀 Added
+
+- Owners can delete their last organization from the profile page [(#11864)](https://github.com/prowler-cloud/prowler/pull/11864)
+
+### 🔄 Changed
+
+- Organization row actions in the profile page are aligned in fixed columns and the Active indicator now sits next to the organization name [(#11864)](https://github.com/prowler-cloud/prowler/pull/11864)
+- Sentry, Google Tag Manager, and PostHog now load their `UI_*` config only when the matching enable flag (`UI_SENTRY_ENABLE` / `UI_GOOGLE_TAG_MANAGER_ENABLE` / `UI_POSTHOG_ENABLE`) is `"true"` (default off); the deprecated legacy names (`NEXT_PUBLIC_*`, `POSTHOG_KEY`/`POSTHOG_HOST`) still activate without the flag [(#11682)](https://github.com/prowler-cloud/prowler/pull/11682)
+
+---
+
+## [1.32.1] (Prowler v5.32.1)
+
+### 🐞 Fixed
+
+- Invitation callback paths are now preserved when invited users continue with Google, GitHub, or SAML authentication [(#11752)](https://github.com/prowler-cloud/prowler/pull/11752)
+
+### 🔐 Security
+
+- Kubernetes provider credential forms now reject kubeconfigs using `exec` authentication in Prowler Cloud before submission [(#11753)](https://github.com/prowler-cloud/prowler/pull/11753)
+
+---
+
+## [1.32.0] (Prowler v5.32.0)
+
+### 🚀 Added
+
+- Filter the Overview, Findings, Resources, Scans, and Providers views by provider group [(#11659)](https://github.com/prowler-cloud/prowler/pull/11659)
+- CIS Controls v8.1 compliance support, including its detail view and report mapping [(#11700)](https://github.com/prowler-cloud/prowler/pull/11700)
+
+### 🔄 Changed
+
+- Improve scan configuration wording and add a documentation link to clarify baseline settings and how custom scan configurations override them [(#11859)](https://github.com/prowler-cloud/prowler/pull/11859)
+
+---
+
## [1.31.1] (Prowler v5.31.1)
### 🔄 Changed
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 86673ba046..6ab9752972 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -78,8 +78,14 @@ ENV HOSTNAME="0.0.0.0"
# NOT baked into the image. Supply it via your orchestrator (docker-compose,
# Helm/K8s):
# - required: UI_API_BASE_URL, AUTH_URL, AUTH_SECRET (missing ⇒ fail fast at boot)
-# - optional: UI_API_DOCS_URL, UI_GOOGLE_TAG_MANAGER_ID, UI_SENTRY_DSN, UI_SENTRY_ENVIRONMENT
-# - reserved: POSTHOG_KEY, POSTHOG_HOST, REO_DEV_CLIENT_ID (no consumer yet)
+# - optional: UI_API_DOCS_URL
+# - gated integrations (load only when *_ENABLED="true"; the value is then
+# required or boot fails). Legacy names (NEXT_PUBLIC_*, POSTHOG_KEY/HOST)
+# still activate without the flag:
+# UI_SENTRY_ENABLED + UI_SENTRY_DSN (+ optional UI_SENTRY_ENVIRONMENT)
+# UI_GOOGLE_TAG_MANAGER_ENABLED + UI_GOOGLE_TAG_MANAGER_ID
+# UI_POSTHOG_ENABLED + UI_POSTHOG_KEY + UI_POSTHOG_HOST (no consumer yet)
+# - reserved: REO_DEV_CLIENT_ID (no consumer yet)
# server.js is created by next build from the standalone output
# https://nextjs.org/docs/pages/api-reference/next-config-js/output
CMD ["node", "server.js"]
diff --git a/ui/README.md b/ui/README.md
index 998dc84a37..31b6ae3057 100644
--- a/ui/README.md
+++ b/ui/README.md
@@ -114,10 +114,9 @@ pnpm run dev
## Technologies Used
-- [Next.js 14](https://nextjs.org/docs/getting-started)
-- [NextUI v2](https://nextui.org/)
-- [Tailwind CSS](https://tailwindcss.com/)
-- [Tailwind Variants](https://tailwind-variants.org)
+- [Next.js 16](https://nextjs.org/docs/getting-started)
+- [shadcn/ui](https://ui.shadcn.com/) (built on [Radix UI](https://www.radix-ui.com/))
+- [Tailwind CSS 4](https://tailwindcss.com/)
- [TypeScript](https://www.typescriptlang.org/)
- [Framer Motion](https://www.framer.com/motion/)
- [next-themes](https://github.com/pacocoursey/next-themes)
diff --git a/ui/actions/finding-groups/finding-groups.adapter.test.ts b/ui/actions/finding-groups/finding-groups.adapter.test.ts
index c9b4a0314c..e4dcb66804 100644
--- a/ui/actions/finding-groups/finding-groups.adapter.test.ts
+++ b/ui/actions/finding-groups/finding-groups.adapter.test.ts
@@ -1,10 +1,26 @@
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+} from "@/types/findings-triage";
import {
adaptFindingGroupResourcesResponse,
adaptFindingGroupsResponse,
} from "./finding-groups.adapter";
+const expectNoRawTriageTransportKeys = (value: Record<string, unknown>) => {
+ expect(value).not.toHaveProperty("triage_status");
+ expect(value).not.toHaveProperty("triage_has_note");
+ expect(value).not.toHaveProperty("attributes");
+ expect(value).not.toHaveProperty("relationships");
+};
+
+afterEach(() => {
+ vi.unstubAllEnvs();
+});
+
// ---------------------------------------------------------------------------
// Fix 1: adaptFindingGroupsResponse — unknown + type guard
// ---------------------------------------------------------------------------
@@ -21,17 +37,6 @@ describe("adaptFindingGroupsResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when apiResponse has no data property", () => {
- // Given
- const input = { meta: { total: 0 } };
-
- // When
- const result = adaptFindingGroupsResponse(input);
-
- // Then
- expect(result).toEqual([]);
- });
-
it("should return [] when data is not an array", () => {
// Given
const input = { data: "not-an-array" };
@@ -43,28 +48,6 @@ describe("adaptFindingGroupsResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when data is null", () => {
- // Given
- const input = { data: null };
-
- // When
- const result = adaptFindingGroupsResponse(input);
-
- // Then
- expect(result).toEqual([]);
- });
-
- it("should return [] when apiResponse is undefined", () => {
- // Given
- const input = undefined;
-
- // When
- const result = adaptFindingGroupsResponse(input);
-
- // Then
- expect(result).toEqual([]);
- });
-
it("should return mapped rows for valid data", () => {
// Given
const input = {
@@ -106,6 +89,10 @@ describe("adaptFindingGroupsResponse — malformed input", () => {
first_seen_at: null,
last_seen_at: "2024-01-01T00:00:00Z",
failing_since: null,
+ finding_id: "group-finding-id-1",
+ finding_uid: "group-finding-uid-1",
+ triage_status: "risk_accepted",
+ triage_has_note: true,
},
},
],
@@ -121,6 +108,10 @@ describe("adaptFindingGroupsResponse — malformed input", () => {
expect(result[0].muted).toBe(true);
expect(result[0].manualCount).toBe(1);
expect(result[0].newFailMutedCount).toBe(1);
+ expect(result[0]).not.toHaveProperty("triage");
+ expectNoRawTriageTransportKeys(
+ result[0] as unknown as Record<string, unknown>,
+ );
});
});
@@ -137,14 +128,6 @@ describe("adaptFindingGroupResourcesResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when apiResponse has no data property", () => {
- // Given/When
- const result = adaptFindingGroupResourcesResponse({ meta: {} }, "check-1");
-
- // Then
- expect(result).toEqual([]);
- });
-
it("should return [] when data is not an array", () => {
// Given/When
const result = adaptFindingGroupResourcesResponse({ data: {} }, "check-1");
@@ -153,12 +136,206 @@ describe("adaptFindingGroupResourcesResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when apiResponse is undefined", () => {
- // Given/When
- const result = adaptFindingGroupResourcesResponse(undefined, "check-1");
+ it("should keep resource rows with valid attributes even when JSON:API type differs", () => {
+ // Given
+ const input = {
+ data: [
+ {
+ id: "resource-row-1",
+ type: "findings",
+ attributes: {
+ finding_id: "real-finding-uuid",
+ finding_uid: "prowler-finding-uid-1",
+ triage_status: "remediating",
+ triage_notes_count: 1,
+ resource: {
+ uid: "arn:aws:s3:::my-bucket",
+ name: "my-bucket",
+ service: "s3",
+ region: "us-east-1",
+ type: "Bucket",
+ resource_group: "default",
+ },
+ provider: {
+ type: "aws",
+ uid: "123456789",
+ alias: "production",
+ },
+ status: "FAIL",
+ severity: "high",
+ first_seen_at: null,
+ last_seen_at: "2024-01-01T00:00:00Z",
+ },
+ },
+ ],
+ };
+
+ // When
+ const result = adaptFindingGroupResourcesResponse(input, "check-1");
// Then
- expect(result).toEqual([]);
+ expect(result).toHaveLength(1);
+ expect(result[0]).toEqual(
+ expect.objectContaining({
+ findingId: "real-finding-uuid",
+ resourceName: "my-bucket",
+ triage: expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ hasVisibleNote: true,
+ }),
+ }),
+ );
+ });
+
+ it("should skip malformed resource entries inside a data array", () => {
+ // Given
+ const input = {
+ data: [
+ null,
+ "bad-entry",
+ {
+ id: "resource-row-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "real-finding-uuid",
+ resource: {
+ uid: "arn:aws:s3:::my-bucket",
+ name: "my-bucket",
+ service: "s3",
+ region: "us-east-1",
+ type: "Bucket",
+ resource_group: "default",
+ },
+ provider: {
+ type: "aws",
+ uid: "123456789",
+ alias: "production",
+ },
+ status: "FAIL",
+ severity: "high",
+ first_seen_at: null,
+ last_seen_at: "2024-01-01T00:00:00Z",
+ },
+ },
+ ],
+ };
+
+ // When
+ const result = adaptFindingGroupResourcesResponse(input, "check-1");
+
+ // Then
+ expect(result).toHaveLength(1);
+ expect(result[0]).toEqual(
+ expect.objectContaining({
+ findingId: "real-finding-uuid",
+ resourceName: "my-bucket",
+ }),
+ );
+ });
+
+ it("should attach adapter-produced triage DTOs to finding-level resource rows", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const input = {
+ data: [
+ {
+ id: "resource-row-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "real-finding-uuid",
+ finding_uid: "prowler-finding-uid-1",
+ triage_status: "under_review",
+ triage_has_note: true,
+ resource: {
+ uid: "arn:aws:s3:::my-bucket",
+ name: "my-bucket",
+ service: "s3",
+ region: "us-east-1",
+ type: "Bucket",
+ resource_group: "default",
+ },
+ provider: {
+ type: "aws",
+ uid: "123456789",
+ alias: "production",
+ },
+ status: "FAIL",
+ muted: false,
+ delta: "new",
+ severity: "critical",
+ first_seen_at: null,
+ last_seen_at: "2024-01-01T00:00:00Z",
+ },
+ },
+ ],
+ };
+
+ // When
+ const [row] = adaptFindingGroupResourcesResponse(input, "s3_check");
+
+ // Then
+ expect(row.triage).toEqual(
+ expect.objectContaining({
+ findingId: "real-finding-uuid",
+ findingUid: "prowler-finding-uid-1",
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ canEdit: true,
+ }),
+ );
+ expectNoRawTriageTransportKeys(
+ row.triage as unknown as Record<string, unknown>,
+ );
+ });
+
+ it("should leave triage editing disabled until a real capability is provided", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ const input = {
+ data: [
+ {
+ id: "resource-row-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "real-finding-uuid",
+ finding_uid: "prowler-finding-uid-1",
+ triage_status: "open",
+ triage_has_note: false,
+ resource: {
+ uid: "arn:aws:s3:::my-bucket",
+ name: "my-bucket",
+ service: "s3",
+ region: "us-east-1",
+ type: "Bucket",
+ resource_group: "default",
+ },
+ provider: {
+ type: "aws",
+ uid: "123456789",
+ alias: "production",
+ },
+ status: "FAIL",
+ muted: false,
+ delta: "new",
+ severity: "critical",
+ first_seen_at: null,
+ last_seen_at: "2024-01-01T00:00:00Z",
+ },
+ },
+ ],
+ };
+
+ // When
+ const [row] = adaptFindingGroupResourcesResponse(input, "s3_check");
+
+ // Then
+ expect(row.triage).toEqual(
+ expect.objectContaining({
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ }),
+ );
});
it("should return mapped rows for valid data", () => {
diff --git a/ui/actions/finding-groups/finding-groups.adapter.ts b/ui/actions/finding-groups/finding-groups.adapter.ts
index 6b78bc189a..c9ee7167c6 100644
--- a/ui/actions/finding-groups/finding-groups.adapter.ts
+++ b/ui/actions/finding-groups/finding-groups.adapter.ts
@@ -1,3 +1,5 @@
+import { adaptFindingTriageSummariesResponse } from "@/actions/findings/findings-triage.adapter";
+import { getFindingTriageAdapterOptions } from "@/actions/findings/findings-triage.options";
import type {
FindingGroupRow,
FindingResourceRow,
@@ -72,6 +74,7 @@ export function adaptFindingGroupsResponse(
}
const data = (apiResponse as { data: FindingGroupApiItem[] }).data;
+
return data.map((item) => ({
id: item.id,
rowType: FINDINGS_ROW_TYPE.GROUP,
@@ -146,6 +149,9 @@ interface FindingGroupResourceAttributes {
first_seen_at: string | null;
last_seen_at: string | null;
muted_reason?: string | null;
+ finding_uid?: string;
+ triage_status?: string;
+ triage_has_note?: boolean;
}
interface FindingGroupResourceApiItem {
@@ -154,6 +160,26 @@ interface FindingGroupResourceApiItem {
attributes: FindingGroupResourceAttributes;
}
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+ value !== null && typeof value === "object";
+
+const isFindingGroupResourceApiItem = (
+ value: unknown,
+): value is FindingGroupResourceApiItem => {
+ if (!isRecord(value) || typeof value.id !== "string") {
+ return false;
+ }
+
+ const attributes = value.attributes;
+
+ return (
+ isRecord(attributes) &&
+ typeof attributes.finding_id === "string" &&
+ isRecord(attributes.resource) &&
+ isRecord(attributes.provider)
+ );
+};
+
/**
* Transforms the API response for finding group resources (drill-down)
* into FindingResourceRow[].
@@ -171,13 +197,20 @@ export function adaptFindingGroupResourcesResponse(
return [];
}
- const data = (apiResponse as { data: FindingGroupResourceApiItem[] }).data;
- return data.map((item) => ({
+ const data = (apiResponse as { data: unknown[] }).data.filter(
+ isFindingGroupResourceApiItem,
+ );
+ const triageSummaries = adaptFindingTriageSummariesResponse(
+ { ...apiResponse, data },
+ getFindingTriageAdapterOptions(),
+ );
+
+ return data.map((item, index) => ({
id: item.id,
rowType: FINDINGS_ROW_TYPE.RESOURCE,
findingId: item.attributes.finding_id || item.id,
checkId,
- providerType: (item.attributes.provider?.type || "aws") as ProviderType,
+ providerType: (item.attributes.provider?.type ?? "") as ProviderType,
providerAlias: item.attributes.provider?.alias || "",
providerUid: item.attributes.provider?.uid || "",
resourceName: item.attributes.resource?.name || "-",
@@ -194,5 +227,6 @@ export function adaptFindingGroupResourcesResponse(
mutedReason: item.attributes.muted_reason || undefined,
firstSeenAt: item.attributes.first_seen_at,
lastSeenAt: item.attributes.last_seen_at,
+ triage: triageSummaries[index],
}));
}
diff --git a/ui/actions/finding-groups/finding-groups.ts b/ui/actions/finding-groups/finding-groups.ts
index bf5df80aae..faa697cf32 100644
--- a/ui/actions/finding-groups/finding-groups.ts
+++ b/ui/actions/finding-groups/finding-groups.ts
@@ -2,6 +2,7 @@
import { redirect } from "next/navigation";
+import type { FindingsFilterParam } from "@/actions/findings/findings-filters";
import {
apiBaseUrl,
composeSort,
@@ -15,7 +16,6 @@ import {
} from "@/lib";
import { appendSanitizedProviderFilters } from "@/lib/provider-filters";
import { handleApiResponse } from "@/lib/server-actions-helper";
-import { FilterParam } from "@/types/filters";
/**
* Maps filter[search] to filter[check_title__icontains] for finding-groups.
@@ -39,7 +39,7 @@ function mapSearchFilter(
* finding-group resources sub-endpoint. These must be stripped before
* calling the resources API to avoid empty results.
*/
-const FINDING_GROUP_RESOURCE_UNSUPPORTED_FILTERS: FilterParam[] = [
+const FINDING_GROUP_RESOURCE_UNSUPPORTED_FILTERS: FindingsFilterParam[] = [
"filter[service__in]",
"filter[scan__in]",
"filter[scan_id]",
@@ -53,7 +53,7 @@ function normalizeFindingGroupResourceFilters(
Object.entries(filters).filter(
([key]) =>
!FINDING_GROUP_RESOURCE_UNSUPPORTED_FILTERS.includes(
- key as FilterParam,
+ key as FindingsFilterParam,
),
),
);
diff --git a/ui/actions/findings/findings-by-resource.adapter.test.ts b/ui/actions/findings/findings-by-resource.adapter.test.ts
index a94f34a9c4..24be4cd6ed 100644
--- a/ui/actions/findings/findings-by-resource.adapter.test.ts
+++ b/ui/actions/findings/findings-by-resource.adapter.test.ts
@@ -22,6 +22,8 @@ vi.mock("next/navigation", () => ({
// Import after mocks
// ---------------------------------------------------------------------------
+import { FINDING_TRIAGE_STATUS } from "@/types/findings-triage";
+
import { adaptFindingsByResourceResponse } from "./findings-by-resource.adapter";
// ---------------------------------------------------------------------------
@@ -43,22 +45,6 @@ describe("adaptFindingsByResourceResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when apiResponse is undefined", () => {
- // Given/When
- const result = adaptFindingsByResourceResponse(undefined);
-
- // Then
- expect(result).toEqual([]);
- });
-
- it("should return [] when apiResponse has no data property", () => {
- // Given/When
- const result = adaptFindingsByResourceResponse({ meta: {} });
-
- // Then
- expect(result).toEqual([]);
- });
-
it("should return [] when data is not an array", () => {
// Given/When
const result = adaptFindingsByResourceResponse({ data: "bad" });
@@ -75,14 +61,6 @@ describe("adaptFindingsByResourceResponse — malformed input", () => {
expect(result).toEqual([]);
});
- it("should return [] when data is a number", () => {
- // Given/When
- const result = adaptFindingsByResourceResponse({ data: 42 });
-
- // Then
- expect(result).toEqual([]);
- });
-
it("should return mapped findings for valid minimal data", () => {
// Given — minimal valid JSON:API shape
const input = {
@@ -194,8 +172,8 @@ describe("adaptFindingsByResourceResponse — malformed input", () => {
expect(result[0].resourceMetadata).toBeNull();
});
- it("should normalize a single finding response into a one-item drawer array", () => {
- // Given — getFindingById returns a single JSON:API resource object
+ it("should preserve triage summary fields for a single finding response", () => {
+ // Given - getFindingById returns a single finding with provisional triage fields
const input = {
data: {
id: "finding-1",
@@ -204,6 +182,10 @@ describe("adaptFindingsByResourceResponse — malformed input", () => {
check_id: "s3_check",
status: "FAIL",
severity: "critical",
+ triage_id: "triage-1",
+ triage_status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ triage_notes_count: 1,
+ triage_has_note: true,
check_metadata: {
checktitle: "S3 Check",
},
@@ -220,8 +202,16 @@ describe("adaptFindingsByResourceResponse — malformed input", () => {
const result = adaptFindingsByResourceResponse(input);
// Then
- expect(result).toHaveLength(1);
- expect(result[0].id).toBe("finding-1");
- expect(result[0].checkTitle).toBe("S3 Check");
+ expect(result[0].triage).toEqual(
+ expect.objectContaining({
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ }),
+ );
});
});
diff --git a/ui/actions/findings/findings-by-resource.adapter.ts b/ui/actions/findings/findings-by-resource.adapter.ts
index 0312df00da..3ebae3c6c5 100644
--- a/ui/actions/findings/findings-by-resource.adapter.ts
+++ b/ui/actions/findings/findings-by-resource.adapter.ts
@@ -1,5 +1,8 @@
+import { adaptFindingTriageSummariesResponse } from "@/actions/findings/findings-triage.adapter";
+import { getFindingTriageAdapterOptions } from "@/actions/findings/findings-triage.options";
import { createDict } from "@/lib";
import type { ProviderType, Severity } from "@/types";
+import type { FindingTriageSummary } from "@/types/findings-triage";
export interface RemediationRecommendation {
text: string;
@@ -49,6 +52,7 @@ export interface ResourceDrawerFinding {
mutedReason: string | null;
firstSeenAt: string | null;
updatedAt: string | null;
+ triage?: FindingTriageSummary;
// Resource
resourceId: string;
resourceUid: string;
@@ -195,8 +199,12 @@ export function adaptFindingsByResourceResponse(
const findings = Array.isArray(apiResponse.data)
? apiResponse.data
: [apiResponse.data];
+ const triageSummaries = adaptFindingTriageSummariesResponse(
+ { ...apiResponse, data: findings },
+ getFindingTriageAdapterOptions(),
+ );
- return findings.map((item) => {
+ return findings.map((item, index) => {
const attrs = item.attributes;
const meta = (attrs.check_metadata || {}) as Record<string, unknown>;
const remediationRaw = meta.remediation as
@@ -254,6 +262,7 @@ export function adaptFindingsByResourceResponse(
mutedReason: attrs.muted_reason || null,
firstSeenAt: attrs.first_seen_at || null,
updatedAt: attrs.updated_at || null,
+ triage: triageSummaries[index],
// Resource
resourceId: resourceRel?.id || "",
resourceUid: (resourceAttrs.uid as string | undefined) || "-",
diff --git a/ui/actions/findings/findings-filters.ts b/ui/actions/findings/findings-filters.ts
new file mode 100644
index 0000000000..268d71e7cd
--- /dev/null
+++ b/ui/actions/findings/findings-filters.ts
@@ -0,0 +1,40 @@
+import { FILTER_FIELD, FilterParam } from "@/types/filters";
+
+/** Findings-only filter fields not shared with other views. */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const FINDINGS_EXTRA_FIELD = {
+ DELTA_IN: "delta__in",
+ SCAN_EXACT: "scan",
+ SCAN_ID: "scan_id",
+ SCAN_ID_IN: "scan_id__in",
+ INSERTED_AT: "inserted_at",
+ INSERTED_AT_GTE: "inserted_at__gte",
+ INSERTED_AT_LTE: "inserted_at__lte",
+ MUTED: "muted",
+} as const;
+
+type FindingsExtraField =
+ (typeof FINDINGS_EXTRA_FIELD)[keyof typeof FINDINGS_EXTRA_FIELD];
+
+/**
+ * URL filter param keys the findings view supports, e.g. `filter[severity__in]`.
+ * Composed from the shared fields it uses plus a few findings-only extras
+ * (alternate scan/date/delta forms not used by other views).
+ */
+export type FindingsFilterParam = FilterParam<
+ // findings uses provider_id, not provider_uid
+ | (typeof FILTER_FIELD)[
+ | "PROVIDER_TYPE"
+ | "PROVIDER_ID"
+ | "PROVIDER_GROUPS"
+ | "REGION"
+ | "SERVICE"
+ | "SEVERITY"
+ | "STATUS"
+ | "DELTA"
+ | "RESOURCE_TYPE"
+ | "CATEGORY"
+ | "RESOURCE_GROUPS"
+ | "SCAN"]
+ | FindingsExtraField
+>;
diff --git a/ui/actions/findings/findings-triage.adapter.test.ts b/ui/actions/findings/findings-triage.adapter.test.ts
new file mode 100644
index 0000000000..c84500677c
--- /dev/null
+++ b/ui/actions/findings/findings-triage.adapter.test.ts
@@ -0,0 +1,417 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+ FINDING_TRIAGE_STATUS_LABELS,
+} from "@/types/findings-triage";
+
+import {
+ adaptFindingTriageDetailResponse,
+ adaptFindingTriageSummariesResponse,
+ adaptLatestFindingTriageNote,
+ attachFindingTriageSummariesToResponse,
+} from "./findings-triage.adapter";
+import {
+ allProvisionalTriageStatusFindings,
+ findingTriageDetailResponse,
+ flatFindingWithAcceptedRiskTriage,
+ flatFindingWithNotePresenceOnly,
+ flatFindingWithUnderReviewTriage,
+ flatPassFindingWithoutPersistedTriage,
+} from "./findings-triage.fixtures";
+
+const expectNoRawTransportKeys = (value: Record<string, unknown>) => {
+ expect(value).not.toHaveProperty("attributes");
+ expect(value).not.toHaveProperty("relationships");
+ expect(value).not.toHaveProperty("included");
+ expect(value).not.toHaveProperty("triage_status");
+ expect(value).not.toHaveProperty("triage_has_note");
+ expect(value).not.toHaveProperty("triage_note");
+ expect(value).not.toHaveProperty("current_note");
+ expect(value).not.toHaveProperty("source");
+ expect(value).not.toHaveProperty("updated_by");
+ expect(value).not.toHaveProperty("inserted_at");
+ expect(value).not.toHaveProperty("updated_at");
+};
+
+describe("provisional findings triage contract fixtures", () => {
+ it("should document every triage status the provisional contract can return", () => {
+ // Given
+ const input = {
+ data: allProvisionalTriageStatusFindings,
+ };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input, {
+ canEdit: true,
+ });
+
+ // Then
+ expect(result).toHaveLength(7);
+ expect(result.map((summary) => summary.status)).toEqual([
+ FINDING_TRIAGE_STATUS.OPEN,
+ FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ FINDING_TRIAGE_STATUS.REMEDIATING,
+ FINDING_TRIAGE_STATUS.RESOLVED,
+ FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+ FINDING_TRIAGE_STATUS.REOPENED,
+ ]);
+ expect(result.map((summary) => summary.label)).toEqual([
+ "Open",
+ "Under Review",
+ "Remediating",
+ "Resolved",
+ "Risk Accepted",
+ "False Positive",
+ "Reopened",
+ ]);
+ expect(result[0].label).toBe(
+ FINDING_TRIAGE_STATUS_LABELS[FINDING_TRIAGE_STATUS.OPEN],
+ );
+ });
+
+ it("should model table note presence without requiring note previews", () => {
+ // Given
+ const input = {
+ data: [flatFindingWithNotePresenceOnly],
+ };
+
+ // When
+ const [summary] = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(summary).toEqual(
+ expect.objectContaining({
+ findingId: "finding-note-presence-1",
+ findingUid: "prowler-finding-note-presence-uid-1",
+ hasVisibleNote: true,
+ }),
+ );
+ expect(JSON.stringify(summary)).not.toContain("triage_note");
+ expect(JSON.stringify(summary)).not.toContain("current_note");
+ });
+
+ it("should model modal note detail as a separate detail payload", () => {
+ // Given / When
+ const detail = adaptFindingTriageDetailResponse(
+ findingTriageDetailResponse,
+ );
+
+ // Then
+ expect(detail.noteBody).toBe("Current note visible only inside the modal.");
+ expect(detail.hasVisibleNote).toBe(true);
+ expect(detail.maxNoteLength).toBe(500);
+ });
+
+ it("should model disabled non-paying state through adapter options only", () => {
+ // Given
+ const input = {
+ data: [flatFindingWithUnderReviewTriage],
+ };
+
+ // When
+ const [summary] = adaptFindingTriageSummariesResponse(input, {
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ });
+
+ // Then
+ expect(summary.canEdit).toBe(false);
+ expect(summary.disabledReason).toBe(
+ FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ );
+ expect(summary.billingHref).toBe("https://prowler.com/pricing");
+ });
+});
+
+describe("adaptLatestFindingTriageNote", () => {
+ it("should adapt the newest note from a JSON:API collection", () => {
+ // Given
+ const response = {
+ data: [
+ {
+ id: "note-latest",
+ type: "finding-triage-notes",
+ attributes: {
+ body: "Latest investigation note",
+ },
+ },
+ ],
+ };
+
+ // When
+ const result = adaptLatestFindingTriageNote(response);
+
+ // Then
+ expect(result).toEqual({
+ noteId: "note-latest",
+ noteBody: "Latest investigation note",
+ });
+ });
+
+ it("should return null when the response has no usable note", () => {
+ expect(adaptLatestFindingTriageNote({ data: [] })).toBeNull();
+ expect(
+ adaptLatestFindingTriageNote({ data: [{ id: "note-1" }] }),
+ ).toBeNull();
+ });
+});
+
+describe("adaptFindingTriageSummariesResponse", () => {
+ it("should return [] when the provisional API response is malformed", () => {
+ // Given
+ const input = { meta: { count: 0 } };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(result).toEqual([]);
+ });
+
+ it("should skip malformed entries inside a data array", () => {
+ // Given
+ const input = {
+ data: [null, "bad-entry", flatFindingWithUnderReviewTriage],
+ };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(result).toHaveLength(1);
+ expect(result[0]).toEqual(
+ expect.objectContaining({
+ findingId: "finding-1",
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ }),
+ );
+ });
+
+ it("should not shift attached summaries after malformed entries", () => {
+ // Given
+ const validWithoutTriage = {
+ id: "resource-row-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "finding-1",
+ finding_uid: "prowler-finding-uid-1",
+ triage_status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ triage_notes_count: 1,
+ status: "FAIL",
+ },
+ };
+ const laterValidWithoutTriage = {
+ id: "resource-row-2",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "finding-2",
+ finding_uid: "prowler-finding-uid-2",
+ triage_status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ triage_notes_count: 0,
+ status: "MUTED",
+ },
+ };
+ const input = {
+ data: [validWithoutTriage, null, laterValidWithoutTriage],
+ };
+
+ // When
+ const result = attachFindingTriageSummariesToResponse(input);
+
+ // Then
+ expect(result?.data[0]).toEqual(
+ expect.objectContaining({
+ triage: expect.objectContaining({
+ findingId: "finding-1",
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ }),
+ }),
+ );
+ expect(result?.data[1]).toBeNull();
+ expect(result?.data[2]).toEqual(
+ expect.objectContaining({
+ triage: expect.objectContaining({
+ findingId: "finding-2",
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ }),
+ }),
+ );
+ });
+
+ it("should use triage_notes_count from the resource triage API contract", () => {
+ // Given
+ const input = {
+ data: [
+ {
+ id: "resource-row-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "finding-1",
+ finding_uid: "prowler-finding-uid-1",
+ triage_status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ triage_notes_count: 5,
+ status: "FAIL",
+ },
+ },
+ {
+ id: "resource-row-2",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "finding-2",
+ finding_uid: "prowler-finding-uid-2",
+ triage_status: FINDING_TRIAGE_STATUS.OPEN,
+ triage_notes_count: 0,
+ status: "FAIL",
+ },
+ },
+ ],
+ };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(result).toHaveLength(2);
+ expect(result[0]).toEqual(
+ expect.objectContaining({
+ hasVisibleNote: true,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ }),
+ );
+ expect(result[1]).toEqual(
+ expect.objectContaining({
+ hasVisibleNote: false,
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ );
+ });
+
+ it("should mark triage as muted when resource status is MUTED", () => {
+ // Given
+ const input = {
+ data: [
+ {
+ id: "resource-row-muted-1",
+ type: "finding-group-resources",
+ attributes: {
+ finding_id: "finding-muted-1",
+ finding_uid: "prowler-finding-muted-uid-1",
+ triage_status: FINDING_TRIAGE_STATUS.OPEN,
+ triage_notes_count: 0,
+ status: "MUTED",
+ },
+ },
+ ],
+ };
+
+ // When
+ const [summary] = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(summary).toEqual(
+ expect.objectContaining({
+ findingId: "finding-muted-1",
+ isMuted: true,
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ );
+ });
+
+ it("should normalize flat provisional finding fields into domain triage summaries", () => {
+ // Given
+ const input = {
+ data: [flatFindingWithUnderReviewTriage],
+ };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input, {
+ canEdit: true,
+ });
+
+ // Then
+ expect(result).toEqual([
+ expect.objectContaining({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ }),
+ ]);
+ });
+
+ it("should fallback from scan status when no persisted triage status exists", () => {
+ // Given
+ const input = {
+ data: [flatPassFindingWithoutPersistedTriage],
+ };
+
+ // When
+ const result = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expect(result[0]).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.RESOLVED,
+ label: "Resolved",
+ hasVisibleNote: false,
+ }),
+ );
+ });
+
+ it("should keep raw provisional fields out of table component DTOs", () => {
+ // Given
+ const input = {
+ data: [flatFindingWithAcceptedRiskTriage],
+ };
+
+ // When
+ const [summary] = adaptFindingTriageSummariesResponse(input);
+
+ // Then
+ expectNoRawTransportKeys(summary as unknown as Record<string, unknown>);
+ expect(JSON.stringify(summary)).not.toContain("Accepted risk note body");
+ });
+});
+
+describe("adaptFindingTriageDetailResponse", () => {
+ it("should normalize provisional detail payloads into modal DTOs", () => {
+ // Given
+ const input = findingTriageDetailResponse;
+
+ // When
+ const detail = adaptFindingTriageDetailResponse(input, {
+ canEdit: true,
+ });
+
+ // Then
+ expect(detail).toEqual(
+ expect.objectContaining({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ label: "Risk Accepted",
+ hasVisibleNote: true,
+ canEdit: true,
+ noteBody: "Current note visible only inside the modal.",
+ maxNoteLength: 500,
+ }),
+ );
+ });
+
+ it("should keep raw provisional fields out of modal component DTOs", () => {
+ // Given
+ const input = findingTriageDetailResponse;
+
+ // When
+ const detail = adaptFindingTriageDetailResponse(input);
+
+ // Then
+ expectNoRawTransportKeys(detail as unknown as Record<string, unknown>);
+ });
+});
diff --git a/ui/actions/findings/findings-triage.adapter.ts b/ui/actions/findings/findings-triage.adapter.ts
new file mode 100644
index 0000000000..2ddfec94e9
--- /dev/null
+++ b/ui/actions/findings/findings-triage.adapter.ts
@@ -0,0 +1,218 @@
+import {
+ FINDING_TRIAGE_BILLING_HREF,
+ FINDING_TRIAGE_NOTE_MAX_LENGTH,
+ FINDING_TRIAGE_STATUS,
+ FINDING_TRIAGE_STATUS_LABELS,
+ type FindingTriageDetail,
+ type FindingTriageDisabledReason,
+ type FindingTriageLoadedNote,
+ type FindingTriageStatus,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+// API/backend triage implementation is external to this UI slice. Keep final
+// contract churn isolated here (and the server action transport) so table/modal
+// components continue consuming stable domain DTOs.
+interface FindingTriageAdapterOptions {
+ canEdit?: boolean;
+ disabledReason?: FindingTriageDisabledReason;
+ billingHref?: string;
+}
+
+interface FindingTriageAttributes {
+ finding_id?: string;
+ finding_uid?: string;
+ uid?: string;
+ triage_id?: string;
+ triage_notes_count?: number;
+ triage_status?: unknown;
+ triage_has_note?: boolean;
+ status?: unknown;
+ muted?: boolean;
+ body?: unknown;
+ current_note?: string;
+ note?: string;
+ has_note?: boolean;
+ note_id?: string;
+}
+
+interface JsonApiResource {
+ id?: string;
+ attributes?: FindingTriageAttributes;
+}
+
+interface NormalizedTriageFields {
+ status: FindingTriageStatus;
+ hasVisibleNote: boolean;
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+ value !== null && typeof value === "object";
+
+const isJsonApiResource = (value: unknown): value is JsonApiResource =>
+ isRecord(value) &&
+ (!("attributes" in value) ||
+ value.attributes === undefined ||
+ isRecord(value.attributes));
+
+const isFindingTriageStatus = (value: unknown): value is FindingTriageStatus =>
+ typeof value === "string" &&
+ Object.values(FINDING_TRIAGE_STATUS).includes(value as FindingTriageStatus);
+
+const fallbackStatusFromFindingStatus = (
+ findingStatus: unknown,
+): FindingTriageStatus =>
+ findingStatus === "PASS"
+ ? FINDING_TRIAGE_STATUS.RESOLVED
+ : FINDING_TRIAGE_STATUS.OPEN;
+
+const normalizeTriageFields = (
+ finding: JsonApiResource,
+): NormalizedTriageFields => {
+ const attributes = finding.attributes ?? {};
+
+ if (isFindingTriageStatus(attributes.triage_status)) {
+ return {
+ status: attributes.triage_status,
+ hasVisibleNote:
+ (typeof attributes.triage_notes_count === "number" &&
+ attributes.triage_notes_count >= 1) ||
+ attributes.triage_has_note === true,
+ };
+ }
+
+ return {
+ status: fallbackStatusFromFindingStatus(attributes.status),
+ hasVisibleNote: false,
+ };
+};
+
+const createSummary = (
+ finding: JsonApiResource,
+ triageFields: NormalizedTriageFields,
+ options: FindingTriageAdapterOptions,
+): FindingTriageSummary => {
+ const attributes = finding.attributes ?? {};
+ const summary: FindingTriageSummary = {
+ findingId: attributes.finding_id || finding.id || "",
+ findingUid: attributes.uid || attributes.finding_uid || "",
+ triageId: attributes.triage_id || null,
+ notesCount: attributes.triage_notes_count ?? 0,
+ status: triageFields.status,
+ label: FINDING_TRIAGE_STATUS_LABELS[triageFields.status],
+ hasVisibleNote: triageFields.hasVisibleNote,
+ isMuted:
+ typeof attributes.muted === "boolean"
+ ? attributes.muted
+ : attributes.status === "MUTED",
+ canEdit: options.canEdit ?? false,
+ billingHref: options.billingHref ?? FINDING_TRIAGE_BILLING_HREF,
+ };
+
+ if (options.disabledReason) {
+ summary.disabledReason = options.disabledReason;
+ }
+
+ return summary;
+};
+
+export function adaptFindingTriageSummariesResponse(
+ apiResponse: unknown,
+ options: FindingTriageAdapterOptions = {},
+): FindingTriageSummary[] {
+ if (!isRecord(apiResponse) || !Array.isArray(apiResponse.data)) {
+ return [];
+ }
+
+ return apiResponse.data
+ .filter(isJsonApiResource)
+ .map((finding) =>
+ createSummary(finding, normalizeTriageFields(finding), options),
+ );
+}
+
+export function adaptLatestFindingTriageNote(
+ apiResponse: unknown,
+): FindingTriageLoadedNote | null {
+ const latestNote =
+ isRecord(apiResponse) && Array.isArray(apiResponse.data)
+ ? apiResponse.data.find(isJsonApiResource)
+ : undefined;
+ const noteId = latestNote?.id;
+ const noteBody = latestNote?.attributes?.body;
+
+ if (typeof noteId !== "string" || !noteId || typeof noteBody !== "string") {
+ return null;
+ }
+
+ return {
+ noteId,
+ noteBody,
+ };
+}
+
+export function attachFindingTriageSummariesToResponse<
+ T extends { data?: unknown },
+>(
+ apiResponse: T | undefined,
+ options: FindingTriageAdapterOptions = {},
+): T | undefined {
+ if (!apiResponse || !Array.isArray(apiResponse.data)) {
+ return apiResponse;
+ }
+
+ return {
+ ...apiResponse,
+ data: apiResponse.data.map((item) =>
+ isJsonApiResource(item)
+ ? {
+ ...item,
+ triage: createSummary(item, normalizeTriageFields(item), options),
+ }
+ : item,
+ ),
+ };
+}
+
+export function adaptFindingTriageDetailResponse(
+ apiResponse: unknown,
+ options: FindingTriageAdapterOptions = {},
+): FindingTriageDetail {
+ const data =
+ isRecord(apiResponse) && isJsonApiResource(apiResponse.data)
+ ? apiResponse.data
+ : undefined;
+ const attributes = data?.attributes ?? {};
+ const status = isFindingTriageStatus(attributes.status)
+ ? attributes.status
+ : FINDING_TRIAGE_STATUS.OPEN;
+ const noteBody =
+ typeof attributes.current_note === "string"
+ ? attributes.current_note
+ : typeof attributes.note === "string"
+ ? attributes.note
+ : "";
+ const summary = createSummary(
+ {
+ id: attributes.finding_id || data?.id || "",
+ attributes: {
+ finding_uid: attributes.finding_uid || "",
+ triage_id: data?.id,
+ triage_notes_count:
+ attributes.triage_notes_count ?? (noteBody.length > 0 ? 1 : 0),
+ },
+ },
+ {
+ status,
+ hasVisibleNote: attributes.has_note === true || noteBody.length > 0,
+ },
+ options,
+ );
+
+ return {
+ ...summary,
+ noteId: attributes.note_id || null,
+ noteBody,
+ maxNoteLength: FINDING_TRIAGE_NOTE_MAX_LENGTH,
+ };
+}
diff --git a/ui/actions/findings/findings-triage.fixtures.ts b/ui/actions/findings/findings-triage.fixtures.ts
new file mode 100644
index 0000000000..879564ed8b
--- /dev/null
+++ b/ui/actions/findings/findings-triage.fixtures.ts
@@ -0,0 +1,101 @@
+// Provisional UI/API contract fixtures only. API implementation is external to this
+// UI slice; when the final API lands, update the adapter/server-action seam instead
+// of teaching table or modal components about the transport payload shape.
+const createFlatFindingWithTriageStatus = (status: string, index: number) => ({
+ type: "findings",
+ id: `finding-contract-${index}`,
+ attributes: {
+ uid: `prowler-finding-contract-uid-${index}`,
+ status: "FAIL",
+ triage_status: status,
+ triage_has_note: false,
+ },
+});
+
+export const allProvisionalTriageStatusFindings = [
+ createFlatFindingWithTriageStatus("open", 1),
+ createFlatFindingWithTriageStatus("under_review", 2),
+ createFlatFindingWithTriageStatus("remediating", 3),
+ createFlatFindingWithTriageStatus("resolved", 4),
+ createFlatFindingWithTriageStatus("risk_accepted", 5),
+ createFlatFindingWithTriageStatus("false_positive", 6),
+ createFlatFindingWithTriageStatus("reopened", 7),
+] as const;
+
+export const flatFindingWithNotePresenceOnly = {
+ type: "findings",
+ id: "finding-note-presence-1",
+ attributes: {
+ uid: "prowler-finding-note-presence-uid-1",
+ status: "FAIL",
+ triage_id: "triage-note-presence-1",
+ triage_status: "under_review",
+ triage_notes_count: 1,
+ triage_has_note: true,
+ },
+} as const;
+
+export const flatFindingWithUnderReviewTriage = {
+ type: "findings",
+ id: "finding-1",
+ attributes: {
+ uid: "prowler-finding-uid-1",
+ status: "FAIL",
+ triage_id: "triage-note-presence-1",
+ triage_status: "under_review",
+ triage_notes_count: 1,
+ triage_has_note: true,
+ },
+} as const;
+
+export const flatPassFindingWithoutPersistedTriage = {
+ type: "findings",
+ id: "finding-pass-1",
+ attributes: {
+ uid: "prowler-finding-pass-uid-1",
+ status: "PASS",
+ triage_id: null,
+ triage_status: null,
+ triage_notes_count: 0,
+ triage_has_note: false,
+ },
+} as const;
+
+export const flatFindingWithAcceptedRiskTriage = {
+ type: "findings",
+ id: "finding-accepted-risk-1",
+ attributes: {
+ uid: "prowler-finding-accepted-risk-uid-1",
+ status: "FAIL",
+ triage_id: "triage-accepted-risk-1",
+ triage_status: "risk_accepted",
+ triage_notes_count: 1,
+ triage_has_note: true,
+ triage_note:
+ "Accepted risk note body that must never appear in a table DTO.",
+ source: "manual",
+ updated_by: "user-1",
+ inserted_at: "2026-06-01T10:00:00Z",
+ updated_at: "2026-06-01T10:05:00Z",
+ },
+} as const;
+
+export const findingTriageDetailResponse = {
+ data: {
+ type: "finding-triages",
+ id: "triage-detail-1",
+ attributes: {
+ finding_id: "finding-1",
+ finding_uid: "prowler-finding-uid-1",
+ status: "risk_accepted",
+ triage_notes_count: 1,
+ has_note: true,
+ note_id: "note-detail-1",
+ current_note: "Current note visible only inside the modal.",
+ source: "manual",
+ updated_by: "user-1",
+ inserted_at: "2026-06-03T10:00:00Z",
+ updated_at: "2026-06-03T10:05:00Z",
+ },
+ },
+} as const;
diff --git a/ui/actions/findings/findings-triage.options.ts b/ui/actions/findings/findings-triage.options.ts
new file mode 100644
index 0000000000..1d0ad6314a
--- /dev/null
+++ b/ui/actions/findings/findings-triage.options.ts
@@ -0,0 +1,20 @@
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ type FindingTriageDisabledReason,
+} from "@/types/findings-triage";
+
+interface FindingTriageAdapterOptions {
+ canEdit: boolean;
+ disabledReason?: FindingTriageDisabledReason;
+}
+
+export function getFindingTriageAdapterOptions(): FindingTriageAdapterOptions {
+ const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+
+ return {
+ canEdit: isCloudEnvironment,
+ ...(isCloudEnvironment
+ ? {}
+ : { disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY }),
+ };
+}
diff --git a/ui/actions/findings/findings-triage.test.ts b/ui/actions/findings/findings-triage.test.ts
new file mode 100644
index 0000000000..d494b64be5
--- /dev/null
+++ b/ui/actions/findings/findings-triage.test.ts
@@ -0,0 +1,644 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { FINDING_TRIAGE_STATUS } from "@/types/findings-triage";
+
+const {
+ createMuteRuleMock,
+ fetchMock,
+ getAuthHeadersMock,
+ handleApiResponseMock,
+} = vi.hoisted(() => ({
+ createMuteRuleMock: vi.fn(),
+ fetchMock: vi.fn(),
+ getAuthHeadersMock: vi.fn(),
+ handleApiResponseMock: vi.fn(),
+}));
+
+vi.mock("@/actions/mute-rules", () => ({
+ createMuteRule: createMuteRuleMock,
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.test/api/v1",
+ getAuthHeaders: getAuthHeadersMock,
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiResponse: handleApiResponseMock,
+}));
+
+const importActions = async () => import("./findings-triage");
+
+describe("findings triage actions", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal("fetch", fetchMock);
+ getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+ createMuteRuleMock.mockResolvedValue({ success: "muted" });
+ fetchMock.mockResolvedValue(new Response(null, { status: 200 }));
+ });
+
+ it("should load notes through the persisted triage route when triageId exists", async () => {
+ // Given
+ const { loadLatestFindingTriageNote } = await importActions();
+ handleApiResponseMock.mockResolvedValue({
+ data: [
+ {
+ id: "note-1",
+ type: "finding-triage-notes",
+ attributes: { body: "Existing note" },
+ },
+ ],
+ });
+
+ // When
+ const result = await loadLatestFindingTriageNote({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ });
+
+ // Then
+ expect(result).toEqual({ noteId: "note-1", noteBody: "Existing note" });
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/finding-triages/triage-1/notes",
+ expect.objectContaining({
+ headers: { Authorization: "Bearer token" },
+ }),
+ );
+ });
+
+ it("should load notes through the finding UID route when triageId is virtual", async () => {
+ // Given
+ const { loadLatestFindingTriageNote } = await importActions();
+ handleApiResponseMock.mockResolvedValue({
+ data: [
+ {
+ id: "note-1",
+ type: "finding-triage-notes",
+ attributes: { body: "Existing note" },
+ },
+ ],
+ });
+
+ // When
+ await loadLatestFindingTriageNote({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage/notes",
+ expect.any(Object),
+ );
+ });
+
+ it("should resolve findingUid from findingId before loading virtual triage notes", async () => {
+ // Given
+ const { loadLatestFindingTriageNote } = await importActions();
+ handleApiResponseMock
+ .mockResolvedValueOnce({
+ data: { attributes: { uid: "finding/stable/uid" } },
+ })
+ .mockResolvedValueOnce({
+ data: [
+ {
+ id: "note-1",
+ type: "finding-triage-notes",
+ attributes: { body: "Existing note" },
+ },
+ ],
+ });
+
+ // When
+ await loadLatestFindingTriageNote({
+ findingId: "finding-snapshot-id",
+ findingUid: "",
+ triageId: null,
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 1,
+ "https://api.test/api/v1/findings/finding-snapshot-id",
+ expect.any(Object),
+ );
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage/notes",
+ expect.any(Object),
+ );
+ });
+
+ it("should send the first note with the status update through the triage route", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "note-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "First note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledTimes(1);
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/finding-triages/triage-1",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "First note",
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should update an existing note through its note id", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "note-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ note: "Updated note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/finding-triages/triage-1/notes/note-1",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triage-notes",
+ attributes: {
+ body: "Updated note",
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should delete an existing persisted note when it is cleared", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "note-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ note: "",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/finding-triages/triage-1/notes/note-1",
+ {
+ method: "DELETE",
+ headers: { Authorization: "Bearer token" },
+ },
+ );
+ expect(fetchMock).not.toHaveBeenCalledWith(
+ "https://api.test/api/v1/finding-triages/triage-1/notes/note-1",
+ expect.objectContaining({ method: "PATCH" }),
+ );
+ });
+
+ it("should update an existing note and send status-only triage patch", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ note: "Updated note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 1,
+ "https://api.test/api/v1/finding-triages/triage-1/notes/note-1",
+ expect.objectContaining({ method: "PATCH" }),
+ );
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/finding-triages/triage-1",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should update a virtual existing note through the finding UID note route", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 1,
+ noteId: "note-1",
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ note: "Updated note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 1,
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage/notes/note-1",
+ expect.objectContaining({ method: "PATCH" }),
+ );
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should not patch virtual triage route for virtual existing-note-only updates", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "note-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 1,
+ noteId: "note-1",
+ note: "Updated note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledTimes(1);
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage/notes/note-1",
+ expect.objectContaining({ method: "PATCH" }),
+ );
+ });
+
+ it("should delete a virtual existing note when it is cleared", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "note-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 1,
+ noteId: "note-1",
+ note: "",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledTimes(1);
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage/notes/note-1",
+ expect.objectContaining({
+ method: "DELETE",
+ headers: { Authorization: "Bearer token" },
+ }),
+ );
+ });
+
+ it("should create a mute rule when status is Risk Accepted", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ });
+
+ // Then
+ expect(createMuteRuleMock).toHaveBeenCalledOnce();
+ const formData = createMuteRuleMock.mock.calls[0][1] as FormData;
+ expect(formData.get("finding_ids")).toBe(
+ JSON.stringify(["finding-snapshot-id"]),
+ );
+ expect(formData.get("name")).toBe(
+ "Finding triage: Risk Accepted - finding-snapshot-id",
+ );
+ expect(formData.get("reason")).toBe(
+ "Finding triage status changed to Risk Accepted.",
+ );
+ });
+
+ it("should reject and skip muting when triage patch returns an action error", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({
+ error: "Triage failed",
+ status: 400,
+ });
+
+ // When / Then
+ await expect(
+ updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ ).rejects.toThrow("Triage failed");
+ expect(createMuteRuleMock).not.toHaveBeenCalled();
+ });
+
+ it("should rollback triage status when automatic muting fails", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+ createMuteRuleMock.mockResolvedValue({
+ errors: { general: "Mute failed" },
+ });
+
+ // When / Then
+ await expect(
+ updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ ).rejects.toThrow("Mute failed");
+
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/finding-triages/triage-1",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should rollback virtual triage status through encoded finding UID when automatic muting fails", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+ createMuteRuleMock.mockResolvedValue({
+ errors: { general: "Mute failed" },
+ });
+
+ // When / Then
+ await expect(
+ updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ ).rejects.toThrow("Mute failed");
+
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ },
+ },
+ }),
+ }),
+ );
+ });
+
+ it("should not create a mute rule when the finding is already muted", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ isMuted: true,
+ });
+
+ // Then
+ expect(createMuteRuleMock).not.toHaveBeenCalled();
+ });
+
+ it("should not create a mute rule when moving between shortcut statuses", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+ previousStatus: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ });
+
+ // Then
+ expect(createMuteRuleMock).not.toHaveBeenCalled();
+ });
+
+ it("should not create a mute rule when shortcut status did not change", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ note: "First note",
+ });
+
+ // Then
+ expect(createMuteRuleMock).not.toHaveBeenCalled();
+ });
+
+ it("should not create a mute rule for regular triage statuses", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ });
+
+ // Then
+ expect(createMuteRuleMock).not.toHaveBeenCalled();
+ });
+
+ it("should update virtual triage through the finding UID route, not the snapshot id", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock.mockResolvedValue({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "finding/stable/uid",
+ triageId: null,
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage",
+ expect.objectContaining({ method: "PATCH" }),
+ );
+ });
+
+ it("should resolve findingUid from findingId before creating virtual triage", async () => {
+ // Given
+ const { updateFindingTriage } = await importActions();
+ handleApiResponseMock
+ .mockResolvedValueOnce({
+ data: { attributes: { uid: "finding/stable/uid" } },
+ })
+ .mockResolvedValueOnce({ data: { id: "triage-1" } });
+
+ // When
+ await updateFindingTriage({
+ findingId: "finding-snapshot-id",
+ findingUid: "",
+ triageId: null,
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "First note",
+ });
+
+ // Then
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 1,
+ "https://api.test/api/v1/findings/finding-snapshot-id",
+ expect.any(Object),
+ );
+ expect(fetchMock).toHaveBeenNthCalledWith(
+ 2,
+ "https://api.test/api/v1/findings/finding%2Fstable%2Fuid/triage",
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "First note",
+ },
+ },
+ }),
+ }),
+ );
+ });
+});
diff --git a/ui/actions/findings/findings-triage.ts b/ui/actions/findings/findings-triage.ts
new file mode 100644
index 0000000000..c08c7a1335
--- /dev/null
+++ b/ui/actions/findings/findings-triage.ts
@@ -0,0 +1,264 @@
+"use server";
+
+import { adaptLatestFindingTriageNote } from "@/actions/findings/findings-triage.adapter";
+import { createMuteRule } from "@/actions/mute-rules";
+import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { handleApiResponse } from "@/lib/server-actions-helper";
+import {
+ FINDING_TRIAGE_STATUS_LABELS,
+ type FindingTriageLoadedNote,
+ type FindingTriageSummary,
+ isMutelistShortcutStatus,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+const JSON_API_CONTENT_TYPE = "application/vnd.api+json";
+
+const buildFindingTriageBody = ({
+ status,
+ note,
+}: {
+ status?:
+ | UpdateFindingTriageInput["status"]
+ | UpdateFindingTriageInput["previousStatus"];
+ note?: UpdateFindingTriageInput["note"];
+}) => ({
+ data: {
+ type: "finding-triages",
+ attributes: {
+ ...(status ? { status } : {}),
+ ...(note ? { note } : {}),
+ },
+ },
+});
+
+const buildFindingTriageNoteBody = (body: string) => ({
+ data: {
+ type: "finding-triage-notes",
+ attributes: {
+ body,
+ },
+ },
+});
+
+const buildApiUrl = (path: `/${string}`) => {
+ if (!apiBaseUrl) {
+ throw new Error("API base URL is not configured.");
+ }
+
+ const url = new URL(apiBaseUrl);
+ url.pathname = `${url.pathname.replace(/\/$/, "")}${path}`;
+ return url.toString();
+};
+
+async function getJsonApi(path: `/${string}`) {
+ const headers = await getAuthHeaders({ contentType: false });
+ const response = await fetch(buildApiUrl(path), {
+ headers,
+ });
+
+ return handleApiResponse(response);
+}
+
+const throwIfApiError = (result: unknown) => {
+ if (
+ result &&
+ typeof result === "object" &&
+ ("error" in result ||
+ ("status" in result &&
+ typeof result.status === "number" &&
+ result.status >= 400))
+ ) {
+ throw new Error(
+ "error" in result && typeof result.error === "string"
+ ? result.error
+ : "Finding triage request failed.",
+ );
+ }
+};
+
+async function patchJsonApi(path: `/${string}`, body: unknown) {
+ const headers = await getAuthHeaders({ contentType: false });
+ const response = await fetch(buildApiUrl(path), {
+ method: "PATCH",
+ headers: {
+ ...headers,
+ "Content-Type": JSON_API_CONTENT_TYPE,
+ },
+ body: JSON.stringify(body),
+ });
+
+ const result = await handleApiResponse(response);
+ throwIfApiError(result);
+ return result;
+}
+
+async function deleteJsonApi(path: `/${string}`) {
+ const headers = await getAuthHeaders({ contentType: false });
+ const response = await fetch(buildApiUrl(path), {
+ method: "DELETE",
+ headers,
+ });
+
+ const result = await handleApiResponse(response);
+ throwIfApiError(result);
+ return result;
+}
+
+const shouldCreateTriageMuteRule = (
+ input: UpdateFindingTriageInput,
+): input is UpdateFindingTriageInput & {
+ status: NonNullable<UpdateFindingTriageInput["status"]>;
+} =>
+ Boolean(input.status) &&
+ input.previousStatus !== undefined &&
+ input.status !== input.previousStatus &&
+ input.isMuted !== true &&
+ isMutelistShortcutStatus(input.status) &&
+ !isMutelistShortcutStatus(input.previousStatus);
+
+async function createTriageMuteRule(input: UpdateFindingTriageInput) {
+ if (!shouldCreateTriageMuteRule(input)) {
+ return;
+ }
+
+ const label = FINDING_TRIAGE_STATUS_LABELS[input.status];
+ const formData = new FormData();
+ formData.set("name", `Finding triage: ${label} - ${input.findingId}`);
+ formData.set("reason", `Finding triage status changed to ${label}.`);
+ formData.set("finding_ids", JSON.stringify([input.findingId]));
+
+ const result = await createMuteRule(null, formData);
+
+ if (result?.errors) {
+ throw new Error(
+ result.errors.general ||
+ result.errors.finding_ids ||
+ result.errors.name ||
+ result.errors.reason ||
+ "Could not mute finding after triage status change.",
+ );
+ }
+}
+
+const encodePathSegment = (value: string) => encodeURIComponent(value);
+
+async function rollbackTriageStatus(
+ input: UpdateFindingTriageInput,
+ findingUid?: string,
+) {
+ if (!input.previousStatus || !shouldCreateTriageMuteRule(input)) {
+ return;
+ }
+
+ const previousStatus = input.previousStatus;
+
+ if (input.triageId) {
+ await patchJsonApi(
+ `/finding-triages/${input.triageId}`,
+ buildFindingTriageBody({ status: previousStatus }),
+ );
+ return;
+ }
+
+ if (findingUid) {
+ await patchJsonApi(
+ `/findings/${encodePathSegment(findingUid)}/triage`,
+ buildFindingTriageBody({ status: previousStatus }),
+ );
+ }
+}
+
+async function createMuteRuleOrRollback(
+ input: UpdateFindingTriageInput,
+ findingUid?: string,
+) {
+ try {
+ await createTriageMuteRule(input);
+ } catch (error) {
+ try {
+ await rollbackTriageStatus(input, findingUid);
+ } catch (rollbackError) {
+ console.error("Could not rollback finding triage status.", rollbackError);
+ }
+ throw error;
+ }
+}
+
+async function resolveFindingUid({
+ findingId,
+ findingUid,
+}: Pick<UpdateFindingTriageInput, "findingId" | "findingUid">) {
+ if (findingUid) {
+ return findingUid;
+ }
+
+ const apiResponse = await getJsonApi(
+ `/findings/${encodePathSegment(findingId)}`,
+ );
+ const resolvedFindingUid = apiResponse?.data?.attributes?.uid;
+
+ if (typeof resolvedFindingUid !== "string" || !resolvedFindingUid) {
+ throw new Error("Cannot create finding triage without findingUid.");
+ }
+
+ return resolvedFindingUid;
+}
+
+export async function loadLatestFindingTriageNote(
+ triage: FindingTriageSummary,
+): Promise<FindingTriageLoadedNote> {
+ const findingUid = triage.triageId
+ ? triage.findingUid
+ : await resolveFindingUid(triage);
+ const apiResponse = await getJsonApi(
+ triage.triageId
+ ? `/finding-triages/${triage.triageId}/notes`
+ : `/findings/${encodePathSegment(findingUid)}/triage/notes`,
+ );
+ const latestNote = adaptLatestFindingTriageNote(apiResponse);
+
+ if (!latestNote) {
+ throw new Error("Could not load the latest finding triage note.");
+ }
+
+ return latestNote;
+}
+
+export async function updateFindingTriage(input: UpdateFindingTriageInput) {
+ let findingUid: string | undefined;
+ let triagePath: `/${string}`;
+
+ if (input.triageId) {
+ triagePath = `/finding-triages/${input.triageId}`;
+ } else {
+ findingUid = await resolveFindingUid(input);
+ triagePath = `/findings/${encodePathSegment(findingUid)}/triage`;
+ }
+
+ if (input.note !== undefined && input.notesCount > 0 && input.noteId) {
+ const notePath: `/${string}` = `${triagePath}/notes/${input.noteId}`;
+ const noteResult =
+ input.note === ""
+ ? await deleteJsonApi(notePath)
+ : await patchJsonApi(notePath, buildFindingTriageNoteBody(input.note));
+
+ if (!input.status) {
+ return noteResult;
+ }
+ }
+
+ if (!input.status && !(input.note && input.notesCount === 0)) {
+ return undefined;
+ }
+
+ const result = await patchJsonApi(
+ triagePath,
+ buildFindingTriageBody({
+ status: input.status,
+ note: input.notesCount === 0 && input.note ? input.note : undefined,
+ }),
+ );
+ await createMuteRuleOrRollback(input, findingUid);
+ return result;
+}
diff --git a/ui/actions/findings/findings.test.ts b/ui/actions/findings/findings.test.ts
new file mode 100644
index 0000000000..efe04f119c
--- /dev/null
+++ b/ui/actions/findings/findings.test.ts
@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const {
+ fetchMock,
+ getAuthHeadersMock,
+ handleApiResponseMock,
+ appendSanitizedProviderTypeFiltersMock,
+ redirectMock,
+} = vi.hoisted(() => ({
+ fetchMock: vi.fn(),
+ getAuthHeadersMock: vi.fn(),
+ handleApiResponseMock: vi.fn(),
+ appendSanitizedProviderTypeFiltersMock: vi.fn(),
+ redirectMock: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ redirect: redirectMock,
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.example.com/api/v1",
+ getAuthHeaders: getAuthHeadersMock,
+}));
+
+vi.mock("@/lib/provider-filters", () => ({
+ appendSanitizedProviderTypeFilters: appendSanitizedProviderTypeFiltersMock,
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiResponse: handleApiResponseMock,
+}));
+
+import { FINDING_TRIAGE_STATUS } from "@/types/findings-triage";
+
+import { getFindings, getLatestFindings } from "./findings";
+
+const findingsResponse = {
+ data: [
+ {
+ type: "findings",
+ id: "finding-1",
+ attributes: {
+ uid: "prowler-finding-uid-1",
+ status: "FAIL",
+ triage_status: "under_review",
+ triage_has_note: true,
+ },
+ },
+ ],
+ meta: { pagination: { page: 1 } },
+};
+
+describe("findings actions triage projection", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal("fetch", fetchMock);
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+ fetchMock.mockResolvedValue(new Response("", { status: 200 }));
+ handleApiResponseMock.mockResolvedValue(findingsResponse);
+ });
+
+ it("should attach domain triage DTOs to historical findings responses", async () => {
+ // When
+ const result = await getFindings({ page: 1, pageSize: 10 });
+
+ // Then
+ expect(result?.data[0].triage).toEqual(
+ expect.objectContaining({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ canEdit: false,
+ disabledReason: "cloud_only",
+ }),
+ );
+ expect(result?.data[0].triage).not.toHaveProperty("triage_status");
+ expect(result?.data[0].triage).not.toHaveProperty("attributes");
+ });
+
+ it("should attach domain triage DTOs to latest findings responses", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ const result = await getLatestFindings({ page: 1, pageSize: 10 });
+
+ // Then
+ expect(result?.data[0].triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ canEdit: true,
+ }),
+ );
+ expect(result?.data[0].triage).not.toHaveProperty("disabledReason");
+ });
+});
diff --git a/ui/actions/findings/findings.ts b/ui/actions/findings/findings.ts
index 242bd007a8..0635d273ce 100644
--- a/ui/actions/findings/findings.ts
+++ b/ui/actions/findings/findings.ts
@@ -2,9 +2,21 @@
import { redirect } from "next/navigation";
+import { attachFindingTriageSummariesToResponse } from "@/actions/findings/findings-triage.adapter";
+import { getFindingTriageAdapterOptions } from "@/actions/findings/findings-triage.options";
import { apiBaseUrl, getAuthHeaders } from "@/lib";
import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
import { handleApiResponse } from "@/lib/server-actions-helper";
+
+const withFindingTriageSummaries = <T extends { data?: unknown }>(
+ response: T | undefined,
+): T | undefined => {
+ return attachFindingTriageSummariesToResponse(
+ response,
+ getFindingTriageAdapterOptions(),
+ );
+};
+
export const getFindings = async ({
page = 1,
pageSize = 10,
@@ -31,8 +43,9 @@ export const getFindings = async ({
const findings = await fetch(url.toString(), {
headers,
});
+ const response = await handleApiResponse(findings);
- return handleApiResponse(findings);
+ return withFindingTriageSummaries(response);
} catch (error) {
console.error("Error fetching findings:", error);
return undefined;
@@ -67,8 +80,9 @@ export const getLatestFindings = async ({
const findings = await fetch(url.toString(), {
headers,
});
+ const response = await handleApiResponse(findings);
- return handleApiResponse(findings);
+ return withFindingTriageSummaries(response);
} catch (error) {
console.error("Error fetching findings:", error);
return undefined;
diff --git a/ui/actions/findings/index.ts b/ui/actions/findings/index.ts
index d9fd5ae3b5..c4de6f1945 100644
--- a/ui/actions/findings/index.ts
+++ b/ui/actions/findings/index.ts
@@ -1,3 +1,4 @@
export * from "./findings";
export * from "./findings-by-resource";
export * from "./findings-by-resource.adapter";
+export * from "./findings-triage";
diff --git a/ui/actions/integrations/jira-dispatch.test.ts b/ui/actions/integrations/jira-dispatch.test.ts
new file mode 100644
index 0000000000..05c3188e47
--- /dev/null
+++ b/ui/actions/integrations/jira-dispatch.test.ts
@@ -0,0 +1,152 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { pollTaskUntilSettledMock } = vi.hoisted(() => ({
+ pollTaskUntilSettledMock: vi.fn(),
+}));
+
+vi.mock("@/actions/task/poll", () => ({
+ pollTaskUntilSettled: pollTaskUntilSettledMock,
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.example.com/api/v1",
+ getAuthHeaders: vi.fn(),
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiError: vi.fn(),
+}));
+
+import { pollJiraDispatchTask } from "./jira-dispatch";
+
+describe("pollJiraDispatchTask", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it("should return the backend error when a completed task has failed Jira dispatches", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "completed",
+ result: {
+ created_count: 0,
+ failed_count: 1,
+ error: "Jira project requires custom fields: Team is required",
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Jira project requires custom fields: Team is required",
+ });
+ });
+
+ it("should return a fallback error when a completed task has failures without an error", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "completed",
+ result: {
+ created_count: 0,
+ failed_count: 1,
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Failed to create Jira issue.",
+ });
+ });
+
+ it("should return a plural fallback error when a completed task has multiple failures without an error", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "completed",
+ result: {
+ created_count: 0,
+ failed_count: 3,
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Failed to create 3 Jira issues.",
+ });
+ });
+
+ it("should surface task failure result errors", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "failed",
+ result: {
+ error: "Jira credentials are invalid.",
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Jira credentials are invalid.",
+ });
+ });
+
+ it("should return success when a completed task has no failures", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "completed",
+ result: {
+ created_count: 1,
+ failed_count: 0,
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: true,
+ message: "Finding successfully sent to Jira!",
+ });
+ });
+
+ it("should return a fallback error when no Jira issue was created", async () => {
+ // Given
+ pollTaskUntilSettledMock.mockResolvedValue({
+ ok: true,
+ state: "completed",
+ result: {
+ created_count: 0,
+ failed_count: 0,
+ },
+ });
+
+ // When
+ const result = await pollJiraDispatchTask("task-123");
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Failed to create Jira issue.",
+ });
+ });
+});
diff --git a/ui/actions/integrations/jira-dispatch.ts b/ui/actions/integrations/jira-dispatch.ts
index 9e3b25679f..b6d3215e13 100644
--- a/ui/actions/integrations/jira-dispatch.ts
+++ b/ui/actions/integrations/jira-dispatch.ts
@@ -159,12 +159,18 @@ export const pollJiraDispatchTask = async (
const jiraResult = result as JiraTaskResult | undefined;
if (state === "completed") {
- if (!jiraResult?.error) {
+ const createdCount = jiraResult?.created_count ?? 0;
+ const failedCount = jiraResult?.failed_count ?? 0;
+ if (!jiraResult?.error && failedCount === 0 && createdCount > 0) {
return { success: true, message: "Finding successfully sent to Jira!" };
}
return {
success: false,
- error: jiraResult?.error || "Failed to create Jira issue.",
+ error:
+ jiraResult?.error ||
+ (failedCount > 1
+ ? `Failed to create ${failedCount} Jira issues.`
+ : "Failed to create Jira issue."),
};
}
diff --git a/ui/actions/integrations/saml.ts b/ui/actions/integrations/saml.ts
index 05a58e9e5e..41e153a46a 100644
--- a/ui/actions/integrations/saml.ts
+++ b/ui/actions/integrations/saml.ts
@@ -166,8 +166,13 @@ export const deleteSamlConfig = async (id: string) => {
}
};
-export const initiateSamlAuth = async (email: string) => {
+export const initiateSamlAuth = async (email: string, callbackUrl = "/") => {
try {
+ const attributes = {
+ email_domain: email,
+ ...(callbackUrl !== "/" && { callback_url: callbackUrl }),
+ };
+
const response = await fetch(`${apiBaseUrl}/auth/saml/initiate/`, {
method: "POST",
headers: {
@@ -176,9 +181,7 @@ export const initiateSamlAuth = async (email: string) => {
body: JSON.stringify({
data: {
type: "saml-initiate",
- attributes: {
- email_domain: email,
- },
+ attributes,
},
}),
redirect: "manual",
diff --git a/ui/actions/lighthouse/index.ts b/ui/actions/lighthouse-v1/index.ts
similarity index 100%
rename from ui/actions/lighthouse/index.ts
rename to ui/actions/lighthouse-v1/index.ts
diff --git a/ui/actions/lighthouse/lighthouse.ts b/ui/actions/lighthouse-v1/lighthouse.ts
similarity index 99%
rename from ui/actions/lighthouse/lighthouse.ts
rename to ui/actions/lighthouse-v1/lighthouse.ts
index 5365517bbd..635571f69e 100644
--- a/ui/actions/lighthouse/lighthouse.ts
+++ b/ui/actions/lighthouse-v1/lighthouse.ts
@@ -4,17 +4,17 @@ import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
import {
validateBaseUrl,
validateCredentials,
-} from "@/lib/lighthouse/validation";
+} from "@/lib/lighthouse-v1/validation";
import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
import {
type LighthouseProvider,
PROVIDER_DISPLAY_NAMES,
-} from "@/types/lighthouse";
+} from "@/types/lighthouse-v1";
import type {
BedrockCredentials,
OpenAICompatibleCredentials,
OpenAICredentials,
-} from "@/types/lighthouse/credentials";
+} from "@/types/lighthouse-v1/credentials";
// API Response Types
type ProviderCredentials =
diff --git a/ui/actions/manage-groups/manage-groups.test.ts b/ui/actions/manage-groups/manage-groups.test.ts
new file mode 100644
index 0000000000..c016832a1f
--- /dev/null
+++ b/ui/actions/manage-groups/manage-groups.test.ts
@@ -0,0 +1,138 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const {
+ fetchMock,
+ getAuthHeadersMock,
+ handleApiErrorMock,
+ handleApiResponseMock,
+} = vi.hoisted(() => ({
+ fetchMock: vi.fn(),
+ getAuthHeadersMock: vi.fn(),
+ handleApiErrorMock: vi.fn(),
+ handleApiResponseMock: vi.fn(),
+}));
+
+vi.mock("next/cache", () => ({
+ revalidatePath: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ redirect: vi.fn(),
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.example.com/api/v1",
+ getAuthHeaders: getAuthHeadersMock,
+ getErrorMessage: vi.fn(),
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiError: handleApiErrorMock,
+ handleApiResponse: handleApiResponseMock,
+}));
+
+import { getAllProviderGroups } from "./manage-groups";
+
+const makeGroup = (id: string, name: string) => ({
+ type: "provider-groups" as const,
+ id,
+ attributes: { name, inserted_at: "", updated_at: "" },
+ relationships: {
+ providers: { meta: { count: 0 }, data: [] },
+ roles: { meta: { count: 0 }, data: [] },
+ },
+ links: { self: "" },
+});
+
+const makePage = (
+ data: ReturnType<typeof makeGroup>[],
+ page: number,
+ pages: number,
+) => ({
+ links: { first: "", last: "", next: null, prev: null },
+ data,
+ meta: { pagination: { page, pages, count: data.length } },
+});
+
+describe("getAllProviderGroups", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal("fetch", fetchMock);
+ getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+ fetchMock.mockResolvedValue(new Response(null, { status: 200 }));
+ });
+
+ it("merges every page into a single response with collapsed pagination", async () => {
+ handleApiResponseMock
+ .mockResolvedValueOnce(
+ makePage(
+ [makeGroup("g1", "Group 1"), makeGroup("g2", "Group 2")],
+ 1,
+ 2,
+ ),
+ )
+ .mockResolvedValueOnce(makePage([makeGroup("g3", "Group 3")], 2, 2));
+
+ const result = await getAllProviderGroups();
+
+ expect(fetchMock).toHaveBeenCalledTimes(2);
+ expect(result?.data.map((group) => group.id)).toEqual(["g1", "g2", "g3"]);
+ expect(result?.meta.pagination).toMatchObject({
+ page: 1,
+ pages: 1,
+ count: 3,
+ });
+ });
+
+ it("stops after the first page when there is only one page", async () => {
+ handleApiResponseMock.mockResolvedValueOnce(
+ makePage([makeGroup("g1", "Group 1")], 1, 1),
+ );
+
+ const result = await getAllProviderGroups();
+
+ expect(fetchMock).toHaveBeenCalledTimes(1);
+ expect(result?.data).toHaveLength(1);
+ });
+
+ it("returns undefined when the first page has no data", async () => {
+ handleApiResponseMock.mockResolvedValueOnce(makePage([], 1, 1));
+
+ const result = await getAllProviderGroups();
+
+ expect(result).toBeUndefined();
+ });
+
+ it("returns undefined when the request throws", async () => {
+ fetchMock.mockRejectedValueOnce(new Error("network down"));
+
+ const result = await getAllProviderGroups();
+
+ expect(result).toBeUndefined();
+ });
+
+ it("returns undefined when a later page resolves to an error payload", async () => {
+ handleApiResponseMock
+ .mockResolvedValueOnce(makePage([makeGroup("g1", "Group 1")], 1, 2))
+ .mockResolvedValueOnce({ error: "Forbidden", status: 403 });
+
+ const result = await getAllProviderGroups();
+
+ expect(result).toBeUndefined();
+ });
+
+ it("returns undefined instead of a truncated list when the max-page cap is hit", async () => {
+ // Given an API that always reports more pages than the 50-page safety cap
+ handleApiResponseMock.mockImplementation((response: Response) => {
+ void response;
+ return Promise.resolve(makePage([makeGroup("g", "Group")], 1, 9999));
+ });
+
+ // When fetching every page
+ const result = await getAllProviderGroups();
+
+ // Then it must not return a partial/truncated list; bail out instead
+ expect(result).toBeUndefined();
+ expect(fetchMock).toHaveBeenCalledTimes(50);
+ });
+});
diff --git a/ui/actions/manage-groups/manage-groups.ts b/ui/actions/manage-groups/manage-groups.ts
index 933dabbdbc..c916a89d39 100644
--- a/ui/actions/manage-groups/manage-groups.ts
+++ b/ui/actions/manage-groups/manage-groups.ts
@@ -51,6 +51,87 @@ export const getProviderGroups = async ({
}
};
+/**
+ * Fetches all provider groups by iterating through every page.
+ * Used to populate filter dropdowns (e.g. the Provider Group selector) without
+ * the pagination cap that `getProviderGroups` applies for the management table.
+ */
+export const getAllProviderGroups = async (): Promise<
+ ProviderGroupsResponse | undefined
+> => {
+ const pageSize = 100; // Larger page size to minimize API calls
+ const maxPages = 50; // Safety limit: 50 pages × 100 = 5000 groups max
+ let currentPage = 1;
+ const allGroups: ProviderGroupsResponse["data"] = [];
+ let lastResponse: ProviderGroupsResponse | undefined;
+ let hasMorePages = true;
+
+ try {
+ const headers = await getAuthHeaders({ contentType: false });
+ while (hasMorePages && currentPage <= maxPages) {
+ const url = new URL(`${apiBaseUrl}/provider-groups`);
+ url.searchParams.append("page[number]", currentPage.toString());
+ url.searchParams.append("page[size]", pageSize.toString());
+
+ const response = await fetch(url.toString(), { headers });
+ const data = (await handleApiResponse(response)) as
+ | ProviderGroupsResponse
+ | { error: string; status?: number }
+ | undefined;
+
+ // A later page resolving to an API error payload must abort rather than
+ // be treated as "no more pages", which would silently truncate groups.
+ if (data && "error" in data) {
+ console.error("Error fetching all provider groups:", data.error);
+ return undefined;
+ }
+
+ if (!data?.data || data.data.length === 0) {
+ hasMorePages = false;
+ continue;
+ }
+
+ allGroups.push(...data.data);
+ lastResponse = data;
+
+ const totalPages = data.meta?.pagination?.pages || 1;
+ if (currentPage >= totalPages) {
+ hasMorePages = false;
+ } else {
+ currentPage++;
+ }
+ }
+
+ if (hasMorePages && currentPage > maxPages) {
+ console.error(
+ `Error fetching all provider groups: exceeded max page limit (${maxPages})`,
+ );
+ return undefined;
+ }
+
+ if (lastResponse) {
+ return {
+ ...lastResponse,
+ data: allGroups,
+ meta: {
+ ...lastResponse.meta,
+ pagination: {
+ ...lastResponse.meta?.pagination,
+ page: 1,
+ pages: 1,
+ count: allGroups.length,
+ },
+ },
+ };
+ }
+
+ return undefined;
+ } catch (error) {
+ console.error("Error fetching all provider groups:", error);
+ return undefined;
+ }
+};
+
export const getProviderGroupInfoById = async (providerGroupId: string) => {
const headers = await getAuthHeaders({ contentType: false });
const url = new URL(`${apiBaseUrl}/provider-groups/${providerGroupId}`);
diff --git a/ui/actions/mute-rules/mute-rules.ts b/ui/actions/mute-rules/mute-rules.ts
index 5b571e2bba..c74c4a7e2a 100644
--- a/ui/actions/mute-rules/mute-rules.ts
+++ b/ui/actions/mute-rules/mute-rules.ts
@@ -158,17 +158,24 @@ export const createMuteRule = async (
try {
if (responseContentType?.includes("application/json")) {
const errorData = await response.json();
+ const jsonApiError = (
+ errorData as {
+ errors?: Array<{
+ detail?: string;
+ title?: string;
+ source?: { pointer?: string };
+ }>;
+ message?: string;
+ }
+ )?.errors?.[0];
errorMessage =
- (
- errorData as {
- errors?: Array<{ detail?: string }>;
- message?: string;
- }
- )?.errors?.[0]?.detail ||
+ jsonApiError?.detail ||
+ jsonApiError?.title ||
(errorData as { message?: string })?.message ||
errorMessage;
} else {
- await response.text();
+ const responseText = await response.text();
+ errorMessage = responseText || errorMessage;
}
} catch {
// JSON parsing failed, use default error message
diff --git a/ui/actions/organizations/organizations.adapter.test.ts b/ui/actions/organizations/organizations.adapter.test.ts
index 07cff60c0c..41e0b8d89f 100644
--- a/ui/actions/organizations/organizations.adapter.test.ts
+++ b/ui/actions/organizations/organizations.adapter.test.ts
@@ -11,6 +11,7 @@ import {
buildOrgTreeData,
getOuIdsForSelectedAccounts,
getSelectableAccountIds,
+ getSelectableAccountIdsForTarget,
} from "./organizations.adapter";
const discoveryFixture: DiscoveryResult = {
@@ -164,6 +165,68 @@ describe("buildAccountLookup", () => {
});
});
+describe("getSelectableAccountIdsForTarget", () => {
+ it("scopes selection to accounts under a target OU, including nested OUs", () => {
+ // ou-parent contains ou-child (holds 111...) and the blocked 222...
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-parent",
+ );
+
+ // Only the selectable descendant is returned; blocked 222... is excluded,
+ // and 333... (under the root, outside the OU) is not included.
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("scopes selection to a leaf OU", () => {
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ );
+
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("includes the deployment account even when it lives outside the target OU", () => {
+ // Deployment (management) account 333... sits under the root, but gets the
+ // role via DeployLocalRole, so it must be pre-selected alongside the OU.
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ "333333333333",
+ );
+
+ expect(scoped).toEqual(["111111111111", "333333333333"]);
+ });
+
+ it("does not include a deployment account that is not selectable", () => {
+ // 222... is blocked, so even as the deployment account it stays unselected.
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ "222222222222",
+ );
+
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("returns every selectable account for a root target (whole organization)", () => {
+ const scoped = getSelectableAccountIdsForTarget(discoveryFixture, "r-root");
+
+ expect(scoped).toEqual(["111111111111", "333333333333"]);
+ });
+
+ it("falls back to all selectable accounts for an empty or unknown target", () => {
+ expect(getSelectableAccountIdsForTarget(discoveryFixture, "")).toEqual([
+ "111111111111",
+ "333333333333",
+ ]);
+ expect(
+ getSelectableAccountIdsForTarget(discoveryFixture, "ou-does-not-exist"),
+ ).toEqual(["111111111111", "333333333333"]);
+ });
+});
+
describe("getOuIdsForSelectedAccounts", () => {
it("collects all ancestor OUs for selected accounts without duplicates", () => {
const ouIds = getOuIdsForSelectedAccounts(discoveryFixture, [
diff --git a/ui/actions/organizations/organizations.adapter.ts b/ui/actions/organizations/organizations.adapter.ts
index e120a1a3dc..2b0c7b5a0b 100644
--- a/ui/actions/organizations/organizations.adapter.ts
+++ b/ui/actions/organizations/organizations.adapter.ts
@@ -109,6 +109,71 @@ export function buildAccountLookup(
return map;
}
+/**
+ * Returns the selectable account IDs that fall under a deployment target
+ * (an OU or root ID), optionally including the deployment account itself.
+ *
+ * The StackSet only rolls the role out to member accounts beneath the chosen
+ * target, and the deployment (management or delegated administrator) account
+ * gets the role via DeployLocalRole even though it usually lives outside that
+ * target. Pre-selecting exactly those accounts keeps the confirmation step in
+ * sync with what was actually deployed.
+ *
+ * Falls back to every selectable account when the target is empty or is not
+ * part of this discovery (e.g. a root ID), preserving the whole-organization
+ * default.
+ */
+export function getSelectableAccountIdsForTarget(
+ result: DiscoveryResult,
+ targetId: string,
+ deploymentAccountId?: string,
+): string[] {
+ const selectableAccountIds = getSelectableAccountIds(result);
+ const normalizedTarget = targetId.trim();
+
+ if (!normalizedTarget) {
+ return selectableAccountIds;
+ }
+
+ const isKnownOu = result.organizational_units.some(
+ (ou) => ou.id === normalizedTarget,
+ );
+
+ // Only a specific OU narrows the selection. A root ID (whole org) or an
+ // unknown target keeps the whole-organization default.
+ if (!isKnownOu) {
+ return selectableAccountIds;
+ }
+
+ // Collect the target OU plus all of its nested descendant OUs.
+ const scopeIds = new Set<string>([normalizedTarget]);
+ let addedNewOu = true;
+ while (addedNewOu) {
+ addedNewOu = false;
+ for (const ou of result.organizational_units) {
+ if (!scopeIds.has(ou.id) && scopeIds.has(ou.parent_id)) {
+ scopeIds.add(ou.id);
+ addedNewOu = true;
+ }
+ }
+ }
+
+ const selectableSet = new Set(selectableAccountIds);
+ const scopedIds = new Set<string>();
+
+ for (const account of result.accounts) {
+ if (scopeIds.has(account.parent_id) && selectableSet.has(account.id)) {
+ scopedIds.add(account.id);
+ }
+ }
+
+ if (deploymentAccountId && selectableSet.has(deploymentAccountId)) {
+ scopedIds.add(deploymentAccountId);
+ }
+
+ return selectableAccountIds.filter((id) => scopedIds.has(id));
+}
+
/**
* Given selected account IDs, returns OU IDs that are ancestors of selected accounts.
*/
diff --git a/ui/actions/overview/overview-filters.ts b/ui/actions/overview/overview-filters.ts
new file mode 100644
index 0000000000..186977f9ce
--- /dev/null
+++ b/ui/actions/overview/overview-filters.ts
@@ -0,0 +1,16 @@
+import { FILTER_FIELD, FilterParam } from "@/types/filters";
+
+/**
+ * URL filter param keys the overview dashboard scopes its widgets by. Overview has
+ * no single action; its widgets read these keys from the URL filters.
+ */
+export type OverviewFilterParam = FilterParam<
+ (typeof FILTER_FIELD)["PROVIDER_TYPE" | "PROVIDER_ID" | "PROVIDER_GROUPS"]
+>;
+
+/** The `filter[...]` keys overview widgets read from the URL. */
+export const OVERVIEW_FILTER_PARAM = {
+ PROVIDER_TYPE: `filter[${FILTER_FIELD.PROVIDER_TYPE}]`,
+ PROVIDER_ID: `filter[${FILTER_FIELD.PROVIDER_ID}]`,
+ PROVIDER_GROUPS: `filter[${FILTER_FIELD.PROVIDER_GROUPS}]`,
+} as const satisfies Record<string, OverviewFilterParam>;
diff --git a/ui/actions/providers/providers-filters.ts b/ui/actions/providers/providers-filters.ts
new file mode 100644
index 0000000000..71184c0b81
--- /dev/null
+++ b/ui/actions/providers/providers-filters.ts
@@ -0,0 +1,18 @@
+import { FILTER_FIELD, FilterParam } from "@/types/filters";
+import { PROVIDERS_PAGE_FILTER } from "@/types/providers-table";
+
+/**
+ * URL filter param keys the providers list supports, e.g. `filter[provider__in]`.
+ * Provider scope plus its providers-only extras (`provider__in` API param,
+ * `connected` status).
+ */
+export type ProvidersFilterParam = FilterParam<
+ | (typeof FILTER_FIELD)["PROVIDER_TYPE" | "PROVIDER_GROUPS" | "PROVIDER_UID"]
+ | (typeof PROVIDERS_PAGE_FILTER)["PROVIDER" | "STATUS"]
+>;
+
+/** `filter[...]` keys used when mapping the provider-type filter to the API param. */
+export const PROVIDERS_FILTER_PARAM = {
+ PROVIDER: `filter[${PROVIDERS_PAGE_FILTER.PROVIDER}]`,
+ PROVIDER_TYPE: `filter[${PROVIDERS_PAGE_FILTER.PROVIDER_TYPE}]`,
+} as const satisfies Record<string, ProvidersFilterParam>;
diff --git a/ui/actions/resources/resources-filters.ts b/ui/actions/resources/resources-filters.ts
new file mode 100644
index 0000000000..01132943a6
--- /dev/null
+++ b/ui/actions/resources/resources-filters.ts
@@ -0,0 +1,25 @@
+import { FILTER_FIELD, FilterParam } from "@/types/filters";
+
+/** Resources-only filter fields not shared with other views. */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const RESOURCES_EXTRA_FIELD = {
+ TYPE: "type__in",
+ GROUPS: "groups__in",
+} as const;
+
+type ResourcesExtraField =
+ (typeof RESOURCES_EXTRA_FIELD)[keyof typeof RESOURCES_EXTRA_FIELD];
+
+/**
+ * URL filter param keys the resources view supports, e.g. `filter[type__in]`.
+ * The shared core plus its resources-only dimensions (`type__in`, `groups__in`).
+ */
+export type ResourcesFilterParam = FilterParam<
+ | (typeof FILTER_FIELD)[
+ | "PROVIDER_TYPE"
+ | "PROVIDER_ID"
+ | "PROVIDER_GROUPS"
+ | "REGION"
+ | "SERVICE"]
+ | ResourcesExtraField
+>;
diff --git a/ui/actions/resources/resources.test.ts b/ui/actions/resources/resources.test.ts
index d8c5d75456..5f45b7815a 100644
--- a/ui/actions/resources/resources.test.ts
+++ b/ui/actions/resources/resources.test.ts
@@ -47,6 +47,14 @@ vi.mock("@/lib/server-actions-helper", () => ({
handleApiResponse: handleApiResponseMock,
}));
+vi.mock("@/actions/findings", () => ({
+ getLatestFindings: vi.fn(),
+}));
+
+vi.mock("@/actions/organizations/organizations", () => ({
+ listOrganizationsSafe: vi.fn(),
+}));
+
vi.mock("@/lib/provider-filters", () => ({
appendSanitizedProviderTypeFilters: vi.fn(),
}));
@@ -102,29 +110,6 @@ describe("getResourceEvents", () => {
expect(calledUrl.searchParams.get("page[size]")).toBe("25");
});
- it("returns parsed response on success", async () => {
- // Given
- const mockData = {
- data: [
- {
- type: "resource-events",
- id: "event-1",
- attributes: { event_name: "CreateStack" },
- },
- ],
- };
- const mockResponse = new Response("", { status: 200 });
- fetchMock.mockResolvedValue(mockResponse);
- handleApiResponseMock.mockResolvedValue(mockData);
-
- // When
- const result = await getResourceEvents("resource-123");
-
- // Then
- expect(result).toEqual(mockData);
- expect(handleApiResponseMock).toHaveBeenCalledWith(mockResponse);
- });
-
it("returns error object for non-ok responses without calling handleApiResponse", async () => {
// Given
const errorBody = JSON.stringify({
diff --git a/ui/actions/scan-configurations/index.ts b/ui/actions/scan-configurations/index.ts
new file mode 100644
index 0000000000..d9631969df
--- /dev/null
+++ b/ui/actions/scan-configurations/index.ts
@@ -0,0 +1 @@
+export * from "./scan-configurations";
diff --git a/ui/actions/scan-configurations/scan-configurations.ts b/ui/actions/scan-configurations/scan-configurations.ts
new file mode 100644
index 0000000000..946fdeca82
--- /dev/null
+++ b/ui/actions/scan-configurations/scan-configurations.ts
@@ -0,0 +1,421 @@
+"use server";
+
+import yaml from "js-yaml";
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+
+import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { scanConfigurationFormSchema } from "@/types/formSchemas";
+import {
+ DeleteScanConfigurationActionState,
+ ScanConfigurationActionState,
+ ScanConfigurationData,
+ ScanConfigurationErrors,
+ ScanConfigurationRequestBody,
+} from "@/types/scan-configurations";
+
+const SCAN_CONFIGURATION_PATH = "/scans/config";
+
+// Scan Configuration IDs are UUIDs. Validate before interpolating into request
+// URLs so a malformed/crafted value can't inject path segments (SSRF / path
+// injection).
+const scanConfigurationIdSchema = z.uuid();
+
+// Provider IDs are UUIDs too. Validate the whole array at the action boundary so
+// a malformed/crafted id fails here instead of relying on API-side validation.
+const providerIdsSchema = z.array(z.uuid());
+
+const parseConfiguration = (value: string): Record<string, unknown> => {
+ // Backend (YamlOrJsonField) accepts either a YAML string or a JSON object.
+ // We parse client-side so failures surface as form errors, not 500s.
+ const parsed = yaml.load(value);
+ if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+ throw new Error("Configuration must be a mapping with provider sections.");
+ }
+ return parsed as Record<string, unknown>;
+};
+
+const collectProviderIds = (formData: FormData): string[] => {
+ return formData
+ .getAll("provider_ids")
+ .map((v) => String(v))
+ .filter(Boolean);
+};
+
+interface ApiErrorSource {
+ pointer?: string;
+}
+
+interface ApiError {
+ detail?: string;
+ title?: string;
+ source?: ApiErrorSource;
+}
+
+// Route each JSON:API error to the matching form field via its `source.pointer`
+// so it renders inline next to the offending input. Only errors we can't anchor
+// to a field fall back to `general` (surfaced as a toast). Shared by create and
+// update so both flows present validation errors identically — otherwise a
+// config error shows inline on create but as a toast on update.
+const mapApiErrorsToFields = (
+ errorData: { errors?: ApiError[]; message?: string } | null | undefined,
+ fallbackMessage: string,
+): ScanConfigurationErrors => {
+ const apiErrors = Array.isArray(errorData?.errors) ? errorData!.errors! : [];
+
+ if (apiErrors.length === 0) {
+ return { general: errorData?.message || fallbackMessage };
+ }
+
+ const errors: ScanConfigurationErrors = {};
+ const append = (key: keyof ScanConfigurationErrors, detail: string) => {
+ errors[key] = errors[key] ? `${errors[key]}\n${detail}` : detail;
+ };
+
+ for (const err of apiErrors) {
+ const detail = err?.detail || err?.title || fallbackMessage;
+ const pointer = err?.source?.pointer;
+ if (pointer?.includes("name")) append("name", detail);
+ else if (pointer?.includes("configuration"))
+ append("configuration", detail);
+ else if (pointer?.includes("provider_ids")) append("provider_ids", detail);
+ else append("general", detail);
+ }
+ return errors;
+};
+
+export const createScanConfiguration = async (
+ _prevState: ScanConfigurationActionState,
+ formData: FormData,
+): Promise<ScanConfigurationActionState> => {
+ const headers = await getAuthHeaders({ contentType: true });
+ const formDataObject = {
+ name: formData.get("name"),
+ configuration: formData.get("configuration"),
+ provider_ids: collectProviderIds(formData),
+ };
+
+ const validated = scanConfigurationFormSchema.safeParse(formDataObject);
+ if (!validated.success) {
+ const fieldErrors = validated.error.flatten().fieldErrors;
+ return {
+ errors: {
+ name: fieldErrors?.name?.[0],
+ configuration: fieldErrors?.configuration?.[0],
+ provider_ids: fieldErrors?.provider_ids?.[0],
+ },
+ };
+ }
+
+ const { name, configuration, provider_ids } = validated.data;
+
+ let parsedConfig: Record<string, unknown>;
+ try {
+ parsedConfig = parseConfiguration(configuration);
+ } catch (e) {
+ return {
+ errors: {
+ configuration:
+ e instanceof Error ? e.message : "Failed to parse configuration",
+ },
+ };
+ }
+
+ try {
+ const url = new URL(`${apiBaseUrl}/scan-configurations`);
+ const bodyData: ScanConfigurationRequestBody = {
+ data: {
+ type: "scan-configurations",
+ attributes: {
+ name,
+ configuration: parsedConfig,
+ provider_ids,
+ },
+ },
+ };
+ const response = await fetch(url.toString(), {
+ method: "POST",
+ headers,
+ body: JSON.stringify(bodyData),
+ });
+
+ if (!response.ok) {
+ const errorData = await response.json().catch(() => ({}));
+ return {
+ errors: mapApiErrorsToFields(
+ errorData,
+ `Failed to create Scan Configuration: ${response.statusText}`,
+ ),
+ };
+ }
+
+ const data = await response.json();
+ revalidatePath(SCAN_CONFIGURATION_PATH);
+ return {
+ success: "Scan Configuration created successfully!",
+ data: data.data as ScanConfigurationData,
+ };
+ } catch (error) {
+ console.error("Error creating Scan Configuration:", error);
+ return {
+ errors: {
+ general:
+ error instanceof Error
+ ? error.message
+ : "Error creating Scan Configuration. Please try again.",
+ },
+ };
+ }
+};
+
+export const updateScanConfiguration = async (
+ _prevState: ScanConfigurationActionState,
+ formData: FormData,
+): Promise<ScanConfigurationActionState> => {
+ const id = formData.get("id");
+ if (!id) {
+ return {
+ errors: { general: "Scan Configuration ID is required for update" },
+ };
+ }
+ const idResult = scanConfigurationIdSchema.safeParse(String(id));
+ if (!idResult.success) {
+ return { errors: { general: "Invalid Scan Configuration ID" } };
+ }
+ const validId = idResult.data;
+ const headers = await getAuthHeaders({ contentType: true });
+ const formDataObject = {
+ name: formData.get("name"),
+ configuration: formData.get("configuration"),
+ provider_ids: collectProviderIds(formData),
+ };
+
+ const validated = scanConfigurationFormSchema.safeParse(formDataObject);
+ if (!validated.success) {
+ const fieldErrors = validated.error.flatten().fieldErrors;
+ return {
+ errors: {
+ name: fieldErrors?.name?.[0],
+ configuration: fieldErrors?.configuration?.[0],
+ provider_ids: fieldErrors?.provider_ids?.[0],
+ },
+ };
+ }
+
+ const { name, configuration, provider_ids } = validated.data;
+
+ let parsedConfig: Record<string, unknown>;
+ try {
+ parsedConfig = parseConfiguration(configuration);
+ } catch (e) {
+ return {
+ errors: {
+ configuration:
+ e instanceof Error ? e.message : "Failed to parse configuration",
+ },
+ };
+ }
+
+ try {
+ const url = new URL(`${apiBaseUrl}/scan-configurations/${validId}`);
+ const bodyData: ScanConfigurationRequestBody = {
+ data: {
+ type: "scan-configurations",
+ id: validId,
+ attributes: {
+ name,
+ configuration: parsedConfig,
+ provider_ids,
+ },
+ },
+ };
+ const response = await fetch(url.toString(), {
+ method: "PATCH",
+ headers,
+ body: JSON.stringify(bodyData),
+ });
+
+ if (!response.ok) {
+ const errorData = await response.json().catch(() => ({}));
+ return {
+ errors: mapApiErrorsToFields(
+ errorData,
+ `Failed to update Scan Configuration: ${response.statusText}`,
+ ),
+ };
+ }
+
+ const data = await response.json();
+ revalidatePath(SCAN_CONFIGURATION_PATH);
+ return {
+ success: "Scan Configuration updated successfully!",
+ data: data.data as ScanConfigurationData,
+ };
+ } catch (error) {
+ console.error("Error updating Scan Configuration:", error);
+ return {
+ errors: {
+ general:
+ error instanceof Error
+ ? error.message
+ : "Error updating Scan Configuration. Please try again.",
+ },
+ };
+ }
+};
+
+// Attach/detach providers on a scan configuration without touching its name or
+// YAML — a partial PATCH of `provider_ids` only. Used by the provider row to
+// associate/disassociate a config (editing the config itself lives in the Scan
+// Config view). The backend's `(tenant, provider)` uniqueness means attaching a
+// provider here moves it off any other config automatically.
+export const setScanConfigurationProviders = async (
+ configId: string,
+ providerIds: string[],
+): Promise<ScanConfigurationActionState> => {
+ const idResult = scanConfigurationIdSchema.safeParse(configId);
+ if (!idResult.success) {
+ return { errors: { general: "Invalid Scan Configuration ID" } };
+ }
+ const validId = idResult.data;
+ const providerIdsResult = providerIdsSchema.safeParse(providerIds);
+ if (!providerIdsResult.success) {
+ return { errors: { provider_ids: "Invalid provider ID" } };
+ }
+ const validProviderIds = providerIdsResult.data;
+ const headers = await getAuthHeaders({ contentType: true });
+
+ try {
+ const url = new URL(`${apiBaseUrl}/scan-configurations/${validId}`);
+ // Partial update: only provider_ids (name/configuration are optional on the
+ // backend update serializer), so we don't type this as the full request body.
+ const bodyData = {
+ data: {
+ type: "scan-configurations" as const,
+ id: validId,
+ attributes: { provider_ids: validProviderIds },
+ },
+ };
+ const response = await fetch(url.toString(), {
+ method: "PATCH",
+ headers,
+ body: JSON.stringify(bodyData),
+ });
+
+ if (!response.ok) {
+ const errorData = await response.json().catch(() => ({}));
+ return {
+ errors: mapApiErrorsToFields(
+ errorData,
+ `Failed to update Scan Configuration: ${response.statusText}`,
+ ),
+ };
+ }
+
+ revalidatePath(SCAN_CONFIGURATION_PATH);
+ revalidatePath("/providers");
+ return { success: "Scan Configuration updated successfully!" };
+ } catch (error) {
+ console.error("Error updating Scan Configuration providers:", error);
+ return {
+ errors: {
+ general:
+ error instanceof Error
+ ? error.message
+ : "Error updating Scan Configuration. Please try again.",
+ },
+ };
+ }
+};
+
+export const listScanConfigurations = async (): Promise<
+ ScanConfigurationData[]
+> => {
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(`${apiBaseUrl}/scan-configurations`);
+
+ try {
+ const response = await fetch(url.toString(), {
+ method: "GET",
+ headers,
+ });
+ if (!response.ok) {
+ throw new Error(
+ `Failed to list Scan Configurations: ${response.statusText}`,
+ );
+ }
+ const json = await response.json();
+ return (json.data || []) as ScanConfigurationData[];
+ } catch (error) {
+ // Re-throw so callers can distinguish a fetch/auth failure from an empty
+ // result. Collapsing errors into `[]` would render a false "no scan
+ // configurations" state and overwrite the table on a failed refresh.
+ console.error("Error listing Scan Configurations:", error);
+ throw error;
+ }
+};
+
+export const getScanConfiguration = async (
+ id: string,
+): Promise<ScanConfigurationData | undefined> => {
+ const idResult = scanConfigurationIdSchema.safeParse(id);
+ if (!idResult.success) return undefined;
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(`${apiBaseUrl}/scan-configurations/${idResult.data}`);
+
+ try {
+ const response = await fetch(url.toString(), {
+ method: "GET",
+ headers,
+ });
+ if (!response.ok) return undefined;
+ const json = await response.json();
+ return json.data as ScanConfigurationData;
+ } catch (error) {
+ console.error("Error fetching Scan Configuration:", error);
+ return undefined;
+ }
+};
+
+export const deleteScanConfiguration = async (
+ _prevState: DeleteScanConfigurationActionState,
+ formData: FormData,
+): Promise<DeleteScanConfigurationActionState> => {
+ const headers = await getAuthHeaders({ contentType: true });
+ const id = formData.get("id");
+ if (!id) {
+ return {
+ errors: { general: "Scan Configuration ID is required for deletion" },
+ };
+ }
+ const idResult = scanConfigurationIdSchema.safeParse(String(id));
+ if (!idResult.success) {
+ return { errors: { general: "Invalid Scan Configuration ID" } };
+ }
+ try {
+ const url = new URL(`${apiBaseUrl}/scan-configurations/${idResult.data}`);
+ const response = await fetch(url.toString(), {
+ method: "DELETE",
+ headers,
+ });
+ if (!response.ok) {
+ const errorData = await response.json().catch(() => ({}));
+ throw new Error(
+ errorData.errors?.[0]?.detail ||
+ `Failed to delete Scan Configuration: ${response.statusText}`,
+ );
+ }
+ revalidatePath(SCAN_CONFIGURATION_PATH);
+ return { success: "Scan Configuration deleted successfully!" };
+ } catch (error) {
+ console.error("Error deleting Scan Configuration:", error);
+ return {
+ errors: {
+ general:
+ error instanceof Error
+ ? error.message
+ : "Error deleting Scan Configuration. Please try again.",
+ },
+ };
+ }
+};
diff --git a/ui/actions/scans/scans-filters.ts b/ui/actions/scans/scans-filters.ts
new file mode 100644
index 0000000000..19958e9fa5
--- /dev/null
+++ b/ui/actions/scans/scans-filters.ts
@@ -0,0 +1,34 @@
+import { FILTER_FIELD, FilterParam } from "@/types/filters";
+
+/**
+ * Provider filter fields used to match/clear synthetic pending scan rows — the
+ * `__in` forms (shared with real scan rows) plus the exact forms, and the
+ * provider-group `__in` form so pending rows honor the group filter too.
+ */
+export const SCANS_PROVIDER_FILTER_FIELD = {
+ PROVIDER_IN: FILTER_FIELD.PROVIDER,
+ PROVIDER: "provider",
+ PROVIDER_TYPE_IN: FILTER_FIELD.PROVIDER_TYPE,
+ PROVIDER_TYPE: "provider_type",
+ PROVIDER_GROUPS_IN: FILTER_FIELD.PROVIDER_GROUPS,
+} as const;
+
+/** Scans-only filter fields not shared with other views. */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const SCANS_EXTRA_FIELD = {
+ STATE: "state__in",
+ TRIGGER: "trigger",
+} as const;
+
+type ScansExtraField =
+ (typeof SCANS_EXTRA_FIELD)[keyof typeof SCANS_EXTRA_FIELD];
+
+/**
+ * URL filter param keys the scans view supports, e.g. `filter[state__in]`.
+ * Provider scope (scans filters accounts by provider id) including provider
+ * groups and the exact pending-row provider forms, plus the scans-only dimensions.
+ */
+export type ScansFilterParam = FilterParam<
+ | (typeof SCANS_PROVIDER_FILTER_FIELD)[keyof typeof SCANS_PROVIDER_FILTER_FIELD]
+ | ScansExtraField
+>;
diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts
index 5a6ddb7a29..e192bb5b49 100644
--- a/ui/actions/scans/scans.ts
+++ b/ui/actions/scans/scans.ts
@@ -14,10 +14,7 @@ import {
type ComplianceReportType,
} from "@/lib/compliance/compliance-report-types";
import { runWithConcurrencyLimit } from "@/lib/concurrency";
-import {
- appendSanitizedProviderTypeFilters,
- sanitizeProviderTypesCsv,
-} from "@/lib/provider-filters";
+import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
import { addScanOperation } from "@/lib/sentry-breadcrumbs";
import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
import { SCAN_STATES } from "@/types/attack-paths";
@@ -66,10 +63,6 @@ export const getScansByState = async () => {
const url = new URL(`${apiBaseUrl}/scans`);
// Request only the necessary fields to optimize the response
url.searchParams.append("fields[scans]", "state");
- url.searchParams.append(
- "filter[provider_type__in]",
- sanitizeProviderTypesCsv(),
- );
// Only need to know whether at least one completed scan exists; filter server-side
// and cap to a single row so the answer is correct regardless of total scan count.
url.searchParams.append("filter[state]", SCAN_STATES.COMPLETED);
diff --git a/ui/actions/users/tenants.ts b/ui/actions/users/tenants.ts
index b43b467d93..79723debaa 100644
--- a/ui/actions/users/tenants.ts
+++ b/ui/actions/users/tenants.ts
@@ -3,6 +3,7 @@
import { revalidatePath } from "next/cache";
import { z } from "zod";
+import { signOut } from "@/auth.config";
import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
@@ -287,6 +288,47 @@ export async function deleteTenant(
}
}
+export async function deleteTenantThenSignOut(
+ _prevState: DeleteTenantState | null,
+ formData: FormData,
+): Promise<DeleteTenantState> {
+ const formDataObject = Object.fromEntries(formData);
+ const validatedData = deleteTenantSchema.safeParse(formDataObject);
+
+ if (!validatedData.success) {
+ return { error: "Invalid tenant ID" };
+ }
+
+ const { tenantId } = validatedData.data;
+ const headers = await getAuthHeaders({ contentType: false });
+
+ try {
+ const url = new URL(`${apiBaseUrl}/tenants/${tenantId}`);
+ const response = await fetch(url.toString(), {
+ method: "DELETE",
+ headers,
+ });
+
+ if (!response.ok) {
+ const errorData = await response.json().catch(() => null);
+ const errorDetail =
+ errorData?.errors?.[0]?.detail ||
+ `Failed to delete tenant: ${response.statusText}`;
+ throw new Error(errorDetail);
+ }
+ } catch (error) {
+ return handleApiError(error);
+ }
+
+ // Deleting the last tenant also removes the user account server-side, so
+ // there is no profile left to revalidate; close the session instead.
+ // signOut redirects by throwing, so it must stay outside the try/catch.
+ await signOut({ redirectTo: "/sign-in" });
+
+ // Unreachable: signOut always redirects. Present to satisfy the return type.
+ return { success: true };
+}
+
interface SwitchThenDeleteSuccess {
success: true;
accessToken: string;
diff --git a/ui/app/(auth)/(guest-only)/sign-up/page.tsx b/ui/app/(auth)/(guest-only)/sign-up/page.tsx
index b846c59a93..4854de012b 100644
--- a/ui/app/(auth)/(guest-only)/sign-up/page.tsx
+++ b/ui/app/(auth)/(guest-only)/sign-up/page.tsx
@@ -13,6 +13,7 @@ const SignUp = async ({
typeof resolvedSearchParams?.invitation_token === "string"
? resolvedSearchParams.invitation_token
: null;
+ const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
const GOOGLE_AUTH_URL = getAuthUrl("google");
const GITHUB_AUTH_URL = getAuthUrl("github");
@@ -21,6 +22,7 @@ const SignUp = async ({
<AuthForm
type="sign-up"
invitationToken={invitationToken}
+ isCloudEnv={isCloudEnv}
googleAuthUrl={GOOGLE_AUTH_URL}
githubAuthUrl={GITHUB_AUTH_URL}
isGoogleOAuthEnabled={isGoogleOAuthEnabled}
diff --git a/ui/app/(auth)/alerts/confirm/page.test.tsx b/ui/app/(auth)/alerts/confirm/page.test.tsx
index 8b6203c109..6885db86b3 100644
--- a/ui/app/(auth)/alerts/confirm/page.test.tsx
+++ b/ui/app/(auth)/alerts/confirm/page.test.tsx
@@ -16,7 +16,8 @@ vi.mock("@/components/auth/oss/auth-layout", () => ({
),
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Button: ({ children }: { children: ReactNode }) => <div>{children}</div>,
}));
diff --git a/ui/app/(auth)/alerts/unsubscribe/page.test.tsx b/ui/app/(auth)/alerts/unsubscribe/page.test.tsx
index 4ffeb548b0..560a5ad010 100644
--- a/ui/app/(auth)/alerts/unsubscribe/page.test.tsx
+++ b/ui/app/(auth)/alerts/unsubscribe/page.test.tsx
@@ -16,7 +16,8 @@ vi.mock("@/components/auth/oss/auth-layout", () => ({
),
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Button: ({ children }: { children: ReactNode }) => <div>{children}</div>,
}));
diff --git a/ui/app/(auth)/invitation/accept/accept-invitation-client.tsx b/ui/app/(auth)/invitation/accept/accept-invitation-client.tsx
index 0ed6346de7..c412eaf48c 100644
--- a/ui/app/(auth)/invitation/accept/accept-invitation-client.tsx
+++ b/ui/app/(auth)/invitation/accept/accept-invitation-client.tsx
@@ -10,6 +10,7 @@ import {
getInvitationErrorDisplay,
INVITATION_ERROR_FLOW,
} from "@/app/(auth)/invitation/_lib/invitation-errors";
+import { AuthBrand } from "@/components/auth/oss/auth-brand";
import { Button } from "@/components/shadcn";
type AcceptState =
@@ -69,16 +70,17 @@ export function AcceptInvitationClient({
return (
<div className="flex min-h-screen items-center justify-center p-4">
<div className="w-full max-w-md space-y-6 text-center">
+ <AuthBrand className="mx-auto" />
{/* No token */}
{state.kind === "no-token" && (
<div className="flex flex-col items-center gap-4">
<Icon
icon="solar:danger-triangle-bold"
- className="text-warning"
+ className="text-text-warning-primary"
width={48}
/>
<h1 className="text-xl font-semibold">Invalid Invitation Link</h1>
- <p className="text-default-500">
+ <p className="text-text-neutral-tertiary">
No invitation token was provided. Please check the link you
received.
</p>
@@ -93,11 +95,11 @@ export function AcceptInvitationClient({
<div className="flex flex-col items-center gap-4">
<Icon
icon="eos-icons:loading"
- className="text-default-500"
+ className="text-text-neutral-tertiary"
width={48}
/>
<h1 className="text-xl font-semibold">Accepting Invitation...</h1>
- <p className="text-default-500">
+ <p className="text-text-neutral-tertiary">
Please wait while we process your invitation.
</p>
</div>
@@ -108,13 +110,13 @@ export function AcceptInvitationClient({
<div className="flex flex-col items-center gap-4">
<Icon
icon="solar:danger-triangle-bold"
- className="text-danger"
+ className="text-text-error-primary"
width={48}
/>
<h1 className="text-xl font-semibold">
Could Not Accept Invitation
</h1>
- <p className="text-default-500">{state.message}</p>
+ <p className="text-text-neutral-tertiary">{state.message}</p>
<div className="flex gap-3">
{state.canRetry && <Button onClick={doAccept}>Retry</Button>}
<Button asChild variant="outline">
@@ -129,14 +131,14 @@ export function AcceptInvitationClient({
<div className="flex flex-col items-center gap-6">
<Icon
icon="solar:letter-bold"
- className="text-primary"
+ className="text-button-primary"
width={48}
/>
<div>
<h1 className="text-xl font-semibold">
You've Been Invited
</h1>
- <p className="text-default-500 mt-2">
+ <p className="text-text-neutral-tertiary mt-2">
You've been invited to join a tenant on Prowler. How would
you like to continue?
</p>
diff --git a/ui/app/(auth)/layout.tsx b/ui/app/(auth)/layout.tsx
index 79a4ce4e89..27fff93fe5 100644
--- a/ui/app/(auth)/layout.tsx
+++ b/ui/app/(auth)/layout.tsx
@@ -6,11 +6,11 @@ import { connection } from "next/server";
import { ReactNode, Suspense } from "react";
import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
-import { NavigationProgress, Toaster } from "@/components/ui";
-import { fontSans } from "@/config/fonts";
+import { NavigationProgress, Toaster } from "@/components/shadcn";
+import { fontMono, fontSans } from "@/config/fonts";
import { siteConfig } from "@/config/site";
import { cn } from "@/lib";
-import { readEnv } from "@/lib/runtime-env";
+import { readGatedEnv } from "@/lib/integrations";
import { Providers } from "../providers";
@@ -42,8 +42,8 @@ export default async function AuthLayout({
// <RuntimePublicConfig/> island's own connection() call).
await connection();
- // Server-side runtime read. Empty/unset id ⇒ GoogleTagManager is not mounted
- const gtmId = readEnv(
+ const gtmId = readGatedEnv(
+ "UI_GOOGLE_TAG_MANAGER_ENABLED",
"UI_GOOGLE_TAG_MANAGER_ID",
"NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
);
@@ -56,8 +56,9 @@ export default async function AuthLayout({
<body
suppressHydrationWarning
className={cn(
- "bg-background min-h-screen font-sans antialiased",
+ "bg-bg-neutral-primary min-h-screen font-sans antialiased",
fontSans.variable,
+ fontMono.variable,
)}
>
<Providers themeProps={{ attribute: "class", defaultTheme: "dark" }}>
diff --git a/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx b/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
index 13f37fad4f..0b6e90a697 100644
--- a/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
+++ b/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
@@ -2,7 +2,8 @@ import { render, screen, within } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
import { describe, expect, it, vi } from "vitest";
-import { FilterType } from "@/types/filters";
+import { ProviderProps } from "@/types";
+import { FILTER_FIELD } from "@/types/filters";
import { AccountsSelector } from "./accounts-selector";
@@ -99,12 +100,13 @@ vi.mock("@/components/shadcn/select/multiselect", () => ({
),
}));
-const providers = [
+const providers: ProviderProps[] = [
{
id: "provider-1",
type: "providers" as const,
attributes: {
provider: "aws" as const,
+ is_dynamic: false,
uid: "123456789012",
alias: "Production AWS",
status: "completed" as const,
@@ -189,7 +191,7 @@ describe("AccountsSelector", () => {
render(
<AccountsSelector
providers={providers}
- filterKey={FilterType.PROVIDER_UID}
+ filterKey={FILTER_FIELD.PROVIDER_UID}
/>,
);
diff --git a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
index 8a7c08b11c..ab5c27fd6c 100644
--- a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
+++ b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
@@ -17,7 +17,7 @@ import {
MultiSelectValue,
} from "@/components/shadcn/select/multiselect";
import { useUrlFilters } from "@/hooks/use-url-filters";
-import { type AccountFilterKey, FilterType } from "@/types/filters";
+import { type AccountFilterKey, FILTER_FIELD } from "@/types/filters";
import {
getProviderDisplayName,
type ProviderProps,
@@ -68,7 +68,7 @@ export function AccountsSelector({
providers,
onBatchChange,
selectedValues,
- filterKey = FilterType.PROVIDER_ID,
+ filterKey = FILTER_FIELD.PROVIDER_ID,
id = "accounts-selector",
disabledValues = [],
search = {
@@ -91,7 +91,7 @@ export function AccountsSelector({
const visibleProviders = providers;
const getProviderValue = (provider: ProviderProps) =>
- filterKey === FilterType.PROVIDER_UID
+ filterKey === FILTER_FIELD.PROVIDER_UID
? provider.attributes.uid
: provider.id;
const disabledValuesSet = new Set(disabledValues);
diff --git a/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.test.tsx b/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.test.tsx
new file mode 100644
index 0000000000..255ac50c63
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.test.tsx
@@ -0,0 +1,52 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { LIGHTHOUSE_OVERVIEW_BANNER_HREF } from "../_lib/lighthouse-banner";
+import { LighthouseOverviewBanner } from "./lighthouse-overview-banner";
+
+describe("LighthouseOverviewBanner", () => {
+ it("renders Toni copy and opens a prompted chat when connected", () => {
+ // Given / When
+ render(
+ <LighthouseOverviewBanner href={LIGHTHOUSE_OVERVIEW_BANNER_HREF.CHAT} />,
+ );
+
+ // Then
+ const link = screen.getByRole("link", {
+ name: /Find and remediate what actually matters\./,
+ });
+ expect(link).toHaveAttribute("href", LIGHTHOUSE_OVERVIEW_BANNER_HREF.CHAT);
+ expect(link).toHaveTextContent("Lighthouse AI");
+ expect(link).toHaveTextContent("Find and remediate what actually matters.");
+ });
+
+ it("links to Lighthouse settings when no connected configuration exists", () => {
+ // Given / When
+ render(
+ <LighthouseOverviewBanner
+ href={LIGHTHOUSE_OVERVIEW_BANNER_HREF.SETTINGS}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("link", {
+ name: /Find and remediate what actually matters\./,
+ }),
+ ).toHaveAttribute("href", "/lighthouse/settings");
+ });
+
+ it("isolates its stacking so content never paints over the sticky navbar", () => {
+ // Given / When: the banner's inner z-10 must stay scoped to the card —
+ // without isolation it ties the sticky header's z-10 and wins by DOM order
+ render(
+ <LighthouseOverviewBanner href={LIGHTHOUSE_OVERVIEW_BANNER_HREF.CHAT} />,
+ );
+
+ // Then
+ const card = screen
+ .getByRole("link", { name: /Find and remediate what actually matters\./ })
+ .querySelector("[data-slot='card']");
+ expect(card).toHaveClass("isolate");
+ });
+});
diff --git a/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.tsx b/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.tsx
new file mode 100644
index 0000000000..8bd8dea414
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_components/lighthouse-overview-banner.tsx
@@ -0,0 +1,130 @@
+"use client";
+
+import { ArrowRight } from "lucide-react";
+import Link from "next/link";
+import { useRef, useState } from "react";
+
+import { LighthouseIcon } from "@/components/icons/Icons";
+import { Card, CardContent } from "@/components/shadcn";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { cn } from "@/lib/utils";
+
+import type { LighthouseOverviewBannerHref } from "../_lib/lighthouse-banner";
+
+interface LighthouseOverviewBannerProps {
+ href: LighthouseOverviewBannerHref;
+}
+
+export function LighthouseOverviewBanner({
+ href,
+}: LighthouseOverviewBannerProps) {
+ const interactiveRef = useRef<HTMLDivElement>(null);
+ const curXRef = useRef(0);
+ const curYRef = useRef(0);
+ const tgXRef = useRef(0);
+ const tgYRef = useRef(0);
+ const [isSafari, setIsSafari] = useState(false);
+
+ useMountEffect(() => {
+ setIsSafari(/^((?!chrome|android).)*safari/i.test(navigator.userAgent));
+ });
+
+ useMountEffect(() => {
+ let animationFrameId: number;
+
+ const move = () => {
+ if (!interactiveRef.current) return;
+
+ curXRef.current += (tgXRef.current - curXRef.current) / 20;
+ curYRef.current += (tgYRef.current - curYRef.current) / 20;
+
+ interactiveRef.current.style.transform = `translate(${Math.round(curXRef.current)}px, ${Math.round(curYRef.current)}px)`;
+
+ animationFrameId = requestAnimationFrame(move);
+ };
+
+ animationFrameId = requestAnimationFrame(move);
+
+ return () => {
+ cancelAnimationFrame(animationFrameId);
+ };
+ });
+
+ const handleMouseMove = (event: React.MouseEvent<HTMLDivElement>) => {
+ if (interactiveRef.current) {
+ const rect = interactiveRef.current.getBoundingClientRect();
+ tgXRef.current = event.clientX - rect.left;
+ tgYRef.current = event.clientY - rect.top;
+ }
+ };
+
+ return (
+ <Link
+ href={href}
+ className="group focus-visible:ring-border-input-primary block rounded-xl focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-none"
+ >
+ <Card
+ variant="base"
+ padding="none"
+ // isolate: the content's internal z-10 (above the gradient layers)
+ // must not compete with the page's sticky header, which is also z-10.
+ className="group-hover:border-border-input-primary relative isolate overflow-hidden transition-colors"
+ onMouseMove={handleMouseMove}
+ >
+ <svg className="hidden">
+ <defs>
+ <filter id="blurMe">
+ <feGaussianBlur
+ in="SourceGraphic"
+ stdDeviation="10"
+ result="blur"
+ />
+ <feColorMatrix
+ in="blur"
+ mode="matrix"
+ values="1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 18 -8"
+ result="goo"
+ />
+ <feBlend in="SourceGraphic" in2="goo" />
+ </filter>
+ </defs>
+ </svg>
+
+ <div
+ className={cn(
+ "pointer-events-none absolute inset-0 blur-lg",
+ isSafari ? "blur-2xl" : "[filter:url(#blurMe)_blur(40px)]",
+ )}
+ >
+ <div className="animate-first lighthouse-banner-gradient-neutral absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:center_center] opacity-100 [mix-blend-mode:hard-light]" />
+
+ <div className="animate-second lighthouse-banner-gradient-primary absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:calc(50%-200px)] opacity-80 [mix-blend-mode:hard-light]" />
+
+ <div className="animate-third lighthouse-banner-gradient-primary-hover absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:calc(50%+200px)] opacity-70 [mix-blend-mode:hard-light]" />
+
+ <div
+ ref={interactiveRef}
+ className="lighthouse-banner-gradient-primary-press absolute -top-1/2 -left-1/2 h-full w-full opacity-60 [mix-blend-mode:hard-light]"
+ />
+ </div>
+
+ <CardContent className="relative z-10 flex min-w-0 items-center justify-between gap-4 px-4 py-3 sm:px-5">
+ <div className="flex min-w-0 items-center gap-3">
+ <span className="border-border-neutral-tertiary bg-bg-neutral-tertiary flex size-9 shrink-0 items-center justify-center rounded-md border">
+ <LighthouseIcon className="size-5" />
+ </span>
+ <div className="min-w-0">
+ <p className="text-text-neutral-primary text-sm font-medium">
+ Lighthouse AI
+ </p>
+ <p className="text-text-neutral-secondary text-sm">
+ Find and remediate what actually matters.
+ </p>
+ </div>
+ </div>
+ <ArrowRight className="text-text-neutral-tertiary size-4 shrink-0 transition-transform group-hover:translate-x-0.5" />
+ </CardContent>
+ </Card>
+ </Link>
+ );
+}
diff --git a/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx b/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
index b2c05b336d..23c7d4ace3 100644
--- a/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
+++ b/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
@@ -1,6 +1,8 @@
import { render, screen, within } from "@testing-library/react";
import { describe, expect, it, vi } from "vitest";
+import { ProviderProps } from "@/types";
+
import { ProviderTypeSelector } from "./provider-type-selector";
const multiSelectContentSpy = vi.fn();
@@ -69,12 +71,13 @@ vi.mock("@/components/shadcn/select/multiselect", () => ({
),
}));
-const providers = [
+const providers: ProviderProps[] = [
{
id: "provider-1",
type: "providers" as const,
attributes: {
provider: "aws" as const,
+ is_dynamic: false,
uid: "123456789012",
alias: "Production AWS",
status: "completed" as const,
diff --git a/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx b/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
index e78412eeeb..fdda0f8e49 100644
--- a/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
+++ b/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
@@ -16,7 +16,22 @@ import {
MultiSelectValue,
} from "@/components/shadcn/select/multiselect";
import { useUrlFilters } from "@/hooks/use-url-filters";
-import { type ProviderProps, ProviderType } from "@/types/providers";
+import {
+ humanizeProviderId,
+ isKnownProviderType,
+ type ProviderProps,
+ ProviderType,
+} from "@/types/providers";
+
+/**
+ * Label for a provider type: the rich configured label for known types, a
+ * humanized id for anything the API returns outside the known set (dynamic
+ * plug-ins). Icons fall back to the generic glyph via `ProviderTypeIcon`.
+ */
+const providerTypeLabel = (type: ProviderType): string =>
+ isKnownProviderType(type)
+ ? PROVIDER_TYPE_DATA[type].label
+ : humanizeProviderId(type);
/** Common props shared by both batch and instant modes. */
interface ProviderTypeSelectorBaseProps {
@@ -88,16 +103,8 @@ export const ProviderTypeSelector = ({
};
const availableTypes = Array.from(
- new Set(
- providers
- // .filter((p) => p.attributes.connection?.connected)
- .map((p) => p.attributes.provider),
- ),
- )
- .filter((type): type is ProviderType => type in PROVIDER_TYPE_DATA)
- .sort((a, b) =>
- PROVIDER_TYPE_DATA[a].label.localeCompare(PROVIDER_TYPE_DATA[b].label),
- );
+ new Set(providers.map((p) => p.attributes.provider)),
+ ).sort((a, b) => providerTypeLabel(a).localeCompare(providerTypeLabel(b)));
const selectedLabel = () => {
if (selectedTypes.length === 0) return null;
@@ -108,9 +115,7 @@ export const ProviderTypeSelector = ({
<span aria-hidden="true">
<ProviderTypeIcon type={providerType} />
</span>
- <span className="truncate">
- {PROVIDER_TYPE_DATA[providerType].label}
- </span>
+ <span className="truncate">{providerTypeLabel(providerType)}</span>
</span>
);
}
@@ -120,7 +125,7 @@ export const ProviderTypeSelector = ({
items={(selectedTypes as ProviderType[]).map((type) => ({
key: type,
type,
- tooltip: PROVIDER_TYPE_DATA[type].label,
+ tooltip: providerTypeLabel(type),
}))}
/>
<span className="min-w-0 truncate">
@@ -176,23 +181,24 @@ export const ProviderTypeSelector = ({
>
{selectedTypes.length === 0 ? "All selected" : "Select All"}
</div>
- {availableTypes.map((providerType) => (
- <MultiSelectItem
- key={providerType}
- value={providerType}
- badgeLabel={PROVIDER_TYPE_DATA[providerType].label}
- keywords={[
- providerType,
- PROVIDER_TYPE_DATA[providerType].label,
- ]}
- aria-label={`${PROVIDER_TYPE_DATA[providerType].label} Provider Type`}
- >
- <span aria-hidden="true">
- <ProviderTypeIcon type={providerType} size={24} />
- </span>
- <span>{PROVIDER_TYPE_DATA[providerType].label}</span>
- </MultiSelectItem>
- ))}
+ {availableTypes.map((providerType) => {
+ const label = providerTypeLabel(providerType);
+
+ return (
+ <MultiSelectItem
+ key={providerType}
+ value={providerType}
+ badgeLabel={label}
+ keywords={[providerType, label]}
+ aria-label={`${label} Provider Type`}
+ >
+ <span aria-hidden="true">
+ <ProviderTypeIcon type={providerType} size={24} />
+ </span>
+ <span>{label}</span>
+ </MultiSelectItem>
+ );
+ })}
</>
) : (
<div className="px-3 py-2 text-sm text-slate-500 dark:text-slate-400">
diff --git a/ui/app/(prowler)/_overview/_lib/lighthouse-banner.test.ts b/ui/app/(prowler)/_overview/_lib/lighthouse-banner.test.ts
new file mode 100644
index 0000000000..baf5e8206f
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_lib/lighthouse-banner.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, it, vi } from "vitest";
+
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2ProviderType,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import {
+ getLighthouseOverviewBannerHref,
+ LIGHTHOUSE_OVERVIEW_PROMPT,
+ resolveLighthouseOverviewBannerHref,
+} from "./lighthouse-banner";
+
+const LIGHTHOUSE_OVERVIEW_CHAT_HREF = `/lighthouse?prompt=${encodeURIComponent(
+ LIGHTHOUSE_OVERVIEW_PROMPT,
+)}`;
+
+describe("resolveLighthouseOverviewBannerHref", () => {
+ it("opens Lighthouse with the remediation prompt when any v2 configuration is connected", () => {
+ // Given / When
+ const href = resolveLighthouseOverviewBannerHref([
+ configuration("openai", false),
+ configuration("bedrock", true),
+ ]);
+
+ // Then
+ expect(href).toBe(LIGHTHOUSE_OVERVIEW_CHAT_HREF);
+ });
+
+ it("routes to Lighthouse settings when no v2 configuration is connected", () => {
+ // Given / When
+ const href = resolveLighthouseOverviewBannerHref([
+ configuration("openai", false),
+ configuration("openai-compatible", null),
+ ]);
+
+ // Then
+ expect(href).toBe("/lighthouse/settings");
+ });
+});
+
+describe("getLighthouseOverviewBannerHref", () => {
+ it("hides the banner outside cloud without loading configurations", async () => {
+ // Given
+ const loadConfigurations = vi.fn(async () => ({
+ data: [configuration("openai", true)],
+ }));
+
+ // When
+ const href = await getLighthouseOverviewBannerHref(
+ false,
+ loadConfigurations,
+ );
+
+ // Then
+ expect(href).toBeNull();
+ expect(loadConfigurations).not.toHaveBeenCalled();
+ });
+
+ it("hides the banner when configurations fail to load", async () => {
+ // Given
+ const loadConfigurations = vi.fn(async () => ({
+ error: "Unauthorized",
+ status: 401,
+ }));
+
+ // When
+ const href = await getLighthouseOverviewBannerHref(
+ true,
+ loadConfigurations,
+ );
+
+ // Then
+ expect(href).toBeNull();
+ });
+
+ it("resolves the banner href from loaded configurations in cloud", async () => {
+ // Given
+ const loadConfigurations = vi.fn(async () => ({
+ data: [configuration("bedrock", true)],
+ }));
+
+ // When
+ const href = await getLighthouseOverviewBannerHref(
+ true,
+ loadConfigurations,
+ );
+
+ // Then
+ expect(href).toBe(LIGHTHOUSE_OVERVIEW_CHAT_HREF);
+ });
+});
+
+function configuration(
+ providerType: LighthouseV2ProviderType,
+ connected: LighthouseV2Configuration["connected"],
+): LighthouseV2Configuration {
+ return {
+ id: `config-${providerType}`,
+ providerType,
+ baseUrl:
+ providerType === "openai-compatible" ? "https://example.com" : null,
+ defaultModel: null,
+ businessContext: "Production account",
+ connected,
+ connectionLastCheckedAt: null,
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ };
+}
diff --git a/ui/app/(prowler)/_overview/_lib/lighthouse-banner.ts b/ui/app/(prowler)/_overview/_lib/lighthouse-banner.ts
new file mode 100644
index 0000000000..b0b0d1a08c
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_lib/lighthouse-banner.ts
@@ -0,0 +1,45 @@
+import type { LighthouseV2Configuration } from "@/app/(prowler)/lighthouse/_types";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import type { ServerActionResult } from "@/types/server-actions";
+
+// Prefilled in the composer when the overview banner opens Lighthouse.
+export const LIGHTHOUSE_OVERVIEW_PROMPT =
+ "Find and guide me to remediate what actually matters. What do I have to do today to be secure?";
+
+export const LIGHTHOUSE_OVERVIEW_BANNER_HREF = {
+ CHAT: `${LIGHTHOUSE_ROUTE.CHAT}?prompt=${encodeURIComponent(LIGHTHOUSE_OVERVIEW_PROMPT)}`,
+ SETTINGS: LIGHTHOUSE_ROUTE.SETTINGS,
+} as const;
+
+export type LighthouseOverviewBannerHref =
+ (typeof LIGHTHOUSE_OVERVIEW_BANNER_HREF)[keyof typeof LIGHTHOUSE_OVERVIEW_BANNER_HREF];
+
+type LoadLighthouseV2Configurations = () => Promise<
+ ServerActionResult<LighthouseV2Configuration[]>
+>;
+
+export function resolveLighthouseOverviewBannerHref(
+ configurations: LighthouseV2Configuration[],
+): LighthouseOverviewBannerHref {
+ return configurations.some(
+ (configuration) => configuration.connected === true,
+ )
+ ? LIGHTHOUSE_OVERVIEW_BANNER_HREF.CHAT
+ : LIGHTHOUSE_OVERVIEW_BANNER_HREF.SETTINGS;
+}
+
+export async function getLighthouseOverviewBannerHref(
+ cloud: boolean,
+ loadConfigurations: LoadLighthouseV2Configurations,
+): Promise<LighthouseOverviewBannerHref | null> {
+ if (!cloud) {
+ return null;
+ }
+
+ const result = await loadConfigurations();
+ if (!("data" in result)) {
+ return null;
+ }
+
+ return resolveLighthouseOverviewBannerHref(result.data);
+}
diff --git a/ui/app/(prowler)/_overview/_lib/provider-scope.test.ts b/ui/app/(prowler)/_overview/_lib/provider-scope.test.ts
new file mode 100644
index 0000000000..3071f84837
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_lib/provider-scope.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it } from "vitest";
+
+import { ProviderProps } from "@/types/providers";
+
+import {
+ filterProvidersByScope,
+ parseFilterIds,
+ scopeProvidersByGroup,
+} from "./provider-scope";
+
+const makeProvider = (
+ id: string,
+ provider: string,
+ groupIds: string[] = [],
+): ProviderProps =>
+ ({
+ id,
+ attributes: { provider },
+ relationships: {
+ provider_groups: {
+ data: groupIds.map((gid) => ({ type: "provider-groups", id: gid })),
+ },
+ },
+ }) as unknown as ProviderProps;
+
+describe("parseFilterIds", () => {
+ it("returns an empty array for undefined", () => {
+ // Given / When / Then
+ expect(parseFilterIds(undefined)).toEqual([]);
+ });
+
+ it("returns an empty array for an empty string", () => {
+ // Given an empty param value (e.g. "filter[provider_groups__in]=")
+ // When / Then it must not produce a [""] match
+ expect(parseFilterIds("")).toEqual([]);
+ });
+
+ it("drops whitespace-only and empty segments", () => {
+ // Given a blank/whitespace value
+ // When / Then
+ expect(parseFilterIds(" ")).toEqual([]);
+ expect(parseFilterIds(",")).toEqual([]);
+ expect(parseFilterIds("a,,b")).toEqual(["a", "b"]);
+ });
+
+ it("splits and trims comma-separated ids", () => {
+ expect(parseFilterIds(" a , b ")).toEqual(["a", "b"]);
+ });
+
+ it("normalizes array param values", () => {
+ expect(parseFilterIds(["a", "", "b"])).toEqual(["a", "b"]);
+ });
+});
+
+describe("scopeProvidersByGroup", () => {
+ const providers = [
+ makeProvider("p1", "aws", ["g1"]),
+ makeProvider("p2", "gcp", ["g2"]),
+ makeProvider("p3", "azure", []),
+ ];
+
+ it("returns every provider when no group is selected", () => {
+ expect(scopeProvidersByGroup(providers, [])).toEqual(providers);
+ });
+
+ it("keeps only providers that belong to a selected group", () => {
+ // When scoping to g1
+ const result = scopeProvidersByGroup(providers, ["g1"]);
+
+ // Then only the g1 member remains
+ expect(result.map((p) => p.id)).toEqual(["p1"]);
+ });
+
+ it("excludes providers with no group memberships", () => {
+ expect(scopeProvidersByGroup(providers, ["g2"]).map((p) => p.id)).toEqual([
+ "p2",
+ ]);
+ });
+});
+
+describe("filterProvidersByScope", () => {
+ const providers = [
+ makeProvider("p1", "aws", ["g1"]),
+ makeProvider("p2", "gcp", ["g1"]),
+ makeProvider("p3", "aws", ["g2"]),
+ makeProvider("p4", "azure", []),
+ ];
+
+ it("returns every provider when no dimension is set", () => {
+ const result = filterProvidersByScope(providers, {
+ providerIds: [],
+ providerTypes: [],
+ providerGroupIds: [],
+ });
+
+ expect(result).toEqual(providers);
+ });
+
+ it("filters by provider id", () => {
+ const result = filterProvidersByScope(providers, {
+ providerIds: ["p2"],
+ providerTypes: [],
+ providerGroupIds: [],
+ });
+
+ expect(result.map((p) => p.id)).toEqual(["p2"]);
+ });
+
+ it("filters by provider type case-insensitively", () => {
+ const result = filterProvidersByScope(providers, {
+ providerIds: [],
+ providerTypes: ["AWS"],
+ providerGroupIds: [],
+ });
+
+ expect(result.map((p) => p.id)).toEqual(["p1", "p3"]);
+ });
+
+ it("filters by provider group", () => {
+ const result = filterProvidersByScope(providers, {
+ providerIds: [],
+ providerTypes: [],
+ providerGroupIds: ["g1"],
+ });
+
+ expect(result.map((p) => p.id)).toEqual(["p1", "p2"]);
+ });
+
+ it("composes group AND type (the risk-plot regression)", () => {
+ // Given both a group and a type filter are active
+ // When combining group g1 with type aws
+ const result = filterProvidersByScope(providers, {
+ providerIds: [],
+ providerTypes: ["aws"],
+ providerGroupIds: ["g1"],
+ });
+
+ // Then only providers matching BOTH survive (p1), not all aws or all g1
+ expect(result.map((p) => p.id)).toEqual(["p1"]);
+ });
+
+ it("composes id AND group", () => {
+ // p3 is aws/g2; selecting it together with group g1 yields nothing
+ const result = filterProvidersByScope(providers, {
+ providerIds: ["p3"],
+ providerTypes: [],
+ providerGroupIds: ["g1"],
+ });
+
+ expect(result).toEqual([]);
+ });
+
+ it("composes all three dimensions", () => {
+ const result = filterProvidersByScope(providers, {
+ providerIds: ["p1", "p2"],
+ providerTypes: ["aws"],
+ providerGroupIds: ["g1"],
+ });
+
+ expect(result.map((p) => p.id)).toEqual(["p1"]);
+ });
+});
diff --git a/ui/app/(prowler)/_overview/_lib/provider-scope.ts b/ui/app/(prowler)/_overview/_lib/provider-scope.ts
new file mode 100644
index 0000000000..49973b201b
--- /dev/null
+++ b/ui/app/(prowler)/_overview/_lib/provider-scope.ts
@@ -0,0 +1,71 @@
+import { ProviderProps } from "@/types/providers";
+
+export interface ProviderScopeFilters {
+ providerIds: string[];
+ providerTypes: string[];
+ providerGroupIds: string[];
+}
+
+/**
+ * Normalize a comma-separated filter param into trimmed, non-empty ids.
+ * Guards against blank values (e.g. an empty "filter[...]=" param) so they are
+ * treated as "no filter" instead of matching against an empty-string id.
+ */
+export const parseFilterIds = (
+ value: string | string[] | undefined,
+): string[] => {
+ if (value === undefined) return [];
+ const raw = Array.isArray(value) ? value.join(",") : value;
+ return raw
+ .split(",")
+ .map((id) => id.trim())
+ .filter((id) => id.length > 0);
+};
+
+const belongsToGroup = (provider: ProviderProps, groupIds: string[]): boolean =>
+ provider.relationships.provider_groups?.data?.some((group) =>
+ groupIds.includes(group.id),
+ ) ?? false;
+
+/**
+ * Keep only providers belonging to one of the selected groups. An empty group
+ * list means "no group filter" and returns every provider unchanged.
+ */
+export const scopeProvidersByGroup = (
+ providers: ProviderProps[],
+ groupIds: string[],
+): ProviderProps[] =>
+ groupIds.length === 0
+ ? providers
+ : providers.filter((p) => belongsToGroup(p, groupIds));
+
+/**
+ * Filter providers by every active scope dimension (id, type, group) combined
+ * with AND. Each empty dimension is skipped, so a provider is kept only when it
+ * satisfies all the filters that are actually set.
+ */
+export const filterProvidersByScope = (
+ providers: ProviderProps[],
+ { providerIds, providerTypes, providerGroupIds }: ProviderScopeFilters,
+): ProviderProps[] => {
+ const normalizedTypes = providerTypes.map((type) => type.toLowerCase());
+
+ return providers.filter((provider) => {
+ if (providerIds.length > 0 && !providerIds.includes(provider.id)) {
+ return false;
+ }
+ if (
+ normalizedTypes.length > 0 &&
+ !normalizedTypes.includes(provider.attributes.provider.toLowerCase())
+ ) {
+ return false;
+ }
+ if (
+ providerGroupIds.length > 0 &&
+ !belongsToGroup(provider, providerGroupIds)
+ ) {
+ return false;
+ }
+ return true;
+ });
+};
diff --git a/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx b/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx
index 0396795cb9..b408ed94ff 100644
--- a/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx
+++ b/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx
@@ -1,13 +1,12 @@
"use server";
import { getLatestFindings } from "@/actions/findings/findings";
-import { LighthouseBanner } from "@/components/lighthouse/banner";
import { LinkToFindings } from "@/components/overview";
import { ColumnLatestFindings } from "@/components/overview/new-findings-table/table";
import { CardTitle } from "@/components/shadcn";
-import { DataTable } from "@/components/ui/table";
-import { FINDINGS_FILTERED_SORT } from "@/lib";
-import { createDict } from "@/lib/helper";
+import { DataTable } from "@/components/shadcn/table";
+import { FINDINGS_FILTERED_SORT, MUTED_FILTER } from "@/lib";
+import { createDict } from "@/lib/utils";
import { FindingProps, SearchParamsProps } from "@/types";
import { pickFilterParams } from "../../_lib/filter-params";
@@ -23,6 +22,7 @@ export async function FindingsViewSSR({ searchParams }: FindingsViewSSRProps) {
const defaultFilters = {
"filter[status]": "FAIL",
"filter[delta]": "new",
+ "filter[muted]": MUTED_FILTER.EXCLUDE,
};
const filters = pickFilterParams(searchParams);
@@ -44,7 +44,8 @@ export async function FindingsViewSSR({ searchParams }: FindingsViewSSRProps) {
const scan = scanDict[finding.relationships?.scan?.data?.id];
const resource =
resourceDict[finding.relationships?.resources?.data?.[0]?.id];
- const provider = providerDict[scan?.relationships?.provider?.data?.id];
+ const provider =
+ providerDict[scan?.relationships?.provider?.data?.id ?? ""];
return {
...finding,
@@ -60,7 +61,6 @@ export async function FindingsViewSSR({ searchParams }: FindingsViewSSRProps) {
return (
<div className="flex w-full flex-col">
- <LighthouseBanner />
<DataTable
key={`dashboard-findings-${Date.now()}`}
columns={ColumnLatestFindings}
diff --git a/ui/app/(prowler)/_overview/graphs-tabs/graphs-tabs-wrapper.tsx b/ui/app/(prowler)/_overview/graphs-tabs/graphs-tabs-wrapper.tsx
index f9741dc75e..4d29e55ff0 100644
--- a/ui/app/(prowler)/_overview/graphs-tabs/graphs-tabs-wrapper.tsx
+++ b/ui/app/(prowler)/_overview/graphs-tabs/graphs-tabs-wrapper.tsx
@@ -1,7 +1,7 @@
-import { Skeleton } from "@heroui/skeleton";
import { Suspense } from "react";
import { SkeletonTableNewFindings } from "@/components/overview/new-findings-table/table";
+import { Skeleton } from "@/components/shadcn";
import { SearchParamsProps } from "@/types";
import { GraphsTabsClient } from "./_components/graphs-tabs-client";
diff --git a/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx b/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx
index b8479432e6..2a4b100379 100644
--- a/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx
+++ b/ui/app/(prowler)/_overview/graphs-tabs/risk-pipeline-view/risk-pipeline-view.ssr.tsx
@@ -3,11 +3,16 @@ import {
getFindingsBySeverity,
SeverityByProviderType,
} from "@/actions/overview";
+import { OVERVIEW_FILTER_PARAM } from "@/actions/overview/overview-filters";
import { getAllProviders } from "@/actions/providers";
import { SankeyChart } from "@/components/graphs/sankey-chart";
import { SearchParamsProps } from "@/types";
import { pickFilterParams } from "../../_lib/filter-params";
+import {
+ parseFilterIds,
+ scopeProvidersByGroup,
+} from "../../_lib/provider-scope";
export async function RiskPipelineViewSSR({
searchParams,
@@ -16,27 +21,31 @@ export async function RiskPipelineViewSSR({
}) {
const filters = pickFilterParams(searchParams);
- const providerTypeFilter = filters["filter[provider_type__in]"];
- const providerIdFilter = filters["filter[provider_id__in]"];
+ const providerTypeFilter = filters[OVERVIEW_FILTER_PARAM.PROVIDER_TYPE];
+ const providerIdFilter = filters[OVERVIEW_FILTER_PARAM.PROVIDER_ID];
+ const providerGroupsFilter = filters[OVERVIEW_FILTER_PARAM.PROVIDER_GROUPS];
// Fetch providers list to know account types
const providersListResponse = await getAllProviders();
const allProviders = providersListResponse?.data || [];
+ // Scope the provider set to the selected groups so we enumerate only their
+ // provider types below (the per-type API calls also carry the group filter).
+ const selectedGroupIds = parseFilterIds(providerGroupsFilter);
+ const scopedProviders = scopeProvidersByGroup(allProviders, selectedGroupIds);
+
// Build severityByProviderType based on filters
const severityByProviderType: SeverityByProviderType = {};
let selectedProviderTypes: string[] | undefined;
if (providerIdFilter) {
// Case: Accounts are selected - group by provider type and make parallel calls
- const selectedAccountIds = String(providerIdFilter)
- .split(",")
- .map((id) => id.trim());
+ const selectedAccountIds = parseFilterIds(providerIdFilter);
// Group selected accounts by provider type
const accountsByType: Record<string, string[]> = {};
for (const accountId of selectedAccountIds) {
- const provider = allProviders.find((p) => p.id === accountId);
+ const provider = scopedProviders.find((p) => p.id === accountId);
if (provider) {
const type = provider.attributes.provider.toLowerCase();
if (!accountsByType[type]) {
@@ -70,9 +79,9 @@ export async function RiskPipelineViewSSR({
}
} else if (providerTypeFilter) {
// Case: Provider types are selected - make parallel calls for each type
- selectedProviderTypes = String(providerTypeFilter)
- .split(",")
- .map((t) => t.trim().toLowerCase());
+ selectedProviderTypes = parseFilterIds(providerTypeFilter).map((type) =>
+ type.toLowerCase(),
+ );
const severityPromises = selectedProviderTypes.map(async (providerType) => {
const response = await getFindingsBySeverity({
@@ -93,9 +102,10 @@ export async function RiskPipelineViewSSR({
}
}
} else {
- // Case: No filters - get all provider types and make parallel calls
+ // Case: No account/type filter - enumerate provider types (scoped to the
+ // selected groups when a group filter is active) and make parallel calls.
const allProviderTypes = Array.from(
- new Set(allProviders.map((p) => p.attributes.provider.toLowerCase())),
+ new Set(scopedProviders.map((p) => p.attributes.provider.toLowerCase())),
);
const severityPromises = allProviderTypes.map(async (providerType) => {
diff --git a/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot.ssr.tsx b/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot.ssr.tsx
index 887eb7a5d5..1f4d3625d4 100644
--- a/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot.ssr.tsx
+++ b/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot.ssr.tsx
@@ -1,5 +1,6 @@
import { Info } from "lucide-react";
+import { OVERVIEW_FILTER_PARAM } from "@/actions/overview/overview-filters";
import {
adaptToRiskPlotData,
getProvidersRiskData,
@@ -8,6 +9,10 @@ import { getAllProviders } from "@/actions/providers";
import { SearchParamsProps } from "@/types";
import { pickFilterParams } from "../../_lib/filter-params";
+import {
+ filterProvidersByScope,
+ parseFilterIds,
+} from "../../_lib/provider-scope";
import { RiskPlotClient } from "./risk-plot-client";
export async function RiskPlotSSR({
@@ -17,31 +22,19 @@ export async function RiskPlotSSR({
}) {
const filters = pickFilterParams(searchParams);
- const providerTypeFilter = filters["filter[provider_type__in]"];
- const providerIdFilter = filters["filter[provider_id__in]"];
-
// Fetch all providers
const providersListResponse = await getAllProviders();
const allProviders = providersListResponse?.data || [];
- // Filter providers based on search params
- let filteredProviders = allProviders;
-
- if (providerIdFilter) {
- // Filter by specific provider IDs
- const selectedIds = String(providerIdFilter)
- .split(",")
- .map((id) => id.trim());
- filteredProviders = allProviders.filter((p) => selectedIds.includes(p.id));
- } else if (providerTypeFilter) {
- // Filter by provider types
- const selectedTypes = String(providerTypeFilter)
- .split(",")
- .map((t) => t.trim().toLowerCase());
- filteredProviders = allProviders.filter((p) =>
- selectedTypes.includes(p.attributes.provider.toLowerCase()),
- );
- }
+ // Compose every active provider-scope filter with AND so combining e.g. a
+ // group and a type narrows to providers matching both.
+ const filteredProviders = filterProvidersByScope(allProviders, {
+ providerIds: parseFilterIds(filters[OVERVIEW_FILTER_PARAM.PROVIDER_ID]),
+ providerTypes: parseFilterIds(filters[OVERVIEW_FILTER_PARAM.PROVIDER_TYPE]),
+ providerGroupIds: parseFilterIds(
+ filters[OVERVIEW_FILTER_PARAM.PROVIDER_GROUPS],
+ ),
+ });
// No providers to show
if (filteredProviders.length === 0) {
diff --git a/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx b/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx
index 9e0802d4ff..b65b6a21f0 100644
--- a/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx
+++ b/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx
@@ -3,6 +3,7 @@
import { useRouter, useSearchParams } from "next/navigation";
import { useState } from "react";
+import { OVERVIEW_FILTER_PARAM } from "@/actions/overview/overview-filters";
import { getSeverityTrendsByTimeRange } from "@/actions/overview/severity-trends";
import { LineChart } from "@/components/graphs/line-chart";
import { LineConfig, LineDataPoint } from "@/components/graphs/types";
@@ -42,10 +43,16 @@ export const FindingSeverityOverTime = ({
const getActiveProviderFilters = (): Record<string, string> => {
const filters: Record<string, string> = {};
- const providerType = searchParams.get("filter[provider_type__in]");
- const providerId = searchParams.get("filter[provider_id__in]");
- if (providerType) filters["filter[provider_type__in]"] = providerType;
- if (providerId) filters["filter[provider_id__in]"] = providerId;
+ const providerType = searchParams.get(OVERVIEW_FILTER_PARAM.PROVIDER_TYPE);
+ const providerId = searchParams.get(OVERVIEW_FILTER_PARAM.PROVIDER_ID);
+ const providerGroups = searchParams.get(
+ OVERVIEW_FILTER_PARAM.PROVIDER_GROUPS,
+ );
+ if (providerType)
+ filters[OVERVIEW_FILTER_PARAM.PROVIDER_TYPE] = providerType;
+ if (providerId) filters[OVERVIEW_FILTER_PARAM.PROVIDER_ID] = providerId;
+ if (providerGroups)
+ filters[OVERVIEW_FILTER_PARAM.PROVIDER_GROUPS] = providerGroups;
return filters;
};
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
index 026ba439f1..28518fd576 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
@@ -40,7 +40,7 @@ vi.mock(
}),
);
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: ({
entityAlias,
entityId,
@@ -104,6 +104,7 @@ const mockProviders: ProviderProps[] = [
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: "123456789012",
alias: "Production AWS",
status: "completed",
@@ -131,6 +132,7 @@ const mockProviders: ProviderProps[] = [
type: "providers",
attributes: {
provider: "gcp",
+ is_dynamic: false,
uid: "prowler-prod-project",
alias: "Production GCP",
status: "completed",
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
index c8a6c9fb61..19f449c159 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
@@ -61,11 +61,9 @@ vi.mock("next/navigation", () => ({
useSearchParams: () => new URLSearchParams(routerMocks.currentSearch),
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: toastMock }),
-}));
-
-vi.mock("@/components/shadcn", () => ({
Button: ({
asChild,
children,
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alerts-table.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alerts-table.test.tsx
index 3cea620aa4..19f3d019da 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alerts-table.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alerts-table.test.tsx
@@ -22,7 +22,7 @@ vi.mock("next/navigation", () => ({
useSearchParams: () => new URLSearchParams(navigationMocks.currentSearch),
}));
-vi.mock("@/components/ui/table/data-table", () => ({
+vi.mock("@/components/shadcn/table/data-table", () => ({
DataTable: ({
columns,
data,
@@ -81,7 +81,7 @@ vi.mock("@/components/ui/table/data-table", () => ({
),
}));
-vi.mock("@/components/ui/table/data-table-column-header", () => ({
+vi.mock("@/components/shadcn/table/data-table-column-header", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
}));
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/seed-from-findings-button.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/seed-from-findings-button.test.tsx
index b6fca816df..4250a9c579 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/seed-from-findings-button.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/seed-from-findings-button.test.tsx
@@ -8,6 +8,8 @@ import type {
AlertFormSubmitResult,
AlertFormValues,
} from "@/app/(prowler)/alerts/_types/alert-form";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
const routerMocks = vi.hoisted(() => ({
push: vi.fn(),
@@ -25,7 +27,8 @@ vi.mock("next/navigation", () => ({
useRouter: () => routerMocks,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
ToastAction: ({
asChild,
children,
@@ -98,6 +101,7 @@ import { SeedFromFindingsButton } from "../seed-from-findings-button";
describe("SeedFromFindingsButton", () => {
afterEach(() => {
vi.clearAllMocks();
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
});
it("should explain why creating an alert is disabled when no real filters are applied", async () => {
@@ -355,8 +359,9 @@ describe("SeedFromFindingsButton", () => {
).not.toBeInTheDocument();
});
- it("should render disabled as a Cloud-only feature in OSS", () => {
+ it("should open the Alerts upgrade in Local Server", async () => {
// Given
+ const user = userEvent.setup();
render(
<SeedFromFindingsButton
filterBag={{ "filter[severity__in]": "critical" }}
@@ -366,19 +371,34 @@ describe("SeedFromFindingsButton", () => {
// When
const button = screen.getByRole("button", { name: /Create Alert/i });
+ await user.click(button);
// Then
- expect(button).toBeDisabled();
+ expect(button).not.toBeDisabled();
expect(button.className).not.toContain("min-w");
expect(button).not.toHaveClass("justify-start");
- const pricingLink = screen.getByRole("link", {
- name: /available in prowler cloud/i,
- });
- expect(pricingLink).toHaveAttribute("href", "https://prowler.com/pricing");
- expect(pricingLink).toHaveClass("whitespace-nowrap");
- expect(pricingLink).toHaveTextContent("Available in Prowler Cloud");
- expect(pricingLink.closest("button")).toBeNull();
- expect(screen.queryByRole("tooltip")).not.toBeInTheDocument();
+ expect(screen.getByText("Cloud")).toBeVisible();
+ expect(screen.queryByRole("link")).not.toBeInTheDocument();
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.ALERTS,
+ );
expect(actionMocks.seedAlertRule).not.toHaveBeenCalled();
});
+
+ it("should expose a single keyboard stop for the Local Server upgrade", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <SeedFromFindingsButton
+ filterBag={{ "filter[severity__in]": "critical" }}
+ isCloudEnabled={false}
+ />,
+ );
+
+ // When
+ await user.tab();
+
+ // Then
+ expect(screen.getByRole("button", { name: /Create Alert/i })).toHaveFocus();
+ });
});
diff --git a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
index 8a9effd890..409055b2bd 100644
--- a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
+++ b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
@@ -594,22 +594,31 @@ const AlertFormModalContent = ({
{errors.root && (
<div className="text-text-error-primary text-sm">{errors.root}</div>
)}
- <div className="flex justify-end gap-2">
- <Button variant="outline" onClick={() => onOpenChange(false)}>
+ {/* mt-4 lifts the gap-4 container spacing to 32px so the distance to
+ the footer matches the launch scan and triage note modals. */}
+ <div className="mt-4 flex w-full justify-between gap-4">
+ <Button
+ variant="outline"
+ size="lg"
+ onClick={() => onOpenChange(false)}
+ >
Cancel
</Button>
- {editingAlert && (
- <Button
- variant="outline"
- onClick={handlePreview}
- disabled={previewLoading || saving}
- >
- {previewLoading ? "Running..." : "Test"}
+ <div className="flex gap-4">
+ {editingAlert && (
+ <Button
+ variant="outline"
+ size="lg"
+ onClick={handlePreview}
+ disabled={previewLoading || saving}
+ >
+ {previewLoading ? "Running..." : "Test"}
+ </Button>
+ )}
+ <Button size="lg" onClick={handleSubmit} disabled={saving}>
+ {submitLabel}
</Button>
- )}
- <Button onClick={handleSubmit} disabled={saving}>
- {submitLabel}
- </Button>
+ </div>
</div>
</div>
</Modal>
diff --git a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
index e29a0651c2..92f11631ad 100644
--- a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
+++ b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
@@ -16,8 +16,8 @@ import {
type AlertRule,
} from "@/app/(prowler)/alerts/_types";
import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
import { DOCS_URLS } from "@/lib/external-urls";
import type { MetaDataProps } from "@/types";
import type { ScanEntity } from "@/types";
diff --git a/ui/app/(prowler)/alerts/_components/alerts-table.tsx b/ui/app/(prowler)/alerts/_components/alerts-table.tsx
index d9251129af..a4ee46e639 100644
--- a/ui/app/(prowler)/alerts/_components/alerts-table.tsx
+++ b/ui/app/(prowler)/alerts/_components/alerts-table.tsx
@@ -9,9 +9,9 @@ import {
ActionDropdownDangerZone,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTable } from "@/components/ui/table/data-table";
-import { DataTableColumnHeader } from "@/components/ui/table/data-table-column-header";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTable } from "@/components/shadcn/table/data-table";
+import { DataTableColumnHeader } from "@/components/shadcn/table/data-table-column-header";
import type { MetaDataProps } from "@/types";
interface AlertsTableProps {
diff --git a/ui/app/(prowler)/alerts/_components/seed-from-findings-button.tsx b/ui/app/(prowler)/alerts/_components/seed-from-findings-button.tsx
index 3db186fe85..6b94549a9e 100644
--- a/ui/app/(prowler)/alerts/_components/seed-from-findings-button.tsx
+++ b/ui/app/(prowler)/alerts/_components/seed-from-findings-button.tsx
@@ -23,14 +23,16 @@ import type {
} from "@/app/(prowler)/alerts/_types/alert-form";
import { buildFindingsFilterChips } from "@/components/findings/findings-filters.utils";
import {
+ Badge,
Button,
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn";
-import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
-import { ToastAction, useToast } from "@/components/ui";
+import { ToastAction, useToast } from "@/components/shadcn";
+import { useCloudUpgradeStore } from "@/store";
import type { ScanEntity } from "@/types";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
import type { ProviderProps } from "@/types/providers";
const DISABLED_FILTER_TOOLTIP =
@@ -138,6 +140,9 @@ export const SeedFromFindingsButton = ({
}: SeedFromFindingsButtonProps) => {
const router = useRouter();
const { toast } = useToast();
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
const [modalOpen, setModalOpen] = useState(false);
const [seeding, setSeeding] = useState(false);
const [seededCondition, setSeededCondition] = useState<AlertCondition | null>(
@@ -154,7 +159,11 @@ export const SeedFromFindingsButton = ({
const canSeedFromFilters = hasFindingFilterValue(filterBag);
const handleClick = async () => {
- if (!isCloudEnabled || !canSeedFromFilters) return;
+ if (!isCloudEnabled) {
+ openCloudUpgrade(CLOUD_UPGRADE_FEATURE.ALERTS);
+ return;
+ }
+ if (!canSeedFromFilters) return;
setSeeding(true);
const result = await seedAlertRule(withDefaultAlertSeedFilters(filterBag));
setSeeding(false);
@@ -201,7 +210,7 @@ export const SeedFromFindingsButton = ({
size={size}
variant="default"
onClick={handleClick}
- disabled={!isCloudEnabled || !canSeedFromFilters || seeding}
+ disabled={(isCloudEnabled && !canSeedFromFilters) || seeding}
className={className}
>
<BellPlusIcon size={14} />
@@ -236,10 +245,10 @@ export const SeedFromFindingsButton = ({
if (!isCloudEnabled) {
return (
- <span className="relative inline-flex" tabIndex={0}>
+ <span className="relative inline-flex">
{button}
- <span className="absolute top-0 right-0 z-10 translate-x-1/3 -translate-y-1/2">
- <CloudFeatureBadgeLink />
+ <span className="pointer-events-none absolute top-0 right-0 z-10 translate-x-1/3 -translate-y-1/2">
+ <Badge variant="cloud">Cloud</Badge>
</span>
</span>
);
diff --git a/ui/app/(prowler)/alerts/page.tsx b/ui/app/(prowler)/alerts/page.tsx
index 28f238ef01..2b7e74336b 100644
--- a/ui/app/(prowler)/alerts/page.tsx
+++ b/ui/app/(prowler)/alerts/page.tsx
@@ -5,8 +5,9 @@ import { getAllProviders } from "@/actions/providers";
import { getScans } from "@/actions/scans";
import { getAlert, listAlerts } from "@/app/(prowler)/alerts/_actions";
import { AlertsManager } from "@/app/(prowler)/alerts/_components/alerts-manager";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { createScanDetailsMapping } from "@/lib";
+import { isCloud } from "@/lib/shared/env";
import type { MetaDataProps, ScanEntity, ScanProps } from "@/types";
interface AlertsPageProps {
@@ -49,7 +50,7 @@ const toAlertsSearchParams = (
};
export default async function AlertsPage({ searchParams }: AlertsPageProps) {
- if (process.env.NEXT_PUBLIC_IS_CLOUD_ENV !== "true") {
+ if (!isCloud()) {
redirect("/");
}
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/_components/vertical-steps.tsx b/ui/app/(prowler)/attack-paths/(workflow)/_components/vertical-steps.tsx
index 7a11c11484..3b88e9f40a 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/_components/vertical-steps.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/_components/vertical-steps.tsx
@@ -128,45 +128,44 @@ export const VerticalSteps = forwardRef<HTMLButtonElement, VerticalStepsProps>(
"[--active-color:var(--step-color)]",
"[--complete-background-color:var(--step-color)]",
"[--complete-border-color:var(--step-color)]",
- "[--inactive-border-color:hsl(var(--heroui-default-300))]",
- "[--inactive-color:hsl(var(--heroui-default-300))]",
+ "[--inactive-border-color:var(--border-neutral-tertiary)]",
+ "[--inactive-color:var(--border-neutral-tertiary)]",
];
switch (color) {
- case "primary":
- userColor = "[--step-color:hsl(var(--heroui-primary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
- break;
case "secondary":
- userColor = "[--step-color:hsl(var(--heroui-secondary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-secondary-foreground))]";
+ userColor =
+ "[--step-color:var(--color-violet-600)] dark:[--step-color:var(--color-violet-400)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "success":
- userColor = "[--step-color:hsl(var(--heroui-success))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-success-foreground))]";
+ userColor = "[--step-color:var(--bg-pass-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "warning":
- userColor = "[--step-color:hsl(var(--heroui-warning))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-warning-foreground))]";
+ userColor = "[--step-color:var(--bg-warning-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "danger":
- userColor = "[--step-color:hsl(var(--heroui-error))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-error-foreground))]";
+ userColor = "[--step-color:var(--bg-fail-primary)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "default":
- userColor = "[--step-color:hsl(var(--heroui-default))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-default-foreground))]";
+ userColor =
+ "[--step-color:var(--color-zinc-300)] dark:[--step-color:var(--color-zinc-600)]";
+ fgColor = "[--step-fg-color:var(--text-neutral-primary)]";
break;
+ case "primary":
default:
- userColor = "[--step-color:hsl(var(--heroui-primary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
+ userColor = "[--step-color:var(--bg-button-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
}
if (!className?.includes("--step-fg-color")) colorsVars.unshift(fgColor);
if (!className?.includes("--step-color")) colorsVars.unshift(userColor);
if (!className?.includes("--inactive-bar-color"))
- colorsVars.push("[--inactive-bar-color:hsl(var(--heroui-default-300))]");
+ colorsVars.push("[--inactive-bar-color:var(--border-neutral-tertiary)]");
const colors = colorsVars;
@@ -189,7 +188,7 @@ export const VerticalSteps = forwardRef<HTMLButtonElement, VerticalStepsProps>(
ref={ref}
aria-current={status === "active" ? "step" : undefined}
className={cn(
- "group rounded-large flex w-full cursor-pointer items-center justify-center gap-4 px-3 py-2.5",
+ "group flex w-full cursor-pointer items-center justify-center gap-4 rounded-[14px] px-3 py-2.5",
stepClassName,
)}
onClick={() => setCurrentStep(stepIdx)}
@@ -201,7 +200,7 @@ export const VerticalSteps = forwardRef<HTMLButtonElement, VerticalStepsProps>(
<m.div
animate={status}
className={cn(
- "border-medium text-large text-default-foreground relative flex h-[34px] w-[34px] items-center justify-center rounded-full font-semibold",
+ "text-text-neutral-primary relative flex h-[34px] w-[34px] items-center justify-center rounded-full border-2 text-lg font-semibold",
{
"shadow-lg": status === "complete",
},
@@ -242,9 +241,10 @@ export const VerticalSteps = forwardRef<HTMLButtonElement, VerticalStepsProps>(
<div>
<div
className={cn(
- "text-medium text-default-foreground font-medium transition-[color,opacity] duration-300 group-active:opacity-70",
+ "text-text-neutral-primary text-base font-medium transition-[color,opacity] duration-300 group-active:opacity-70",
{
- "text-default-500": status === "inactive",
+ "text-text-neutral-tertiary":
+ status === "inactive",
},
)}
>
@@ -252,9 +252,10 @@ export const VerticalSteps = forwardRef<HTMLButtonElement, VerticalStepsProps>(
</div>
<div
className={cn(
- "text-tiny text-default-600 lg:text-small transition-[color,opacity] duration-300 group-active:opacity-70",
+ "text-text-neutral-secondary text-xs transition-[color,opacity] duration-300 group-active:opacity-70 lg:text-sm",
{
- "text-default-500": status === "inactive",
+ "text-text-neutral-tertiary":
+ status === "inactive",
},
)}
>
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/_components/workflow-attack-paths.tsx b/ui/app/(prowler)/attack-paths/(workflow)/_components/workflow-attack-paths.tsx
index 101f97d5b7..cf37eeb3f5 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/_components/workflow-attack-paths.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/_components/workflow-attack-paths.tsx
@@ -38,7 +38,7 @@ export const WorkflowAttackPaths = () => {
style={{ width: `${progressPercentage}%` }}
/>
</div>
- <h3 className="dark:text-prowler-theme-pale/90 text-sm font-semibold">
+ <h3 className="dark:text-text-neutral-primary/90 text-sm font-semibold">
Step {currentStep + 1} of {steps.length}
</h3>
</div>
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.test.tsx
index d7209c68c8..1183120a54 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.test.tsx
@@ -7,7 +7,7 @@ import type { GraphNode } from "@/types/attack-paths";
import { NodeDetailPanel } from "./node-detail-panel";
-vi.mock("@/components/ui/sheet/sheet", () => ({
+vi.mock("@/components/shadcn/sheet/sheet", () => ({
Sheet: ({ children }: { children: ReactNode }) => <div>{children}</div>,
SheetContent: ({ children }: { children: ReactNode }) => (
<div>{children}</div>
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.tsx
index 97d8657bfd..2dc42b2fc1 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-detail-panel.tsx
@@ -1,14 +1,14 @@
"use client";
import { Button, Card, CardContent } from "@/components/shadcn";
-import { Spinner } from "@/components/shadcn/spinner/spinner";
import {
Sheet,
SheetContent,
SheetDescription,
SheetHeader,
SheetTitle,
-} from "@/components/ui/sheet/sheet";
+} from "@/components/shadcn/sheet/sheet";
+import { Spinner } from "@/components/shadcn/spinner/spinner";
import type { GraphNode } from "@/types/attack-paths";
import { NodeFindings } from "./node-findings";
@@ -46,7 +46,7 @@ export const NodeDetailContent = ({
{/* Node Overview Section */}
<Card className="border-border-neutral-secondary">
<CardContent className="flex flex-col gap-3 p-4">
- <h3 className="dark:text-prowler-theme-pale/90 text-sm font-semibold">
+ <h3 className="dark:text-text-neutral-primary/90 text-sm font-semibold">
Node Overview
</h3>
<NodeOverview node={node} />
@@ -57,7 +57,7 @@ export const NodeDetailContent = ({
{!isProwlerFinding && (
<Card className="border-border-neutral-secondary">
<CardContent className="flex flex-col gap-3 p-4">
- <h3 className="dark:text-prowler-theme-pale/90 text-sm font-semibold">
+ <h3 className="dark:text-text-neutral-primary/90 text-sm font-semibold">
Related Findings
</h3>
<div className="text-text-neutral-secondary dark:text-text-neutral-secondary text-xs">
@@ -77,7 +77,7 @@ export const NodeDetailContent = ({
{isProwlerFinding && (
<Card className="border-border-neutral-secondary">
<CardContent className="flex flex-col gap-3 p-4">
- <h3 className="dark:text-prowler-theme-pale/90 text-sm font-semibold">
+ <h3 className="dark:text-text-neutral-primary/90 text-sm font-semibold">
Affected Resources
</h3>
<div className="text-text-neutral-secondary dark:text-text-neutral-secondary text-xs">
@@ -112,7 +112,7 @@ export const NodeDetailPanel = ({
return (
<Sheet open={isOpen} onOpenChange={(open) => !open && onClose?.()}>
- <SheetContent className="dark:bg-prowler-theme-midnight my-4 max-h-[calc(100vh-2rem)] max-w-[95vw] overflow-y-auto rounded-l-xl pt-10 md:my-8 md:max-h-[calc(100vh-4rem)] md:max-w-[55vw]">
+ <SheetContent className="my-4 max-h-[calc(100vh-2rem)] max-w-[95vw] overflow-y-auto rounded-l-xl pt-10 md:my-8 md:max-h-[calc(100vh-4rem)] md:max-w-[55vw]">
<SheetHeader>
<div className="flex items-start justify-between gap-2">
<div className="flex-1">
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-findings.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-findings.tsx
index 253401fa97..6ce173ac0e 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-findings.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-findings.tsx
@@ -2,7 +2,7 @@
import { Button } from "@/components/shadcn";
import { Spinner } from "@/components/shadcn/spinner/spinner";
-import { SeverityBadge } from "@/components/ui/table/severity-badge";
+import { SeverityBadge } from "@/components/shadcn/table/severity-badge";
import type { GraphNode } from "@/types/attack-paths";
const SEVERITY_LEVELS = {
@@ -80,7 +80,7 @@ export const NodeFindings = ({
severity={normalizeSeverity(finding.properties.severity)}
/>
)}
- <h5 className="dark:text-prowler-theme-pale/90 text-sm font-medium">
+ <h5 className="dark:text-text-neutral-primary/90 text-sm font-medium">
{findingName}
</h5>
</div>
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-overview.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-overview.tsx
index 2e294cf069..d2ee88bf5f 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-overview.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-overview.tsx
@@ -1,8 +1,8 @@
"use client";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { DateWithTime } from "@/components/shadcn/entities/date-with-time";
import { InfoField } from "@/components/shadcn/info-field/info-field";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { DateWithTime } from "@/components/ui/entities/date-with-time";
import type { GraphNode, GraphNodePropertyValue } from "@/types/attack-paths";
import { formatNodeLabels } from "../../_lib";
@@ -47,7 +47,7 @@ export const NodeOverview = ({ node }: NodeOverviewProps) => {
{/* Display all properties */}
<div className="mt-4 border-t border-gray-200 pt-4 dark:border-gray-700">
- <h4 className="dark:text-prowler-theme-pale/90 mb-3 text-sm font-semibold">
+ <h4 className="dark:text-text-neutral-primary/90 mb-3 text-sm font-semibold">
Properties
</h4>
<div className="grid grid-cols-1 gap-3 md:grid-cols-2">
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-remediation.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-remediation.tsx
index 3ece3184f0..8211d19ca8 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-remediation.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-remediation.tsx
@@ -3,6 +3,7 @@
import { Badge } from "@/components/shadcn/badge/badge";
import { Button } from "@/components/shadcn/button/button";
import { Spinner } from "@/components/shadcn/spinner/spinner";
+import { StatusFindingBadge } from "@/components/shadcn/table";
interface Finding {
id: string;
@@ -40,12 +41,6 @@ export const NodeRemediation = ({
}
};
- const getStatusVariant = (status: string) => {
- if (status === "PASS") return "default";
- if (status === "FAIL") return "destructive";
- return "secondary";
- };
-
return (
<div className="flex flex-col gap-3">
{findings.map((finding) => (
@@ -55,7 +50,7 @@ export const NodeRemediation = ({
>
<div className="flex items-start justify-between gap-2">
<div className="flex-1">
- <h5 className="dark:text-prowler-theme-pale/90 text-sm font-medium">
+ <h5 className="dark:text-text-neutral-primary/90 text-sm font-medium">
{finding.title}
</h5>
<p className="mt-1 text-xs text-gray-500 dark:text-gray-400">
@@ -66,9 +61,7 @@ export const NodeRemediation = ({
<Badge variant={getSeverityVariant(finding.severity)}>
{finding.severity}
</Badge>
- <Badge variant={getStatusVariant(finding.status)}>
- {finding.status}
- </Badge>
+ <StatusFindingBadge status={finding.status} />
</div>
</div>
<div className="mt-2">
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-resources.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-resources.tsx
index 47f1f8db5f..dad0379932 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-resources.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/node-detail/node-resources.tsx
@@ -63,7 +63,7 @@ export const NodeResources = ({ node, allNodes = [] }: NodeResourcesProps) => {
{resource.labels[0]}
</Badge>
)}
- <h5 className="dark:text-prowler-theme-pale/90 text-sm font-medium">
+ <h5 className="dark:text-text-neutral-primary/90 text-sm font-medium">
{String(resource.properties?.name || resourceId)}
</h5>
</div>
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-parameters-form.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-parameters-form.tsx
index 94edbf2a68..60ef106331 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-parameters-form.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-parameters-form.tsx
@@ -9,7 +9,7 @@ import {
FormItem,
FormLabel,
FormMessage,
-} from "@/components/ui/form";
+} from "@/components/shadcn/form";
import { cn } from "@/lib/utils";
import {
type AttackPathQuery,
@@ -37,7 +37,7 @@ export const QueryParametersForm = ({
return (
<div className="flex flex-col gap-4">
- <h3 className="dark:text-prowler-theme-pale/90 text-sm font-semibold">
+ <h3 className="dark:text-text-neutral-primary/90 text-sm font-semibold">
Query Parameters
</h3>
@@ -63,7 +63,7 @@ export const QueryParametersForm = ({
}
onChange={(e) => field.onChange(e.target.checked)}
aria-label={param.label}
- className="border-border-neutral-secondary bg-bg-neutral-primary text-text-primary focus:ring-primary dark:border-border-neutral-secondary dark:bg-bg-neutral-primary dark:text-text-primary h-4 w-4 rounded border focus:ring-2"
+ className="border-border-neutral-secondary bg-bg-neutral-primary text-text-primary focus:ring-button-primary dark:border-border-neutral-secondary dark:bg-bg-neutral-primary dark:text-text-primary h-4 w-4 rounded border focus:ring-2"
/>
</FormControl>
<div className="flex flex-col gap-1">
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
index 5ec29558ff..fc2704c1d4 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
@@ -37,7 +37,7 @@ vi.mock("@/components/shadcn/tooltip", () => ({
),
}));
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: ({
entityAlias,
entityId,
@@ -47,11 +47,11 @@ vi.mock("@/components/ui/entities/entity-info", () => ({
}) => <div>{entityAlias ?? entityId}</div>,
}));
-vi.mock("@/components/ui/entities/date-with-time", () => ({
+vi.mock("@/components/shadcn/entities/date-with-time", () => ({
DateWithTime: ({ dateTime }: { dateTime: string }) => <span>{dateTime}</span>,
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
DataTable: ({
columns,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
index dd532f9ed6..5f894580e0 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
@@ -5,18 +5,18 @@ import { Check, Minus } from "lucide-react";
import { usePathname, useRouter, useSearchParams } from "next/navigation";
import { useRef } from "react";
+import { DateWithTime } from "@/components/shadcn/entities/date-with-time";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import {
RadioGroup,
RadioGroupItem,
} from "@/components/shadcn/radio-group/radio-group";
+import { DataTable, DataTableColumnHeader } from "@/components/shadcn/table";
import {
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn/tooltip";
-import { DateWithTime } from "@/components/ui/entities/date-with-time";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
-import { DataTable, DataTableColumnHeader } from "@/components/ui/table";
import { formatDuration } from "@/lib/date-utils";
import { cn } from "@/lib/utils";
import type { MetaDataProps, ProviderType } from "@/types";
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
index bc2cf36331..7f982e7857 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
@@ -101,6 +101,31 @@ describe("waiting states", () => {
});
describe("running a query", () => {
+ test("the query builder surface uses the shared card primitive", async ({
+ mountWith,
+ }) => {
+ const graph = await mountWith();
+
+ const card = await graph.waitFor(() => graph.queryBuilderCard, 10000);
+
+ expect(card).toHaveAttribute("data-slot", "card");
+ expect(card).toHaveClass("rounded-xl");
+ });
+
+ test("a parameterized query shows its required inputs after selection", async ({
+ mountWith,
+ }) => {
+ const graph = await mountWith(fixtures.parameterizedQuery());
+
+ await graph.selectQuery();
+
+ expect(graph.containsText(/Query Parameters/i)).toBe(true);
+ expect(graph.containsText(/Tag key/i)).toBe(true);
+ expect(graph.getInputByName("tag_key")).toBeTruthy();
+ expect(graph.containsText(/Tag value/i)).toBe(true);
+ expect(graph.getInputByName("tag_value")).toBeTruthy();
+ });
+
test("the graph renders with a background, a minimap, and a viewport", async ({
mountWith,
}) => {
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
index 41089af527..f7aef5e721 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
@@ -242,6 +242,40 @@ export const resourcesOnly = (): PageFixture => ({
},
});
+export const parameterizedQuery = (): PageFixture => ({
+ scans: [buildScan(TYPICAL_SCAN_ID)],
+ scanId: TYPICAL_SCAN_ID,
+ queries: [
+ buildQuery(
+ "aws-internet-exposed-ec2-sensitive-s3-access",
+ "Internet-Exposed EC2 with Sensitive S3 Access",
+ {
+ parameters: [
+ {
+ name: "tag_key",
+ label: "Tag key",
+ data_type: "string",
+ description: "Tag key to filter the S3 bucket.",
+ placeholder: "DataClassification",
+ },
+ {
+ name: "tag_value",
+ label: "Tag value",
+ data_type: "string",
+ description: "Tag value to filter the S3 bucket.",
+ placeholder: "Sensitive",
+ },
+ ],
+ },
+ ),
+ ],
+ queryId: "aws-internet-exposed-ec2-sensitive-s3-access",
+ queryResult: {
+ nodes: [buildResourceNode("s3-1", "S3Bucket", "sensitive-data")],
+ relationships: [],
+ },
+});
+
export const disconnected = (): PageFixture => ({
scans: [buildScan(TYPICAL_SCAN_ID)],
scanId: TYPICAL_SCAN_ID,
@@ -322,6 +356,7 @@ export const fixtures = {
singleNode,
findingsOnly,
resourcesOnly,
+ parameterizedQuery,
disconnected,
large,
edgeCases,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.harness.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.harness.ts
index dff9ccdb51..ad2d4bf72d 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.harness.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.harness.ts
@@ -216,6 +216,22 @@ export class AttackPathPageHarness {
return this.q(AttackPathPageHarness.VIEWPORT_SEL);
}
+ get queryBuilderCard(): HTMLElement | null {
+ return (
+ this.container
+ .querySelector<HTMLElement>(
+ '[data-tour-id="attack-paths-query-selector"]',
+ )
+ ?.closest<HTMLElement>('[data-slot="card"]') ?? null
+ );
+ }
+
+ getInputByName(name: string): HTMLInputElement | null {
+ return this.container.querySelector<HTMLInputElement>(
+ `input[name="${name}"]`,
+ );
+ }
+
/**
* Inline `transform` of the React Flow viewport element. This is the
* pan/zoom matrix React Flow rewrites on every fit/zoom/pan, so comparing
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
index 6bcf03d082..cc87406aa8 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
@@ -16,7 +16,7 @@ import { FindingDetailDrawer } from "@/components/findings/table";
import { PageReady } from "@/components/onboarding";
import { useFindingDetails } from "@/components/resources/table/use-finding-details";
import { AutoRefresh } from "@/components/scans";
-import { Button } from "@/components/shadcn";
+import { Button, Card, useToast } from "@/components/shadcn";
import {
Dialog,
DialogContent,
@@ -26,7 +26,6 @@ import {
DialogTrigger,
} from "@/components/shadcn/dialog";
import { StatusAlert } from "@/components/shared/status-alert";
-import { useToast } from "@/components/ui";
import { useMountEffect } from "@/hooks/use-mount-effect";
import { isCloud } from "@/lib/shared/env";
import {
@@ -70,7 +69,7 @@ import {
} from "./_lib/get-attack-paths-view-state";
const SCROLL_CONTAINER_CLASS =
- "minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4";
+ "minimal-scrollbar relative z-0 w-full gap-4 overflow-auto shadow-sm";
export default function AttackPathsPage() {
const searchParams = useSearchParams();
@@ -427,9 +426,9 @@ export default function AttackPathsPage() {
</div>
{viewState === ATTACK_PATHS_VIEW_STATES.LOADING ? (
- <div className={SCROLL_CONTAINER_CLASS}>
+ <Card variant="base" className={SCROLL_CONTAINER_CLASS}>
<p className="text-sm">Loading scans...</p>
- </div>
+ </Card>
) : viewState === ATTACK_PATHS_VIEW_STATES.NO_SCANS ? (
// Keep the empty-scans tour anchor: attackPathsEmptyTour targets
// data-tour-id="attack-paths-empty-scans-cta". The panel's NO_SCANS
@@ -463,7 +462,7 @@ export default function AttackPathsPage() {
)}
{scanId && (
- <div className={SCROLL_CONTAINER_CLASS}>
+ <Card variant="base" className={SCROLL_CONTAINER_CLASS}>
{queriesLoading ? (
<p className="text-sm">Loading queries...</p>
) : queriesError ? (
@@ -514,14 +513,14 @@ export default function AttackPathsPage() {
)}
</>
)}
- </div>
+ </Card>
)}
{(graphState.loading ||
(graphState.data &&
graphState.data.nodes &&
graphState.data.nodes.length > 0)) && (
- <div className={SCROLL_CONTAINER_CLASS}>
+ <Card variant="base" className={SCROLL_CONTAINER_CLASS}>
{graphState.loading ? (
<GraphLoading />
) : graphState.data &&
@@ -664,7 +663,7 @@ export default function AttackPathsPage() {
</div>
</>
) : null}
- </div>
+ </Card>
)}
{finding.findingDetails && (
diff --git a/ui/app/(prowler)/attack-paths/layout.tsx b/ui/app/(prowler)/attack-paths/layout.tsx
index 3a9a90b6d1..0ab889b7fe 100644
--- a/ui/app/(prowler)/attack-paths/layout.tsx
+++ b/ui/app/(prowler)/attack-paths/layout.tsx
@@ -1,4 +1,4 @@
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
export default function AttackPathsLayout({
children,
diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
index f5d42f8bc8..d1d734ea66 100644
--- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
+++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
@@ -1,4 +1,5 @@
-import { Spacer } from "@heroui/spacer";
+import { ChevronDownIcon } from "lucide-react";
+import { notFound, redirect } from "next/navigation";
import { Suspense } from "react";
import {
@@ -25,13 +26,17 @@ import {
TopFailedSectionsCardSkeleton,
} from "@/components/compliance";
import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
-import { ContentLayout } from "@/components/ui";
+import { Button } from "@/components/shadcn/button/button";
+import { Card } from "@/components/shadcn/card/card";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { getComplianceMapper } from "@/lib/compliance/compliance-mapper";
import {
getReportTypeForCompliance,
pickLatestCisPerProvider,
} from "@/lib/compliance/compliance-report-types";
+import { isCloud } from "@/lib/shared/env";
import { cn } from "@/lib/utils";
+import type { SearchParamsProps } from "@/types";
import {
AttributesData,
Framework,
@@ -39,38 +44,84 @@ import {
} from "@/types/compliance";
import { ScanEntity } from "@/types/scans";
-interface ComplianceDetailSearchParams {
- complianceId: string;
- version?: string;
- scanId?: string;
- section?: string;
- "filter[region__in]"?: string;
- "filter[cis_profile_level]"?: string;
- page?: string;
- pageSize?: string;
-}
+import { CrossProviderDetail } from "../_components/cross-provider-detail";
+import { resolveCrossProviderFramework } from "../_lib/cross-provider-frameworks";
+import { buildSearchParamsKey } from "../_lib/search-params-key";
+
+const getSingleSearchParam = (
+ value: string | string[] | undefined,
+): string | undefined =>
+ typeof value === "string" && value ? value : undefined;
export default async function ComplianceDetail({
params,
searchParams,
}: {
params: Promise<{ compliancetitle: string }>;
- searchParams: Promise<ComplianceDetailSearchParams>;
+ searchParams: Promise<SearchParamsProps>;
}) {
const { compliancetitle } = await params;
const resolvedSearchParams = await searchParams;
- const { complianceId, version, scanId, section } = resolvedSearchParams;
- const regionFilter = resolvedSearchParams["filter[region__in]"];
- const cisProfileFilter = resolvedSearchParams["filter[cis_profile_level]"];
+ const complianceId = getSingleSearchParam(resolvedSearchParams.complianceId);
+ const version = getSingleSearchParam(resolvedSearchParams.version);
+ const scanId = getSingleSearchParam(resolvedSearchParams.scanId);
+ const section = getSingleSearchParam(resolvedSearchParams.section);
+ const mode = getSingleSearchParam(resolvedSearchParams.mode);
+
+ if (!complianceId) {
+ notFound();
+ }
+
+ // Cross-provider mode replaces the per-scan pipeline with the universal
+ // roll-up view. Prowler Cloud-only: the OSS API has no such endpoint, so
+ // the route is blocked in OSS the same way the compliance tab is.
+ if (mode === "cross-provider") {
+ if (!isCloud()) {
+ redirect("/compliance");
+ }
+
+ const framework = resolveCrossProviderFramework(
+ complianceId,
+ compliancetitle,
+ );
+ if (!framework) {
+ notFound();
+ }
+
+ const crossProviderTitle = framework.title.split("-").join(" ");
+ return (
+ <ContentLayout title={`${crossProviderTitle} - ${framework.version}`}>
+ <Suspense
+ key={buildSearchParamsKey(resolvedSearchParams)}
+ fallback={
+ <div className="flex flex-col gap-8">
+ <div className="grid grid-cols-1 gap-6 md:grid-cols-[minmax(280px,400px)_1fr]">
+ <RequirementsStatusCardSkeleton />
+ <TopFailedSectionsCardSkeleton />
+ </div>
+ <SkeletonAccordion />
+ </div>
+ }
+ >
+ <CrossProviderDetail
+ compliancetitle={compliancetitle}
+ complianceId={complianceId}
+ searchParams={resolvedSearchParams}
+ targetSection={section}
+ />
+ </Suspense>
+ </ContentLayout>
+ );
+ }
+ const regionFilter = getSingleSearchParam(
+ resolvedSearchParams["filter[region__in]"],
+ );
+ const cisProfileFilter = getSingleSearchParam(
+ resolvedSearchParams["filter[cis_profile_level]"],
+ );
const logoPath = getComplianceIcon(compliancetitle);
- // Create a key that excludes pagination parameters to preserve accordion state avoiding reloads with pagination
- const paramsForKey = Object.fromEntries(
- Object.entries(resolvedSearchParams).filter(
- ([key]) => key !== "page" && key !== "pageSize",
- ),
- );
- const searchParamsKey = JSON.stringify(paramsForKey);
+ const searchParamsKey = buildSearchParamsKey(resolvedSearchParams);
const formattedTitle = compliancetitle.split("-").join(" ");
const pageTitle = version
@@ -177,33 +228,45 @@ export default async function ComplianceDetail({
return (
<ContentLayout title={finalPageTitle}>
- <div className="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
- <div className="min-w-0 flex-1">
- <ComplianceHeader
- scans={[]}
- uniqueRegions={uniqueRegions}
- showSearch={false}
- framework={compliancetitle}
- showProviders={false}
- logoPath={logoPath}
- complianceTitle={compliancetitle}
- selectedScan={selectedScan}
- />
- </div>
- {selectedScanId && (
- <div className="mb-4 flex-shrink-0 self-end sm:mb-0 sm:self-start sm:pt-1">
- <ComplianceDownloadContainer
- scanId={selectedScanId}
- complianceId={complianceId}
- reportType={getReportTypeForCompliance(
- attributesData?.data?.[0]?.attributes?.framework,
- complianceId,
- latestCisIds.has(complianceId),
- )}
+ {/* Header card — same surface as the cross-provider detail: scan info
+ and filters on the left, report actions and framework logo on the
+ right (lighthouse-settings card pattern). */}
+ <Card variant="base" className="mb-6 w-full gap-4 p-4 md:p-5">
+ <div className="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
+ <div className="min-w-0 flex-1">
+ <ComplianceHeader
+ scans={[]}
+ uniqueRegions={uniqueRegions}
+ showSearch={false}
+ framework={compliancetitle}
+ showProviders={false}
+ logoPath={logoPath}
+ complianceTitle={compliancetitle}
+ selectedScan={selectedScan}
/>
</div>
- )}
- </div>
+ {selectedScanId && (
+ <div className="mb-4 flex-shrink-0 self-end sm:mb-0 sm:self-start sm:pt-1">
+ <ComplianceDownloadContainer
+ scanId={selectedScanId}
+ complianceId={complianceId}
+ presentation="dropdown"
+ dropdownTrigger={
+ <Button variant="outline">
+ Report
+ <ChevronDownIcon />
+ </Button>
+ }
+ reportType={getReportTypeForCompliance(
+ attributesData?.data?.[0]?.attributes?.framework,
+ complianceId,
+ latestCisIds.has(complianceId),
+ )}
+ />
+ </div>
+ )}
+ </div>
+ </Card>
<Suspense
key={searchParamsKey}
@@ -350,7 +413,6 @@ const SSRComplianceContent = async ({
{/* <SectionsFailureRateCard categories={categoryHeatmapData} /> */}
</div>
- <Spacer className="bg-border-neutral-primary h-1 w-full rounded-full" />
<ClientAccordionWrapper
hideExpandButton={complianceId.includes("mitre_attack")}
items={accordionItems}
diff --git a/ui/app/(prowler)/compliance/_actions/cross-provider.test.ts b/ui/app/(prowler)/compliance/_actions/cross-provider.test.ts
new file mode 100644
index 0000000000..edd1481aac
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_actions/cross-provider.test.ts
@@ -0,0 +1,349 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const {
+ fetchMock,
+ getAuthHeadersMock,
+ handleApiResponseMock,
+ captureExceptionMock,
+} = vi.hoisted(() => ({
+ fetchMock: vi.fn(),
+ getAuthHeadersMock: vi.fn(),
+ handleApiResponseMock: vi.fn(),
+ captureExceptionMock: vi.fn(),
+}));
+
+vi.mock("@/lib", () => ({
+ apiBaseUrl: "https://api.test/api/v1",
+ getAuthHeaders: getAuthHeadersMock,
+ getErrorMessage: (error: unknown) =>
+ error instanceof Error ? error.message : String(error),
+ GENERIC_SERVER_ERROR_MESSAGE: "Generic server error.",
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+ handleApiResponse: handleApiResponseMock,
+}));
+
+vi.mock("@sentry/nextjs", () => ({
+ captureException: captureExceptionMock,
+}));
+
+import {
+ generateCrossProviderPdf,
+ getCrossProviderComplianceOverview,
+ getCrossProviderPdfBinary,
+ getLatestCrossProviderPdf,
+} from "./cross-provider";
+
+const lastFetchUrl = (): URL => {
+ const call = fetchMock.mock.calls.at(-1);
+ if (!call) throw new Error("fetch was not called");
+ return new URL(String(call[0]));
+};
+
+const jsonResponse = (body: unknown, status = 200) =>
+ new Response(JSON.stringify(body), {
+ status,
+ headers: { "Content-Type": "application/vnd.api+json" },
+ });
+
+beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal("fetch", fetchMock);
+ fetchMock.mockResolvedValue(jsonResponse({ data: null }));
+ getAuthHeadersMock.mockResolvedValue({
+ Accept: "application/vnd.api+json",
+ Authorization: "Bearer test-token",
+ });
+ handleApiResponseMock.mockResolvedValue({ data: null });
+});
+
+describe("getCrossProviderComplianceOverview", () => {
+ it("requests the overview with the required compliance_id filter", async () => {
+ await getCrossProviderComplianceOverview({ complianceId: "csa_ccm_4.0" });
+
+ const url = lastFetchUrl();
+ expect(url.pathname).toBe("/api/v1/cross-provider-compliance-overviews");
+ expect(url.searchParams.get("filter[compliance_id]")).toBe("csa_ccm_4.0");
+ expect(Array.from(url.searchParams.keys())).toEqual([
+ "filter[compliance_id]",
+ ]);
+ });
+
+ it("serializes optional filters and joins scan ids with commas", async () => {
+ await getCrossProviderComplianceOverview({
+ complianceId: "dora_2022_2554",
+ filters: {
+ scanIds: ["scan-1", "scan-2"],
+ providerTypes: "aws,gcp",
+ providerIds: "prov-1",
+ providerGroups: "group-1",
+ },
+ });
+
+ const url = lastFetchUrl();
+ expect(url.searchParams.get("filter[scan__in]")).toBe("scan-1,scan-2");
+ expect(url.searchParams.get("filter[provider_type__in]")).toBe("aws,gcp");
+ expect(url.searchParams.get("filter[provider_id__in]")).toBe("prov-1");
+ expect(url.searchParams.get("filter[provider_groups__in]")).toBe("group-1");
+ expect(url.searchParams.has("filter[region__in]")).toBe(false);
+ });
+
+ it("wraps successful overview responses", async () => {
+ const payload = { data: { id: "csa_ccm_4.0" } };
+ handleApiResponseMock.mockResolvedValue(payload);
+
+ const result = await getCrossProviderComplianceOverview({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toEqual({ status: "success", response: payload });
+ });
+
+ it("returns the shared action error shape for payment-required responses", async () => {
+ fetchMock.mockResolvedValue(jsonResponse({ errors: [] }, 402));
+ handleApiResponseMock.mockResolvedValue({
+ error: "Payment required.",
+ status: 402,
+ });
+
+ const result = await getCrossProviderComplianceOverview({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toEqual({
+ status: "action-error",
+ result: { error: "Payment required.", status: 402 },
+ });
+ });
+
+ it("returns a load error when the network call throws", async () => {
+ fetchMock.mockRejectedValue(new Error("boom"));
+
+ const result = await getCrossProviderComplianceOverview({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toEqual({
+ status: "load-error",
+ message:
+ "Could not load cross-provider compliance data. Try again later.",
+ });
+ });
+});
+
+describe("generateCrossProviderPdf", () => {
+ it("POSTs pdf with filters and an optional report name", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse({ data: { type: "tasks", id: "task-1" } }, 202),
+ );
+
+ const result = await generateCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ filters: { scanIds: ["scan-1"], providerTypes: "aws" },
+ reportName: "quarterly.pdf",
+ });
+
+ expect(result).toEqual({ taskId: "task-1" });
+ const call = fetchMock.mock.calls.at(-1);
+ expect((call?.[1] as RequestInit).method).toBe("POST");
+ const url = lastFetchUrl();
+ expect(url.pathname).toBe(
+ "/api/v1/cross-provider-compliance-overviews/pdf",
+ );
+ expect(url.searchParams.get("filter[compliance_id]")).toBe("csa_ccm_4.0");
+ expect(url.searchParams.get("filter[scan__in]")).toBe("scan-1");
+ expect(url.searchParams.get("filter[provider_type__in]")).toBe("aws");
+ expect(url.searchParams.get("report_name")).toBe("quarterly.pdf");
+ expect(url.searchParams.has("only_failed")).toBe(false);
+ expect(url.searchParams.has("include_manual")).toBe(false);
+ });
+
+ it("omits the optional report name when not provided", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse({ data: { type: "tasks", id: "task-1" } }, 202),
+ );
+
+ await generateCrossProviderPdf({ complianceId: "csa_ccm_4.0" });
+
+ const url = lastFetchUrl();
+ expect(url.searchParams.has("report_name")).toBe(false);
+ });
+
+ it("returns the API error detail when generation fails", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse({ errors: [{ detail: "No compatible scans." }] }, 422),
+ );
+
+ const result = await generateCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toEqual({ error: "No compatible scans." });
+ });
+
+ it("reports 5xx failures to Sentry with the static route template only", async () => {
+ fetchMock.mockResolvedValue(jsonResponse({}, 500));
+
+ const result = await generateCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ reportName: "secret-name.pdf",
+ });
+
+ expect(result).toEqual({ error: "Generic server error." });
+ expect(captureExceptionMock).toHaveBeenCalledTimes(1);
+ const serialized = JSON.stringify(captureExceptionMock.mock.calls[0]);
+ expect(serialized).toContain("cross-provider-compliance-overviews/pdf");
+ expect(serialized).not.toContain("secret-name");
+ });
+
+ it("falls back to the static message for text/html error pages", async () => {
+ // A proxy/gateway error page must not be parsed as JSON.
+ fetchMock.mockResolvedValue(
+ new Response("<html>Bad Gateway</html>", {
+ status: 422,
+ headers: { "Content-Type": "text/html" },
+ }),
+ );
+
+ const result = await generateCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toEqual({
+ error:
+ "Unable to start PDF generation. Contact support if the issue continues.",
+ });
+ });
+});
+
+describe("getCrossProviderPdfBinary", () => {
+ it("returns pending state on 202", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse(
+ { data: { id: "task-1", attributes: { state: "executing" } } },
+ 202,
+ ),
+ );
+
+ const result = await getCrossProviderPdfBinary("task-1");
+
+ expect(result).toEqual({
+ pending: true,
+ state: "executing",
+ taskId: "task-1",
+ });
+ expect(lastFetchUrl().pathname).toBe(
+ "/api/v1/cross-provider-compliance-overviews/pdf/task-1",
+ );
+ });
+
+ it("returns the binary as base64 with the content-disposition filename", async () => {
+ fetchMock.mockResolvedValue(
+ new Response(Buffer.from("pdf-bytes"), {
+ status: 200,
+ headers: {
+ "Content-Type": "application/pdf",
+ "Content-Disposition": 'attachment; filename="csa-report.pdf"',
+ },
+ }),
+ );
+
+ const result = await getCrossProviderPdfBinary("task-1");
+
+ expect(result).toEqual({
+ success: true,
+ data: Buffer.from("pdf-bytes").toString("base64"),
+ filename: "csa-report.pdf",
+ });
+ });
+
+ it("rejects task ids that could smuggle path segments, without fetching", async () => {
+ const result = await getCrossProviderPdfBinary("../../../etc/passwd");
+
+ expect(result).toEqual({ error: "Invalid task identifier." });
+ expect(fetchMock).not.toHaveBeenCalled();
+ });
+
+ it("returns the API error detail on failure", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse({ errors: [{ detail: "Report expired." }] }, 410),
+ );
+
+ const result = await getCrossProviderPdfBinary("task-1");
+
+ expect(result).toEqual({ error: "Report expired." });
+ });
+
+ it("reports 5xx failures to Sentry", async () => {
+ fetchMock.mockResolvedValue(jsonResponse({}, 500));
+
+ const result = await getCrossProviderPdfBinary("task-1");
+
+ expect(result).toEqual({ error: "Generic server error." });
+ expect(captureExceptionMock).toHaveBeenCalledTimes(1);
+ const serialized = JSON.stringify(captureExceptionMock.mock.calls[0]);
+ expect(serialized).toContain("pdf/{taskId}");
+ });
+});
+
+describe("getLatestCrossProviderPdf", () => {
+ it("returns the report descriptor when a matching report exists", async () => {
+ fetchMock.mockResolvedValue(
+ jsonResponse({
+ data: {
+ type: "tasks",
+ id: "task-9",
+ attributes: {
+ completed_at: "2026-07-01T10:00:00Z",
+ result: { filename: "csa-latest.pdf" },
+ },
+ },
+ }),
+ );
+
+ const result = await getLatestCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ filters: { scanIds: ["scan-1"] },
+ });
+
+ expect(result).toEqual({
+ taskId: "task-9",
+ filename: "csa-latest.pdf",
+ completedAt: "2026-07-01T10:00:00Z",
+ });
+ const url = lastFetchUrl();
+ expect(url.pathname).toBe(
+ "/api/v1/cross-provider-compliance-overviews/pdf/latest",
+ );
+ expect(url.searchParams.get("filter[scan__in]")).toBe("scan-1");
+ });
+
+ it("returns null when no report has been generated yet (404)", async () => {
+ fetchMock.mockResolvedValue(jsonResponse({ errors: [] }, 404));
+
+ const result = await getLatestCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toBeNull();
+ });
+
+ it("degrades to null on 5xx but still reports to Sentry", async () => {
+ const consoleErrorSpy = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ fetchMock.mockResolvedValue(jsonResponse({}, 500));
+
+ const result = await getLatestCrossProviderPdf({
+ complianceId: "csa_ccm_4.0",
+ });
+
+ expect(result).toBeNull();
+ expect(captureExceptionMock).toHaveBeenCalledTimes(1);
+ const serialized = JSON.stringify(captureExceptionMock.mock.calls[0]);
+ expect(serialized).toContain("pdf/latest");
+
+ consoleErrorSpy.mockRestore();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_actions/cross-provider.ts b/ui/app/(prowler)/compliance/_actions/cross-provider.ts
new file mode 100644
index 0000000000..eacdc29fde
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_actions/cross-provider.ts
@@ -0,0 +1,315 @@
+"use server";
+
+import * as Sentry from "@sentry/nextjs";
+
+import type { ScanBinaryResult } from "@/actions/scans/scans";
+import {
+ apiBaseUrl,
+ GENERIC_SERVER_ERROR_MESSAGE,
+ getAuthHeaders,
+ getErrorMessage,
+} from "@/lib";
+import { hasActionError } from "@/lib/action-errors";
+import { handleApiResponse } from "@/lib/server-actions-helper";
+import { SentryErrorSource, SentryErrorType } from "@/sentry";
+
+import type {
+ CrossProviderApiFilters,
+ CrossProviderOverviewResponse,
+ CrossProviderOverviewResult,
+ LatestCrossProviderPdf,
+} from "../_types";
+import {
+ CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
+ CROSS_PROVIDER_OVERVIEW_RESULT_STATUS,
+} from "../_types";
+
+const CROSS_PROVIDER_API_PATH = "/cross-provider-compliance-overviews";
+
+/** Error payload shapes the PDF endpoints emit (JSON:API or plain). */
+interface PdfEndpointErrorBody {
+ errors?: Array<{ detail?: string }>;
+ error?: string;
+ message?: string;
+}
+
+/**
+ * Extracts a user-safe message from a failed PDF endpoint response and, for
+ * unexpected failures, reports it to Sentry. `operation` must be a STATIC
+ * route template (e.g. `GET .../pdf/{taskId}`) — never the
+ * resolved URL, which would carry the task id or a user-typed report name.
+ */
+const getPdfEndpointErrorMessage = async (
+ response: Response,
+ fallbackMessage: string,
+ operation: string,
+): Promise<string> => {
+ const contentType = response.headers.get("content-type")?.toLowerCase() || "";
+ const errorData: PdfEndpointErrorBody | null = contentType.includes(
+ "text/html",
+ )
+ ? null
+ : await response.json().catch(() => null);
+
+ // These endpoints bypass handleApiResponse (binary/task protocol), so
+ // server failures would otherwise go unmonitored.
+ if (response.status >= 500) {
+ Sentry.captureException(
+ new Error(
+ `Cross-provider PDF request failed (${response.status}) at ${operation}`,
+ ),
+ {
+ tags: {
+ api_error: true,
+ status_code: response.status.toString(),
+ error_type: SentryErrorType.SERVER_ERROR,
+ error_source: SentryErrorSource.SERVER_ACTION,
+ },
+ level: "error",
+ contexts: {
+ api_response: {
+ status: response.status,
+ statusText: response.statusText,
+ operation,
+ },
+ },
+ },
+ );
+ return GENERIC_SERVER_ERROR_MESSAGE;
+ }
+
+ return (
+ errorData?.errors?.[0]?.detail ||
+ errorData?.error ||
+ errorData?.message ||
+ fallbackMessage
+ );
+};
+
+/** Appends the shared cross-provider filter params to a request URL. */
+const applyFilters = (url: URL, filters?: CrossProviderApiFilters) => {
+ if (!filters) return;
+
+ if (filters.scanIds && filters.scanIds.length > 0) {
+ url.searchParams.set("filter[scan__in]", filters.scanIds.join(","));
+ }
+
+ const paramMap = {
+ "filter[provider_type__in]": filters.providerTypes,
+ "filter[provider_id__in]": filters.providerIds,
+ "filter[provider_groups__in]": filters.providerGroups,
+ };
+ for (const [key, value] of Object.entries(paramMap)) {
+ if (value && value.trim().length > 0) {
+ url.searchParams.set(key, value);
+ }
+ }
+};
+
+/**
+ * Aggregate a universal compliance framework across one scan per compatible
+ * provider (Prowler Cloud only — the OSS API has no such endpoint).
+ *
+ * When `filters.scanIds` is omitted the API auto-selects the latest COMPLETED
+ * scan per compatible provider. Non-2xx responses are returned as structured
+ * action errors so callers can reuse the app-wide 402/403 handlers.
+ */
+export const getCrossProviderComplianceOverview = async ({
+ complianceId,
+ filters,
+}: {
+ complianceId: string;
+ filters?: CrossProviderApiFilters;
+}): Promise<CrossProviderOverviewResult> => {
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}`);
+ url.searchParams.set("filter[compliance_id]", complianceId);
+ applyFilters(url, filters);
+
+ try {
+ const response = await fetch(url.toString(), { headers });
+ const responseData = await handleApiResponse(response);
+
+ if (hasActionError(responseData)) {
+ return {
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR,
+ result: responseData,
+ };
+ }
+
+ return {
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.SUCCESS,
+ response: responseData as CrossProviderOverviewResponse,
+ };
+ } catch (error) {
+ console.error("Error fetching cross-provider compliance overview:", error);
+ return {
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR,
+ message: CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
+ };
+ }
+};
+
+/**
+ * Trigger ad-hoc generation of the combined cross-provider compliance PDF.
+ *
+ * The PDF is built asynchronously by a backend task: this returns the task id
+ * so the caller can poll it and then download via
+ * {@link getCrossProviderPdfBinary}. Pass the exact `scanIds` currently on
+ * screen (`attributes.scan_ids`) so the report matches the displayed data
+ * instead of re-resolving "latest scan per provider", which could race a scan
+ * completing in between.
+ */
+export const generateCrossProviderPdf = async ({
+ complianceId,
+ filters,
+ reportName,
+}: {
+ complianceId: string;
+ filters?: CrossProviderApiFilters;
+ /** Optional download filename; sanitized server-side. */
+ reportName?: string;
+}): Promise<{ taskId: string } | { error: string }> => {
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf`);
+ url.searchParams.set("filter[compliance_id]", complianceId);
+ applyFilters(url, filters);
+ if (reportName) url.searchParams.set("report_name", reportName);
+
+ try {
+ const response = await fetch(url.toString(), { method: "POST", headers });
+
+ if (!response.ok) {
+ throw new Error(
+ await getPdfEndpointErrorMessage(
+ response,
+ "Unable to start PDF generation. Contact support if the issue continues.",
+ `POST ${CROSS_PROVIDER_API_PATH}/pdf`,
+ ),
+ );
+ }
+
+ const json = await response.json();
+ const taskId = json?.data?.id;
+ if (!taskId) {
+ throw new Error("Unexpected response starting PDF generation.");
+ }
+
+ return { taskId };
+ } catch (error) {
+ return { error: getErrorMessage(error) };
+ }
+};
+
+/**
+ * Fetch the finished cross-provider PDF for a task started by
+ * {@link generateCrossProviderPdf}. Speaks the same 202-pending /
+ * 2xx-binary / error-JSON protocol as the per-scan report endpoints, so it
+ * returns the shared {@link ScanBinaryResult} shape and callers can reuse the
+ * existing download plumbing unchanged.
+ */
+export const getCrossProviderPdfBinary = async (
+ taskId: string,
+): Promise<ScanBinaryResult> => {
+ // The task id reaches the URL path: constrain it to the task-id charset
+ // (UUIDs) so a crafted value cannot smuggle `/`, `..` or a host.
+ const safeTaskId = taskId.trim();
+ if (!/^[A-Za-z0-9_-]+$/.test(safeTaskId)) {
+ return { error: "Invalid task identifier." };
+ }
+
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(
+ `${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf/${encodeURIComponent(safeTaskId)}`,
+ );
+
+ try {
+ const response = await fetch(url.toString(), { headers });
+
+ if (response.status === 202) {
+ const json = await response.json();
+ return {
+ pending: true,
+ state: json?.data?.attributes?.state,
+ taskId: json?.data?.id,
+ };
+ }
+
+ if (!response.ok) {
+ throw new Error(
+ await getPdfEndpointErrorMessage(
+ response,
+ "Unable to retrieve the compliance PDF report. Contact support if the issue continues.",
+ `GET ${CROSS_PROVIDER_API_PATH}/pdf/{taskId}`,
+ ),
+ );
+ }
+
+ const contentDisposition =
+ response.headers.get("content-disposition") || "";
+ const filenameMatch = contentDisposition.match(/filename="?([^";]+)"?/i);
+ const filename = filenameMatch?.[1] || "cross-provider-compliance.pdf";
+
+ const arrayBuffer = await response.arrayBuffer();
+ const base64 = Buffer.from(arrayBuffer).toString("base64");
+
+ return { success: true, data: base64, filename };
+ } catch (error) {
+ return { error: getErrorMessage(error) };
+ }
+};
+
+/**
+ * Check whether a cross-provider PDF already exists for the given filters so
+ * the UI can offer "Download" immediately instead of forcing a re-generate.
+ *
+ * 404 means "not generated yet" — a normal state, returned as `null` rather
+ * than an error. The backend only matches reports built from the exact scan
+ * set the filters resolve to, so a report goes stale (→ `null`) as soon as a
+ * contributing provider completes a new scan. Failures also degrade to
+ * `null`: this is an optional availability check and the caller's fallback
+ * (show "Generate") is always safe.
+ */
+export const getLatestCrossProviderPdf = async ({
+ complianceId,
+ filters,
+}: {
+ complianceId: string;
+ filters?: CrossProviderApiFilters;
+}): Promise<LatestCrossProviderPdf | null> => {
+ const headers = await getAuthHeaders({ contentType: false });
+ const url = new URL(`${apiBaseUrl}${CROSS_PROVIDER_API_PATH}/pdf/latest`);
+ url.searchParams.set("filter[compliance_id]", complianceId);
+ applyFilters(url, filters);
+
+ try {
+ const response = await fetch(url.toString(), { headers });
+
+ if (response.status === 404) return null;
+
+ if (!response.ok) {
+ throw new Error(
+ await getPdfEndpointErrorMessage(
+ response,
+ "Unable to check for an existing PDF report.",
+ `GET ${CROSS_PROVIDER_API_PATH}/pdf/latest`,
+ ),
+ );
+ }
+
+ const json = await response.json();
+ const taskId = json?.data?.id;
+ if (!taskId) return null;
+
+ return {
+ taskId,
+ filename: json?.data?.attributes?.result?.filename,
+ completedAt: json?.data?.attributes?.completed_at,
+ };
+ } catch (error) {
+ // Degraded on purpose, but logged: without this a systematically failing
+ // endpoint would be indistinguishable from "never generated".
+ console.error("Error checking for an existing cross-provider PDF:", error);
+ return null;
+ }
+};
diff --git a/ui/app/(prowler)/compliance/_components/compliance-page-tabs.shared.ts b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.shared.ts
new file mode 100644
index 0000000000..7cb6b8cb39
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.shared.ts
@@ -0,0 +1,17 @@
+import { COMPLIANCE_TAB, type ComplianceTab } from "../_types";
+
+function isComplianceTab(value: string): value is ComplianceTab {
+ return Object.values(COMPLIANCE_TAB).includes(value as ComplianceTab);
+}
+
+/** Resolves `?tab=` into a valid tab, defaulting to Per Scan so existing
+ * bookmarks (no query param) keep working. */
+function getComplianceTab(value: string | string[] | undefined): ComplianceTab {
+ if (typeof value !== "string") {
+ return COMPLIANCE_TAB.PER_SCAN;
+ }
+
+ return isComplianceTab(value) ? value : COMPLIANCE_TAB.PER_SCAN;
+}
+
+export { getComplianceTab };
diff --git a/ui/app/(prowler)/compliance/_components/compliance-page-tabs.test.tsx b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.test.tsx
new file mode 100644
index 0000000000..617d943030
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.test.tsx
@@ -0,0 +1,93 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { COMPLIANCE_TAB } from "../_types";
+import { CompliancePageTabs } from "./compliance-page-tabs";
+import { getComplianceTab } from "./compliance-page-tabs.shared";
+
+const { pushMock } = vi.hoisted(() => ({
+ pushMock: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ useRouter: () => ({
+ push: pushMock,
+ }),
+}));
+
+describe("getComplianceTab", () => {
+ it("falls back to per-scan for missing or invalid values", () => {
+ expect(getComplianceTab(undefined)).toBe(COMPLIANCE_TAB.PER_SCAN);
+ expect(getComplianceTab(["cross-provider"])).toBe(COMPLIANCE_TAB.PER_SCAN);
+ expect(getComplianceTab("bogus")).toBe(COMPLIANCE_TAB.PER_SCAN);
+ expect(getComplianceTab("cross-provider")).toBe(
+ COMPLIANCE_TAB.CROSS_PROVIDER,
+ );
+ });
+});
+
+describe("CompliancePageTabs", () => {
+ beforeEach(() => {
+ pushMock.mockClear();
+ });
+
+ afterEach(() => {
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+ });
+
+ it("navigates with ?tab=cross-provider and back to the bare route", async () => {
+ const user = userEvent.setup();
+ const { rerender } = render(
+ <CompliancePageTabs
+ activeTab={COMPLIANCE_TAB.PER_SCAN}
+ crossProviderEnabled
+ perScanContent={<div>Per scan content</div>}
+ crossProviderContent={<div>Cross provider content</div>}
+ />,
+ );
+
+ await user.click(screen.getByRole("tab", { name: /cross-provider/i }));
+ expect(pushMock).toHaveBeenCalledWith("/compliance?tab=cross-provider");
+
+ rerender(
+ <CompliancePageTabs
+ activeTab={COMPLIANCE_TAB.CROSS_PROVIDER}
+ crossProviderEnabled
+ perScanContent={<div>Per scan content</div>}
+ crossProviderContent={<div>Cross provider content</div>}
+ />,
+ );
+
+ await user.click(screen.getByRole("tab", { name: /per scan/i }));
+ expect(pushMock).toHaveBeenCalledWith("/compliance");
+ });
+
+ it("opens the cross-provider upgrade without changing tabs in Local Server", async () => {
+ const user = userEvent.setup();
+ render(
+ <CompliancePageTabs
+ activeTab={COMPLIANCE_TAB.PER_SCAN}
+ crossProviderEnabled={false}
+ perScanContent={<div>Per scan content</div>}
+ crossProviderContent={null}
+ />,
+ );
+
+ const crossProviderTab = screen.getByRole("tab", {
+ name: /cross-provider/i,
+ });
+ await user.click(crossProviderTab);
+
+ expect(crossProviderTab).not.toBeDisabled();
+ expect(crossProviderTab).toHaveAttribute("aria-selected", "false");
+ expect(screen.getByText("Cloud")).toBeVisible();
+ expect(pushMock).not.toHaveBeenCalled();
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE,
+ );
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx
new file mode 100644
index 0000000000..79e5d8af00
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/compliance-page-tabs.tsx
@@ -0,0 +1,88 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { ReactNode } from "react";
+
+import {
+ Badge,
+ Tabs,
+ TabsContent,
+ TabsList,
+ TabsTrigger,
+} from "@/components/shadcn";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { COMPLIANCE_TAB, type ComplianceTab } from "../_types";
+
+interface CompliancePageTabsProps {
+ activeTab: ComplianceTab;
+ /** False in OSS: the Cross-Provider tab renders disabled with the
+ * "Available in Prowler Cloud" upsell badge. */
+ crossProviderEnabled: boolean;
+ perScanContent: ReactNode;
+ crossProviderContent: ReactNode;
+}
+
+export const CompliancePageTabs = ({
+ activeTab,
+ crossProviderEnabled,
+ perScanContent,
+ crossProviderContent,
+}: CompliancePageTabsProps) => {
+ const router = useRouter();
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+
+ const handleTabChange = (tab: string) => {
+ const typedTab = tab as ComplianceTab;
+
+ if (typedTab === COMPLIANCE_TAB.CROSS_PROVIDER && !crossProviderEnabled) {
+ openCloudUpgrade(CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE);
+ return;
+ }
+
+ if (typedTab === activeTab) {
+ return;
+ }
+
+ // Per Scan renders without the query param so existing bookmarks and
+ // shared links keep resolving to the default view.
+ if (typedTab === COMPLIANCE_TAB.PER_SCAN) {
+ router.push("/compliance");
+ } else {
+ router.push(`/compliance?tab=${typedTab}`);
+ }
+ };
+
+ return (
+ // Same layout spacing as the scans view tabs (scans-page-shell.tsx).
+ <Tabs
+ value={activeTab}
+ onValueChange={handleTabChange}
+ className="flex flex-col gap-[18px]"
+ >
+ <TabsList className="overflow-x-auto">
+ <TabsTrigger value={COMPLIANCE_TAB.PER_SCAN}>Per Scan</TabsTrigger>
+ <TabsTrigger
+ value={COMPLIANCE_TAB.CROSS_PROVIDER}
+ adornment={
+ !crossProviderEnabled ? (
+ <Badge variant="cloud">Cloud</Badge>
+ ) : undefined
+ }
+ >
+ Cross-Provider
+ </TabsTrigger>
+ </TabsList>
+
+ <TabsContent value={COMPLIANCE_TAB.PER_SCAN}>
+ {perScanContent}
+ </TabsContent>
+ <TabsContent value={COMPLIANCE_TAB.CROSS_PROVIDER}>
+ {crossProviderContent}
+ </TabsContent>
+ </Tabs>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-detail.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-detail.tsx
new file mode 100644
index 0000000000..7972379b1f
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-detail.tsx
@@ -0,0 +1,241 @@
+import { Info } from "lucide-react";
+import Image from "next/image";
+
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
+import { getAllProviders } from "@/actions/providers";
+import {
+ ClientAccordionWrapper,
+ RequirementsStatusCard,
+ TopFailedSectionsCard,
+} from "@/components/compliance";
+import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
+import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import { Card } from "@/components/shadcn/card/card";
+import { getComplianceMapper } from "@/lib/compliance/compliance-mapper";
+import type { Framework, RequirementsTotals } from "@/types/compliance";
+
+import {
+ getCrossProviderComplianceOverview,
+ getLatestCrossProviderPdf,
+} from "../_actions/cross-provider";
+import { toCrossProviderAccordionItems } from "../_lib/cross-provider-accordion";
+import {
+ buildRequirementExtrasMap,
+ computeProviderBreakdown,
+ crossProviderToMapperInput,
+} from "../_lib/cross-provider-adapter";
+import {
+ CROSS_PROVIDER_FRAMEWORKS,
+ parseCrossProviderFilters,
+} from "../_lib/cross-provider-frameworks";
+import { CROSS_PROVIDER_OVERVIEW_RESULT_STATUS } from "../_types";
+import { CrossProviderErrorAlert } from "./cross-provider-error-alert";
+import type {
+ CrossProviderAccountOption,
+ CrossProviderGroupOption,
+} from "./cross-provider-filters";
+import { CrossProviderFilters } from "./cross-provider-filters";
+import { CrossProviderHubLink } from "./cross-provider-hub-link";
+import { CrossProviderPdfButton } from "./cross-provider-pdf-button";
+import { ProviderCoverageCard } from "./provider-coverage-card";
+
+interface CrossProviderDetailProps {
+ compliancetitle: string;
+ complianceId: string;
+ searchParams: Record<string, string | string[] | undefined>;
+ targetSection?: string;
+}
+
+/**
+ * Server island for the cross-provider detail (`?mode=cross-provider`):
+ * fetches the roll-up, funnels it through the real framework mapper via the
+ * adapter, and renders the same summary-charts + accordion layout as the
+ * per-scan detail with per-provider augmentations.
+ */
+export const CrossProviderDetail = async ({
+ compliancetitle,
+ complianceId,
+ searchParams,
+ targetSection,
+}: CrossProviderDetailProps) => {
+ const filters = parseCrossProviderFilters(searchParams);
+
+ const [overviewResponse, providersData, providerGroupsData] =
+ await Promise.all([
+ getCrossProviderComplianceOverview({ complianceId, filters }),
+ getAllProviders(),
+ getAllProviderGroups(),
+ ]);
+
+ if (
+ overviewResponse.status ===
+ CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR
+ ) {
+ return <CrossProviderErrorAlert result={overviewResponse.result} />;
+ }
+
+ if (
+ overviewResponse.status === CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR
+ ) {
+ return <CrossProviderErrorAlert message={overviewResponse.message} />;
+ }
+
+ const overviewData = overviewResponse.response.data;
+
+ if (!overviewData?.attributes) {
+ return (
+ <Alert variant="info">
+ <Info className="size-4" />
+ <AlertDescription>
+ No cross-provider compliance data was returned for this framework.
+ Universal frameworks aggregate the latest completed scan of every
+ compatible provider — run a scan to populate this view.
+ </AlertDescription>
+ </Alert>
+ );
+ }
+
+ const attrs = overviewData.attributes;
+
+ // Scoped to the EXACT scans the overview resolved (not the raw filters), so
+ // an offered "Download latest" always matches the data on screen even if a
+ // provider finished a new scan between the two calls. The overview
+ // aggregation dominates wall-clock; serializing this quick check is cheap.
+ const latestPdf = await getLatestCrossProviderPdf({
+ complianceId,
+ filters: { ...filters, scanIds: attrs.scan_ids },
+ });
+
+ const mapper = getComplianceMapper(attrs.framework);
+ const { attributesData, requirementsData } =
+ crossProviderToMapperInput(attrs);
+ const data = mapper.mapComplianceData(attributesData, requirementsData);
+ const extras = buildRequirementExtrasMap(attrs);
+ const providerBreakdown = computeProviderBreakdown(attrs);
+
+ const totals: RequirementsTotals = data.reduce(
+ (acc: RequirementsTotals, framework: Framework) => ({
+ pass: acc.pass + framework.pass,
+ fail: acc.fail + framework.fail,
+ manual: acc.manual + framework.manual,
+ }),
+ { pass: 0, fail: 0, manual: 0 },
+ );
+ const accordionItems = toCrossProviderAccordionItems(
+ data,
+ extras,
+ attrs.framework,
+ );
+ const topFailedResult = mapper.getTopFailedSections(data);
+
+ // Same `${framework.name}-${category.name}` key scheme as the per-scan
+ // detail, so ?section= deep links (e.g. from Top Failed Sections) work.
+ const initialExpandedKeys: string[] = [];
+ if (targetSection) {
+ const candidates = new Set(
+ data.map((framework: Framework) => `${framework.name}-${targetSection}`),
+ );
+ const match = accordionItems.find((item) => candidates.has(item.key));
+ if (match) {
+ initialExpandedKeys.push(match.key);
+ }
+ }
+
+ const catalogEntry = CROSS_PROVIDER_FRAMEWORKS.find(
+ (entry) => entry.complianceId === complianceId,
+ );
+ const compatibleTypes =
+ catalogEntry?.compatibleProviders ??
+ providerBreakdown.map((b) => b.provider);
+ const logoPath = getComplianceIcon(compliancetitle);
+
+ const providerAccounts: CrossProviderAccountOption[] = (
+ providersData?.data || []
+ )
+ .filter((provider) =>
+ compatibleTypes.some((type) => type === provider.attributes.provider),
+ )
+ .map((provider) => ({
+ id: provider.id,
+ label: provider.attributes.alias
+ ? `${provider.attributes.alias} (${provider.attributes.uid})`
+ : provider.attributes.uid,
+ type: provider.attributes.provider,
+ }));
+
+ const providerGroups: CrossProviderGroupOption[] = (
+ providerGroupsData?.data || []
+ ).map((group) => ({ id: group.id, name: group.attributes.name }));
+
+ return (
+ <div className="flex flex-col gap-8">
+ {/* Header card — same structure as the per-scan detail: identity row
+ (logo + context) with the report action top-right, filters below
+ (lighthouse-settings card pattern). */}
+ <Card variant="base" className="w-full gap-4 p-4 md:p-5">
+ <div className="flex w-full flex-col gap-4">
+ <div className="flex w-full items-center justify-between gap-4">
+ <div className="flex min-w-0 items-center gap-4">
+ {logoPath && (
+ <div className="relative h-12 w-12 shrink-0">
+ <Image
+ src={logoPath}
+ alt={`${compliancetitle} logo`}
+ fill
+ className="rounded-lg border border-gray-300 bg-white object-contain p-0"
+ />
+ </div>
+ )}
+ <div className="flex min-w-0 flex-col gap-0.5">
+ <div className="flex min-w-0 items-center gap-2">
+ <span className="truncate text-sm font-medium">
+ {attrs.name || compliancetitle.split("-").join(" ")}
+ </span>
+ <CrossProviderHubLink complianceId={complianceId} />
+ </div>
+ <p className="text-text-neutral-tertiary text-xs">
+ {attrs.providers.length} of {compatibleTypes.length}{" "}
+ compatible providers scanned · {attrs.scan_ids.length}{" "}
+ {attrs.scan_ids.length === 1 ? "scan" : "scans"} aggregated
+ </p>
+ </div>
+ </div>
+ <div className="shrink-0">
+ <CrossProviderPdfButton
+ complianceId={complianceId}
+ filters={{ ...filters, scanIds: attrs.scan_ids }}
+ latestPdf={latestPdf}
+ />
+ </div>
+ </div>
+
+ <CrossProviderFilters
+ providerTypes={compatibleTypes}
+ providerAccounts={providerAccounts}
+ providerGroups={providerGroups}
+ />
+ </div>
+ </Card>
+
+ <div className="grid grid-cols-1 gap-6 md:grid-cols-2 xl:grid-cols-[minmax(280px,400px)_minmax(280px,360px)_1fr]">
+ <RequirementsStatusCard
+ pass={totals.pass}
+ fail={totals.fail}
+ manual={totals.manual}
+ />
+ <ProviderCoverageCard breakdown={providerBreakdown} />
+ <TopFailedSectionsCard
+ sections={topFailedResult.items}
+ dataType={topFailedResult.type}
+ prepopulated={topFailedResult.prepopulated}
+ />
+ </div>
+
+ <ClientAccordionWrapper
+ items={accordionItems}
+ defaultExpandedKeys={initialExpandedKeys}
+ scrollToKey={initialExpandedKeys[0]}
+ />
+ </div>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-error-alert.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-error-alert.tsx
new file mode 100644
index 0000000000..d692ea14b9
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-error-alert.tsx
@@ -0,0 +1,38 @@
+import { AlertTriangle } from "lucide-react";
+
+import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import { UsageLimitMessage } from "@/components/shared/usage-limit-message";
+import {
+ ACTION_ERROR_STATUS,
+ type ActionErrorResult,
+ getActionErrorMessage,
+} from "@/lib/action-errors";
+
+import { CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE } from "../_types";
+
+interface CrossProviderErrorAlertProps {
+ result?: ActionErrorResult;
+ message?: string;
+}
+
+export const CrossProviderErrorAlert = ({
+ result,
+ message = CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
+}: CrossProviderErrorAlertProps) => {
+ const isUsageLimit = result?.status === ACTION_ERROR_STATUS.PAYMENT_REQUIRED;
+
+ return (
+ <Alert variant="error">
+ <AlertTriangle className="size-4" />
+ <AlertDescription>
+ {isUsageLimit ? (
+ <UsageLimitMessage />
+ ) : result ? (
+ getActionErrorMessage(result, { fallback: message })
+ ) : (
+ message
+ )}
+ </AlertDescription>
+ </Alert>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-filters.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-filters.test.tsx
new file mode 100644
index 0000000000..6c27fbed74
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-filters.test.tsx
@@ -0,0 +1,72 @@
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+import { CrossProviderFilters } from "./cross-provider-filters";
+
+vi.mock("next/navigation", () => ({
+ useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("@/hooks/use-url-filters", () => ({
+ useUrlFilters: () => ({ updateFilter: vi.fn() }),
+}));
+
+vi.mock("@/components/filters/clear-filters-button", () => ({
+ ClearFiltersButton: () => <button>Clear filters</button>,
+}));
+
+vi.mock("@/components/shadcn/select/multiselect", () => ({
+ MultiSelect: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ MultiSelectTrigger: ({
+ children,
+ ...props
+ }: {
+ children: ReactNode;
+ "aria-label"?: string;
+ }) => (
+ <button role="combobox" {...props}>
+ {children}
+ </button>
+ ),
+ MultiSelectValue: ({ placeholder }: { placeholder: string }) => (
+ <span>{placeholder}</span>
+ ),
+ MultiSelectContent: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ MultiSelectItem: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ MultiSelectSelectAll: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ MultiSelectSeparator: () => <hr />,
+}));
+
+describe("CrossProviderFilters", () => {
+ it("shows only the three cross-provider filters with product copy", () => {
+ // Given / When
+ render(
+ <CrossProviderFilters
+ providerTypes={["aws", "azure"]}
+ providerAccounts={[
+ { id: "provider-1", label: "Production", type: "aws" },
+ ]}
+ providerGroups={[{ id: "group-1", name: "Critical" }]}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("combobox", { name: "Provider type" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("combobox", { name: "Providers" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("combobox", { name: "Provider group" }),
+ ).toBeInTheDocument();
+ expect(screen.getAllByRole("combobox")).toHaveLength(3);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx
new file mode 100644
index 0000000000..44c477837b
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-filters.tsx
@@ -0,0 +1,119 @@
+"use client";
+
+import { useSearchParams } from "next/navigation";
+
+import { ClearFiltersButton } from "@/components/filters/clear-filters-button";
+import {
+ MultiSelect,
+ MultiSelectContent,
+ MultiSelectItem,
+ MultiSelectSelectAll,
+ MultiSelectSeparator,
+ MultiSelectTrigger,
+ MultiSelectValue,
+} from "@/components/shadcn/select/multiselect";
+import { useUrlFilters } from "@/hooks/use-url-filters";
+import {
+ type KnownProviderType,
+ PROVIDER_DISPLAY_NAMES,
+ type ProviderType,
+} from "@/types/providers";
+
+export interface CrossProviderAccountOption {
+ id: string;
+ label: string;
+ type: ProviderType;
+}
+
+export interface CrossProviderGroupOption {
+ id: string;
+ name: string;
+}
+
+interface CrossProviderFiltersProps {
+ /** Provider types offered by the visible universal frameworks. */
+ providerTypes: readonly KnownProviderType[];
+ providerAccounts: CrossProviderAccountOption[];
+ providerGroups: CrossProviderGroupOption[];
+}
+
+interface UrlMultiSelectOption {
+ value: string;
+ label: string;
+}
+
+interface UrlMultiSelectProps {
+ filterKey: string;
+ placeholder: string;
+ options: UrlMultiSelectOption[];
+}
+
+const UrlMultiSelect = ({
+ filterKey,
+ placeholder,
+ options,
+}: UrlMultiSelectProps) => {
+ const searchParams = useSearchParams();
+ const { updateFilter } = useUrlFilters();
+
+ const values =
+ searchParams.get(`filter[${filterKey}]`)?.split(",").filter(Boolean) ?? [];
+
+ return (
+ <div className="w-full sm:max-w-[280px] sm:min-w-[180px] sm:flex-1">
+ <MultiSelect
+ values={values}
+ onValuesChange={(nextValues) => updateFilter(filterKey, nextValues)}
+ >
+ <MultiSelectTrigger size="default" aria-label={placeholder}>
+ <MultiSelectValue placeholder={placeholder} />
+ </MultiSelectTrigger>
+ <MultiSelectContent search={options.length > 8} width="wide">
+ <MultiSelectSelectAll>Select All</MultiSelectSelectAll>
+ <MultiSelectSeparator />
+ {options.map((option) => (
+ <MultiSelectItem key={option.value} value={option.value}>
+ {option.label}
+ </MultiSelectItem>
+ ))}
+ </MultiSelectContent>
+ </MultiSelect>
+ </div>
+ );
+};
+
+export const CrossProviderFilters = ({
+ providerTypes,
+ providerAccounts,
+ providerGroups,
+}: CrossProviderFiltersProps) => {
+ return (
+ <div className="flex flex-wrap items-center gap-4">
+ <UrlMultiSelect
+ filterKey="provider_type__in"
+ placeholder="Provider type"
+ options={providerTypes.map((type) => ({
+ value: type,
+ label: PROVIDER_DISPLAY_NAMES[type],
+ }))}
+ />
+ <UrlMultiSelect
+ filterKey="provider_id__in"
+ placeholder="Providers"
+ options={providerAccounts.map((account) => ({
+ value: account.id,
+ label: account.label,
+ }))}
+ />
+ <UrlMultiSelect
+ filterKey="provider_groups__in"
+ placeholder="Provider group"
+ options={providerGroups.map((group) => ({
+ value: group.id,
+ label: group.name,
+ }))}
+ />
+ <ClearFiltersButton showCount />
+ </div>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-framework-card.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-framework-card.tsx
new file mode 100644
index 0000000000..65b87806e1
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-framework-card.tsx
@@ -0,0 +1,162 @@
+"use client";
+
+import Image from "next/image";
+import { useRouter, useSearchParams } from "next/navigation";
+
+import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
+import { Card, CardContent } from "@/components/shadcn/card/card";
+import { Progress } from "@/components/shadcn/progress";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import {
+ getScoreIndicatorClass,
+ type ScoreColorVariant,
+} from "@/lib/compliance/score-utils";
+import { cn } from "@/lib/utils";
+import { PROVIDER_DISPLAY_NAMES } from "@/types/providers";
+
+import { buildCrossProviderDetailHref } from "../_lib/cross-provider-frameworks";
+import type { CrossProviderFrameworkSummary } from "../_types";
+
+export const CrossProviderFrameworkCard = ({
+ complianceId,
+ title,
+ version,
+ description,
+ requirementsPassed,
+ requirementsFailed,
+ requirementsManual,
+ totalRequirements,
+ providerBreakdown,
+}: CrossProviderFrameworkSummary) => {
+ const router = useRouter();
+ const searchParams = useSearchParams();
+
+ const formattedTitle = `${title.split("-").join(" ")}${version ? ` - ${version}` : ""}`;
+
+ const ratingPercentage =
+ totalRequirements > 0
+ ? Math.floor((requirementsPassed / totalRequirements) * 100)
+ : 0;
+
+ // Same thresholds as the per-scan ComplianceCard.
+ const getRatingVariant = (value: number): ScoreColorVariant => {
+ if (value <= 10) return "danger";
+ if (value <= 40) return "warning";
+ return "success";
+ };
+
+ const navigateToDetail = () => {
+ router.push(
+ buildCrossProviderDetailHref(
+ { complianceId, title, version },
+ Object.fromEntries(searchParams.entries()),
+ ),
+ );
+ };
+
+ return (
+ <Card
+ variant="base"
+ padding="md"
+ className="relative cursor-pointer transition-shadow hover:shadow-md"
+ onClick={navigateToDetail}
+ role="button"
+ aria-label={formattedTitle}
+ tabIndex={0}
+ onKeyDown={(event) => {
+ if (event.key === "Enter" || event.key === " ") {
+ event.preventDefault();
+ navigateToDetail();
+ }
+ }}
+ >
+ <CardContent className="p-0">
+ <div className="flex w-full flex-col gap-3">
+ <div className="flex items-center gap-3">
+ {getComplianceIcon(title) && (
+ <div className="flex h-10 w-10 min-w-10 shrink-0 items-center justify-center rounded-md border border-gray-300 bg-white">
+ <Image
+ src={getComplianceIcon(title)}
+ alt={`${title} logo`}
+ width={32}
+ height={32}
+ className="h-8 w-8 object-contain"
+ />
+ </div>
+ )}
+ <div className="flex min-w-0 flex-1 flex-col">
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <h4 className="truncate text-sm leading-5 font-bold">
+ {formattedTitle}
+ </h4>
+ </TooltipTrigger>
+ <TooltipContent>{description}</TooltipContent>
+ </Tooltip>
+ <small className="truncate">
+ <span className="mr-1 text-xs font-semibold">
+ {requirementsPassed} / {totalRequirements}
+ </span>
+ Passing Requirements
+ </small>
+ </div>
+ </div>
+
+ <div className="flex flex-col gap-2">
+ <div className="flex items-center justify-between gap-3 text-xs">
+ <span className="text-text-neutral-secondary font-medium tracking-wider">
+ Score:
+ </span>
+ <span className="text-text-neutral-secondary">
+ {ratingPercentage}%
+ </span>
+ </div>
+ <Progress
+ aria-label="Cross-provider compliance score"
+ value={ratingPercentage}
+ className="border-border-neutral-secondary h-2.5 border drop-shadow-sm"
+ indicatorClassName={getScoreIndicatorClass(
+ getRatingVariant(ratingPercentage),
+ )}
+ />
+ </div>
+
+ <div className="flex items-center justify-between gap-3">
+ <div className="flex flex-wrap items-center gap-1.5">
+ {providerBreakdown.map((entry) => (
+ <Tooltip key={entry.provider}>
+ <TooltipTrigger asChild>
+ <span
+ data-testid={`provider-chip-${entry.provider}`}
+ data-unscanned={entry.unscanned || undefined}
+ className={cn(
+ "inline-flex items-center",
+ entry.unscanned && "opacity-35 grayscale",
+ )}
+ >
+ <ProviderTypeIcon type={entry.provider} size={18} />
+ </span>
+ </TooltipTrigger>
+ <TooltipContent>
+ {PROVIDER_DISPLAY_NAMES[entry.provider]}
+ {entry.unscanned
+ ? " — no completed scan yet"
+ : ` — ${entry.score}% passing`}
+ </TooltipContent>
+ </Tooltip>
+ ))}
+ </div>
+ <span className="text-text-neutral-secondary text-xs whitespace-nowrap">
+ {requirementsFailed} failed · {requirementsManual} manual
+ </span>
+ </div>
+ </div>
+ </CardContent>
+ </Card>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.test.tsx
new file mode 100644
index 0000000000..202a92eb28
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.test.tsx
@@ -0,0 +1,20 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { CrossProviderHubLink } from "./cross-provider-hub-link";
+
+describe("CrossProviderHubLink", () => {
+ it("opens the framework page in Prowler Hub safely", () => {
+ // Given / When
+ render(<CrossProviderHubLink complianceId="cis_controls_8.1" />);
+
+ // Then
+ const link = screen.getByRole("link", { name: /view on prowler hub/i });
+ expect(link).toHaveAttribute(
+ "href",
+ "https://hub.prowler.com/compliance/cis_controls_8.1",
+ );
+ expect(link).toHaveAttribute("target", "_blank");
+ expect(link).toHaveAttribute("rel", "noopener noreferrer");
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.tsx
new file mode 100644
index 0000000000..d531940fd1
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-hub-link.tsx
@@ -0,0 +1,24 @@
+import { SquareArrowOutUpRight } from "lucide-react";
+import Link from "next/link";
+
+import { Button } from "@/components/shadcn/button/button";
+
+interface CrossProviderHubLinkProps {
+ complianceId: string;
+}
+
+export const CrossProviderHubLink = ({
+ complianceId,
+}: CrossProviderHubLinkProps) => (
+ <Button variant="link" size="link-xs" asChild>
+ <Link
+ href={`https://hub.prowler.com/compliance/${encodeURIComponent(complianceId)}`}
+ target="_blank"
+ rel="noopener noreferrer"
+ prefetch={false}
+ >
+ View on Prowler Hub
+ <SquareArrowOutUpRight />
+ </Link>
+ </Button>
+);
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-overview.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-overview.test.tsx
new file mode 100644
index 0000000000..b2fb3b66f4
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-overview.test.tsx
@@ -0,0 +1,137 @@
+import { render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { ACTION_ERROR_STATUS, USAGE_LIMIT_MESSAGE } from "@/lib/action-errors";
+
+import { getCrossProviderComplianceOverview } from "../_actions/cross-provider";
+import { CROSS_PROVIDER_FRAMEWORKS } from "../_lib/cross-provider-frameworks";
+import type { CrossProviderOverviewResult } from "../_types";
+import {
+ CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
+ CROSS_PROVIDER_OVERVIEW_RESULT_STATUS,
+ CROSS_PROVIDER_OVERVIEW_TYPE,
+} from "../_types";
+import { CrossProviderOverview } from "./cross-provider-overview";
+
+vi.mock("../_actions/cross-provider", () => ({
+ getCrossProviderComplianceOverview: vi.fn(),
+}));
+
+vi.mock("@/actions/providers", () => ({
+ getAllProviders: vi.fn().mockResolvedValue({ data: [] }),
+}));
+
+vi.mock("@/actions/manage-groups/manage-groups", () => ({
+ getAllProviderGroups: vi.fn().mockResolvedValue({ data: [] }),
+}));
+
+vi.mock("./cross-provider-filters", () => ({
+ CrossProviderFilters: () => <div data-testid="cross-provider-filters" />,
+}));
+
+vi.mock("./cross-provider-framework-card", () => ({
+ CrossProviderFrameworkCard: ({ title }: { title: string }) => (
+ <div data-testid="framework-card">{title}</div>
+ ),
+}));
+
+const successResult = (complianceId: string): CrossProviderOverviewResult => ({
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.SUCCESS,
+ response: {
+ data: {
+ type: CROSS_PROVIDER_OVERVIEW_TYPE,
+ id: complianceId,
+ attributes: {
+ compliance_id: complianceId,
+ framework: complianceId,
+ name: complianceId,
+ version: "1.0",
+ description: "",
+ compatible_providers: ["aws"],
+ requested_providers: ["aws"],
+ providers: ["aws"],
+ scan_ids: [],
+ scan_ids_by_provider: {},
+ requirements_passed: 1,
+ requirements_failed: 0,
+ requirements_manual: 0,
+ total_requirements: 1,
+ requirements: [],
+ },
+ },
+ },
+});
+
+const loadErrorResult: CrossProviderOverviewResult = {
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR,
+ message: CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE,
+};
+
+const renderOverview = async () =>
+ render(await CrossProviderOverview({ searchParams: {} }));
+
+describe("CrossProviderOverview", () => {
+ beforeEach(() => {
+ vi.mocked(getCrossProviderComplianceOverview).mockReset();
+ });
+
+ it("degrades to a partial view when a single framework fails to load", async () => {
+ // Given: DORA fails, the other frameworks load
+ vi.mocked(getCrossProviderComplianceOverview).mockImplementation(
+ async ({ complianceId }) =>
+ complianceId === "dora_2022_2554"
+ ? loadErrorResult
+ : successResult(complianceId),
+ );
+
+ // When
+ await renderOverview();
+
+ // Then: loaded cards render, the failed framework is called out by name
+ expect(screen.getAllByTestId("framework-card")).toHaveLength(
+ CROSS_PROVIDER_FRAMEWORKS.length - 1,
+ );
+ expect(screen.getByText(/Could not load DORA/)).toBeInTheDocument();
+ expect(
+ screen.queryByText(CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE),
+ ).not.toBeInTheDocument();
+ });
+
+ it("replaces the tab with the error alert when every framework fails to load", async () => {
+ // Given
+ vi.mocked(getCrossProviderComplianceOverview).mockResolvedValue(
+ loadErrorResult,
+ );
+
+ // When
+ await renderOverview();
+
+ // Then
+ expect(
+ screen.getByText(CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE),
+ ).toBeInTheDocument();
+ expect(screen.queryByTestId("framework-card")).not.toBeInTheDocument();
+ });
+
+ it("gates the whole tab on an action error even if other frameworks loaded", async () => {
+ // Given: one framework hits the usage limit (402)
+ vi.mocked(getCrossProviderComplianceOverview).mockImplementation(
+ async ({ complianceId }) =>
+ complianceId === "dora_2022_2554"
+ ? {
+ status: CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR,
+ result: { status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED },
+ }
+ : successResult(complianceId),
+ );
+
+ // When
+ await renderOverview();
+
+ // Then
+ expect(
+ screen.getByText(new RegExp(USAGE_LIMIT_MESSAGE)),
+ ).toBeInTheDocument();
+ expect(screen.queryByTestId("framework-card")).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx
new file mode 100644
index 0000000000..17af2b38bf
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-overview.tsx
@@ -0,0 +1,189 @@
+import { AlertTriangle, Info } from "lucide-react";
+
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
+import { getAllProviders } from "@/actions/providers";
+import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import { SearchParamsProps } from "@/types";
+import type { KnownProviderType } from "@/types/providers";
+
+import { getCrossProviderComplianceOverview } from "../_actions/cross-provider";
+import { computeProviderBreakdown } from "../_lib/cross-provider-adapter";
+import {
+ CROSS_PROVIDER_FRAMEWORKS,
+ type CrossProviderFrameworkEntry,
+ parseCrossProviderFilters,
+} from "../_lib/cross-provider-frameworks";
+import type { CrossProviderFrameworkSummary } from "../_types";
+import { CROSS_PROVIDER_OVERVIEW_RESULT_STATUS } from "../_types";
+import { CrossProviderErrorAlert } from "./cross-provider-error-alert";
+import type {
+ CrossProviderAccountOption,
+ CrossProviderGroupOption,
+} from "./cross-provider-filters";
+import { CrossProviderFilters } from "./cross-provider-filters";
+import { CrossProviderFrameworkCard } from "./cross-provider-framework-card";
+
+/** Zero-state summary: the framework renders with every compatible provider
+ * chip dimmed when the API returned nothing usable (e.g. no scans yet). */
+const emptySummary = (
+ entry: CrossProviderFrameworkEntry,
+): CrossProviderFrameworkSummary => ({
+ complianceId: entry.complianceId,
+ title: entry.title,
+ version: entry.version,
+ description: entry.description,
+ requirementsPassed: 0,
+ requirementsFailed: 0,
+ requirementsManual: 0,
+ totalRequirements: 0,
+ providerBreakdown: entry.compatibleProviders.map((provider) => ({
+ provider,
+ pass: 0,
+ fail: 0,
+ manual: 0,
+ total: 0,
+ score: 0,
+ unscanned: true,
+ })),
+});
+
+/**
+ * Server island for the Cross-Provider tab: fetches the roll-up for every
+ * catalog framework in parallel and renders the filter row plus the cards
+ * grid. Rendered only in Prowler Cloud with the tab active, so OSS and the
+ * Per Scan tab never pay for these aggregation calls.
+ */
+export const CrossProviderOverview = async ({
+ searchParams,
+}: {
+ searchParams: SearchParamsProps;
+}) => {
+ const filters = parseCrossProviderFilters(searchParams);
+
+ const [responses, providersData, providerGroupsData] = await Promise.all([
+ Promise.all(
+ CROSS_PROVIDER_FRAMEWORKS.map((entry) =>
+ getCrossProviderComplianceOverview({
+ complianceId: entry.complianceId,
+ filters,
+ }).then((result) => ({ entry, result })),
+ ),
+ ),
+ getAllProviders(),
+ getAllProviderGroups(),
+ ]);
+
+ // Action errors (402 usage limit, 403) gate the whole feature, not one
+ // framework, so any of them replaces the tab instead of degrading it.
+ const actionError = responses.find(
+ ({ result }) =>
+ result.status === CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR,
+ );
+ if (
+ actionError?.result.status ===
+ CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR
+ ) {
+ return <CrossProviderErrorAlert result={actionError.result.result} />;
+ }
+
+ // Load errors are per-framework and often transient: degrade to a partial
+ // view with a warning, and only replace the tab when nothing loaded.
+ const loadErrors = responses.flatMap(({ entry, result }) =>
+ result.status === CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR
+ ? [{ entry, result }]
+ : [],
+ );
+ if (loadErrors.length === responses.length && loadErrors.length > 0) {
+ return <CrossProviderErrorAlert message={loadErrors[0].result.message} />;
+ }
+
+ const summaries: CrossProviderFrameworkSummary[] = responses
+ .filter(
+ ({ result }) =>
+ result.status !== CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR,
+ )
+ .map(({ entry, result }) => {
+ if (result.status !== CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.SUCCESS) {
+ return emptySummary(entry);
+ }
+
+ const data = result.response.data;
+ if (!data?.attributes) return emptySummary(entry);
+
+ const attrs = data.attributes;
+ return {
+ complianceId: entry.complianceId,
+ title: entry.title,
+ version: entry.version,
+ description: entry.description,
+ requirementsPassed: attrs.requirements_passed,
+ requirementsFailed: attrs.requirements_failed,
+ requirementsManual: attrs.requirements_manual,
+ totalRequirements: attrs.total_requirements,
+ providerBreakdown: computeProviderBreakdown(attrs),
+ };
+ });
+
+ const compatibleTypes = Array.from(
+ new Set<KnownProviderType>(
+ CROSS_PROVIDER_FRAMEWORKS.flatMap((entry) => entry.compatibleProviders),
+ ),
+ ).sort();
+
+ const providerAccounts: CrossProviderAccountOption[] = (
+ providersData?.data || []
+ )
+ .filter((provider) =>
+ compatibleTypes.some((type) => type === provider.attributes.provider),
+ )
+ .map((provider) => ({
+ id: provider.id,
+ label: provider.attributes.alias
+ ? `${provider.attributes.alias} (${provider.attributes.uid})`
+ : provider.attributes.uid,
+ type: provider.attributes.provider,
+ }));
+
+ const providerGroups: CrossProviderGroupOption[] = (
+ providerGroupsData?.data || []
+ ).map((group) => ({ id: group.id, name: group.attributes.name }));
+
+ return (
+ <div className="flex flex-col gap-6">
+ <CrossProviderFilters
+ providerTypes={compatibleTypes}
+ providerAccounts={providerAccounts}
+ providerGroups={providerGroups}
+ />
+
+ {loadErrors.length > 0 && (
+ <Alert variant="warning">
+ <AlertTriangle className="size-4" />
+ <AlertDescription>
+ Could not load{" "}
+ {loadErrors.map(({ entry }) => entry.title).join(", ")}. Showing the
+ frameworks that loaded — try again later.
+ </AlertDescription>
+ </Alert>
+ )}
+
+ {loadErrors.length === 0 &&
+ summaries.every((summary) => summary.totalRequirements === 0) && (
+ <Alert variant="info">
+ <Info className="size-4" />
+ <AlertDescription>
+ No cross-provider compliance data yet. Universal frameworks
+ aggregate the latest completed scan of every compatible provider —
+ run a scan to populate these cards.
+ </AlertDescription>
+ </Alert>
+ )}
+
+ <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 2xl:grid-cols-4">
+ {summaries.map((summary) => (
+ <CrossProviderFrameworkCard key={summary.complianceId} {...summary} />
+ ))}
+ </div>
+ </div>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx
new file mode 100644
index 0000000000..2f04c202db
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.test.tsx
@@ -0,0 +1,233 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { CrossProviderPdfButton } from "./cross-provider-pdf-button";
+
+// Radix dialogs/dropdowns rely on pointer-capture and scrollIntoView, which
+// jsdom does not implement.
+beforeAll(() => {
+ Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+ configurable: true,
+ value: vi.fn(() => false),
+ });
+ Object.defineProperty(HTMLElement.prototype, "setPointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+});
+
+const {
+ generatePdfMock,
+ trackAndPollMock,
+ downloadPdfMock,
+ toastMock,
+ storeState,
+} = vi.hoisted(() => ({
+ generatePdfMock: vi.fn(),
+ trackAndPollMock: vi.fn(),
+ downloadPdfMock: vi.fn(),
+ toastMock: vi.fn(),
+ storeState: {
+ tasks: {} as Record<
+ string,
+ {
+ taskId: string;
+ kind: string;
+ status: string;
+ meta: Record<string, string>;
+ startedAt: number;
+ }
+ >,
+ },
+}));
+
+vi.mock("../_actions/cross-provider", () => ({
+ generateCrossProviderPdf: generatePdfMock,
+}));
+
+vi.mock("../_lib/cross-provider-pdf", () => ({
+ CROSS_PROVIDER_PDF_TASK_KIND: "cross-provider-pdf",
+ buildCrossProviderPdfTaskScope: vi.fn(() => "scope-1"),
+ downloadCrossProviderPdf: downloadPdfMock,
+ crossProviderPdfHandler: { onReady: vi.fn(), onError: vi.fn() },
+}));
+
+vi.mock("@/store/task-watcher/store", () => ({
+ TASK_WATCHER_STATUS: { PENDING: "pending", READY: "ready", ERROR: "error" },
+ trackAndPollTask: trackAndPollMock,
+ useTaskWatcherStore: (selector: (state: typeof storeState) => unknown) =>
+ selector(storeState),
+}));
+
+vi.mock("@/components/shadcn/toast", () => ({
+ toast: toastMock,
+ ToastAction: () => null,
+}));
+
+const props = {
+ complianceId: "csa_ccm_4.0",
+ filters: { scanIds: ["scan-1"], providerTypes: "aws" },
+ latestPdf: null,
+};
+
+describe("CrossProviderPdfButton", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ storeState.tasks = {};
+ generatePdfMock.mockResolvedValue({ taskId: "task-1" });
+ });
+
+ const openGenerateModal = async (
+ user: ReturnType<typeof userEvent.setup>,
+ ) => {
+ await user.click(screen.getByRole("button", { name: /report/i }));
+ await user.click(
+ await screen.findByRole("menuitem", { name: /generate new report/i }),
+ );
+ };
+
+ it("generates a named report without unsupported requirement options", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<CrossProviderPdfButton {...props} />);
+
+ // When
+ await openGenerateModal(user);
+ await user.type(
+ screen.getByLabelText(/report name/i),
+ "quarterly-audit.pdf",
+ );
+ expect(screen.queryByLabelText(/only failed/i)).not.toBeInTheDocument();
+ expect(screen.queryByLabelText(/include manual/i)).not.toBeInTheDocument();
+ await user.click(screen.getByRole("button", { name: /^generate$/i }));
+
+ // Then
+ await waitFor(() => expect(generatePdfMock).toHaveBeenCalledTimes(1));
+ expect(generatePdfMock).toHaveBeenCalledWith({
+ complianceId: "csa_ccm_4.0",
+ filters: props.filters,
+ reportName: "quarterly-audit.pdf",
+ });
+ expect(trackAndPollMock).toHaveBeenCalledWith({
+ taskId: "task-1",
+ kind: "cross-provider-pdf",
+ meta: expect.objectContaining({ complianceId: "csa_ccm_4.0" }),
+ });
+ });
+
+ it("surfaces generation errors as a destructive toast without tracking", async () => {
+ generatePdfMock.mockResolvedValue({ error: "No compatible scans." });
+ const user = userEvent.setup();
+ render(<CrossProviderPdfButton {...props} />);
+
+ await openGenerateModal(user);
+ await user.click(screen.getByRole("button", { name: /^generate$/i }));
+
+ await waitFor(() =>
+ expect(toastMock).toHaveBeenCalledWith(
+ expect.objectContaining({ variant: "destructive" }),
+ ),
+ );
+ expect(trackAndPollMock).not.toHaveBeenCalled();
+ });
+
+ it("shows a generating state while a task for this framework is pending", () => {
+ storeState.tasks = {
+ "task-9": {
+ taskId: "task-9",
+ kind: "cross-provider-pdf",
+ status: "pending",
+ meta: { complianceId: "csa_ccm_4.0", scopeKey: "scope-1" },
+ startedAt: Date.now(),
+ },
+ };
+
+ render(<CrossProviderPdfButton {...props} />);
+
+ expect(screen.getByRole("button", { name: /generating/i })).toBeDisabled();
+ });
+
+ it("offers an instant download when a matching report already exists", async () => {
+ const user = userEvent.setup();
+ render(
+ <CrossProviderPdfButton
+ {...props}
+ latestPdf={{
+ taskId: "task-7",
+ filename: "csa-latest.pdf",
+ completedAt: "2026-07-01T10:00:00Z",
+ }}
+ />,
+ );
+
+ await user.click(screen.getByRole("button", { name: /report/i }));
+ await user.click(
+ await screen.findByRole("menuitem", { name: /download latest/i }),
+ );
+
+ await waitFor(() => expect(downloadPdfMock).toHaveBeenCalledWith("task-7"));
+ });
+
+ it("keeps a completed report downloadable after the ready toast closes", async () => {
+ // Given
+ storeState.tasks = {
+ "task-8": {
+ taskId: "task-8",
+ kind: "cross-provider-pdf",
+ status: "ready",
+ meta: {
+ complianceId: "csa_ccm_4.0",
+ scopeKey: "scope-1",
+ reportLabel: "quarterly-audit.pdf",
+ },
+ startedAt: Date.now(),
+ },
+ };
+ const user = userEvent.setup();
+ render(<CrossProviderPdfButton {...props} />);
+
+ // When
+ await user.click(screen.getByRole("button", { name: /report/i }));
+ await user.click(
+ await screen.findByRole("menuitem", { name: /download latest/i }),
+ );
+
+ // Then
+ await waitFor(() => expect(downloadPdfMock).toHaveBeenCalledWith("task-8"));
+ });
+
+ it("does not offer a completed report from a different filter scope", async () => {
+ // Given
+ storeState.tasks = {
+ "task-other-scope": {
+ taskId: "task-other-scope",
+ kind: "cross-provider-pdf",
+ status: "ready",
+ meta: {
+ complianceId: "csa_ccm_4.0",
+ scopeKey: "another-scope",
+ },
+ startedAt: Date.now(),
+ },
+ };
+ const user = userEvent.setup();
+ render(<CrossProviderPdfButton {...props} />);
+
+ // When
+ await user.click(screen.getByRole("button", { name: /report/i }));
+
+ // Then
+ expect(
+ screen.queryByRole("menuitem", { name: /download latest/i }),
+ ).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.tsx
new file mode 100644
index 0000000000..163ef91ed0
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-pdf-button.tsx
@@ -0,0 +1,208 @@
+"use client";
+
+import { ChevronDownIcon, DownloadIcon, FileTextIcon } from "lucide-react";
+import { useState } from "react";
+
+import { Button, Label } from "@/components/shadcn";
+import {
+ ActionDropdown,
+ ActionDropdownItem,
+} from "@/components/shadcn/dropdown";
+import { FormButtons } from "@/components/shadcn/form";
+import { Input } from "@/components/shadcn/input/input";
+import { Modal } from "@/components/shadcn/modal";
+import { toast } from "@/components/shadcn/toast";
+import {
+ TASK_WATCHER_STATUS,
+ trackAndPollTask,
+ useTaskWatcherStore,
+} from "@/store/task-watcher/store";
+
+import { generateCrossProviderPdf } from "../_actions/cross-provider";
+import {
+ buildCrossProviderPdfTaskScope,
+ CROSS_PROVIDER_PDF_TASK_KIND,
+ downloadCrossProviderPdf,
+} from "../_lib/cross-provider-pdf";
+import type {
+ CrossProviderApiFilters,
+ LatestCrossProviderPdf,
+} from "../_types";
+
+interface CrossProviderPdfButtonProps {
+ complianceId: string;
+ /** The filters (and exact scan ids) of the view currently on screen, so
+ * the generated PDF matches what the user is looking at. */
+ filters: CrossProviderApiFilters;
+ /** Already-generated report matching these filters, if any — offered as an
+ * instant download instead of forcing a re-generate. */
+ latestPdf: LatestCrossProviderPdf | null;
+}
+
+export const CrossProviderPdfButton = ({
+ complianceId,
+ filters,
+ latestPdf,
+}: CrossProviderPdfButtonProps) => {
+ const [dialogOpen, setDialogOpen] = useState(false);
+ const [reportName, setReportName] = useState("");
+ const [submitting, setSubmitting] = useState(false);
+ const taskScope = buildCrossProviderPdfTaskScope(complianceId, filters);
+
+ const isGenerating = useTaskWatcherStore((state) =>
+ Object.values(state.tasks).some(
+ (task) =>
+ task.kind === CROSS_PROVIDER_PDF_TASK_KIND &&
+ task.status === TASK_WATCHER_STATUS.PENDING &&
+ task.meta.scopeKey === taskScope,
+ ),
+ );
+ const completedTask = useTaskWatcherStore((state) =>
+ Object.values(state.tasks).reduce<(typeof state.tasks)[string] | undefined>(
+ (latest, task) => {
+ if (
+ task.kind !== CROSS_PROVIDER_PDF_TASK_KIND ||
+ task.status !== TASK_WATCHER_STATUS.READY ||
+ task.meta.scopeKey !== taskScope
+ ) {
+ return latest;
+ }
+
+ return !latest || task.startedAt > latest.startedAt ? task : latest;
+ },
+ undefined,
+ ),
+ );
+ const availablePdf: LatestCrossProviderPdf | null = completedTask
+ ? {
+ taskId: completedTask.taskId,
+ filename: completedTask.meta.reportLabel,
+ }
+ : latestPdf;
+
+ const handleGenerate = async () => {
+ setSubmitting(true);
+ try {
+ const result = await generateCrossProviderPdf({
+ complianceId,
+ filters,
+ reportName: reportName.trim() || undefined,
+ });
+
+ if ("error" in result) {
+ toast({
+ variant: "destructive",
+ title: "Could not start report generation",
+ description: result.error,
+ });
+ return;
+ }
+
+ setDialogOpen(false);
+ toast({
+ title: "Report generation started",
+ description:
+ "We'll let you know when the PDF is ready — you can keep working meanwhile.",
+ });
+ await trackAndPollTask({
+ taskId: result.taskId,
+ kind: CROSS_PROVIDER_PDF_TASK_KIND,
+ meta: {
+ complianceId,
+ scopeKey: taskScope,
+ ...(reportName.trim() ? { reportLabel: reportName.trim() } : {}),
+ },
+ });
+ } catch {
+ // The action returns {error} for API failures; this guards the
+ // server-action RPC itself (e.g. a network drop mid-request).
+ toast({
+ variant: "destructive",
+ title: "Could not start report generation",
+ description: "An unexpected error occurred. Please try again later.",
+ });
+ } finally {
+ setSubmitting(false);
+ }
+ };
+
+ const formatGeneratedAt = (completedAt?: string) => {
+ if (!completedAt) return "";
+ const date = new Date(completedAt);
+ return Number.isNaN(date.getTime())
+ ? ""
+ : ` (${date.toLocaleDateString()})`;
+ };
+
+ return (
+ <>
+ {/* Same trigger as the per-scan detail's export dropdown, so both
+ compliance headers expose one consistent "Report" action. */}
+ {isGenerating ? (
+ <Button variant="outline" disabled>
+ Generating report…
+ </Button>
+ ) : (
+ <ActionDropdown
+ variant="bordered"
+ ariaLabel="Compliance report actions"
+ trigger={
+ <Button variant="outline">
+ Report
+ <ChevronDownIcon />
+ </Button>
+ }
+ >
+ {availablePdf && (
+ <ActionDropdownItem
+ icon={<DownloadIcon />}
+ label={`Download latest${formatGeneratedAt(availablePdf.completedAt)}`}
+ description={availablePdf.filename}
+ onSelect={() => downloadCrossProviderPdf(availablePdf.taskId)}
+ />
+ )}
+ <ActionDropdownItem
+ icon={<FileTextIcon />}
+ label="Generate new report…"
+ onSelect={() => setDialogOpen(true)}
+ />
+ </ActionDropdown>
+ )}
+
+ <Modal
+ open={dialogOpen}
+ onOpenChange={setDialogOpen}
+ title="Generate Cross-Provider Report"
+ description="The report covers the providers, accounts and filters currently applied to this view."
+ size="xl"
+ >
+ <form
+ onSubmit={(event) => {
+ event.preventDefault();
+ handleGenerate();
+ }}
+ className="flex flex-col gap-6"
+ >
+ <div className="flex flex-col gap-4">
+ <div className="flex flex-col gap-2">
+ <Label htmlFor="cross-provider-report-name">Report name</Label>
+ <Input
+ id="cross-provider-report-name"
+ placeholder="Optional — a timestamped name is used by default"
+ value={reportName}
+ onChange={(event) => setReportName(event.target.value)}
+ />
+ </div>
+ </div>
+
+ <FormButtons
+ onCancel={() => setDialogOpen(false)}
+ submitText="Generate"
+ loadingText="Starting..."
+ isDisabled={submitting}
+ />
+ </form>
+ </Modal>
+ </>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.test.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.test.tsx
new file mode 100644
index 0000000000..98a9f11aab
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.test.tsx
@@ -0,0 +1,120 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import type { CheckProviderTypesMap, Requirement } from "@/types/compliance";
+
+import type { CrossProviderRequirementExtras } from "../_types";
+import { CrossProviderRequirementContent } from "./cross-provider-requirement-content";
+
+const { clientAccordionContentMock } = vi.hoisted(() => ({
+ clientAccordionContentMock: vi.fn(
+ ({
+ requirement,
+ scanIds,
+ }: {
+ requirement: Requirement;
+ scanIds: string[];
+ framework: string;
+ checkProviders: CheckProviderTypesMap;
+ disableFindings?: boolean;
+ }) => (
+ <div data-testid="findings-content">
+ {scanIds.join("|")}:{requirement.check_ids.join("|")}:
+ {requirement.status}
+ </div>
+ ),
+ ),
+}));
+
+// The real ClientAccordionContent drags the findings/server-action chain into
+// jsdom; its behavior has its own tests. Here we assert the combined-view
+// composition around it.
+vi.mock(
+ "@/components/compliance/compliance-accordion/client-accordion-content",
+ () => ({ ClientAccordionContent: clientAccordionContentMock }),
+);
+
+const mappedRequirement: Requirement = {
+ name: "A&A-01 - Audit and Assurance Policy and Procedures",
+ description: "Establish audit policies.",
+ status: "FAIL",
+ pass: 0,
+ fail: 1,
+ manual: 0,
+ check_ids: ["aws_check", "azure_check", "shared_check"],
+ scope_applicability: "IaaS",
+};
+
+const extras: CrossProviderRequirementExtras = {
+ requirementId: "A&A-01",
+ providers: { aws: "FAIL", azure: "PASS" },
+ checkIdsByProvider: {
+ aws: ["aws_check", "shared_check"],
+ azure: ["azure_check", "shared_check"],
+ },
+ scanIdsByProvider: {
+ aws: ["scan-aws-1", "scan-aws-2"],
+ azure: ["scan-azure-1"],
+ },
+};
+
+describe("CrossProviderRequirementContent", () => {
+ it("renders the requirement once with all contributing scans combined", () => {
+ clientAccordionContentMock.mockClear();
+ render(
+ <CrossProviderRequirementContent
+ requirement={mappedRequirement}
+ extras={extras}
+ framework="CSA-CCM"
+ />,
+ );
+
+ // One combined block — no per-provider sections repeating the detail.
+ expect(clientAccordionContentMock).toHaveBeenCalledTimes(1);
+ expect(screen.queryByText(/account 1 of/)).not.toBeInTheDocument();
+ expect(screen.getByTestId("findings-content")).toHaveTextContent(
+ "scan-aws-1|scan-aws-2|scan-azure-1:aws_check|azure_check|shared_check:FAIL",
+ );
+
+ // The mapped requirement passes through untouched (union checks,
+ // roll-up status, detail fields for getDetailsComponent).
+ const call = clientAccordionContentMock.mock.calls.at(-1)?.[0];
+ expect(call?.requirement).toBe(mappedRequirement);
+ expect(call?.framework).toBe("CSA-CCM");
+ expect(call?.disableFindings).toBe(false);
+ });
+
+ it("disables findings when no provider contributed any check", () => {
+ clientAccordionContentMock.mockClear();
+ render(
+ <CrossProviderRequirementContent
+ requirement={{ ...mappedRequirement, check_ids: [], status: "MANUAL" }}
+ extras={{
+ ...extras,
+ providers: { aws: "MANUAL", azure: "MANUAL" },
+ checkIdsByProvider: {},
+ }}
+ framework="CSA-CCM"
+ />,
+ );
+
+ const call = clientAccordionContentMock.mock.calls.at(-1)?.[0];
+ expect(call?.disableFindings).toBe(true);
+ });
+
+ it("shows an empty state when no provider scan contributed", () => {
+ clientAccordionContentMock.mockClear();
+ render(
+ <CrossProviderRequirementContent
+ requirement={mappedRequirement}
+ extras={{ ...extras, providers: {} }}
+ framework="CSA-CCM"
+ />,
+ );
+
+ expect(
+ screen.getByText(/No provider scan contributed/),
+ ).toBeInTheDocument();
+ expect(clientAccordionContentMock).not.toHaveBeenCalled();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.tsx b/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.tsx
new file mode 100644
index 0000000000..e0d05f8f4d
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/cross-provider-requirement-content.tsx
@@ -0,0 +1,58 @@
+"use client";
+
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import type { Requirement } from "@/types/compliance";
+import { PROVIDER_TYPES } from "@/types/providers";
+
+import { invertCheckIdsByProvider } from "../_lib/cross-provider-adapter";
+import type { CrossProviderRequirementExtras } from "../_types";
+
+interface CrossProviderRequirementContentProps {
+ /** The requirement as produced by the framework mapper (roll-up level). */
+ requirement: Requirement;
+ extras: CrossProviderRequirementExtras;
+ framework: string;
+}
+
+/**
+ * Combined findings view for a cross-provider requirement: the requirement
+ * detail rendered once, one checks list labeling each check with its provider
+ * types, and a single findings table querying every contributing scan at once
+ * (each row carries its own provider column). Mounts lazily — the requirement
+ * accordion unmounts collapsed content, so the combined fetch only fires on
+ * expand.
+ */
+export const CrossProviderRequirementContent = ({
+ requirement,
+ extras,
+ framework,
+}: CrossProviderRequirementContentProps) => {
+ const contributingTypes = PROVIDER_TYPES.filter(
+ (type) => extras.providers[type],
+ );
+
+ if (contributingTypes.length === 0) {
+ return (
+ <p className="text-sm">
+ No provider scan contributed to this requirement with the current
+ filters.
+ </p>
+ );
+ }
+
+ const scanIds = Array.from(
+ new Set(
+ contributingTypes.flatMap((type) => extras.scanIdsByProvider[type] ?? []),
+ ),
+ );
+
+ return (
+ <ClientAccordionContent
+ requirement={requirement}
+ scanIds={scanIds}
+ framework={framework}
+ checkProviders={invertCheckIdsByProvider(extras.checkIdsByProvider)}
+ disableFindings={requirement.check_ids.length === 0}
+ />
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/provider-coverage-card.test.tsx b/ui/app/(prowler)/compliance/_components/provider-coverage-card.test.tsx
new file mode 100644
index 0000000000..d1f73d264a
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/provider-coverage-card.test.tsx
@@ -0,0 +1,53 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import type { ProviderBreakdownEntry } from "../_types";
+import { ProviderCoverageCard } from "./provider-coverage-card";
+
+vi.mock("@/components/icons/providers-badge/provider-type-icon", () => ({
+ ProviderTypeIcon: () => <span aria-hidden="true" />,
+}));
+
+const scannedProvider: ProviderBreakdownEntry = {
+ provider: "aws",
+ pass: 8,
+ fail: 2,
+ manual: 1,
+ total: 11,
+ score: 80,
+ unscanned: false,
+};
+
+const unscannedProvider: ProviderBreakdownEntry = {
+ provider: "gcp",
+ pass: 0,
+ fail: 0,
+ manual: 0,
+ total: 0,
+ score: 0,
+ unscanned: true,
+};
+
+describe("ProviderCoverageCard", () => {
+ it("shows only providers that have a scan", () => {
+ // Given / When
+ render(
+ <ProviderCoverageCard breakdown={[scannedProvider, unscannedProvider]} />,
+ );
+
+ // Then
+ expect(screen.getByTestId("coverage-row-aws")).toBeInTheDocument();
+ expect(screen.queryByTestId("coverage-row-gcp")).not.toBeInTheDocument();
+ expect(screen.queryByText("No completed scan")).not.toBeInTheDocument();
+ });
+
+ it("shows an empty state when no provider has a scan", () => {
+ // Given / When
+ render(<ProviderCoverageCard breakdown={[unscannedProvider]} />);
+
+ // Then
+ expect(
+ screen.getByText("No scanned providers for this framework yet."),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_components/provider-coverage-card.tsx b/ui/app/(prowler)/compliance/_components/provider-coverage-card.tsx
new file mode 100644
index 0000000000..c6b6b9511c
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/provider-coverage-card.tsx
@@ -0,0 +1,72 @@
+"use client";
+
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
+import { Progress } from "@/components/shadcn/progress";
+import {
+ getScoreColor,
+ getScoreIndicatorClass,
+} from "@/lib/compliance/score-utils";
+import { PROVIDER_DISPLAY_NAMES } from "@/types/providers";
+
+import type { ProviderBreakdownEntry } from "../_types";
+
+interface ProviderCoverageCardProps {
+ breakdown: ProviderBreakdownEntry[];
+}
+
+/** Per-provider pass score for the cross-provider detail: one row per
+ * provider with a completed scan. */
+export const ProviderCoverageCard = ({
+ breakdown,
+}: ProviderCoverageCardProps) => {
+ const scannedProviders = breakdown.filter((entry) => !entry.unscanned);
+
+ return (
+ <Card variant="base" className="flex h-full min-h-[372px] flex-col">
+ <CardHeader>
+ <CardTitle>Provider Coverage</CardTitle>
+ </CardHeader>
+ {/* Capped + scrollable so a long provider list never stretches the
+ sibling chart cards in the same grid row. */}
+ <CardContent className="minimal-scrollbar flex max-h-[300px] flex-col gap-4 overflow-y-auto">
+ {scannedProviders.length === 0 && (
+ <p className="text-text-neutral-secondary text-sm">
+ No scanned providers for this framework yet.
+ </p>
+ )}
+ {scannedProviders.map((entry) => (
+ <div
+ key={entry.provider}
+ data-testid={`coverage-row-${entry.provider}`}
+ >
+ <div className="flex items-center justify-between gap-3 text-sm">
+ <span className="flex min-w-0 items-center gap-2">
+ <ProviderTypeIcon type={entry.provider} size={18} />
+ <span className="truncate">
+ {PROVIDER_DISPLAY_NAMES[entry.provider]}
+ </span>
+ </span>
+ <span className="text-text-neutral-secondary text-xs">
+ {entry.score}%
+ </span>
+ </div>
+ <div className="mt-1.5 flex items-center gap-3">
+ <Progress
+ aria-label={`${PROVIDER_DISPLAY_NAMES[entry.provider]} passing score`}
+ value={entry.score}
+ className="border-border-neutral-secondary h-2 border"
+ indicatorClassName={getScoreIndicatorClass(
+ getScoreColor(entry.score),
+ )}
+ />
+ <span className="text-text-neutral-tertiary text-xs whitespace-nowrap">
+ {entry.pass}/{entry.pass + entry.fail} · {entry.manual} manual
+ </span>
+ </div>
+ </div>
+ ))}
+ </CardContent>
+ </Card>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_components/requirement-provider-chips.tsx b/ui/app/(prowler)/compliance/_components/requirement-provider-chips.tsx
new file mode 100644
index 0000000000..02bd202088
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_components/requirement-provider-chips.tsx
@@ -0,0 +1,50 @@
+"use client";
+
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
+import {
+ type FindingStatus,
+ StatusFindingBadge,
+} from "@/components/shadcn/table/status-finding-badge";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { PROVIDER_DISPLAY_NAMES, PROVIDER_TYPES } from "@/types/providers";
+
+import type { ProviderStatusMap } from "../_types";
+
+interface RequirementProviderChipsProps {
+ providers: ProviderStatusMap;
+}
+
+/** Per-provider status chips shown next to a cross-provider requirement:
+ * each contributing provider's icon paired with its own PASS/FAIL/MANUAL. */
+export const RequirementProviderChips = ({
+ providers,
+}: RequirementProviderChipsProps) => {
+ // Iterate the canonical order so chips are stable across requirements.
+ const entries = PROVIDER_TYPES.filter((type) => providers[type]);
+
+ return (
+ <div className="flex flex-wrap items-center gap-2">
+ {entries.map((type) => (
+ <Tooltip key={type}>
+ <TooltipTrigger asChild>
+ <span
+ data-testid={`requirement-chip-${type}`}
+ className="inline-flex items-center gap-1"
+ >
+ <ProviderTypeIcon type={type} size={16} />
+ <StatusFindingBadge
+ status={providers[type] as FindingStatus}
+ size="sm"
+ />
+ </span>
+ </TooltipTrigger>
+ <TooltipContent>{PROVIDER_DISPLAY_NAMES[type]}</TooltipContent>
+ </Tooltip>
+ ))}
+ </div>
+ );
+};
diff --git a/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-accordion.test.tsx b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-accordion.test.tsx
new file mode 100644
index 0000000000..7f5e02ea27
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-accordion.test.tsx
@@ -0,0 +1,109 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import type { Framework } from "@/types/compliance";
+
+// The requirement content component drags the findings/server-action chain
+// into jsdom; assembly structure is what's under test here.
+vi.mock(
+ "@/components/compliance/compliance-accordion/client-accordion-content",
+ () => ({ ClientAccordionContent: () => null }),
+);
+// The section header reaches next-auth through the shadcn/table barrel
+// (data-table-pagination → @/lib). Same stub as compliance-mapper.test.ts.
+// The requirement title is rendered for real here — it only pulls the
+// leak-free status-finding-badge file + provider icons.
+vi.mock(
+ "@/components/compliance/compliance-accordion/compliance-accordion-title",
+ () => ({ ComplianceAccordionTitle: () => null }),
+);
+
+import type { CrossProviderRequirementExtras } from "../../_types";
+import { toCrossProviderAccordionItems } from "../cross-provider-accordion";
+
+const data: Framework[] = [
+ {
+ name: "CSA-CCM",
+ pass: 1,
+ fail: 1,
+ manual: 0,
+ categories: [
+ {
+ name: "Audit & Assurance",
+ pass: 1,
+ fail: 1,
+ manual: 0,
+ controls: [
+ {
+ label: "Audit & Assurance",
+ pass: 1,
+ fail: 1,
+ manual: 0,
+ requirements: [
+ {
+ name: "A&A-01 - Audit Policy",
+ description: "desc",
+ status: "FAIL",
+ pass: 0,
+ fail: 1,
+ manual: 0,
+ check_ids: ["check_a"],
+ },
+ {
+ name: "A&A-02 - Independent Assessments",
+ description: "desc",
+ status: "PASS",
+ pass: 1,
+ fail: 0,
+ manual: 0,
+ check_ids: [],
+ },
+ ],
+ },
+ ],
+ },
+ ],
+ },
+];
+
+const extras = new Map<string, CrossProviderRequirementExtras>([
+ [
+ "A&A-01 - Audit Policy",
+ {
+ requirementId: "A&A-01",
+ providers: { aws: "FAIL" },
+ checkIdsByProvider: { aws: ["check_a"] },
+ scanIdsByProvider: { aws: ["scan-1"] },
+ },
+ ],
+]);
+
+describe("toCrossProviderAccordionItems", () => {
+ const items = toCrossProviderAccordionItems(data, extras, "CSA-CCM");
+
+ it("keeps the per-scan accordion key scheme so ?section= deep links work", () => {
+ expect(items).toHaveLength(1);
+ expect(items[0].key).toBe("CSA-CCM-Audit & Assurance");
+ expect(items[0].items).toHaveLength(2);
+ });
+
+ it("shows the status only once via the provider chips (no duplicate roll-up badge)", () => {
+ // A&A-01 has a single provider (aws FAIL): its status must appear once,
+ // in the chip — not also as a separate roll-up badge.
+ const { unmount } = render(<>{items[0].items?.[0].title}</>);
+
+ expect(screen.getByText("A&A-01 - Audit Policy")).toBeInTheDocument();
+ expect(screen.getAllByText(/^fail$/i)).toHaveLength(1);
+ unmount();
+ });
+
+ it("falls back to a single roll-up badge when a requirement has no per-provider breakdown", () => {
+ // A&A-02 is absent from the extras map, so it keeps one roll-up status.
+ render(<>{items[0].items?.[1].title}</>);
+
+ expect(
+ screen.getByText("A&A-02 - Independent Assessments"),
+ ).toBeInTheDocument();
+ expect(screen.getAllByText(/^pass$/i)).toHaveLength(1);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-adapter.test.ts b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-adapter.test.ts
new file mode 100644
index 0000000000..7d2e7ba737
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-adapter.test.ts
@@ -0,0 +1,351 @@
+import { describe, expect, it, vi } from "vitest";
+
+// The mapper registry transitively imports the client accordion chain, which
+// pulls server-only code (next-auth → next/server) into vitest. Stub the JSX
+// leaves — mapComplianceData, the code under test here, never touches them.
+// Same approach as lib/compliance/compliance-mapper.test.ts.
+const { stubComponent } = vi.hoisted(() => ({
+ stubComponent: () => () => null,
+}));
+
+vi.mock(
+ "@/components/compliance/compliance-custom-details/asd-essential-eight-details",
+ () => ({ ASDEssentialEightCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/aws-well-architected-details",
+ () => ({ AWSWellArchitectedCustomDetails: stubComponent() }),
+);
+vi.mock("@/components/compliance/compliance-custom-details/c5-details", () => ({
+ C5CustomDetails: stubComponent(),
+}));
+vi.mock(
+ "@/components/compliance/compliance-custom-details/ccc-details",
+ () => ({ CCCCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/cis-details",
+ () => ({ CISCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/csa-details",
+ () => ({ CSACustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/ens-details",
+ () => ({ ENSCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/generic-details",
+ () => ({ GenericCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/iso-details",
+ () => ({ ISOCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/kisa-details",
+ () => ({ KISACustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/mitre-details",
+ () => ({ MITRECustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/threat-details",
+ () => ({ ThreatCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/okta-idaas-stig-details",
+ () => ({ OktaIDaaSStigCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/cis-controls-details",
+ () => ({ CISControlsCustomDetails: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-custom-details/dora-details",
+ () => ({ DORACustomDetails: stubComponent() }),
+);
+
+vi.mock(
+ "@/components/compliance/compliance-accordion/client-accordion-content",
+ () => ({ ClientAccordionContent: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title",
+ () => ({ ComplianceAccordionRequirementTitle: stubComponent() }),
+);
+vi.mock(
+ "@/components/compliance/compliance-accordion/compliance-accordion-title",
+ () => ({ ComplianceAccordionTitle: stubComponent() }),
+);
+
+import { getComplianceMapper } from "@/lib/compliance/compliance-mapper";
+import type { Framework, Requirement } from "@/types/compliance";
+
+import type {
+ CrossProviderOverviewAttributes,
+ CrossProviderRequirementData,
+} from "../../_types";
+import {
+ buildRequirementExtrasMap,
+ computeProviderBreakdown,
+ crossProviderToMapperInput,
+ invertCheckIdsByProvider,
+} from "../cross-provider-adapter";
+
+const buildAttributes = (
+ overrides: Partial<CrossProviderOverviewAttributes> & {
+ framework: string;
+ requirements: CrossProviderRequirementData[];
+ },
+): CrossProviderOverviewAttributes => ({
+ compliance_id: "test_1.0",
+ name: "Test Framework",
+ version: "1.0",
+ description: "Test description",
+ compatible_providers: ["aws", "azure", "gcp"],
+ requested_providers: ["aws", "azure"],
+ providers: ["aws", "azure"],
+ scan_ids: ["scan-aws-1", "scan-azure-1"],
+ scan_ids_by_provider: { aws: ["scan-aws-1"], azure: ["scan-azure-1"] },
+ requirements_passed: 0,
+ requirements_failed: 0,
+ requirements_manual: 0,
+ total_requirements: overrides.requirements.length,
+ ...overrides,
+});
+
+const csaAttributes = buildAttributes({
+ framework: "CSA-CCM",
+ requirements: [
+ {
+ id: "A&A-01",
+ name: "Audit and Assurance Policy and Procedures",
+ description: "Establish audit policies.",
+ attributes: {
+ Section: "Audit & Assurance",
+ CCMLite: "Yes",
+ IaaS: "Yes",
+ PaaS: "Yes",
+ SaaS: "Yes",
+ ScopeApplicability: "IaaS, PaaS, SaaS",
+ },
+ status: "FAIL",
+ providers: { aws: "FAIL", azure: "PASS" },
+ check_ids_by_provider: {
+ aws: ["iam_check_1", "shared_check"],
+ azure: ["entra_check_1", "shared_check"],
+ },
+ },
+ {
+ id: "A&A-02",
+ name: "Independent Assessments",
+ description: "Conduct independent audits.",
+ attributes: {
+ Section: "Audit & Assurance",
+ CCMLite: "No",
+ IaaS: "Yes",
+ PaaS: "No",
+ SaaS: "No",
+ ScopeApplicability: "IaaS",
+ },
+ status: "MANUAL",
+ providers: { aws: "MANUAL", azure: "MANUAL" },
+ check_ids_by_provider: {},
+ },
+ {
+ id: "DSP-01",
+ name: "Data Security Policies",
+ description: "Protect data.",
+ attributes: {
+ Section: "Data Security and Privacy Lifecycle Management",
+ CCMLite: "Yes",
+ IaaS: "Yes",
+ PaaS: "Yes",
+ SaaS: "Yes",
+ ScopeApplicability: "IaaS",
+ },
+ status: "PASS",
+ providers: { aws: "PASS" },
+ check_ids_by_provider: { aws: ["s3_check_1"] },
+ },
+ ],
+});
+
+const doraAttributes = buildAttributes({
+ framework: "DORA",
+ requirements: [
+ {
+ id: "RQ-01",
+ name: "ICT Risk Management",
+ description: "Manage ICT risk.",
+ attributes: {
+ Pillar: "ICT risk management",
+ Article: "Art. 5",
+ ArticleTitle: "Governance and organisation",
+ },
+ status: "FAIL",
+ providers: { aws: "FAIL", azure: "FAIL" },
+ check_ids_by_provider: { aws: ["check_a"], azure: ["check_b"] },
+ },
+ ],
+});
+
+const cisControlsAttributes = buildAttributes({
+ framework: "CIS-Controls",
+ requirements: [
+ {
+ id: "1.1",
+ name: "Establish and Maintain Detailed Enterprise Asset Inventory",
+ description: "Maintain an asset inventory.",
+ attributes: {
+ Section: "01 Inventory and Control of Enterprise Assets",
+ Function: "Identify",
+ AssetType: "Devices",
+ ImplementationGroups: ["IG1", "IG2", "IG3"],
+ },
+ status: "PASS",
+ providers: { aws: "PASS" },
+ check_ids_by_provider: { aws: ["ec2_check"] },
+ },
+ ],
+});
+
+const collectRequirements = (frameworks: Framework[]): Requirement[] =>
+ frameworks.flatMap((framework) =>
+ framework.categories.flatMap((category) =>
+ category.controls.flatMap((control) => control.requirements),
+ ),
+ );
+
+describe.each([
+ ["CSA-CCM", csaAttributes],
+ ["DORA", doraAttributes],
+ ["CIS-Controls", cisControlsAttributes],
+])("crossProviderToMapperInput through the real %s mapper", (key, attrs) => {
+ it("preserves the cross-provider requirement contract", () => {
+ const attributes = attrs as CrossProviderOverviewAttributes;
+ const mapper = getComplianceMapper(key);
+ const { attributesData, requirementsData } =
+ crossProviderToMapperInput(attributes);
+ const mapped = collectRequirements(
+ mapper.mapComplianceData(attributesData, requirementsData),
+ );
+ const extras = buildRequirementExtrasMap(attributes);
+ const statuses = Object.fromEntries(mapped.map((r) => [r.name, r.status]));
+
+ expect(mapped).toHaveLength(attributes.requirements.length);
+ for (const requirement of attributes.requirements) {
+ const composedName = `${requirement.id} - ${requirement.name}`;
+ const mappedRequirement = mapped.find((r) => r.name === composedName);
+ const expectedCheckIds = new Set(
+ Object.values(requirement.check_ids_by_provider ?? {}).flat(),
+ );
+
+ expect(statuses[composedName]).toBe(requirement.status);
+ expect(
+ extras.get(composedName),
+ `no extras for "${composedName}"`,
+ ).toBeDefined();
+ expect(extras.get(composedName)?.scanIdsByProvider).toEqual(
+ attributes.scan_ids_by_provider,
+ );
+ expect(new Set(mappedRequirement?.check_ids)).toEqual(expectedCheckIds);
+ expect(mappedRequirement?.check_ids).toHaveLength(expectedCheckIds.size);
+ }
+ });
+});
+
+describe("CSA grouping through the real mapper", () => {
+ it("groups requirements by Section into categories with correct counters", () => {
+ const mapper = getComplianceMapper("CSA-CCM");
+ const { attributesData, requirementsData } =
+ crossProviderToMapperInput(csaAttributes);
+ const [framework] = mapper.mapComplianceData(
+ attributesData,
+ requirementsData,
+ );
+
+ expect(framework.name).toBe("CSA-CCM");
+ expect(framework.categories.map((c) => c.name)).toEqual([
+ "Audit & Assurance",
+ "Data Security and Privacy Lifecycle Management",
+ ]);
+ expect(framework.pass).toBe(1);
+ expect(framework.fail).toBe(1);
+ expect(framework.manual).toBe(1);
+ });
+});
+
+describe("invertCheckIdsByProvider", () => {
+ it("maps exclusive and shared checks to their provider types", () => {
+ expect(
+ invertCheckIdsByProvider({
+ aws: ["shared_check", "iam_check_1"],
+ azure: ["shared_check"],
+ }),
+ ).toEqual({
+ shared_check: ["aws", "azure"],
+ iam_check_1: ["aws"],
+ });
+ });
+});
+
+describe("computeProviderBreakdown", () => {
+ it("tallies per-provider statuses and flags compatible-but-unscanned providers", () => {
+ const breakdown = computeProviderBreakdown(csaAttributes);
+
+ const aws = breakdown.find((entry) => entry.provider === "aws");
+ expect(aws).toEqual({
+ provider: "aws",
+ pass: 1,
+ fail: 1,
+ manual: 1,
+ total: 3,
+ score: 50,
+ unscanned: false,
+ });
+
+ const azure = breakdown.find((entry) => entry.provider === "azure");
+ expect(azure?.pass).toBe(1);
+ expect(azure?.fail).toBe(0);
+ expect(azure?.manual).toBe(1);
+ expect(azure?.score).toBe(100);
+
+ const gcp = breakdown.find((entry) => entry.provider === "gcp");
+ expect(gcp?.unscanned).toBe(true);
+ expect(gcp?.total).toBe(0);
+ });
+
+ it("lists scanned providers first, each group alphabetically", () => {
+ const breakdown = computeProviderBreakdown(
+ buildAttributes({
+ framework: "CSA-CCM",
+ compatible_providers: ["oraclecloud", "gcp", "azure", "aws"],
+ providers: ["gcp", "aws"],
+ requirements: [],
+ }),
+ );
+
+ expect(breakdown.map((entry) => entry.provider)).toEqual([
+ "aws",
+ "gcp",
+ "azure",
+ "oraclecloud",
+ ]);
+ });
+
+ it("ignores provider types the UI does not know", () => {
+ const breakdown = computeProviderBreakdown(
+ buildAttributes({
+ framework: "CSA-CCM",
+ compatible_providers: ["aws", "not-a-provider"],
+ requirements: [],
+ }),
+ );
+
+ expect(breakdown.map((entry) => entry.provider)).toEqual(["aws"]);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-frameworks.test.ts b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-frameworks.test.ts
new file mode 100644
index 0000000000..b087f6b99e
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-frameworks.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from "vitest";
+
+import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance";
+import { PROVIDER_TYPES } from "@/types/providers";
+
+import {
+ buildCrossProviderDetailHref,
+ CROSS_PROVIDER_FRAMEWORKS,
+ resolveCrossProviderFramework,
+} from "../cross-provider-frameworks";
+
+describe("CROSS_PROVIDER_FRAMEWORKS catalog", () => {
+ it("uses titles that resolve to a compliance icon", () => {
+ for (const entry of CROSS_PROVIDER_FRAMEWORKS) {
+ expect(getComplianceIcon(entry.title), entry.title).not.toBeNull();
+ }
+ });
+
+ it("only lists providers the UI knows how to render", () => {
+ for (const entry of CROSS_PROVIDER_FRAMEWORKS) {
+ for (const provider of entry.compatibleProviders) {
+ expect(PROVIDER_TYPES).toContain(provider);
+ }
+ expect(new Set(entry.compatibleProviders).size).toBe(
+ entry.compatibleProviders.length,
+ );
+ }
+ });
+});
+
+describe("resolveCrossProviderFramework", () => {
+ it.each([
+ [undefined, "CSA-CCM"],
+ ["csa_ccm_4.0", "DORA"],
+ ["csa_ccm_4.0", "csa-ccm"],
+ ])("rejects invalid detail links", (complianceId, title) => {
+ expect(resolveCrossProviderFramework(complianceId, title)).toBeUndefined();
+ });
+
+ it("resolves the catalog entry for a valid detail link", () => {
+ // Given
+ const expected = CROSS_PROVIDER_FRAMEWORKS[0];
+
+ // When
+ const framework = resolveCrossProviderFramework(
+ expected.complianceId,
+ expected.title,
+ );
+
+ // Then
+ expect(framework).toEqual(expected);
+ });
+});
+
+describe("buildCrossProviderDetailHref", () => {
+ const entry = CROSS_PROVIDER_FRAMEWORKS[0];
+
+ it("builds the detail path with cross-provider mode and identity params", () => {
+ const href = buildCrossProviderDetailHref(entry);
+
+ expect(href).toBe(
+ `/compliance/${encodeURIComponent(entry.title)}?mode=cross-provider&complianceId=${encodeURIComponent(entry.complianceId)}&version=${encodeURIComponent(entry.version)}`,
+ );
+ });
+
+ it("forwards only the cross-provider filter params present in searchParams", () => {
+ const href = buildCrossProviderDetailHref(entry, {
+ "filter[provider_type__in]": "aws,gcp",
+ "filter[provider_id__in]": "prov-1",
+ "filter[provider_groups__in]": "group-1",
+ "filter[region__in]": "eu-west-1",
+ "filter[cis_profile_level]": "Level 1",
+ scanId: "scan-1",
+ tab: "cross-provider",
+ });
+
+ const url = new URL(href, "https://localhost");
+ expect(url.searchParams.get("mode")).toBe("cross-provider");
+ expect(url.searchParams.get("filter[provider_type__in]")).toBe("aws,gcp");
+ expect(url.searchParams.get("filter[provider_id__in]")).toBe("prov-1");
+ expect(url.searchParams.get("filter[provider_groups__in]")).toBe("group-1");
+ expect(url.searchParams.has("filter[region__in]")).toBe(false);
+ expect(url.searchParams.has("filter[cis_profile_level]")).toBe(false);
+ expect(url.searchParams.has("scanId")).toBe(false);
+ expect(url.searchParams.has("tab")).toBe(false);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-pdf.test.ts b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-pdf.test.ts
new file mode 100644
index 0000000000..c125eccc0d
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/__tests__/cross-provider-pdf.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../../_actions/cross-provider", () => ({
+ getCrossProviderPdfBinary: vi.fn(),
+}));
+
+vi.mock("@/components/shadcn/toast", () => ({
+ toast: vi.fn(),
+ ToastAction: () => null,
+}));
+
+vi.mock("@/lib/helper", () => ({
+ downloadFile: vi.fn(),
+}));
+
+import { buildCrossProviderPdfTaskScope } from "../cross-provider-pdf";
+
+describe("buildCrossProviderPdfTaskScope", () => {
+ it("normalizes set-like filter ordering into one task scope", () => {
+ // Given / When
+ const first = buildCrossProviderPdfTaskScope("csa_ccm_4.0", {
+ scanIds: ["scan-2", "scan-1"],
+ providerTypes: "gcp,aws",
+ providerIds: "provider-2,provider-1",
+ });
+ const second = buildCrossProviderPdfTaskScope("csa_ccm_4.0", {
+ scanIds: ["scan-1", "scan-2"],
+ providerTypes: "aws,gcp",
+ providerIds: "provider-1,provider-2",
+ });
+
+ // Then
+ expect(first).toBe(second);
+ });
+
+ it("keeps reports from different provider groups in separate scopes", () => {
+ // Given / When
+ const productionScope = buildCrossProviderPdfTaskScope("csa_ccm_4.0", {
+ scanIds: ["scan-1"],
+ providerGroups: "production",
+ });
+ const developmentScope = buildCrossProviderPdfTaskScope("csa_ccm_4.0", {
+ scanIds: ["scan-1"],
+ providerGroups: "development",
+ });
+
+ // Then
+ expect(productionScope).not.toBe(developmentScope);
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_lib/__tests__/search-params-key.test.ts b/ui/app/(prowler)/compliance/_lib/__tests__/search-params-key.test.ts
new file mode 100644
index 0000000000..a36d5c1403
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/__tests__/search-params-key.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+
+import { buildSearchParamsKey } from "../search-params-key";
+
+describe("buildSearchParamsKey", () => {
+ it("ignores table-state params so paginating or sorting never remounts the view", () => {
+ const base = {
+ complianceId: "comp-1",
+ scanId: "scan-1",
+ "filter[region__in]": "eu-west-1",
+ };
+
+ const withTableState = {
+ ...base,
+ page: "3",
+ pageSize: "25",
+ sort: "-severity",
+ };
+
+ expect(buildSearchParamsKey(withTableState)).toBe(
+ buildSearchParamsKey(base),
+ );
+ });
+
+ it("changes when a non-table param changes", () => {
+ expect(
+ buildSearchParamsKey({ complianceId: "comp-1", scanId: "scan-1" }),
+ ).not.toBe(
+ buildSearchParamsKey({ complianceId: "comp-1", scanId: "scan-2" }),
+ );
+ });
+});
diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-accordion.tsx b/ui/app/(prowler)/compliance/_lib/cross-provider-accordion.tsx
new file mode 100644
index 0000000000..55b3aebd72
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/cross-provider-accordion.tsx
@@ -0,0 +1,82 @@
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import type { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import {
+ type FindingStatus,
+ StatusFindingBadge,
+} from "@/components/shadcn/table/status-finding-badge";
+import type { Framework } from "@/types/compliance";
+
+import { CrossProviderRequirementContent } from "../_components/cross-provider-requirement-content";
+import { RequirementProviderChips } from "../_components/requirement-provider-chips";
+import type { CrossProviderRequirementExtras } from "../_types";
+
+/**
+ * Accordion assembly for the cross-provider detail. Mirrors the per-scan
+ * mappers' `toAccordionItems` (same section key scheme, so `?section=` deep
+ * links behave identically) but swaps the per-scan findings content for the
+ * per-provider fan-out. Each requirement's status is shown once, on the same
+ * row as the name and the expand chevron: via the per-provider chips when a
+ * breakdown exists, or a single roll-up badge as a fallback. `extras` is the
+ * map produced by `buildRequirementExtrasMap`, keyed by the mapper-composed
+ * requirement name.
+ */
+export const toCrossProviderAccordionItems = (
+ data: Framework[],
+ extras: Map<string, CrossProviderRequirementExtras>,
+ framework: string,
+): AccordionItemProps[] =>
+ data.flatMap((frameworkData) =>
+ frameworkData.categories.map((category) => ({
+ key: `${frameworkData.name}-${category.name}`,
+ title: (
+ <ComplianceAccordionTitle
+ label={category.name}
+ pass={category.pass}
+ fail={category.fail}
+ manual={category.manual}
+ isParentLevel={true}
+ />
+ ),
+ content: "",
+ items: category.controls.flatMap((control) =>
+ control.requirements.map((requirement, reqIndex) => {
+ const requirementExtras = extras.get(requirement.name as string);
+
+ return {
+ key: `${frameworkData.name}-${category.name}-req-${reqIndex}`,
+ title: (
+ <div className="flex w-full items-center justify-between gap-3">
+ <span className="min-w-0 truncate">
+ {requirement.name as string}
+ </span>
+ {/* Status shown once: the per-provider chips carry each
+ provider's status; only fall back to a roll-up badge when
+ no per-provider breakdown exists. */}
+ {requirementExtras ? (
+ <RequirementProviderChips
+ providers={requirementExtras.providers}
+ />
+ ) : (
+ <StatusFindingBadge
+ status={requirement.status as FindingStatus}
+ />
+ )}
+ </div>
+ ),
+ content: requirementExtras ? (
+ <CrossProviderRequirementContent
+ requirement={requirement}
+ extras={requirementExtras}
+ framework={framework}
+ />
+ ) : (
+ <p className="text-sm">
+ No per-provider breakdown is available for this requirement.
+ </p>
+ ),
+ items: [],
+ };
+ }),
+ ),
+ })),
+ );
diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts b/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts
new file mode 100644
index 0000000000..9a15fa2f99
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/cross-provider-adapter.ts
@@ -0,0 +1,168 @@
+import type {
+ AttributesData,
+ AttributesItemData,
+ CheckProviderTypesMap,
+ RequirementItemData,
+ RequirementsData,
+} from "@/types/compliance";
+import { isKnownProviderType, PROVIDER_TYPES } from "@/types/providers";
+
+import type {
+ CrossProviderOverviewAttributes,
+ CrossProviderRequirementExtras,
+ ProviderBreakdownEntry,
+ ProviderCheckIdsMap,
+} from "../_types";
+
+/** The composed display name the per-scan mappers give every requirement.
+ * Shared with `buildRequirementExtrasMap` so the extras join never parses
+ * strings back apart. */
+const composeRequirementName = (id: string, name: string): string =>
+ name ? `${id} - ${name}` : id;
+
+/**
+ * Convert a cross-provider overview into the `{AttributesData,
+ * RequirementsData}` pair the per-scan compliance mappers consume, so the
+ * existing framework mappers (grouping, counters, detail fields) render the
+ * requirements accordion without a parallel cross-provider pipeline.
+ *
+ * The mappers read `attributes.attributes.metadata[0]` for framework-specific
+ * fields (Section, Pillar, …), so each requirement's flat `attributes` dict is
+ * wrapped in a single-element array. `check_ids` is the deduped union across
+ * providers — per-provider splits travel separately via
+ * {@link buildRequirementExtrasMap}.
+ */
+export const crossProviderToMapperInput = (
+ attrs: CrossProviderOverviewAttributes,
+): { attributesData: AttributesData; requirementsData: RequirementsData } => {
+ const attributeItems: AttributesItemData[] = [];
+ const requirementItems: RequirementItemData[] = [];
+
+ for (const requirement of attrs.requirements) {
+ const allCheckIds = Array.from(
+ new Set(
+ Object.values(requirement.check_ids_by_provider ?? {}).flatMap(
+ (ids) => ids ?? [],
+ ),
+ ),
+ );
+
+ attributeItems.push({
+ type: "compliance-requirements-attributes",
+ id: requirement.id,
+ attributes: {
+ framework_description: attrs.description || "",
+ name: requirement.name,
+ framework: attrs.framework,
+ version: attrs.version || "",
+ description: requirement.description || "",
+ attributes: {
+ metadata: [
+ requirement.attributes,
+ ] as AttributesItemData["attributes"]["attributes"]["metadata"],
+ check_ids: allCheckIds,
+ },
+ },
+ });
+
+ requirementItems.push({
+ type: "compliance-requirements-details",
+ id: requirement.id,
+ attributes: {
+ framework: attrs.framework,
+ version: attrs.version || "",
+ description: requirement.description || "",
+ status: requirement.status,
+ },
+ });
+ }
+
+ return {
+ attributesData: { data: attributeItems },
+ requirementsData: { data: requirementItems },
+ };
+};
+
+/**
+ * Cross-provider context for each requirement, keyed by the exact composed
+ * name the mappers produce, so renderers can join per-provider statuses and
+ * scan/check splits onto mapped requirements without touching the mappers.
+ */
+export const buildRequirementExtrasMap = (
+ attrs: CrossProviderOverviewAttributes,
+): Map<string, CrossProviderRequirementExtras> => {
+ const extras = new Map<string, CrossProviderRequirementExtras>();
+
+ for (const requirement of attrs.requirements) {
+ extras.set(composeRequirementName(requirement.id, requirement.name), {
+ requirementId: requirement.id,
+ providers: requirement.providers,
+ checkIdsByProvider: requirement.check_ids_by_provider ?? {},
+ scanIdsByProvider: attrs.scan_ids_by_provider,
+ });
+ }
+
+ return extras;
+};
+
+/**
+ * Invert a requirement's per-provider check split into check id → provider
+ * types, so the combined checks list can label each check. Iterates
+ * PROVIDER_TYPES for a stable icon order regardless of API key order.
+ */
+export const invertCheckIdsByProvider = (
+ checkIdsByProvider: ProviderCheckIdsMap,
+): CheckProviderTypesMap => {
+ const byCheck: CheckProviderTypesMap = {};
+
+ for (const provider of PROVIDER_TYPES) {
+ for (const checkId of checkIdsByProvider[provider] ?? []) {
+ (byCheck[checkId] ??= []).push(provider);
+ }
+ }
+
+ return byCheck;
+};
+
+/**
+ * Per-provider score summary for the coverage panel and framework cards.
+ * Scanned providers come first, each group sorted alphabetically; entries the
+ * UI cannot render (unknown provider types) are dropped. Score is the pass
+ * percentage over non-manual requirements the provider contributed.
+ */
+export const computeProviderBreakdown = (
+ attrs: CrossProviderOverviewAttributes,
+): ProviderBreakdownEntry[] => {
+ const contributing = new Set(attrs.providers);
+
+ return attrs.compatible_providers
+ .filter(isKnownProviderType)
+ .sort((a, b) => {
+ const aScanned = contributing.has(a);
+ if (aScanned !== contributing.has(b)) return aScanned ? -1 : 1;
+ return a.localeCompare(b);
+ })
+ .map((provider) => {
+ let pass = 0;
+ let fail = 0;
+ let manual = 0;
+
+ for (const requirement of attrs.requirements) {
+ const status = requirement.providers[provider];
+ if (status === "PASS") pass += 1;
+ else if (status === "FAIL") fail += 1;
+ else if (status === "MANUAL") manual += 1;
+ }
+
+ const scored = pass + fail;
+ return {
+ provider,
+ pass,
+ fail,
+ manual,
+ total: pass + fail + manual,
+ score: scored > 0 ? Math.round((pass / scored) * 100) : 0,
+ unscanned: !contributing.has(provider),
+ };
+ });
+};
diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts b/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts
new file mode 100644
index 0000000000..93a6e466eb
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts
@@ -0,0 +1,114 @@
+import type { KnownProviderType } from "@/types/providers";
+
+import type { CrossProviderApiFilters } from "../_types";
+
+// Catalog of universal compliance frameworks served by the cross-provider
+// endpoint. Hardcoded because the API has no listing endpoint for universal
+// framework ids: when a new universal JSON ships in the SDK
+// (prowler/compliance/<framework>.json), add an entry here.
+
+export interface CrossProviderFrameworkEntry {
+ /** Universal framework id used as filter[compliance_id]. */
+ complianceId: string;
+ /** Card/detail title; also the [compliancetitle] path segment and the
+ * key getComplianceIcon resolves the framework icon from. */
+ title: string;
+ version: string;
+ description: string;
+ /** Static fallback for the per-provider chips; the API response's
+ * compatible_providers is authoritative at runtime. */
+ compatibleProviders: KnownProviderType[];
+}
+
+export const CROSS_PROVIDER_FRAMEWORKS: CrossProviderFrameworkEntry[] = [
+ {
+ complianceId: "csa_ccm_4.0",
+ title: "CSA-CCM",
+ version: "4.0",
+ description:
+ "CSA Cloud Controls Matrix v4.0 — a cybersecurity control framework with 197 control objectives across 17 domains.",
+ compatibleProviders: ["aws", "azure", "gcp", "alibabacloud", "oraclecloud"],
+ },
+ {
+ complianceId: "cis_controls_8.1",
+ title: "CIS-Controls",
+ version: "8.1",
+ description:
+ "CIS Critical Security Controls v8.1 — prioritized safeguards organized into 18 controls to mitigate the most prevalent cyber-attacks.",
+ compatibleProviders: [
+ "aws",
+ "azure",
+ "gcp",
+ "m365",
+ "kubernetes",
+ "github",
+ "googleworkspace",
+ "okta",
+ "oraclecloud",
+ "alibabacloud",
+ "cloudflare",
+ "mongodbatlas",
+ "openstack",
+ "vercel",
+ ],
+ },
+ {
+ complianceId: "dora_2022_2554",
+ title: "DORA",
+ version: "2022/2554",
+ description:
+ "Digital Operational Resilience Act (EU 2022/2554) — the EU framework for the digital operational resilience of the financial sector.",
+ compatibleProviders: ["aws", "azure", "gcp", "alibabacloud", "cloudflare"],
+ },
+];
+
+/** Resolves only canonical catalog links. Missing, unknown, or mismatched
+ * identities must not reach the API as an `undefined` or unrelated filter. */
+export const resolveCrossProviderFramework = (
+ complianceId: string | undefined,
+ title: string,
+): CrossProviderFrameworkEntry | undefined =>
+ CROSS_PROVIDER_FRAMEWORKS.find(
+ (entry) => entry.complianceId === complianceId && entry.title === title,
+ );
+
+/** Cross-provider filter params forwarded from the overview into detail
+ * links (and consumed back by the detail page). */
+const CROSS_PROVIDER_FILTER_PARAMS = [
+ "filter[provider_type__in]",
+ "filter[provider_id__in]",
+ "filter[provider_groups__in]",
+] as const;
+
+/** Parses the URL filter params every cross-provider endpoint accepts. Kept
+ * next to CROSS_PROVIDER_FILTER_PARAMS so the overview and detail islands
+ * build identical, typed filter objects. */
+export const parseCrossProviderFilters = (
+ searchParams: Record<string, string | string[] | undefined>,
+): CrossProviderApiFilters => ({
+ providerTypes:
+ searchParams["filter[provider_type__in]"]?.toString() || undefined,
+ providerIds: searchParams["filter[provider_id__in]"]?.toString() || undefined,
+ providerGroups:
+ searchParams["filter[provider_groups__in]"]?.toString() || undefined,
+});
+
+export const buildCrossProviderDetailHref = (
+ entry: Pick<
+ CrossProviderFrameworkEntry,
+ "complianceId" | "title" | "version"
+ >,
+ searchParams?: Record<string, string | string[] | undefined>,
+): string => {
+ const params = new URLSearchParams();
+ params.set("mode", "cross-provider");
+ params.set("complianceId", entry.complianceId);
+ params.set("version", entry.version);
+
+ for (const key of CROSS_PROVIDER_FILTER_PARAMS) {
+ const value = searchParams?.[key]?.toString();
+ if (value) params.set(key, value);
+ }
+
+ return `/compliance/${encodeURIComponent(entry.title)}?${params.toString()}`;
+};
diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-pdf.tsx b/ui/app/(prowler)/compliance/_lib/cross-provider-pdf.tsx
new file mode 100644
index 0000000000..f60110c569
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/cross-provider-pdf.tsx
@@ -0,0 +1,91 @@
+"use client";
+
+import { toast, ToastAction } from "@/components/shadcn/toast";
+import { downloadFile } from "@/lib/helper";
+import type { TaskKindHandler } from "@/store/task-watcher/store";
+
+import { getCrossProviderPdfBinary } from "../_actions/cross-provider";
+import type { CrossProviderApiFilters } from "../_types";
+
+export const CROSS_PROVIDER_PDF_TASK_KIND = "cross-provider-pdf";
+
+const normalizeCommaSeparatedFilter = (value?: string): string =>
+ value
+ ?.split(",")
+ .map((item) => item.trim())
+ .filter(Boolean)
+ .sort()
+ .join(",") ?? "";
+
+/** Stable identity for the exact cross-provider view a PDF represents. */
+export const buildCrossProviderPdfTaskScope = (
+ complianceId: string,
+ filters: CrossProviderApiFilters,
+): string =>
+ JSON.stringify({
+ complianceId,
+ scanIds: [...(filters.scanIds ?? [])].sort(),
+ providerTypes: normalizeCommaSeparatedFilter(filters.providerTypes),
+ providerIds: normalizeCommaSeparatedFilter(filters.providerIds),
+ providerGroups: normalizeCommaSeparatedFilter(filters.providerGroups),
+ });
+
+/** Fetches the finished cross-provider PDF and hands it to the browser,
+ * reusing the shared base64→blob download + toast handling. Never rejects:
+ * it is fired from toast actions and dropdown items whose rejections would
+ * otherwise vanish unhandled. */
+export const downloadCrossProviderPdf = async (
+ taskId: string,
+): Promise<void> => {
+ try {
+ const result = await getCrossProviderPdfBinary(taskId);
+ await downloadFile(
+ result,
+ "application/pdf",
+ "The cross-provider compliance PDF has been downloaded successfully.",
+ toast,
+ );
+ } catch {
+ // The action catches API failures itself; this guards the server-action
+ // RPC (e.g. a network drop between browser and Next server).
+ toast({
+ variant: "destructive",
+ title: "Download failed",
+ description: "Could not fetch the report. Please try again later.",
+ });
+ }
+};
+
+/**
+ * Completion handler for cross-provider PDF generation tasks. Fired by the
+ * generic task watcher (`@/store/task-watcher`) whenever a tracked task of
+ * this kind settles — including after client-side navigation (module-scope
+ * poll loop) or a hard reload (persisted store + `TaskPollingWatcher`).
+ */
+export const crossProviderPdfHandler: TaskKindHandler = {
+ onReady: (task) => {
+ toast({
+ title: "Compliance report ready",
+ description: task.meta.reportLabel
+ ? `The ${task.meta.reportLabel} cross-provider PDF has been generated.`
+ : "The cross-provider compliance PDF has been generated.",
+ action: (
+ <ToastAction
+ altText="Download report"
+ onClick={() => downloadCrossProviderPdf(task.taskId)}
+ >
+ Download
+ </ToastAction>
+ ),
+ });
+ },
+ onError: (task) => {
+ toast({
+ variant: "destructive",
+ title: "Report generation failed",
+ description:
+ task.error ||
+ "The cross-provider PDF could not be generated. Try again later.",
+ });
+ },
+};
diff --git a/ui/app/(prowler)/compliance/_lib/search-params-key.ts b/ui/app/(prowler)/compliance/_lib/search-params-key.ts
new file mode 100644
index 0000000000..0a893a9954
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_lib/search-params-key.ts
@@ -0,0 +1,19 @@
+/** Params the findings DataTable pushes to the URL. They must not remount the
+ * detail view: the client accordion would collapse and lose its state, while
+ * the findings hook already refetches from useSearchParams on its own. */
+const TABLE_STATE_PARAMS = ["page", "pageSize", "sort"];
+
+/**
+ * Suspense key for the compliance detail views, stable across table-state
+ * navigations (pagination/sort) so only real query changes remount the tree.
+ */
+export const buildSearchParamsKey = (
+ searchParams: Record<string, string | string[] | undefined>,
+): string =>
+ JSON.stringify(
+ Object.fromEntries(
+ Object.entries(searchParams).filter(
+ ([key]) => !TABLE_STATE_PARAMS.includes(key),
+ ),
+ ),
+ );
diff --git a/ui/app/(prowler)/compliance/_types.ts b/ui/app/(prowler)/compliance/_types.ts
new file mode 100644
index 0000000000..7c8dbabba2
--- /dev/null
+++ b/ui/app/(prowler)/compliance/_types.ts
@@ -0,0 +1,163 @@
+import type { ActionErrorResult } from "@/lib/action-errors";
+import type { RequirementStatus } from "@/types/compliance";
+import type { KnownProviderType, ProviderType } from "@/types/providers";
+
+// Types for the Cloud-only cross-provider compliance roll-up, backed by
+// GET /cross-provider-compliance-overviews (one universal framework
+// aggregated across one scan per compatible provider; roll-up status is
+// computed server-side as FAIL > PASS > MANUAL).
+
+export const COMPLIANCE_TAB = {
+ PER_SCAN: "per-scan",
+ CROSS_PROVIDER: "cross-provider",
+} as const;
+
+export type ComplianceTab =
+ (typeof COMPLIANCE_TAB)[keyof typeof COMPLIANCE_TAB];
+
+export const CROSS_PROVIDER_OVERVIEW_TYPE =
+ "cross-provider-compliance-overviews" as const;
+
+/** Roll-up statuses the endpoint emits (never "No findings"). */
+export type CrossProviderStatus = Extract<
+ RequirementStatus,
+ "PASS" | "FAIL" | "MANUAL"
+>;
+
+export type ProviderStatusMap = Partial<
+ Record<ProviderType, CrossProviderStatus>
+>;
+
+export type ProviderCheckIdsMap = Partial<Record<ProviderType, string[]>>;
+
+export type ProviderScanIdsMap = Partial<Record<ProviderType, string[]>>;
+
+export interface CrossProviderRequirementData {
+ id: string;
+ name: string;
+ description: string;
+ /** Free-form per-requirement metadata from the universal JSON (e.g. CSA
+ * exposes Section/CCMLite; DORA exposes Chapter/Article). */
+ attributes: Record<string, unknown>;
+ status: CrossProviderStatus;
+ providers: ProviderStatusMap;
+ check_ids_by_provider?: ProviderCheckIdsMap;
+}
+
+export interface CrossProviderOverviewAttributes {
+ compliance_id: string;
+ framework: string;
+ name: string;
+ version: string;
+ description: string;
+ /** Provider types the universal framework declares checks for. */
+ compatible_providers: string[];
+ /** Provider types of the scans used as aggregation input. */
+ requested_providers: string[];
+ /** Provider types that contributed at least one row after RBAC/filters. */
+ providers: string[];
+ scan_ids: string[];
+ /** Provider type → scan UUIDs aggregated (a type can have N accounts). */
+ scan_ids_by_provider: ProviderScanIdsMap;
+ requirements_passed: number;
+ requirements_failed: number;
+ requirements_manual: number;
+ total_requirements: number;
+ requirements: CrossProviderRequirementData[];
+}
+
+export interface CrossProviderOverviewData {
+ type: typeof CROSS_PROVIDER_OVERVIEW_TYPE;
+ id: string;
+ attributes: CrossProviderOverviewAttributes;
+}
+
+export interface CrossProviderOverviewResponse {
+ data: CrossProviderOverviewData;
+}
+
+export const CROSS_PROVIDER_OVERVIEW_RESULT_STATUS = {
+ SUCCESS: "success",
+ ACTION_ERROR: "action-error",
+ LOAD_ERROR: "load-error",
+} as const;
+
+export type CrossProviderOverviewResultStatus =
+ (typeof CROSS_PROVIDER_OVERVIEW_RESULT_STATUS)[keyof typeof CROSS_PROVIDER_OVERVIEW_RESULT_STATUS];
+
+export const CROSS_PROVIDER_OVERVIEW_LOAD_ERROR_MESSAGE =
+ "Could not load cross-provider compliance data. Try again later.";
+
+export interface CrossProviderOverviewSuccessResult {
+ status: typeof CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.SUCCESS;
+ response: CrossProviderOverviewResponse;
+}
+
+export interface CrossProviderOverviewActionErrorResult {
+ status: typeof CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.ACTION_ERROR;
+ result: ActionErrorResult;
+}
+
+export interface CrossProviderOverviewLoadErrorResult {
+ status: typeof CROSS_PROVIDER_OVERVIEW_RESULT_STATUS.LOAD_ERROR;
+ message: string;
+}
+
+export type CrossProviderOverviewResult =
+ | CrossProviderOverviewSuccessResult
+ | CrossProviderOverviewActionErrorResult
+ | CrossProviderOverviewLoadErrorResult;
+
+/** Filters accepted by every cross-provider endpoint (comma-joined). */
+export interface CrossProviderApiFilters {
+ scanIds?: string[];
+ providerTypes?: string;
+ providerIds?: string;
+ providerGroups?: string;
+}
+
+/** Cross-provider context joined onto a mapped requirement, keyed by the
+ * composed requirement name the per-scan mappers produce. */
+export interface CrossProviderRequirementExtras {
+ requirementId: string;
+ providers: ProviderStatusMap;
+ checkIdsByProvider: ProviderCheckIdsMap;
+ scanIdsByProvider: ProviderScanIdsMap;
+}
+
+/** Card-ready framework roll-up shared by the overview grid (producer) and
+ * `CrossProviderFrameworkCard` (props), so the `{...summary}` spread can
+ * never drift between the two. */
+export interface CrossProviderFrameworkSummary {
+ complianceId: string;
+ title: string;
+ version: string;
+ description: string;
+ requirementsPassed: number;
+ requirementsFailed: number;
+ requirementsManual: number;
+ totalRequirements: number;
+ providerBreakdown: ProviderBreakdownEntry[];
+}
+
+export interface ProviderBreakdownEntry {
+ /** Narrowed to the known set: the breakdown only renders providers the UI
+ * ships display names and icons for. */
+ provider: KnownProviderType;
+ pass: number;
+ fail: number;
+ manual: number;
+ total: number;
+ /** 0-100 pass percentage over non-manual requirements. */
+ score: number;
+ /** Compatible with the framework but no scan contributed. */
+ unscanned: boolean;
+}
+
+/** A previously generated PDF matching the current filters, downloadable
+ * immediately without polling. */
+export interface LatestCrossProviderPdf {
+ taskId: string;
+ filename?: string;
+ completedAt?: string;
+}
diff --git a/ui/app/(prowler)/compliance/page.tsx b/ui/app/(prowler)/compliance/page.tsx
index d4ee609a0c..119e39c5e5 100644
--- a/ui/app/(prowler)/compliance/page.tsx
+++ b/ui/app/(prowler)/compliance/page.tsx
@@ -16,8 +16,9 @@ import { ComplianceFilters } from "@/components/compliance/compliance-header/com
import { ComplianceOverviewGrid } from "@/components/compliance/compliance-overview-grid";
import { Alert, AlertDescription } from "@/components/shadcn/alert";
import { Card, CardContent } from "@/components/shadcn/card/card";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { pickLatestCisPerProvider } from "@/lib/compliance/compliance-report-types";
+import { isCloud } from "@/lib/shared/env";
import {
ExpandedScanData,
ScanEntity,
@@ -26,6 +27,11 @@ import {
} from "@/types";
import { ComplianceOverviewData } from "@/types/compliance";
+import { CompliancePageTabs } from "./_components/compliance-page-tabs";
+import { getComplianceTab } from "./_components/compliance-page-tabs.shared";
+import { CrossProviderOverview } from "./_components/cross-provider-overview";
+import { COMPLIANCE_TAB } from "./_types";
+
export default async function Compliance({
searchParams,
}: {
@@ -34,6 +40,44 @@ export default async function Compliance({
const resolvedSearchParams = await searchParams;
const searchParamsKey = JSON.stringify(resolvedSearchParams || {});
+ // Cross-Provider is Prowler Cloud-only (the OSS API has no
+ // cross-provider-compliance-overviews endpoint): in OSS the tab renders
+ // disabled with the upsell badge and Per Scan is forced active.
+ const crossProviderEnabled = isCloud();
+ const activeTab = crossProviderEnabled
+ ? getComplianceTab(resolvedSearchParams.tab)
+ : COMPLIANCE_TAB.PER_SCAN;
+
+ // Only the active tab's payload is built: switching tabs is a real
+ // navigation, so pre-building the inactive tab buys nothing.
+ if (activeTab === COMPLIANCE_TAB.CROSS_PROVIDER) {
+ return (
+ <ContentLayout
+ title="Compliance"
+ icon="lucide:shield-check"
+ onboardingAction={{ flowId: "view-compliance" }}
+ >
+ <CompliancePageTabs
+ activeTab={activeTab}
+ crossProviderEnabled={crossProviderEnabled}
+ perScanContent={null}
+ crossProviderContent={
+ <Suspense
+ key={`cross-provider-${searchParamsKey}`}
+ fallback={
+ <ComplianceOverviewPanel>
+ <ComplianceSkeletonGrid />
+ </ComplianceOverviewPanel>
+ }
+ >
+ <CrossProviderOverview searchParams={resolvedSearchParams} />
+ </Suspense>
+ }
+ />
+ </ContentLayout>
+ );
+ }
+
const scansData = await getScans({
filters: {
"filter[state]": "completed",
@@ -56,7 +100,12 @@ export default async function Compliance({
useFallback: true,
}}
>
- <NoScansAvailable />
+ <CompliancePageTabs
+ activeTab={activeTab}
+ crossProviderEnabled={crossProviderEnabled}
+ perScanContent={<NoScansAvailable />}
+ crossProviderContent={null}
+ />
</ContentLayout>
);
}
@@ -140,54 +189,61 @@ export default async function Compliance({
}
}
+ const perScanContent = selectedScanId ? (
+ <>
+ <div className="mb-6">
+ <ComplianceFilters
+ scans={expandedScansData}
+ uniqueRegions={uniqueRegions}
+ selectedScanId={selectedScanId}
+ />
+ </div>
+
+ {threatScoreData &&
+ typeof selectedScanId === "string" &&
+ selectedScan && (
+ <div className="mb-6">
+ <ThreatScoreBadge
+ score={threatScoreData.score}
+ scanId={selectedScanId}
+ provider={selectedScan.providerInfo.provider}
+ selectedScan={selectedScanData}
+ sectionScores={threatScoreData.sectionScores}
+ />
+ </div>
+ )}
+
+ <Suspense
+ key={searchParamsKey}
+ fallback={
+ <ComplianceOverviewPanel>
+ <ComplianceSkeletonGrid />
+ </ComplianceOverviewPanel>
+ }
+ >
+ <SSRComplianceGrid
+ searchParams={resolvedSearchParams}
+ scanId={selectedScanId}
+ selectedScan={selectedScanData}
+ />
+ </Suspense>
+ </>
+ ) : (
+ <NoScansAvailable />
+ );
+
return (
<ContentLayout
title="Compliance"
icon="lucide:shield-check"
onboardingAction={onboardingAction}
>
- {selectedScanId ? (
- <>
- <div className="mb-6">
- <ComplianceFilters
- scans={expandedScansData}
- uniqueRegions={uniqueRegions}
- selectedScanId={selectedScanId}
- />
- </div>
-
- {threatScoreData &&
- typeof selectedScanId === "string" &&
- selectedScan && (
- <div className="mb-6">
- <ThreatScoreBadge
- score={threatScoreData.score}
- scanId={selectedScanId}
- provider={selectedScan.providerInfo.provider}
- selectedScan={selectedScanData}
- sectionScores={threatScoreData.sectionScores}
- />
- </div>
- )}
-
- <Suspense
- key={searchParamsKey}
- fallback={
- <ComplianceOverviewPanel>
- <ComplianceSkeletonGrid />
- </ComplianceOverviewPanel>
- }
- >
- <SSRComplianceGrid
- searchParams={resolvedSearchParams}
- scanId={selectedScanId}
- selectedScan={selectedScanData}
- />
- </Suspense>
- </>
- ) : (
- <NoScansAvailable />
- )}
+ <CompliancePageTabs
+ activeTab={activeTab}
+ crossProviderEnabled={crossProviderEnabled}
+ perScanContent={perScanContent}
+ crossProviderContent={null}
+ />
</ContentLayout>
);
}
@@ -274,7 +330,7 @@ const ComplianceOverviewPanel = ({
<Card
variant="base"
padding="none"
- className="minimal-scrollbar shadow-small relative z-0 w-full gap-4 overflow-auto"
+ className="minimal-scrollbar relative z-0 w-full gap-4 overflow-auto shadow-sm"
>
<CardContent className="flex flex-col gap-4 p-4">{children}</CardContent>
</Card>
diff --git a/ui/app/(prowler)/demo-expandable-table/page.tsx b/ui/app/(prowler)/demo-expandable-table/page.tsx
index b97770f1a6..b4be4cf1d2 100644
--- a/ui/app/(prowler)/demo-expandable-table/page.tsx
+++ b/ui/app/(prowler)/demo-expandable-table/page.tsx
@@ -4,9 +4,9 @@ import { ColumnDef } from "@tanstack/react-table";
import { CloudIcon, FolderIcon, ServerIcon } from "lucide-react";
import { notFound } from "next/navigation";
-import { DataTable } from "@/components/ui/table/data-table";
-import { DataTableExpandAllToggle } from "@/components/ui/table/data-table-expand-all-toggle";
-import { DataTableExpandableCell } from "@/components/ui/table/data-table-expandable-cell";
+import { DataTable } from "@/components/shadcn/table/data-table";
+import { DataTableExpandAllToggle } from "@/components/shadcn/table/data-table-expand-all-toggle";
+import { DataTableExpandableCell } from "@/components/shadcn/table/data-table-expandable-cell";
/**
* Demo page for the Expandable DataTable component.
diff --git a/ui/app/(prowler)/demo-tree-view/page.tsx b/ui/app/(prowler)/demo-tree-view/page.tsx
index 353aeccc57..1518623fdc 100644
--- a/ui/app/(prowler)/demo-tree-view/page.tsx
+++ b/ui/app/(prowler)/demo-tree-view/page.tsx
@@ -135,7 +135,7 @@ export default function DemoTreeViewPage() {
<TooltipContent side="top">{item.name}</TooltipContent>
</Tooltip>
{hasChildren && !isLeaf && (
- <span className="bg-prowler-white/10 inline-flex min-w-5 shrink-0 items-center justify-center rounded px-1 py-0.5 text-xs tabular-nums">
+ <span className="inline-flex min-w-5 shrink-0 items-center justify-center rounded bg-white/10 px-1 py-0.5 text-xs tabular-nums">
{item.children?.length}
</span>
)}
diff --git a/ui/app/(prowler)/error.tsx b/ui/app/(prowler)/error.tsx
index 69b008c31c..67ca92184b 100644
--- a/ui/app/(prowler)/error.tsx
+++ b/ui/app/(prowler)/error.tsx
@@ -12,7 +12,7 @@ import {
CardHeader,
CardTitle,
} from "@/components/shadcn/card/card";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { SentryErrorSource, SentryErrorType } from "@/sentry";
export default function Error({
diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx
index 65e8eca9cd..77cb1d8d0e 100644
--- a/ui/app/(prowler)/findings/page.tsx
+++ b/ui/app/(prowler)/findings/page.tsx
@@ -6,6 +6,7 @@ import {
getLatestFindingGroups,
} from "@/actions/finding-groups";
import { getLatestMetadataInfo, getMetadataInfo } from "@/actions/findings";
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import { getAllProviders } from "@/actions/providers";
import { getScan, getScans } from "@/actions/scans";
import { SeedFromFindingsButton } from "@/app/(prowler)/alerts/_components";
@@ -14,7 +15,7 @@ import {
FindingsGroupTable,
SkeletonTableFindings,
} from "@/components/findings/table";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { FilterTransitionWrapper } from "@/contexts";
import {
applyDefaultMutedFilter,
@@ -24,6 +25,7 @@ import {
hasDateOrScanFilter,
} from "@/lib";
import { resolveFindingScanDateFilters } from "@/lib/findings-scan-filters";
+import { isCloud } from "@/lib/shared/env";
import { ScanEntity, ScanProps } from "@/types";
import { SearchParamsProps } from "@/types/components";
@@ -36,8 +38,9 @@ export default async function Findings({
const { encodedSort } = extractSortAndKey(resolvedSearchParams);
const { filters, query } = extractFiltersAndQuery(resolvedSearchParams);
- const [providersData, scansData] = await Promise.all([
+ const [providersData, providerGroupsData, scansData] = await Promise.all([
getAllProviders(),
+ getAllProviderGroups(),
getScans({ pageSize: 50 }),
]);
@@ -87,7 +90,7 @@ export default async function Findings({
completedScans || [],
providersData,
) as { [uid: string]: ScanEntity }[];
- const alertsEnabled = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const alertsEnabled = isCloud();
return (
<ContentLayout
@@ -99,6 +102,7 @@ export default async function Findings({
<div className="mb-6">
<FindingsFilters
providers={providersData?.data || []}
+ providerGroups={providerGroupsData?.data || []}
completedScanIds={completedScanIds}
scanDetails={scanDetails}
uniqueRegions={uniqueRegions}
@@ -163,7 +167,7 @@ const SSRDataTable = async ({
return (
<>
{findingGroupsData?.errors?.length > 0 && (
- <div className="text-small mb-4 flex rounded-lg border border-red-500 bg-red-100 p-2 text-red-700">
+ <div className="mb-4 flex rounded-lg border border-red-500 bg-red-100 p-2 text-sm text-red-700">
<p className="mr-2 font-semibold">Error:</p>
<p>{findingGroupsData.errors[0].detail}</p>
</div>
diff --git a/ui/app/(prowler)/integrations/amazon-s3/page.tsx b/ui/app/(prowler)/integrations/amazon-s3/page.tsx
index 9db94b034f..868b3789b2 100644
--- a/ui/app/(prowler)/integrations/amazon-s3/page.tsx
+++ b/ui/app/(prowler)/integrations/amazon-s3/page.tsx
@@ -4,7 +4,7 @@ import { getIntegrations } from "@/actions/integrations";
import { getAllProviders } from "@/actions/providers";
import { S3IntegrationsManager } from "@/components/integrations/s3/s3-integrations-manager";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
interface S3IntegrationsProps {
searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
diff --git a/ui/app/(prowler)/integrations/aws-security-hub/page.tsx b/ui/app/(prowler)/integrations/aws-security-hub/page.tsx
index 12050a8eaa..20c423557e 100644
--- a/ui/app/(prowler)/integrations/aws-security-hub/page.tsx
+++ b/ui/app/(prowler)/integrations/aws-security-hub/page.tsx
@@ -4,7 +4,7 @@ import { getIntegrations } from "@/actions/integrations";
import { getAllProviders } from "@/actions/providers";
import { SecurityHubIntegrationsManager } from "@/components/integrations/security-hub/security-hub-integrations-manager";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
interface SecurityHubIntegrationsProps {
searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
diff --git a/ui/app/(prowler)/integrations/jira/page.tsx b/ui/app/(prowler)/integrations/jira/page.tsx
index 63d53c6ff9..f6360d0151 100644
--- a/ui/app/(prowler)/integrations/jira/page.tsx
+++ b/ui/app/(prowler)/integrations/jira/page.tsx
@@ -1,7 +1,7 @@
import { getIntegrations } from "@/actions/integrations";
import { JiraIntegrationsManager } from "@/components/integrations/jira/jira-integrations-manager";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
interface JiraIntegrationsProps {
searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
diff --git a/ui/app/(prowler)/integrations/page.tsx b/ui/app/(prowler)/integrations/page.tsx
index d3f733d658..c8b120391e 100644
--- a/ui/app/(prowler)/integrations/page.tsx
+++ b/ui/app/(prowler)/integrations/page.tsx
@@ -5,7 +5,7 @@ import {
SecurityHubIntegrationCard,
SsoLinkCard,
} from "@/components/integrations";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
export default async function Integrations() {
return (
diff --git a/ui/app/(prowler)/invitations/(send-invite)/layout.tsx b/ui/app/(prowler)/invitations/(send-invite)/layout.tsx
index 874d5129b7..672ad5dd20 100644
--- a/ui/app/(prowler)/invitations/(send-invite)/layout.tsx
+++ b/ui/app/(prowler)/invitations/(send-invite)/layout.tsx
@@ -1,10 +1,9 @@
import "@/styles/globals.css";
-import { Spacer } from "@heroui/spacer";
import React from "react";
import { WorkflowSendInvite } from "@/components/invitations/workflow";
-import { NavigationHeader } from "@/components/ui";
+import { NavigationHeader } from "@/components/shadcn";
interface InvitationLayoutProps {
children: React.ReactNode;
@@ -18,7 +17,7 @@ export default function InvitationLayout({ children }: InvitationLayoutProps) {
icon="icon-park-outline:close-small"
href="/invitations"
/>
- <Spacer y={16} />
+ <div className="h-16" />
<div className="grid grid-cols-1 gap-8 px-4 lg:grid-cols-12 lg:px-0">
<div className="order-1 my-auto h-full lg:col-span-4 lg:col-start-2">
<WorkflowSendInvite />
diff --git a/ui/app/(prowler)/invitations/page.tsx b/ui/app/(prowler)/invitations/page.tsx
index 57cc268354..3e9f164edf 100644
--- a/ui/app/(prowler)/invitations/page.tsx
+++ b/ui/app/(prowler)/invitations/page.tsx
@@ -3,16 +3,14 @@ import { Suspense } from "react";
import { getInvitations } from "@/actions/invitations/invitation";
import { getRoles } from "@/actions/roles";
-import { FilterControls } from "@/components/filters";
import { filterInvitations } from "@/components/filters/data-filters";
-import { AddIcon } from "@/components/icons";
import {
ColumnsInvitation,
SkeletonTableInvitation,
} from "@/components/invitations/table";
import { Button } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
-import { DataTable, DataTableFilterCustom } from "@/components/ui/table";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { DataTable, DataTableFilterCustom } from "@/components/shadcn/table";
import { InvitationProps, Role, SearchParamsProps } from "@/types";
export default async function Invitations({
@@ -25,17 +23,15 @@ export default async function Invitations({
return (
<ContentLayout title="Invitations" icon="lucide:mail">
- <FilterControls search />
-
<div className="flex flex-col gap-6">
<div className="flex flex-row items-end justify-between">
- <DataTableFilterCustom filters={filterInvitations || []} />
+ <DataTableFilterCustom
+ filters={filterInvitations || []}
+ gridClassName="w-fit grid-cols-[14rem_auto] items-center gap-4 sm:grid-cols-[14rem_auto] lg:grid-cols-[14rem_auto] xl:grid-cols-[14rem_auto] 2xl:grid-cols-[14rem_auto]"
+ />
<Button asChild>
- <Link href="/invitations/new">
- Send Invitation
- <AddIcon size={20} />
- </Link>
+ <Link href="/invitations/new">Send Invitation</Link>
</Button>
</div>
@@ -124,6 +120,7 @@ const SSRDataTable = async ({
columns={ColumnsInvitation}
data={expandedResponse?.data || []}
metadata={invitationsData?.meta}
+ showSearch
/>
);
};
diff --git a/ui/app/(prowler)/layout.tsx b/ui/app/(prowler)/layout.tsx
index 2554ab02b9..f657f32199 100644
--- a/ui/app/(prowler)/layout.tsx
+++ b/ui/app/(prowler)/layout.tsx
@@ -6,16 +6,18 @@ import { ReactNode, Suspense } from "react";
import { getProviders } from "@/actions/providers";
import { getScansByState } from "@/actions/scans/scans";
+import MainLayout from "@/components/layout/main-layout/main-layout";
import {
OnboardingCheckpointWatcher,
OnboardingGate,
OnboardingSequenceBanner,
} from "@/components/onboarding";
import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
-import MainLayout from "@/components/ui/main-layout/main-layout";
-import { NavigationProgress } from "@/components/ui/navigation-progress";
-import { Toaster } from "@/components/ui/toast";
-import { fontSans } from "@/config/fonts";
+import { NavigationProgress } from "@/components/shadcn/navigation-progress";
+import { Toaster } from "@/components/shadcn/toast";
+import { TaskPollingWatcher } from "@/components/shared/task-polling-watcher";
+import { GlobalSidePanel } from "@/components/side-panel";
+import { fontMono, fontSans } from "@/config/fonts";
import { siteConfig } from "@/config/site";
import { isCloud } from "@/lib/shared/env";
import { cn } from "@/lib/utils";
@@ -83,8 +85,9 @@ export default async function RootLayout({
<body
suppressHydrationWarning
className={cn(
- "bg-background min-h-screen font-sans antialiased",
+ "bg-bg-neutral-primary min-h-screen font-sans antialiased",
fontSans.variable,
+ fontMono.variable,
)}
>
<Providers themeProps={{ attribute: "class", defaultTheme: "dark" }}>
@@ -105,6 +108,12 @@ export default async function RootLayout({
</>
)}
<MainLayout>{children}</MainLayout>
+ {/* Always mounted: it hosts the detail (finding/resource) views in
+ every deployment; the AI tab inside is cloud-gated on its own. */}
+ <GlobalSidePanel />
+ {/* Resumes persisted background-task polling (e.g. cross-provider
+ PDF generation) so completion toasts survive hard reloads. */}
+ <TaskPollingWatcher />
<Toaster />
</Providers>
</body>
diff --git a/ui/app/(prowler)/lighthouse/_actions/index.ts b/ui/app/(prowler)/lighthouse/_actions/index.ts
new file mode 100644
index 0000000000..9d89b59a59
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_actions/index.ts
@@ -0,0 +1 @@
+export * from "./lighthouse-v2";
diff --git a/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.test.ts b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.test.ts
new file mode 100644
index 0000000000..7a04246b77
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.test.ts
@@ -0,0 +1,276 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ buildLighthouseV2ConfigurationPayload,
+ buildLighthouseV2ConfigurationUpdatePayload,
+ buildLighthouseV2MessagePayload,
+ mapLighthouseV2Configuration,
+ mapLighthouseV2Message,
+ mapLighthouseV2Model,
+ mapLighthouseV2Provider,
+ validateLighthouseV2ConfigurationInput,
+} from "./lighthouse-v2.adapter";
+
+describe("lighthouse-v2.adapter", () => {
+ describe("when mapping Cloud JSON:API resources", () => {
+ it("should map configuration attributes to UI fields", () => {
+ // Given
+ const resource: Parameters<typeof mapLighthouseV2Configuration>[0] = {
+ id: "config-1",
+ type: "lighthouse-ai-configurations",
+ attributes: {
+ provider_type: "bedrock",
+ base_url: null,
+ default_model: "anthropic.claude",
+ business_context: "Production tenant",
+ connected: true,
+ connection_last_checked_at: "2026-06-24T10:00:00Z",
+ inserted_at: "2026-06-24T09:00:00Z",
+ updated_at: "2026-06-24T10:00:00Z",
+ },
+ };
+
+ // When
+ const config = mapLighthouseV2Configuration(resource);
+
+ // Then
+ expect(config).toEqual({
+ id: "config-1",
+ providerType: "bedrock",
+ baseUrl: null,
+ defaultModel: "anthropic.claude",
+ businessContext: "Production tenant",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:00:00Z",
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ });
+ });
+
+ it("should map supported provider and model payloads", () => {
+ // Given
+ const provider = {
+ id: "openai_compatible",
+ type: "lighthouse-supported-providers",
+ attributes: { name: "OpenAI Compatible" },
+ };
+ const model = {
+ id: "gpt-5.5",
+ type: "lighthouse-supported-models",
+ attributes: {
+ model_name: "GPT 5.5",
+ max_input_tokens: 100000,
+ max_output_tokens: 8192,
+ supports_function_calling: true,
+ supports_vision: false,
+ supports_reasoning: true,
+ },
+ };
+
+ // When / Then
+ expect(mapLighthouseV2Provider(provider)).toEqual({
+ id: "openai-compatible",
+ name: "OpenAI Compatible",
+ });
+ expect(mapLighthouseV2Model(model)).toEqual({
+ id: "gpt-5.5",
+ name: "GPT 5.5",
+ maxInputTokens: 100000,
+ maxOutputTokens: 8192,
+ supportsFunctionCalling: true,
+ supportsVision: false,
+ supportsReasoning: true,
+ });
+ });
+
+ it("should map message parts from backend names", () => {
+ // Given
+ const resource: Parameters<typeof mapLighthouseV2Message>[0] = {
+ id: "message-1",
+ type: "lighthouse-messages",
+ attributes: {
+ role: "assistant",
+ model: "gpt-5.5",
+ token_usage: { input: 10 },
+ inserted_at: "2026-06-24T10:01:00Z",
+ parts: [
+ {
+ id: "part-1",
+ type: "lighthouse-parts",
+ attributes: {
+ part_type: "text",
+ content: { text: "Done" },
+ tool_call_outcome: null,
+ inserted_at: "2026-06-24T10:01:00Z",
+ updated_at: "2026-06-24T10:01:00Z",
+ },
+ },
+ ],
+ },
+ };
+
+ // When
+ const message = mapLighthouseV2Message(resource);
+
+ // Then
+ expect(message.parts[0]).toMatchObject({
+ id: "part-1",
+ type: "text",
+ content: { text: "Done" },
+ });
+ });
+
+ it("should give id-less parts stable fallback keys instead of empty strings", () => {
+ // Given
+ const resource: Parameters<typeof mapLighthouseV2Message>[0] = {
+ id: "message-2",
+ type: "lighthouse-messages",
+ attributes: {
+ role: "assistant",
+ model: null,
+ token_usage: null,
+ inserted_at: "2026-06-24T10:02:00Z",
+ parts: [
+ { part_type: "text", content: { text: "one" } },
+ { part_type: "text", content: { text: "two" } },
+ ],
+ },
+ };
+
+ // When
+ const message = mapLighthouseV2Message(resource);
+
+ // Then
+ expect(message.parts.map((part) => part.id)).toEqual([
+ "part-0",
+ "part-1",
+ ]);
+ });
+
+ it("should reject unknown provider ids at the adapter boundary", () => {
+ // Given / When / Then
+ expect(() =>
+ mapLighthouseV2Provider({
+ id: "totally-unknown-provider",
+ type: "lighthouse-supported-providers",
+ attributes: { name: "Mystery" },
+ }),
+ ).toThrow(/Unsupported Lighthouse v2 provider/);
+ });
+ });
+
+ describe("when building Cloud payloads", () => {
+ it("should use Cloud Bedrock credential keys", () => {
+ // Given
+ const input = {
+ providerType: "bedrock" as const,
+ credentials: {
+ aws_access_key_id: "test-bedrock-access-key",
+ aws_secret_access_key: "a".repeat(40),
+ aws_region_name: "us-east-1",
+ },
+ };
+
+ // When
+ const payload = buildLighthouseV2ConfigurationPayload(input);
+
+ // Then
+ expect(payload.data).toMatchObject({
+ type: "lighthouse-ai-configurations",
+ attributes: {
+ provider_type: "bedrock",
+ credentials: {
+ aws_access_key_id: "test-bedrock-access-key",
+ aws_secret_access_key: "a".repeat(40),
+ aws_region_name: "us-east-1",
+ },
+ },
+ });
+ expect(payload.data.attributes).not.toHaveProperty("default_model");
+ expect(payload.data.attributes).not.toHaveProperty("business_context");
+ });
+
+ it("should serialize OpenAI-compatible configuration provider ids for the Cloud API", () => {
+ // Given
+ const input = {
+ providerType: "openai-compatible" as const,
+ credentials: { api_key: "provider-key" },
+ baseUrl: "https://openrouter.ai/api/v1",
+ };
+
+ // When
+ const payload = buildLighthouseV2ConfigurationPayload(input);
+
+ // Then
+ expect(payload.data.attributes).toMatchObject({
+ provider_type: "openai_compatible",
+ credentials: { api_key: "provider-key" },
+ base_url: "https://openrouter.ai/api/v1",
+ });
+ });
+
+ it("should serialize OpenAI-compatible message provider ids for the Cloud API", () => {
+ // Given
+ const input = {
+ text: "Summarize critical findings",
+ provider: "openai-compatible" as const,
+ model: "openrouter/auto",
+ };
+
+ // When
+ const payload = buildLighthouseV2MessagePayload(input);
+
+ // Then
+ expect(payload.data.attributes.provider).toBe("openai_compatible");
+ });
+
+ it("should build per-provider update payloads with default_model and business_context", () => {
+ // When
+ const payload = buildLighthouseV2ConfigurationUpdatePayload("config-1", {
+ defaultModel: "anthropic.claude-4",
+ businessContext: "Production tenant",
+ });
+
+ // Then
+ expect(payload).toEqual({
+ data: {
+ type: "lighthouse-ai-configurations",
+ id: "config-1",
+ attributes: {
+ default_model: "anthropic.claude-4",
+ business_context: "Production tenant",
+ },
+ },
+ });
+ });
+
+ it("should omit untouched fields from the update payload", () => {
+ // When
+ const payload = buildLighthouseV2ConfigurationUpdatePayload("config-1", {
+ defaultModel: "gpt-5.1",
+ });
+
+ // Then
+ expect(payload.data.attributes).toEqual({ default_model: "gpt-5.1" });
+ expect(payload.data.attributes).not.toHaveProperty("business_context");
+ expect(payload.data.attributes).not.toHaveProperty("credentials");
+ });
+
+ it("should require base_url for OpenAI-compatible configurations", () => {
+ // Given
+ const input = {
+ providerType: "openai-compatible" as const,
+ credentials: { api_key: "provider-key" },
+ };
+
+ // When
+ const result = validateLighthouseV2ConfigurationInput(input);
+
+ // Then
+ expect(result).toEqual({
+ success: false,
+ error: "Base URL is required for OpenAI-compatible providers.",
+ });
+ });
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.ts b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.ts
new file mode 100644
index 0000000000..5d9a93295c
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.adapter.ts
@@ -0,0 +1,380 @@
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2Configuration,
+ type LighthouseV2ConfigurationInput,
+ type LighthouseV2ConfigurationUpdateInput,
+ type LighthouseV2Credentials,
+ type LighthouseV2Message,
+ type LighthouseV2MessageRole,
+ type LighthouseV2Part,
+ type LighthouseV2PartType,
+ type LighthouseV2ProviderType,
+ type LighthouseV2Session,
+ type LighthouseV2SupportedModel,
+ type LighthouseV2SupportedProvider,
+ type LighthouseV2Task,
+} from "@/app/(prowler)/lighthouse/_types";
+import type { JsonApiDocument, JsonApiResource } from "@/types/jsonapi";
+import type {
+ TaskAttributes as ApiTaskAttributes,
+ TaskState,
+} from "@/types/tasks";
+
+interface ConfigurationAttributes {
+ provider_type: string;
+ base_url: string | null;
+ default_model?: string | null;
+ business_context?: string | null;
+ connected: boolean | null;
+ connection_last_checked_at: string | null;
+ inserted_at: string;
+ updated_at: string;
+}
+
+interface SupportedProviderAttributes {
+ name: string;
+}
+
+interface SupportedModelAttributes {
+ model_name?: string | null;
+ name?: string | null;
+ max_input_tokens: number | null;
+ max_output_tokens: number | null;
+ supports_function_calling: boolean | null;
+ supports_vision: boolean | null;
+ supports_reasoning: boolean | null;
+}
+
+interface SessionAttributes {
+ title: string | null;
+ is_archived: boolean;
+ inserted_at: string;
+ updated_at: string;
+}
+
+interface MessageAttributes {
+ role: LighthouseV2MessageRole;
+ model: string | null;
+ token_usage: unknown;
+ inserted_at: string;
+ parts?: UnknownPartResource[];
+}
+
+interface PartAttributes {
+ id?: string;
+ part_type: LighthouseV2PartType;
+ content: unknown;
+ tool_call_outcome?: string | null;
+ inserted_at?: string | null;
+ updated_at?: string | null;
+}
+
+type UnknownPartResource =
+ | JsonApiResource<PartAttributes>
+ | (PartAttributes & { id?: string });
+
+// Extends the shared task attributes: the Lighthouse task resource always
+// carries `state` plus scheduling metadata.
+interface TaskAttributes extends ApiTaskAttributes {
+ state: TaskState;
+ inserted_at?: string;
+ completed_at?: string | null;
+ name?: string | null;
+ metadata?: unknown;
+}
+
+interface ValidationSuccess {
+ success: true;
+}
+
+interface ValidationFailure {
+ success: false;
+ error: string;
+}
+
+type ValidationResult = ValidationSuccess | ValidationFailure;
+
+const LIGHTHOUSE_V2_API_PROVIDER_TYPE = {
+ OPENAI: "openai",
+ BEDROCK: "bedrock",
+ OPENAI_COMPATIBLE: "openai_compatible",
+} as const;
+
+type LighthouseV2ApiProviderType =
+ (typeof LIGHTHOUSE_V2_API_PROVIDER_TYPE)[keyof typeof LIGHTHOUSE_V2_API_PROVIDER_TYPE];
+
+export function getJsonApiArray<TResource>(
+ document: JsonApiDocument<TResource[]>,
+): TResource[] {
+ return document.data ?? [];
+}
+
+export function mapLighthouseV2Configuration(
+ resource: JsonApiResource<ConfigurationAttributes>,
+): LighthouseV2Configuration {
+ return {
+ id: resource.id,
+ providerType: normalizeLighthouseV2ProviderType(
+ resource.attributes.provider_type,
+ ),
+ baseUrl: resource.attributes.base_url,
+ defaultModel: resource.attributes.default_model ?? null,
+ businessContext: resource.attributes.business_context ?? "",
+ connected: resource.attributes.connected,
+ connectionLastCheckedAt: resource.attributes.connection_last_checked_at,
+ insertedAt: resource.attributes.inserted_at,
+ updatedAt: resource.attributes.updated_at,
+ };
+}
+
+export function mapLighthouseV2Provider(
+ resource: JsonApiResource<SupportedProviderAttributes>,
+): LighthouseV2SupportedProvider {
+ return {
+ id: normalizeLighthouseV2ProviderType(resource.id),
+ name: resource.attributes.name,
+ };
+}
+
+export function mapLighthouseV2Model(
+ resource: JsonApiResource<SupportedModelAttributes>,
+): LighthouseV2SupportedModel {
+ return {
+ id: resource.id,
+ name:
+ resource.attributes.model_name ?? resource.attributes.name ?? resource.id,
+ maxInputTokens: resource.attributes.max_input_tokens,
+ maxOutputTokens: resource.attributes.max_output_tokens,
+ supportsFunctionCalling: resource.attributes.supports_function_calling,
+ supportsVision: resource.attributes.supports_vision,
+ supportsReasoning: resource.attributes.supports_reasoning,
+ };
+}
+
+export function mapLighthouseV2Session(
+ resource: JsonApiResource<SessionAttributes>,
+): LighthouseV2Session {
+ return {
+ id: resource.id,
+ title: resource.attributes.title,
+ isArchived: resource.attributes.is_archived,
+ insertedAt: resource.attributes.inserted_at,
+ updatedAt: resource.attributes.updated_at,
+ };
+}
+
+export function mapLighthouseV2Message(
+ resource: JsonApiResource<MessageAttributes>,
+): LighthouseV2Message {
+ return {
+ id: resource.id,
+ role: resource.attributes.role,
+ model: resource.attributes.model,
+ tokenUsage: resource.attributes.token_usage,
+ insertedAt: resource.attributes.inserted_at,
+ parts: (resource.attributes.parts ?? []).map((part, index) =>
+ mapLighthouseV2Part(part, index),
+ ),
+ };
+}
+
+export function mapLighthouseV2Task(
+ resource: JsonApiResource<TaskAttributes>,
+): LighthouseV2Task {
+ return {
+ id: resource.id,
+ name: resource.attributes.name ?? null,
+ state: resource.attributes.state,
+ insertedAt: resource.attributes.inserted_at,
+ completedAt: resource.attributes.completed_at,
+ metadata: resource.attributes.metadata,
+ result: resource.attributes.result,
+ };
+}
+
+export function buildLighthouseV2ConfigurationPayload(
+ input: LighthouseV2ConfigurationInput,
+) {
+ return {
+ data: {
+ type: "lighthouse-ai-configurations",
+ attributes: filterUndefinedAttributes({
+ provider_type: toLighthouseV2ApiProviderType(input.providerType),
+ credentials: input.credentials,
+ base_url: input.baseUrl ?? null,
+ }),
+ },
+ };
+}
+
+export function buildLighthouseV2ConfigurationUpdatePayload(
+ configId: string,
+ input: LighthouseV2ConfigurationUpdateInput,
+) {
+ return {
+ data: {
+ type: "lighthouse-ai-configurations",
+ id: configId,
+ attributes: filterUndefinedAttributes({
+ credentials: input.credentials,
+ base_url: input.baseUrl,
+ default_model: input.defaultModel,
+ business_context: input.businessContext,
+ }),
+ },
+ };
+}
+
+export function buildLighthouseV2SessionCreatePayload(title?: string | null) {
+ return {
+ data: {
+ type: "lighthouse-sessions",
+ attributes: { title: title || null },
+ },
+ };
+}
+
+export function buildLighthouseV2SessionUpdatePayload(
+ sessionId: string,
+ attributes: { title?: string | null; isArchived?: boolean },
+) {
+ return {
+ data: {
+ type: "lighthouse-sessions",
+ id: sessionId,
+ attributes: filterUndefinedAttributes({
+ title: attributes.title,
+ is_archived: attributes.isArchived,
+ }),
+ },
+ };
+}
+
+export function buildLighthouseV2MessagePayload(input: {
+ text: string;
+ provider: LighthouseV2ProviderType;
+ model?: string | null;
+}) {
+ return {
+ data: {
+ type: "lighthouse-messages",
+ attributes: filterUndefinedAttributes({
+ parts: [
+ {
+ part_type: "text",
+ content: { text: input.text },
+ },
+ ],
+ provider: toLighthouseV2ApiProviderType(input.provider),
+ model: input.model || undefined,
+ }),
+ },
+ };
+}
+
+export function validateLighthouseV2ConfigurationInput(input: {
+ providerType: LighthouseV2ProviderType;
+ credentials?: LighthouseV2Credentials;
+ baseUrl?: string | null;
+}): ValidationResult {
+ if (!input.credentials) {
+ return { success: false, error: "Credentials are required." };
+ }
+
+ if (
+ input.providerType === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE &&
+ !input.baseUrl
+ ) {
+ return {
+ success: false,
+ error: "Base URL is required for OpenAI-compatible providers.",
+ };
+ }
+
+ if (
+ input.providerType !== LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE &&
+ input.baseUrl
+ ) {
+ return {
+ success: false,
+ error: "Base URL is only supported for OpenAI-compatible providers.",
+ };
+ }
+
+ if (
+ input.providerType === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK &&
+ !hasBedrockRegion(input.credentials)
+ ) {
+ return {
+ success: false,
+ error: "AWS region is required for Bedrock providers.",
+ };
+ }
+
+ return { success: true };
+}
+
+export function toLighthouseV2ApiProviderType(
+ providerType: LighthouseV2ProviderType,
+): LighthouseV2ApiProviderType {
+ switch (providerType) {
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI:
+ return LIGHTHOUSE_V2_API_PROVIDER_TYPE.OPENAI;
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK:
+ return LIGHTHOUSE_V2_API_PROVIDER_TYPE.BEDROCK;
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE:
+ return LIGHTHOUSE_V2_API_PROVIDER_TYPE.OPENAI_COMPATIBLE;
+ }
+}
+
+function mapLighthouseV2Part(
+ resource: UnknownPartResource,
+ index: number,
+): LighthouseV2Part {
+ const attributes = "attributes" in resource ? resource.attributes : resource;
+ // Persisted parts carry an id; streamed/id-less parts fall back to a stable
+ // per-message index so multiple id-less parts never collide on "" as a key.
+ const id =
+ ("id" in resource ? resource.id : attributes.id) ?? `part-${index}`;
+
+ return {
+ id,
+ type: attributes.part_type,
+ content: attributes.content,
+ toolCallOutcome: attributes.tool_call_outcome ?? null,
+ insertedAt: attributes.inserted_at ?? null,
+ updatedAt: attributes.updated_at ?? null,
+ };
+}
+
+function filterUndefinedAttributes<T extends Record<string, unknown>>(
+ attributes: T,
+) {
+ return Object.fromEntries(
+ Object.entries(attributes).filter(([, value]) => value !== undefined),
+ ) as Partial<T>;
+}
+
+function hasBedrockRegion(credentials: LighthouseV2Credentials): boolean {
+ return (
+ "aws_region_name" in credentials && Boolean(credentials.aws_region_name)
+ );
+}
+
+function normalizeLighthouseV2ProviderType(
+ providerType: string,
+): LighthouseV2ProviderType {
+ const normalized =
+ providerType === "openai_compatible"
+ ? LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE
+ : providerType;
+
+ // Validate at the adapter boundary so an unexpected backend id fails fast
+ // here instead of crossing into the UI as a bogus "valid" provider.
+ const allowed: readonly string[] = Object.values(LIGHTHOUSE_V2_PROVIDER_TYPE);
+ if (!allowed.includes(normalized)) {
+ throw new Error(`Unsupported Lighthouse v2 provider: ${providerType}`);
+ }
+
+ return normalized as LighthouseV2ProviderType;
+}
diff --git a/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.test.ts b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.test.ts
new file mode 100644
index 0000000000..bab81d7157
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const { authMock, revalidatePathMock } = vi.hoisted(() => ({
+ authMock: vi.fn(),
+ revalidatePathMock: vi.fn(),
+}));
+
+vi.mock("@/auth.config", () => ({ auth: authMock }));
+vi.mock("next/cache", () => ({ revalidatePath: revalidatePathMock }));
+vi.mock("@sentry/nextjs", () => ({
+ captureException: vi.fn(),
+ captureMessage: vi.fn(),
+}));
+// Provide the primitives the action AND the real handleApiResponse need, while
+// keeping the revalidate gate (the behavior under test) running for real.
+vi.mock("@/lib/helper", () => ({
+ apiBaseUrl: "https://api.example.com/api/v1",
+ getAuthHeaders: vi
+ .fn()
+ .mockResolvedValue({ Authorization: "Bearer token-123" }),
+ parseStringify: (value: unknown) => JSON.parse(JSON.stringify(value)),
+ getErrorMessage: (error: unknown) => String(error),
+ sanitizeErrorMessage: (message: string) => message,
+ GENERIC_SERVER_ERROR_MESSAGE: "Server error",
+}));
+
+import {
+ createLighthouseV2Session,
+ getLighthouseV2SupportedModels,
+ updateLighthouseV2Configuration,
+ updateLighthouseV2Session,
+} from "./lighthouse-v2";
+
+function sessionResponse(id = "session-1") {
+ return Response.json(
+ {
+ data: {
+ id,
+ type: "lighthouse-sessions",
+ attributes: {
+ title: "Summarize findings",
+ is_archived: false,
+ inserted_at: "2026-06-25T10:00:00Z",
+ updated_at: "2026-06-25T10:00:00Z",
+ active_celery_task_id: null,
+ },
+ },
+ },
+ { status: 201 },
+ );
+}
+
+function configurationResponse(id = "config-1") {
+ return Response.json(
+ {
+ data: {
+ id,
+ type: "lighthouse-ai-configurations",
+ attributes: {
+ provider_type: "bedrock",
+ base_url: null,
+ default_model: "anthropic.claude-4",
+ business_context: "Production tenant",
+ connected: true,
+ connection_last_checked_at: "2026-06-25T10:00:00Z",
+ inserted_at: "2026-06-25T09:00:00Z",
+ updated_at: "2026-06-25T10:00:00Z",
+ },
+ },
+ },
+ { status: 200 },
+ );
+}
+
+function modelsResponse() {
+ return Response.json({ data: [] }, { status: 200 });
+}
+
+describe("Lighthouse v2 session write actions", () => {
+ beforeEach(() => {
+ authMock.mockResolvedValue({ accessToken: "token-123" });
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ vi.clearAllMocks();
+ });
+
+ it("does NOT revalidate /lighthouse when creating a session (avoids chat remount)", async () => {
+ vi.stubGlobal("fetch", vi.fn().mockResolvedValue(sessionResponse()));
+
+ const result = await createLighthouseV2Session("Summarize findings");
+
+ expect("data" in result && result.data.id).toBe("session-1");
+ // Revalidating the active force-dynamic route would remount the chat and
+ // kill the live EventSource — so it must stay off for session creation.
+ expect(revalidatePathMock).not.toHaveBeenCalled();
+ });
+
+ it("still revalidates /lighthouse for other session writes (regression contrast)", async () => {
+ vi.stubGlobal("fetch", vi.fn().mockResolvedValue(sessionResponse()));
+
+ await updateLighthouseV2Session("session-1", { title: "Renamed" });
+
+ // Proves the test harness would catch a revalidate being (re)introduced.
+ expect(revalidatePathMock).toHaveBeenCalledWith("/lighthouse");
+ });
+
+ it("persists the chosen model as the provider default without remounting the active chat", async () => {
+ // Given
+ const fetchMock = vi.fn().mockResolvedValue(configurationResponse());
+ vi.stubGlobal("fetch", fetchMock);
+
+ // When
+ const result = await updateLighthouseV2Configuration("config-1", {
+ defaultModel: "anthropic.claude-4",
+ });
+
+ // Then
+ expect("data" in result && result.data.defaultModel).toBe(
+ "anthropic.claude-4",
+ );
+ expect(fetchMock).toHaveBeenCalledWith(
+ new URL("https://api.example.com/api/v1/lighthouse/config/config-1"),
+ expect.objectContaining({
+ method: "PATCH",
+ body: JSON.stringify({
+ data: {
+ type: "lighthouse-ai-configurations",
+ id: "config-1",
+ attributes: { default_model: "anthropic.claude-4" },
+ },
+ }),
+ }),
+ );
+ // Revalidating the active force-dynamic chat route would remount it and kill
+ // the live EventSource — only the settings route may be revalidated.
+ expect(revalidatePathMock).not.toHaveBeenCalledWith("/lighthouse");
+ expect(revalidatePathMock).toHaveBeenCalledWith("/lighthouse/settings");
+ });
+
+ it("loads OpenAI-compatible models using the Cloud provider id", async () => {
+ // Given
+ const fetchMock = vi.fn().mockResolvedValue(modelsResponse());
+ vi.stubGlobal("fetch", fetchMock);
+
+ // When
+ const result = await getLighthouseV2SupportedModels("openai-compatible");
+
+ // Then
+ expect("data" in result && result.data).toEqual([]);
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.example.com/api/v1/lighthouse/supported-providers/openai_compatible/models",
+ expect.objectContaining({
+ method: "GET",
+ }),
+ );
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.ts b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.ts
new file mode 100644
index 0000000000..c78233b35f
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.ts
@@ -0,0 +1,372 @@
+"use server";
+
+import { pollTaskUntilSettled } from "@/actions/task/poll";
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2ConfigurationInput,
+ LighthouseV2ConfigurationUpdateInput,
+ LighthouseV2Message,
+ LighthouseV2ProviderType,
+ LighthouseV2SendMessageInput,
+ LighthouseV2SendMessageResult,
+ LighthouseV2Session,
+ LighthouseV2SupportedModel,
+ LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
+import type { JsonApiDocument } from "@/types/jsonapi";
+import type { ServerActionResult } from "@/types/server-actions";
+
+import {
+ buildLighthouseV2ConfigurationPayload,
+ buildLighthouseV2ConfigurationUpdatePayload,
+ buildLighthouseV2MessagePayload,
+ buildLighthouseV2SessionCreatePayload,
+ buildLighthouseV2SessionUpdatePayload,
+ getJsonApiArray,
+ mapLighthouseV2Configuration,
+ mapLighthouseV2Message,
+ mapLighthouseV2Model,
+ mapLighthouseV2Provider,
+ mapLighthouseV2Session,
+ mapLighthouseV2Task,
+ toLighthouseV2ApiProviderType,
+ validateLighthouseV2ConfigurationInput,
+} from "./lighthouse-v2.adapter";
+
+type TaskResource = Parameters<typeof mapLighthouseV2Task>[0];
+
+export type LighthouseV2ActionResult<T> = ServerActionResult<T>;
+
+const CONFIG_ENDPOINT = "/lighthouse/config";
+const SESSIONS_ENDPOINT = "/lighthouse/sessions";
+const SUPPORTED_PROVIDERS_ENDPOINT = "/lighthouse/supported-providers";
+
+// 20 attempts x 3s: ~60s ceiling for the provider connection-check task.
+const CONNECTION_TEST_MAX_ATTEMPTS = 20;
+const CONNECTION_TEST_DELAY_MS = 3000;
+
+export async function getLighthouseV2Configurations(): Promise<
+ LighthouseV2ActionResult<LighthouseV2Configuration[]>
+> {
+ return getCollection(CONFIG_ENDPOINT, mapLighthouseV2Configuration);
+}
+
+export async function createLighthouseV2Configuration(
+ input: LighthouseV2ConfigurationInput,
+): Promise<LighthouseV2ActionResult<LighthouseV2Configuration>> {
+ const validation = validateLighthouseV2ConfigurationInput(input);
+ if (!validation.success) {
+ return { error: validation.error, status: 400 };
+ }
+
+ return mutateSingle(
+ CONFIG_ENDPOINT,
+ {
+ method: "POST",
+ body: JSON.stringify(buildLighthouseV2ConfigurationPayload(input)),
+ },
+ mapLighthouseV2Configuration,
+ LIGHTHOUSE_ROUTE.SETTINGS,
+ );
+}
+
+export async function updateLighthouseV2Configuration(
+ configId: string,
+ input: LighthouseV2ConfigurationUpdateInput,
+): Promise<LighthouseV2ActionResult<LighthouseV2Configuration>> {
+ return mutateSingle(
+ `${CONFIG_ENDPOINT}/${encodeURIComponent(configId)}`,
+ {
+ method: "PATCH",
+ body: JSON.stringify(
+ buildLighthouseV2ConfigurationUpdatePayload(configId, input),
+ ),
+ },
+ mapLighthouseV2Configuration,
+ LIGHTHOUSE_ROUTE.SETTINGS,
+ );
+}
+
+export async function deleteLighthouseV2Configuration(
+ configId: string,
+): Promise<LighthouseV2ActionResult<true>> {
+ return mutateEmpty(
+ `${CONFIG_ENDPOINT}/${encodeURIComponent(configId)}`,
+ { method: "DELETE" },
+ LIGHTHOUSE_ROUTE.SETTINGS,
+ );
+}
+
+// Starts the backend connection-check task, polls it to completion (reusing the
+// shared task poller), then returns the re-fetched configuration so the caller
+// can render the authoritative `connected` / `connectionLastCheckedAt` status.
+export async function testLighthouseV2ConfigurationConnection(
+ configId: string,
+): Promise<LighthouseV2ActionResult<LighthouseV2Configuration>> {
+ try {
+ const response = await fetch(
+ buildApiUrl(
+ `${CONFIG_ENDPOINT}/${encodeURIComponent(configId)}/connection`,
+ ),
+ { method: "POST", headers: await getAuthHeaders({ contentType: false }) },
+ );
+ const document = (await handleApiResponse(
+ response,
+ )) as JsonApiDocument<TaskResource>;
+ if (isErrorDocument(document) || !document.data) {
+ return toErrorResult(document);
+ }
+
+ const settled = await pollTaskUntilSettled(
+ mapLighthouseV2Task(document.data).id,
+ {
+ maxAttempts: CONNECTION_TEST_MAX_ATTEMPTS,
+ delayMs: CONNECTION_TEST_DELAY_MS,
+ },
+ );
+ if (!settled.ok) {
+ return { error: settled.error || "Connection test timed out." };
+ }
+
+ const configurations = await getLighthouseV2Configurations();
+ if ("error" in configurations) {
+ return configurations;
+ }
+ const updated = configurations.data.find(
+ (config) => config.id === configId,
+ );
+ if (!updated) {
+ return { error: "Configuration not found after connection test." };
+ }
+ return { data: updated };
+ } catch (error) {
+ return handleApiError(error);
+ }
+}
+
+export async function getLighthouseV2SupportedProviders(): Promise<
+ LighthouseV2ActionResult<LighthouseV2SupportedProvider[]>
+> {
+ return getCollection(SUPPORTED_PROVIDERS_ENDPOINT, mapLighthouseV2Provider);
+}
+
+export async function getLighthouseV2SupportedModels(
+ provider: LighthouseV2ProviderType,
+): Promise<LighthouseV2ActionResult<LighthouseV2SupportedModel[]>> {
+ return getCollection(
+ `${SUPPORTED_PROVIDERS_ENDPOINT}/${encodeURIComponent(toLighthouseV2ApiProviderType(provider))}/models`,
+ mapLighthouseV2Model,
+ );
+}
+
+export async function getLighthouseV2Sessions(): Promise<
+ LighthouseV2ActionResult<LighthouseV2Session[]>
+> {
+ return getCollection(SESSIONS_ENDPOINT, mapLighthouseV2Session);
+}
+
+export async function createLighthouseV2Session(
+ title?: string | null,
+): Promise<LighthouseV2ActionResult<LighthouseV2Session>> {
+ // Intentionally NOT revalidating "/lighthouse": the page is force-dynamic
+ // (nothing to revalidate) and revalidating the active route mid-submit would
+ // re-run the server component and remount the chat, killing the live stream.
+ // The sidebar refreshes client-side via notifyLighthouseV2SessionsChanged().
+ return mutateSingle(
+ SESSIONS_ENDPOINT,
+ {
+ method: "POST",
+ body: JSON.stringify(buildLighthouseV2SessionCreatePayload(title)),
+ },
+ mapLighthouseV2Session,
+ "",
+ );
+}
+
+export async function updateLighthouseV2Session(
+ sessionId: string,
+ attributes: { title?: string | null; isArchived?: boolean },
+): Promise<LighthouseV2ActionResult<LighthouseV2Session>> {
+ return mutateSingle(
+ `${SESSIONS_ENDPOINT}/${encodeURIComponent(sessionId)}`,
+ {
+ method: "PATCH",
+ body: JSON.stringify(
+ buildLighthouseV2SessionUpdatePayload(sessionId, attributes),
+ ),
+ },
+ mapLighthouseV2Session,
+ LIGHTHOUSE_ROUTE.CHAT,
+ );
+}
+
+export async function archiveLighthouseV2Session(
+ sessionId: string,
+): Promise<LighthouseV2ActionResult<LighthouseV2Session>> {
+ return updateLighthouseV2Session(sessionId, { isArchived: true });
+}
+
+export async function getLighthouseV2Messages(
+ sessionId: string,
+): Promise<LighthouseV2ActionResult<LighthouseV2Message[]>> {
+ return getCollection(
+ `${SESSIONS_ENDPOINT}/${encodeURIComponent(sessionId)}/messages`,
+ mapLighthouseV2Message,
+ );
+}
+
+export async function sendLighthouseV2Message(
+ input: LighthouseV2SendMessageInput,
+): Promise<LighthouseV2ActionResult<LighthouseV2SendMessageResult>> {
+ try {
+ const response = await fetch(
+ buildApiUrl(
+ `${SESSIONS_ENDPOINT}/${encodeURIComponent(input.sessionId)}/messages`,
+ ),
+ {
+ method: "POST",
+ headers: await getAuthHeaders({ contentType: true }),
+ body: JSON.stringify(buildLighthouseV2MessagePayload(input)),
+ },
+ );
+ const document = (await handleApiResponse(
+ response,
+ )) as JsonApiDocument<TaskResource>;
+
+ if (isErrorDocument(document) || !document.data) {
+ return toErrorResult(document);
+ }
+
+ return {
+ data: {
+ task: mapLighthouseV2Task(document.data),
+ },
+ meta: document.meta,
+ };
+ } catch (error) {
+ return handleApiError(error);
+ }
+}
+
+async function getCollection<TResource, TOutput>(
+ path: string,
+ mapper: (resource: TResource) => TOutput,
+): Promise<LighthouseV2ActionResult<TOutput[]>> {
+ return getCollectionFromUrl(buildApiUrl(path), mapper);
+}
+
+async function getCollectionFromUrl<TResource, TOutput>(
+ url: URL,
+ mapper: (resource: TResource) => TOutput,
+): Promise<LighthouseV2ActionResult<TOutput[]>> {
+ try {
+ const headers = await getAuthHeaders({ contentType: false });
+ const first = (await handleApiResponse(
+ await fetch(url.toString(), {
+ method: "GET",
+ headers,
+ cache: "no-store",
+ }),
+ )) as JsonApiDocument<TResource[]>;
+
+ if (isErrorDocument(first)) {
+ return toErrorResult(first);
+ }
+
+ const resources = [...getJsonApiArray(first)];
+ let nextUrl: string | undefined = first.links?.next ?? undefined;
+ while (nextUrl) {
+ const page = (await handleApiResponse(
+ await fetch(nextUrl, { method: "GET", headers, cache: "no-store" }),
+ )) as JsonApiDocument<TResource[]>;
+ if (isErrorDocument(page)) {
+ return toErrorResult(page);
+ }
+ resources.push(...getJsonApiArray(page));
+ nextUrl = page.links?.next ?? undefined;
+ }
+
+ return {
+ data: resources.map(mapper),
+ meta: first.meta,
+ links: first.links,
+ };
+ } catch (error) {
+ return handleApiError(error);
+ }
+}
+
+async function mutateSingle<TResource, TOutput>(
+ path: string,
+ init: RequestInit,
+ mapper: (resource: TResource) => TOutput,
+ pathToRevalidate: string,
+ includeContentType = true,
+): Promise<LighthouseV2ActionResult<TOutput>> {
+ try {
+ const response = await fetch(buildApiUrl(path), {
+ ...init,
+ headers: await getAuthHeaders({ contentType: includeContentType }),
+ });
+ const document = (await handleApiResponse(
+ response,
+ pathToRevalidate,
+ )) as JsonApiDocument<TResource>;
+ if (isErrorDocument(document) || !document.data) {
+ return toErrorResult(document);
+ }
+ return { data: mapper(document.data), meta: document.meta };
+ } catch (error) {
+ return handleApiError(error);
+ }
+}
+
+async function mutateEmpty(
+ path: string,
+ init: RequestInit,
+ pathToRevalidate: string,
+): Promise<LighthouseV2ActionResult<true>> {
+ try {
+ const response = await fetch(buildApiUrl(path), {
+ ...init,
+ headers: await getAuthHeaders({ contentType: false }),
+ });
+ const document = await handleApiResponse(response, pathToRevalidate);
+ if (isErrorDocument(document)) {
+ return toErrorResult(document);
+ }
+ return { data: true, status: document.status };
+ } catch (error) {
+ return handleApiError(error);
+ }
+}
+
+function buildApiUrl(path: string): URL {
+ return new URL(`${getRequiredApiBaseUrl()}${path}`);
+}
+
+function getRequiredApiBaseUrl(): string {
+ if (!apiBaseUrl) {
+ throw new Error("API base URL is not configured.");
+ }
+ return apiBaseUrl;
+}
+
+function isErrorDocument<TData>(
+ document: JsonApiDocument<TData> | { error?: unknown },
+): document is JsonApiDocument<TData> & { error: string } {
+ return typeof document.error === "string";
+}
+
+function toErrorResult<TData>(
+ document: JsonApiDocument<TData>,
+): Extract<LighthouseV2ActionResult<never>, { error: string }> {
+ return {
+ error: document.error ?? "Unexpected Lighthouse AI response.",
+ errors: document.errors,
+ status: document.status,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/ai-elements/README.md b/ui/app/(prowler)/lighthouse/_components/ai-elements/README.md
new file mode 100644
index 0000000000..0030ddeb40
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/ai-elements/README.md
@@ -0,0 +1,7 @@
+# AI Elements
+
+Components vendored from Vercel's AI Elements registry
+(https://ai-sdk.dev/elements), adapted to this repo's shadcn imports and
+lint rules. They live in their own folder — same idea as `components/shadcn/`
+— so they can be diffed against upstream when updating instead of being mixed
+with hand-written chat UI, which lives in `../chat/`.
diff --git a/ui/app/(prowler)/lighthouse/_components/ai-elements/chain-of-thought.tsx b/ui/app/(prowler)/lighthouse/_components/ai-elements/chain-of-thought.tsx
new file mode 100644
index 0000000000..474fed577c
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/ai-elements/chain-of-thought.tsx
@@ -0,0 +1,239 @@
+"use client";
+
+import { useControllableState } from "@radix-ui/react-use-controllable-state";
+import {
+ BrainIcon,
+ ChevronDownIcon,
+ DotIcon,
+ type LucideIcon,
+} from "lucide-react";
+import type { ComponentProps, ReactNode } from "react";
+import { createContext, useContext } from "react";
+
+import { Badge } from "@/components/shadcn/badge/badge";
+import {
+ Collapsible,
+ CollapsibleContent,
+ CollapsibleTrigger,
+} from "@/components/shadcn/collapsible";
+import { cn } from "@/lib/utils";
+
+type ChainOfThoughtContextValue = {
+ isOpen: boolean;
+ setIsOpen: (open: boolean) => void;
+};
+
+const ChainOfThoughtContext = createContext<ChainOfThoughtContextValue | null>(
+ null,
+);
+
+const useChainOfThought = () => {
+ const context = useContext(ChainOfThoughtContext);
+ if (!context) {
+ throw new Error(
+ "ChainOfThought components must be used within ChainOfThought",
+ );
+ }
+ return context;
+};
+
+export type ChainOfThoughtProps = ComponentProps<"div"> & {
+ open?: boolean;
+ defaultOpen?: boolean;
+ onOpenChange?: (open: boolean) => void;
+};
+
+export function ChainOfThought({
+ className,
+ open,
+ defaultOpen = false,
+ onOpenChange,
+ children,
+ ...props
+}: ChainOfThoughtProps) {
+ const [isOpen, setIsOpen] = useControllableState({
+ prop: open,
+ defaultProp: defaultOpen,
+ onChange: onOpenChange,
+ });
+
+ const chainOfThoughtContext = { isOpen, setIsOpen };
+
+ // One Collapsible root wraps both header and content so CollapsibleTrigger and
+ // CollapsibleContent share Radix's ARIA/id wiring; the context only carries
+ // `isOpen` for presentational bits like the header chevron.
+ return (
+ <ChainOfThoughtContext.Provider value={chainOfThoughtContext}>
+ <Collapsible
+ open={isOpen}
+ onOpenChange={setIsOpen}
+ className={cn("not-prose w-full space-y-4", className)}
+ {...props}
+ >
+ {children}
+ </Collapsible>
+ </ChainOfThoughtContext.Provider>
+ );
+}
+
+export type ChainOfThoughtHeaderProps = ComponentProps<
+ typeof CollapsibleTrigger
+>;
+
+export function ChainOfThoughtHeader({
+ className,
+ children,
+ ...props
+}: ChainOfThoughtHeaderProps) {
+ const { isOpen } = useChainOfThought();
+
+ return (
+ <CollapsibleTrigger
+ className={cn(
+ "text-muted-foreground hover:text-foreground flex w-full items-center gap-2 text-sm transition-colors",
+ className,
+ )}
+ {...props}
+ >
+ <BrainIcon className="size-4" />
+ <span className="flex-1 text-left">{children ?? "Chain of Thought"}</span>
+ <ChevronDownIcon
+ className={cn(
+ "size-4 transition-transform",
+ isOpen ? "rotate-180" : "rotate-0",
+ )}
+ />
+ </CollapsibleTrigger>
+ );
+}
+
+export const CHAIN_OF_THOUGHT_STATUS = {
+ COMPLETE: "complete",
+ ACTIVE: "active",
+ PENDING: "pending",
+} as const;
+
+export type ChainOfThoughtStatus =
+ (typeof CHAIN_OF_THOUGHT_STATUS)[keyof typeof CHAIN_OF_THOUGHT_STATUS];
+
+export type ChainOfThoughtStepProps = ComponentProps<"div"> & {
+ icon?: LucideIcon;
+ label: ReactNode;
+ description?: ReactNode;
+ status?: ChainOfThoughtStatus;
+};
+
+export function ChainOfThoughtStep({
+ className,
+ icon: Icon = DotIcon,
+ label,
+ description,
+ status = CHAIN_OF_THOUGHT_STATUS.COMPLETE,
+ children,
+ ...props
+}: ChainOfThoughtStepProps) {
+ const statusStyles = {
+ complete: "text-muted-foreground",
+ active: "text-foreground",
+ pending: "text-muted-foreground/50",
+ };
+
+ return (
+ <div
+ className={cn(
+ "flex gap-2 text-sm",
+ statusStyles[status],
+ "fade-in-0 slide-in-from-top-2 animate-in",
+ className,
+ )}
+ {...props}
+ >
+ <div className="relative mt-0.5">
+ <Icon className="size-4" />
+ <div className="bg-border absolute top-7 bottom-0 left-1/2 -mx-px w-px" />
+ </div>
+ <div className="flex-1 space-y-2 overflow-hidden">
+ <div>{label}</div>
+ {description && (
+ <div className="text-muted-foreground text-xs">{description}</div>
+ )}
+ {children}
+ </div>
+ </div>
+ );
+}
+
+export type ChainOfThoughtSearchResultsProps = ComponentProps<"div">;
+
+export function ChainOfThoughtSearchResults({
+ className,
+ ...props
+}: ChainOfThoughtSearchResultsProps) {
+ return (
+ <div
+ className={cn("flex flex-wrap items-center gap-2", className)}
+ {...props}
+ />
+ );
+}
+
+export type ChainOfThoughtSearchResultProps = ComponentProps<typeof Badge>;
+
+export function ChainOfThoughtSearchResult({
+ className,
+ children,
+ ...props
+}: ChainOfThoughtSearchResultProps) {
+ return (
+ <Badge
+ className={cn("gap-1 px-2 py-0.5 text-xs font-normal", className)}
+ variant="secondary"
+ {...props}
+ >
+ {children}
+ </Badge>
+ );
+}
+
+export type ChainOfThoughtContentProps = ComponentProps<
+ typeof CollapsibleContent
+>;
+
+export function ChainOfThoughtContent({
+ className,
+ children,
+ ...props
+}: ChainOfThoughtContentProps) {
+ return (
+ <CollapsibleContent
+ className={cn(
+ "mt-2 space-y-3",
+ "data-[state=closed]:fade-out-0 data-[state=closed]:slide-out-to-top-2 data-[state=open]:slide-in-from-top-2 text-popover-foreground data-[state=closed]:animate-out data-[state=open]:animate-in outline-none",
+ className,
+ )}
+ {...props}
+ >
+ {children}
+ </CollapsibleContent>
+ );
+}
+
+export type ChainOfThoughtImageProps = ComponentProps<"div"> & {
+ caption?: string;
+};
+
+export function ChainOfThoughtImage({
+ className,
+ children,
+ caption,
+ ...props
+}: ChainOfThoughtImageProps) {
+ return (
+ <div className={cn("mt-2 space-y-2", className)} {...props}>
+ <div className="bg-muted relative flex max-h-[22rem] items-center justify-center overflow-hidden rounded-lg p-3">
+ {children}
+ </div>
+ {caption && <p className="text-muted-foreground text-xs">{caption}</p>}
+ </div>
+ );
+}
diff --git a/ui/components/ai-elements/conversation.tsx b/ui/app/(prowler)/lighthouse/_components/ai-elements/conversation.tsx
similarity index 73%
rename from ui/components/ai-elements/conversation.tsx
rename to ui/app/(prowler)/lighthouse/_components/ai-elements/conversation.tsx
index 44916f06d1..f1adfa3689 100644
--- a/ui/components/ai-elements/conversation.tsx
+++ b/ui/app/(prowler)/lighthouse/_components/ai-elements/conversation.tsx
@@ -19,19 +19,42 @@ export const Conversation = ({ className, ...props }: ConversationProps) => (
/>
);
-export type ConversationContentProps = ComponentProps<
- typeof StickToBottom.Content
->;
+type ConversationContentChildren =
+ | ReactNode
+ | ((context: ReturnType<typeof useStickToBottomContext>) => ReactNode);
+
+export type ConversationContentProps = Omit<
+ ComponentProps<"div">,
+ "children" | "ref"
+> & {
+ children?: ConversationContentChildren;
+ scrollClassName?: string;
+};
export const ConversationContent = ({
+ children,
className,
+ scrollClassName,
...props
-}: ConversationContentProps) => (
- <StickToBottom.Content
- className={cn("flex flex-col gap-8 p-4", className)}
- {...props}
- />
-);
+}: ConversationContentProps) => {
+ const context = useStickToBottomContext();
+ const { contentRef, scrollRef } = context;
+
+ return (
+ <div
+ ref={scrollRef}
+ className={cn("h-full min-h-0 w-full overflow-y-auto", scrollClassName)}
+ >
+ <div
+ ref={contentRef}
+ className={cn("flex flex-col gap-8 p-4", className)}
+ {...props}
+ >
+ {typeof children === "function" ? children(context) : children}
+ </div>
+ </div>
+ );
+};
export type ConversationEmptyStateProps = ComponentProps<"div"> & {
title?: string;
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/composer.tsx b/ui/app/(prowler)/lighthouse/_components/chat/composer.tsx
new file mode 100644
index 0000000000..b9f854dbdb
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/composer.tsx
@@ -0,0 +1,198 @@
+"use client";
+
+import { CornerDownLeft, Settings, TriangleAlert } from "lucide-react";
+import Link from "next/link";
+import { type ReactNode, type SubmitEvent, useRef } from "react";
+
+import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import { Button } from "@/components/shadcn/button/button";
+import { Spinner } from "@/components/shadcn/spinner/spinner";
+import { Textarea } from "@/components/shadcn/textarea/textarea";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+
+interface ChatComposerPanelProps {
+ feedback: string | null;
+ canRetry: boolean;
+ onRetry: () => void;
+ onDismissFeedback: () => void;
+ canSend: boolean;
+ input: string;
+ isStreaming: boolean;
+ modelSelector: ReactNode;
+ selectedConfigurationConnected: boolean;
+ onInputChange: (value: string) => void;
+ onSubmit: (event: SubmitEvent<HTMLFormElement>) => void;
+ onSubmitText: (text: string) => Promise<void>;
+}
+
+// Feedback banner + input, shared by the empty and active chat layouts so the
+// two branches can't drift apart.
+export function ChatComposerPanel({
+ feedback,
+ canRetry,
+ onRetry,
+ onDismissFeedback,
+ ...composerProps
+}: ChatComposerPanelProps) {
+ return (
+ <>
+ <ChatFeedbackBar
+ feedback={feedback}
+ canRetry={canRetry}
+ onRetry={onRetry}
+ onDismiss={onDismissFeedback}
+ />
+ <ChatComposer {...composerProps} />
+ </>
+ );
+}
+
+function ChatFeedbackBar({
+ feedback,
+ canRetry,
+ onRetry,
+ onDismiss,
+}: {
+ feedback: string | null;
+ canRetry: boolean;
+ onRetry: () => void;
+ onDismiss: () => void;
+}) {
+ if (!feedback) return null;
+
+ return (
+ <Alert variant="error" onClose={onDismiss} className="mb-3 pr-10">
+ <TriangleAlert />
+ <AlertDescription className="flex items-center justify-between gap-3">
+ <span>{feedback}</span>
+ {canRetry && (
+ <Button type="button" variant="outline" size="sm" onClick={onRetry}>
+ Retry
+ </Button>
+ )}
+ </AlertDescription>
+ </Alert>
+ );
+}
+
+interface ChatComposerProps {
+ canSend: boolean;
+ input: string;
+ isStreaming: boolean;
+ modelSelector: ReactNode;
+ selectedConfigurationConnected: boolean;
+ onInputChange: (value: string) => void;
+ onSubmit: (event: SubmitEvent<HTMLFormElement>) => void;
+ onSubmitText: (text: string) => Promise<void>;
+}
+
+function ChatComposer({
+ canSend,
+ input,
+ isStreaming,
+ selectedConfigurationConnected,
+ onInputChange,
+ modelSelector,
+ onSubmit,
+ onSubmitText,
+}: ChatComposerProps) {
+ const textareaRef = useRef<HTMLTextAreaElement>(null);
+
+ useMountEffect(() => {
+ textareaRef.current?.focus();
+ });
+
+ return (
+ <form
+ className="border-border-neutral-secondary bg-bg-neutral-tertiary has-[textarea:focus]:border-border-input-primary-press flex min-h-[150px] w-full flex-col overflow-hidden rounded-[8px] border shadow-xs transition-all"
+ onSubmit={onSubmit}
+ >
+ <Textarea
+ ref={textareaRef}
+ aria-label="Message"
+ value={input}
+ onChange={(event) => onInputChange(event.target.value)}
+ // Typing stays available while a response streams (sending is what is
+ // gated, via canSend); only a disconnected provider blocks the input.
+ disabled={!selectedConfigurationConnected}
+ placeholder={
+ selectedConfigurationConnected
+ ? "Ask a question"
+ : "Connect a provider first"
+ }
+ variant="soft"
+ textareaSize="lg"
+ className="min-h-[104px] flex-1"
+ onKeyDown={(event) => {
+ // Ignore Enter while an IME composition is active so confirming an
+ // East Asian candidate doesn't submit the message prematurely.
+ if (
+ event.key === "Enter" &&
+ !event.shiftKey &&
+ !event.nativeEvent.isComposing
+ ) {
+ event.preventDefault();
+ void onSubmitText(input);
+ }
+ }}
+ />
+ <div className="flex items-center justify-between gap-3 px-3 pb-3">
+ <div className="flex min-w-0 flex-1 items-center gap-2">
+ <Button type="button" variant="outline" size="icon-sm" asChild>
+ <Link
+ href={LIGHTHOUSE_ROUTE.SETTINGS}
+ aria-label="Lighthouse AI settings"
+ >
+ <Settings className="size-4" />
+ </Link>
+ </Button>
+ {modelSelector}
+ </div>
+ {isStreaming ? (
+ <div
+ className="flex size-8 items-center justify-center"
+ role="status"
+ aria-label="Generating response"
+ >
+ <Spinner className="size-4" />
+ </div>
+ ) : (
+ <ChatSendButton canSend={canSend} hasText={input.trim().length > 0} />
+ )}
+ </div>
+ </form>
+ );
+}
+
+function ChatSendButton({
+ canSend,
+ hasText,
+}: {
+ canSend: boolean;
+ hasText: boolean;
+}) {
+ const sendButton = (
+ <Button type="submit" size="icon-sm" disabled={!canSend || !hasText}>
+ <CornerDownLeft className="size-4" />
+ </Button>
+ );
+
+ if (canSend && !hasText) {
+ return (
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <span className="inline-flex cursor-not-allowed">{sendButton}</span>
+ </TooltipTrigger>
+ <TooltipContent side="top">Type something</TooltipContent>
+ </Tooltip>
+ );
+ }
+
+ return sendButton;
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text-hooks.ts b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text-hooks.ts
new file mode 100644
index 0000000000..ff039329e1
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text-hooks.ts
@@ -0,0 +1,374 @@
+import { useEffect, useRef, useState } from "react";
+
+export const REVEAL_DIRECTION = {
+ START: "start",
+ END: "end",
+ CENTER: "center",
+} as const;
+
+export const DECRYPTED_TEXT_ANIMATE_ON = {
+ VIEW: "view",
+ HOVER: "hover",
+ IN_VIEW_HOVER: "inViewHover",
+ CLICK: "click",
+} as const;
+
+export const DECRYPTED_TEXT_CLICK_MODE = {
+ ONCE: "once",
+ TOGGLE: "toggle",
+} as const;
+
+const DIRECTION = {
+ FORWARD: "forward",
+ REVERSE: "reverse",
+} as const;
+
+export type RevealDirection =
+ (typeof REVEAL_DIRECTION)[keyof typeof REVEAL_DIRECTION];
+export type DecryptedTextAnimateOn =
+ (typeof DECRYPTED_TEXT_ANIMATE_ON)[keyof typeof DECRYPTED_TEXT_ANIMATE_ON];
+export type DecryptedTextClickMode =
+ (typeof DECRYPTED_TEXT_CLICK_MODE)[keyof typeof DECRYPTED_TEXT_CLICK_MODE];
+
+export const DEFAULT_CHARACTERS =
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!@#$%^&*()_+";
+
+interface DecryptedTextControllerOptions {
+ text: string;
+ speed: number;
+ maxIterations: number;
+ sequential: boolean;
+ revealDirection: RevealDirection;
+ useOriginalCharsOnly: boolean;
+ characters: string;
+ animateOn: DecryptedTextAnimateOn;
+ clickMode: DecryptedTextClickMode;
+}
+
+type Direction = (typeof DIRECTION)[keyof typeof DIRECTION];
+
+function buildPool(
+ text: string,
+ characters: string,
+ useOriginalCharsOnly: boolean,
+): string[] {
+ return useOriginalCharsOnly
+ ? Array.from(new Set(text.split(""))).filter((char) => char !== " ")
+ : characters.split("");
+}
+
+function shuffleText(
+ originalText: string,
+ revealed: Set<number>,
+ pool: string[],
+): string {
+ return originalText
+ .split("")
+ .map((char, i) => {
+ if (char === " ") return " ";
+ if (revealed.has(i)) return originalText[i];
+ return pool[Math.floor(Math.random() * pool.length)];
+ })
+ .join("");
+}
+
+function computeOrder(len: number, revealDirection: RevealDirection): number[] {
+ const order: number[] = [];
+ if (len <= 0) return order;
+ if (revealDirection === "start") {
+ for (let i = 0; i < len; i++) order.push(i);
+ return order;
+ }
+ if (revealDirection === "end") {
+ for (let i = len - 1; i >= 0; i--) order.push(i);
+ return order;
+ }
+ const middle = Math.floor(len / 2);
+ let offset = 0;
+ while (order.length < len) {
+ if (offset % 2 === 0) {
+ const idx = middle + offset / 2;
+ if (idx >= 0 && idx < len) order.push(idx);
+ } else {
+ const idx = middle - Math.ceil(offset / 2);
+ if (idx >= 0 && idx < len) order.push(idx);
+ }
+ offset++;
+ }
+ return order.slice(0, len);
+}
+
+function fillAllIndices(len: number): Set<number> {
+ const s = new Set<number>();
+ for (let i = 0; i < len; i++) s.add(i);
+ return s;
+}
+
+function removeRandomIndices(set: Set<number>, count: number): Set<number> {
+ const arr = Array.from(set);
+ for (let i = 0; i < count && arr.length > 0; i++) {
+ const idx = Math.floor(Math.random() * arr.length);
+ arr.splice(idx, 1);
+ }
+ return new Set(arr);
+}
+
+export function useDecryptedTextController({
+ text,
+ speed,
+ maxIterations,
+ sequential,
+ revealDirection,
+ useOriginalCharsOnly,
+ characters,
+ animateOn,
+ clickMode,
+}: DecryptedTextControllerOptions) {
+ const [displayText, setDisplayText] = useState<string>(text);
+ const [isAnimating, setIsAnimating] = useState<boolean>(false);
+ const [revealedIndices, setRevealedIndices] = useState<Set<number>>(
+ new Set(),
+ );
+ const [hasAnimated, setHasAnimated] = useState<boolean>(false);
+ const [isDecrypted, setIsDecrypted] = useState<boolean>(
+ animateOn !== "click",
+ );
+ const [direction, setDirection] = useState<Direction>(DIRECTION.FORWARD);
+
+ const containerRef = useRef<HTMLSpanElement>(null);
+ const orderRef = useRef<number[]>([]);
+ const pointerRef = useRef<number>(0);
+ const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null);
+
+ const pool = buildPool(text, characters, useOriginalCharsOnly);
+
+ const triggerDecrypt = () => {
+ if (sequential) {
+ orderRef.current = computeOrder(text.length, revealDirection);
+ pointerRef.current = 0;
+ }
+ setRevealedIndices(new Set());
+ setDirection(DIRECTION.FORWARD);
+ setIsAnimating(true);
+ };
+
+ const triggerReverse = () => {
+ if (sequential) {
+ orderRef.current = computeOrder(text.length, revealDirection)
+ .slice()
+ .reverse();
+ pointerRef.current = 0;
+ }
+ setRevealedIndices(fillAllIndices(text.length));
+ setDisplayText(shuffleText(text, fillAllIndices(text.length), pool));
+ setDirection(DIRECTION.REVERSE);
+ setIsAnimating(true);
+ };
+
+ useEffect(() => {
+ if (!isAnimating) return;
+
+ let currentIteration = 0;
+ const effectPool = buildPool(text, characters, useOriginalCharsOnly);
+
+ const getNextIndex = (revealedSet: Set<number>): number => {
+ const textLength = text.length;
+ switch (revealDirection) {
+ case "start":
+ return revealedSet.size;
+ case "end":
+ return textLength - 1 - revealedSet.size;
+ case "center": {
+ const middle = Math.floor(textLength / 2);
+ const offset = Math.floor(revealedSet.size / 2);
+ const nextIndex =
+ revealedSet.size % 2 === 0 ? middle + offset : middle - offset - 1;
+
+ if (
+ nextIndex >= 0 &&
+ nextIndex < textLength &&
+ !revealedSet.has(nextIndex)
+ ) {
+ return nextIndex;
+ }
+ for (let i = 0; i < textLength; i++) {
+ if (!revealedSet.has(i)) return i;
+ }
+ return 0;
+ }
+ default:
+ return revealedSet.size;
+ }
+ };
+
+ intervalRef.current = setInterval(() => {
+ setRevealedIndices((prevRevealed) => {
+ if (sequential) {
+ if (direction === DIRECTION.FORWARD) {
+ if (prevRevealed.size < text.length) {
+ const nextIndex = getNextIndex(prevRevealed);
+ const newRevealed = new Set(prevRevealed);
+ newRevealed.add(nextIndex);
+ setDisplayText(shuffleText(text, newRevealed, effectPool));
+ return newRevealed;
+ }
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setIsDecrypted(true);
+ return prevRevealed;
+ }
+ if (pointerRef.current < orderRef.current.length) {
+ const idxToRemove = orderRef.current[pointerRef.current++];
+ const newRevealed = new Set(prevRevealed);
+ newRevealed.delete(idxToRemove);
+ setDisplayText(shuffleText(text, newRevealed, effectPool));
+ if (newRevealed.size === 0) {
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setIsDecrypted(false);
+ }
+ return newRevealed;
+ }
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setIsDecrypted(false);
+ return prevRevealed;
+ }
+
+ if (direction === DIRECTION.FORWARD) {
+ setDisplayText(shuffleText(text, prevRevealed, effectPool));
+ currentIteration++;
+ if (currentIteration >= maxIterations) {
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setDisplayText(text);
+ setIsDecrypted(true);
+ }
+ return prevRevealed;
+ }
+
+ const currentSet =
+ prevRevealed.size === 0 ? fillAllIndices(text.length) : prevRevealed;
+ const removeCount = Math.max(
+ 1,
+ Math.ceil(text.length / Math.max(1, maxIterations)),
+ );
+ const nextSet = removeRandomIndices(currentSet, removeCount);
+ setDisplayText(shuffleText(text, nextSet, effectPool));
+ currentIteration++;
+ if (nextSet.size === 0 || currentIteration >= maxIterations) {
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setIsDecrypted(false);
+ setDisplayText(shuffleText(text, new Set(), effectPool));
+ return new Set();
+ }
+ return nextSet;
+ });
+ }, speed);
+
+ return () => clearInterval(intervalRef.current ?? undefined);
+ }, [
+ isAnimating,
+ text,
+ speed,
+ maxIterations,
+ sequential,
+ revealDirection,
+ direction,
+ characters,
+ useOriginalCharsOnly,
+ ]);
+
+ const handleClick = () => {
+ if (animateOn !== "click") return;
+
+ if (clickMode === "once") {
+ if (isDecrypted) return;
+ triggerDecrypt();
+ }
+
+ if (clickMode === "toggle") {
+ if (isDecrypted) {
+ triggerReverse();
+ } else {
+ triggerDecrypt();
+ }
+ }
+ };
+
+ const triggerHoverDecrypt = () => {
+ if (isAnimating) return;
+ setRevealedIndices(new Set());
+ setIsDecrypted(false);
+ setDisplayText(text);
+ setDirection(DIRECTION.FORWARD);
+ setIsAnimating(true);
+ };
+
+ const resetToPlainText = () => {
+ clearInterval(intervalRef.current ?? undefined);
+ setIsAnimating(false);
+ setRevealedIndices(new Set());
+ setDisplayText(text);
+ setIsDecrypted(true);
+ setDirection(DIRECTION.FORWARD);
+ };
+
+ useEffect(() => {
+ if (animateOn !== "view" && animateOn !== "inViewHover") return;
+ if (typeof IntersectionObserver === "undefined") return;
+
+ const observer = new IntersectionObserver(
+ (entries) => {
+ entries.forEach((entry) => {
+ if (entry.isIntersecting && !hasAnimated) {
+ if (sequential) {
+ orderRef.current = computeOrder(text.length, revealDirection);
+ pointerRef.current = 0;
+ }
+ setRevealedIndices(new Set());
+ setDirection(DIRECTION.FORWARD);
+ setIsAnimating(true);
+ setHasAnimated(true);
+ }
+ });
+ },
+ { root: null, rootMargin: "0px", threshold: 0.1 },
+ );
+
+ const currentRef = containerRef.current;
+ if (currentRef) observer.observe(currentRef);
+
+ return () => {
+ if (currentRef) observer.unobserve(currentRef);
+ };
+ }, [animateOn, hasAnimated, sequential, text, revealDirection]);
+
+ useEffect(() => {
+ if (animateOn === "click") {
+ const emptySet = new Set<number>();
+ setRevealedIndices(emptySet);
+ setDisplayText(
+ shuffleText(text, emptySet, buildPool(text, characters, false)),
+ );
+ setIsDecrypted(false);
+ } else {
+ setRevealedIndices(new Set());
+ setDisplayText(text);
+ setIsDecrypted(true);
+ }
+ setDirection(DIRECTION.FORWARD);
+ }, [animateOn, text, characters]);
+
+ return {
+ containerRef,
+ displayText,
+ handleClick,
+ isAnimating,
+ isDecrypted,
+ resetToPlainText,
+ revealedIndices,
+ triggerHoverDecrypt,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.test.tsx b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.test.tsx
new file mode 100644
index 0000000000..3ff46d0690
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.test.tsx
@@ -0,0 +1,23 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { DecryptedText } from "./decrypted-text";
+
+describe("DecryptedText", () => {
+ it("keeps the accessible text stable while the visible text is encrypted", async () => {
+ // Given / When
+ const { container } = render(
+ <DecryptedText text="Secret Text" animateOn="click" characters="X" />,
+ );
+
+ // Then
+ await waitFor(() =>
+ expect(container.querySelector('[aria-hidden="true"]')).toHaveTextContent(
+ "XXXXXX XXXX",
+ ),
+ );
+ expect(
+ screen.getByText("Secret Text", { selector: ".sr-only" }),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.tsx b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.tsx
new file mode 100644
index 0000000000..43e95966fe
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/decrypted-text.tsx
@@ -0,0 +1,102 @@
+"use client";
+
+import { type HTMLMotionProps, motion } from "framer-motion";
+
+import { cn } from "@/lib/utils";
+
+import {
+ type DecryptedTextAnimateOn,
+ type DecryptedTextClickMode,
+ DEFAULT_CHARACTERS,
+ type RevealDirection,
+ useDecryptedTextController,
+} from "./decrypted-text-hooks";
+
+interface DecryptedTextProps extends HTMLMotionProps<"span"> {
+ text: string;
+ speed?: number;
+ maxIterations?: number;
+ sequential?: boolean;
+ revealDirection?: RevealDirection;
+ useOriginalCharsOnly?: boolean;
+ characters?: string;
+ className?: string;
+ encryptedClassName?: string;
+ parentClassName?: string;
+ animateOn?: DecryptedTextAnimateOn;
+ clickMode?: DecryptedTextClickMode;
+}
+
+// Ported from reactbits DecryptedText, adapted to Prowler conventions:
+// framer-motion import, no useMemo/useCallback (React Compiler), pure helpers
+// hoisted to module scope, and IntersectionObserver guarded for SSR/test safety.
+export function DecryptedText({
+ text,
+ speed = 50,
+ maxIterations = 10,
+ sequential = false,
+ revealDirection = "start",
+ useOriginalCharsOnly = false,
+ characters = DEFAULT_CHARACTERS,
+ className = "",
+ parentClassName = "",
+ encryptedClassName = "",
+ animateOn = "hover",
+ clickMode = "once",
+ ...props
+}: DecryptedTextProps) {
+ const {
+ containerRef,
+ displayText,
+ handleClick,
+ isAnimating,
+ isDecrypted,
+ resetToPlainText,
+ revealedIndices,
+ triggerHoverDecrypt,
+ } = useDecryptedTextController({
+ text,
+ speed,
+ maxIterations,
+ sequential,
+ revealDirection,
+ useOriginalCharsOnly,
+ characters,
+ animateOn,
+ clickMode,
+ });
+
+ const animateProps =
+ animateOn === "hover" || animateOn === "inViewHover"
+ ? { onMouseEnter: triggerHoverDecrypt, onMouseLeave: resetToPlainText }
+ : animateOn === "click"
+ ? { onClick: handleClick }
+ : {};
+
+ return (
+ <motion.span
+ ref={containerRef}
+ className={cn("inline-block whitespace-pre-wrap", parentClassName)}
+ {...animateProps}
+ {...props}
+ >
+ <span className="sr-only">{text}</span>
+
+ <span aria-hidden="true">
+ {displayText.split("").map((char, index) => {
+ const isRevealedOrDone =
+ revealedIndices.has(index) || (!isAnimating && isDecrypted);
+
+ return (
+ <span
+ key={index}
+ className={isRevealedOrDone ? className : encryptedClassName}
+ >
+ {char}
+ </span>
+ );
+ })}
+ </span>
+ </motion.span>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/empty-state.tsx b/ui/app/(prowler)/lighthouse/_components/chat/empty-state.tsx
new file mode 100644
index 0000000000..b84c71b3b7
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/empty-state.tsx
@@ -0,0 +1,133 @@
+"use client";
+
+import { Cloud, FileCheck2, Network, ShieldAlert } from "lucide-react";
+import { type ReactNode, type SubmitEvent } from "react";
+
+import { LighthouseIconWithAura } from "@/components/icons";
+import { Button } from "@/components/shadcn/button/button";
+import { cn } from "@/lib/utils";
+
+import { ChatComposerPanel } from "./composer";
+import { DecryptedText } from "./decrypted-text";
+
+const LIGHTHOUSE_V2_SUGGESTIONS = [
+ {
+ label: "Critical findings",
+ prompt: "Summarize my most critical open findings and what to fix first.",
+ icon: ShieldAlert,
+ },
+ {
+ label: "Compliance gaps",
+ prompt: "What are my highest-impact compliance gaps right now?",
+ icon: FileCheck2,
+ },
+ {
+ label: "Attack paths",
+ prompt: "Find risky attack paths and explain the exposure.",
+ icon: Network,
+ },
+ {
+ label: "How can I onboard to my AWS account?",
+ prompt: "How can I onboard to my AWS account?",
+ icon: Cloud,
+ },
+] as const;
+
+interface ChatEmptyStateProps {
+ feedback: string | null;
+ canRetry: boolean;
+ onRetry: () => void;
+ onDismissFeedback: () => void;
+ canSend: boolean;
+ input: string;
+ isStreaming: boolean;
+ modelSelector: ReactNode;
+ selectedConfigurationConnected: boolean;
+ onInputChange: (value: string) => void;
+ onSubmit: (event: SubmitEvent<HTMLFormElement>) => void;
+ onSubmitText: (text: string) => Promise<void>;
+ footer?: ReactNode;
+ // Side-panel variant: smaller logo and static (non-animated) copy — the
+ // decrypt animation reflows multi-line text in narrow widths.
+ compact?: boolean;
+}
+
+export function ChatEmptyState({
+ onInputChange,
+ footer,
+ compact = false,
+ ...composerPanelProps
+}: ChatEmptyStateProps) {
+ return (
+ <div className="flex min-h-0 flex-1 items-center justify-center px-4 py-10 md:px-8">
+ <div className="mx-auto flex w-full max-w-5xl flex-col items-center gap-5">
+ <LighthouseIconWithAura className={compact ? "size-12" : "size-20"} />
+ <div className="space-y-2 text-center">
+ <h1
+ className={cn(
+ "text-text-neutral-primary font-semibold",
+ compact ? "text-lg" : "text-3xl",
+ )}
+ >
+ {compact ? (
+ "Find and remediate what actually matters."
+ ) : (
+ <DecryptedText
+ text="Find and remediate what actually matters."
+ animateOn="view"
+ sequential
+ speed={15}
+ encryptedClassName="text-text-neutral-tertiary"
+ />
+ )}
+ </h1>
+ <p
+ className={cn(
+ "text-text-neutral-secondary italic",
+ compact ? "text-sm" : "text-base",
+ )}
+ >
+ {compact ? (
+ "What do you want to know today?"
+ ) : (
+ <DecryptedText
+ text="What do you want to know today?"
+ animateOn="view"
+ sequential
+ speed={15}
+ encryptedClassName="text-text-neutral-tertiary"
+ />
+ )}
+ </p>
+ </div>
+ <div className="w-full max-w-4xl">
+ <ChatComposerPanel
+ {...composerPanelProps}
+ onInputChange={onInputChange}
+ />
+ </div>
+ <div className="flex max-w-4xl flex-wrap items-center justify-center gap-2">
+ <span className="text-text-neutral-secondary basis-full text-center text-sm font-medium">
+ Try Lighthouse AI for...
+ </span>
+ {LIGHTHOUSE_V2_SUGGESTIONS.map((suggestion) => {
+ const Icon = suggestion.icon;
+ return (
+ <Button
+ key={suggestion.label}
+ type="button"
+ variant="outline"
+ size="sm"
+ onClick={() => onInputChange(suggestion.prompt)}
+ >
+ <Icon className="size-4" />
+ {suggestion.label}
+ </Button>
+ );
+ })}
+ </div>
+ {footer ? <div className="w-full max-w-4xl">{footer}</div> : null}
+ </div>
+ </div>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/index.ts b/ui/app/(prowler)/lighthouse/_components/chat/index.ts
new file mode 100644
index 0000000000..2c634ab620
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/index.ts
@@ -0,0 +1 @@
+export { LighthouseV2ChatPage } from "./lighthouse-v2-chat-page";
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-chat-store-provider.tsx b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-chat-store-provider.tsx
new file mode 100644
index 0000000000..55866304bb
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-chat-store-provider.tsx
@@ -0,0 +1,41 @@
+"use client";
+
+import { createContext, type ReactNode, useContext } from "react";
+import { useStore } from "zustand";
+
+import type {
+ LighthouseChatState,
+ LighthouseChatStore,
+} from "@/app/(prowler)/lighthouse/_lib/chat-store";
+
+const LighthouseChatStoreContext = createContext<LighthouseChatStore | null>(
+ null,
+);
+
+interface LighthouseChatStoreProviderProps {
+ store: LighthouseChatStore;
+ children: ReactNode;
+}
+
+export function LighthouseChatStoreProvider({
+ store,
+ children,
+}: LighthouseChatStoreProviderProps) {
+ return (
+ <LighthouseChatStoreContext.Provider value={store}>
+ {children}
+ </LighthouseChatStoreContext.Provider>
+ );
+}
+
+export function useLighthouseChatStore<T>(
+ selector: (state: LighthouseChatState) => T,
+): T {
+ const store = useContext(LighthouseChatStoreContext);
+ if (!store) {
+ throw new Error(
+ "useLighthouseChatStore must be used within LighthouseChatStoreProvider",
+ );
+ }
+ return useStore(store, selector);
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.test.tsx b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.test.tsx
new file mode 100644
index 0000000000..b6c5890db4
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.test.tsx
@@ -0,0 +1,805 @@
+import { act, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { type ReactNode } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ getOrCreatePanelChatStore,
+ resetPanelChatStoreForTests,
+} from "@/app/(prowler)/lighthouse/_lib/panel-chat-store";
+import {
+ LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT,
+ notifyLighthouseV2SessionArchived,
+} from "@/app/(prowler)/lighthouse/_lib/session-events";
+import {
+ type MockEventSource,
+ stubEventSource,
+} from "@/app/(prowler)/lighthouse/_lib/testing/event-source-mock";
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2Message,
+ LighthouseV2SupportedModel,
+ LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import { LighthouseV2ChatPage } from "./lighthouse-v2-chat-page";
+
+let eventSources: MockEventSource[] = [];
+
+const {
+ createSessionMock,
+ getMessagesMock,
+ sendMessageMock,
+ updateConfigurationMock,
+} = vi.hoisted(() => ({
+ createSessionMock: vi.fn(),
+ getMessagesMock: vi.fn(),
+ sendMessageMock: vi.fn(),
+ updateConfigurationMock: vi.fn(),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ createLighthouseV2Session: createSessionMock,
+ getLighthouseV2Messages: getMessagesMock,
+ sendLighthouseV2Message: sendMessageMock,
+ updateLighthouseV2Configuration: updateConfigurationMock,
+}));
+
+// Streamdown pulls in shiki/wasm syntax highlighting that doesn't run under
+// jsdom; render its text passthrough so message bodies are still assertable.
+vi.mock("streamdown", () => ({
+ Streamdown: ({ children }: { children: ReactNode }) => <>{children}</>,
+ defaultRehypePlugins: { katex: undefined, harden: undefined },
+}));
+
+const configurations: LighthouseV2Configuration[] = [
+ {
+ id: "config-openai",
+ providerType: "openai",
+ baseUrl: null,
+ defaultModel: "gpt-5.1",
+ businessContext: "Production account",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:00:00Z",
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ {
+ id: "config-bedrock",
+ providerType: "bedrock",
+ baseUrl: null,
+ defaultModel: "anthropic.claude-4",
+ businessContext: "Production account",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-23T10:00:00Z",
+ insertedAt: "2026-06-23T09:00:00Z",
+ updatedAt: "2026-06-23T10:00:00Z",
+ },
+];
+
+const modelsByProvider = {
+ openai: [model("gpt-5.1"), model("gpt-4.1")],
+ bedrock: [model("anthropic.claude-4")],
+ "openai-compatible": [model("llama-3.3")],
+};
+
+const supportedProviders: LighthouseV2SupportedProvider[] = [
+ { id: "openai", name: "OpenAI" },
+ { id: "bedrock", name: "AWS Bedrock" },
+ { id: "openai-compatible", name: "OpenAI Compatible" },
+];
+
+describe("LighthouseV2ChatPage", () => {
+ beforeEach(() => {
+ vi.stubGlobal(
+ "ResizeObserver",
+ class ResizeObserver {
+ observe = vi.fn();
+ unobserve = vi.fn();
+ disconnect = vi.fn();
+ },
+ );
+ Object.defineProperty(Element.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ createSessionMock.mockReset();
+ getMessagesMock.mockReset();
+ sendMessageMock.mockReset();
+ updateConfigurationMock.mockReset();
+ resetPanelChatStoreForTests();
+ eventSources = stubEventSource();
+
+ createSessionMock.mockResolvedValue({
+ data: {
+ id: "session-1",
+ title: "Summarize findings",
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ });
+ getMessagesMock.mockResolvedValue({ data: [] });
+ sendMessageMock.mockResolvedValue({
+ data: {
+ task: {
+ id: "task-1",
+ name: "lighthouse-run",
+ state: "executing",
+ },
+ },
+ });
+ updateConfigurationMock.mockResolvedValue({ data: configurations[1] });
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it("renders the searchable model selector and settings shortcut", () => {
+ // Given / When
+ renderPage();
+
+ // Then
+ expect(screen.getByRole("combobox", { name: "Model" })).toBeInTheDocument();
+ expect(
+ screen.getByRole("link", { name: "Lighthouse AI settings" }),
+ ).toHaveAttribute("href", "/lighthouse/settings");
+ });
+
+ it("renders the empty-state headline with correct wording", () => {
+ // Given / When
+ renderPage();
+
+ // Then
+ expect(
+ screen.getByText("Find and remediate what actually matters."),
+ ).toBeInTheDocument();
+ });
+
+ it("continues using the panel chat store on the full-page surface", () => {
+ // Given: the panel owns an in-progress new chat with a draft
+ const panelStore = getOrCreatePanelChatStore({
+ configurations,
+ modelsByProvider,
+ supportedProviders,
+ });
+ panelStore.getState().setInput("Draft from the side panel");
+
+ // When
+ renderPage();
+
+ // Then: the page owns the same live store, not a stale server snapshot
+ const input = screen.getByRole("textbox", { name: "Message" });
+ expect(input).toHaveValue("Draft from the side panel");
+ act(() => panelStore.getState().setInput("Updated after navigation"));
+ expect(input).toHaveValue("Updated after navigation");
+ });
+
+ it("enables session URL sync after claiming a new panel chat", async () => {
+ // Given: the panel owns a new chat before full-page navigation
+ const user = userEvent.setup();
+ getOrCreatePanelChatStore({
+ configurations,
+ modelsByProvider,
+ supportedProviders,
+ });
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ renderPage();
+
+ // When: the first page message creates its session
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then: the claimed panel store now follows the full-page URL contract
+ await waitFor(() =>
+ expect(replaceStateSpy).toHaveBeenCalledWith(
+ window.history.state,
+ "",
+ "/lighthouse?session=session-1",
+ ),
+ );
+ });
+
+ it("shows the current OpenAI model without a selector when OpenAI is the only connected provider", () => {
+ // Given / When
+ renderPage({
+ configurations: [
+ { ...configurations[0], defaultModel: "gpt-5.1", connected: true },
+ { ...configurations[1], connected: false },
+ ],
+ modelsByProvider: {
+ openai: [model("gpt-5.1", "GPT-5.1")],
+ bedrock: [model("anthropic.claude-4")],
+ "openai-compatible": [model("llama-3.3")],
+ },
+ });
+
+ // Then
+ expect(
+ screen.queryByRole("combobox", { name: "Model" }),
+ ).not.toBeInTheDocument();
+ const currentModel = screen.getByLabelText("Current model: OpenAI GPT-5.1");
+ expect(within(currentModel).getByText("OpenAI")).toBeInTheDocument();
+ expect(within(currentModel).getByText("GPT-5.1")).toBeInTheDocument();
+ });
+
+ it("defaults to gpt-5.6-terra when OpenAI has no remembered model", () => {
+ // Given / When
+ renderPage({
+ configurations: [
+ { ...configurations[0], defaultModel: null, connected: true },
+ { ...configurations[1], connected: false },
+ ],
+ modelsByProvider: {
+ openai: [
+ model("gpt-4.1", "GPT-4.1"),
+ model("gpt-5.6-terra", "GPT-5.6 Terra"),
+ ],
+ bedrock: [model("anthropic.claude-4")],
+ "openai-compatible": [model("llama-3.3")],
+ },
+ });
+
+ // Then
+ const currentModel = screen.getByLabelText(
+ "Current model: OpenAI GPT-5.6 Terra",
+ );
+ expect(within(currentModel).getByText("GPT-5.6 Terra")).toBeInTheDocument();
+ });
+
+ it("uses the AWS onboarding quick prompt instead of the docs prompt", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.click(
+ screen.getByRole("button", {
+ name: "How can I onboard to my AWS account?",
+ }),
+ );
+
+ // Then
+ expect(
+ screen.queryByRole("button", { name: "Docs" }),
+ ).not.toBeInTheDocument();
+ expect(screen.getByRole("textbox", { name: "Message" })).toHaveValue(
+ "How can I onboard to my AWS account?",
+ );
+ });
+
+ it("prefills the overview remediation prompt without starting a conversation", () => {
+ // Given
+ const initialPrompt =
+ "Find and guide me to remediate what actually matters. What do I have to do today to be secure?";
+
+ // When
+ renderPage({ initialPrompt });
+
+ // Then
+ expect(screen.getByRole("textbox", { name: "Message" })).toHaveValue(
+ initialPrompt,
+ );
+ expect(createSessionMock).not.toHaveBeenCalled();
+ expect(sendMessageMock).not.toHaveBeenCalled();
+ });
+
+ it("shows model names in the selector while keeping model ids for persistence", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage({
+ configurations: [
+ { ...configurations[0], defaultModel: "gpt-5.1" },
+ {
+ ...configurations[1],
+ defaultModel: "us.anthropic.claude-sonnet-4-20250514-v1:0",
+ },
+ ],
+ modelsByProvider: {
+ openai: [model("gpt-5.1", "GPT-5.1")],
+ bedrock: [
+ model(
+ "us.anthropic.claude-sonnet-4-20250514-v1:0",
+ "Claude Sonnet 4",
+ ),
+ ],
+ "openai-compatible": [],
+ },
+ });
+
+ // When
+ const modelSelector = screen.getByRole("combobox", { name: "Model" });
+ await user.click(modelSelector);
+
+ // Then
+ expect(modelSelector).toHaveTextContent("GPT-5.1");
+ expect(
+ await screen.findByRole("option", { name: "Claude Sonnet 4" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.queryByText("us.anthropic.claude-sonnet-4-20250514-v1:0"),
+ ).not.toBeInTheDocument();
+
+ // When
+ await user.click(screen.getByRole("option", { name: "Claude Sonnet 4" }));
+
+ // Then
+ await waitFor(() =>
+ expect(updateConfigurationMock).toHaveBeenCalledWith("config-bedrock", {
+ defaultModel: "us.anthropic.claude-sonnet-4-20250514-v1:0",
+ }),
+ );
+ expect(modelSelector).toHaveTextContent("Claude Sonnet 4");
+ });
+
+ it("uses supported provider names as model selector section headings", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage({
+ configurations: [
+ ...configurations,
+ {
+ id: "config-openai-compatible",
+ providerType: "openai-compatible",
+ baseUrl: "https://example.com/v1",
+ defaultModel: "llama-3.3",
+ businessContext: "Production account",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-22T10:00:00Z",
+ insertedAt: "2026-06-22T09:00:00Z",
+ updatedAt: "2026-06-22T10:00:00Z",
+ },
+ ],
+ supportedProviders,
+ });
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Model" }));
+
+ // Then
+ expect(await screen.findByText("AWS Bedrock")).toBeInTheDocument();
+ expect(screen.getByText("OpenAI Compatible")).toBeInTheDocument();
+ expect(screen.queryByText("Amazon Bedrock")).not.toBeInTheDocument();
+ });
+
+ it("uses the tuned scrollbar and bottom fade without a composer separator", () => {
+ // Given / When
+ const { container } = renderPage({
+ initialMessages: [message("message-1", "assistant", "Existing answer")],
+ });
+
+ // Then
+ const conversation = screen.getByRole("log");
+ const scrollViewport = conversation.firstElementChild as HTMLElement;
+ const content = scrollViewport.firstElementChild as HTMLElement;
+ const scrollFade = container.querySelector(
+ '[data-slot="lighthouse-v2-chat-scroll-fade"]',
+ );
+
+ expect(conversation).toHaveClass("h-full", "min-h-0");
+ expect(conversation.parentElement).toHaveClass("flex", "overflow-hidden");
+ expect(scrollViewport).toHaveClass(
+ "minimal-scrollbar",
+ "overflow-x-hidden",
+ "overflow-y-auto",
+ );
+ expect(content).toHaveClass("pb-20");
+ expect(scrollFade).toHaveClass(
+ "pointer-events-none",
+ "absolute",
+ "bottom-0",
+ "right-2",
+ "h-16",
+ "bg-gradient-to-t",
+ "from-bg-neutral-secondary",
+ "to-transparent",
+ );
+ expect(
+ container.querySelector(
+ '[data-slot="lighthouse-v2-chat-composer-panel"]',
+ ),
+ ).not.toHaveClass("border-t");
+ });
+
+ it("opens the highest-priority connected provider with its remembered model", async () => {
+ // Given: both OpenAI and Bedrock are connected; OpenAI outranks Bedrock
+ const user = userEvent.setup();
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ renderPage();
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then: the message is sent with OpenAI and its remembered defaultModel,
+ // even though EventSource never fires "open"
+ await waitFor(() =>
+ expect(sendMessageMock).toHaveBeenCalledWith({
+ sessionId: "session-1",
+ text: "Summarize findings",
+ provider: "openai",
+ model: "gpt-5.1",
+ }),
+ );
+ expect(createSessionMock).toHaveBeenCalledWith("Summarize findings");
+ // The session URL is set in place (no router navigation / remount)
+ expect(replaceStateSpy).toHaveBeenCalledWith(
+ null,
+ "",
+ "/lighthouse?session=session-1",
+ );
+ // The stream is opened against our same-origin SSE proxy (not the
+ // cross-origin API host), so the browser EventSource can actually connect.
+ expect(EventSource).toHaveBeenCalledWith(
+ "/api/lighthouse/v2/sessions/session-1/event-stream",
+ );
+ replaceStateSpy.mockRestore();
+ });
+
+ it("opens a lower-priority provider when the higher-priority one is disconnected", async () => {
+ // Given: only Bedrock is connected
+ const user = userEvent.setup();
+ renderPage({
+ configurations: [
+ { ...configurations[0], connected: false },
+ configurations[1],
+ ],
+ });
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then
+ await waitFor(() =>
+ expect(sendMessageMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ provider: "bedrock",
+ model: "anthropic.claude-4",
+ }),
+ ),
+ );
+ });
+
+ it("falls back to the first supported model when the remembered model is unsupported", async () => {
+ // Given: OpenAI's remembered default model is no longer offered
+ const user = userEvent.setup();
+ renderPage({
+ configurations: [
+ { ...configurations[0], defaultModel: "missing-model" },
+ configurations[1],
+ ],
+ });
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then: OpenAI stays selected (highest priority) but on its first model
+ await waitFor(() =>
+ expect(sendMessageMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ provider: "openai",
+ model: "gpt-5.1",
+ }),
+ ),
+ );
+ });
+
+ it("persists the selected chat model as that provider's default", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Model" }));
+ await user.click(
+ await screen.findByRole("option", { name: "anthropic.claude-4" }),
+ );
+
+ // Then: only the chosen provider's config is updated, by id
+ await waitFor(() =>
+ expect(updateConfigurationMock).toHaveBeenCalledWith("config-bedrock", {
+ defaultModel: "anthropic.claude-4",
+ }),
+ );
+ });
+
+ it("keeps the chosen model applied and surfaces the backend reason when saving the default fails", async () => {
+ // Given
+ const user = userEvent.setup();
+ updateConfigurationMock.mockResolvedValue({
+ error: "Invalid model 'anthropic.claude-4' for provider 'bedrock'.",
+ status: 400,
+ });
+ renderPage();
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Model" }));
+ await user.click(
+ await screen.findByRole("option", { name: "anthropic.claude-4" }),
+ );
+
+ // Then: the failed save shows the real backend message as an error alert,
+ // and the selection stays applied so the connected provider remains usable.
+ expect(await screen.findByRole("alert")).toHaveTextContent(
+ "Invalid model 'anthropic.claude-4' for provider 'bedrock'.",
+ );
+ expect(screen.getByRole("combobox", { name: "Model" })).toHaveTextContent(
+ "anthropic.claude-4",
+ );
+ });
+
+ it("updates the URL before notifying session history listeners", async () => {
+ // Given
+ const user = userEvent.setup();
+ const notifiedUrls: string[] = [];
+ const recordCurrentUrl = () => {
+ notifiedUrls.push(`${window.location.pathname}${window.location.search}`);
+ };
+
+ try {
+ // Register inside the try so a throw in renderPage() can't leak the
+ // listener into later tests (the finally only runs if we entered the try).
+ window.addEventListener(
+ LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT,
+ recordCurrentUrl,
+ );
+ renderPage();
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then
+ await waitFor(() => expect(notifiedUrls.length).toBeGreaterThan(0));
+ expect(notifiedUrls[0]).toBe("/lighthouse?session=session-1");
+ } finally {
+ window.removeEventListener(
+ LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT,
+ recordCurrentUrl,
+ );
+ }
+ });
+
+ it("subscribes to the stream before sending the message (no replay buffer)", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+
+ // Then: the EventSource must be constructed before the POST, otherwise
+ // early tokens emitted by the worker would be lost (backend has no replay).
+ await waitFor(() => expect(sendMessageMock).toHaveBeenCalled());
+ const eventSourceOrder = vi.mocked(EventSource).mock.invocationCallOrder[0];
+ const sendOrder = sendMessageMock.mock.invocationCallOrder[0];
+ expect(eventSourceOrder).toBeLessThan(sendOrder);
+ });
+
+ it("renders a copy button (copies text) and an ISO timestamp under each message", async () => {
+ // Given
+ const user = userEvent.setup();
+ const writeText = vi.fn().mockResolvedValue(undefined);
+ Object.defineProperty(navigator, "clipboard", {
+ value: { writeText },
+ configurable: true,
+ });
+ const { container } = renderPage({
+ initialMessages: [message("message-1", "assistant", "Existing answer")],
+ });
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Copy message" }));
+
+ // Then: copies the message text, and the timestamp carries the raw ISO
+ expect(writeText).toHaveBeenCalledWith("Existing answer");
+ expect(container.querySelector("time")).toHaveAttribute(
+ "datetime",
+ "2026-06-25T10:00:00Z",
+ );
+ });
+
+ it("renders streamed deltas and reloads persisted messages on message.end", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+ await waitFor(() => expect(eventSources).toHaveLength(1));
+ const source = eventSources[0];
+
+ // When a delta arrives, it renders live
+ act(() => source.emit("message.delta", { content: "Hello there" }));
+ expect(await screen.findByText("Hello there")).toBeInTheDocument();
+
+ // When the run ends, the full persisted message is reloaded from the DB
+ act(() => source.emit("message.end", { message_id: "message-1" }));
+ await waitFor(() =>
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1"),
+ );
+ expect(source.close).toHaveBeenCalled();
+ });
+
+ it("resets to a new chat when the live-created session is archived from the sidebar", async () => {
+ // Given: a session created in this chat (its URL was set via replaceState,
+ // so the sidebar cannot see it in Next's search params)
+ const user = userEvent.setup();
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ renderPage();
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+ await waitFor(() => expect(sendMessageMock).toHaveBeenCalled());
+
+ // When: the sidebar archives that same session
+ act(() => notifyLighthouseV2SessionArchived("session-1"));
+
+ // Then: the chat resets in place and the URL leaves the dead session
+ await waitFor(() =>
+ expect(replaceStateSpy).toHaveBeenCalledWith(null, "", "/lighthouse"),
+ );
+ expect(screen.queryByText("Summarize findings")).not.toBeInTheDocument();
+ expect(eventSources[0].close).toHaveBeenCalled();
+ replaceStateSpy.mockRestore();
+ });
+
+ it("drops a stale message reload that resolves after the session is archived", async () => {
+ // Given: a live session whose message.end reload is still in flight
+ const user = userEvent.setup();
+ let resolveReload: (value: unknown) => void = () => {};
+ getMessagesMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveReload = resolve;
+ }),
+ );
+ renderPage();
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+ await waitFor(() => expect(eventSources).toHaveLength(1));
+
+ // When: the run ends (starting the async reload) and, before it resolves,
+ // the open session is archived and the chat resets
+ act(() => eventSources[0].emit("message.end", { message_id: "message-1" }));
+ await waitFor(() =>
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1"),
+ );
+ act(() => notifyLighthouseV2SessionArchived("session-1"));
+
+ // The reload finally resolves with the (now archived) session's messages
+ await act(async () => {
+ resolveReload({
+ data: [message("message-1", "assistant", "Archived answer")],
+ });
+ });
+
+ // Then: the stale reload is ignored so the reset chat is not repopulated
+ expect(screen.queryByText("Archived answer")).not.toBeInTheDocument();
+ });
+
+ it("keeps the conversation when a different session is archived", async () => {
+ // Given
+ renderPage({
+ initialSessionId: "session-2",
+ initialMessages: [message("message-1", "assistant", "Existing answer")],
+ });
+
+ // When
+ act(() => notifyLighthouseV2SessionArchived("session-other"));
+
+ // Then
+ expect(screen.getByText("Existing answer")).toBeInTheDocument();
+ });
+
+ it("lets the user draft the next message while a response is streaming, without sending it", async () => {
+ // Given: a message is in flight (spinner replaces the send button)
+ const user = userEvent.setup();
+ renderPage();
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+ await waitFor(() => expect(sendMessageMock).toHaveBeenCalledTimes(1));
+ expect(
+ screen.getByRole("status", { name: "Generating response" }),
+ ).toBeInTheDocument();
+
+ // When: the user types a follow-up and presses Enter mid-stream
+ const input = screen.getByRole("textbox", { name: "Message" });
+ await user.type(input, ["Next question", "{Enter}"].join(""));
+
+ // Then: the draft is kept in the input and no second message is sent
+ expect(input).toHaveValue("Next question");
+ expect(sendMessageMock).toHaveBeenCalledTimes(1);
+ });
+
+ it("surfaces a connection error when the stream closes without retrying", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+ await user.type(
+ screen.getByRole("textbox", { name: "Message" }),
+ ["Summarize findings", "{Enter}"].join(""),
+ );
+ await waitFor(() => expect(eventSources).toHaveLength(1));
+
+ // When the EventSource fails terminally (e.g. 401/404 on the SSE GET)
+ act(() => eventSources[0].fail(2 /* EventSource.CLOSED */));
+
+ // Then a clear error is shown instead of an endless "Reconnecting" spinner
+ expect(
+ await screen.findByText("Unable to connect to the response stream."),
+ ).toBeInTheDocument();
+ });
+});
+
+type RenderPageProps = Partial<Parameters<typeof LighthouseV2ChatPage>[0]>;
+
+function renderPage(props?: RenderPageProps) {
+ const componentProps = {
+ configurations: props?.configurations ?? configurations,
+ modelsByProvider: props?.modelsByProvider ?? modelsByProvider,
+ supportedProviders: props?.supportedProviders ?? supportedProviders,
+ initialSessionId: props?.initialSessionId,
+ initialMessages: props?.initialMessages ?? [],
+ initialPrompt: props?.initialPrompt,
+ } satisfies Parameters<typeof LighthouseV2ChatPage>[0];
+
+ return render(<LighthouseV2ChatPage {...componentProps} />);
+}
+
+function model(id: string, name = id): LighthouseV2SupportedModel {
+ return {
+ id,
+ name,
+ maxInputTokens: null,
+ maxOutputTokens: null,
+ supportsFunctionCalling: null,
+ supportsVision: null,
+ supportsReasoning: null,
+ };
+}
+
+function message(
+ id: string,
+ role: LighthouseV2Message["role"],
+ content: string,
+): LighthouseV2Message {
+ return {
+ id,
+ role,
+ model: null,
+ tokenUsage: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ parts: [
+ {
+ id: `${id}-part`,
+ type: "text",
+ content,
+ toolCallOutcome: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ },
+ ],
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.tsx b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.tsx
new file mode 100644
index 0000000000..14b1e18b9d
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-page.tsx
@@ -0,0 +1,111 @@
+"use client";
+
+import { useState } from "react";
+
+import {
+ createLighthouseChatStore,
+ type LighthouseChatStore,
+} from "@/app/(prowler)/lighthouse/_lib/chat-store";
+import {
+ getPanelChatStoreForSession,
+ isPanelChatStore,
+} from "@/app/(prowler)/lighthouse/_lib/panel-chat-store";
+import {
+ onLighthouseV2NewChat,
+ onLighthouseV2SessionArchived,
+} from "@/app/(prowler)/lighthouse/_lib/session-events";
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2Message,
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel,
+ LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+
+import { LighthouseChatStoreProvider } from "./lighthouse-chat-store-provider";
+import {
+ LIGHTHOUSE_CHAT_SURFACE,
+ LighthouseV2ChatView,
+} from "./lighthouse-v2-chat-view";
+
+interface LighthouseV2ChatPageProps {
+ configurations: LighthouseV2Configuration[];
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >;
+ supportedProviders: LighthouseV2SupportedProvider[];
+ initialSessionId?: string;
+ initialMessages: LighthouseV2Message[];
+ initialPrompt?: string;
+ initialError?: string;
+}
+
+export function LighthouseV2ChatPage({
+ configurations,
+ modelsByProvider,
+ supportedProviders,
+ initialSessionId,
+ initialMessages,
+ initialPrompt,
+ initialError,
+}: LighthouseV2ChatPageProps) {
+ // Navigation from the side panel transfers its live store so drafts,
+ // streamed output and the open EventSource continue without a snapshot gap.
+ // Direct/session-mismatched navigation builds the normal page-owned store.
+ const [store] = useState<LighthouseChatStore>(() => {
+ const panelStore =
+ initialPrompt === undefined
+ ? getPanelChatStoreForSession(initialSessionId)
+ : null;
+ return (
+ panelStore ??
+ createLighthouseChatStore({
+ config: { configurations, modelsByProvider, supportedProviders },
+ syncUrlToSession: true,
+ initialSessionId,
+ initialMessages,
+ initialInput: initialPrompt,
+ initialError,
+ })
+ );
+ });
+ const reusesPanelStore = isPanelChatStore(store);
+
+ // A reused panel store returns to panel URL semantics when the page leaves;
+ // a page-owned store closes its EventSource as before.
+ useMountEffect(() => {
+ if (reusesPanelStore) {
+ store.getState().setSessionUrlSyncEnabled(true);
+ }
+ return () => {
+ if (reusesPanelStore) {
+ store.getState().setSessionUrlSyncEnabled(false);
+ return;
+ }
+ store.getState().destroy();
+ };
+ });
+
+ // The sidebar "+" can't rely on routing to reset the latest conversation (its
+ // URL was set via replaceState, invisible to Next's router), so reset in place.
+ useMountEffect(() => {
+ const unsubscribeNewChat = onLighthouseV2NewChat(() =>
+ store.getState().resetToNewChat(),
+ );
+ const unsubscribeSessionArchived = onLighthouseV2SessionArchived(
+ (sessionId) => store.getState().handleSessionArchived(sessionId),
+ );
+ return () => {
+ unsubscribeNewChat();
+ unsubscribeSessionArchived();
+ };
+ });
+
+ return (
+ <LighthouseChatStoreProvider store={store}>
+ <LighthouseV2ChatView surface={LIGHTHOUSE_CHAT_SURFACE.PAGE} />
+ </LighthouseChatStoreProvider>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-view.tsx b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-view.tsx
new file mode 100644
index 0000000000..0060dbe44e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/lighthouse-v2-chat-view.tsx
@@ -0,0 +1,339 @@
+"use client";
+
+import { type ReactNode, type SubmitEvent } from "react";
+
+import {
+ Conversation,
+ ConversationContent,
+ ConversationScrollButton,
+} from "@/app/(prowler)/lighthouse/_components/ai-elements/conversation";
+import { selectLighthouseChatCanSend } from "@/app/(prowler)/lighthouse/_lib/chat-store";
+import { LIGHTHOUSE_V2_STREAM_STATUS } from "@/app/(prowler)/lighthouse/_lib/event-reducer";
+import {
+ buildLighthouseV2ModelSelectionValue,
+ type LighthouseV2ModelSelection,
+ parseLighthouseV2ModelSelectionValue,
+} from "@/app/(prowler)/lighthouse/_lib/model-selection";
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2Configuration,
+ type LighthouseV2ProviderType,
+ type LighthouseV2SupportedModel,
+ type LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { Card } from "@/components/shadcn";
+import {
+ Combobox,
+ type ComboboxGroup,
+} from "@/components/shadcn/combobox/combobox";
+import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
+
+import { ProviderIcon } from "../config/provider-icon";
+import { ChatComposerPanel } from "./composer";
+import { ChatEmptyState } from "./empty-state";
+import { useLighthouseChatStore } from "./lighthouse-chat-store-provider";
+import { MessageBubble } from "./message-bubble";
+import { StreamingAssistantMessage } from "./streaming-message";
+
+export const LIGHTHOUSE_CHAT_SURFACE = {
+ PAGE: "page",
+ PANEL: "panel",
+} as const;
+
+export type LighthouseChatSurface =
+ (typeof LIGHTHOUSE_CHAT_SURFACE)[keyof typeof LIGHTHOUSE_CHAT_SURFACE];
+
+interface LighthouseV2ChatViewProps {
+ surface: LighthouseChatSurface;
+ emptyStateFooter?: ReactNode;
+}
+
+export function LighthouseV2ChatView({
+ surface,
+ emptyStateFooter,
+}: LighthouseV2ChatViewProps) {
+ // Whole-store subscription is intentional: the view renders most of the state and selectLighthouseChatCanSend takes full state.
+ const state = useLighthouseChatStore((current) => current);
+ const {
+ config,
+ messages,
+ streamState,
+ input,
+ feedback,
+ isLoadingSession,
+ lastSubmittedText,
+ selectedModelSelection,
+ modelPreferenceSaving,
+ setInput,
+ dismissFeedback,
+ selectModel,
+ submitMessage,
+ } = state;
+ const { modelsByProvider, supportedProviders } = config;
+ const connectedConfigurations = config.configurations.filter(
+ (configuration) => configuration.connected === true,
+ );
+
+ const selectedConfiguration = selectedModelSelection
+ ? connectedConfigurations.find(
+ (configuration) =>
+ configuration.providerType === selectedModelSelection.providerType,
+ )
+ : undefined;
+ const modelSelectorGroups = buildModelSelectorGroups(
+ connectedConfigurations,
+ modelsByProvider,
+ supportedProviders,
+ );
+ const showStaticOpenAIModel =
+ isOnlyConnectedProvider(
+ connectedConfigurations,
+ LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI,
+ ) &&
+ selectedModelSelection?.providerType === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI;
+ const selectedModelLabel = selectedModelSelection
+ ? getModelSelectionLabel(selectedModelSelection, modelsByProvider)
+ : "No model selected";
+ const selectedProviderName = selectedModelSelection
+ ? getProviderDisplayName(
+ selectedModelSelection.providerType,
+ supportedProviders,
+ )
+ : "OpenAI";
+ const selectedModelValue = selectedModelSelection
+ ? buildLighthouseV2ModelSelectionValue(
+ selectedModelSelection.providerType,
+ selectedModelSelection.modelId,
+ )
+ : "";
+
+ const canSend = selectLighthouseChatCanSend(state);
+
+ const handleModelValueChange = (value: string) => {
+ const selection = parseLighthouseV2ModelSelectionValue(value);
+ if (!selection) return;
+ void selectModel(selection);
+ };
+
+ const handleSubmit = (event: SubmitEvent<HTMLFormElement>) => {
+ event.preventDefault();
+ void submitMessage(input);
+ };
+
+ const hasLiveAssistantActivity =
+ Boolean(streamState.activeTaskId) ||
+ Boolean(streamState.assistantText) ||
+ streamState.toolCalls.length > 0;
+ const hasConversation = messages.length > 0 || hasLiveAssistantActivity;
+
+ const composerPanelProps = {
+ feedback,
+ canRetry:
+ streamState.status === LIGHTHOUSE_V2_STREAM_STATUS.DISCONNECTED &&
+ lastSubmittedText !== null,
+ onRetry: () =>
+ lastSubmittedText ? void submitMessage(lastSubmittedText) : undefined,
+ onDismissFeedback: dismissFeedback,
+ canSend,
+ input,
+ isStreaming: Boolean(streamState.activeTaskId),
+ modelSelector: showStaticOpenAIModel ? (
+ <CurrentModelDisplay
+ provider={selectedModelSelection.providerType}
+ providerName={selectedProviderName}
+ modelName={selectedModelLabel}
+ />
+ ) : (
+ <div className="min-w-0 flex-1 sm:max-w-48">
+ <Combobox
+ aria-label="Model"
+ value={selectedModelValue}
+ onValueChange={handleModelValueChange}
+ groups={modelSelectorGroups}
+ disabled={modelSelectorGroups.length === 0 || modelPreferenceSaving}
+ placeholder="Select model"
+ searchPlaceholder="Search models..."
+ emptyMessage="No models found."
+ size="sm"
+ />
+ </div>
+ ),
+ selectedConfigurationConnected: selectedConfiguration?.connected === true,
+ onInputChange: setInput,
+ onSubmit: handleSubmit,
+ onSubmitText: submitMessage,
+ };
+
+ const chatBody = isLoadingSession ? (
+ <SessionLoadingState />
+ ) : hasConversation ? (
+ <div className="flex min-h-0 flex-1 flex-col">
+ <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
+ <Conversation className="h-full min-h-0">
+ <ConversationContent
+ className="mx-auto w-full max-w-4xl gap-5 px-4 pt-8 pb-20 md:px-8"
+ scrollClassName="minimal-scrollbar overflow-x-hidden overflow-y-auto"
+ >
+ {messages.map((message) => (
+ <MessageBubble key={message.id} message={message} />
+ ))}
+ {hasLiveAssistantActivity && (
+ <StreamingAssistantMessage streamState={streamState} />
+ )}
+ </ConversationContent>
+ <ConversationScrollButton className="z-20" />
+ </Conversation>
+ <div
+ data-slot="lighthouse-v2-chat-scroll-fade"
+ className="from-bg-neutral-secondary pointer-events-none absolute right-2 bottom-0 left-0 z-10 h-16 bg-gradient-to-t to-transparent"
+ />
+ </div>
+ <div
+ data-slot="lighthouse-v2-chat-composer-panel"
+ className="bg-bg-neutral-secondary px-4 pb-5 md:px-8"
+ >
+ <div className="mx-auto w-full max-w-4xl">
+ <ChatComposerPanel {...composerPanelProps} />
+ </div>
+ </div>
+ </div>
+ ) : (
+ <ChatEmptyState
+ {...composerPanelProps}
+ footer={emptyStateFooter}
+ compact={surface === LIGHTHOUSE_CHAT_SURFACE.PANEL}
+ />
+ );
+
+ if (surface === LIGHTHOUSE_CHAT_SURFACE.PAGE) {
+ return (
+ <Card
+ variant="base"
+ className="flex h-full min-h-0 flex-col overflow-hidden"
+ >
+ {chatBody}
+ </Card>
+ );
+ }
+
+ return (
+ <div className="bg-bg-neutral-secondary flex h-full min-h-0 flex-col overflow-hidden">
+ {chatBody}
+ </div>
+ );
+}
+
+function SessionLoadingState() {
+ return (
+ <div
+ aria-label="Loading conversation"
+ className="flex min-h-0 flex-1 flex-col gap-4 px-4 pt-8 md:px-8"
+ >
+ <Skeleton className="h-10 w-2/3 self-end" />
+ <Skeleton className="h-24 w-full" />
+ <Skeleton className="h-10 w-1/2 self-end" />
+ <Skeleton className="h-16 w-full" />
+ </div>
+ );
+}
+
+interface CurrentModelDisplayProps {
+ provider: LighthouseV2ProviderType;
+ providerName: string;
+ modelName: string;
+}
+
+function CurrentModelDisplay({
+ provider,
+ providerName,
+ modelName,
+}: CurrentModelDisplayProps) {
+ return (
+ <div
+ aria-label={`Current model: ${providerName} ${modelName}`}
+ className="border-border-neutral-secondary bg-bg-neutral-secondary flex h-8 max-w-48 min-w-0 items-center gap-2 rounded-lg border px-2.5 text-sm"
+ >
+ <ProviderIcon
+ provider={provider}
+ className="text-text-neutral-secondary size-3.5 shrink-0"
+ />
+ <span className="text-text-neutral-tertiary shrink-0">
+ {providerName}
+ </span>
+ <span className="text-text-neutral-primary min-w-0 truncate font-medium">
+ {modelName}
+ </span>
+ </div>
+ );
+}
+
+function buildModelSelectorGroups(
+ connectedConfigurations: LighthouseV2Configuration[],
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >,
+ supportedProviders: LighthouseV2SupportedProvider[],
+): ComboboxGroup[] {
+ const groups: ComboboxGroup[] = [];
+
+ for (const provider of supportedProviders) {
+ const configuration = connectedConfigurations.find(
+ (item) => item.providerType === provider.id,
+ );
+ if (!configuration) continue;
+
+ const options = (modelsByProvider[configuration.providerType] ?? []).map(
+ (model) => ({
+ value: buildLighthouseV2ModelSelectionValue(
+ configuration.providerType,
+ model.id,
+ ),
+ label: model.name,
+ }),
+ );
+
+ if (options.length === 0) continue;
+
+ groups.push({
+ heading: provider.name,
+ options,
+ });
+ }
+
+ return groups;
+}
+
+function isOnlyConnectedProvider(
+ connectedConfigurations: LighthouseV2Configuration[],
+ providerType: LighthouseV2ProviderType,
+) {
+ return (
+ connectedConfigurations.length === 1 &&
+ connectedConfigurations[0]?.providerType === providerType
+ );
+}
+
+function getModelSelectionLabel(
+ selection: LighthouseV2ModelSelection,
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >,
+) {
+ return (
+ modelsByProvider[selection.providerType]?.find(
+ (model) => model.id === selection.modelId,
+ )?.name ?? selection.modelId
+ );
+}
+
+function getProviderDisplayName(
+ providerType: LighthouseV2ProviderType,
+ supportedProviders: LighthouseV2SupportedProvider[],
+) {
+ return (
+ supportedProviders.find((provider) => provider.id === providerType)?.name ??
+ providerType
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.test.tsx b/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.test.tsx
new file mode 100644
index 0000000000..ab11429774
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.test.tsx
@@ -0,0 +1,182 @@
+import { render, screen } from "@testing-library/react";
+import { type ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+import {
+ LIGHTHOUSE_V2_MESSAGE_ROLE,
+ LIGHTHOUSE_V2_PART_TYPE,
+ type LighthouseV2Message,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import { MessageBubble } from "./message-bubble";
+
+vi.mock("streamdown", () => ({
+ Streamdown: ({ children }: { children: ReactNode }) => {
+ const text = String(children);
+ if (text.includes("very-wide-header")) {
+ return (
+ <table>
+ <caption>Wide markdown table</caption>
+ <tbody>
+ <tr>
+ <td>{text}</td>
+ </tr>
+ </tbody>
+ </table>
+ );
+ }
+
+ if (text.includes("graph TD")) {
+ // Mirrors streamdown's real mermaid DOM: pan/zoom wrapper + inline max-width on the svg
+ return (
+ <div data-streamdown="mermaid-block">
+ <div className="my-4 overflow-hidden">
+ <div role="application">
+ <div aria-label="Mermaid chart" role="img">
+ <svg aria-hidden="true" style={{ maxWidth: "1024px" }} />
+ </div>
+ </div>
+ </div>
+ </div>
+ );
+ }
+
+ return <>{children}</>;
+ },
+ defaultRehypePlugins: { katex: undefined, harden: undefined },
+}));
+
+describe("MessageBubble", () => {
+ it("should render assistant text and tool calls in persisted part order", () => {
+ // Given
+ const orderedMessage = buildAssistantMessage([
+ textPart("part-1", "Voy a buscar los findings por severidad"),
+ toolCallPart("part-2", "prowler_search_security_findings"),
+ textPart("part-3", "Ahora voy a buscar en los criticos"),
+ ]);
+
+ // When
+ render(<MessageBubble message={orderedMessage} />);
+
+ // Then
+ const firstText = screen.getByText(
+ "Voy a buscar los findings por severidad",
+ );
+ const toolCall = screen.getByRole("button", {
+ name: /Used Search security findings/,
+ });
+ const secondText = screen.getByText("Ahora voy a buscar en los criticos");
+
+ expect(isBefore(firstText, toolCall)).toBe(true);
+ expect(isBefore(toolCall, secondText)).toBe(true);
+ });
+
+ it("should keep wide assistant tables inside the message width", () => {
+ // Given
+ const wideTableMessage = buildAssistantMessage([
+ textPart(
+ "part-1",
+ "| very-wide-header | another-wide-header |\n| --- | --- |\n| very-long-cell-value-that-should-not-resize-the-message | value |",
+ ),
+ ]);
+
+ // When
+ render(<MessageBubble message={wideTableMessage} />);
+
+ // Then
+ const table = screen.getByRole("table", {
+ name: "Wide markdown table",
+ });
+ const markdown = table.closest(".lighthouse-markdown");
+ if (!(markdown instanceof HTMLElement)) {
+ throw new Error("Expected markdown wrapper around assistant table");
+ }
+
+ expect(markdown).toHaveClass("min-w-0", "max-w-full", "overflow-x-auto");
+ expect(markdown.parentElement).toHaveClass("min-w-0");
+ expect(markdown.parentElement?.parentElement).toHaveClass(
+ "min-w-0",
+ "max-w-full",
+ );
+ expect(markdown.parentElement?.parentElement?.parentElement).toHaveClass(
+ "min-w-0",
+ );
+ });
+
+ it("keeps Mermaid diagrams inside the constrained markdown wrapper", () => {
+ // Given
+ const mermaidMessage = buildAssistantMessage([
+ textPart("part-1", "```mermaid\ngraph TD\n A --> B\n```"),
+ ]);
+
+ // When
+ render(<MessageBubble message={mermaidMessage} />);
+
+ // Then
+ const mermaid = screen.getByRole("img", { name: "Mermaid chart" });
+ const markdown = mermaid.closest(".lighthouse-markdown");
+ if (!(markdown instanceof HTMLElement)) {
+ throw new Error("Expected markdown wrapper around Mermaid diagram");
+ }
+
+ expect(markdown).toHaveClass("min-w-0", "max-w-full", "overflow-x-auto");
+ expect(markdown.parentElement).toHaveClass("min-w-0");
+ expect(markdown.parentElement?.parentElement).toHaveClass(
+ "min-w-0",
+ "max-w-full",
+ );
+ });
+});
+
+function isBefore(first: HTMLElement, second: HTMLElement): boolean {
+ return Boolean(
+ first.compareDocumentPosition(second) & Node.DOCUMENT_POSITION_FOLLOWING,
+ );
+}
+
+function buildAssistantMessage(
+ parts: LighthouseV2Message["parts"],
+): LighthouseV2Message {
+ return {
+ id: "message-1",
+ role: LIGHTHOUSE_V2_MESSAGE_ROLE.ASSISTANT,
+ model: null,
+ tokenUsage: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ parts,
+ };
+}
+
+function textPart(
+ id: string,
+ text: string,
+): LighthouseV2Message["parts"][number] {
+ return {
+ id,
+ type: LIGHTHOUSE_V2_PART_TYPE.TEXT,
+ content: { text },
+ toolCallOutcome: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ };
+}
+
+function toolCallPart(
+ id: string,
+ toolName: string,
+): LighthouseV2Message["parts"][number] {
+ return {
+ id,
+ type: LIGHTHOUSE_V2_PART_TYPE.TOOL_CALL,
+ content: {
+ tool_call_id: id,
+ tool_name: toolName,
+ arguments: null,
+ result: null,
+ outcome: "success",
+ },
+ toolCallOutcome: "success",
+ insertedAt: "2026-06-25T10:00:01Z",
+ updatedAt: "2026-06-25T10:00:01Z",
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.tsx b/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.tsx
new file mode 100644
index 0000000000..3c79e880ab
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/message-bubble.tsx
@@ -0,0 +1,206 @@
+"use client";
+
+import { Bot, Check, Copy, UserRound } from "lucide-react";
+import { useState } from "react";
+
+import { formatMessageTimestamp } from "@/app/(prowler)/lighthouse/_lib/format";
+import { getTextContent } from "@/app/(prowler)/lighthouse/_lib/messages";
+import {
+ LIGHTHOUSE_V2_MESSAGE_ROLE,
+ LIGHTHOUSE_V2_PART_TYPE,
+ type LighthouseV2Message,
+ type LighthouseV2Part,
+} from "@/app/(prowler)/lighthouse/_types";
+import { Button } from "@/components/shadcn/button/button";
+import { cn } from "@/lib/utils";
+
+import { MessageMarkdown } from "./message-markdown";
+import { ToolCalls } from "./tool-call-part";
+
+const ASSISTANT_PART_GROUP_TYPE = {
+ TEXT: "text",
+ TOOL_CALL: "tool_call",
+} as const;
+
+type AssistantPartGroupType =
+ (typeof ASSISTANT_PART_GROUP_TYPE)[keyof typeof ASSISTANT_PART_GROUP_TYPE];
+
+interface AssistantPartGroup {
+ id: string;
+ type: AssistantPartGroupType;
+ parts: LighthouseV2Part[];
+}
+
+export function MessageBubble({ message }: { message: LighthouseV2Message }) {
+ const isUser = message.role === LIGHTHOUSE_V2_MESSAGE_ROLE.USER;
+ // Text-only join feeds the copy button; tool calls are rendered separately.
+ const messageText = message.parts
+ .filter((part) => part.type === LIGHTHOUSE_V2_PART_TYPE.TEXT)
+ .map((part) => getTextContent(part.content))
+ .filter(Boolean)
+ .join("\n\n");
+
+ return (
+ <article
+ className={cn(
+ "group flex min-w-0 gap-3",
+ isUser ? "justify-end" : "justify-start",
+ )}
+ >
+ {!isUser && <Bot className="text-text-neutral-tertiary mt-1 size-5" />}
+ <div
+ className={cn(
+ "flex max-w-[min(760px,85%)] min-w-0 flex-col gap-1",
+ isUser ? "items-end" : "items-start",
+ )}
+ >
+ <div
+ className={cn(
+ "max-w-full min-w-0 rounded-[8px] px-4 py-3 text-sm",
+ isUser
+ ? "bg-button-primary text-slate-950"
+ : "bg-bg-neutral-tertiary text-text-neutral-primary",
+ )}
+ >
+ {/* User text stays plain to preserve HTML-like tags; assistant
+ renders parts in order so tool calls sit between text blocks. */}
+ {isUser ? (
+ <p className="whitespace-pre-wrap">{messageText}</p>
+ ) : (
+ <AssistantParts parts={message.parts} />
+ )}
+ </div>
+ <MessageMeta
+ isUser={isUser}
+ text={messageText}
+ insertedAt={message.insertedAt}
+ />
+ </div>
+ {isUser && (
+ <UserRound className="text-text-neutral-tertiary mt-1 size-5" />
+ )}
+ </article>
+ );
+}
+
+function AssistantParts({ parts }: { parts: LighthouseV2Part[] }) {
+ const groups = groupAssistantParts(parts);
+
+ return (
+ <div className="min-w-0 space-y-3">
+ {groups.map((group) =>
+ group.type === ASSISTANT_PART_GROUP_TYPE.TOOL_CALL ? (
+ <ToolCalls key={group.id} parts={group.parts} />
+ ) : (
+ <AssistantTextParts key={group.id} parts={group.parts} />
+ ),
+ )}
+ </div>
+ );
+}
+
+function AssistantTextParts({ parts }: { parts: LighthouseV2Part[] }) {
+ return parts.map((part, index) => {
+ const text = getTextContent(part.content);
+ return text ? (
+ <MessageMarkdown key={part.id || `text-${index}`} text={text} />
+ ) : null;
+ });
+}
+
+function groupAssistantParts(parts: LighthouseV2Part[]): AssistantPartGroup[] {
+ return parts.reduce<AssistantPartGroup[]>((groups, part, index) => {
+ const groupType = getAssistantPartGroupType(part);
+ if (!groupType) {
+ return groups;
+ }
+
+ const lastGroup = groups.at(-1);
+ if (lastGroup?.type === groupType) {
+ return [
+ ...groups.slice(0, -1),
+ {
+ ...lastGroup,
+ parts: [...lastGroup.parts, part],
+ },
+ ];
+ }
+
+ return [
+ ...groups,
+ {
+ id: `${groupType}-${part.id || index}`,
+ type: groupType,
+ parts: [part],
+ },
+ ];
+ }, []);
+}
+
+function getAssistantPartGroupType(
+ part: LighthouseV2Part,
+): AssistantPartGroupType | null {
+ if (part.type === LIGHTHOUSE_V2_PART_TYPE.TEXT) {
+ return ASSISTANT_PART_GROUP_TYPE.TEXT;
+ }
+ if (part.type === LIGHTHOUSE_V2_PART_TYPE.TOOL_CALL) {
+ return ASSISTANT_PART_GROUP_TYPE.TOOL_CALL;
+ }
+ return null;
+}
+
+function MessageMeta({
+ isUser,
+ text,
+ insertedAt,
+}: {
+ isUser: boolean;
+ text: string;
+ insertedAt: string;
+}) {
+ // Copy is always shown; the timestamp only reveals on hover over the message.
+ // Agent footer reads left-to-right ([copy] [time]); user footer mirrors it.
+ return (
+ <div
+ className={cn(
+ "flex items-center gap-1 px-1",
+ isUser && "flex-row-reverse",
+ )}
+ >
+ <CopyMessageButton text={text} />
+ <time
+ dateTime={insertedAt}
+ className="text-text-neutral-tertiary text-xs opacity-0 transition-opacity group-hover:opacity-100"
+ >
+ {formatMessageTimestamp(insertedAt)}
+ </time>
+ </div>
+ );
+}
+
+function CopyMessageButton({ text }: { text: string }) {
+ const [copied, setCopied] = useState(false);
+
+ const handleCopy = async () => {
+ try {
+ await navigator.clipboard.writeText(text);
+ setCopied(true);
+ window.setTimeout(() => setCopied(false), 1500);
+ } catch {
+ // Clipboard can reject (e.g. permissions); nothing to recover.
+ }
+ };
+
+ return (
+ <Button
+ type="button"
+ variant="ghost"
+ size="icon-sm"
+ aria-label="Copy message"
+ onClick={handleCopy}
+ className="text-text-neutral-tertiary hover:text-text-neutral-primary size-6"
+ >
+ {copied ? <Check className="size-3.5" /> : <Copy className="size-3.5" />}
+ </Button>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/message-markdown.tsx b/ui/app/(prowler)/lighthouse/_components/chat/message-markdown.tsx
new file mode 100644
index 0000000000..89755c155e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/message-markdown.tsx
@@ -0,0 +1,32 @@
+import { defaultRehypePlugins, Streamdown } from "streamdown";
+
+import { escapeAngleBracketPlaceholders } from "@/lib/markdown";
+
+// Renders assistant message text as markdown (code blocks, tables, lists),
+// matching the Lighthouse v1 chat. `isStreaming` animates partial output.
+export function MessageMarkdown({
+ text,
+ isStreaming = false,
+}: {
+ text: string;
+ isStreaming?: boolean;
+}) {
+ return (
+ <div className="lighthouse-markdown max-w-full min-w-0 overflow-x-auto">
+ <Streamdown
+ parseIncompleteMarkdown
+ shikiTheme={["github-light", "github-dark"]}
+ controls={{ code: true, table: true, mermaid: true }}
+ // Omit defaultRehypePlugins.raw so HTML-like tokens (e.g. <bucket_name>)
+ // are escaped rather than parsed as elements.
+ rehypePlugins={[
+ defaultRehypePlugins.katex,
+ defaultRehypePlugins.harden,
+ ]}
+ isAnimating={isStreaming}
+ >
+ {escapeAngleBracketPlaceholders(text)}
+ </Streamdown>
+ </div>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/streaming-message.tsx b/ui/app/(prowler)/lighthouse/_components/chat/streaming-message.tsx
new file mode 100644
index 0000000000..0127ce5917
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/streaming-message.tsx
@@ -0,0 +1,244 @@
+"use client";
+
+import { Bot, Loader2 } from "lucide-react";
+
+import {
+ ChainOfThought,
+ ChainOfThoughtContent,
+ ChainOfThoughtHeader,
+ ChainOfThoughtStep,
+} from "@/app/(prowler)/lighthouse/_components/ai-elements/chain-of-thought";
+import {
+ LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE,
+ LIGHTHOUSE_V2_STREAM_STATUS,
+ LIGHTHOUSE_V2_TOOL_CALL_STATUS,
+ type LighthouseV2StreamActivityItem,
+ type LighthouseV2StreamState,
+ type LighthouseV2StreamToolCallActivityItem,
+} from "@/app/(prowler)/lighthouse/_lib/event-reducer";
+import { formatToolName } from "@/app/(prowler)/lighthouse/_lib/tool-calls";
+import { cn } from "@/lib/utils";
+
+import { MessageMarkdown } from "./message-markdown";
+
+const STREAMING_ACTIVITY_GROUP_TYPE = {
+ TEXT: "text",
+ TOOL_CALL: "tool_call",
+} as const;
+
+interface StreamingTextActivityGroup {
+ id: string;
+ type: typeof STREAMING_ACTIVITY_GROUP_TYPE.TEXT;
+ text: string;
+}
+
+interface StreamingToolCallActivityGroup {
+ id: string;
+ type: typeof STREAMING_ACTIVITY_GROUP_TYPE.TOOL_CALL;
+ toolCalls: LighthouseV2StreamToolCallActivityItem[];
+}
+
+type StreamingActivityGroup =
+ | StreamingTextActivityGroup
+ | StreamingToolCallActivityGroup;
+
+export function StreamingAssistantMessage({
+ streamState,
+}: {
+ streamState: LighthouseV2StreamState;
+}) {
+ const hasActivity =
+ Boolean(streamState.activeTaskId) || streamState.toolCalls.length > 0;
+
+ return (
+ <article className="flex min-w-0 justify-start gap-3">
+ <Bot className="text-text-neutral-tertiary mt-1 size-5" />
+ <div className="bg-bg-neutral-tertiary text-text-neutral-primary max-w-[min(760px,85%)] min-w-0 rounded-[8px] px-4 py-3 text-sm">
+ {streamState.activityItems.length > 0 ? (
+ <StreamingActivityGroups streamState={streamState} />
+ ) : (
+ hasActivity && <StreamingPendingActivity streamState={streamState} />
+ )}
+ </div>
+ </article>
+ );
+}
+
+function StreamingActivityGroups({
+ streamState,
+}: {
+ streamState: LighthouseV2StreamState;
+}) {
+ const groups = groupStreamingActivityItems(streamState.activityItems);
+ const isDisconnected =
+ streamState.status === LIGHTHOUSE_V2_STREAM_STATUS.DISCONNECTED;
+
+ return (
+ <div className="min-w-0 space-y-3">
+ {groups.map((group) =>
+ group.type === STREAMING_ACTIVITY_GROUP_TYPE.TOOL_CALL ? (
+ <StreamingToolCallGroup key={group.id} toolCalls={group.toolCalls} />
+ ) : (
+ <MessageMarkdown key={group.id} text={group.text} isStreaming />
+ ),
+ )}
+ {isDisconnected && <StreamingReconnectActivity />}
+ </div>
+ );
+}
+
+function StreamingPendingActivity({
+ streamState,
+}: {
+ streamState: LighthouseV2StreamState;
+}) {
+ const isDisconnected =
+ streamState.status === LIGHTHOUSE_V2_STREAM_STATUS.DISCONNECTED;
+
+ return (
+ <ChainOfThought className="max-w-none space-y-0">
+ <ChainOfThoughtHeader className="text-text-neutral-secondary">
+ <span className={cn(!isDisconnected && "animate-pulse")}>
+ {getActivityHeader(streamState)}
+ </span>
+ </ChainOfThoughtHeader>
+ <ChainOfThoughtContent className="mt-2 space-y-2">
+ <ChainOfThoughtStep label="Preparing response" status="active" />
+ {isDisconnected && (
+ <ChainOfThoughtStep label="Reconnecting stream" status="active" />
+ )}
+ </ChainOfThoughtContent>
+ </ChainOfThought>
+ );
+}
+
+function StreamingToolCallGroup({
+ toolCalls,
+}: {
+ toolCalls: LighthouseV2StreamToolCallActivityItem[];
+}) {
+ return (
+ <ChainOfThought className="max-w-none space-y-0">
+ <ChainOfThoughtHeader className="text-text-neutral-secondary">
+ <span className={cn(hasRunningToolCall(toolCalls) && "animate-pulse")}>
+ {getToolActivityHeader(toolCalls)}
+ </span>
+ </ChainOfThoughtHeader>
+ <ChainOfThoughtContent className="mt-2 space-y-2">
+ {toolCalls.map((toolCall) => (
+ <ChainOfThoughtStep
+ key={toolCall.id}
+ description={
+ toolCall.outcome && toolCall.outcome.toLowerCase() !== "success"
+ ? toolCall.outcome
+ : undefined
+ }
+ icon={
+ toolCall.status === LIGHTHOUSE_V2_TOOL_CALL_STATUS.RUNNING
+ ? Loader2
+ : undefined
+ }
+ label={getToolCallLabel(toolCall)}
+ status={
+ toolCall.status === LIGHTHOUSE_V2_TOOL_CALL_STATUS.RUNNING
+ ? "active"
+ : "complete"
+ }
+ />
+ ))}
+ </ChainOfThoughtContent>
+ </ChainOfThought>
+ );
+}
+
+function StreamingReconnectActivity() {
+ return (
+ <ChainOfThought className="max-w-none space-y-0">
+ <ChainOfThoughtHeader className="text-text-neutral-secondary">
+ <span className="animate-pulse">Reconnecting</span>
+ </ChainOfThoughtHeader>
+ <ChainOfThoughtContent className="mt-2 space-y-2">
+ <ChainOfThoughtStep label="Reconnecting stream" status="active" />
+ </ChainOfThoughtContent>
+ </ChainOfThought>
+ );
+}
+
+function getActivityHeader(streamState: LighthouseV2StreamState): string {
+ if (streamState.status === LIGHTHOUSE_V2_STREAM_STATUS.DISCONNECTED) {
+ return "Reconnecting";
+ }
+ return "Thinking";
+}
+
+function getToolCallLabel(
+ toolCall: LighthouseV2StreamToolCallActivityItem,
+): string {
+ return `${toolCall.status === LIGHTHOUSE_V2_TOOL_CALL_STATUS.RUNNING ? "Calling" : "Called"} ${formatToolName(toolCall.name)}`;
+}
+
+function getToolActivityHeader(
+ toolCalls: LighthouseV2StreamToolCallActivityItem[],
+): string {
+ if (toolCalls.length === 1) {
+ return getToolCallLabel(toolCalls[0]);
+ }
+
+ return hasRunningToolCall(toolCalls) ? "Using tools" : "Used tools";
+}
+
+function hasRunningToolCall(
+ toolCalls: LighthouseV2StreamToolCallActivityItem[],
+): boolean {
+ return toolCalls.some(
+ (toolCall) => toolCall.status === LIGHTHOUSE_V2_TOOL_CALL_STATUS.RUNNING,
+ );
+}
+
+function groupStreamingActivityItems(
+ activityItems: LighthouseV2StreamActivityItem[],
+): StreamingActivityGroup[] {
+ return activityItems.reduce<StreamingActivityGroup[]>((groups, item) => {
+ const lastGroup = groups.at(-1);
+
+ if (item.type === LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TEXT) {
+ if (lastGroup?.type === STREAMING_ACTIVITY_GROUP_TYPE.TEXT) {
+ return [
+ ...groups.slice(0, -1),
+ {
+ ...lastGroup,
+ text: `${lastGroup.text}${item.text}`,
+ },
+ ];
+ }
+
+ return [
+ ...groups,
+ {
+ id: item.id,
+ type: STREAMING_ACTIVITY_GROUP_TYPE.TEXT,
+ text: item.text,
+ },
+ ];
+ }
+
+ if (lastGroup?.type === STREAMING_ACTIVITY_GROUP_TYPE.TOOL_CALL) {
+ return [
+ ...groups.slice(0, -1),
+ {
+ ...lastGroup,
+ toolCalls: [...lastGroup.toolCalls, item],
+ },
+ ];
+ }
+
+ return [
+ ...groups,
+ {
+ id: item.id,
+ type: STREAMING_ACTIVITY_GROUP_TYPE.TOOL_CALL,
+ toolCalls: [item],
+ },
+ ];
+ }, []);
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/chat/tool-call-part.tsx b/ui/app/(prowler)/lighthouse/_components/chat/tool-call-part.tsx
new file mode 100644
index 0000000000..c15849367e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/chat/tool-call-part.tsx
@@ -0,0 +1,124 @@
+"use client";
+
+import { Check, ChevronDown, TriangleAlert, Wrench } from "lucide-react";
+
+import {
+ ChainOfThought,
+ ChainOfThoughtContent,
+ ChainOfThoughtHeader,
+} from "@/app/(prowler)/lighthouse/_components/ai-elements/chain-of-thought";
+import {
+ formatToolName,
+ getToolCallContent,
+ isToolCallError,
+} from "@/app/(prowler)/lighthouse/_lib/tool-calls";
+import type { LighthouseV2Part } from "@/app/(prowler)/lighthouse/_types";
+import {
+ Collapsible,
+ CollapsibleContent,
+ CollapsibleTrigger,
+} from "@/components/shadcn/collapsible";
+import {
+ QUERY_EDITOR_LANGUAGE,
+ QueryCodeEditor,
+} from "@/components/shared/query-code-editor";
+
+// Groups consecutive finished tool calls under one collapsed disclosure so the
+// "work" stays compact while surrounding text can render in chronological order.
+export function ToolCalls({ parts }: { parts: LighthouseV2Part[] }) {
+ if (parts.length === 0) {
+ return null;
+ }
+ const label = getToolCallsLabel(parts);
+
+ return (
+ <ChainOfThought className="space-y-0">
+ <ChainOfThoughtHeader className="text-text-neutral-secondary">
+ {label}
+ </ChainOfThoughtHeader>
+ <ChainOfThoughtContent className="mt-2 space-y-1.5">
+ {parts.map((part, index) => (
+ <ToolCallPart key={part.id || `tool-${index}`} part={part} />
+ ))}
+ </ChainOfThoughtContent>
+ </ChainOfThought>
+ );
+}
+
+function getToolCallsLabel(parts: LighthouseV2Part[]): string {
+ if (parts.length === 1) {
+ const toolCall = getToolCallContent(parts[0].content);
+ if (toolCall) {
+ return `Used ${formatToolName(toolCall.toolName)}`;
+ }
+ }
+
+ return `Used ${parts.length} ${parts.length === 1 ? "tool" : "tools"}`;
+}
+
+// One tool call as a light, collapsed row: status + humanized name, expanding to
+// the arguments the agent sent and the result it got back.
+function ToolCallPart({ part }: { part: LighthouseV2Part }) {
+ const toolCall = getToolCallContent(part.content);
+ if (!toolCall) {
+ return null;
+ }
+
+ // `content.outcome` is authoritative; fall back to the part-level column.
+ const outcome = toolCall.outcome ?? part.toolCallOutcome;
+ const isError = isToolCallError(outcome);
+
+ return (
+ <Collapsible className="border-border-neutral-secondary rounded-[6px] border">
+ <CollapsibleTrigger className="group flex w-full items-center gap-2 px-2.5 py-1.5 text-xs">
+ {isError ? (
+ <TriangleAlert className="text-text-error-primary size-3.5 shrink-0" />
+ ) : (
+ <Check className="text-text-success-primary size-3.5 shrink-0" />
+ )}
+ <Wrench className="text-text-neutral-tertiary size-3.5 shrink-0" />
+ <span className="text-text-neutral-primary flex-1 truncate text-left">
+ {formatToolName(toolCall.toolName)}
+ </span>
+ {isError && outcome && (
+ <span className="text-text-error-primary truncate">{outcome}</span>
+ )}
+ <ChevronDown className="text-text-neutral-tertiary size-3.5 shrink-0 transition-transform group-data-[state=open]:rotate-180" />
+ </CollapsibleTrigger>
+ <CollapsibleContent className="space-y-2 px-2.5 pb-2.5">
+ <ToolCallSection label="Arguments" value={toolCall.arguments} />
+ <ToolCallSection label="Result" value={toolCall.result} />
+ </CollapsibleContent>
+ </Collapsible>
+ );
+}
+
+function ToolCallSection({ label, value }: { label: string; value: unknown }) {
+ if (value === null || value === undefined || value === "") {
+ return null;
+ }
+ // String results (often markdown) render as plain text so real newlines show
+ // instead of escaped "\n"; structured values render as highlighted JSON.
+ const isText = typeof value === "string";
+ const text = isText ? value : JSON.stringify(value, null, 2);
+ if (!text) {
+ return null;
+ }
+
+ return (
+ <QueryCodeEditor
+ ariaLabel={label}
+ visibleLabel={label}
+ language={
+ isText ? QUERY_EDITOR_LANGUAGE.PLAIN_TEXT : QUERY_EDITOR_LANGUAGE.JSON
+ }
+ value={text}
+ copyValue={text}
+ editable={false}
+ minHeight={0}
+ showCopyButton
+ showLineNumbers={false}
+ onChange={() => {}}
+ />
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/business-context-form.test.tsx b/ui/app/(prowler)/lighthouse/_components/config/business-context-form.test.tsx
new file mode 100644
index 0000000000..1f2e622de2
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/business-context-form.test.tsx
@@ -0,0 +1,137 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { LighthouseV2BusinessContextForm } from "./business-context-form";
+
+const { updateConfigurationMock } = vi.hoisted(() => ({
+ updateConfigurationMock: vi.fn(),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ updateLighthouseV2Configuration: updateConfigurationMock,
+}));
+
+function configuration(businessContext: string) {
+ return {
+ id: "config-1",
+ providerType: "bedrock" as const,
+ baseUrl: null,
+ defaultModel: null,
+ businessContext,
+ connected: true,
+ connectionLastCheckedAt: null,
+ insertedAt: "2026-06-25T09:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ };
+}
+
+describe("LighthouseV2BusinessContextForm", () => {
+ beforeEach(() => {
+ updateConfigurationMock.mockReset();
+ updateConfigurationMock.mockResolvedValue({
+ data: configuration("Production context"),
+ });
+ });
+
+ it("seeds the textarea with the business context and disables save until edited", () => {
+ // Given / When
+ render(
+ <LighthouseV2BusinessContextForm
+ configurationId="config-1"
+ initialBusinessContext="Production context"
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("textbox", { name: /Business context/i }),
+ ).toHaveValue("Production context");
+ expect(
+ screen.getByRole("button", { name: "Save business context" }),
+ ).toBeDisabled();
+ });
+
+ it("saves the shared business context against the provider configuration", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <LighthouseV2BusinessContextForm
+ configurationId="config-1"
+ initialBusinessContext=""
+ />,
+ );
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: /Business context/i }),
+ "Production context",
+ );
+ await user.click(
+ screen.getByRole("button", { name: "Save business context" }),
+ );
+
+ // Then
+ await waitFor(() =>
+ expect(updateConfigurationMock).toHaveBeenCalledWith("config-1", {
+ businessContext: "Production context",
+ }),
+ );
+ });
+
+ it("shows the counter and blocks saving over the character limit", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <LighthouseV2BusinessContextForm
+ configurationId="config-1"
+ initialBusinessContext=""
+ />,
+ );
+
+ // When: paste in one event instead of 5001 keystrokes
+ await user.click(
+ screen.getByRole("textbox", { name: /Business context/i }),
+ );
+ await user.paste("a".repeat(5001));
+
+ // Then
+ expect(screen.getByText("5001/5000")).toBeInTheDocument();
+ expect(
+ screen.getByText("Business context cannot exceed 5000 characters."),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("button", { name: "Save business context" }),
+ ).toBeDisabled();
+ expect(updateConfigurationMock).not.toHaveBeenCalled();
+ });
+
+ it("surfaces the backend reason when the save fails", async () => {
+ // Given
+ const user = userEvent.setup();
+ updateConfigurationMock.mockResolvedValue({
+ error: "No active configuration found for 'bedrock'.",
+ status: 400,
+ });
+ render(
+ <LighthouseV2BusinessContextForm
+ configurationId="config-1"
+ initialBusinessContext=""
+ />,
+ );
+
+ // When
+ await user.type(
+ screen.getByRole("textbox", { name: /Business context/i }),
+ "Production context",
+ );
+ await user.click(
+ screen.getByRole("button", { name: "Save business context" }),
+ );
+
+ // Then
+ expect(
+ await screen.findByText("No active configuration found for 'bedrock'."),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_components/config/business-context-form.tsx b/ui/app/(prowler)/lighthouse/_components/config/business-context-form.tsx
new file mode 100644
index 0000000000..6e02d11cad
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/business-context-form.tsx
@@ -0,0 +1,128 @@
+"use client";
+
+import { Bot, Loader2, Save } from "lucide-react";
+import { useState } from "react";
+
+import { updateLighthouseV2Configuration } from "@/app/(prowler)/lighthouse/_actions";
+import { BUSINESS_CONTEXT_LIMIT } from "@/app/(prowler)/lighthouse/_lib/config";
+import { Button } from "@/components/shadcn/button/button";
+import { Card } from "@/components/shadcn/card/card";
+import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
+import { Textarea } from "@/components/shadcn/textarea/textarea";
+import { cn } from "@/lib/utils";
+
+// Shared business context. The backend syncs it across every provider config, so
+// it is edited once here against any single configuration rather than per provider.
+export function LighthouseV2BusinessContextForm({
+ configurationId,
+ initialBusinessContext,
+}: {
+ configurationId: string;
+ initialBusinessContext: string;
+}) {
+ const [businessContext, setBusinessContext] = useState(
+ initialBusinessContext,
+ );
+ const [savedContext, setSavedContext] = useState(initialBusinessContext);
+ const [saving, setSaving] = useState(false);
+ const [error, setError] = useState<string | null>(null);
+
+ const overLimit = businessContext.length > BUSINESS_CONTEXT_LIMIT;
+ const isDirty = businessContext !== savedContext;
+ const canSave = isDirty && !overLimit && !saving;
+
+ const handleSave = async () => {
+ if (!canSave) return;
+
+ setSaving(true);
+ setError(null);
+
+ try {
+ const result = await updateLighthouseV2Configuration(configurationId, {
+ businessContext,
+ });
+
+ if ("error" in result) {
+ setError(result.error);
+ return;
+ }
+
+ setSavedContext(result.data.businessContext);
+ setBusinessContext(result.data.businessContext);
+ } catch {
+ setError("Something went wrong while saving. Please try again.");
+ } finally {
+ setSaving(false);
+ }
+ };
+
+ return (
+ <Card
+ variant="inner"
+ padding="none"
+ data-lighthouse-v2-business-context=""
+ className="gap-4 p-4 md:p-5"
+ >
+ <div className="flex items-start gap-3">
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex size-12 shrink-0 items-center justify-center rounded-[10px] border">
+ <Bot className="text-text-neutral-secondary size-6" />
+ </div>
+ <div className="min-w-0">
+ <h3 className="text-text-neutral-primary text-xl font-semibold">
+ Business context
+ </h3>
+ <p className="text-text-neutral-secondary mt-1 max-w-2xl text-sm">
+ Shared context Lighthouse AI considers for every provider and chat.
+ </p>
+ </div>
+ </div>
+
+ <div className="flex flex-col gap-4">
+ <Field>
+ <div className="flex items-center justify-between gap-3">
+ <FieldLabel htmlFor="lighthouse-v2-business-context">
+ Business context
+ </FieldLabel>
+ <span
+ className={cn(
+ "text-xs",
+ overLimit
+ ? "text-text-error-primary"
+ : "text-text-neutral-tertiary",
+ )}
+ >
+ {businessContext.length}/{BUSINESS_CONTEXT_LIMIT}
+ </span>
+ </div>
+ <Textarea
+ id="lighthouse-v2-business-context"
+ textareaSize="lg"
+ aria-invalid={overLimit}
+ value={businessContext}
+ onChange={(event) => setBusinessContext(event.target.value)}
+ placeholder="Example: production AWS accounts, PCI workloads, EU data residency, critical internet-facing services..."
+ />
+ {overLimit && (
+ <FieldError>
+ Business context cannot exceed {BUSINESS_CONTEXT_LIMIT}{" "}
+ characters.
+ </FieldError>
+ )}
+ {error && <FieldError>{error}</FieldError>}
+ </Field>
+
+ <div className="flex justify-end">
+ <Button
+ type="button"
+ aria-label="Save business context"
+ onClick={handleSave}
+ disabled={!canSave}
+ >
+ {saving ? <Loader2 className="animate-spin" /> : <Save />}
+ {saving ? "Saving…" : "Save"}
+ </Button>
+ </div>
+ </div>
+ </Card>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/configuration-form.tsx b/ui/app/(prowler)/lighthouse/_components/config/configuration-form.tsx
new file mode 100644
index 0000000000..6ce5bab8b2
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/configuration-form.tsx
@@ -0,0 +1,325 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { KeyRound, Loader2, PlugZap, Save, Trash2 } from "lucide-react";
+import { useState } from "react";
+import { useForm } from "react-hook-form";
+
+import {
+ createLighthouseV2Configuration,
+ deleteLighthouseV2Configuration,
+ testLighthouseV2ConfigurationConnection,
+ updateLighthouseV2Configuration,
+} from "@/app/(prowler)/lighthouse/_actions";
+import {
+ buildCredentialPayload,
+ buildLighthouseV2ConfigFormSchema,
+ buildLighthouseV2ConfigurationInput,
+ EMPTY_FORM_VALUES,
+ FEEDBACK_VARIANT,
+ type FeedbackState,
+ getConnectionStatus,
+ getFormDefaults,
+ type LighthouseV2ConfigFormValues,
+ trimToNullable,
+} from "@/app/(prowler)/lighthouse/_lib/config";
+import { formatLastChecked } from "@/app/(prowler)/lighthouse/_lib/format";
+import { notifyLighthouseV2ConfigurationsChanged } from "@/app/(prowler)/lighthouse/_lib/session-events";
+import {
+ type LighthouseV2Configuration,
+ type LighthouseV2ConfigurationUpdateInput,
+ type LighthouseV2Credentials,
+ type LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { Button } from "@/components/shadcn/button/button";
+import { Card } from "@/components/shadcn/card/card";
+import { Modal } from "@/components/shadcn/modal";
+
+import { ConfigurationSection } from "./configuration-section";
+import { CredentialFields } from "./credential-fields";
+import { ProviderIcon } from "./provider-icon";
+import { StatusBadge } from "./status-badge";
+
+export function LighthouseV2ConfigurationForm({
+ configuration,
+ onConfigurationDeleted,
+ onConfigurationSaved,
+ onConfigurationTested,
+ onFeedback,
+ provider,
+}: {
+ configuration?: LighthouseV2Configuration;
+ onConfigurationDeleted: (configurationId: string) => void;
+ onConfigurationSaved: (configuration: LighthouseV2Configuration) => void;
+ onConfigurationTested: (configuration: LighthouseV2Configuration) => void;
+ onFeedback: (feedback: FeedbackState | null) => void;
+ provider: LighthouseV2SupportedProvider;
+}) {
+ const [saving, setSaving] = useState(false);
+ const [testing, setTesting] = useState(false);
+ const [deleting, setDeleting] = useState(false);
+ const [deleteOpen, setDeleteOpen] = useState(false);
+ const providerType = provider.id;
+ const hasConfiguration = Boolean(configuration);
+ const form = useForm<LighthouseV2ConfigFormValues>({
+ resolver: zodResolver(
+ buildLighthouseV2ConfigFormSchema(providerType, hasConfiguration),
+ ),
+ defaultValues: getFormDefaults(configuration),
+ mode: "onSubmit",
+ });
+ const status = getConnectionStatus(configuration);
+
+ const runConnectionTest = async (configurationId: string) => {
+ setTesting(true);
+ onFeedback(null);
+
+ try {
+ const result =
+ await testLighthouseV2ConfigurationConnection(configurationId);
+
+ if ("error" in result) {
+ onFeedback({
+ title: "Connection check failed",
+ description: result.error,
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ return;
+ }
+
+ onConfigurationTested(result.data);
+ } catch {
+ onFeedback({
+ title: "Connection check failed",
+ description: "Something went wrong while testing. Please try again.",
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ } finally {
+ setTesting(false);
+ }
+ };
+
+ const handleSave = async (values: LighthouseV2ConfigFormValues) => {
+ setSaving(true);
+ onFeedback(null);
+
+ const credentials = buildCredentialPayload(
+ providerType,
+ values,
+ hasConfiguration,
+ );
+ const baseUrl = trimToNullable(values.baseUrl);
+ const shouldTestAfterSave =
+ !configuration ||
+ Boolean(credentials) ||
+ baseUrl !== (configuration.baseUrl ?? null);
+
+ try {
+ const result = configuration
+ ? await updateLighthouseV2Configuration(configuration.id, {
+ baseUrl,
+ ...(credentials ? { credentials } : {}),
+ } satisfies LighthouseV2ConfigurationUpdateInput)
+ : await createLighthouseV2Configuration(
+ buildLighthouseV2ConfigurationInput(
+ providerType,
+ credentials as LighthouseV2Credentials,
+ baseUrl,
+ ),
+ );
+
+ if ("error" in result) {
+ onFeedback({
+ title: "Configuration not saved",
+ description: result.error,
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ return;
+ }
+
+ form.reset(getFormDefaults(result.data));
+ onConfigurationSaved(result.data);
+ notifyLighthouseV2ConfigurationsChanged();
+ if (shouldTestAfterSave) {
+ await runConnectionTest(result.data.id);
+ }
+ } catch {
+ onFeedback({
+ title: "Configuration not saved",
+ description: "Something went wrong while saving. Please try again.",
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ } finally {
+ setSaving(false);
+ }
+ };
+
+ const handleTestConnection = async () => {
+ if (!configuration) return;
+
+ await runConnectionTest(configuration.id);
+ };
+
+ const handleDelete = async () => {
+ if (!configuration) return;
+
+ setDeleting(true);
+
+ try {
+ const result = await deleteLighthouseV2Configuration(configuration.id);
+
+ if ("error" in result) {
+ onFeedback({
+ title: "Configuration not removed",
+ description: result.error,
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ return;
+ }
+
+ setDeleteOpen(false);
+ form.reset(EMPTY_FORM_VALUES);
+ onConfigurationDeleted(configuration.id);
+ notifyLighthouseV2ConfigurationsChanged();
+ } catch {
+ onFeedback({
+ title: "Configuration not removed",
+ description: "Something went wrong while deleting. Please try again.",
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ } finally {
+ setDeleting(false);
+ }
+ };
+
+ return (
+ <>
+ <Card
+ variant="inner"
+ padding="none"
+ className="h-full min-w-0 p-4 md:p-5"
+ >
+ <section className="flex h-full w-full min-w-0 flex-col gap-4">
+ <div className="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
+ <div className="flex min-w-0 gap-3">
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex size-12 shrink-0 items-center justify-center rounded-[10px] border">
+ <ProviderIcon
+ provider={providerType}
+ className="text-text-neutral-secondary size-6"
+ />
+ </div>
+ <div className="min-w-0">
+ <div className="flex flex-wrap items-center gap-2">
+ <h3 className="text-text-neutral-primary text-xl font-semibold">
+ {provider.name}
+ </h3>
+ <StatusBadge status={status} />
+ <span className="text-text-neutral-tertiary text-xs">
+ {formatLastChecked(configuration?.connectionLastCheckedAt)}
+ </span>
+ </div>
+ <p className="text-text-neutral-secondary mt-1 max-w-2xl text-sm">
+ {configuration
+ ? "Stored provider configuration. Rotate credentials only when needed."
+ : "Create provider configuration before Lighthouse AI can use this model family."}
+ </p>
+ </div>
+ </div>
+
+ <div className="flex flex-wrap items-center gap-2">
+ <Button
+ type="button"
+ variant="outline"
+ onClick={handleTestConnection}
+ disabled={!configuration || testing}
+ >
+ {testing ? <Loader2 className="animate-spin" /> : <PlugZap />}
+ {testing ? "Testing connection…" : "Test connection"}
+ </Button>
+ </div>
+ </div>
+
+ <div
+ aria-hidden="true"
+ className="border-border-neutral-secondary border-t"
+ />
+
+ <form
+ className="flex min-h-0 w-full flex-1 flex-col gap-4"
+ onSubmit={form.handleSubmit(handleSave)}
+ noValidate
+ >
+ <div className="min-h-0 overflow-y-auto">
+ <ConfigurationSection
+ icon={<KeyRound className="size-4" />}
+ title="Credentials"
+ description={
+ configuration
+ ? "Leave blank to keep existing credentials."
+ : "Credentials are required for new configurations."
+ }
+ >
+ <CredentialFields
+ errors={form.formState.errors}
+ hasStoredCredentials={hasConfiguration}
+ provider={providerType}
+ register={form.register}
+ />
+ </ConfigurationSection>
+ </div>
+
+ <div className="mt-auto flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">
+ <div className="text-text-neutral-secondary text-sm">
+ {configuration
+ ? "Saving updates may change chat behavior immediately."
+ : "Save provider before testing the connection."}
+ </div>
+ <div className="flex flex-wrap gap-2">
+ <Button type="submit" disabled={saving}>
+ {saving ? <Loader2 className="animate-spin" /> : <Save />}
+ Save
+ </Button>
+ <Button
+ type="button"
+ variant="destructive"
+ onClick={() => setDeleteOpen(true)}
+ disabled={!configuration || deleting}
+ >
+ {deleting ? <Loader2 className="animate-spin" /> : <Trash2 />}
+ Delete
+ </Button>
+ </div>
+ </div>
+ </form>
+ </section>
+ </Card>
+
+ <Modal
+ open={deleteOpen}
+ onOpenChange={setDeleteOpen}
+ title="Delete Lighthouse AI configuration?"
+ description={`This removes ${provider.name} from Lighthouse AI. Existing chat history stays available, but this provider cannot be used until configured again.`}
+ size="md"
+ >
+ <div className="flex justify-end gap-2">
+ <Button
+ type="button"
+ variant="outline"
+ onClick={() => setDeleteOpen(false)}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="button"
+ variant="destructive"
+ onClick={handleDelete}
+ disabled={deleting}
+ >
+ {deleting ? <Loader2 className="animate-spin" /> : <Trash2 />}
+ Delete configuration
+ </Button>
+ </div>
+ </Modal>
+ </>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/configuration-section.tsx b/ui/app/(prowler)/lighthouse/_components/config/configuration-section.tsx
new file mode 100644
index 0000000000..0e178bcf1e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/configuration-section.tsx
@@ -0,0 +1,32 @@
+import { type ReactNode } from "react";
+
+export function ConfigurationSection({
+ children,
+ description,
+ icon,
+ title,
+}: {
+ children: ReactNode;
+ description: string;
+ icon: ReactNode;
+ title: string;
+}) {
+ return (
+ <section className="grid gap-6 md:grid-cols-[220px_minmax(0,1fr)]">
+ <div className="flex gap-3">
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex size-8 shrink-0 items-center justify-center rounded-[8px] border">
+ {icon}
+ </div>
+ <div>
+ <h4 className="text-text-neutral-primary text-sm font-semibold">
+ {title}
+ </h4>
+ <p className="text-text-neutral-secondary mt-1 text-sm">
+ {description}
+ </p>
+ </div>
+ </div>
+ <div className="min-w-0">{children}</div>
+ </section>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/credential-fields.tsx b/ui/app/(prowler)/lighthouse/_components/config/credential-fields.tsx
new file mode 100644
index 0000000000..d850cd8029
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/credential-fields.tsx
@@ -0,0 +1,120 @@
+import { type useForm } from "react-hook-form";
+
+import { type LighthouseV2ConfigFormValues } from "@/app/(prowler)/lighthouse/_lib/config";
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2ProviderType,
+} from "@/app/(prowler)/lighthouse/_types";
+import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
+import { Input } from "@/components/shadcn/input/input";
+
+// Stored secrets are never sent back by the API, so the fields would look
+// empty even when a key exists; the masked placeholder stands in for it.
+const STORED_SECRET_PLACEHOLDER = "•".repeat(36);
+
+export function CredentialFields({
+ errors,
+ hasStoredCredentials = false,
+ provider,
+ register,
+}: {
+ errors: ReturnType<
+ typeof useForm<LighthouseV2ConfigFormValues>
+ >["formState"]["errors"];
+ hasStoredCredentials?: boolean;
+ provider: LighthouseV2ProviderType;
+ register: ReturnType<
+ typeof useForm<LighthouseV2ConfigFormValues>
+ >["register"];
+}) {
+ const secretPlaceholder = hasStoredCredentials
+ ? STORED_SECRET_PLACEHOLDER
+ : undefined;
+ return (
+ <div className="grid gap-4">
+ {(provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI ||
+ provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE) && (
+ <Field>
+ <FieldLabel htmlFor="lighthouse-v2-api-key">API key</FieldLabel>
+ <Input
+ id="lighthouse-v2-api-key"
+ type="password"
+ autoComplete="off"
+ placeholder={secretPlaceholder}
+ aria-invalid={Boolean(errors.apiKey)}
+ {...register("apiKey")}
+ />
+ {errors.apiKey?.message && (
+ <FieldError>{errors.apiKey.message}</FieldError>
+ )}
+ </Field>
+ )}
+
+ {provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE && (
+ <Field>
+ <FieldLabel htmlFor="lighthouse-v2-base-url">Base URL</FieldLabel>
+ <Input
+ id="lighthouse-v2-base-url"
+ aria-invalid={Boolean(errors.baseUrl)}
+ placeholder="https://llm.example.com/v1"
+ {...register("baseUrl")}
+ />
+ {errors.baseUrl?.message && (
+ <FieldError>{errors.baseUrl.message}</FieldError>
+ )}
+ </Field>
+ )}
+
+ {provider === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK && (
+ <div className="grid gap-4 md:grid-cols-2">
+ <Field>
+ <FieldLabel htmlFor="lighthouse-v2-access-key">
+ AWS access key ID
+ </FieldLabel>
+ <Input
+ id="lighthouse-v2-access-key"
+ type="password"
+ autoComplete="off"
+ placeholder={secretPlaceholder}
+ aria-invalid={Boolean(errors.awsAccessKeyId)}
+ {...register("awsAccessKeyId")}
+ />
+ {errors.awsAccessKeyId?.message && (
+ <FieldError>{errors.awsAccessKeyId.message}</FieldError>
+ )}
+ </Field>
+
+ <Field>
+ <FieldLabel htmlFor="lighthouse-v2-secret-key">
+ AWS secret access key
+ </FieldLabel>
+ <Input
+ id="lighthouse-v2-secret-key"
+ type="password"
+ autoComplete="off"
+ placeholder={secretPlaceholder}
+ aria-invalid={Boolean(errors.awsSecretAccessKey)}
+ {...register("awsSecretAccessKey")}
+ />
+ {errors.awsSecretAccessKey?.message && (
+ <FieldError>{errors.awsSecretAccessKey.message}</FieldError>
+ )}
+ </Field>
+
+ <Field className="md:col-span-2">
+ <FieldLabel htmlFor="lighthouse-v2-region">AWS region</FieldLabel>
+ <Input
+ id="lighthouse-v2-region"
+ placeholder="us-east-1"
+ aria-invalid={Boolean(errors.awsRegionName)}
+ {...register("awsRegionName")}
+ />
+ {errors.awsRegionName?.message && (
+ <FieldError>{errors.awsRegionName.message}</FieldError>
+ )}
+ </Field>
+ </div>
+ )}
+ </div>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/empty-state.tsx b/ui/app/(prowler)/lighthouse/_components/config/empty-state.tsx
new file mode 100644
index 0000000000..6094b2f97c
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/empty-state.tsx
@@ -0,0 +1,32 @@
+import { AlertCircle, DatabaseZap } from "lucide-react";
+
+import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn/alert";
+import { Card, CardContent } from "@/components/shadcn/card/card";
+
+export function LighthouseV2EmptyState({ error }: { error?: string }) {
+ return (
+ <Card variant="base" padding="lg" className="mx-auto max-w-3xl">
+ <CardContent className="flex flex-col items-center gap-4 py-8 text-center">
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex size-14 items-center justify-center rounded-[14px] border">
+ <DatabaseZap className="text-text-neutral-secondary size-7" />
+ </div>
+ <div>
+ <h2 className="text-text-neutral-primary text-xl font-semibold">
+ No Lighthouse AI providers available
+ </h2>
+ <p className="text-text-neutral-secondary mt-2 text-sm">
+ Cloud did not return supported providers for Lighthouse AI
+ configuration.
+ </p>
+ </div>
+ {error && (
+ <Alert variant="error" className="text-left">
+ <AlertCircle className="size-4" />
+ <AlertTitle>Configuration unavailable</AlertTitle>
+ <AlertDescription>{error}</AlertDescription>
+ </Alert>
+ )}
+ </CardContent>
+ </Card>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/index.ts b/ui/app/(prowler)/lighthouse/_components/config/index.ts
new file mode 100644
index 0000000000..bc276ea5c7
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/index.ts
@@ -0,0 +1 @@
+export { LighthouseV2ConfigPage } from "./lighthouse-v2-config-page";
diff --git a/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.test.tsx b/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.test.tsx
new file mode 100644
index 0000000000..84a13ee741
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.test.tsx
@@ -0,0 +1,404 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import { LighthouseV2ConfigPage } from "./lighthouse-v2-config-page";
+
+const {
+ createConfigurationMock,
+ deleteConfigurationMock,
+ testConnectionMock,
+ updateConfigurationMock,
+ toastMock,
+} = vi.hoisted(() => ({
+ createConfigurationMock: vi.fn(),
+ deleteConfigurationMock: vi.fn(),
+ testConnectionMock: vi.fn(),
+ updateConfigurationMock: vi.fn(),
+ toastMock: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ useRouter: () => ({ refresh: vi.fn(), push: vi.fn() }),
+}));
+
+// Action feedback is delivered through toasts (rendered by the layout Toaster),
+// so we assert the dispatched toast rather than in-page banner text.
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: toastMock, dismiss: vi.fn() }),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ createLighthouseV2Configuration: createConfigurationMock,
+ deleteLighthouseV2Configuration: deleteConfigurationMock,
+ testLighthouseV2ConfigurationConnection: testConnectionMock,
+ updateLighthouseV2Configuration: updateConfigurationMock,
+}));
+
+const providers: LighthouseV2SupportedProvider[] = [
+ { id: "openai", name: "OpenAI" },
+ { id: "bedrock", name: "Amazon Bedrock" },
+ { id: "openai-compatible", name: "OpenAI-compatible" },
+];
+
+const configurations: LighthouseV2Configuration[] = [
+ {
+ id: "config-openai",
+ providerType: "openai",
+ baseUrl: null,
+ defaultModel: "gpt-5.1",
+ businessContext: "Production context",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:00:00Z",
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ {
+ id: "config-bedrock",
+ providerType: "bedrock",
+ baseUrl: null,
+ defaultModel: "anthropic.claude-4",
+ businessContext: "Production context",
+ connected: false,
+ connectionLastCheckedAt: "2026-06-23T10:00:00Z",
+ insertedAt: "2026-06-23T09:00:00Z",
+ updatedAt: "2026-06-23T10:00:00Z",
+ },
+];
+
+describe("LighthouseV2ConfigPage", () => {
+ beforeEach(() => {
+ createConfigurationMock.mockReset();
+ deleteConfigurationMock.mockReset();
+ testConnectionMock.mockReset();
+ updateConfigurationMock.mockReset();
+ toastMock.mockReset();
+
+ createConfigurationMock.mockResolvedValue({ data: configurations[0] });
+ deleteConfigurationMock.mockResolvedValue({ data: true });
+ // The action polls the task internally and resolves with the re-fetched
+ // configuration carrying the authoritative connection status.
+ testConnectionMock.mockResolvedValue({
+ data: { ...configurations[0], connected: true },
+ });
+ updateConfigurationMock.mockResolvedValue({ data: configurations[0] });
+ });
+
+ it("renders provider statuses and the active provider without the readiness summary card", () => {
+ // Given / When
+ const { container } = renderPage();
+
+ // Then
+ expect(
+ screen.queryByRole("heading", { name: "Lighthouse readiness" }),
+ ).not.toBeInTheDocument();
+ expect(screen.queryByText("1 connected")).not.toBeInTheDocument();
+ expect(screen.queryByText("1 failed")).not.toBeInTheDocument();
+ expect(screen.queryByText("1 not tested")).not.toBeInTheDocument();
+
+ const openAIProvider = screen.getByRole("button", { name: "OpenAI" });
+ const settingsCard = screen.getByRole("region", {
+ name: "Lighthouse AI settings",
+ });
+ const settingsSeparator = container.querySelector(
+ '[data-slot="settings-separator"]',
+ );
+ const innerCards = settingsCard.querySelectorAll('[data-slot="card"]');
+
+ expect(settingsCard).toHaveAttribute("data-slot", "card");
+ expect(settingsCard).toHaveClass("w-full", "gap-4", "p-4", "md:p-5");
+ expect(settingsCard).not.toHaveClass(
+ "gap-0",
+ "overflow-hidden",
+ "mx-auto",
+ "max-w-7xl",
+ );
+ expect(settingsSeparator).toBeNull();
+ expect(innerCards).toHaveLength(3);
+ innerCards.forEach((card) =>
+ expect(card).toHaveClass(
+ "border-border-neutral-tertiary",
+ "bg-bg-neutral-tertiary",
+ ),
+ );
+ expect(settingsCard).toContainElement(openAIProvider);
+ expect(openAIProvider).toHaveAttribute("aria-pressed", "true");
+ expect(within(openAIProvider).getByText("Connected")).toBeInTheDocument();
+
+ const bedrockProvider = screen.getByRole("button", {
+ name: /Amazon Bedrock/i,
+ });
+ expect(within(bedrockProvider).getByText("Failed")).toBeInTheDocument();
+
+ const compatibleProvider = screen.getByRole("button", {
+ name: /OpenAI-compatible/i,
+ });
+ expect(
+ within(compatibleProvider).getByText("Not tested"),
+ ).toBeInTheDocument();
+ });
+
+ it("renders a single shared business context, not a per-provider default model", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // Then: business context is tenant-wide, so there is exactly one editor
+ expect(
+ screen.getAllByRole("textbox", { name: /Business context/i }),
+ ).toHaveLength(1);
+
+ // When switching providers, no per-provider model/context field appears
+ await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+
+ // Then
+ expect(
+ screen.queryByRole("combobox", { name: "Default model" }),
+ ).not.toBeInTheDocument();
+ expect(screen.queryByText("Default model")).not.toBeInTheDocument();
+ expect(
+ screen.getAllByRole("textbox", { name: /Business context/i }),
+ ).toHaveLength(1);
+ });
+
+ it("hides the business context editor until a provider is configured", () => {
+ // Given / When: no configurations exist yet
+ renderPage({ configurations: [] });
+
+ // Then: the editor is replaced by a hint and the textarea is absent
+ expect(
+ screen.queryByRole("textbox", { name: /Business context/i }),
+ ).not.toBeInTheDocument();
+ expect(screen.getByText(/Configure a provider first/i)).toBeInTheDocument();
+ });
+
+ it("updates an existing configuration without sending blank credentials or model defaults", async () => {
+ // Given
+ const user = userEvent.setup();
+ updateConfigurationMock.mockResolvedValue({ data: configurations[0] });
+ renderPage();
+
+ // When: save the active provider without touching credentials
+ await user.click(
+ within(
+ screen.getByRole("region", { name: "Lighthouse AI settings" }),
+ ).getByRole("button", { name: /^Save$/i }),
+ );
+
+ // Then
+ await waitFor(() => expect(updateConfigurationMock).toHaveBeenCalled());
+ expect(updateConfigurationMock.mock.calls[0]?.[0]).toBe("config-openai");
+ expect(updateConfigurationMock.mock.calls[0]?.[1]).not.toHaveProperty(
+ "credentials",
+ );
+ expect(updateConfigurationMock.mock.calls[0]?.[1]).not.toHaveProperty(
+ "defaultModel",
+ );
+ });
+
+ it("creates a new OpenAI-compatible configuration with required credentials", async () => {
+ // Given
+ const user = userEvent.setup();
+ const createdConfig: LighthouseV2Configuration = {
+ id: "config-compatible",
+ providerType: "openai-compatible",
+ baseUrl: "https://llm.example.com/v1",
+ defaultModel: "llama-3.3",
+ businessContext: "",
+ connected: null,
+ connectionLastCheckedAt: null,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ };
+ createConfigurationMock.mockResolvedValue({ data: createdConfig });
+ testConnectionMock.mockResolvedValue({
+ data: {
+ ...createdConfig,
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:01:00Z",
+ },
+ });
+ renderPage();
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: /OpenAI-compatible/i }),
+ );
+ await user.type(screen.getByLabelText("API key"), "provider-key");
+ await user.type(
+ screen.getByLabelText("Base URL"),
+ "https://llm.example.com/v1",
+ );
+ await user.click(screen.getByRole("button", { name: /^Save$/i }));
+
+ // Then
+ await waitFor(() => expect(createConfigurationMock).toHaveBeenCalled());
+ expect(createConfigurationMock.mock.calls[0]?.[0]).toEqual(
+ expect.objectContaining({
+ providerType: "openai-compatible",
+ credentials: { api_key: "provider-key" },
+ baseUrl: "https://llm.example.com/v1",
+ }),
+ );
+ expect(createConfigurationMock.mock.calls[0]?.[0]).not.toHaveProperty(
+ "defaultModel",
+ );
+ expect(createConfigurationMock.mock.calls[0]?.[0]).not.toHaveProperty(
+ "businessContext",
+ );
+ await waitFor(() =>
+ expect(testConnectionMock).toHaveBeenCalledWith("config-compatible"),
+ );
+ await waitFor(() =>
+ expect(toastMock).toHaveBeenCalledWith(
+ expect.objectContaining({ title: "Connection successful." }),
+ ),
+ );
+ expect(
+ within(
+ screen.getByRole("button", { name: /OpenAI-compatible/i }),
+ ).getByText("Connected"),
+ ).toBeInTheDocument();
+ });
+
+ it("hints at stored credentials with a masked placeholder", async () => {
+ // Given / When: OpenAI and Bedrock already have stored configurations
+ const user = userEvent.setup();
+ renderPage();
+
+ // Then: secret fields simulate the hidden stored key instead of looking
+ // empty, at a length resembling a real API key
+ const maskedKey = "•".repeat(36);
+ expect(screen.getByLabelText("API key")).toHaveAttribute(
+ "placeholder",
+ maskedKey,
+ );
+
+ await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+ expect(screen.getByLabelText("AWS access key ID")).toHaveAttribute(
+ "placeholder",
+ maskedKey,
+ );
+ expect(screen.getByLabelText("AWS secret access key")).toHaveAttribute(
+ "placeholder",
+ maskedKey,
+ );
+ });
+
+ it("shows no masked placeholder before credentials are stored", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When: OpenAI-compatible has no configuration yet
+ await user.click(
+ screen.getByRole("button", { name: /OpenAI-compatible/i }),
+ );
+
+ // Then
+ expect(screen.getByLabelText("API key")).not.toHaveAttribute("placeholder");
+ });
+
+ it("blocks OpenAI-compatible save when base URL is missing", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: /OpenAI-compatible/i }),
+ );
+ await user.type(screen.getByLabelText("API key"), "provider-key");
+ await user.click(screen.getByRole("button", { name: /^Save$/i }));
+
+ // Then
+ expect(
+ await screen.findByText(
+ "Base URL is required for OpenAI-compatible providers.",
+ ),
+ ).toBeInTheDocument();
+ expect(createConfigurationMock).not.toHaveBeenCalled();
+ });
+
+ it("shows Bedrock access key, secret key, and region fields", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.click(screen.getByRole("button", { name: /Amazon Bedrock/i }));
+
+ // Then
+ expect(screen.getByLabelText("AWS access key ID")).toBeInTheDocument();
+ expect(screen.getByLabelText("AWS secret access key")).toBeInTheDocument();
+ expect(screen.getByLabelText("AWS region")).toBeInTheDocument();
+ });
+
+ it("tests the connection and reports the resulting status", async () => {
+ // Given
+ const user = userEvent.setup();
+ testConnectionMock.mockResolvedValue({
+ data: { ...configurations[0], connected: false },
+ });
+ renderPage();
+
+ // When
+ await user.click(screen.getByRole("button", { name: /Test connection/i }));
+
+ // Then: the action is polled to completion and the resulting status shown
+ await waitFor(() =>
+ expect(testConnectionMock).toHaveBeenCalledWith("config-openai"),
+ );
+ await waitFor(() =>
+ expect(toastMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ title: "Connection failed.",
+ variant: "destructive",
+ }),
+ ),
+ );
+ expect(
+ screen.queryByRole("button", { name: /Refresh status/i }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("confirms before deleting an existing configuration", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderPage();
+
+ // When
+ await user.click(screen.getByRole("button", { name: /^Delete$/i }));
+ await user.click(
+ screen.getByRole("button", { name: /Delete configuration/i }),
+ );
+
+ // Then
+ await waitFor(() =>
+ expect(deleteConfigurationMock).toHaveBeenCalledWith("config-openai"),
+ );
+ await waitFor(() =>
+ expect(toastMock).toHaveBeenCalledWith(
+ expect.objectContaining({ title: "Configuration removed." }),
+ ),
+ );
+ });
+});
+
+function renderPage(
+ props?: Partial<Parameters<typeof LighthouseV2ConfigPage>[0]>,
+) {
+ return render(
+ <LighthouseV2ConfigPage
+ configurations={props?.configurations ?? configurations}
+ providers={props?.providers ?? providers}
+ error={props?.error}
+ />,
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.tsx b/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.tsx
new file mode 100644
index 0000000000..07dd1ff255
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/lighthouse-v2-config-page.tsx
@@ -0,0 +1,184 @@
+"use client";
+
+import { useState } from "react";
+
+import {
+ FEEDBACK_VARIANT,
+ type FeedbackState,
+} from "@/app/(prowler)/lighthouse/_lib/config";
+import {
+ type LighthouseV2Configuration,
+ type LighthouseV2ProviderType,
+ type LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { useToast } from "@/components/shadcn";
+import { Card } from "@/components/shadcn/card/card";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+
+import { LighthouseV2BusinessContextForm } from "./business-context-form";
+import { LighthouseV2ConfigurationForm } from "./configuration-form";
+import { LighthouseV2EmptyState } from "./empty-state";
+import { LighthouseV2ProviderRail } from "./provider-rail";
+
+interface LighthouseV2ConfigPageProps {
+ configurations: LighthouseV2Configuration[];
+ providers: LighthouseV2SupportedProvider[];
+ error?: string;
+}
+
+export function LighthouseV2ConfigPage({
+ configurations,
+ providers,
+ error,
+}: LighthouseV2ConfigPageProps) {
+ const { toast } = useToast();
+ const [localConfigurations, setLocalConfigurations] =
+ useState(configurations);
+ const [selectedProvider, setSelectedProvider] =
+ useState<LighthouseV2ProviderType>(providers[0]?.id ?? "openai");
+
+ const showFeedback = (feedback: FeedbackState) => {
+ toast({
+ title: feedback.title,
+ description: feedback.description,
+ variant:
+ feedback.variant === FEEDBACK_VARIANT.ERROR ? "destructive" : "default",
+ });
+ };
+
+ // Surface a load-time error (failed fetch) once, since it is not tied to a
+ // user interaction that could dispatch the toast itself.
+ useMountEffect(() => {
+ if (error) {
+ showFeedback({
+ title: "Configuration unavailable",
+ description: error,
+ variant: FEEDBACK_VARIANT.ERROR,
+ });
+ }
+ });
+
+ // Business context is shared across every provider (the backend syncs it on
+ // update), so it is edited once against any single configuration.
+ const businessContextConfig = localConfigurations[0];
+
+ const selectedConfig = localConfigurations.find(
+ (config) => config.providerType === selectedProvider,
+ );
+ const selectedProviderDefinition =
+ providers.find((provider) => provider.id === selectedProvider) ??
+ providers[0];
+
+ // Replace in place (don't filter+append): the shared business-context editor
+ // is anchored to localConfigurations[0], so reordering on every save/test
+ // would silently retarget it to a different provider's configuration.
+ const upsertConfiguration = (configuration: LighthouseV2Configuration) => {
+ setLocalConfigurations((current) => {
+ const index = current.findIndex(
+ (config) => config.id === configuration.id,
+ );
+ if (index === -1) {
+ return [...current, configuration];
+ }
+ const next = [...current];
+ next[index] = configuration;
+ return next;
+ });
+ };
+
+ const handleConfigurationSaved = (
+ configuration: LighthouseV2Configuration,
+ ) => {
+ upsertConfiguration(configuration);
+ setSelectedProvider(configuration.providerType);
+ showFeedback({
+ title: "Configuration saved.",
+ description:
+ "Lighthouse AI can use this provider after it tests cleanly.",
+ variant: FEEDBACK_VARIANT.SUCCESS,
+ });
+ };
+
+ const handleConfigurationTested = (
+ configuration: LighthouseV2Configuration,
+ ) => {
+ upsertConfiguration(configuration);
+ showFeedback(
+ configuration.connected
+ ? {
+ title: "Connection successful.",
+ description: "Lighthouse AI can send messages with this provider.",
+ variant: FEEDBACK_VARIANT.SUCCESS,
+ }
+ : {
+ title: "Connection failed.",
+ description:
+ "Review the credentials and test the connection again.",
+ variant: FEEDBACK_VARIANT.ERROR,
+ },
+ );
+ };
+
+ const handleConfigurationDeleted = (configurationId: string) => {
+ setLocalConfigurations((current) =>
+ current.filter((config) => config.id !== configurationId),
+ );
+ showFeedback({
+ title: "Configuration removed.",
+ description: "This provider is no longer available for Lighthouse AI.",
+ variant: FEEDBACK_VARIANT.INFO,
+ });
+ };
+
+ if (providers.length === 0 || !selectedProviderDefinition) {
+ return <LighthouseV2EmptyState error={error} />;
+ }
+
+ return (
+ <Card
+ variant="base"
+ padding="none"
+ role="region"
+ aria-label="Lighthouse AI settings"
+ className="w-full gap-4 p-4 md:p-5"
+ >
+ {businessContextConfig ? (
+ <LighthouseV2BusinessContextForm
+ key={businessContextConfig.id}
+ configurationId={businessContextConfig.id}
+ initialBusinessContext={businessContextConfig.businessContext}
+ />
+ ) : (
+ <Card
+ variant="inner"
+ padding="md"
+ data-lighthouse-v2-business-context-empty=""
+ className="text-text-neutral-secondary text-sm"
+ >
+ Configure a provider first to add shared business context.
+ </Card>
+ )}
+
+ <div className="grid min-h-0 flex-1 gap-4 xl:grid-cols-[320px_minmax(0,1fr)]">
+ <LighthouseV2ProviderRail
+ configurations={localConfigurations}
+ providers={providers}
+ selectedProvider={selectedProvider}
+ onSelectProvider={setSelectedProvider}
+ />
+
+ <LighthouseV2ConfigurationForm
+ key={selectedProvider}
+ configuration={selectedConfig}
+ provider={selectedProviderDefinition}
+ onConfigurationSaved={handleConfigurationSaved}
+ onConfigurationDeleted={handleConfigurationDeleted}
+ onConfigurationTested={handleConfigurationTested}
+ onFeedback={(feedback) => {
+ if (feedback) showFeedback(feedback);
+ }}
+ />
+ </div>
+ </Card>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/provider-icon.tsx b/ui/app/(prowler)/lighthouse/_components/config/provider-icon.tsx
new file mode 100644
index 0000000000..0848bfc52c
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/provider-icon.tsx
@@ -0,0 +1,28 @@
+import { Icon } from "@iconify/react";
+
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2ProviderType,
+} from "@/app/(prowler)/lighthouse/_types";
+
+const LIGHTHOUSE_V2_PROVIDER_ICONS = {
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI]: "simple-icons:openai",
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK]: "simple-icons:amazonwebservices",
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE]: "simple-icons:openai",
+} as const satisfies Record<LighthouseV2ProviderType, string>;
+
+export function ProviderIcon({
+ provider,
+ className,
+}: {
+ provider: LighthouseV2ProviderType;
+ className?: string;
+}) {
+ return (
+ <Icon
+ aria-hidden="true"
+ className={className}
+ icon={LIGHTHOUSE_V2_PROVIDER_ICONS[provider]}
+ />
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/provider-rail.tsx b/ui/app/(prowler)/lighthouse/_components/config/provider-rail.tsx
new file mode 100644
index 0000000000..c569347805
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/provider-rail.tsx
@@ -0,0 +1,83 @@
+import { getConnectionStatus } from "@/app/(prowler)/lighthouse/_lib/config";
+import { formatLastChecked } from "@/app/(prowler)/lighthouse/_lib/format";
+import {
+ type LighthouseV2Configuration,
+ type LighthouseV2ProviderType,
+ type LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+import { Card } from "@/components/shadcn/card/card";
+import { cn } from "@/lib/utils";
+
+import { ProviderIcon } from "./provider-icon";
+import { StatusBadge } from "./status-badge";
+
+export function LighthouseV2ProviderRail({
+ configurations,
+ providers,
+ selectedProvider,
+ onSelectProvider,
+}: {
+ configurations: LighthouseV2Configuration[];
+ providers: LighthouseV2SupportedProvider[];
+ selectedProvider: LighthouseV2ProviderType;
+ onSelectProvider: (provider: LighthouseV2ProviderType) => void;
+}) {
+ return (
+ <Card variant="inner" padding="none" className="min-w-0 p-4 md:p-5">
+ <aside className="flex min-w-0 flex-col gap-3">
+ <div className="flex items-center justify-between gap-3 px-1">
+ <div>
+ <h3 className="text-text-neutral-primary text-sm font-semibold">
+ Providers
+ </h3>
+ <p className="text-text-neutral-secondary text-xs">
+ Choose provider to configure
+ </p>
+ </div>
+ </div>
+ <div className="flex flex-col gap-2">
+ {providers.map((provider) => {
+ const config = configurations.find(
+ (item) => item.providerType === provider.id,
+ );
+ const active = provider.id === selectedProvider;
+ const status = getConnectionStatus(config);
+
+ return (
+ <button
+ key={provider.id}
+ type="button"
+ aria-label={provider.name}
+ aria-pressed={active}
+ onClick={() => onSelectProvider(provider.id)}
+ className={cn(
+ "border-border-neutral-secondary bg-bg-neutral-secondary hover:bg-bg-neutral-tertiary group flex min-w-0 items-start gap-3 rounded-[12px] border p-3 text-left transition-colors",
+ active &&
+ "border-border-input-primary-press bg-bg-neutral-tertiary ring-border-input-primary-press ring-1",
+ )}
+ >
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex size-10 shrink-0 items-center justify-center rounded-[9px] border">
+ <ProviderIcon
+ provider={provider.id}
+ className="text-text-neutral-secondary size-5"
+ />
+ </div>
+ <div className="min-w-0 flex-1">
+ <div className="flex min-w-0 items-center justify-between gap-2">
+ <span className="text-text-neutral-primary truncate text-sm font-medium">
+ {provider.name}
+ </span>
+ <StatusBadge status={status} />
+ </div>
+ <p className="text-text-neutral-tertiary mt-1 text-xs">
+ {formatLastChecked(config?.connectionLastCheckedAt)}
+ </p>
+ </div>
+ </button>
+ );
+ })}
+ </div>
+ </aside>
+ </Card>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/config/status-badge.tsx b/ui/app/(prowler)/lighthouse/_components/config/status-badge.tsx
new file mode 100644
index 0000000000..3e6eaf7097
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/config/status-badge.tsx
@@ -0,0 +1,34 @@
+import { AlertCircle, CheckCircle2, CircleDashed } from "lucide-react";
+
+import {
+ CONNECTION_STATUS,
+ type ConnectionStatus,
+} from "@/app/(prowler)/lighthouse/_lib/config";
+import { Badge } from "@/components/shadcn/badge/badge";
+
+export function StatusBadge({ status }: { status: ConnectionStatus }) {
+ if (status === CONNECTION_STATUS.CONNECTED) {
+ return (
+ <Badge variant="success">
+ <CheckCircle2 />
+ Connected
+ </Badge>
+ );
+ }
+
+ if (status === CONNECTION_STATUS.FAILED) {
+ return (
+ <Badge variant="error">
+ <AlertCircle />
+ Failed
+ </Badge>
+ );
+ }
+
+ return (
+ <Badge variant="outline">
+ <CircleDashed />
+ Not tested
+ </Badge>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/history/index.ts b/ui/app/(prowler)/lighthouse/_components/history/index.ts
new file mode 100644
index 0000000000..edf61d3df7
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/history/index.ts
@@ -0,0 +1 @@
+export { LighthouseV2SessionHistory } from "./lighthouse-v2-session-history";
diff --git a/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.test.tsx b/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.test.tsx
new file mode 100644
index 0000000000..9f9bf755dd
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.test.tsx
@@ -0,0 +1,276 @@
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { LighthouseV2Session } from "@/app/(prowler)/lighthouse/_types";
+
+import { LighthouseV2SessionHistory } from "./lighthouse-v2-session-history";
+
+describe("LighthouseV2SessionHistory", () => {
+ beforeEach(() => {
+ vi.useFakeTimers();
+ vi.setSystemTime(new Date("2026-06-25T12:00:00Z"));
+ });
+
+ afterEach(() => {
+ vi.useRealTimers();
+ });
+
+ it("keeps the session title truncated and the age label visible without horizontal overflow", () => {
+ // Given / When
+ renderHistory({
+ sessions: [
+ session({
+ id: "session-today",
+ title:
+ "This is a very long Lighthouse conversation title that must fit next to the age label",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ ],
+ });
+
+ // Then
+ const sessionButton = screen.getByRole("button", {
+ name: /This is a very long Lighthouse conversation title.*Today/,
+ });
+ const title = within(sessionButton).getByText(
+ /This is a very long Lighthouse conversation title/i,
+ );
+ const age = within(sessionButton).getByText("Today");
+
+ expect(sessionButton).toHaveClass("min-w-0", "overflow-hidden");
+ expect(sessionButton.parentElement).toHaveClass(
+ "min-w-0",
+ "overflow-hidden",
+ );
+ expect(title).toHaveClass("min-w-0", "flex-1", "truncate");
+ expect(age).toHaveClass("shrink-0", "whitespace-nowrap");
+ });
+
+ it("renders session age as numeric day labels instead of compact counters", () => {
+ // Given / When
+ renderHistory({
+ sessions: [
+ session({
+ id: "session-today",
+ title: "Today session",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ session({
+ id: "session-one-day",
+ title: "One day session",
+ updatedAt: "2026-06-24T09:00:00Z",
+ }),
+ session({
+ id: "session-two-days",
+ title: "Two days session",
+ updatedAt: "2026-06-23T09:00:00Z",
+ }),
+ session({
+ id: "session-thirty-days",
+ title: "Thirty days session",
+ updatedAt: "2026-05-26T09:00:00Z",
+ }),
+ ],
+ });
+
+ // Then
+ expect(screen.getByText("Today")).toBeInTheDocument();
+ expect(screen.getByText("1 day")).toBeInTheDocument();
+ expect(screen.getByText("2 days")).toBeInTheDocument();
+ expect(screen.getByText("30 days")).toBeInTheDocument();
+ expect(screen.queryByText("today")).not.toBeInTheDocument();
+ expect(screen.queryByText("1d")).not.toBeInTheDocument();
+ expect(screen.queryByText("2d")).not.toBeInTheDocument();
+ expect(screen.queryByText("30d")).not.toBeInTheDocument();
+ expect(screen.queryByText("one day")).not.toBeInTheDocument();
+ expect(screen.queryByText("thirty days")).not.toBeInTheDocument();
+ });
+
+ it("filters visible sessions by the current search value", () => {
+ // Given / When
+ renderHistory({
+ search: "threat",
+ sessions: [
+ session({
+ id: "session-threat",
+ title: "Threat model review",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ session({
+ id: "session-compliance",
+ title: "Compliance gap analysis",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ ],
+ });
+
+ // Then
+ expect(screen.getByText("Threat model review")).toBeInTheDocument();
+ expect(
+ screen.queryByText("Compliance gap analysis"),
+ ).not.toBeInTheDocument();
+ });
+
+ it("replaces the age label with the archive action on row hover", () => {
+ // Given / When
+ renderHistory({
+ sessions: [
+ session({
+ id: "session-today",
+ title: "Threat model review",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ ],
+ });
+
+ // Then
+ const sessionButton = screen.getByRole("button", {
+ name: /Threat model review.*Today/,
+ });
+ const row = sessionButton.parentElement;
+ const age = within(sessionButton).getByText("Today");
+ const archiveButton = screen.getByRole("button", {
+ name: "Archive Threat model review",
+ });
+
+ expect(row).toHaveClass("hover:bg-bg-neutral-tertiary");
+ expect(sessionButton).not.toHaveClass("hover:bg-bg-neutral-tertiary");
+ expect(age).toHaveClass(
+ "transition-opacity",
+ "group-hover:opacity-0",
+ "group-focus-within:opacity-0",
+ );
+ expect(archiveButton).toHaveClass(
+ "absolute",
+ "right-1",
+ "opacity-0",
+ "group-hover:opacity-100",
+ "group-focus-within:opacity-100",
+ "hover:text-text-neutral-secondary",
+ "active:text-text-neutral-secondary",
+ );
+ });
+
+ it("opens a confirmation modal before archiving a session", async () => {
+ // Given
+ vi.useRealTimers();
+ const user = userEvent.setup();
+ const onArchiveSession = vi.fn();
+ renderHistory({
+ onArchiveSession,
+ sessions: [
+ session({
+ id: "session-today",
+ title: "Threat model review",
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ ],
+ });
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: "Archive Threat model review" }),
+ );
+
+ // Then
+ expect(onArchiveSession).not.toHaveBeenCalled();
+ const dialog = screen.getByRole("dialog", {
+ name: "Are you absolutely sure?",
+ });
+ expect(
+ within(dialog).getByText(
+ "This action cannot be undone. This will archive this chat and remove it from your chat history.",
+ ),
+ ).toBeInTheDocument();
+
+ // When
+ await user.click(within(dialog).getByRole("button", { name: "Archive" }));
+
+ // Then
+ expect(onArchiveSession).toHaveBeenCalledWith("session-today");
+ expect(
+ screen.queryByRole("dialog", { name: "Are you absolutely sure?" }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("explains the new chat button in a tooltip", async () => {
+ // Given
+ renderHistory();
+ vi.useRealTimers();
+ const user = userEvent.setup();
+
+ // When
+ await user.hover(screen.getByRole("button", { name: "New chat" }));
+
+ // Then
+ const tooltip = await screen.findByRole("tooltip");
+ expect(tooltip).toHaveTextContent("New chat");
+ });
+
+ it("disables the new chat button while already on a new chat", () => {
+ // Given / When
+ renderHistory({ newChatDisabled: true });
+
+ // Then
+ expect(screen.getByRole("button", { name: "New chat" })).toBeDisabled();
+ });
+
+ it("shows the full trimmed title in a right-side tooltip", async () => {
+ // Given
+ const fullTitle =
+ "This is the complete Lighthouse conversation title shown in the tooltip";
+ renderHistory({
+ sessions: [
+ session({
+ id: "session-tooltip",
+ title: fullTitle,
+ updatedAt: "2026-06-25T09:00:00Z",
+ }),
+ ],
+ });
+ const sessionButton = screen.getByRole("button", {
+ name: new RegExp(`${fullTitle}.*Today`),
+ });
+ vi.useRealTimers();
+ const user = userEvent.setup();
+
+ // When
+ await user.hover(sessionButton);
+
+ // Then
+ const tooltip = await screen.findByRole("tooltip");
+ expect(tooltip).toHaveTextContent(fullTitle);
+ });
+});
+
+function renderHistory(
+ props?: Partial<Parameters<typeof LighthouseV2SessionHistory>[0]>,
+) {
+ return render(
+ <LighthouseV2SessionHistory
+ sessions={props?.sessions ?? []}
+ activeSessionId={props?.activeSessionId}
+ search={props?.search ?? ""}
+ onSearchChange={props?.onSearchChange ?? vi.fn()}
+ onNewSession={props?.onNewSession ?? vi.fn()}
+ onOpenSession={props?.onOpenSession ?? vi.fn()}
+ onArchiveSession={props?.onArchiveSession ?? vi.fn()}
+ newChatDisabled={props?.newChatDisabled}
+ compact={props?.compact}
+ />,
+ );
+}
+
+function session(
+ overrides: Partial<LighthouseV2Session> = {},
+): LighthouseV2Session {
+ return {
+ id: "session-1",
+ title: "Session",
+ isArchived: false,
+ insertedAt: "2026-06-25T09:00:00Z",
+ updatedAt: "2026-06-25T09:00:00Z",
+ ...overrides,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.tsx b/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.tsx
new file mode 100644
index 0000000000..6dc5d8cf1c
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/history/lighthouse-v2-session-history.tsx
@@ -0,0 +1,195 @@
+"use client";
+
+import { Archive, Plus } from "lucide-react";
+import { useState } from "react";
+
+import { formatSessionAge } from "@/app/(prowler)/lighthouse/_lib/format";
+import type { LighthouseV2Session } from "@/app/(prowler)/lighthouse/_types";
+import { Button } from "@/components/shadcn/button/button";
+import { Modal } from "@/components/shadcn/modal";
+import { SearchInput } from "@/components/shadcn/search-input/search-input";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { cn } from "@/lib/utils";
+
+interface LighthouseV2SessionHistoryProps {
+ sessions: LighthouseV2Session[];
+ activeSessionId?: string | null;
+ search: string;
+ onSearchChange: (value: string) => void;
+ onNewSession: () => void;
+ onOpenSession: (sessionId: string) => void;
+ onArchiveSession: (sessionId: string) => void;
+ newChatDisabled?: boolean;
+ compact?: boolean;
+}
+
+export function LighthouseV2SessionHistory({
+ sessions,
+ activeSessionId,
+ search,
+ onSearchChange,
+ onNewSession,
+ onOpenSession,
+ onArchiveSession,
+ newChatDisabled = false,
+ compact = false,
+}: LighthouseV2SessionHistoryProps) {
+ const [sessionPendingArchive, setSessionPendingArchive] =
+ useState<LighthouseV2Session | null>(null);
+ const visibleSessions = filterSessionsBySearch(sessions, search);
+
+ const handleArchiveModalOpenChange = (open: boolean) => {
+ if (!open) {
+ setSessionPendingArchive(null);
+ }
+ };
+
+ const handleConfirmArchive = () => {
+ if (!sessionPendingArchive) return;
+
+ onArchiveSession(sessionPendingArchive.id);
+ setSessionPendingArchive(null);
+ };
+
+ return (
+ <aside
+ className={cn(
+ "flex min-h-0 w-full min-w-0 flex-col gap-3 overflow-hidden",
+ compact && "gap-2",
+ )}
+ >
+ <div className="flex items-center gap-2">
+ <SearchInput
+ aria-label="Search Lighthouse AI sessions"
+ value={search}
+ placeholder="Chat history"
+ size={compact ? "sm" : "default"}
+ onChange={(event) => onSearchChange(event.target.value)}
+ onClear={() => onSearchChange("")}
+ />
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <Button
+ type="button"
+ aria-label="New chat"
+ size={compact ? "icon-sm" : "icon"}
+ disabled={newChatDisabled}
+ onClick={onNewSession}
+ >
+ <Plus />
+ </Button>
+ </TooltipTrigger>
+ <TooltipContent side="right">New chat</TooltipContent>
+ </Tooltip>
+ </div>
+
+ <div className="minimal-scrollbar min-h-0 min-w-0 flex-1 overflow-x-hidden overflow-y-auto">
+ {visibleSessions.length === 0 ? (
+ <div className="text-text-neutral-secondary px-2 py-8 text-center text-sm">
+ No chats
+ </div>
+ ) : (
+ <div className="grid min-w-0">
+ {visibleSessions.map((session) => {
+ const sessionTitle = session.title || "Untitled chat";
+ const isActive = activeSessionId === session.id;
+
+ return (
+ <div
+ key={session.id}
+ className={cn(
+ "hover:bg-bg-neutral-tertiary group relative flex min-w-0 items-center overflow-hidden rounded-[8px] transition-colors",
+ isActive &&
+ "bg-bg-neutral-tertiary before:bg-button-primary before:absolute before:top-1/2 before:left-0 before:h-5 before:w-0.5 before:-translate-y-1/2 before:rounded-full",
+ )}
+ >
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <button
+ type="button"
+ className={cn(
+ "flex min-w-0 flex-1 items-center gap-2 overflow-hidden rounded-[8px] px-2 py-2 text-left text-sm",
+ isActive && "text-text-neutral-primary",
+ )}
+ onClick={() => onOpenSession(session.id)}
+ >
+ <span
+ className={cn(
+ "min-w-0 flex-1 truncate",
+ isActive && "font-medium",
+ )}
+ >
+ {sessionTitle}
+ </span>
+ <span className="text-text-neutral-tertiary min-w-[3.25rem] shrink-0 text-right text-xs whitespace-nowrap transition-opacity group-focus-within:opacity-0 group-hover:opacity-0">
+ {formatSessionAge(session.updatedAt)}
+ </span>
+ </button>
+ </TooltipTrigger>
+ <TooltipContent side="right">{sessionTitle}</TooltipContent>
+ </Tooltip>
+ <Button
+ type="button"
+ aria-label={`Archive ${sessionTitle}`}
+ variant="bare"
+ size="icon-xs"
+ className="hover:text-text-neutral-secondary active:text-text-neutral-secondary absolute top-1/2 right-1 -translate-y-1/2 opacity-0 transition-opacity group-focus-within:opacity-100 group-hover:opacity-100 focus-visible:opacity-100"
+ onClick={() => setSessionPendingArchive(session)}
+ >
+ <Archive />
+ </Button>
+ </div>
+ );
+ })}
+ </div>
+ )}
+ </div>
+
+ <Modal
+ open={Boolean(sessionPendingArchive)}
+ onOpenChange={handleArchiveModalOpenChange}
+ title="Are you absolutely sure?"
+ description="This action cannot be undone. This will archive this chat and remove it from your chat history."
+ size="md"
+ >
+ <div className="flex w-full justify-end gap-4">
+ <Button
+ type="button"
+ variant="ghost"
+ size="lg"
+ onClick={() => setSessionPendingArchive(null)}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="button"
+ variant="destructive"
+ size="lg"
+ onClick={handleConfirmArchive}
+ >
+ <Archive />
+ Archive
+ </Button>
+ </div>
+ </Modal>
+ </aside>
+ );
+}
+
+function filterSessionsBySearch(
+ sessions: LighthouseV2Session[],
+ search: string,
+): LighthouseV2Session[] {
+ const normalizedSearch = search.trim().toLocaleLowerCase();
+ if (!normalizedSearch) return sessions;
+
+ return sessions.filter((session) =>
+ (session.title || "Untitled chat")
+ .toLocaleLowerCase()
+ .includes(normalizedSearch),
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/navigation/index.ts b/ui/app/(prowler)/lighthouse/_components/navigation/index.ts
new file mode 100644
index 0000000000..0e8f765e45
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/navigation/index.ts
@@ -0,0 +1 @@
+export { LighthouseV2SidebarChat } from "./lighthouse-v2-sidebar-chat";
diff --git a/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.test.tsx b/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.test.tsx
new file mode 100644
index 0000000000..a9f9c85594
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.test.tsx
@@ -0,0 +1,247 @@
+import { act, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT,
+ LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT,
+} from "@/app/(prowler)/lighthouse/_lib/session-events";
+import type { LighthouseV2Session } from "@/app/(prowler)/lighthouse/_types";
+
+import { LighthouseV2SidebarChat } from "./lighthouse-v2-sidebar-chat";
+
+const navigationMocks = vi.hoisted(() => ({
+ push: vi.fn(),
+ searchParams: "",
+ pathname: "/lighthouse",
+}));
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => navigationMocks.pathname,
+ useRouter: () => ({ push: navigationMocks.push }),
+ useSearchParams: () => new URLSearchParams(navigationMocks.searchParams),
+}));
+
+const actions = vi.hoisted(() => ({
+ archiveLighthouseV2Session: vi.fn(),
+ getLighthouseV2Sessions: vi.fn(),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ archiveLighthouseV2Session: actions.archiveLighthouseV2Session,
+ getLighthouseV2Sessions: actions.getLighthouseV2Sessions,
+}));
+
+describe("LighthouseV2SidebarChat", () => {
+ beforeEach(() => {
+ navigationMocks.push.mockReset();
+ navigationMocks.searchParams = "";
+ navigationMocks.pathname = "/lighthouse";
+ actions.archiveLighthouseV2Session.mockReset();
+ actions.getLighthouseV2Sessions.mockReset();
+ window.history.replaceState(null, "", "/lighthouse");
+ });
+
+ it("marks the URL session as active in chat history", async () => {
+ // Given
+ navigationMocks.searchParams = "session=session-active";
+ actions.getLighthouseV2Sessions.mockResolvedValue({
+ data: [
+ session({ id: "session-active", title: "Active chat" }),
+ session({ id: "session-other", title: "Other chat" }),
+ ],
+ });
+
+ // When
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // Then
+ const activeSession = await screen.findByRole("button", {
+ name: /^Active chat/,
+ });
+ const otherSession = screen.getByRole("button", {
+ name: /^Other chat/,
+ });
+
+ await waitFor(() =>
+ expect(activeSession.parentElement).toHaveClass("bg-bg-neutral-tertiary"),
+ );
+ expect(otherSession.parentElement).not.toHaveClass(
+ "bg-bg-neutral-tertiary",
+ );
+ });
+
+ it("navigates back to a new chat when archiving the open session", async () => {
+ // Given: the archived session is the one currently open (in the URL)
+ const user = userEvent.setup();
+ navigationMocks.searchParams = "session=session-active";
+ actions.getLighthouseV2Sessions.mockResolvedValue({
+ data: [session({ id: "session-active", title: "Active chat" })],
+ });
+ actions.archiveLighthouseV2Session.mockResolvedValue({
+ data: session({ id: "session-active", isArchived: true }),
+ });
+ const archivedIds: string[] = [];
+ const recordArchivedId = (event: Event) => {
+ archivedIds.push(
+ (event as CustomEvent<{ sessionId: string }>).detail.sessionId,
+ );
+ };
+
+ try {
+ window.addEventListener(
+ LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT,
+ recordArchivedId,
+ );
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // When
+ await user.click(
+ await screen.findByRole("button", { name: "Archive Active chat" }),
+ );
+ await user.click(
+ within(screen.getByRole("dialog")).getByRole("button", {
+ name: "Archive",
+ }),
+ );
+
+ // Then: the URL no longer points at the archived (deleted) conversation,
+ // and the chat page is told which session died (it may hold a
+ // live-created session invisible to the router).
+ await waitFor(() =>
+ expect(navigationMocks.push).toHaveBeenCalledWith("/lighthouse"),
+ );
+ expect(archivedIds).toEqual(["session-active"]);
+ } finally {
+ window.removeEventListener(
+ LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT,
+ recordArchivedId,
+ );
+ }
+ });
+
+ it("stays on the open session when archiving a different one", async () => {
+ // Given
+ const user = userEvent.setup();
+ navigationMocks.searchParams = "session=session-active";
+ actions.getLighthouseV2Sessions.mockResolvedValue({
+ data: [
+ session({ id: "session-active", title: "Active chat" }),
+ session({ id: "session-other", title: "Other chat" }),
+ ],
+ });
+ actions.archiveLighthouseV2Session.mockResolvedValue({
+ data: session({ id: "session-other", isArchived: true }),
+ });
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // When
+ await user.click(
+ await screen.findByRole("button", { name: "Archive Other chat" }),
+ );
+ await user.click(
+ within(screen.getByRole("dialog")).getByRole("button", {
+ name: "Archive",
+ }),
+ );
+
+ // Then
+ await waitFor(() =>
+ expect(actions.archiveLighthouseV2Session).toHaveBeenCalledWith(
+ "session-other",
+ ),
+ );
+ expect(navigationMocks.push).not.toHaveBeenCalled();
+ });
+
+ it("disables the new chat button while already on a pristine new chat", async () => {
+ // Given: /lighthouse with no session in any URL
+ actions.getLighthouseV2Sessions.mockResolvedValue({ data: [] });
+
+ // When
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // Then
+ expect(
+ await screen.findByRole("button", { name: "New chat" }),
+ ).toBeDisabled();
+ });
+
+ it("enables the new chat button when a conversation is open", async () => {
+ // Given
+ navigationMocks.searchParams = "session=session-active";
+ actions.getLighthouseV2Sessions.mockResolvedValue({
+ data: [session({ id: "session-active", title: "Active chat" })],
+ });
+
+ // When
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // Then
+ expect(
+ await screen.findByRole("button", { name: "New chat" }),
+ ).toBeEnabled();
+ });
+
+ it("enables the new chat button when the chat creates its session in place", async () => {
+ // Given: a pristine new chat
+ actions.getLighthouseV2Sessions.mockResolvedValue({ data: [] });
+ render(<LighthouseV2SidebarChat isOpen />);
+ expect(
+ await screen.findByRole("button", { name: "New chat" }),
+ ).toBeDisabled();
+
+ // When: the first message creates the session via replaceState (Next's
+ // router never sees this URL) and history listeners are notified
+ act(() => {
+ window.history.replaceState(null, "", "/lighthouse?session=live-1");
+ window.dispatchEvent(new Event(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT));
+ });
+
+ // Then
+ await waitFor(() =>
+ expect(screen.getByRole("button", { name: "New chat" })).toBeEnabled(),
+ );
+ });
+
+ it("disables the collapsed new chat button too on a pristine new chat", async () => {
+ // Given
+ actions.getLighthouseV2Sessions.mockResolvedValue({ data: [] });
+
+ // When
+ render(<LighthouseV2SidebarChat isOpen={false} />);
+
+ // Then
+ await waitFor(() =>
+ expect(screen.getByRole("button", { name: "New chat" })).toBeDisabled(),
+ );
+ });
+
+ it("keeps the new chat button enabled outside the chat page", async () => {
+ // Given: chat sidebar mode active while browsing another page
+ navigationMocks.pathname = "/findings";
+ window.history.replaceState(null, "", "/findings");
+ actions.getLighthouseV2Sessions.mockResolvedValue({ data: [] });
+
+ // When
+ render(<LighthouseV2SidebarChat isOpen />);
+
+ // Then
+ expect(
+ await screen.findByRole("button", { name: "New chat" }),
+ ).toBeEnabled();
+ });
+});
+
+function session(
+ overrides: Partial<LighthouseV2Session> = {},
+): LighthouseV2Session {
+ return {
+ id: "session-1",
+ title: "Session",
+ isArchived: false,
+ insertedAt: "2026-06-30T09:00:00Z",
+ updatedAt: new Date().toISOString(),
+ ...overrides,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.tsx b/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.tsx
new file mode 100644
index 0000000000..6148c5f946
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/navigation/lighthouse-v2-sidebar-chat.tsx
@@ -0,0 +1,157 @@
+"use client";
+
+import { MessageSquare, Plus } from "lucide-react";
+import { usePathname, useRouter, useSearchParams } from "next/navigation";
+import { useState, useSyncExternalStore } from "react";
+
+import {
+ archiveLighthouseV2Session,
+ getLighthouseV2Sessions,
+} from "@/app/(prowler)/lighthouse/_actions";
+import {
+ LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT,
+ notifyLighthouseV2NewChat,
+ notifyLighthouseV2SessionArchived,
+} from "@/app/(prowler)/lighthouse/_lib/session-events";
+import type { LighthouseV2Session } from "@/app/(prowler)/lighthouse/_types";
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+
+import { LighthouseV2SessionHistory } from "../history";
+
+export function LighthouseV2SidebarChat({ isOpen }: { isOpen: boolean }) {
+ const router = useRouter();
+ const pathname = usePathname();
+ const searchParams = useSearchParams();
+ const activeSessionId = searchParams.get("session");
+ const browserUrlSessionId = useBrowserUrlSessionId();
+ // A pristine new chat is the chat route with no session anywhere; there,
+ // starting yet another new chat is a no-op.
+ const isOnNewChat =
+ pathname === LIGHTHOUSE_ROUTE.CHAT &&
+ !activeSessionId &&
+ !browserUrlSessionId;
+ const [sessions, setSessions] = useState<LighthouseV2Session[]>([]);
+ const [search, setSearch] = useState("");
+
+ const refreshSessions = async () => {
+ try {
+ const result = await getLighthouseV2Sessions();
+ if ("data" in result) {
+ setSessions(result.data);
+ }
+ } catch {
+ // Best-effort refresh: swallow transport-level failures so a rejected
+ // server action never escapes the mount effect as an unhandled error.
+ }
+ };
+
+ const handleSearchChange = (value: string) => {
+ setSearch(value);
+ };
+
+ const handleNewSession = () => {
+ // Reset an already-open chat in place, then route (covers other pages too).
+ notifyLighthouseV2NewChat();
+ router.push("/lighthouse");
+ };
+
+ const handleOpenSession = (sessionId: string) => {
+ router.push(`/lighthouse?session=${encodeURIComponent(sessionId)}`);
+ };
+
+ const handleArchiveSession = async (sessionId: string) => {
+ try {
+ const result = await archiveLighthouseV2Session(sessionId);
+ if ("data" in result) {
+ setSessions((current) =>
+ current.filter((session) => session.id !== sessionId),
+ );
+ // Covers live-created sessions the router can't see (replaceState URL).
+ notifyLighthouseV2SessionArchived(sessionId);
+ if (sessionId === activeSessionId) {
+ // The archived session no longer exists; leave its URL.
+ router.push("/lighthouse");
+ }
+ }
+ } catch {
+ // Archiving is recoverable from the sidebar; ignore transient failures.
+ }
+ };
+
+ useMountEffect(() => {
+ void refreshSessions();
+ const refresh = () => void refreshSessions();
+ window.addEventListener(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT, refresh);
+ return () => {
+ window.removeEventListener(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT, refresh);
+ };
+ });
+
+ if (!isOpen) {
+ return (
+ <div className="flex flex-col items-center gap-2 px-2 pt-4">
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <Button
+ type="button"
+ aria-label="New chat"
+ size="icon"
+ disabled={isOnNewChat}
+ onClick={handleNewSession}
+ >
+ <Plus />
+ </Button>
+ </TooltipTrigger>
+ <TooltipContent side="right">New chat</TooltipContent>
+ </Tooltip>
+ <MessageSquare className="text-text-neutral-tertiary size-5" />
+ </div>
+ );
+ }
+
+ return (
+ <div className="flex h-full min-h-0 flex-col px-2 pt-4">
+ <LighthouseV2SessionHistory
+ compact
+ sessions={sessions}
+ activeSessionId={activeSessionId}
+ search={search}
+ onSearchChange={handleSearchChange}
+ onNewSession={handleNewSession}
+ onOpenSession={handleOpenSession}
+ onArchiveSession={handleArchiveSession}
+ newChatDisabled={isOnNewChat}
+ />
+ </div>
+ );
+}
+
+// Sessions created live set their URL via replaceState, invisible to Next's
+// router, so the real browser URL is the only reliable session source.
+function useBrowserUrlSessionId() {
+ return useSyncExternalStore(
+ subscribeToSessionUrl,
+ readBrowserUrlSessionId,
+ () => null,
+ );
+}
+
+function subscribeToSessionUrl(onChange: () => void) {
+ window.addEventListener(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT, onChange);
+ window.addEventListener("popstate", onChange);
+ return () => {
+ window.removeEventListener(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT, onChange);
+ window.removeEventListener("popstate", onChange);
+ };
+}
+
+function readBrowserUrlSessionId() {
+ return new URLSearchParams(window.location.search).get("session");
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat-skeleton.tsx b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat-skeleton.tsx
new file mode 100644
index 0000000000..4a75f6c1e9
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat-skeleton.tsx
@@ -0,0 +1,71 @@
+import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
+import { cn } from "@/lib/utils";
+
+// 1:1 skeleton of the panel chat empty state (logo, headline, composer,
+// suggestion chips, recent chats). Kept in its own file with light imports:
+// the side-panel shell uses it as the Suspense fallback while the real
+// (lazy) chat bundle downloads, so it must not pull that bundle in.
+export function LighthousePanelChatSkeleton() {
+ return (
+ <div
+ aria-label="Loading Lighthouse AI"
+ className="flex h-full min-h-0 flex-col items-center justify-center gap-5 overflow-hidden px-4 py-10"
+ >
+ {/* Lighthouse logo */}
+ <Skeleton className="size-12 rounded-full" />
+
+ {/* Headline + subline */}
+ <div className="flex w-full flex-col items-center gap-2">
+ <Skeleton className="h-5 w-3/5 max-w-72 rounded" />
+ <Skeleton className="h-4 w-2/5 max-w-52 rounded" />
+ </div>
+
+ {/* Composer: textarea, then model selector + send button row */}
+ <div className="border-border-neutral-secondary w-full max-w-4xl rounded-xl border p-3">
+ <Skeleton className="h-10 w-full rounded" />
+ <div className="mt-3 flex items-center justify-between gap-2">
+ <Skeleton className="h-8 w-40 rounded-lg" />
+ <Skeleton className="size-8 rounded-lg" />
+ </div>
+ </div>
+
+ {/* "Try Lighthouse AI for..." suggestion chips */}
+ <div className="flex w-full flex-col items-center gap-2">
+ <Skeleton className="h-4 w-36 rounded" />
+ <div className="flex w-full flex-wrap items-center justify-center gap-2">
+ <Skeleton className="h-8 w-32 rounded-lg" />
+ <Skeleton className="h-8 w-36 rounded-lg" />
+ <Skeleton className="h-8 w-28 rounded-lg" />
+ <Skeleton className="h-8 w-40 rounded-lg" />
+ </div>
+ </div>
+
+ {/* Recent chats: label, search + new-chat row, session rows */}
+ <div className="flex w-full max-w-4xl flex-col gap-2">
+ <Skeleton className="h-4 w-24 rounded" />
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-8 flex-1 rounded-lg" />
+ <Skeleton className="size-8 shrink-0 rounded-lg" />
+ </div>
+ <div className="flex flex-col gap-1">
+ <SessionRowSkeleton titleWidth="w-3/5" />
+ <SessionRowSkeleton titleWidth="w-2/5" />
+ <SessionRowSkeleton titleWidth="w-1/2" />
+ </div>
+ </div>
+ </div>
+ );
+}
+
+interface SessionRowSkeletonProps {
+ titleWidth: string;
+}
+
+function SessionRowSkeleton({ titleWidth }: SessionRowSkeletonProps) {
+ return (
+ <div className="flex items-center justify-between gap-2 px-2 py-2">
+ <Skeleton className={cn("h-4 rounded", titleWidth)} />
+ <Skeleton className="h-3 w-8 shrink-0 rounded" />
+ </div>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.test.tsx b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.test.tsx
new file mode 100644
index 0000000000..f903bd87e2
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.test.tsx
@@ -0,0 +1,464 @@
+import { act, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { type ReactNode } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { resetPanelChatStoreForTests } from "@/app/(prowler)/lighthouse/_lib/panel-chat-store";
+import { notifyLighthouseV2ConfigurationsChanged } from "@/app/(prowler)/lighthouse/_lib/session-events";
+import { stubEventSource } from "@/app/(prowler)/lighthouse/_lib/testing/event-source-mock";
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2Session,
+ LighthouseV2SupportedModel,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import {
+ LighthousePanelChat,
+ resetPanelChatConfigCacheForTests,
+} from "./lighthouse-panel-chat";
+import { LighthousePanelHeaderActions } from "./lighthouse-panel-header-actions";
+
+const {
+ getConfigurationsMock,
+ getSupportedProvidersMock,
+ getSupportedModelsMock,
+ getSessionsMock,
+ archiveSessionMock,
+ createSessionMock,
+ getMessagesMock,
+ sendMessageMock,
+ updateConfigurationMock,
+} = vi.hoisted(() => ({
+ getConfigurationsMock: vi.fn(),
+ getSupportedProvidersMock: vi.fn(),
+ getSupportedModelsMock: vi.fn(),
+ getSessionsMock: vi.fn(),
+ archiveSessionMock: vi.fn(),
+ createSessionMock: vi.fn(),
+ getMessagesMock: vi.fn(),
+ sendMessageMock: vi.fn(),
+ updateConfigurationMock: vi.fn(),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ getLighthouseV2Configurations: getConfigurationsMock,
+ getLighthouseV2SupportedProviders: getSupportedProvidersMock,
+ getLighthouseV2SupportedModels: getSupportedModelsMock,
+ getLighthouseV2Sessions: getSessionsMock,
+ archiveLighthouseV2Session: archiveSessionMock,
+ createLighthouseV2Session: createSessionMock,
+ getLighthouseV2Messages: getMessagesMock,
+ sendLighthouseV2Message: sendMessageMock,
+ updateLighthouseV2Configuration: updateConfigurationMock,
+}));
+
+// Streamdown pulls in shiki/wasm syntax highlighting that doesn't run under
+// jsdom; render its text passthrough so message bodies are still assertable.
+vi.mock("streamdown", () => ({
+ Streamdown: ({ children }: { children: ReactNode }) => <>{children}</>,
+ defaultRehypePlugins: { katex: undefined, harden: undefined },
+}));
+
+const configurations: LighthouseV2Configuration[] = [
+ {
+ id: "config-openai",
+ providerType: "openai",
+ baseUrl: null,
+ defaultModel: "gpt-5.1",
+ businessContext: "Production account",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:00:00Z",
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+];
+
+describe("LighthousePanelChat", () => {
+ beforeEach(() => {
+ vi.stubGlobal(
+ "ResizeObserver",
+ class ResizeObserver {
+ observe = vi.fn();
+ unobserve = vi.fn();
+ disconnect = vi.fn();
+ },
+ );
+ Object.defineProperty(Element.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ getConfigurationsMock.mockReset();
+ getSupportedProvidersMock.mockReset();
+ getSupportedModelsMock.mockReset();
+ getSessionsMock.mockReset();
+ archiveSessionMock.mockReset();
+ getMessagesMock.mockReset();
+ stubEventSource();
+ resetPanelChatStoreForTests();
+ resetPanelChatConfigCacheForTests();
+
+ getConfigurationsMock.mockResolvedValue({ data: configurations });
+ getSupportedProvidersMock.mockResolvedValue({
+ data: [
+ { id: "openai", name: "OpenAI" },
+ { id: "bedrock", name: "AWS Bedrock" },
+ { id: "openai-compatible", name: "OpenAI Compatible" },
+ ],
+ });
+ getSupportedModelsMock.mockResolvedValue({ data: [model("gpt-5.1")] });
+ getSessionsMock.mockResolvedValue({ data: [] });
+ getMessagesMock.mockResolvedValue({ data: [] });
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it("shows a loading skeleton while the config loads", () => {
+ // Given: a config fetch that never resolves within the assertion window
+ getConfigurationsMock.mockReturnValue(new Promise(() => {}));
+
+ // When
+ render(<LighthousePanelChat />);
+
+ // Then
+ expect(screen.getByLabelText("Loading Lighthouse AI")).toBeInTheDocument();
+ });
+
+ it("shows the error state with a Retry that reloads the config", async () => {
+ // Given
+ getConfigurationsMock.mockResolvedValueOnce({
+ error: "Something went wrong.",
+ status: 500,
+ });
+ const user = userEvent.setup();
+ render(<LighthousePanelChat />);
+ expect(await screen.findByRole("alert")).toHaveTextContent(
+ "Something went wrong.",
+ );
+
+ // When: retrying after the backend recovers
+ await user.click(screen.getByRole("button", { name: "Retry" }));
+
+ // Then
+ expect(
+ await screen.findByRole("textbox", { name: "Message" }),
+ ).toBeInTheDocument();
+ });
+
+ it("shows an in-panel connect CTA instead of redirecting when no LLM is connected", async () => {
+ // Given
+ getConfigurationsMock.mockResolvedValue({
+ data: [{ ...configurations[0], connected: false }],
+ });
+
+ // When
+ render(<LighthousePanelChat />);
+
+ // Then
+ expect(
+ await screen.findByRole("link", { name: "Connect an LLM provider" }),
+ ).toHaveAttribute("href", "/lighthouse/settings");
+ });
+
+ it("renders the chat composer and recent chats once ready", async () => {
+ // Given
+ getSessionsMock.mockResolvedValue({
+ data: [session("session-1", "Counting critical findings")],
+ });
+
+ // When
+ render(<LighthousePanelChat />);
+
+ // Then: composer is live and the empty state lists recent chats
+ expect(
+ await screen.findByRole("textbox", { name: "Message" }),
+ ).toBeInTheDocument();
+ expect(screen.getByText("Recent chats")).toBeInTheDocument();
+ expect(
+ await screen.findByText("Counting critical findings"),
+ ).toBeInTheDocument();
+ });
+
+ it("opens a recent chat in place without navigating", async () => {
+ // Given
+ const user = userEvent.setup();
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ getSessionsMock.mockResolvedValue({
+ data: [session("session-1", "Counting critical findings")],
+ });
+ getMessagesMock.mockResolvedValue({
+ data: [
+ {
+ id: "message-1",
+ role: "assistant",
+ model: null,
+ tokenUsage: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ parts: [
+ {
+ id: "message-1-part",
+ type: "text",
+ content: "There are 3 critical findings.",
+ toolCallOutcome: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ },
+ ],
+ },
+ ],
+ });
+ render(<LighthousePanelChat />);
+
+ // When
+ await user.click(
+ await screen.findByRole("button", {
+ name: /^Counting critical findings/,
+ }),
+ );
+
+ // Then: the conversation loads in the panel and the URL never changes
+ expect(
+ await screen.findByText("There are 3 critical findings."),
+ ).toBeInTheDocument();
+ expect(replaceStateSpy).not.toHaveBeenCalled();
+ replaceStateSpy.mockRestore();
+ });
+
+ it("explains why a new chat is unavailable before the first message", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<LighthousePanelHeaderActions />);
+ const newChatButton = screen.getByRole("button", { name: "New chat" });
+
+ // When
+ const disabledTrigger = newChatButton.parentElement;
+
+ // Then
+ expect(newChatButton).toBeDisabled();
+ expect(disabledTrigger).toHaveClass("cursor-not-allowed");
+ await user.hover(disabledTrigger!);
+ expect(await screen.findByRole("tooltip")).toHaveTextContent(
+ "Send a message before starting a new chat",
+ );
+ });
+
+ it("opens the active panel conversation on the full-page chat route", async () => {
+ // Given: the panel starts on a new chat and exposes the full-page action
+ const user = userEvent.setup();
+ getSessionsMock.mockResolvedValue({
+ data: [session("session-1", "Counting critical findings")],
+ });
+ render(
+ <>
+ <LighthousePanelHeaderActions />
+ <LighthousePanelChat />
+ </>,
+ );
+ const fullPageLink = await screen.findByRole("link", {
+ name: "Open Lighthouse AI full page",
+ });
+ expect(fullPageLink).toHaveAttribute("href", "/lighthouse");
+
+ // When: an existing conversation becomes active in the panel
+ await user.click(
+ await screen.findByRole("button", {
+ name: /^Counting critical findings/,
+ }),
+ );
+
+ // Then: full-page navigation carries the active session in the URL
+ expect(fullPageLink).toHaveAttribute(
+ "href",
+ "/lighthouse?session=session-1",
+ );
+ });
+
+ it("starts a new chat from the panel header", async () => {
+ // Given: an existing conversation is open in the panel
+ const user = userEvent.setup();
+ getSessionsMock.mockResolvedValue({
+ data: [session("session-1", "Counting critical findings")],
+ });
+ getMessagesMock.mockResolvedValue({
+ data: [
+ {
+ id: "message-1",
+ role: "assistant",
+ model: null,
+ tokenUsage: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ parts: [
+ {
+ id: "message-1-part",
+ type: "text",
+ content: "There are 3 critical findings.",
+ toolCallOutcome: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ },
+ ],
+ },
+ ],
+ });
+ render(
+ <>
+ <div aria-label="Panel header actions">
+ <LighthousePanelHeaderActions />
+ </div>
+ <LighthousePanelChat />
+ </>,
+ );
+ await screen.findByRole("textbox", { name: "Message" });
+ const panelHeader = screen.getByLabelText("Panel header actions");
+ const newChatButton = within(panelHeader).getByRole("button", {
+ name: "New chat",
+ });
+ expect(newChatButton).toBeDisabled();
+
+ await user.click(
+ await screen.findByRole("button", {
+ name: /^Counting critical findings/,
+ }),
+ );
+ expect(
+ await screen.findByText("There are 3 critical findings."),
+ ).toBeInTheDocument();
+ expect(newChatButton).toBeEnabled();
+
+ // When
+ await user.click(newChatButton);
+
+ // Then
+ expect(
+ screen.queryByText("There are 3 critical findings."),
+ ).not.toBeInTheDocument();
+ expect(screen.getByRole("textbox", { name: "Message" })).toHaveValue("");
+ expect(newChatButton).toBeDisabled();
+ });
+
+ it("caches the loaded config so a remount skips the skeleton", async () => {
+ // Given: a first mount that loads successfully
+ const { unmount } = render(<LighthousePanelChat />);
+ await screen.findByRole("textbox", { name: "Message" });
+ unmount();
+ getConfigurationsMock.mockClear();
+
+ // When
+ render(<LighthousePanelChat />);
+
+ // Then: ready immediately, no refetch
+ await waitFor(() =>
+ expect(
+ screen.getByRole("textbox", { name: "Message" }),
+ ).toBeInTheDocument(),
+ );
+ expect(getConfigurationsMock).not.toHaveBeenCalled();
+ });
+
+ it("reloads models after a transient model-loading failure", async () => {
+ // Given: configuration loads, but the first model request fails
+ getSupportedModelsMock.mockResolvedValueOnce({
+ error: "Models are temporarily unavailable.",
+ status: 500,
+ });
+ const { unmount } = render(<LighthousePanelChat />);
+ await screen.findByRole("textbox", { name: "Message" });
+ unmount();
+ getSupportedModelsMock.mockClear();
+
+ // When: the panel reopens after the model endpoint recovers
+ render(<LighthousePanelChat />);
+
+ // Then: the partial ready state is not reused as a successful cache entry
+ await waitFor(() => expect(getSupportedModelsMock).toHaveBeenCalled());
+ });
+
+ it("removes an archived chat from the recent chats list", async () => {
+ // Given: one recent chat
+ const user = userEvent.setup();
+ getSessionsMock.mockResolvedValue({
+ data: [session("session-1", "Counting critical findings")],
+ });
+ archiveSessionMock.mockResolvedValue({ data: { id: "session-1" } });
+ render(<LighthousePanelChat />);
+ await screen.findByText("Counting critical findings");
+
+ // When: archiving it from the panel (hover action + confirm dialog)
+ getSessionsMock.mockResolvedValue({ data: [] });
+ await user.click(
+ screen.getByRole("button", {
+ name: "Archive Counting critical findings",
+ }),
+ );
+ await user.click(
+ within(await screen.findByRole("dialog")).getByRole("button", {
+ name: "Archive",
+ }),
+ );
+
+ // Then: the archived chat leaves the list
+ await waitFor(() =>
+ expect(
+ screen.queryByText("Counting critical findings"),
+ ).not.toBeInTheDocument(),
+ );
+ });
+
+ it("swaps the connect CTA for the chat once a provider is connected", async () => {
+ // Given: no connected provider yet
+ getConfigurationsMock.mockResolvedValueOnce({
+ data: [{ ...configurations[0], connected: false }],
+ });
+ render(<LighthousePanelChat />);
+ await screen.findByRole("link", { name: "Connect an LLM provider" });
+
+ // When: a provider gets connected on the settings page
+ act(() => notifyLighthouseV2ConfigurationsChanged());
+
+ // Then: the panel reloads into the live chat
+ expect(
+ await screen.findByRole("textbox", { name: "Message" }),
+ ).toBeInTheDocument();
+ });
+
+ it("drops the cached config when configurations change while unmounted", async () => {
+ // Given: a cached config from a previous mount
+ const { unmount } = render(<LighthousePanelChat />);
+ await screen.findByRole("textbox", { name: "Message" });
+ unmount();
+ getConfigurationsMock.mockClear();
+
+ // When: config CRUD happens with the panel closed, then it reopens
+ notifyLighthouseV2ConfigurationsChanged();
+ render(<LighthousePanelChat />);
+
+ // Then: the stale cache is gone and the config reloads
+ expect(
+ await screen.findByRole("textbox", { name: "Message" }),
+ ).toBeInTheDocument();
+ expect(getConfigurationsMock).toHaveBeenCalled();
+ });
+});
+
+function model(id: string, name = id): LighthouseV2SupportedModel {
+ return {
+ id,
+ name,
+ maxInputTokens: null,
+ maxOutputTokens: null,
+ supportsFunctionCalling: null,
+ supportsVision: null,
+ supportsReasoning: null,
+ };
+}
+
+function session(id: string, title: string): LighthouseV2Session {
+ return {
+ id,
+ title,
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.tsx b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.tsx
new file mode 100644
index 0000000000..acecf64b32
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat.tsx
@@ -0,0 +1,340 @@
+"use client";
+
+import Link from "next/link";
+import { useState } from "react";
+
+import {
+ archiveLighthouseV2Session,
+ getLighthouseV2Sessions,
+} from "@/app/(prowler)/lighthouse/_actions";
+import { LighthouseV2SessionHistory } from "@/app/(prowler)/lighthouse/_components/history";
+import type { LighthouseChatConfig } from "@/app/(prowler)/lighthouse/_lib/chat-store";
+import {
+ LIGHTHOUSE_CHAT_CONFIG_STATUS,
+ loadLighthouseChatConfig,
+} from "@/app/(prowler)/lighthouse/_lib/load-chat-config";
+import {
+ resetPanelChatMessageState,
+ setPanelChatMessageState,
+} from "@/app/(prowler)/lighthouse/_lib/panel-chat-message-state";
+import {
+ getOrCreatePanelChatStore,
+ resetPanelChatStore,
+} from "@/app/(prowler)/lighthouse/_lib/panel-chat-store";
+import {
+ notifyLighthouseV2SessionArchived,
+ onLighthouseV2ConfigurationsChanged,
+ onLighthouseV2NewChat,
+ onLighthouseV2SessionArchived,
+ onLighthouseV2SessionsChanged,
+} from "@/app/(prowler)/lighthouse/_lib/session-events";
+import type { LighthouseV2Session } from "@/app/(prowler)/lighthouse/_types";
+import { LighthouseIconWithAura } from "@/components/icons";
+import { Button } from "@/components/shadcn/button/button";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+
+import {
+ LighthouseChatStoreProvider,
+ useLighthouseChatStore,
+} from "../chat/lighthouse-chat-store-provider";
+import {
+ LIGHTHOUSE_CHAT_SURFACE,
+ LighthouseV2ChatView,
+} from "../chat/lighthouse-v2-chat-view";
+import { LighthousePanelChatSkeleton } from "./lighthouse-panel-chat-skeleton";
+
+const PANEL_CHAT_STATUS = {
+ LOADING: "loading",
+ ERROR: "error",
+ NOT_CONFIGURED: "not-configured",
+ READY: "ready",
+} as const;
+
+interface PanelChatLoadingState {
+ status: typeof PANEL_CHAT_STATUS.LOADING;
+}
+
+interface PanelChatErrorState {
+ status: typeof PANEL_CHAT_STATUS.ERROR;
+ message: string;
+}
+
+interface PanelChatNotConfiguredState {
+ status: typeof PANEL_CHAT_STATUS.NOT_CONFIGURED;
+}
+
+interface PanelChatReadyState {
+ status: typeof PANEL_CHAT_STATUS.READY;
+ config: LighthouseChatConfig;
+ modelsError?: string;
+}
+
+type PanelChatState =
+ | PanelChatLoadingState
+ | PanelChatErrorState
+ | PanelChatNotConfiguredState
+ | PanelChatReadyState;
+
+// Config cache: the panel loads its configs/models lazily on first open (never
+// in the layout, so pages don't pay for a panel most sessions never open); the
+// cache makes every later mount — reopen, drawer AI tab — instant.
+let cachedReadyState: PanelChatReadyState | null = null;
+
+export function resetPanelChatConfigCacheForTests(): void {
+ cachedReadyState = null;
+ resetPanelChatMessageState();
+}
+
+// Config CRUD happens on the settings route while the global panel can remain
+// mounted. Invalidate at module scope so the open panel reloads in place and a
+// later open rebuilds cache and store against the new configuration.
+if (typeof window !== "undefined") {
+ onLighthouseV2ConfigurationsChanged(() => {
+ cachedReadyState = null;
+ resetPanelChatMessageState();
+ resetPanelChatStore();
+ });
+}
+
+export function LighthousePanelChat() {
+ const [state, setState] = useState<PanelChatState>(
+ () => cachedReadyState ?? { status: PANEL_CHAT_STATUS.LOADING },
+ );
+
+ const load = async () => {
+ setState({ status: PANEL_CHAT_STATUS.LOADING });
+ const next = await loadPanelChatState();
+ if (
+ next.status === PANEL_CHAT_STATUS.READY &&
+ next.modelsError === undefined
+ ) {
+ cachedReadyState = next;
+ } else {
+ cachedReadyState = null;
+ }
+ setState(next);
+ };
+
+ useMountEffect(() => {
+ if (state.status !== PANEL_CHAT_STATUS.READY) {
+ void load();
+ }
+ // The module-scope listener above already invalidated cache and store
+ // (registration order); reload so an open panel refreshes in place.
+ return onLighthouseV2ConfigurationsChanged(() => void load());
+ });
+
+ if (state.status === PANEL_CHAT_STATUS.LOADING) {
+ return <LighthousePanelChatSkeleton />;
+ }
+ if (state.status === PANEL_CHAT_STATUS.ERROR) {
+ return (
+ <PanelChatError message={state.message} onRetry={() => void load()} />
+ );
+ }
+ if (state.status === PANEL_CHAT_STATUS.NOT_CONFIGURED) {
+ return <PanelChatConnectCta />;
+ }
+ return (
+ <PanelChatReady config={state.config} modelsError={state.modelsError} />
+ );
+}
+
+interface PanelChatReadyProps {
+ config: LighthouseChatConfig;
+ modelsError?: string;
+}
+
+function PanelChatReady({ config, modelsError }: PanelChatReadyProps) {
+ const [store] = useState(() =>
+ getOrCreatePanelChatStore(config, { initialError: modelsError }),
+ );
+ const [sessions, setSessions] = useState<LighthouseV2Session[]>([]);
+
+ const refreshSessions = async () => {
+ try {
+ const result = await getLighthouseV2Sessions();
+ if ("data" in result) {
+ setSessions(result.data);
+ }
+ } catch {
+ // Best-effort refresh: swallow transport-level failures so a rejected
+ // server action never escapes the mount effect as an unhandled error.
+ }
+ };
+
+ useMountEffect(() => {
+ void refreshSessions();
+ const syncPanelChatState = () => {
+ const chatState = store.getState();
+ setPanelChatMessageState({
+ hasMessages: chatState.messages.length > 0,
+ activeSessionId: chatState.activeSessionId,
+ });
+ };
+ syncPanelChatState();
+ const unsubscribeChatStore = store.subscribe(syncPanelChatState);
+ const unsubscribeSessionsChanged = onLighthouseV2SessionsChanged(() => {
+ void refreshSessions();
+ });
+ const unsubscribeNewChat = onLighthouseV2NewChat(() =>
+ store.getState().resetToNewChat(),
+ );
+ // Archiving from any surface (sidebar, popover) must reset the panel chat
+ // when its open session is the archived one, and drop the archived chat
+ // from the "Recent chats" list.
+ const unsubscribeSessionArchived = onLighthouseV2SessionArchived(
+ (sessionId) => {
+ store.getState().handleSessionArchived(sessionId);
+ void refreshSessions();
+ },
+ );
+ return () => {
+ unsubscribeChatStore();
+ unsubscribeSessionsChanged();
+ unsubscribeNewChat();
+ unsubscribeSessionArchived();
+ // A partial config cannot be reused after the model endpoint recovers:
+ // this store captured the incomplete model list at creation time.
+ if (modelsError) resetPanelChatStore();
+ };
+ });
+
+ return (
+ <LighthouseChatStoreProvider store={store}>
+ <div className="flex h-full min-h-0 flex-col">
+ <div className="min-h-0 flex-1">
+ <LighthouseV2ChatView
+ surface={LIGHTHOUSE_CHAT_SURFACE.PANEL}
+ emptyStateFooter={
+ sessions.length > 0 ? (
+ <div className="flex max-h-64 flex-col gap-2">
+ <span className="text-text-neutral-secondary text-sm font-medium">
+ Recent chats
+ </span>
+ <PanelChatSessions sessions={sessions} />
+ </div>
+ ) : undefined
+ }
+ />
+ </div>
+ </div>
+ </LighthouseChatStoreProvider>
+ );
+}
+
+interface PanelChatSessionsProps {
+ sessions: LighthouseV2Session[];
+ onAfterSelect?: () => void;
+}
+
+function PanelChatSessions({
+ sessions,
+ onAfterSelect,
+}: PanelChatSessionsProps) {
+ const [search, setSearch] = useState("");
+ const activeSessionId = useLighthouseChatStore(
+ (state) => state.activeSessionId,
+ );
+ const isOnNewChat = useLighthouseChatStore(
+ (state) => state.activeSessionId === null && state.messages.length === 0,
+ );
+ const openSession = useLighthouseChatStore((state) => state.openSession);
+ const resetToNewChat = useLighthouseChatStore(
+ (state) => state.resetToNewChat,
+ );
+
+ const handleArchiveSession = async (sessionId: string) => {
+ try {
+ const result = await archiveLighthouseV2Session(sessionId);
+ if ("data" in result) {
+ // Resets this chat when its open session is archived, and prompts
+ // every session list (sidebar included) to refresh.
+ notifyLighthouseV2SessionArchived(sessionId);
+ }
+ } catch {
+ // Archiving is recoverable from the list; ignore transient failures.
+ }
+ };
+
+ return (
+ <LighthouseV2SessionHistory
+ compact
+ sessions={sessions}
+ activeSessionId={activeSessionId}
+ search={search}
+ onSearchChange={setSearch}
+ newChatDisabled={isOnNewChat}
+ onNewSession={() => {
+ resetToNewChat();
+ onAfterSelect?.();
+ }}
+ onOpenSession={(sessionId) => {
+ void openSession(sessionId);
+ onAfterSelect?.();
+ }}
+ onArchiveSession={(sessionId) => void handleArchiveSession(sessionId)}
+ />
+ );
+}
+
+interface PanelChatErrorProps {
+ message: string;
+ onRetry: () => void;
+}
+
+function PanelChatError({ message, onRetry }: PanelChatErrorProps) {
+ return (
+ <div className="flex h-full flex-col items-center justify-center gap-4 p-6 text-center">
+ <p role="alert" className="text-text-neutral-secondary text-sm">
+ {message}
+ </p>
+ <Button type="button" variant="outline" onClick={onRetry}>
+ Retry
+ </Button>
+ </div>
+ );
+}
+
+function PanelChatConnectCta() {
+ return (
+ <div className="flex h-full flex-col items-center justify-center gap-4 p-6 text-center">
+ <LighthouseIconWithAura className="size-16" />
+ <div className="space-y-1">
+ <h2 className="text-text-neutral-primary text-base font-semibold">
+ Lighthouse AI is not set up yet
+ </h2>
+ <p className="text-text-neutral-secondary text-sm">
+ Connect an LLM provider to start asking questions about your cloud
+ security posture.
+ </p>
+ </div>
+ <Button asChild>
+ <Link href={LIGHTHOUSE_ROUTE.SETTINGS}>Connect an LLM provider</Link>
+ </Button>
+ </div>
+ );
+}
+
+async function loadPanelChatState(): Promise<PanelChatState> {
+ try {
+ const result = await loadLighthouseChatConfig();
+ if (result.status === LIGHTHOUSE_CHAT_CONFIG_STATUS.ERROR) {
+ return { status: PANEL_CHAT_STATUS.ERROR, message: result.message };
+ }
+ if (result.status === LIGHTHOUSE_CHAT_CONFIG_STATUS.NOT_CONFIGURED) {
+ return { status: PANEL_CHAT_STATUS.NOT_CONFIGURED };
+ }
+ return {
+ status: PANEL_CHAT_STATUS.READY,
+ config: result.config,
+ modelsError: result.modelsError,
+ };
+ } catch {
+ return {
+ status: PANEL_CHAT_STATUS.ERROR,
+ message: "Could not load Lighthouse AI. Try again shortly.",
+ };
+ }
+}
diff --git a/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-header-actions.tsx b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-header-actions.tsx
new file mode 100644
index 0000000000..9f71449626
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-header-actions.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { Maximize2, Plus } from "lucide-react";
+import Link from "next/link";
+import { useSyncExternalStore } from "react";
+
+import {
+ getPanelChatActiveSessionId,
+ getPanelChatHasMessages,
+ subscribePanelChatHasMessages,
+} from "@/app/(prowler)/lighthouse/_lib/panel-chat-message-state";
+import { notifyLighthouseV2NewChat } from "@/app/(prowler)/lighthouse/_lib/session-events";
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import { cn } from "@/lib/utils";
+
+export function LighthousePanelHeaderActions() {
+ const hasMessages = useSyncExternalStore(
+ subscribePanelChatHasMessages,
+ getPanelChatHasMessages,
+ () => false,
+ );
+ const activeSessionId = useSyncExternalStore(
+ subscribePanelChatHasMessages,
+ getPanelChatActiveSessionId,
+ () => null,
+ );
+ const fullPageHref = activeSessionId
+ ? `${LIGHTHOUSE_ROUTE.CHAT}?session=${encodeURIComponent(activeSessionId)}`
+ : LIGHTHOUSE_ROUTE.CHAT;
+
+ return (
+ <>
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <span
+ className={cn("inline-flex", !hasMessages && "cursor-not-allowed")}
+ >
+ <Button
+ type="button"
+ variant="ghost"
+ size="icon-sm"
+ aria-label="New chat"
+ disabled={!hasMessages}
+ onClick={notifyLighthouseV2NewChat}
+ >
+ <Plus />
+ </Button>
+ </span>
+ </TooltipTrigger>
+ <TooltipContent>
+ {hasMessages
+ ? "New chat"
+ : "Send a message before starting a new chat"}
+ </TooltipContent>
+ </Tooltip>
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <Button asChild variant="ghost" size="icon-sm">
+ <Link href={fullPageHref} aria-label="Open Lighthouse AI full page">
+ <Maximize2 />
+ </Link>
+ </Button>
+ </TooltipTrigger>
+ <TooltipContent>Open full page</TooltipContent>
+ </Tooltip>
+ </>
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/chat-store.test.ts b/ui/app/(prowler)/lighthouse/_lib/chat-store.test.ts
new file mode 100644
index 0000000000..16fc3c3e8e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/chat-store.test.ts
@@ -0,0 +1,503 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ createLighthouseChatStore,
+ selectLighthouseChatCanSend,
+} from "@/app/(prowler)/lighthouse/_lib/chat-store";
+import {
+ type MockEventSource,
+ stubEventSource,
+} from "@/app/(prowler)/lighthouse/_lib/testing/event-source-mock";
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2Message,
+ LighthouseV2SupportedModel,
+ LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+
+const {
+ createSessionMock,
+ getMessagesMock,
+ sendMessageMock,
+ updateConfigurationMock,
+} = vi.hoisted(() => ({
+ createSessionMock: vi.fn(),
+ getMessagesMock: vi.fn(),
+ sendMessageMock: vi.fn(),
+ updateConfigurationMock: vi.fn(),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_actions", () => ({
+ createLighthouseV2Session: createSessionMock,
+ getLighthouseV2Messages: getMessagesMock,
+ sendLighthouseV2Message: sendMessageMock,
+ updateLighthouseV2Configuration: updateConfigurationMock,
+}));
+
+const configurations: LighthouseV2Configuration[] = [
+ {
+ id: "config-openai",
+ providerType: "openai",
+ baseUrl: null,
+ defaultModel: "gpt-5.1",
+ businessContext: "Production account",
+ connected: true,
+ connectionLastCheckedAt: "2026-06-24T10:00:00Z",
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+];
+
+const modelsByProvider = {
+ openai: [model("gpt-5.1")],
+ bedrock: [],
+ "openai-compatible": [],
+};
+
+const supportedProviders: LighthouseV2SupportedProvider[] = [
+ { id: "openai", name: "OpenAI" },
+ { id: "bedrock", name: "AWS Bedrock" },
+ { id: "openai-compatible", name: "OpenAI Compatible" },
+];
+
+const config = { configurations, modelsByProvider, supportedProviders };
+
+let eventSources: MockEventSource[] = [];
+
+describe("createLighthouseChatStore", () => {
+ beforeEach(() => {
+ createSessionMock.mockReset();
+ getMessagesMock.mockReset();
+ sendMessageMock.mockReset();
+ updateConfigurationMock.mockReset();
+ eventSources = stubEventSource();
+
+ createSessionMock.mockResolvedValue({
+ data: {
+ id: "session-1",
+ title: "Summarize findings",
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ });
+ getMessagesMock.mockResolvedValue({ data: [] });
+ sendMessageMock.mockResolvedValue({
+ data: {
+ task: { id: "task-1", name: "lighthouse-run", state: "executing" },
+ },
+ });
+ window.history.replaceState(null, "", "/");
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it("resolves the connected provider's remembered model on creation", () => {
+ // Given / When
+ const store = makeStore();
+
+ // Then
+ expect(store.getState().selectedModelSelection).toEqual({
+ providerType: "openai",
+ modelId: "gpt-5.1",
+ });
+ expect(selectLighthouseChatCanSend(store.getState())).toBe(true);
+ });
+
+ it("creates a session and subscribes to the stream before sending (no replay buffer)", async () => {
+ // Given
+ const store = makeStore();
+
+ // When
+ await store.getState().submitMessage("Summarize findings");
+
+ // Then
+ expect(createSessionMock).toHaveBeenCalledWith("Summarize findings");
+ expect(EventSource).toHaveBeenCalledWith(
+ "/api/lighthouse/v2/sessions/session-1/event-stream",
+ );
+ const eventSourceOrder = vi.mocked(EventSource).mock.invocationCallOrder[0];
+ const sendOrder = sendMessageMock.mock.invocationCallOrder[0];
+ expect(eventSourceOrder).toBeLessThan(sendOrder);
+ // The optimistic user message renders immediately and the task id is live.
+ expect(store.getState().messages.at(-1)?.parts[0]?.content).toEqual({
+ text: "Summarize findings",
+ });
+ expect(store.getState().streamState.activeTaskId).toBe("task-1");
+ });
+
+ it("does not touch the URL when syncUrlToSession is off (panel surface)", async () => {
+ // Given
+ const store = makeStore({ syncUrlToSession: false });
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+ // When
+ await store.getState().submitMessage("Summarize findings");
+
+ // Then
+ expect(store.getState().activeSessionId).toBe("session-1");
+ expect(replaceStateSpy).not.toHaveBeenCalled();
+ });
+
+ it("writes the session URL in place when syncUrlToSession is on (page surface)", async () => {
+ // Given
+ const store = makeStore({ syncUrlToSession: true });
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+ // When
+ await store.getState().submitMessage("Summarize findings");
+
+ // Then
+ expect(replaceStateSpy).toHaveBeenCalledWith(
+ null,
+ "",
+ "/lighthouse?session=session-1",
+ );
+ });
+
+ it("reloads persisted messages and closes the stream on message.end", async () => {
+ // Given
+ const store = makeStore();
+ await store.getState().submitMessage("Summarize findings");
+ getMessagesMock.mockResolvedValue({
+ data: [message("message-1", "assistant", "Persisted answer")],
+ });
+
+ // When
+ eventSources[0].emit("message.end", { message_id: "message-1" });
+ await vi.waitFor(() =>
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1"),
+ );
+
+ // Then
+ await vi.waitFor(() =>
+ expect(store.getState().messages[0]?.parts[0]?.content).toBe(
+ "Persisted answer",
+ ),
+ );
+ expect(eventSources[0].close).toHaveBeenCalled();
+ expect(store.getState().streamState.activeTaskId).toBeNull();
+ });
+
+ it("blocks sending and refreshes messages on a 409 conflict", async () => {
+ // Given
+ const store = makeStore();
+ sendMessageMock.mockResolvedValue({
+ error: "Another run is in progress.",
+ status: 409,
+ });
+
+ // When
+ await store.getState().submitMessage("Summarize findings");
+
+ // Then
+ expect(store.getState().blockedByConflict).toBe(true);
+ expect(store.getState().feedback).toBe("Another run is in progress.");
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1");
+ expect(eventSources[0].close).toHaveBeenCalled();
+ expect(selectLighthouseChatCanSend(store.getState())).toBe(false);
+ });
+
+ it("reconciles the optimistic message when the send fails without a conflict", async () => {
+ // Given: the backend rejects the message with a plain failure
+ const store = makeStore();
+ sendMessageMock.mockResolvedValue({ error: "Send failed.", status: 500 });
+
+ // When
+ await store.getState().submitMessage("Summarize findings");
+
+ // Then: feedback surfaces without blocking, and the optimistic user
+ // message is reconciled against the server (it was never persisted)
+ expect(store.getState().feedback).toBe("Send failed.");
+ expect(store.getState().blockedByConflict).toBe(false);
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1");
+ expect(store.getState().messages).toHaveLength(0);
+ });
+
+ it("drops a failed send once the chat points at another session", async () => {
+ // Given: a send still in flight
+ const store = makeStore();
+ let resolveSend: (value: unknown) => void = () => {};
+ sendMessageMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveSend = resolve;
+ }),
+ );
+ const submitting = store.getState().submitMessage("Summarize findings");
+ await vi.waitFor(() => expect(sendMessageMock).toHaveBeenCalled());
+
+ // When: the user opens another session before the send fails
+ await store.getState().openSession("session-9");
+ resolveSend({ error: "Send failed.", status: 500 });
+ await submitting;
+
+ // Then: the dead submission's failure never surfaces in the new session
+ expect(store.getState().activeSessionId).toBe("session-9");
+ expect(store.getState().feedback).toBeNull();
+ });
+
+ it("keeps a fast follow-up intact when the terminal refresh resolves late", async () => {
+ // Given: a completed run whose terminal message refresh is still in flight
+ const store = makeStore();
+ await store.getState().submitMessage("First question");
+ let resolveRefresh: (value: unknown) => void = () => {};
+ getMessagesMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveRefresh = resolve;
+ }),
+ );
+ eventSources[0].emit("message.end", { message_id: "message-1" });
+ await vi.waitFor(() =>
+ expect(getMessagesMock).toHaveBeenCalledWith("session-1"),
+ );
+
+ // When: the user sends a follow-up before that refresh resolves
+ sendMessageMock.mockResolvedValue({
+ data: {
+ task: { id: "task-2", name: "lighthouse-run", state: "executing" },
+ },
+ });
+ await store.getState().submitMessage("Follow-up question");
+ resolveRefresh({ data: [message("message-1", "assistant", "Answer")] });
+ await new Promise((resolve) => setTimeout(resolve, 0));
+
+ // Then: the stale snapshot erases neither the new optimistic message nor
+ // the follow-up's task id
+ expect(store.getState().streamState.activeTaskId).toBe("task-2");
+ expect(store.getState().messages.at(-1)?.parts[0]?.content).toEqual({
+ text: "Follow-up question",
+ });
+ });
+
+ it("abandons an in-flight submit after destroy", async () => {
+ // Given: destroy fires while the session create is still in flight
+ const store = makeStore({ syncUrlToSession: true });
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ let resolveCreate: (value: unknown) => void = () => {};
+ createSessionMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveCreate = resolve;
+ }),
+ );
+ const submitting = store.getState().submitMessage("Summarize findings");
+ store.getState().destroy();
+
+ // When
+ resolveCreate({
+ data: {
+ id: "session-1",
+ title: "Summarize findings",
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ });
+ await submitting;
+
+ // Then: no URL rewrite on whatever page is now open, no orphan stream
+ expect(replaceStateSpy).not.toHaveBeenCalled();
+ expect(eventSources).toHaveLength(0);
+ });
+
+ it("does not replace a session opened while a new session is being created", async () => {
+ // Given: creating the first session is still in flight
+ const store = makeStore();
+ let resolveCreate: (value: unknown) => void = () => {};
+ createSessionMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveCreate = resolve;
+ }),
+ );
+ const submitting = store.getState().submitMessage("Summarize findings");
+ await vi.waitFor(() => expect(createSessionMock).toHaveBeenCalled());
+
+ // When: the user opens another conversation before creation resolves
+ await store.getState().openSession("session-9");
+ resolveCreate({
+ data: {
+ id: "session-1",
+ title: "Summarize findings",
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ });
+ await submitting;
+
+ // Then: the stale creation cannot replace or submit into the open chat
+ expect(store.getState().activeSessionId).toBe("session-9");
+ expect(sendMessageMock).not.toHaveBeenCalled();
+ });
+
+ it("does not revive a session creation cancelled by a new-chat reset", async () => {
+ // Given: creating the first session is still in flight
+ const store = makeStore();
+ let resolveCreate: (value: unknown) => void = () => {};
+ createSessionMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveCreate = resolve;
+ }),
+ );
+ const submitting = store.getState().submitMessage("Summarize findings");
+ await vi.waitFor(() => expect(createSessionMock).toHaveBeenCalled());
+
+ // When: the user resets to a new chat before creation resolves
+ store.getState().resetToNewChat();
+ resolveCreate({
+ data: {
+ id: "session-1",
+ title: "Summarize findings",
+ isArchived: false,
+ insertedAt: "2026-06-24T10:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ },
+ });
+ await submitting;
+
+ // Then
+ expect(store.getState().activeSessionId).toBeNull();
+ expect(sendMessageMock).not.toHaveBeenCalled();
+ });
+
+ it("opens an existing session client-side without navigation", async () => {
+ // Given
+ const store = makeStore({ syncUrlToSession: false });
+ const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+ getMessagesMock.mockResolvedValue({
+ data: [message("message-1", "assistant", "Old answer")],
+ });
+
+ // When
+ await store.getState().openSession("session-9");
+
+ // Then
+ expect(store.getState().activeSessionId).toBe("session-9");
+ expect(store.getState().messages[0]?.parts[0]?.content).toBe("Old answer");
+ expect(replaceStateSpy).not.toHaveBeenCalled();
+ });
+
+ it("drops a stale openSession result when the chat was reset meanwhile", async () => {
+ // Given: opening a session whose message fetch is still in flight
+ const store = makeStore();
+ let resolveLoad: (value: unknown) => void = () => {};
+ getMessagesMock.mockReturnValueOnce(
+ new Promise((resolve) => {
+ resolveLoad = resolve;
+ }),
+ );
+ const opening = store.getState().openSession("session-9");
+
+ // When: the user starts a new chat before the fetch resolves
+ store.getState().resetToNewChat();
+ resolveLoad({ data: [message("message-1", "assistant", "Stale answer")] });
+ await opening;
+
+ // Then: the stale messages never repopulate the reset chat
+ expect(store.getState().activeSessionId).toBeNull();
+ expect(store.getState().messages).toHaveLength(0);
+ });
+
+ it("resets to a new chat and closes any open stream", async () => {
+ // Given
+ const store = makeStore();
+ await store.getState().submitMessage("Summarize findings");
+ expect(store.getState().activeSessionId).toBe("session-1");
+
+ // When
+ store.getState().resetToNewChat();
+
+ // Then
+ expect(eventSources[0].close).toHaveBeenCalled();
+ expect(store.getState().activeSessionId).toBeNull();
+ expect(store.getState().messages).toHaveLength(0);
+ expect(store.getState().streamState.activeTaskId).toBeNull();
+ });
+
+ it("resets only when the archived session is the active one", async () => {
+ // Given
+ const store = makeStore();
+ await store.getState().submitMessage("Summarize findings");
+
+ // When / Then: an unrelated session leaves the conversation intact
+ store.getState().handleSessionArchived("session-other");
+ expect(store.getState().activeSessionId).toBe("session-1");
+
+ // When / Then: archiving the active session resets in place
+ store.getState().handleSessionArchived("session-1");
+ expect(store.getState().activeSessionId).toBeNull();
+ });
+
+ it("closes the stream on destroy", async () => {
+ // Given
+ const store = makeStore();
+ await store.getState().submitMessage("Summarize findings");
+
+ // When
+ store.getState().destroy();
+
+ // Then
+ expect(eventSources[0].close).toHaveBeenCalled();
+ });
+
+ it("surfaces a connection error when the stream closes terminally", async () => {
+ // Given
+ const store = makeStore();
+ await store.getState().submitMessage("Summarize findings");
+
+ // When: the EventSource fails terminally (e.g. 401/404 on the SSE GET)
+ eventSources[0].fail(2 /* EventSource.CLOSED */);
+
+ // Then
+ expect(store.getState().feedback).toBe(
+ "Unable to connect to the response stream.",
+ );
+ });
+});
+
+function makeStore(
+ overrides?: Partial<Parameters<typeof createLighthouseChatStore>[0]>,
+) {
+ return createLighthouseChatStore({
+ config,
+ syncUrlToSession: false,
+ ...overrides,
+ });
+}
+
+function model(id: string, name = id): LighthouseV2SupportedModel {
+ return {
+ id,
+ name,
+ maxInputTokens: null,
+ maxOutputTokens: null,
+ supportsFunctionCalling: null,
+ supportsVision: null,
+ supportsReasoning: null,
+ };
+}
+
+function message(
+ id: string,
+ role: LighthouseV2Message["role"],
+ content: string,
+): LighthouseV2Message {
+ return {
+ id,
+ role,
+ model: null,
+ tokenUsage: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ parts: [
+ {
+ id: `${id}-part`,
+ type: "text",
+ content,
+ toolCallOutcome: null,
+ insertedAt: "2026-06-25T10:00:00Z",
+ updatedAt: "2026-06-25T10:00:00Z",
+ },
+ ],
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/chat-store.ts b/ui/app/(prowler)/lighthouse/_lib/chat-store.ts
new file mode 100644
index 0000000000..0cdbde9478
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/chat-store.ts
@@ -0,0 +1,485 @@
+import { createStore, type StoreApi } from "zustand/vanilla";
+
+import {
+ createLighthouseV2Session,
+ getLighthouseV2Messages,
+ sendLighthouseV2Message,
+ updateLighthouseV2Configuration,
+} from "@/app/(prowler)/lighthouse/_actions";
+import {
+ createInitialLighthouseV2StreamState,
+ type LighthouseV2StreamState,
+ reduceLighthouseV2Event,
+} from "@/app/(prowler)/lighthouse/_lib/event-reducer";
+import {
+ buildOptimisticMessage,
+ buildSessionTitle,
+} from "@/app/(prowler)/lighthouse/_lib/messages";
+import type { LighthouseV2ModelSelection } from "@/app/(prowler)/lighthouse/_lib/model-selection";
+import { notifyLighthouseV2SessionsChanged } from "@/app/(prowler)/lighthouse/_lib/session-events";
+import { parseStreamEvent } from "@/app/(prowler)/lighthouse/_lib/stream-event-parser";
+import { buildLighthouseV2StreamUrl } from "@/app/(prowler)/lighthouse/_lib/stream-url";
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ LIGHTHOUSE_V2_SSE_EVENT,
+ type LighthouseV2Configuration,
+ type LighthouseV2Message,
+ type LighthouseV2ProviderType,
+ type LighthouseV2SSEEvent,
+ type LighthouseV2SupportedModel,
+ type LighthouseV2SupportedProvider,
+} from "@/app/(prowler)/lighthouse/_types";
+
+export interface LighthouseChatConfig {
+ configurations: LighthouseV2Configuration[];
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >;
+ supportedProviders: LighthouseV2SupportedProvider[];
+}
+
+export interface CreateLighthouseChatStoreOptions {
+ config: LighthouseChatConfig;
+ // The /lighthouse page mirrors the active session into the URL via
+ // replaceState; other surfaces (side panel, drawers) must never touch it.
+ syncUrlToSession: boolean;
+ initialSessionId?: string;
+ initialMessages?: LighthouseV2Message[];
+ initialInput?: string;
+ initialError?: string;
+}
+
+export interface LighthouseChatState {
+ config: LighthouseChatConfig;
+ activeSessionId: string | null;
+ messages: LighthouseV2Message[];
+ streamState: LighthouseV2StreamState;
+ input: string;
+ feedback: string | null;
+ blockedByConflict: boolean;
+ isSubmitting: boolean;
+ isLoadingSession: boolean;
+ lastSubmittedText: string | null;
+ selectedModelSelection: LighthouseV2ModelSelection | null;
+ modelPreferenceSaving: boolean;
+ setSessionUrlSyncEnabled: (enabled: boolean) => void;
+ setInput: (value: string) => void;
+ dismissFeedback: () => void;
+ selectModel: (selection: LighthouseV2ModelSelection) => Promise<void>;
+ submitMessage: (text: string) => Promise<void>;
+ openSession: (sessionId: string) => Promise<void>;
+ resetToNewChat: () => void;
+ handleSessionArchived: (sessionId: string) => void;
+ destroy: () => void;
+}
+
+export type LighthouseChatStore = StoreApi<LighthouseChatState>;
+
+export function selectLighthouseChatCanSend(
+ state: LighthouseChatState,
+): boolean {
+ const selectedConfiguration = state.config.configurations.find(
+ (configuration) =>
+ configuration.connected === true &&
+ configuration.providerType === state.selectedModelSelection?.providerType,
+ );
+ return (
+ selectedConfiguration?.connected === true &&
+ Boolean(state.selectedModelSelection?.modelId) &&
+ !state.streamState.activeTaskId &&
+ !state.blockedByConflict &&
+ !state.isSubmitting
+ );
+}
+
+export function createLighthouseChatStore(
+ options: CreateLighthouseChatStoreOptions,
+): LighthouseChatStore {
+ const { config } = options;
+ const connectedConfigurations = config.configurations.filter(
+ (configuration) => configuration.connected === true,
+ );
+ // The EventSource lives in this closure (never in state): it isn't
+ // serializable, no render depends on it, and here it survives the consuming
+ // component unmounting — the reason this factory exists.
+ let eventSource: EventSource | null = null;
+ // Set by destroy(): async flows check it after each await so a torn-down
+ // store never rewrites the URL of another page or opens an orphan stream.
+ let destroyed = false;
+ // User-driven session changes invalidate async session creation. Comparing
+ // only activeSessionId is insufficient because both the initial chat and a
+ // later reset intentionally use null.
+ let sessionIntentVersion = 0;
+ let syncUrlToSession = options.syncUrlToSession;
+
+ const syncSessionUrl = (sessionId: string | null) => {
+ if (!syncUrlToSession) return;
+ const url = sessionId
+ ? `/lighthouse?session=${encodeURIComponent(sessionId)}`
+ : "/lighthouse";
+ window.history.replaceState(window.history.state, "", url);
+ };
+
+ return createStore<LighthouseChatState>()((set, get) => {
+ const closeStream = () => {
+ eventSource?.close();
+ eventSource = null;
+ };
+
+ const refreshMessages = async (
+ sessionId: string,
+ shouldApply: () => boolean = () => true,
+ ): Promise<boolean> => {
+ const result = await getLighthouseV2Messages(sessionId);
+ // The fetch is async, so a reset (new chat, or archiving this session)
+ // can land while it is in flight. Drop the stale result instead of
+ // repopulating a chat that no longer points at this session.
+ if (sessionId !== get().activeSessionId || !shouldApply()) return false;
+ if ("data" in result) {
+ set({ messages: result.data });
+ return true;
+ }
+ return false;
+ };
+
+ const handleTerminalEvent = async (
+ sessionId: string,
+ event: LighthouseV2SSEEvent,
+ ) => {
+ if (
+ event.type === LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_END ||
+ event.type === LIGHTHOUSE_V2_SSE_EVENT.ERROR
+ ) {
+ closeStream();
+ set({ blockedByConflict: false });
+ if (event.type === LIGHTHOUSE_V2_SSE_EVENT.ERROR) {
+ set({ feedback: event.detail || "Agent run failed." });
+ }
+ // A fast follow-up can start while this refresh is in flight; applying
+ // it would erase the new optimistic message and provisional task id.
+ const noNewerSubmission = () =>
+ !get().isSubmitting && !get().streamState.activeTaskId;
+ const refreshed = await refreshMessages(sessionId, noNewerSubmission);
+ if (refreshed) {
+ set({ streamState: createInitialLighthouseV2StreamState() });
+ }
+ notifyLighthouseV2SessionsChanged();
+ }
+ };
+
+ const startStream = (streamUrl: string, sessionId: string) => {
+ closeStream();
+ const source = new EventSource(streamUrl);
+ eventSource = source;
+
+ const applyEvent = (event: LighthouseV2SSEEvent) => {
+ set((current) => ({
+ streamState: reduceLighthouseV2Event(current.streamState, event),
+ }));
+ void handleTerminalEvent(sessionId, event);
+ };
+
+ source.addEventListener("message.delta", (event) =>
+ applyEvent(
+ parseStreamEvent(event, LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_DELTA),
+ ),
+ );
+ source.addEventListener("tool_call.start", (event) =>
+ applyEvent(
+ parseStreamEvent(event, LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_START),
+ ),
+ );
+ source.addEventListener("tool_call.end", (event) =>
+ applyEvent(
+ parseStreamEvent(event, LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_END),
+ ),
+ );
+ source.addEventListener("message.end", (event) =>
+ applyEvent(
+ parseStreamEvent(event, LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_END),
+ ),
+ );
+ source.addEventListener("error", (event) => {
+ if (event instanceof MessageEvent) {
+ applyEvent(parseStreamEvent(event, LIGHTHOUSE_V2_SSE_EVENT.ERROR));
+ }
+ });
+ // The browser fires `onerror` both on a transient drop (it auto-reconnects)
+ // and on a non-retryable failure such as a 401/404 on the SSE GET. Only the
+ // latter leaves the source CLOSED, so surface a connection error there and
+ // treat everything else as a reconnect.
+ source.onerror = () => {
+ if (eventSource !== source) return;
+ if (source.readyState === EventSource.CLOSED) {
+ closeStream();
+ set({ feedback: "Unable to connect to the response stream." });
+ }
+ set((current) => ({
+ streamState: reduceLighthouseV2Event(current.streamState, {
+ type: "disconnect",
+ }),
+ }));
+ };
+ };
+
+ const ensureSession = async (text: string) => {
+ const existingSessionId = get().activeSessionId;
+ if (existingSessionId) {
+ return existingSessionId;
+ }
+
+ const intentVersion = sessionIntentVersion;
+ const title = buildSessionTitle(text);
+ const result = await createLighthouseV2Session(title);
+ if (destroyed || intentVersion !== sessionIntentVersion) return null;
+ if ("error" in result) {
+ set({ feedback: result.error });
+ return null;
+ }
+
+ // Update the URL in place (not router.push) so the force-dynamic server
+ // component is NOT re-run mid-submit. A re-run would change `key` in
+ // page.tsx and remount the chat, tearing down the open EventSource.
+ syncSessionUrl(result.data.id);
+ set({ activeSessionId: result.data.id });
+ notifyLighthouseV2SessionsChanged();
+ return result.data.id;
+ };
+
+ return {
+ config,
+ activeSessionId: options.initialSessionId ?? null,
+ messages: options.initialMessages ?? [],
+ streamState: createInitialLighthouseV2StreamState(),
+ input: options.initialInput ?? "",
+ feedback: options.initialError ?? null,
+ blockedByConflict: false,
+ isSubmitting: false,
+ isLoadingSession: false,
+ lastSubmittedText: null,
+ selectedModelSelection: resolveInitialModelSelection(
+ connectedConfigurations,
+ config.modelsByProvider,
+ ),
+ modelPreferenceSaving: false,
+
+ setSessionUrlSyncEnabled: (enabled) => {
+ syncUrlToSession = enabled;
+ },
+
+ setInput: (value) => set({ input: value }),
+
+ dismissFeedback: () => set({ feedback: null }),
+
+ selectModel: async (selection) => {
+ // The selection drives the model used for the next message, so it stays
+ // applied even if persisting it as the provider's default model fails —
+ // reverting it would make a connected provider unusable when the save 4xxs.
+ set({ selectedModelSelection: selection, feedback: null });
+
+ const configId = connectedConfigurations.find(
+ (configuration) =>
+ configuration.providerType === selection.providerType,
+ )?.id;
+ if (!configId) return;
+
+ set({ modelPreferenceSaving: true });
+
+ const result = await updateLighthouseV2Configuration(configId, {
+ defaultModel: selection.modelId,
+ });
+
+ set({ modelPreferenceSaving: false });
+
+ if ("error" in result) {
+ set({ feedback: result.error });
+ }
+ },
+
+ submitMessage: async (text) => {
+ const trimmedText = text.trim();
+ if (!trimmedText) return;
+ if (!get().selectedModelSelection) {
+ set({ feedback: "Select a model before sending a message." });
+ return;
+ }
+ if (!selectLighthouseChatCanSend(get())) return;
+
+ set({ isSubmitting: true });
+ try {
+ const sessionId = await ensureSession(trimmedText);
+ if (!sessionId || destroyed) return;
+
+ const selection = get().selectedModelSelection;
+ if (!selection) return;
+
+ const provisionalTaskId = `pending-${Date.now()}`;
+ set((current) => ({
+ feedback: null,
+ blockedByConflict: false,
+ lastSubmittedText: trimmedText,
+ input: "",
+ messages: [
+ ...current.messages,
+ buildOptimisticMessage("user", trimmedText),
+ ],
+ streamState:
+ createInitialLighthouseV2StreamState(provisionalTaskId),
+ }));
+
+ // Subscribe to the same-origin SSE proxy BEFORE sending the message:
+ // the backend has no replay buffer, so the listener must be attached
+ // before the worker starts emitting.
+ startStream(buildLighthouseV2StreamUrl(sessionId), sessionId);
+
+ const result = await sendLighthouseV2Message({
+ sessionId,
+ text: trimmedText,
+ provider: selection.providerType,
+ model: selection.modelId,
+ });
+ if (destroyed) return;
+
+ if ("error" in result) {
+ // Stale guard: the chat may point at another session by now, so
+ // this failure must not clobber its stream state or feedback.
+ if (get().activeSessionId !== sessionId) return;
+ closeStream();
+ set({
+ streamState: createInitialLighthouseV2StreamState(),
+ feedback: result.error,
+ });
+ if (result.status === 409) {
+ set({ blockedByConflict: true });
+ }
+ // Reconcile the optimistic user message against the server on any
+ // failure — it may or may not have been persisted.
+ await refreshMessages(sessionId);
+ return;
+ }
+
+ set((current) => ({
+ streamState:
+ current.streamState.activeTaskId === provisionalTaskId
+ ? { ...current.streamState, activeTaskId: result.data.task.id }
+ : current.streamState,
+ }));
+ notifyLighthouseV2SessionsChanged();
+ } finally {
+ set({ isSubmitting: false });
+ }
+ },
+
+ openSession: async (sessionId) => {
+ if (get().activeSessionId === sessionId) return;
+ sessionIntentVersion += 1;
+ closeStream();
+ set({
+ activeSessionId: sessionId,
+ messages: [],
+ input: "",
+ feedback: null,
+ blockedByConflict: false,
+ isSubmitting: false,
+ isLoadingSession: true,
+ lastSubmittedText: null,
+ streamState: createInitialLighthouseV2StreamState(),
+ });
+ syncSessionUrl(sessionId);
+
+ const result = await getLighthouseV2Messages(sessionId);
+ // Stale guard: a reset or another openSession can land mid-fetch.
+ if (get().activeSessionId !== sessionId) return;
+ if ("data" in result) {
+ set({ messages: result.data, isLoadingSession: false });
+ } else {
+ set({ feedback: result.error, isLoadingSession: false });
+ }
+ },
+
+ resetToNewChat: () => {
+ sessionIntentVersion += 1;
+ closeStream();
+ set({
+ activeSessionId: null,
+ messages: [],
+ input: "",
+ feedback: null,
+ blockedByConflict: false,
+ isSubmitting: false,
+ isLoadingSession: false,
+ lastSubmittedText: null,
+ streamState: createInitialLighthouseV2StreamState(),
+ });
+ syncSessionUrl(null);
+ },
+
+ handleSessionArchived: (sessionId) => {
+ // Archiving deletes the session; when it's the open one, fall back to a
+ // new chat instead of leaving a dead conversation on screen.
+ if (sessionId === get().activeSessionId) {
+ get().resetToNewChat();
+ }
+ },
+
+ destroy: () => {
+ destroyed = true;
+ closeStream();
+ },
+ };
+ });
+}
+
+// Fixed precedence used to pick which connected provider opens the chat. Any
+// provider outside this list keeps its relative order behind these.
+const LIGHTHOUSE_V2_PROVIDER_PRIORITY = [
+ LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI,
+ LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK,
+ LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE,
+] as const;
+
+// Fallback model per provider when the configuration has no remembered model.
+const LIGHTHOUSE_V2_PREFERRED_DEFAULT_MODEL: Partial<
+ Record<LighthouseV2ProviderType, string>
+> = {
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI]: "gpt-5.6-terra",
+};
+
+function resolveInitialModelSelection(
+ connectedConfigurations: LighthouseV2Configuration[],
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >,
+): LighthouseV2ModelSelection | null {
+ const priorityIndex = (providerType: LighthouseV2ProviderType) => {
+ const index = LIGHTHOUSE_V2_PROVIDER_PRIORITY.indexOf(providerType);
+ return index === -1 ? LIGHTHOUSE_V2_PROVIDER_PRIORITY.length : index;
+ };
+ // Stable sort keeps providers outside the priority list in their original order.
+ const orderedConfigurations = [...connectedConfigurations].sort(
+ (a, b) => priorityIndex(a.providerType) - priorityIndex(b.providerType),
+ );
+
+ for (const configuration of orderedConfigurations) {
+ const providerModels = modelsByProvider[configuration.providerType] ?? [];
+ if (providerModels.length === 0) continue;
+ // Prefer the provider's remembered model when it is still supported, then
+ // the provider's preferred default, then the first supported model.
+ const rememberedModel = providerModels.find(
+ (model) => model.id === configuration.defaultModel,
+ );
+ const preferredModel = providerModels.find(
+ (model) =>
+ model.id ===
+ LIGHTHOUSE_V2_PREFERRED_DEFAULT_MODEL[configuration.providerType],
+ );
+ return {
+ providerType: configuration.providerType,
+ modelId: (rememberedModel ?? preferredModel ?? providerModels[0]).id,
+ };
+ }
+
+ return null;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/config.ts b/ui/app/(prowler)/lighthouse/_lib/config.ts
new file mode 100644
index 0000000000..6f79c338dc
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/config.ts
@@ -0,0 +1,221 @@
+import { z } from "zod";
+
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2BedrockCredentials,
+ type LighthouseV2Configuration,
+ type LighthouseV2ConfigurationInput,
+ type LighthouseV2Credentials,
+ type LighthouseV2OpenAICompatibleCredentials,
+ type LighthouseV2OpenAICredentials,
+ type LighthouseV2ProviderType,
+} from "@/app/(prowler)/lighthouse/_types";
+
+export const BUSINESS_CONTEXT_LIMIT = 5000;
+
+export const CONNECTION_STATUS = {
+ CONNECTED: "connected",
+ FAILED: "failed",
+ NOT_TESTED: "not-tested",
+} as const;
+
+export type ConnectionStatus =
+ (typeof CONNECTION_STATUS)[keyof typeof CONNECTION_STATUS];
+
+export const FEEDBACK_VARIANT = {
+ ERROR: "error",
+ SUCCESS: "success",
+ INFO: "info",
+} as const;
+
+export type FeedbackVariant =
+ (typeof FEEDBACK_VARIANT)[keyof typeof FEEDBACK_VARIANT];
+
+export interface FeedbackState {
+ title: string;
+ description?: string;
+ variant: FeedbackVariant;
+}
+
+const lighthouseV2ConfigFormSchemaBase = z.object({
+ apiKey: z.string(),
+ awsAccessKeyId: z.string(),
+ awsSecretAccessKey: z.string(),
+ awsRegionName: z.string(),
+ baseUrl: z.string(),
+});
+
+export type LighthouseV2ConfigFormValues = z.infer<
+ typeof lighthouseV2ConfigFormSchemaBase
+>;
+
+export const EMPTY_FORM_VALUES: LighthouseV2ConfigFormValues = {
+ apiKey: "",
+ awsAccessKeyId: "",
+ awsSecretAccessKey: "",
+ awsRegionName: "",
+ baseUrl: "",
+};
+
+export function getFormDefaults(
+ configuration?: LighthouseV2Configuration,
+): LighthouseV2ConfigFormValues {
+ return {
+ ...EMPTY_FORM_VALUES,
+ baseUrl: configuration?.baseUrl ?? "",
+ };
+}
+
+export function buildLighthouseV2ConfigFormSchema(
+ provider: LighthouseV2ProviderType,
+ hasConfiguration: boolean,
+) {
+ return lighthouseV2ConfigFormSchemaBase.superRefine((data, ctx) => {
+ const apiKey = data.apiKey.trim();
+ const baseUrl = data.baseUrl.trim();
+
+ if (
+ provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE &&
+ !baseUrl
+ ) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "Base URL is required for OpenAI-compatible providers.",
+ path: ["baseUrl"],
+ });
+ }
+
+ // Presence is enforced above per provider; here we only reject malformed
+ // values so strings like "foo" never reach the Cloud API.
+ if (baseUrl && !isValidUrl(baseUrl)) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "Base URL must be a valid URL.",
+ path: ["baseUrl"],
+ });
+ }
+
+ if (
+ (provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI ||
+ provider === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE) &&
+ !hasConfiguration &&
+ !apiKey
+ ) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "API key is required for new configurations.",
+ path: ["apiKey"],
+ });
+ }
+
+ if (provider !== LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK) return;
+
+ const hasAnyBedrockCredential =
+ Boolean(data.awsAccessKeyId.trim()) ||
+ Boolean(data.awsSecretAccessKey.trim()) ||
+ Boolean(data.awsRegionName.trim());
+ const shouldRequireBedrockCredentials =
+ !hasConfiguration || hasAnyBedrockCredential;
+
+ if (!shouldRequireBedrockCredentials) return;
+
+ if (!data.awsAccessKeyId.trim()) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "AWS access key ID is required.",
+ path: ["awsAccessKeyId"],
+ });
+ }
+ if (!data.awsSecretAccessKey.trim()) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "AWS secret access key is required.",
+ path: ["awsSecretAccessKey"],
+ });
+ }
+ if (!data.awsRegionName.trim()) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "AWS region is required.",
+ path: ["awsRegionName"],
+ });
+ }
+ });
+}
+
+export function buildCredentialPayload(
+ provider: LighthouseV2ProviderType,
+ values: LighthouseV2ConfigFormValues,
+ hasConfiguration: boolean,
+): LighthouseV2Credentials | undefined {
+ if (provider === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK) {
+ const hasBedrockCredentials =
+ Boolean(values.awsAccessKeyId.trim()) ||
+ Boolean(values.awsSecretAccessKey.trim()) ||
+ Boolean(values.awsRegionName.trim());
+
+ if (hasConfiguration && !hasBedrockCredentials) return undefined;
+
+ return {
+ aws_access_key_id: values.awsAccessKeyId.trim(),
+ aws_secret_access_key: values.awsSecretAccessKey.trim(),
+ aws_region_name: values.awsRegionName.trim(),
+ };
+ }
+
+ if (hasConfiguration && !values.apiKey.trim()) return undefined;
+
+ return { api_key: values.apiKey.trim() };
+}
+
+function isValidUrl(value: string): boolean {
+ try {
+ new URL(value);
+ return true;
+ } catch {
+ return false;
+ }
+}
+
+// Builds the provider-keyed discriminated input from the runtime `provider` and
+// the credentials the form assembled for it. This is the single place where the
+// dynamic provider value is narrowed to a concrete variant, so the casts stay
+// confined here while every typed caller of `LighthouseV2ConfigurationInput`
+// gets full discriminated-union checking.
+export function buildLighthouseV2ConfigurationInput(
+ provider: LighthouseV2ProviderType,
+ credentials: LighthouseV2Credentials,
+ baseUrl: string | null,
+): LighthouseV2ConfigurationInput {
+ switch (provider) {
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE:
+ return {
+ providerType: LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE,
+ credentials: credentials as LighthouseV2OpenAICompatibleCredentials,
+ baseUrl: baseUrl ?? "",
+ };
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK:
+ return {
+ providerType: LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK,
+ credentials: credentials as LighthouseV2BedrockCredentials,
+ };
+ case LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI:
+ return {
+ providerType: LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI,
+ credentials: credentials as LighthouseV2OpenAICredentials,
+ };
+ }
+}
+
+export function trimToNullable(value: string) {
+ const trimmed = value.trim();
+ return trimmed ? trimmed : null;
+}
+
+export function getConnectionStatus(
+ configuration?: LighthouseV2Configuration,
+): ConnectionStatus {
+ if (configuration?.connected === true) return CONNECTION_STATUS.CONNECTED;
+ if (configuration?.connected === false) return CONNECTION_STATUS.FAILED;
+ return CONNECTION_STATUS.NOT_TESTED;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/event-reducer.test.ts b/ui/app/(prowler)/lighthouse/_lib/event-reducer.test.ts
new file mode 100644
index 0000000000..89c62ef8bc
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/event-reducer.test.ts
@@ -0,0 +1,148 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ createInitialLighthouseV2StreamState,
+ reduceLighthouseV2Event,
+} from "./event-reducer";
+
+describe("event-reducer", () => {
+ it("should append message deltas", () => {
+ // Given
+ const state = createInitialLighthouseV2StreamState("task-1");
+
+ // When
+ const next = reduceLighthouseV2Event(state, {
+ type: "message.delta",
+ content: "Hello",
+ });
+
+ // Then
+ expect(next.assistantText).toBe("Hello");
+ expect(next.status).toBe("streaming");
+ });
+
+ it("should pair tool start and end events", () => {
+ // Given
+ const state = reduceLighthouseV2Event(
+ createInitialLighthouseV2StreamState("task-1"),
+ {
+ type: "tool_call.start",
+ toolCallId: "tool-1",
+ toolName: "search",
+ },
+ );
+
+ // When
+ const next = reduceLighthouseV2Event(state, {
+ type: "tool_call.end",
+ toolCallId: "tool-1",
+ outcome: "success",
+ });
+
+ // Then
+ expect(next.toolCalls).toEqual([
+ {
+ id: "tool-1",
+ name: "search",
+ status: "completed",
+ outcome: "success",
+ },
+ ]);
+ });
+
+ it("should preserve the live display order of text and tool events", () => {
+ // Given
+ let state = createInitialLighthouseV2StreamState("task-1");
+
+ // When
+ state = reduceLighthouseV2Event(state, {
+ type: "message.delta",
+ content: "Voy a buscar los findings por severidad",
+ });
+ state = reduceLighthouseV2Event(state, {
+ type: "tool_call.start",
+ toolCallId: "tool-1",
+ toolName: "prowler_search_security_findings",
+ });
+ state = reduceLighthouseV2Event(state, {
+ type: "tool_call.end",
+ toolCallId: "tool-1",
+ outcome: "success",
+ });
+ state = reduceLighthouseV2Event(state, {
+ type: "message.delta",
+ content: "Ahora voy a buscar en los criticos",
+ });
+
+ // Then
+ expect(state.activityItems).toEqual([
+ {
+ id: "text-0",
+ type: "text",
+ text: "Voy a buscar los findings por severidad",
+ },
+ {
+ id: "tool-1",
+ type: "tool_call",
+ name: "prowler_search_security_findings",
+ status: "completed",
+ outcome: "success",
+ },
+ {
+ id: "text-2",
+ type: "text",
+ text: "Ahora voy a buscar en los criticos",
+ },
+ ]);
+ });
+
+ it("should mark message end as completed", () => {
+ // Given
+ const state = createInitialLighthouseV2StreamState("task-1");
+
+ // When
+ const next = reduceLighthouseV2Event(state, {
+ type: "message.end",
+ messageId: "message-1",
+ });
+
+ // Then
+ expect(next.status).toBe("completed");
+ expect(next.messageId).toBe("message-1");
+ expect(next.activeTaskId).toBeNull();
+ });
+
+ it("should store terminal errors", () => {
+ // Given
+ const state = createInitialLighthouseV2StreamState("task-1");
+
+ // When
+ const next = reduceLighthouseV2Event(state, {
+ type: "error",
+ code: "llm_error",
+ detail: "Provider failed",
+ });
+
+ // Then
+ expect(next.status).toBe("error");
+ expect(next.error).toEqual({
+ code: "llm_error",
+ detail: "Provider failed",
+ });
+ expect(next.activeTaskId).toBeNull();
+ });
+
+ it("should clear the task gate on disconnect so retry can recover", () => {
+ // Given
+ const state = createInitialLighthouseV2StreamState("task-1");
+
+ // When
+ const next = reduceLighthouseV2Event(state, { type: "disconnect" });
+
+ // Then
+ expect(next.status).toBe("disconnected");
+ // activeTaskId must be cleared: leaving it set keeps canSend false and
+ // makes the Retry button a no-op after a dropped SSE connection.
+ expect(next.activeTaskId).toBeNull();
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_lib/event-reducer.ts b/ui/app/(prowler)/lighthouse/_lib/event-reducer.ts
new file mode 100644
index 0000000000..89b48ec838
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/event-reducer.ts
@@ -0,0 +1,193 @@
+import {
+ LIGHTHOUSE_V2_SSE_EVENT,
+ type LighthouseV2SSEEvent,
+} from "@/app/(prowler)/lighthouse/_types";
+
+export const LIGHTHOUSE_V2_STREAM_STATUS = {
+ IDLE: "idle",
+ STREAMING: "streaming",
+ COMPLETED: "completed",
+ ERROR: "error",
+ DISCONNECTED: "disconnected",
+} as const;
+
+export type LighthouseV2StreamStatus =
+ (typeof LIGHTHOUSE_V2_STREAM_STATUS)[keyof typeof LIGHTHOUSE_V2_STREAM_STATUS];
+
+export const LIGHTHOUSE_V2_TOOL_CALL_STATUS = {
+ RUNNING: "running",
+ COMPLETED: "completed",
+} as const;
+
+export type LighthouseV2ToolCallStatus =
+ (typeof LIGHTHOUSE_V2_TOOL_CALL_STATUS)[keyof typeof LIGHTHOUSE_V2_TOOL_CALL_STATUS];
+
+export const LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE = {
+ TEXT: "text",
+ TOOL_CALL: "tool_call",
+} as const;
+
+export interface LighthouseV2ToolCallState {
+ id: string;
+ name: string;
+ status: LighthouseV2ToolCallStatus;
+ outcome?: string;
+}
+
+export interface LighthouseV2StreamTextActivityItem {
+ id: string;
+ type: typeof LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TEXT;
+ text: string;
+}
+
+export interface LighthouseV2StreamToolCallActivityItem
+ extends LighthouseV2ToolCallState {
+ type: typeof LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TOOL_CALL;
+}
+
+export type LighthouseV2StreamActivityItem =
+ | LighthouseV2StreamTextActivityItem
+ | LighthouseV2StreamToolCallActivityItem;
+
+export interface LighthouseV2StreamError {
+ code: string;
+ detail: string;
+}
+
+export interface LighthouseV2StreamState {
+ status: LighthouseV2StreamStatus;
+ activeTaskId: string | null;
+ assistantText: string;
+ toolCalls: LighthouseV2ToolCallState[];
+ activityItems: LighthouseV2StreamActivityItem[];
+ messageId?: string;
+ error?: LighthouseV2StreamError;
+}
+
+export function createInitialLighthouseV2StreamState(
+ taskId: string | null = null,
+): LighthouseV2StreamState {
+ return {
+ status: taskId
+ ? LIGHTHOUSE_V2_STREAM_STATUS.STREAMING
+ : LIGHTHOUSE_V2_STREAM_STATUS.IDLE,
+ activeTaskId: taskId,
+ assistantText: "",
+ toolCalls: [],
+ activityItems: [],
+ };
+}
+
+export function reduceLighthouseV2Event(
+ state: LighthouseV2StreamState,
+ event: LighthouseV2SSEEvent,
+): LighthouseV2StreamState {
+ switch (event.type) {
+ case LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_DELTA:
+ return {
+ ...state,
+ status: LIGHTHOUSE_V2_STREAM_STATUS.STREAMING,
+ assistantText: `${state.assistantText}${event.content}`,
+ activityItems: appendTextActivityItem(
+ state.activityItems,
+ event.content,
+ ),
+ };
+ case LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_START: {
+ const toolCall = {
+ id: event.toolCallId,
+ name: event.toolName,
+ status: LIGHTHOUSE_V2_TOOL_CALL_STATUS.RUNNING,
+ };
+ return {
+ ...state,
+ status: LIGHTHOUSE_V2_STREAM_STATUS.STREAMING,
+ toolCalls: [...state.toolCalls, toolCall],
+ activityItems: [
+ ...state.activityItems,
+ {
+ ...toolCall,
+ type: LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TOOL_CALL,
+ },
+ ],
+ };
+ }
+ case LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_END:
+ return {
+ ...state,
+ toolCalls: state.toolCalls.map((toolCall) =>
+ toolCall.id === event.toolCallId
+ ? {
+ ...toolCall,
+ status: LIGHTHOUSE_V2_TOOL_CALL_STATUS.COMPLETED,
+ outcome: event.outcome,
+ }
+ : toolCall,
+ ),
+ activityItems: state.activityItems.map((item) =>
+ item.type === LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TOOL_CALL &&
+ item.id === event.toolCallId
+ ? {
+ ...item,
+ status: LIGHTHOUSE_V2_TOOL_CALL_STATUS.COMPLETED,
+ outcome: event.outcome,
+ }
+ : item,
+ ),
+ };
+ case LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_END:
+ return {
+ ...state,
+ status: LIGHTHOUSE_V2_STREAM_STATUS.COMPLETED,
+ activeTaskId: null,
+ messageId: event.messageId,
+ };
+ case LIGHTHOUSE_V2_SSE_EVENT.ERROR:
+ return {
+ ...state,
+ status: LIGHTHOUSE_V2_STREAM_STATUS.ERROR,
+ activeTaskId: null,
+ error: {
+ code: event.code,
+ detail: event.detail,
+ },
+ };
+ case LIGHTHOUSE_V2_SSE_EVENT.DISCONNECT:
+ // Clear the task gate so the UI can recover: keeping activeTaskId set
+ // leaves canSend false and makes the Retry button a no-op.
+ return {
+ ...state,
+ status: LIGHTHOUSE_V2_STREAM_STATUS.DISCONNECTED,
+ activeTaskId: null,
+ };
+ }
+}
+
+function appendTextActivityItem(
+ activityItems: LighthouseV2StreamActivityItem[],
+ text: string,
+): LighthouseV2StreamActivityItem[] {
+ if (!text) {
+ return activityItems;
+ }
+
+ const lastItem = activityItems.at(-1);
+ if (lastItem?.type === LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TEXT) {
+ return [
+ ...activityItems.slice(0, -1),
+ {
+ ...lastItem,
+ text: `${lastItem.text}${text}`,
+ },
+ ];
+ }
+
+ return [
+ ...activityItems,
+ {
+ id: `text-${activityItems.length}`,
+ type: LIGHTHOUSE_V2_STREAM_ACTIVITY_ITEM_TYPE.TEXT,
+ text,
+ },
+ ];
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/format.ts b/ui/app/(prowler)/lighthouse/_lib/format.ts
new file mode 100644
index 0000000000..b299d74549
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/format.ts
@@ -0,0 +1,30 @@
+import { differenceInCalendarDays, format, isValid, parseISO } from "date-fns";
+
+import { formatLocalDate } from "@/lib/date-utils";
+
+// Chat bubble timestamp, e.g. "Monday 9:30 AM".
+export function formatMessageTimestamp(insertedAt: string): string {
+ const date = new Date(insertedAt);
+ if (Number.isNaN(date.getTime())) {
+ return "";
+ }
+ return format(date, "EEEE h:mm a");
+}
+
+// Provider connection "last checked" label, reusing the app-wide local date
+// format (e.g. "Jun 15, 2026") instead of a bespoke toLocaleDateString call.
+export function formatLastChecked(value?: string | null): string {
+ if (!value) return "Never checked";
+ const formatted = formatLocalDate(value);
+ return formatted ? `Last checked ${formatted}` : "Last check unavailable";
+}
+
+// Relative age for the session history list, e.g. "Today", "1 day", "5 days".
+export function formatSessionAge(dateString: string): string {
+ const date = parseISO(dateString);
+ if (!isValid(date)) return "";
+
+ const ageInDays = Math.max(0, differenceInCalendarDays(new Date(), date));
+ if (ageInDays === 0) return "Today";
+ return ageInDays === 1 ? "1 day" : `${ageInDays} days`;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/load-chat-config.ts b/ui/app/(prowler)/lighthouse/_lib/load-chat-config.ts
new file mode 100644
index 0000000000..becc488a34
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/load-chat-config.ts
@@ -0,0 +1,86 @@
+import {
+ getLighthouseV2Configurations,
+ getLighthouseV2SupportedModels,
+ getLighthouseV2SupportedProviders,
+} from "@/app/(prowler)/lighthouse/_actions";
+import type { LighthouseChatConfig } from "@/app/(prowler)/lighthouse/_lib/chat-store";
+import { loadLighthouseV2ConnectedModels } from "@/app/(prowler)/lighthouse/_lib/model-loading";
+
+export const LIGHTHOUSE_CHAT_CONFIG_STATUS = {
+ ERROR: "error",
+ NOT_CONFIGURED: "not-configured",
+ READY: "ready",
+} as const;
+
+interface LighthouseChatConfigError {
+ status: typeof LIGHTHOUSE_CHAT_CONFIG_STATUS.ERROR;
+ message: string;
+}
+
+interface LighthouseChatConfigNotConfigured {
+ status: typeof LIGHTHOUSE_CHAT_CONFIG_STATUS.NOT_CONFIGURED;
+}
+
+interface LighthouseChatConfigReady {
+ status: typeof LIGHTHOUSE_CHAT_CONFIG_STATUS.READY;
+ config: LighthouseChatConfig;
+ modelsError?: string;
+}
+
+export type LighthouseChatConfigResult =
+ | LighthouseChatConfigError
+ | LighthouseChatConfigNotConfigured
+ | LighthouseChatConfigReady;
+
+// Shared by the /lighthouse server page and the client panel: both need the
+// same configurations + providers + connected-models bundle. Server actions
+// are callable from either context. Rejections propagate to the caller.
+export async function loadLighthouseChatConfig(): Promise<LighthouseChatConfigResult> {
+ const [configurationsResult, supportedProvidersResult] = await Promise.all([
+ getLighthouseV2Configurations(),
+ getLighthouseV2SupportedProviders(),
+ ]);
+ if ("error" in configurationsResult) {
+ return {
+ status: LIGHTHOUSE_CHAT_CONFIG_STATUS.ERROR,
+ message: configurationsResult.error,
+ };
+ }
+ if ("error" in supportedProvidersResult) {
+ return {
+ status: LIGHTHOUSE_CHAT_CONFIG_STATUS.ERROR,
+ message: supportedProvidersResult.error,
+ };
+ }
+
+ const configurations = configurationsResult.data;
+ const hasConnectedProvider = configurations.some(
+ (configuration) => configuration.connected === true,
+ );
+ if (!hasConnectedProvider) {
+ return { status: LIGHTHOUSE_CHAT_CONFIG_STATUS.NOT_CONFIGURED };
+ }
+
+ const { modelsByProvider, failedModelProviders } =
+ await loadLighthouseV2ConnectedModels(
+ configurations,
+ getLighthouseV2SupportedModels,
+ );
+ // Surface (rather than silently swallow to []) connected providers whose
+ // models failed to load, so their empty list reads as a real backend
+ // failure. Disconnected providers are never fetched (see model-loading.ts).
+ const modelsError =
+ failedModelProviders.length > 0
+ ? `Could not load available models for: ${failedModelProviders.join(", ")}. Try again shortly.`
+ : undefined;
+
+ return {
+ status: LIGHTHOUSE_CHAT_CONFIG_STATUS.READY,
+ config: {
+ configurations,
+ modelsByProvider,
+ supportedProviders: supportedProvidersResult.data,
+ },
+ modelsError,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/messages.ts b/ui/app/(prowler)/lighthouse/_lib/messages.ts
new file mode 100644
index 0000000000..4294660be6
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/messages.ts
@@ -0,0 +1,60 @@
+import {
+ LIGHTHOUSE_V2_PART_TYPE,
+ type LighthouseV2Message,
+ type LighthouseV2MessageRole,
+} from "@/app/(prowler)/lighthouse/_types";
+
+// Message parts can arrive as a raw string or as a `{ text }` object; this
+// normalizes both to a plain string and ignores anything else.
+export function getTextContent(content: unknown): string {
+ if (typeof content === "string") {
+ return content;
+ }
+ if (
+ typeof content === "object" &&
+ content !== null &&
+ "text" in content &&
+ typeof content.text === "string"
+ ) {
+ return content.text;
+ }
+ return "";
+}
+
+// Monotonic counter guaranteeing unique optimistic ids even when two messages
+// are built within the same millisecond (toISOString alone is ms-granular).
+let optimisticMessageCounter = 0;
+
+// Builds a client-only message shown immediately after submit, before the
+// backend echoes the persisted message back through the stream/refresh.
+export function buildOptimisticMessage(
+ role: LighthouseV2MessageRole,
+ text: string,
+): LighthouseV2Message {
+ const now = new Date().toISOString();
+ optimisticMessageCounter += 1;
+ const id = `optimistic-${role}-${now}-${optimisticMessageCounter}`;
+ return {
+ id,
+ role,
+ model: null,
+ tokenUsage: null,
+ insertedAt: now,
+ parts: [
+ {
+ id: `${id}-part`,
+ type: LIGHTHOUSE_V2_PART_TYPE.TEXT,
+ content: { text },
+ toolCallOutcome: null,
+ insertedAt: now,
+ updatedAt: now,
+ },
+ ],
+ };
+}
+
+// Derives a session title from the first user message (collapsed + truncated).
+export function buildSessionTitle(text: string): string {
+ const normalized = text.replace(/\s+/g, " ").trim();
+ return normalized.length > 80 ? `${normalized.slice(0, 77)}...` : normalized;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/model-loading.test.ts b/ui/app/(prowler)/lighthouse/_lib/model-loading.test.ts
new file mode 100644
index 0000000000..7298b7243a
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/model-loading.test.ts
@@ -0,0 +1,126 @@
+import { describe, expect, it, vi } from "vitest";
+
+import type {
+ LighthouseV2Configuration,
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel,
+} from "@/app/(prowler)/lighthouse/_types";
+
+import { loadLighthouseV2ConnectedModels } from "./model-loading";
+
+describe("loadLighthouseV2ConnectedModels", () => {
+ it("loads models only for connected configurations and initializes the rest as empty", async () => {
+ // Given
+ const openAIModel = model("gpt-5.5");
+ const loadModels = vi.fn(async (providerType: LighthouseV2ProviderType) => {
+ if (providerType === "openai-compatible") {
+ return { error: "Connection failed", status: 400 };
+ }
+
+ return { data: [openAIModel] };
+ });
+
+ // When
+ const result = await loadLighthouseV2ConnectedModels(
+ [
+ configuration("openai", true),
+ configuration("bedrock", false),
+ configuration("openai-compatible", false),
+ ],
+ loadModels,
+ );
+
+ // Then
+ expect(loadModels).toHaveBeenCalledTimes(1);
+ expect(loadModels).toHaveBeenCalledWith("openai");
+ expect(result.modelsByProvider).toEqual({
+ openai: [openAIModel],
+ bedrock: [],
+ "openai-compatible": [],
+ });
+ expect(result.failedModelProviders).toEqual([]);
+ });
+
+ it("reports model-loading failures only for connected configurations", async () => {
+ // Given
+ const loadModels = vi.fn(async (providerType: LighthouseV2ProviderType) => {
+ if (providerType === "bedrock") {
+ return { error: "Bedrock models unavailable", status: 503 };
+ }
+
+ throw new Error(`Disconnected provider should not load: ${providerType}`);
+ });
+
+ // When
+ const result = await loadLighthouseV2ConnectedModels(
+ [
+ configuration("openai", false),
+ configuration("bedrock", true),
+ configuration("openai-compatible", false),
+ ],
+ loadModels,
+ );
+
+ // Then
+ expect(loadModels).toHaveBeenCalledTimes(1);
+ expect(loadModels).toHaveBeenCalledWith("bedrock");
+ expect(result.modelsByProvider).toEqual({
+ openai: [],
+ bedrock: [],
+ "openai-compatible": [],
+ });
+ expect(result.failedModelProviders).toEqual(["bedrock"]);
+ });
+
+ it("dedupes provider types and treats null connection state as disconnected", async () => {
+ // Given
+ const openAIModel = model("gpt-5.5");
+ const loadModels = vi.fn(async () => ({ data: [openAIModel] }));
+
+ // When
+ const result = await loadLighthouseV2ConnectedModels(
+ [
+ configuration("openai", true),
+ { ...configuration("openai", true), id: "config-openai-2" },
+ { ...configuration("bedrock", false), connected: null },
+ ],
+ loadModels,
+ );
+
+ // Then
+ expect(loadModels).toHaveBeenCalledTimes(1);
+ expect(loadModels).toHaveBeenCalledWith("openai");
+ expect(result.modelsByProvider.openai).toEqual([openAIModel]);
+ expect(result.modelsByProvider.bedrock).toEqual([]);
+ });
+});
+
+function configuration(
+ providerType: LighthouseV2ProviderType,
+ connected: boolean,
+): LighthouseV2Configuration {
+ return {
+ id: `config-${providerType}`,
+ providerType,
+ baseUrl:
+ providerType === "openai-compatible" ? "https://example.com" : null,
+ defaultModel: null,
+ businessContext: "Production account",
+ connected,
+ connectionLastCheckedAt: null,
+ insertedAt: "2026-06-24T09:00:00Z",
+ updatedAt: "2026-06-24T10:00:00Z",
+ };
+}
+
+function model(id: string): LighthouseV2SupportedModel {
+ return {
+ id,
+ name: id,
+ maxInputTokens: null,
+ maxOutputTokens: null,
+ supportsFunctionCalling: true,
+ supportsVision: false,
+ supportsReasoning: true,
+ };
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/model-loading.ts b/ui/app/(prowler)/lighthouse/_lib/model-loading.ts
new file mode 100644
index 0000000000..cbac91559e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/model-loading.ts
@@ -0,0 +1,79 @@
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2Configuration,
+ type LighthouseV2ProviderType,
+ type LighthouseV2SupportedModel,
+} from "@/app/(prowler)/lighthouse/_types";
+
+interface LighthouseV2SupportedModelsSuccess {
+ data: LighthouseV2SupportedModel[];
+}
+
+interface LighthouseV2SupportedModelsFailure {
+ error: string;
+ errors?: unknown[];
+ status?: number;
+}
+
+type LighthouseV2SupportedModelsResult =
+ | LighthouseV2SupportedModelsSuccess
+ | LighthouseV2SupportedModelsFailure;
+
+type LoadLighthouseV2SupportedModels = (
+ providerType: LighthouseV2ProviderType,
+) => Promise<LighthouseV2SupportedModelsResult>;
+
+interface LighthouseV2ConnectedModelsResult {
+ modelsByProvider: Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+ >;
+ failedModelProviders: LighthouseV2ProviderType[];
+}
+
+export function createEmptyLighthouseV2ModelsByProvider(): Record<
+ LighthouseV2ProviderType,
+ LighthouseV2SupportedModel[]
+> {
+ return {
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI]: [],
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK]: [],
+ [LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE]: [],
+ };
+}
+
+export async function loadLighthouseV2ConnectedModels(
+ configurations: LighthouseV2Configuration[],
+ loadModels: LoadLighthouseV2SupportedModels,
+): Promise<LighthouseV2ConnectedModelsResult> {
+ const modelsByProvider = createEmptyLighthouseV2ModelsByProvider();
+ // Disconnected providers keep the [] pre-seed and never hit the models
+ // endpoint, so they can't surface spurious load failures either.
+ const connectedProviderTypes = Array.from(
+ new Set(
+ configurations
+ .filter((configuration) => configuration.connected === true)
+ .map((configuration) => configuration.providerType),
+ ),
+ );
+
+ const modelsEntries = await Promise.all(
+ connectedProviderTypes.map(async (providerType) => {
+ const result = await loadModels(providerType);
+ return [providerType, result] as const;
+ }),
+ );
+
+ const failedModelProviders: LighthouseV2ProviderType[] = [];
+
+ modelsEntries.forEach(([providerType, result]) => {
+ if ("data" in result) {
+ modelsByProvider[providerType] = result.data;
+ return;
+ }
+
+ failedModelProviders.push(providerType);
+ });
+
+ return { modelsByProvider, failedModelProviders };
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/model-selection.test.ts b/ui/app/(prowler)/lighthouse/_lib/model-selection.test.ts
new file mode 100644
index 0000000000..edb5aa038e
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/model-selection.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ buildLighthouseV2ModelSelectionValue,
+ parseLighthouseV2ModelSelectionValue,
+} from "./model-selection";
+
+describe("model-selection value codec", () => {
+ it("round-trips a provider and model id", () => {
+ // Given
+ const value = buildLighthouseV2ModelSelectionValue("openai", "gpt-5.1");
+
+ // When
+ const selection = parseLighthouseV2ModelSelectionValue(value);
+
+ // Then
+ expect(value).toBe("openai:gpt-5.1");
+ expect(selection).toEqual({ providerType: "openai", modelId: "gpt-5.1" });
+ });
+
+ it("keeps colons inside Bedrock model ids by splitting on the first colon only", () => {
+ // Given
+ const value = buildLighthouseV2ModelSelectionValue(
+ "bedrock",
+ "anthropic.claude-3-sonnet-20240229-v1:0",
+ );
+
+ // When
+ const selection = parseLighthouseV2ModelSelectionValue(value);
+
+ // Then
+ expect(selection).toEqual({
+ providerType: "bedrock",
+ modelId: "anthropic.claude-3-sonnet-20240229-v1:0",
+ });
+ });
+
+ it("rejects values without a known provider or model id", () => {
+ // Then
+ expect(parseLighthouseV2ModelSelectionValue("")).toBeNull();
+ expect(parseLighthouseV2ModelSelectionValue("gpt-5.1")).toBeNull();
+ expect(parseLighthouseV2ModelSelectionValue(":gpt-5.1")).toBeNull();
+ expect(parseLighthouseV2ModelSelectionValue("unknown:gpt-5.1")).toBeNull();
+ expect(parseLighthouseV2ModelSelectionValue("openai:")).toBeNull();
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_lib/model-selection.ts b/ui/app/(prowler)/lighthouse/_lib/model-selection.ts
new file mode 100644
index 0000000000..3142ffa68b
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/model-selection.ts
@@ -0,0 +1,45 @@
+import {
+ LIGHTHOUSE_V2_PROVIDER_TYPE,
+ type LighthouseV2ProviderType,
+} from "@/app/(prowler)/lighthouse/_types";
+
+export interface LighthouseV2ModelSelection {
+ providerType: LighthouseV2ProviderType;
+ modelId: string;
+}
+
+// Encodes a provider + model into a single combobox option value. The value is
+// kept human-readable (no encoding) so the combobox search matches the model id
+// the user types. Bedrock model ids can contain ":" (e.g. "...-v1:0"), so the
+// parser splits on the FIRST ":" only.
+export function buildLighthouseV2ModelSelectionValue(
+ providerType: LighthouseV2ProviderType,
+ modelId: string,
+) {
+ return `${providerType}:${modelId}`;
+}
+
+export function parseLighthouseV2ModelSelectionValue(
+ value: string,
+): LighthouseV2ModelSelection | null {
+ const separatorIndex = value.indexOf(":");
+ if (separatorIndex <= 0) return null;
+
+ const providerType = value.slice(0, separatorIndex);
+ if (!isLighthouseV2ProviderType(providerType)) return null;
+
+ const modelId = value.slice(separatorIndex + 1);
+ if (!modelId) return null;
+
+ return { providerType, modelId };
+}
+
+function isLighthouseV2ProviderType(
+ value: string,
+): value is LighthouseV2ProviderType {
+ return (
+ value === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI ||
+ value === LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK ||
+ value === LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/panel-chat-message-state.ts b/ui/app/(prowler)/lighthouse/_lib/panel-chat-message-state.ts
new file mode 100644
index 0000000000..55661c55bd
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/panel-chat-message-state.ts
@@ -0,0 +1,44 @@
+type PanelChatMessageStateListener = () => void;
+
+const listeners = new Set<PanelChatMessageStateListener>();
+let hasMessages = false;
+let activeSessionId: string | null = null;
+
+export function getPanelChatHasMessages(): boolean {
+ return hasMessages;
+}
+
+export function subscribePanelChatHasMessages(
+ listener: PanelChatMessageStateListener,
+): () => void {
+ listeners.add(listener);
+ return () => listeners.delete(listener);
+}
+
+export function getPanelChatActiveSessionId(): string | null {
+ return activeSessionId;
+}
+
+interface PanelChatMessageState {
+ hasMessages: boolean;
+ activeSessionId: string | null;
+}
+
+export function setPanelChatMessageState(
+ nextState: PanelChatMessageState,
+): void {
+ if (
+ hasMessages === nextState.hasMessages &&
+ activeSessionId === nextState.activeSessionId
+ ) {
+ return;
+ }
+
+ hasMessages = nextState.hasMessages;
+ activeSessionId = nextState.activeSessionId;
+ listeners.forEach((listener) => listener());
+}
+
+export function resetPanelChatMessageState(): void {
+ setPanelChatMessageState({ hasMessages: false, activeSessionId: null });
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/panel-chat-store.ts b/ui/app/(prowler)/lighthouse/_lib/panel-chat-store.ts
new file mode 100644
index 0000000000..d435fde2b2
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/panel-chat-store.ts
@@ -0,0 +1,57 @@
+import {
+ createLighthouseChatStore,
+ type LighthouseChatConfig,
+ type LighthouseChatStore,
+} from "@/app/(prowler)/lighthouse/_lib/chat-store";
+
+// Module-level singleton: the global side panel keeps the same conversation
+// while switching between Details and Lighthouse AI, across route navigation
+// and panel closes. The full-page route can reuse it for the same conversation.
+let panelChatStore: LighthouseChatStore | null = null;
+
+interface PanelChatStoreOptions {
+ initialError?: string;
+}
+
+export function getOrCreatePanelChatStore(
+ config: LighthouseChatConfig,
+ options?: PanelChatStoreOptions,
+): LighthouseChatStore {
+ if (!panelChatStore) {
+ panelChatStore = createLighthouseChatStore({
+ config,
+ syncUrlToSession: false,
+ initialError: options?.initialError,
+ });
+ }
+ return panelChatStore;
+}
+
+// Lets the full-page surface reuse the singleton only when both surfaces point
+// at the same conversation. This is intentionally a pure lookup: React may
+// run state initializers twice in Strict Mode.
+export function getPanelChatStoreForSession(
+ initialSessionId?: string,
+): LighthouseChatStore | null {
+ if (!panelChatStore) return null;
+ const expectedSessionId = initialSessionId ?? null;
+ if (panelChatStore.getState().activeSessionId !== expectedSessionId) {
+ return null;
+ }
+ return panelChatStore;
+}
+
+export function isPanelChatStore(store: LighthouseChatStore): boolean {
+ return panelChatStore === store;
+}
+
+// The config is captured in the store's closure at creation, so a
+// configuration change must tear the singleton down and rebuild it.
+export function resetPanelChatStore(): void {
+ panelChatStore?.getState().destroy();
+ panelChatStore = null;
+}
+
+export function resetPanelChatStoreForTests(): void {
+ resetPanelChatStore();
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/redirect-with-search-params.ts b/ui/app/(prowler)/lighthouse/_lib/redirect-with-search-params.ts
new file mode 100644
index 0000000000..efac742363
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/redirect-with-search-params.ts
@@ -0,0 +1,25 @@
+import { redirect } from "next/navigation";
+
+type SearchParams = Promise<Record<string, string | string[] | undefined>>;
+
+export async function redirectWithSearchParams(
+ searchParams: SearchParams,
+ pathname: string,
+) {
+ const params = await searchParams;
+ const query = new URLSearchParams();
+
+ Object.entries(params).forEach(([key, value]) => {
+ if (Array.isArray(value)) {
+ value.forEach((item) => query.append(key, item));
+ return;
+ }
+
+ if (typeof value === "string") {
+ query.set(key, value);
+ }
+ });
+
+ const queryString = query.toString();
+ redirect(queryString ? `${pathname}?${queryString}` : pathname);
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/session-events.ts b/ui/app/(prowler)/lighthouse/_lib/session-events.ts
new file mode 100644
index 0000000000..84c722fcd6
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/session-events.ts
@@ -0,0 +1,72 @@
+export const LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT =
+ "lighthouse-v2:sessions-changed";
+
+export function notifyLighthouseV2SessionsChanged() {
+ if (typeof window === "undefined") return;
+ window.dispatchEvent(new Event(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT));
+}
+
+export const LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT =
+ "lighthouse-v2:session-archived";
+
+// Carries the archived session id so the chat page can reset itself when its
+// open session is archived. Needed because sessions created live set their URL
+// via replaceState, so the sidebar can't spot them through useSearchParams.
+export function notifyLighthouseV2SessionArchived(sessionId: string) {
+ if (typeof window === "undefined") return;
+ window.dispatchEvent(
+ new CustomEvent(LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT, {
+ detail: { sessionId },
+ }),
+ );
+}
+
+export const LIGHTHOUSE_V2_NEW_CHAT_EVENT = "lighthouse-v2:new-chat";
+
+// Lets the sidebar reset an already-mounted chat page. router.push("/lighthouse")
+// is a no-op when the URL was set via replaceState (Next's router never saw it),
+// so the latest conversation needs a client-side reset signal.
+export function notifyLighthouseV2NewChat() {
+ if (typeof window === "undefined") return;
+ window.dispatchEvent(new Event(LIGHTHOUSE_V2_NEW_CHAT_EVENT));
+}
+
+export const LIGHTHOUSE_V2_CONFIGURATIONS_CHANGED_EVENT =
+ "lighthouse-v2:configurations-changed";
+
+// Fired after provider configuration CRUD so cached chat configs (the panel
+// keeps one at module scope) can invalidate and reload.
+export function notifyLighthouseV2ConfigurationsChanged() {
+ if (typeof window === "undefined") return;
+ window.dispatchEvent(new Event(LIGHTHOUSE_V2_CONFIGURATIONS_CHANGED_EVENT));
+}
+
+// Typed subscribe helpers: each returns an unsubscribe function so consumers
+// never hand-roll addEventListener plus the CustomEvent detail cast.
+function subscribe(eventName: string, handler: (event: Event) => void) {
+ if (typeof window === "undefined") return () => {};
+ window.addEventListener(eventName, handler);
+ return () => window.removeEventListener(eventName, handler);
+}
+
+export function onLighthouseV2SessionsChanged(callback: () => void) {
+ return subscribe(LIGHTHOUSE_V2_SESSIONS_CHANGED_EVENT, callback);
+}
+
+export function onLighthouseV2SessionArchived(
+ callback: (sessionId: string) => void,
+) {
+ return subscribe(LIGHTHOUSE_V2_SESSION_ARCHIVED_EVENT, (event) => {
+ const sessionId = (event as CustomEvent<{ sessionId: string }>).detail
+ ?.sessionId;
+ if (sessionId) callback(sessionId);
+ });
+}
+
+export function onLighthouseV2NewChat(callback: () => void) {
+ return subscribe(LIGHTHOUSE_V2_NEW_CHAT_EVENT, callback);
+}
+
+export function onLighthouseV2ConfigurationsChanged(callback: () => void) {
+ return subscribe(LIGHTHOUSE_V2_CONFIGURATIONS_CHANGED_EVENT, callback);
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/stream-event-parser.ts b/ui/app/(prowler)/lighthouse/_lib/stream-event-parser.ts
new file mode 100644
index 0000000000..617b82c23f
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/stream-event-parser.ts
@@ -0,0 +1,64 @@
+import {
+ LIGHTHOUSE_V2_SSE_EVENT,
+ type LighthouseV2SSEEvent,
+} from "@/app/(prowler)/lighthouse/_types";
+
+// Parses a raw browser SSE event into a typed Lighthouse v2 stream event.
+// The backend sends one named event per SSE type; the data payload is JSON.
+export function parseStreamEvent(
+ event: Event,
+ type: LighthouseV2SSEEvent["type"],
+): LighthouseV2SSEEvent {
+ const data = event instanceof MessageEvent ? parseJsonObject(event.data) : {};
+
+ if (type === LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_DELTA) {
+ return {
+ type,
+ content: readString(data, "content"),
+ };
+ }
+ if (type === LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_START) {
+ return {
+ type,
+ toolCallId: readString(data, "tool_call_id"),
+ toolName: readString(data, "tool_name"),
+ };
+ }
+ if (type === LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_END) {
+ return {
+ type,
+ toolCallId: readString(data, "tool_call_id"),
+ outcome: readString(data, "outcome"),
+ };
+ }
+ if (type === LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_END) {
+ return {
+ type,
+ messageId: readString(data, "message_id"),
+ };
+ }
+ return {
+ type: LIGHTHOUSE_V2_SSE_EVENT.ERROR,
+ code: readString(data, "code"),
+ detail: readString(data, "detail"),
+ };
+}
+
+function parseJsonObject(value: unknown): Record<string, unknown> {
+ if (typeof value !== "string") {
+ return {};
+ }
+ try {
+ const parsed: unknown = JSON.parse(value);
+ return typeof parsed === "object" && parsed !== null
+ ? (parsed as Record<string, unknown>)
+ : {};
+ } catch {
+ return {};
+ }
+}
+
+function readString(data: Record<string, unknown>, key: string): string {
+ const value = data[key];
+ return typeof value === "string" ? value : "";
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/stream-url.ts b/ui/app/(prowler)/lighthouse/_lib/stream-url.ts
new file mode 100644
index 0000000000..de2478b15f
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/stream-url.ts
@@ -0,0 +1,8 @@
+// Same-origin path for the Lighthouse v2 SSE proxy route handler.
+//
+// The browser EventSource MUST hit our own origin (not the cross-origin API
+// host) so it doesn't fail on CORS, and so the access token stays server-side
+// (it is attached by the route handler, never placed in the browser URL).
+export function buildLighthouseV2StreamUrl(sessionId: string): string {
+ return `/api/lighthouse/v2/sessions/${encodeURIComponent(sessionId)}/event-stream`;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/testing/event-source-mock.ts b/ui/app/(prowler)/lighthouse/_lib/testing/event-source-mock.ts
new file mode 100644
index 0000000000..2672509510
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/testing/event-source-mock.ts
@@ -0,0 +1,49 @@
+import { vi } from "vitest";
+
+// Controllable EventSource mock: records each instance so tests can drive
+// named SSE events and connection failures, while still being a vi.fn so
+// `expect(EventSource).toHaveBeenCalledWith(...)` keeps working.
+export interface MockEventSource {
+ url: string;
+ readyState: number;
+ onerror: ((event: Event) => void) | null;
+ listeners: Map<string, Set<EventListener>>;
+ addEventListener: (type: string, cb: EventListener) => void;
+ close: ReturnType<typeof vi.fn>;
+ emit: (type: string, data: unknown) => void;
+ fail: (readyState: number) => void;
+}
+
+// The mock never fires "open": the client must POST the message without
+// waiting for it (the backend sends no bytes until the worker emits, which
+// only happens after the POST). This is the regression guard for the
+// open-gate deadlock.
+export function stubEventSource(): MockEventSource[] {
+ const eventSources: MockEventSource[] = [];
+ const EventSourceMock = vi.fn(function (this: MockEventSource, url: string) {
+ this.url = url;
+ this.readyState = 0;
+ this.onerror = null;
+ this.listeners = new Map();
+ this.addEventListener = (type: string, cb: EventListener) => {
+ const set = this.listeners.get(type) ?? new Set<EventListener>();
+ set.add(cb);
+ this.listeners.set(type, set);
+ };
+ this.close = vi.fn(() => {
+ this.readyState = 2;
+ });
+ this.emit = (type: string, data: unknown) => {
+ const event = new MessageEvent(type, { data: JSON.stringify(data) });
+ this.listeners.get(type)?.forEach((cb) => cb(event));
+ };
+ this.fail = (readyState: number) => {
+ this.readyState = readyState;
+ this.onerror?.(new Event("error"));
+ };
+ eventSources.push(this);
+ });
+ Object.assign(EventSourceMock, { CONNECTING: 0, OPEN: 1, CLOSED: 2 });
+ vi.stubGlobal("EventSource", EventSourceMock);
+ return eventSources;
+}
diff --git a/ui/app/(prowler)/lighthouse/_lib/tool-calls.test.ts b/ui/app/(prowler)/lighthouse/_lib/tool-calls.test.ts
new file mode 100644
index 0000000000..5ccc2b4129
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/tool-calls.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ formatToolName,
+ getToolCallContent,
+ isToolCallError,
+} from "./tool-calls";
+
+describe("getToolCallContent", () => {
+ it("should normalize the snake_case backend blob to camelCase", () => {
+ // Given
+ const content = {
+ tool_call_id: "call_1",
+ tool_name: "prowler_search_security_findings",
+ arguments: { severity: "high" },
+ result: { count: 3 },
+ outcome: "success",
+ };
+
+ // When
+ const parsed = getToolCallContent(content);
+
+ // Then
+ expect(parsed).toEqual({
+ toolCallId: "call_1",
+ toolName: "prowler_search_security_findings",
+ arguments: { severity: "high" },
+ result: { count: 3 },
+ outcome: "success",
+ });
+ });
+
+ it("should default missing optional fields without throwing", () => {
+ // Given a blob with only the required tool_name
+ const parsed = getToolCallContent({ tool_name: "search_tools" });
+
+ // Then
+ expect(parsed).toEqual({
+ toolCallId: "",
+ toolName: "search_tools",
+ arguments: null,
+ result: null,
+ outcome: null,
+ });
+ });
+
+ it("should return null for non-tool-call content", () => {
+ expect(getToolCallContent(null)).toBeNull();
+ expect(getToolCallContent("text")).toBeNull();
+ expect(getToolCallContent({ text: "hi" })).toBeNull();
+ });
+});
+
+describe("formatToolName", () => {
+ it("should strip the prowler prefix and title-case", () => {
+ expect(formatToolName("prowler_search_security_findings")).toBe(
+ "Search security findings",
+ );
+ expect(formatToolName("prowler_hub_list_checks")).toBe("List checks");
+ });
+
+ it("should still strip the legacy prowler_app_ prefix", () => {
+ expect(formatToolName("prowler_app_search_security_findings")).toBe(
+ "Search security findings",
+ );
+ });
+
+ it("should humanize prefix-less tools", () => {
+ expect(formatToolName("search_tools")).toBe("Search tools");
+ });
+});
+
+describe("isToolCallError", () => {
+ it("should treat success and absent outcomes as non-errors", () => {
+ expect(isToolCallError("success")).toBe(false);
+ expect(isToolCallError(null)).toBe(false);
+ });
+
+ it("should treat any other outcome as an error", () => {
+ expect(isToolCallError("timeout")).toBe(true);
+ expect(isToolCallError("mcp_tool_error")).toBe(true);
+ });
+});
diff --git a/ui/app/(prowler)/lighthouse/_lib/tool-calls.ts b/ui/app/(prowler)/lighthouse/_lib/tool-calls.ts
new file mode 100644
index 0000000000..88e478089b
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_lib/tool-calls.ts
@@ -0,0 +1,53 @@
+import type { LighthouseV2ToolCallContent } from "@/app/(prowler)/lighthouse/_types";
+
+// Prefixes shared by the MCP-sourced tools; stripped for display so a name like
+// `prowler_search_security_findings` reads as "Search security findings". The
+// specific prefixes are listed before the bare `prowler_` catch-all so Hub, Docs,
+// and legacy `prowler_app_` records match first and render cleanly.
+const TOOL_NAME_PREFIXES = [
+ "prowler_hub_",
+ "prowler_docs_",
+ "prowler_app_",
+ "prowler_",
+] as const;
+
+// Reads the snake_case TOOL_CALL blob the backend persists and normalizes it to
+// the camelCase UI shape. Returns null when `content` isn't a tool-call object.
+export function getToolCallContent(
+ content: unknown,
+): LighthouseV2ToolCallContent | null {
+ if (typeof content !== "object" || content === null) {
+ return null;
+ }
+ const record = content as Record<string, unknown>;
+ if (typeof record.tool_name !== "string") {
+ return null;
+ }
+ return {
+ toolCallId:
+ typeof record.tool_call_id === "string" ? record.tool_call_id : "",
+ toolName: record.tool_name,
+ arguments: record.arguments ?? null,
+ result: record.result ?? null,
+ outcome: typeof record.outcome === "string" ? record.outcome : null,
+ };
+}
+
+// Turns a raw tool name into a human label by dropping the known prefix and
+// title-casing, e.g. `prowler_hub_list_checks` -> "List checks". A humanizer
+// (not a hardcoded map) keeps this in sync as the MCP tool whitelist grows.
+export function formatToolName(toolName: string): string {
+ const prefix = TOOL_NAME_PREFIXES.find((value) => toolName.startsWith(value));
+ const stripped = prefix ? toolName.slice(prefix.length) : toolName;
+ const words = stripped.replace(/_/g, " ").trim();
+ if (!words) {
+ return toolName;
+ }
+ return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
+// A tool call succeeded when its outcome is absent or the literal "success";
+// any other outcome is an error surfaced to the user.
+export function isToolCallError(outcome: string | null): boolean {
+ return outcome !== null && outcome.toLowerCase() !== "success";
+}
diff --git a/ui/app/(prowler)/lighthouse/_types/config.ts b/ui/app/(prowler)/lighthouse/_types/config.ts
new file mode 100644
index 0000000000..c987c1899a
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_types/config.ts
@@ -0,0 +1,97 @@
+export const LIGHTHOUSE_V2_PROVIDER_TYPE = {
+ OPENAI: "openai",
+ BEDROCK: "bedrock",
+ OPENAI_COMPATIBLE: "openai-compatible",
+} as const;
+
+export type LighthouseV2ProviderType =
+ (typeof LIGHTHOUSE_V2_PROVIDER_TYPE)[keyof typeof LIGHTHOUSE_V2_PROVIDER_TYPE];
+
+export interface LighthouseV2OpenAICredentials {
+ api_key: string;
+}
+
+export interface LighthouseV2OpenAICompatibleCredentials {
+ api_key: string;
+}
+
+export interface LighthouseV2BedrockAccessKeyCredentials {
+ aws_access_key_id: string;
+ aws_secret_access_key: string;
+ aws_region_name: string;
+}
+
+export interface LighthouseV2BedrockApiKeyCredentials {
+ api_key: string;
+ aws_region_name: string;
+}
+
+export type LighthouseV2BedrockCredentials =
+ | LighthouseV2BedrockAccessKeyCredentials
+ | LighthouseV2BedrockApiKeyCredentials;
+
+export type LighthouseV2Credentials =
+ | LighthouseV2OpenAICredentials
+ | LighthouseV2OpenAICompatibleCredentials
+ | LighthouseV2BedrockCredentials;
+
+export interface LighthouseV2Configuration {
+ id: string;
+ providerType: LighthouseV2ProviderType;
+ baseUrl: string | null;
+ defaultModel: string | null;
+ businessContext: string;
+ connected: boolean | null;
+ connectionLastCheckedAt: string | null;
+ insertedAt: string;
+ updatedAt: string;
+}
+
+// Provider-keyed input variants: the `providerType` discriminant ties the
+// accepted `credentials` shape (and whether `baseUrl` is allowed) to each
+// provider, so a mismatched pair fails to type-check at the call site instead
+// of slipping past into the adapter/server-action boundary.
+export interface LighthouseV2OpenAIConfigurationInput {
+ providerType: typeof LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI;
+ credentials: LighthouseV2OpenAICredentials;
+ baseUrl?: null;
+}
+
+export interface LighthouseV2OpenAICompatibleConfigurationInput {
+ providerType: typeof LIGHTHOUSE_V2_PROVIDER_TYPE.OPENAI_COMPATIBLE;
+ credentials: LighthouseV2OpenAICompatibleCredentials;
+ baseUrl: string;
+}
+
+export interface LighthouseV2BedrockConfigurationInput {
+ providerType: typeof LIGHTHOUSE_V2_PROVIDER_TYPE.BEDROCK;
+ credentials: LighthouseV2BedrockCredentials;
+ baseUrl?: null;
+}
+
+export type LighthouseV2ConfigurationInput =
+ | LighthouseV2OpenAIConfigurationInput
+ | LighthouseV2OpenAICompatibleConfigurationInput
+ | LighthouseV2BedrockConfigurationInput;
+
+export interface LighthouseV2ConfigurationUpdateInput {
+ credentials?: LighthouseV2Credentials;
+ baseUrl?: string | null;
+ defaultModel?: string | null;
+ businessContext?: string;
+}
+
+export interface LighthouseV2SupportedProvider {
+ id: LighthouseV2ProviderType;
+ name: string;
+}
+
+export interface LighthouseV2SupportedModel {
+ id: string;
+ name: string;
+ maxInputTokens: number | null;
+ maxOutputTokens: number | null;
+ supportsFunctionCalling: boolean | null;
+ supportsVision: boolean | null;
+ supportsReasoning: boolean | null;
+}
diff --git a/ui/app/(prowler)/lighthouse/_types/events.ts b/ui/app/(prowler)/lighthouse/_types/events.ts
new file mode 100644
index 0000000000..cccff312e9
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_types/events.ts
@@ -0,0 +1,51 @@
+export const LIGHTHOUSE_V2_SSE_EVENT = {
+ MESSAGE_DELTA: "message.delta",
+ TOOL_CALL_START: "tool_call.start",
+ TOOL_CALL_END: "tool_call.end",
+ MESSAGE_END: "message.end",
+ ERROR: "error",
+ DISCONNECT: "disconnect",
+} as const;
+
+export type LighthouseV2SSEEventName =
+ (typeof LIGHTHOUSE_V2_SSE_EVENT)[keyof typeof LIGHTHOUSE_V2_SSE_EVENT];
+
+export interface LighthouseV2MessageDeltaEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_DELTA;
+ content: string;
+}
+
+export interface LighthouseV2ToolCallStartEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_START;
+ toolCallId: string;
+ toolName: string;
+}
+
+export interface LighthouseV2ToolCallEndEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.TOOL_CALL_END;
+ toolCallId: string;
+ outcome: string;
+}
+
+export interface LighthouseV2MessageEndEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.MESSAGE_END;
+ messageId: string;
+}
+
+export interface LighthouseV2ErrorEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.ERROR;
+ code: string;
+ detail: string;
+}
+
+export interface LighthouseV2DisconnectEvent {
+ type: typeof LIGHTHOUSE_V2_SSE_EVENT.DISCONNECT;
+}
+
+export type LighthouseV2SSEEvent =
+ | LighthouseV2MessageDeltaEvent
+ | LighthouseV2ToolCallStartEvent
+ | LighthouseV2ToolCallEndEvent
+ | LighthouseV2MessageEndEvent
+ | LighthouseV2ErrorEvent
+ | LighthouseV2DisconnectEvent;
diff --git a/ui/app/(prowler)/lighthouse/_types/index.ts b/ui/app/(prowler)/lighthouse/_types/index.ts
new file mode 100644
index 0000000000..c74b8ced02
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_types/index.ts
@@ -0,0 +1,3 @@
+export * from "./config";
+export * from "./events";
+export * from "./sessions";
diff --git a/ui/app/(prowler)/lighthouse/_types/sessions.ts b/ui/app/(prowler)/lighthouse/_types/sessions.ts
new file mode 100644
index 0000000000..0a832d5303
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/_types/sessions.ts
@@ -0,0 +1,87 @@
+import type { LighthouseV2ProviderType } from "./config";
+
+export const LIGHTHOUSE_V2_MESSAGE_ROLE = {
+ USER: "user",
+ ASSISTANT: "assistant",
+} as const;
+
+export type LighthouseV2MessageRole =
+ (typeof LIGHTHOUSE_V2_MESSAGE_ROLE)[keyof typeof LIGHTHOUSE_V2_MESSAGE_ROLE];
+
+export const LIGHTHOUSE_V2_PART_TYPE = {
+ TEXT: "text",
+ REASONING: "reasoning",
+ TOOL_CALL: "tool_call",
+} as const;
+
+export type LighthouseV2PartType =
+ (typeof LIGHTHOUSE_V2_PART_TYPE)[keyof typeof LIGHTHOUSE_V2_PART_TYPE];
+
+export interface LighthouseV2Session {
+ id: string;
+ title: string | null;
+ isArchived: boolean;
+ insertedAt: string;
+ updatedAt: string;
+}
+
+export interface LighthouseV2Part {
+ id: string;
+ type: LighthouseV2PartType;
+ content: unknown;
+ toolCallOutcome: string | null;
+ insertedAt: string | null;
+ updatedAt: string | null;
+}
+
+// Normalized shape of a TOOL_CALL part's `content`. The backend persists this
+// blob in snake_case (tool_call_id, tool_name, ...); `getToolCallContent`
+// maps it to this camelCase form so the UI never touches the raw keys.
+export interface LighthouseV2ToolCallContent {
+ toolCallId: string;
+ toolName: string;
+ arguments: unknown;
+ result: unknown;
+ outcome: string | null;
+}
+
+export interface LighthouseV2Message {
+ id: string;
+ role: LighthouseV2MessageRole;
+ model: string | null;
+ tokenUsage: unknown;
+ insertedAt: string;
+ parts: LighthouseV2Part[];
+}
+
+export interface LighthouseV2SendMessageInput {
+ sessionId: string;
+ text: string;
+ provider: LighthouseV2ProviderType;
+ model?: string | null;
+}
+
+export const LIGHTHOUSE_V2_TASK_STATE = {
+ AVAILABLE: "available",
+ EXECUTING: "executing",
+ COMPLETED: "completed",
+ FAILED: "failed",
+ CANCELLED: "cancelled",
+} as const;
+
+export type LighthouseV2TaskState =
+ (typeof LIGHTHOUSE_V2_TASK_STATE)[keyof typeof LIGHTHOUSE_V2_TASK_STATE];
+
+export interface LighthouseV2Task {
+ id: string;
+ name: string | null;
+ state: LighthouseV2TaskState | string;
+ insertedAt?: string;
+ completedAt?: string | null;
+ metadata?: unknown;
+ result?: unknown;
+}
+
+export interface LighthouseV2SendMessageResult {
+ task: LighthouseV2Task;
+}
diff --git a/ui/app/(prowler)/lighthouse/config/connect/page.tsx b/ui/app/(prowler)/lighthouse/config/connect/page.tsx
new file mode 100644
index 0000000000..a4dd9f1106
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/config/connect/page.tsx
@@ -0,0 +1,9 @@
+import { redirectWithSearchParams } from "@/app/(prowler)/lighthouse/_lib/redirect-with-search-params";
+
+export default async function LighthouseConfigConnectRedirectPage({
+ searchParams,
+}: {
+ searchParams: Promise<Record<string, string | string[] | undefined>>;
+}) {
+ await redirectWithSearchParams(searchParams, "/lighthouse/settings/connect");
+}
diff --git a/ui/app/(prowler)/lighthouse/config/page.tsx b/ui/app/(prowler)/lighthouse/config/page.tsx
index 1cf09496f6..bac2d5204e 100644
--- a/ui/app/(prowler)/lighthouse/config/page.tsx
+++ b/ui/app/(prowler)/lighthouse/config/page.tsx
@@ -1,16 +1,7 @@
-import { Spacer } from "@heroui/spacer";
+import { redirect } from "next/navigation";
-import { LighthouseSettings, LLMProvidersTable } from "@/components/lighthouse";
-import { ContentLayout } from "@/components/ui";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
-export const dynamic = "force-dynamic";
-
-export default async function ChatbotConfigPage() {
- return (
- <ContentLayout title="LLM Configuration">
- <LLMProvidersTable />
- <Spacer y={8} />
- <LighthouseSettings />
- </ContentLayout>
- );
+export default function LighthouseConfigRedirectPage() {
+ redirect(LIGHTHOUSE_ROUTE.SETTINGS);
}
diff --git a/ui/app/(prowler)/lighthouse/config/select-model/page.tsx b/ui/app/(prowler)/lighthouse/config/select-model/page.tsx
new file mode 100644
index 0000000000..3c9d74e909
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/config/select-model/page.tsx
@@ -0,0 +1,12 @@
+import { redirectWithSearchParams } from "@/app/(prowler)/lighthouse/_lib/redirect-with-search-params";
+
+export default async function LighthouseConfigSelectModelRedirectPage({
+ searchParams,
+}: {
+ searchParams: Promise<Record<string, string | string[] | undefined>>;
+}) {
+ await redirectWithSearchParams(
+ searchParams,
+ "/lighthouse/settings/select-model",
+ );
+}
diff --git a/ui/app/(prowler)/lighthouse/page.tsx b/ui/app/(prowler)/lighthouse/page.tsx
index eefca03e6b..f54be45aed 100644
--- a/ui/app/(prowler)/lighthouse/page.tsx
+++ b/ui/app/(prowler)/lighthouse/page.tsx
@@ -3,10 +3,22 @@ import { redirect } from "next/navigation";
import {
getLighthouseProvidersConfig,
isLighthouseConfigured,
-} from "@/actions/lighthouse/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
+import { getLighthouseV2Messages } from "@/app/(prowler)/lighthouse/_actions";
+import { LighthouseV2ChatPage } from "@/app/(prowler)/lighthouse/_components/chat";
+import {
+ LIGHTHOUSE_CHAT_CONFIG_STATUS,
+ loadLighthouseChatConfig,
+} from "@/app/(prowler)/lighthouse/_lib/load-chat-config";
import { LighthouseIcon } from "@/components/icons/Icons";
-import { Chat } from "@/components/lighthouse";
-import { ContentLayout } from "@/components/ui";
+import {
+ APP_SIDEBAR_MODE,
+ AppSidebarModeSync,
+} from "@/components/layout/app-sidebar";
+import { Chat } from "@/components/lighthouse-v1";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import { isCloud } from "@/lib/shared/env";
export const dynamic = "force-dynamic";
@@ -18,11 +30,56 @@ export default async function AIChatbot({
const params = await searchParams;
const initialPrompt =
typeof params.prompt === "string" ? params.prompt : undefined;
+ const activeSessionId =
+ typeof params.session === "string" ? params.session : undefined;
+
+ if (isCloud()) {
+ const chatConfigResult = await loadLighthouseChatConfig();
+ // Errors and the not-configured case both land on settings, where the
+ // user can connect (or fix) a provider.
+ if (chatConfigResult.status !== LIGHTHOUSE_CHAT_CONFIG_STATUS.READY) {
+ return redirect(LIGHTHOUSE_ROUTE.SETTINGS);
+ }
+ const { config, modelsError } = chatConfigResult;
+
+ const initialMessages = activeSessionId
+ ? await getLighthouseV2Messages(activeSessionId)
+ : { data: [] };
+ // Treat the ?session= id as valid when its messages load (you can't fetch
+ // messages for a non-existent session, so this is the authoritative
+ // "session exists" check). A stale/deleted id fails here and is dropped so
+ // the client starts fresh instead of sending against a dead session.
+ const sessionLoaded = Boolean(activeSessionId) && "data" in initialMessages;
+ const validSessionId = sessionLoaded ? activeSessionId : undefined;
+ const chatMessages =
+ sessionLoaded && "data" in initialMessages ? initialMessages.data : [];
+ const chatRouteKey = validSessionId ?? initialPrompt ?? "new";
+
+ return (
+ <ContentLayout title="Lighthouse AI" icon={<LighthouseIcon />}>
+ <AppSidebarModeSync mode={APP_SIDEBAR_MODE.CHAT} closeSidePanel />
+ {/* [contain:layout] traps streamdown's fixed fullscreen overlay inside
+ the chat area so it never covers the sidebar or navbar. */}
+ <div className="h-[calc(100dvh-6.5rem)] min-h-0 [contain:layout]">
+ <LighthouseV2ChatPage
+ key={chatRouteKey}
+ configurations={config.configurations}
+ modelsByProvider={config.modelsByProvider}
+ supportedProviders={config.supportedProviders}
+ initialSessionId={validSessionId}
+ initialMessages={chatMessages}
+ initialPrompt={initialPrompt}
+ initialError={modelsError}
+ />
+ </div>
+ </ContentLayout>
+ );
+ }
const hasConfig = await isLighthouseConfigured();
if (!hasConfig) {
- return redirect("/lighthouse/config");
+ return redirect(LIGHTHOUSE_ROUTE.SETTINGS);
}
// Fetch provider configuration with default models
@@ -30,7 +87,7 @@ export default async function AIChatbot({
// Handle errors or missing configuration
if (providersConfig.errors || !providersConfig.providers) {
- return redirect("/lighthouse/config");
+ return redirect(LIGHTHOUSE_ROUTE.SETTINGS);
}
return (
diff --git a/ui/app/(prowler)/lighthouse/config/(connect-llm)/connect/page.tsx b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/connect/page.tsx
similarity index 73%
rename from ui/app/(prowler)/lighthouse/config/(connect-llm)/connect/page.tsx
rename to ui/app/(prowler)/lighthouse/settings/(connect-llm)/connect/page.tsx
index 6446c726a0..acebbf9cb4 100644
--- a/ui/app/(prowler)/lighthouse/config/(connect-llm)/connect/page.tsx
+++ b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/connect/page.tsx
@@ -1,11 +1,12 @@
"use client";
-import { useSearchParams } from "next/navigation";
+import { redirect, useSearchParams } from "next/navigation";
import { Suspense } from "react";
-import { ConnectLLMProvider } from "@/components/lighthouse/connect-llm-provider";
-import { SelectBedrockAuthMethod } from "@/components/lighthouse/select-bedrock-auth-method";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import { ConnectLLMProvider } from "@/components/lighthouse-v1/connect-llm-provider";
+import { SelectBedrockAuthMethod } from "@/components/lighthouse-v1/select-bedrock-auth-method";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
export const BEDROCK_AUTH_MODES = {
IAM: "iam",
@@ -43,6 +44,10 @@ function ConnectContent() {
}
export default function ConnectLLMProviderPage() {
+ if (process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true") {
+ redirect(LIGHTHOUSE_ROUTE.SETTINGS);
+ }
+
return (
<Suspense fallback={<div>Loading...</div>}>
<ConnectContent />
diff --git a/ui/app/(prowler)/lighthouse/config/(connect-llm)/layout.tsx b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/layout.tsx
similarity index 86%
rename from ui/app/(prowler)/lighthouse/config/(connect-llm)/layout.tsx
rename to ui/app/(prowler)/lighthouse/settings/(connect-llm)/layout.tsx
index 61579abcb0..8c8db3f7c7 100644
--- a/ui/app/(prowler)/lighthouse/config/(connect-llm)/layout.tsx
+++ b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/layout.tsx
@@ -2,7 +2,6 @@
import "@/styles/globals.css";
-import { Spacer } from "@heroui/spacer";
import { Icon } from "@iconify/react";
import { useRouter, useSearchParams } from "next/navigation";
import React, { useEffect, useState } from "react";
@@ -10,13 +9,14 @@ import React, { useEffect, useState } from "react";
import {
getTenantConfig,
updateTenantConfig,
-} from "@/actions/lighthouse/lighthouse";
-import { DeleteLLMProviderForm } from "@/components/lighthouse/forms/delete-llm-provider-form";
-import { WorkflowConnectLLM } from "@/components/lighthouse/workflow";
+} from "@/actions/lighthouse-v1/lighthouse";
+import { DeleteLLMProviderForm } from "@/components/lighthouse-v1/forms/delete-llm-provider-form";
+import { WorkflowConnectLLM } from "@/components/lighthouse-v1/workflow";
import { Button } from "@/components/shadcn";
+import { NavigationHeader } from "@/components/shadcn";
import { Modal } from "@/components/shadcn/modal";
-import { NavigationHeader } from "@/components/ui";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
interface ConnectLLMLayoutProps {
children: React.ReactNode;
@@ -54,7 +54,7 @@ export default function ConnectLLMLayout({ children }: ConnectLLMLayoutProps) {
await updateTenantConfig({
default_provider: provider,
});
- router.push("/lighthouse/config");
+ router.push(LIGHTHOUSE_ROUTE.SETTINGS);
};
if (!provider) {
@@ -78,9 +78,9 @@ export default function ConnectLLMLayout({ children }: ConnectLLMLayoutProps) {
<NavigationHeader
title={isEditMode ? "Configure LLM Provider" : "Connect LLM Provider"}
icon="icon-park-outline:close-small"
- href="/lighthouse/config"
+ href={LIGHTHOUSE_ROUTE.SETTINGS}
/>
- <Spacer y={8} />
+ <div className="h-8" />
<div className="grid grid-cols-1 gap-8 lg:grid-cols-12">
<div className="order-1 my-auto hidden h-full lg:col-span-4 lg:col-start-2 lg:block">
<WorkflowConnectLLM />
@@ -113,7 +113,7 @@ export default function ConnectLLMLayout({ children }: ConnectLLMLayoutProps) {
Delete Provider
</Button>
</div>
- <Spacer y={4} />
+ <div className="h-4" />
</>
)}
{children}
diff --git a/ui/app/(prowler)/lighthouse/config/(connect-llm)/select-model/page.tsx b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/select-model/page.tsx
similarity index 56%
rename from ui/app/(prowler)/lighthouse/config/(connect-llm)/select-model/page.tsx
rename to ui/app/(prowler)/lighthouse/settings/(connect-llm)/select-model/page.tsx
index 2ce22b1733..7b61e92c62 100644
--- a/ui/app/(prowler)/lighthouse/config/(connect-llm)/select-model/page.tsx
+++ b/ui/app/(prowler)/lighthouse/settings/(connect-llm)/select-model/page.tsx
@@ -1,10 +1,11 @@
"use client";
-import { useRouter, useSearchParams } from "next/navigation";
+import { redirect, useRouter, useSearchParams } from "next/navigation";
import { Suspense } from "react";
-import { SelectModel } from "@/components/lighthouse/select-model";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import { SelectModel } from "@/components/lighthouse-v1/select-model";
+import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
function SelectModelContent() {
const searchParams = useSearchParams();
@@ -20,12 +21,16 @@ function SelectModelContent() {
<SelectModel
provider={provider}
mode={mode}
- onSelect={() => router.push("/lighthouse/config")}
+ onSelect={() => router.push(LIGHTHOUSE_ROUTE.SETTINGS)}
/>
);
}
export default function SelectModelPage() {
+ if (process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true") {
+ redirect(LIGHTHOUSE_ROUTE.SETTINGS);
+ }
+
return (
<Suspense fallback={<div>Loading...</div>}>
<SelectModelContent />
diff --git a/ui/app/(prowler)/lighthouse/settings/page.tsx b/ui/app/(prowler)/lighthouse/settings/page.tsx
new file mode 100644
index 0000000000..f077678c7d
--- /dev/null
+++ b/ui/app/(prowler)/lighthouse/settings/page.tsx
@@ -0,0 +1,53 @@
+import {
+ getLighthouseV2Configurations,
+ getLighthouseV2SupportedProviders,
+} from "@/app/(prowler)/lighthouse/_actions";
+import { LighthouseV2ConfigPage } from "@/app/(prowler)/lighthouse/_components/config";
+import {
+ LighthouseSettings,
+ LLMProvidersTable,
+ ManagedLighthouseCallout,
+} from "@/components/lighthouse-v1";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { isCloud } from "@/lib/shared/env";
+
+export const dynamic = "force-dynamic";
+
+export default async function LighthouseSettingsPage() {
+ if (isCloud()) {
+ const [configurationsResult, providersResult] = await Promise.all([
+ getLighthouseV2Configurations(),
+ getLighthouseV2SupportedProviders(),
+ ]);
+
+ const providers = "data" in providersResult ? providersResult.data : [];
+ const error =
+ "error" in configurationsResult
+ ? configurationsResult.error
+ : "error" in providersResult
+ ? providersResult.error
+ : undefined;
+
+ return (
+ <ContentLayout title="Settings">
+ <LighthouseV2ConfigPage
+ configurations={
+ "data" in configurationsResult ? configurationsResult.data : []
+ }
+ providers={providers}
+ error={error}
+ />
+ </ContentLayout>
+ );
+ }
+
+ return (
+ <ContentLayout title="Settings">
+ <ManagedLighthouseCallout />
+ <div className="h-8" aria-hidden="true" />
+ <LLMProvidersTable />
+ <div className="h-8" aria-hidden="true" />
+ <LighthouseSettings />
+ </ContentLayout>
+ );
+}
diff --git a/ui/app/(prowler)/manage-groups/layout.tsx b/ui/app/(prowler)/manage-groups/layout.tsx
index 8e8487934e..224c4b4018 100644
--- a/ui/app/(prowler)/manage-groups/layout.tsx
+++ b/ui/app/(prowler)/manage-groups/layout.tsx
@@ -2,7 +2,7 @@ import "@/styles/globals.css";
import React from "react";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
interface ProviderLayoutProps {
children: React.ReactNode;
diff --git a/ui/app/(prowler)/mutelist/_components/advanced-mutelist-form.tsx b/ui/app/(prowler)/mutelist/_components/advanced-mutelist-form.tsx
index d6992d6fb5..5d30308ee3 100644
--- a/ui/app/(prowler)/mutelist/_components/advanced-mutelist-form.tsx
+++ b/ui/app/(prowler)/mutelist/_components/advanced-mutelist-form.tsx
@@ -1,6 +1,5 @@
"use client";
-import { Textarea } from "@heroui/input";
import { Trash2 } from "lucide-react";
import { useActionState, useEffect, useState } from "react";
@@ -10,11 +9,18 @@ import {
getMutedFindingsConfig,
updateMutedFindingsConfig,
} from "@/actions/processors";
-import { Button, Card, Skeleton } from "@/components/shadcn";
+import {
+ Button,
+ Card,
+ FieldError,
+ Skeleton,
+ Textarea,
+} from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { CustomLink } from "@/components/ui/custom/custom-link";
import { fontMono } from "@/config/fonts";
+import { cn } from "@/lib/utils";
import {
convertToYaml,
defaultMutedFindingsConfig,
@@ -132,6 +138,13 @@ export function AdvancedMutelistForm() {
}
};
+ const isConfigInvalid =
+ (!hasUserStartedTyping && !!state?.errors?.configuration) ||
+ !yamlValidation.isValid;
+ const configErrorMessage =
+ (!hasUserStartedTyping && state?.errors?.configuration) ||
+ (!yamlValidation.isValid ? yamlValidation.error : "");
+
if (isLoading) {
return (
<Card variant="base" className="p-6">
@@ -159,7 +172,7 @@ export function AdvancedMutelistForm() {
size="md"
>
<div className="flex flex-col gap-4">
- <p className="text-default-600 text-sm">
+ <p className="text-text-neutral-secondary text-sm">
Are you sure you want to delete this configuration? This action
cannot be undone.
</p>
@@ -193,10 +206,10 @@ export function AdvancedMutelistForm() {
<div className="flex flex-col gap-4">
<div>
- <h3 className="text-default-700 mb-2 text-lg font-semibold">
+ <h3 className="text-text-neutral-secondary mb-2 text-lg font-semibold">
Advanced Mutelist Configuration
</h3>
- <ul className="text-default-600 mb-4 list-disc pl-5 text-sm">
+ <ul className="text-text-neutral-secondary mb-4 list-disc pl-5 text-sm">
<li>
<strong>
This Mutelist configuration will take effect on the next
@@ -227,7 +240,7 @@ export function AdvancedMutelistForm() {
<div className="flex flex-col gap-2">
<label
htmlFor="configuration"
- className="text-default-700 text-sm font-medium"
+ className="text-text-neutral-secondary text-sm font-medium"
>
Mutelist Configuration (YAML)
</label>
@@ -236,29 +249,26 @@ export function AdvancedMutelistForm() {
id="configuration"
name="configuration"
placeholder={defaultMutedFindingsConfig}
- variant="bordered"
value={configText}
onChange={(e) => handleConfigChange(e.target.value)}
- minRows={20}
- maxRows={20}
- isInvalid={
- (!hasUserStartedTyping && !!state?.errors?.configuration) ||
- !yamlValidation.isValid
- }
- errorMessage={
- (!hasUserStartedTyping && state?.errors?.configuration) ||
- (!yamlValidation.isValid ? yamlValidation.error : "")
- }
- classNames={{
- input: fontMono.className + " text-sm",
- base: "min-h-[400px]",
- errorMessage: "whitespace-pre-wrap",
- }}
+ rows={20}
+ aria-invalid={isConfigInvalid}
+ className={cn(
+ fontMono.className,
+ "min-h-[400px] text-sm",
+ isConfigInvalid &&
+ "border-border-error focus:border-border-error focus:ring-border-error",
+ )}
/>
+ {isConfigInvalid && configErrorMessage && (
+ <FieldError className="my-1 px-1 whitespace-pre-wrap">
+ {configErrorMessage}
+ </FieldError>
+ )}
{yamlValidation.isValid &&
configText &&
hasUserStartedTyping && (
- <div className="text-tiny text-success my-1 flex items-center px-1">
+ <div className="text-text-success-primary my-1 flex items-center px-1 text-xs">
<span>Valid YAML format</span>
</div>
)}
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.test.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.test.tsx
index 70b90187b6..1f13aaa09c 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.test.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.test.tsx
@@ -11,13 +11,7 @@ vi.mock("@/actions/mute-rules", () => ({
updateMuteRule: updateMuteRuleMock,
}));
-vi.mock("@/components/ui", () => ({
- useToast: () => ({
- toast: toastMock,
- }),
-}));
-
-vi.mock("@/components/ui/form", () => ({
+vi.mock("@/components/shadcn/form", () => ({
FormButtons: ({
onCancel,
submitText = "Save",
@@ -38,7 +32,9 @@ vi.mock("@/components/ui/form", () => ({
),
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: toastMock }),
Input: ({
defaultValue,
...props
@@ -53,7 +49,7 @@ vi.mock("@/components/shadcn", () => ({
),
}));
-vi.mock("@/components/ui/form/Label", () => ({
+vi.mock("@/components/shadcn/form/Label", () => ({
Label: ({
children,
...props
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.tsx
index 1c90e86b90..96268f72e0 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-edit-form.tsx
@@ -5,8 +5,8 @@ import { FormEvent, useState } from "react";
import { updateMuteRule } from "@/actions/mute-rules";
import { MuteRuleActionState, MuteRuleData } from "@/actions/mute-rules/types";
import { Input, Textarea } from "@/components/shadcn";
-import { FormButtons } from "@/components/ui/form";
-import { Label } from "@/components/ui/form/Label";
+import { FormButtons } from "@/components/shadcn/form";
+import { Label } from "@/components/shadcn/form/Label";
import { useMuteRuleAction } from "@/hooks/use-mute-rule-action";
import {
enforceMuteRuleReasonLimit,
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-enabled-toggle.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-enabled-toggle.tsx
index ec843e8415..73af798640 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-enabled-toggle.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-enabled-toggle.tsx
@@ -1,11 +1,11 @@
"use client";
-import { Switch } from "@heroui/switch";
import { useState } from "react";
import { toggleMuteRule } from "@/actions/mute-rules";
import { MuteRuleData } from "@/actions/mute-rules/types";
-import { useToast } from "@/components/ui";
+import { Switch } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
interface MuteRuleEnabledToggleProps {
muteRule: MuteRuleData;
@@ -44,10 +44,9 @@ export function MuteRuleEnabledToggle({
return (
<Switch
- isSelected={isEnabled}
- onValueChange={handleToggle}
- isDisabled={isLoading}
- size="sm"
+ checked={isEnabled}
+ onCheckedChange={handleToggle}
+ disabled={isLoading}
aria-label={`Toggle mute rule ${muteRule.attributes.name}`}
/>
);
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.test.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.test.tsx
new file mode 100644
index 0000000000..eb8db616e2
--- /dev/null
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.test.tsx
@@ -0,0 +1,84 @@
+import { render, screen, within } from "@testing-library/react";
+import { type ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+import { type MuteRuleTableData } from "./mute-rule-target-previews";
+
+vi.mock("@/components/shadcn/modal", () => ({
+ Modal: ({
+ children,
+ open,
+ title,
+ }: {
+ children: ReactNode;
+ open: boolean;
+ title?: string;
+ }) =>
+ open ? (
+ <div role="dialog" aria-label={title}>
+ {children}
+ </div>
+ ) : null,
+}));
+
+import { MuteRuleTargetsModal } from "./mute-rule-targets-modal";
+
+const longMuteRule: MuteRuleTableData = {
+ type: "mute-rules",
+ id: "mute-rule-1",
+ attributes: {
+ inserted_at: "2026-04-22T09:00:00Z",
+ updated_at: "2026-04-22T09:05:00Z",
+ name: "Finding triage: Risk Accepted - 019f1d6f-b304-78a6-8a59-9f648f65d123",
+ reason: "Existing reason",
+ enabled: true,
+ finding_uids: ["uid-1"],
+ },
+ targetLabels: [
+ "Security Hub is enabled with standards or integrations configured • hub/unknown",
+ ],
+ targetSummaryLabel:
+ "Security Hub is enabled with standards or integrations configured • hub/unknown",
+ hiddenTargetCount: 0,
+};
+
+describe("MuteRuleTargetsModal", () => {
+ it("keeps long mute rule and finding cards constrained to the modal width", () => {
+ // Given / When
+ render(
+ <MuteRuleTargetsModal
+ muteRule={longMuteRule}
+ open
+ onOpenChange={vi.fn()}
+ />,
+ );
+
+ // Then
+ const dialog = screen.getByRole("dialog", { name: "Muted Findings" });
+ const content = dialog.firstElementChild;
+ if (!(content instanceof HTMLElement)) {
+ throw new Error("Expected modal content wrapper");
+ }
+
+ const muteRuleCard = within(dialog)
+ .getByText("Mute rule")
+ .closest("div")?.parentElement;
+ if (!(muteRuleCard instanceof HTMLElement)) {
+ throw new Error("Expected mute rule card");
+ }
+
+ const targetList = within(dialog).getByRole("list");
+ const targetsCard = targetList.parentElement;
+ if (!(targetsCard instanceof HTMLElement)) {
+ throw new Error("Expected targets card");
+ }
+
+ expect(content).toHaveClass("min-w-0", "max-w-full");
+ expect(muteRuleCard).toHaveClass(
+ "min-w-0",
+ "max-w-full",
+ "overflow-hidden",
+ );
+ expect(targetsCard).toHaveClass("min-w-0", "max-w-full", "overflow-hidden");
+ });
+});
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.tsx
index d2e2783c9c..2ec6bbaac6 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rule-targets-modal.tsx
@@ -29,9 +29,9 @@ export function MuteRuleTargetsModal({
description="Review every finding currently muted by this rule."
size="xl"
>
- <div className="flex flex-col gap-5">
- <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex items-start justify-between gap-4 rounded-xl border p-4">
- <div className="min-w-0">
+ <div className="flex max-w-full min-w-0 flex-col gap-5">
+ <div className="border-border-neutral-secondary bg-bg-neutral-tertiary flex max-w-full min-w-0 items-start justify-between gap-4 overflow-hidden rounded-xl border p-4">
+ <div className="min-w-0 flex-1">
<p className="text-text-neutral-tertiary text-xs font-medium tracking-[0.08em] uppercase">
Mute rule
</p>
@@ -48,7 +48,7 @@ export function MuteRuleTargetsModal({
</div>
</div>
- <div className="minimal-scrollbar border-border-neutral-secondary bg-bg-neutral-tertiary max-h-[60vh] overflow-y-auto rounded-xl border">
+ <div className="minimal-scrollbar border-border-neutral-secondary bg-bg-neutral-tertiary max-h-[60vh] max-w-full min-w-0 overflow-hidden overflow-y-auto rounded-xl border">
<ul className="divide-border-neutral-secondary divide-y">
{muteRule.targetLabels.map((label, index) => {
const [title, ...metaParts] = label.split(" • ");
@@ -57,7 +57,7 @@ export function MuteRuleTargetsModal({
return (
<li
key={`${muteRule.id}-${label}-${index}`}
- className="min-w-0 px-4 py-3"
+ className="max-w-full min-w-0 px-4 py-3"
>
<p className="text-text-neutral-primary text-sm font-medium break-all">
{title}
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.test.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.test.tsx
index aeb7747184..89788b7d73 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.test.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.test.tsx
@@ -4,11 +4,11 @@ import { describe, expect, it, vi } from "vitest";
import { createMuteRulesColumns } from "./mute-rules-columns";
-vi.mock("@/components/ui/entities", () => ({
+vi.mock("@/components/shadcn/entities", () => ({
DateWithTime: () => null,
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
}));
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx
index 68968bb414..51d136e3fd 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx
@@ -5,8 +5,8 @@ import { List } from "lucide-react";
import { MuteRuleData } from "@/actions/mute-rules/types";
import { Button } from "@/components/shadcn";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { MuteRuleEnabledToggle } from "./mute-rule-enabled-toggle";
import { MuteRuleRowActions } from "./mute-rule-row-actions";
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.test.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.test.tsx
index 8aa0e8b354..64ac2cee32 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.test.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.test.tsx
@@ -19,13 +19,9 @@ vi.mock("@/actions/mute-rules", () => ({
deleteMuteRule: deleteMuteRuleMock,
}));
-vi.mock("@/components/ui", () => ({
- useToast: () => ({
- toast: toastMock,
- }),
-}));
-
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: toastMock }),
Button: ({
children,
...props
@@ -52,7 +48,7 @@ vi.mock("@/components/shadcn/modal", () => ({
) : null,
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTable: (props: {
columns: Array<{
id?: string;
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.tsx
index da3a2478a3..17af6dd3c2 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table-client.tsx
@@ -1,6 +1,5 @@
"use client";
-import { useDisclosure } from "@heroui/use-disclosure";
import { Trash2 } from "lucide-react";
import { useRouter } from "next/navigation";
import { FormEvent, useState } from "react";
@@ -8,9 +7,9 @@ import { FormEvent, useState } from "react";
import { deleteMuteRule } from "@/actions/mute-rules";
import { MuteRuleData } from "@/actions/mute-rules/types";
import { CardTitle } from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
-import { FormButtons } from "@/components/ui/form";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import { useMuteRuleAction } from "@/hooks/use-mute-rule-action";
import { MetaDataProps } from "@/types";
@@ -37,27 +36,27 @@ export function MuteRulesTableClient({
const { isPending: isDeleting, runAction: runDeleteAction } =
useMuteRuleAction();
- const editModal = useDisclosure();
- const deleteModal = useDisclosure();
- const targetsModal = useDisclosure();
+ const [isEditModalOpen, setIsEditModalOpen] = useState(false);
+ const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+ const [isTargetsModalOpen, setIsTargetsModalOpen] = useState(false);
const handleEditClick = (muteRule: MuteRuleData) => {
setSelectedMuteRule(muteRule);
- editModal.onOpen();
+ setIsEditModalOpen(true);
};
const handleDeleteClick = (muteRule: MuteRuleData) => {
setSelectedMuteRule(muteRule);
- deleteModal.onOpen();
+ setIsDeleteModalOpen(true);
};
const handleViewTargets = (muteRule: MuteRuleTableData) => {
setSelectedTargetsRule(muteRule);
- targetsModal.onOpen();
+ setIsTargetsModalOpen(true);
};
const handleEditSuccess = () => {
- editModal.onClose();
+ setIsEditModalOpen(false);
router.refresh();
};
@@ -68,7 +67,7 @@ export function MuteRulesTableClient({
runDeleteAction(() => deleteMuteRule(null, formData), {
onSuccess: () => {
- deleteModal.onClose();
+ setIsDeleteModalOpen(false);
router.refresh();
},
});
@@ -102,15 +101,15 @@ export function MuteRulesTableClient({
<MuteRuleTargetsModal
muteRule={selectedTargetsRule}
- open={targetsModal.isOpen}
- onOpenChange={targetsModal.onOpenChange}
+ open={isTargetsModalOpen}
+ onOpenChange={setIsTargetsModalOpen}
/>
{/* Edit Modal */}
{selectedMuteRule && (
<Modal
- open={editModal.isOpen}
- onOpenChange={editModal.onOpenChange}
+ open={isEditModalOpen}
+ onOpenChange={setIsEditModalOpen}
title="Edit Mute Rule"
description="Update the rule metadata without changing the muted findings linked to it."
size="lg"
@@ -119,7 +118,7 @@ export function MuteRulesTableClient({
key={selectedMuteRule.id}
muteRule={selectedMuteRule}
onSuccess={handleEditSuccess}
- onCancel={editModal.onClose}
+ onCancel={() => setIsEditModalOpen(false)}
/>
</Modal>
)}
@@ -127,8 +126,8 @@ export function MuteRulesTableClient({
{/* Delete Confirmation Modal */}
{selectedMuteRule && (
<Modal
- open={deleteModal.isOpen}
- onOpenChange={deleteModal.onOpenChange}
+ open={isDeleteModalOpen}
+ onOpenChange={setIsDeleteModalOpen}
title="Delete Mute Rule"
description="Remove this rule from Mutelist. Existing muted findings will remain muted."
size="md"
@@ -153,7 +152,7 @@ export function MuteRulesTableClient({
</div>
<FormButtons
- onCancel={deleteModal.onClose}
+ onCancel={() => setIsDeleteModalOpen(false)}
submitText={isDeleting ? "Deleting..." : "Delete"}
isDisabled={isDeleting}
submitColor="danger"
diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table.tsx
index 2cccb1fe1c..07b6208e83 100644
--- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table.tsx
+++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-table.tsx
@@ -43,8 +43,10 @@ export async function MuteRulesTable({ searchParams }: MuteRulesTableProps) {
</h3>
<p className="text-text-neutral-secondary mt-1 text-sm">
Mute rules are created when you mute findings from the Findings
- page. Select findings and click "Mute" to create your
- first rule.
+ page.
+ <br />
+ Select findings and click "Mute" to create your first
+ rule.
</p>
</div>
</div>
@@ -94,7 +96,7 @@ export function MuteRulesTableSkeleton() {
return (
<div
data-testid="mute-rules-table-skeleton"
- className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden border p-4"
+ className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm"
>
<div
data-testid="mute-rules-table-skeleton-intro"
diff --git a/ui/app/(prowler)/mutelist/mutelist-tabs.tsx b/ui/app/(prowler)/mutelist/mutelist-tabs.tsx
index 9540c320d0..92a08f0f67 100644
--- a/ui/app/(prowler)/mutelist/mutelist-tabs.tsx
+++ b/ui/app/(prowler)/mutelist/mutelist-tabs.tsx
@@ -1,6 +1,5 @@
"use client";
-import { List, Settings } from "lucide-react";
import { ReactNode } from "react";
import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/shadcn";
@@ -15,14 +14,8 @@ export function MutelistTabs({ simpleContent }: MutelistTabsProps) {
return (
<Tabs defaultValue="simple" className="w-full">
<TabsList className="mb-6">
- <TabsTrigger value="simple" className="gap-2">
- <List className="size-4" />
- Simple
- </TabsTrigger>
- <TabsTrigger value="advanced" className="gap-2">
- <Settings className="size-4" />
- Advanced
- </TabsTrigger>
+ <TabsTrigger value="simple">Simple</TabsTrigger>
+ <TabsTrigger value="advanced">Advanced</TabsTrigger>
</TabsList>
<TabsContent value="simple">{simpleContent}</TabsContent>
diff --git a/ui/app/(prowler)/mutelist/page.tsx b/ui/app/(prowler)/mutelist/page.tsx
index 97fd2733c2..8d41fb3a49 100644
--- a/ui/app/(prowler)/mutelist/page.tsx
+++ b/ui/app/(prowler)/mutelist/page.tsx
@@ -1,6 +1,6 @@
import { Suspense } from "react";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { SearchParamsProps } from "@/types/components";
import { MuteRulesTable, MuteRulesTableSkeleton } from "./_components/simple";
diff --git a/ui/app/(prowler)/page.tsx b/ui/app/(prowler)/page.tsx
index 99f152b4e4..ff70583e19 100644
--- a/ui/app/(prowler)/page.tsx
+++ b/ui/app/(prowler)/page.tsx
@@ -1,10 +1,20 @@
import { Suspense } from "react";
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import { getAllProviders } from "@/actions/providers";
+import { getLighthouseV2Configurations } from "@/app/(prowler)/lighthouse/_actions";
import { ProviderAccountSelectors } from "@/components/filters/provider-account-selectors";
-import { ContentLayout } from "@/components/ui";
+import { ProviderGroupSelector } from "@/components/filters/provider-group-selector";
+import {
+ APP_SIDEBAR_MODE,
+ AppSidebarModeSync,
+} from "@/components/layout/app-sidebar";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { isCloud } from "@/lib/shared/env";
import { SearchParamsProps } from "@/types";
+import { LighthouseOverviewBanner } from "./_overview/_components/lighthouse-overview-banner";
+import { getLighthouseOverviewBannerHref } from "./_overview/_lib/lighthouse-banner";
import {
AttackSurfaceSkeleton,
AttackSurfaceSSR,
@@ -38,14 +48,27 @@ export default async function Home({
searchParams: Promise<SearchParamsProps>;
}) {
const resolvedSearchParams = await searchParams;
- const providersData = await getAllProviders();
+ const [providersData, providerGroupsData, lighthouseBannerHref] =
+ await Promise.all([
+ getAllProviders(),
+ getAllProviderGroups(),
+ getLighthouseOverviewBannerHref(isCloud(), getLighthouseV2Configurations),
+ ]);
return (
<ContentLayout title="Overview" icon="lucide:square-chart-gantt">
+ <AppSidebarModeSync mode={APP_SIDEBAR_MODE.BROWSE} />
<div className="xxl:grid-cols-4 mb-6 grid grid-cols-1 gap-6 sm:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4">
<ProviderAccountSelectors providers={providersData?.data ?? []} />
+ <ProviderGroupSelector groups={providerGroupsData?.data ?? []} />
</div>
+ {lighthouseBannerHref ? (
+ <div className="mb-6">
+ <LighthouseOverviewBanner href={lighthouseBannerHref} />
+ </div>
+ ) : null}
+
<div className="flex flex-col gap-6 xl:flex-row xl:flex-wrap xl:items-stretch">
<Suspense fallback={<ThreatScoreSkeleton />}>
<ThreatScoreSSR searchParams={resolvedSearchParams} />
diff --git a/ui/app/(prowler)/profile/page.test.ts b/ui/app/(prowler)/profile/page.test.ts
new file mode 100644
index 0000000000..19184bdf8c
--- /dev/null
+++ b/ui/app/(prowler)/profile/page.test.ts
@@ -0,0 +1,35 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+describe("profile page layout", () => {
+ const currentDir = path.dirname(fileURLToPath(import.meta.url));
+ const pagePath = path.join(currentDir, "page.tsx");
+ const source = readFileSync(pagePath, "utf8");
+
+ it("places roles before API Keys and exposes its deep-link target", () => {
+ expect(source).toContain('aria-label="User profile settings"');
+ expect(source).toContain('className="w-full gap-4 p-4 md:p-5"');
+ expect(source).toContain('id="api-keys"');
+ expect(source).not.toContain("xl:grid-cols");
+ expect(source).not.toContain('className="flex w-full flex-col gap-6"');
+
+ const sectionOrder = [
+ "<UserBasicInfoCard",
+ "<RolesCard",
+ 'id="api-keys"',
+ "<ApiKeysCard",
+ "<SamlIntegrationCard",
+ "<MembershipsCard",
+ ];
+
+ const sectionIndexes = sectionOrder.map((section) =>
+ source.indexOf(section),
+ );
+
+ expect(sectionIndexes).not.toContain(-1);
+ expect(sectionIndexes).toEqual([...sectionIndexes].sort((a, b) => a - b));
+ });
+});
diff --git a/ui/app/(prowler)/profile/page.tsx b/ui/app/(prowler)/profile/page.tsx
index c992734283..8dbd27183f 100644
--- a/ui/app/(prowler)/profile/page.tsx
+++ b/ui/app/(prowler)/profile/page.tsx
@@ -4,7 +4,8 @@ import { getSamlConfig } from "@/actions/integrations/saml";
import { getUserInfo } from "@/actions/users/users";
import { auth } from "@/auth.config";
import { SamlIntegrationCard } from "@/components/integrations/saml/saml-integration-card";
-import { ContentLayout } from "@/components/ui";
+import { Card } from "@/components/shadcn";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { ApiKeysCard, UserBasicInfoCard } from "@/components/users/profile";
import { MembershipsCard } from "@/components/users/profile/memberships-card";
import { RolesCard } from "@/components/users/profile/roles-card";
@@ -96,25 +97,29 @@ const SSRDataUser = async ({
const samlConfig = hasManageIntegrations ? await getSamlConfig() : undefined;
return (
- <div className="flex w-full flex-col gap-6">
+ <Card
+ variant="base"
+ padding="none"
+ role="region"
+ aria-label="User profile settings"
+ className="w-full gap-4 p-4 md:p-5"
+ >
<UserBasicInfoCard user={userData} tenantId={userTenantId || ""} />
- <div className="flex flex-col gap-6 xl:flex-row">
- <div className="flex w-full flex-col gap-6 xl:max-w-[50%]">
- <RolesCard roles={roleDetails} roleDetails={roleDetailsMap} />
- {hasManageIntegrations && (
- <SamlIntegrationCard samlConfig={samlConfig?.data?.[0]} />
- )}
+ <RolesCard roles={roleDetails} roleDetails={roleDetailsMap} />
+ {hasManageAccount && (
+ <div id="api-keys" className="scroll-mt-6">
+ <ApiKeysCard searchParams={searchParams} />
</div>
- <div className="flex w-full flex-col gap-6 xl:max-w-[50%]">
- <MembershipsCard
- memberships={membershipsIncluded}
- tenantsMap={tenantsMap}
- hasManageAccount={hasManageAccount}
- sessionTenantId={session?.tenantId}
- />
- {hasManageAccount && <ApiKeysCard searchParams={searchParams} />}
- </div>
- </div>
- </div>
+ )}
+ {hasManageIntegrations && (
+ <SamlIntegrationCard samlConfig={samlConfig?.data?.[0]} />
+ )}
+ <MembershipsCard
+ memberships={membershipsIncluded}
+ tenantsMap={tenantsMap}
+ hasManageAccount={hasManageAccount}
+ sessionTenantId={session?.tenantId}
+ />
+ </Card>
);
};
diff --git a/ui/app/(prowler)/providers/page.test.ts b/ui/app/(prowler)/providers/page.test.ts
deleted file mode 100644
index 96612380df..0000000000
--- a/ui/app/(prowler)/providers/page.test.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-describe("providers page", () => {
- it("does not use unstable Date.now keys for the providers DataTable", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const pagePath = path.join(currentDir, "page.tsx");
- const source = readFileSync(pagePath, "utf8");
-
- expect(source).not.toContain("key={`providers-${Date.now()}`}");
- });
-
- it("does not pass non-serializable DataTable callbacks from the server page", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const pagePath = path.join(currentDir, "page.tsx");
- const source = readFileSync(pagePath, "utf8");
-
- expect(source).not.toContain("getSubRows={(row) => row.subRows}");
- });
-
- it("keeps expandable providers columns on explicit fixed widths", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const columnsPath = path.join(
- currentDir,
- "../../../components/providers/table/column-providers.tsx",
- );
- const source = readFileSync(columnsPath, "utf8");
-
- // Provider is fixed, Provider Groups is fluid (no explicit size)
- expect(source).toContain("size: 420");
- expect(source).toContain("size: 160");
- expect(source).toContain("size: 140");
- });
-
- it("keeps the CLI import banner gated by the Cloud environment", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const pagePath = path.join(currentDir, "page.tsx");
- const source = readFileSync(pagePath, "utf8");
-
- expect(source).toContain("NEXT_PUBLIC_IS_CLOUD_ENV");
- expect(source).toContain("{isCloudEnvironment && <CliImportBanner");
- });
-});
diff --git a/ui/app/(prowler)/providers/page.tsx b/ui/app/(prowler)/providers/page.tsx
index e6186df10a..777d28a99a 100644
--- a/ui/app/(prowler)/providers/page.tsx
+++ b/ui/app/(prowler)/providers/page.tsx
@@ -1,12 +1,18 @@
import { Suspense } from "react";
+import { listScanConfigurations } from "@/actions/scan-configurations";
import { ProvidersAccountsView } from "@/components/providers";
import { SkeletonTableProviders } from "@/components/providers/table";
import { CliImportBanner } from "@/components/scans";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-import { ContentLayout } from "@/components/ui";
import { FilterTransitionWrapper } from "@/contexts";
+import { isCloud } from "@/lib/shared/env";
import { SearchParamsProps } from "@/types";
+import {
+ SCAN_CONFIGURATION_LIST_STATUS,
+ type ScanConfigurationListState,
+} from "@/types/scan-configurations";
import { ProviderGroupsContent } from "./provider-groups-content";
import { ProviderPageTabs } from "./provider-page-tabs";
@@ -20,7 +26,7 @@ export default async function Providers({
}) {
const resolvedSearchParams = await searchParams;
const activeTab = getProviderTab(resolvedSearchParams.tab);
- const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const isCloudEnvironment = isCloud();
// Exclude `tab` and `onboarding` from the key: tab switches must not re-suspend,
// and `onboarding` is ephemeral (stripped via history.replaceState) — keeping it
@@ -103,23 +109,48 @@ const ProviderGroupsFallback = () => {
);
};
+const loadScanConfigs = async (
+ isCloud: boolean,
+): Promise<ScanConfigurationListState> => {
+ if (!isCloud) {
+ return { status: SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE, data: [] };
+ }
+
+ try {
+ return {
+ status: SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ data: await listScanConfigurations(),
+ };
+ } catch (error) {
+ console.error("Error loading provider scan configurations:", error);
+ return { status: SCAN_CONFIGURATION_LIST_STATUS.UNAVAILABLE, data: [] };
+ }
+};
+
const ProvidersTabContent = async ({
searchParams,
}: {
searchParams: SearchParamsProps;
}) => {
- const providersView = await loadProvidersAccountsViewData({
- searchParams,
- isCloud: process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true",
- });
+ const isCloudEnvironment = isCloud();
+ const [providersView, scanConfigsState] = await Promise.all([
+ loadProvidersAccountsViewData({
+ searchParams,
+ isCloud: isCloudEnvironment,
+ }),
+ loadScanConfigs(isCloudEnvironment),
+ ]);
return (
<ProvidersAccountsView
- isCloud={process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true"}
+ isCloud={isCloudEnvironment}
filters={providersView.filters}
providers={providersView.providers}
+ providerGroups={providersView.providerGroups}
metadata={providersView.metadata}
rows={providersView.rows}
+ scanConfigs={scanConfigsState.data}
+ scanConfigStatus={scanConfigsState.status}
/>
);
};
diff --git a/ui/app/(prowler)/providers/provider-groups-content.tsx b/ui/app/(prowler)/providers/provider-groups-content.tsx
index f732f131e5..51d1b30c39 100644
--- a/ui/app/(prowler)/providers/provider-groups-content.tsx
+++ b/ui/app/(prowler)/providers/provider-groups-content.tsx
@@ -6,7 +6,7 @@ import { getAllProviders } from "@/actions/providers";
import { getRoles } from "@/actions/roles";
import { AddGroupForm, EditGroupForm } from "@/components/manage-groups/forms";
import { ColumnGroups } from "@/components/manage-groups/table";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import { ProviderProps, Role, SearchParamsProps } from "@/types";
export const ProviderGroupsContent = async ({
diff --git a/ui/app/(prowler)/providers/providers-page.utils.test.ts b/ui/app/(prowler)/providers/providers-page.utils.test.ts
index 6cac891480..fff1cc863c 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.test.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.test.ts
@@ -18,6 +18,10 @@ const schedulesActionsMock = vi.hoisted(() => ({
getSchedules: vi.fn(),
}));
+const manageGroupsActionsMock = vi.hoisted(() => ({
+ getAllProviderGroups: vi.fn(),
+}));
+
vi.mock("@/actions/providers", () => providersActionsMock);
vi.mock(
"@/actions/organizations/organizations",
@@ -25,6 +29,7 @@ vi.mock(
);
vi.mock("@/actions/scans", () => scansActionsMock);
vi.mock("@/actions/schedules", () => schedulesActionsMock);
+vi.mock("@/actions/manage-groups/manage-groups", () => manageGroupsActionsMock);
import { SearchParamsProps } from "@/types";
import { ProvidersApiResponse } from "@/types/providers";
@@ -57,6 +62,7 @@ const providersResponse: ProvidersApiResponse = {
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: "111111111111",
alias: "AWS App Account",
status: "completed",
@@ -102,6 +108,7 @@ const providersResponse: ProvidersApiResponse = {
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: "222222222222",
alias: "Standalone Account",
status: "completed",
diff --git a/ui/app/(prowler)/providers/providers-page.utils.ts b/ui/app/(prowler)/providers/providers-page.utils.ts
index 0b589557bb..52a56c4fe0 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.ts
@@ -1,8 +1,10 @@
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import {
listOrganizationsSafe,
listOrganizationUnitsSafe,
} from "@/actions/organizations/organizations";
import { getAllProviders, getProviders } from "@/actions/providers";
+import { PROVIDERS_FILTER_PARAM } from "@/actions/providers/providers-filters";
import { getSchedules } from "@/actions/schedules";
import {
extractFiltersAndQuery,
@@ -484,13 +486,12 @@ export async function loadProvidersAccountsViewData({
// Map provider_type__in (used by ProviderTypeSelector) to provider__in (API param)
const providerTypeFilter =
- providerFilters[`filter[${PROVIDERS_PAGE_FILTER.PROVIDER_TYPE}]`];
+ providerFilters[PROVIDERS_FILTER_PARAM.PROVIDER_TYPE];
if (providerTypeFilter) {
- providerFilters[`filter[${PROVIDERS_PAGE_FILTER.PROVIDER}]`] =
- providerTypeFilter;
+ providerFilters[PROVIDERS_FILTER_PARAM.PROVIDER] = providerTypeFilter;
}
- delete providerFilters[`filter[${PROVIDERS_PAGE_FILTER.PROVIDER_TYPE}]`];
+ delete providerFilters[PROVIDERS_FILTER_PARAM.PROVIDER_TYPE];
const emptyOrganizationsResponse: OrganizationListResponse = {
data: [],
@@ -502,6 +503,7 @@ export async function loadProvidersAccountsViewData({
const [
providersResponse,
allProvidersResponse,
+ allProviderGroupsResponse,
schedulesResponse,
organizationsResponse,
organizationUnitsResponse,
@@ -518,6 +520,8 @@ export async function loadProvidersAccountsViewData({
// Unfiltered fetch for ProviderTypeSelector — only needs distinct types;
// TODO: Replace with a dedicated lightweight endpoint when available.
resolveActionResult(getAllProviders()),
+ // Unfiltered fetch for the Provider Group selector dropdown.
+ resolveActionResult(getAllProviderGroups()),
// Fetch configured schedules as a fallback when provider scan_* fields are
// absent (best-effort: typically empty in OSS).
resolveActionResult(getSchedules()),
@@ -546,6 +550,7 @@ export async function loadProvidersAccountsViewData({
filters: createProvidersFilters(),
metadata: providersResponse?.meta,
providers: allProvidersResponse?.data ?? [],
+ providerGroups: allProviderGroupsResponse?.data ?? [],
rows,
};
}
diff --git a/ui/app/(prowler)/resources/page.tsx b/ui/app/(prowler)/resources/page.tsx
index fb7e5ab63d..4eb2268c30 100644
--- a/ui/app/(prowler)/resources/page.tsx
+++ b/ui/app/(prowler)/resources/page.tsx
@@ -1,5 +1,6 @@
import { Suspense } from "react";
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import { getAllProviders } from "@/actions/providers";
import {
getLatestMetadataInfo,
@@ -11,7 +12,7 @@ import {
import { ResourcesFilters } from "@/components/resources/resources-filters";
import { SkeletonTableResources } from "@/components/resources/skeleton/skeleton-table-resources";
import { ResourcesTableWithSelection } from "@/components/resources/table";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import { FilterTransitionWrapper } from "@/contexts";
import {
createDict,
@@ -37,19 +38,23 @@ export default async function Resources({
const initialResourceId = resolvedSearchParams.resourceId?.toString();
- const [metadataInfoData, providersData, resourceByIdData] = await Promise.all(
- [
- (hasDateOrScan ? getMetadataInfo : getLatestMetadataInfo)({
- query,
- filters: outputFilters,
- sort: encodedSort,
- }),
- getAllProviders(),
- initialResourceId
- ? getResourceById(initialResourceId, { include: ["provider"] })
- : Promise.resolve(undefined),
- ],
- );
+ const [
+ metadataInfoData,
+ providersData,
+ providerGroupsData,
+ resourceByIdData,
+ ] = await Promise.all([
+ (hasDateOrScan ? getMetadataInfo : getLatestMetadataInfo)({
+ query,
+ filters: outputFilters,
+ sort: encodedSort,
+ }),
+ getAllProviders(),
+ getAllProviderGroups(),
+ initialResourceId
+ ? getResourceById(initialResourceId, { include: ["provider"] })
+ : Promise.resolve(undefined),
+ ]);
const processedResource = resourceByIdData?.data
? (() => {
@@ -80,6 +85,7 @@ export default async function Resources({
<div className="mb-6">
<ResourcesFilters
providers={providersData?.data || []}
+ providerGroups={providerGroupsData?.data || []}
uniqueRegions={uniqueRegions}
uniqueServices={uniqueServices}
uniqueResourceTypes={uniqueResourceTypes}
@@ -166,7 +172,7 @@ const SSRDataTable = async ({
return (
<>
{resourcesData?.errors && (
- <div className="text-small mb-4 flex rounded-lg border border-red-500 bg-red-100 p-2 text-red-700">
+ <div className="mb-4 flex rounded-lg border border-red-500 bg-red-100 p-2 text-sm text-red-700">
<p className="mr-2 font-semibold">Error:</p>
<p>{resourcesData.errors[0].detail}</p>
</div>
diff --git a/ui/app/(prowler)/roles/(add-role)/layout.tsx b/ui/app/(prowler)/roles/(add-role)/layout.tsx
index 32a1030426..1895ed6892 100644
--- a/ui/app/(prowler)/roles/(add-role)/layout.tsx
+++ b/ui/app/(prowler)/roles/(add-role)/layout.tsx
@@ -1,10 +1,9 @@
import "@/styles/globals.css";
-import { Spacer } from "@heroui/spacer";
import React from "react";
import { WorkflowAddEditRole } from "@/components/roles/workflow";
-import { NavigationHeader } from "@/components/ui";
+import { NavigationHeader } from "@/components/shadcn";
interface RoleLayoutProps {
children: React.ReactNode;
@@ -18,7 +17,7 @@ export default function RoleLayout({ children }: RoleLayoutProps) {
icon="icon-park-outline:close-small"
href="/roles"
/>
- <Spacer y={16} />
+ <div className="h-16" />
<div className="grid grid-cols-1 gap-8 px-4 sm:px-6 lg:grid-cols-12 lg:px-0">
<div className="order-1 my-auto hidden h-full lg:col-span-4 lg:col-start-2 lg:block">
<WorkflowAddEditRole />
diff --git a/ui/app/(prowler)/roles/page.tsx b/ui/app/(prowler)/roles/page.tsx
index 259776c5a3..6634d0358f 100644
--- a/ui/app/(prowler)/roles/page.tsx
+++ b/ui/app/(prowler)/roles/page.tsx
@@ -2,13 +2,11 @@ import Link from "next/link";
import { Suspense } from "react";
import { getRoles } from "@/actions/roles";
-import { FilterControls } from "@/components/filters";
import { filterRoles } from "@/components/filters/data-filters";
-import { AddIcon } from "@/components/icons";
import { ColumnsRoles, SkeletonTableRoles } from "@/components/roles/table";
import { Button } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
-import { DataTable, DataTableFilterCustom } from "@/components/ui/table";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { DataTable, DataTableFilterCustom } from "@/components/shadcn/table";
import { SearchParamsProps } from "@/types";
export default async function Roles({
@@ -21,16 +19,14 @@ export default async function Roles({
return (
<ContentLayout title="Roles" icon="lucide:user-cog">
- <FilterControls search />
-
<div className="flex flex-col gap-6">
<div className="flex flex-row items-end justify-between">
- <DataTableFilterCustom filters={filterRoles || []} />
+ <DataTableFilterCustom
+ filters={filterRoles || []}
+ gridClassName="w-fit grid-cols-[14rem_auto] items-center gap-4 sm:grid-cols-[14rem_auto] lg:grid-cols-[14rem_auto] xl:grid-cols-[14rem_auto] 2xl:grid-cols-[14rem_auto]"
+ />
<Button asChild>
- <Link href="/roles/new">
- Add Role
- <AddIcon size={20} />
- </Link>
+ <Link href="/roles/new">Add Role</Link>
</Button>
</div>
@@ -67,6 +63,7 @@ const SSRDataTable = async ({
columns={ColumnsRoles}
data={rolesData?.data || []}
metadata={rolesData?.meta}
+ showSearch
/>
);
};
diff --git a/ui/app/(prowler)/scans/config/_components/scan-configuration-editor.tsx b/ui/app/(prowler)/scans/config/_components/scan-configuration-editor.tsx
new file mode 100644
index 0000000000..e9086cd366
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/_components/scan-configuration-editor.tsx
@@ -0,0 +1,324 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { useRef } from "react";
+import { useForm } from "react-hook-form";
+import { z } from "zod";
+
+import {
+ createScanConfiguration,
+ updateScanConfiguration,
+} from "@/actions/scan-configurations";
+import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
+import {
+ Button,
+ Field,
+ FieldError,
+ FieldLabel,
+ Input,
+ Textarea,
+} from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { Modal } from "@/components/shadcn/modal";
+import { DOCS_URLS } from "@/lib/external-urls";
+import {
+ convertToYaml,
+ defaultScanConfigurationYaml,
+ validateYaml,
+} from "@/lib/yaml";
+import { scanConfigurationFormSchema } from "@/types/formSchemas";
+import { ProviderProps } from "@/types/providers";
+import { ScanConfigurationData } from "@/types/scan-configurations";
+
+import { getSelectableProviders } from "./scan-configuration-providers";
+
+interface ScanConfigurationEditorProps {
+ open: boolean;
+ onClose: (saved: boolean) => void;
+ richProviders: ProviderProps[];
+ existingConfigs: ScanConfigurationData[];
+ config: ScanConfigurationData | null;
+}
+
+interface ScanConfigurationFormProps {
+ onClose: (saved: boolean) => void;
+ richProviders: ProviderProps[];
+ existingConfigs: ScanConfigurationData[];
+ config: ScanConfigurationData | null;
+}
+
+// `provider_ids` has a zod `.default([])`, so the resolver's input and output
+// types differ — type the form with both so RHF and zodResolver line up.
+type ScanConfigurationFormInput = z.input<typeof scanConfigurationFormSchema>;
+type ScanConfigurationFormValues = z.output<typeof scanConfigurationFormSchema>;
+
+function ScanConfigurationForm({
+ onClose,
+ richProviders,
+ existingConfigs,
+ config,
+}: ScanConfigurationFormProps) {
+ const isEdit = !!config;
+ const { toast } = useToast();
+ const errorPanelRef = useRef<HTMLDivElement | null>(null);
+
+ // The form is remounted every time the modal opens (Radix unmounts the
+ // dialog content on close), so deriving the defaults from `config` here is
+ // enough to reset the form — no `useEffect` needed.
+ const form = useForm<
+ ScanConfigurationFormInput,
+ unknown,
+ ScanConfigurationFormValues
+ >({
+ resolver: zodResolver(scanConfigurationFormSchema),
+ defaultValues: config
+ ? {
+ name: config.attributes.name,
+ configuration: convertToYaml(config.attributes.configuration || ""),
+ provider_ids: config.attributes.providers || [],
+ }
+ : { name: "", configuration: "", provider_ids: [] },
+ });
+
+ const configText = form.watch("configuration") || "";
+ const selectedProviders = form.watch("provider_ids") || [];
+
+ // Mirror the Mutelist editor: the client validates YAML *syntax* live (that it
+ // parses to a mapping); the API validates the configuration values
+ // (ranges/enums) on save and returns them inline. Skip while empty so we don't
+ // flag an error before the user types.
+ const yamlSyntax = configText.trim()
+ ? validateYaml(configText)
+ : { isValid: true as const };
+
+ // Dynamic providers can't use a Scan Configuration, and a provider can only be
+ // attached to one config at a time, so both are excluded from the selector.
+ // (AccountsSelector doesn't expose a per-option disabled state, so filtering
+ // out is the cleanest contract here.)
+ const { selectableProviders, configurableCount, lockedCount } =
+ getSelectableProviders(richProviders, existingConfigs, config?.id ?? null);
+
+ const onSubmit = form.handleSubmit(async (values) => {
+ // Block on a YAML syntax error (the inline message already explains it); the
+ // API validates the values on save and returns any errors inline.
+ if (!yamlSyntax.isValid) {
+ errorPanelRef.current?.scrollIntoView({
+ behavior: "smooth",
+ block: "center",
+ });
+ return;
+ }
+
+ const formData = new FormData();
+ formData.append("name", values.name.trim());
+ formData.append("configuration", values.configuration);
+ values.provider_ids.forEach((pid) => {
+ formData.append("provider_ids", pid);
+ });
+ if (config) {
+ formData.append("id", config.id);
+ }
+
+ try {
+ const result = config
+ ? await updateScanConfiguration(null, formData)
+ : await createScanConfiguration(null, formData);
+
+ if (result?.success) {
+ toast({
+ title: isEdit
+ ? "Scan Configuration updated"
+ : "Scan Configuration created",
+ description: result.success,
+ });
+ onClose(true);
+ return;
+ }
+
+ // Field-level errors render inline next to each input; only a general
+ // error (no field to anchor it to) falls back to a toast.
+ const errors = result?.errors || {};
+ if (errors.name) form.setError("name", { message: errors.name });
+ if (errors.configuration)
+ form.setError("configuration", { message: errors.configuration });
+ if (errors.provider_ids)
+ form.setError("provider_ids", { message: errors.provider_ids });
+ if (errors.general) {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: errors.general,
+ });
+ }
+ } catch (e) {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description:
+ e instanceof Error ? e.message : "Unexpected error. Please retry.",
+ });
+ }
+ });
+
+ const isSubmitting = form.formState.isSubmitting;
+ const nameError = form.formState.errors.name?.message;
+ const configError = form.formState.errors.configuration?.message;
+ const providersError = form.formState.errors.provider_ids?.message;
+
+ return (
+ <form onSubmit={onSubmit} className="flex flex-col gap-5">
+ <Field>
+ <FieldLabel htmlFor="scan-configuration-name">Name</FieldLabel>
+ <Input
+ id="scan-configuration-name"
+ placeholder="e.g. stricter-iam-aws"
+ aria-invalid={!!nameError}
+ {...form.register("name")}
+ />
+ {nameError && <FieldError>{nameError}</FieldError>}
+ </Field>
+
+ <Field>
+ <FieldLabel htmlFor="scan-configuration-yaml">
+ Configuration (YAML)
+ </FieldLabel>
+ <ul className="text-text-neutral-tertiary mb-1 list-disc pl-5 text-xs">
+ <li>
+ Follows the structure of{" "}
+ <code className="bg-bg-neutral-tertiary text-text-neutral-secondary rounded px-1 py-0.5 font-mono">
+ prowler/config/config.yaml
+ </code>
+ ; include only the keys you want to override. Learn more{" "}
+ <CustomLink size="xs" href={DOCS_URLS.SCAN_CONFIGURATION}>
+ here
+ </CustomLink>
+ .
+ </li>
+ <li>The configuration is validated on save.</li>
+ </ul>
+ <Textarea
+ id="scan-configuration-yaml"
+ placeholder={defaultScanConfigurationYaml}
+ rows={14}
+ aria-invalid={!!configError || !yamlSyntax.isValid}
+ font="mono"
+ {...form.register("configuration", {
+ // A server-side validation error becomes stale the moment the user
+ // edits the YAML — clear it so it can't linger next to the live
+ // client-side syntax check.
+ onChange: () => form.clearErrors("configuration"),
+ })}
+ />
+ <div
+ aria-live="polite"
+ className="mt-1 flex flex-col gap-1"
+ ref={errorPanelRef}
+ >
+ {!yamlSyntax.isValid ? (
+ <FieldError>{`Invalid YAML format: ${yamlSyntax.error}`}</FieldError>
+ ) : configText.trim() && !configError ? (
+ <p className="text-text-success-primary text-xs">
+ Valid YAML format
+ </p>
+ ) : null}
+ {configError && <FieldError multiline>{configError}</FieldError>}
+ </div>
+ </Field>
+
+ <Field>
+ <FieldLabel>Attach to providers (optional)</FieldLabel>
+ <p className="text-text-neutral-tertiary text-xs">
+ Pick the providers that should use this configuration on their next
+ scan. You can save it without any and attach providers later — it just
+ won't apply to a scan until one is attached.
+ {lockedCount > 0 && (
+ <>
+ {" "}
+ {lockedCount}{" "}
+ {lockedCount === 1 ? "provider is" : "providers are"} hidden
+ because they are already attached to another Scan Configuration.
+ </>
+ )}
+ </p>
+ {selectableProviders.length === 0 ? (
+ <p className="text-text-neutral-tertiary text-xs italic">
+ {richProviders.length === 0
+ ? "No providers available in this tenant."
+ : configurableCount === 0
+ ? "Dynamic providers can't use custom Scan Configurations, so there are none to attach."
+ : "All providers are already attached to other Scan Configurations."}
+ </p>
+ ) : (
+ <AccountsSelector
+ providers={selectableProviders}
+ onBatchChange={(_filterKey, values) =>
+ form.setValue("provider_ids", values, { shouldValidate: true })
+ }
+ selectedValues={selectedProviders}
+ // Here an empty selection means "no providers attached" (the field
+ // is optional), not the filter default of "all providers". Override
+ // the filter-oriented labels so the control reads correctly.
+ placeholder="No providers selected"
+ emptySelectionLabel="No providers selected"
+ clearSelectionLabel="Clear selection"
+ search={{
+ placeholder: "Search providers...",
+ emptyMessage: "No providers found.",
+ }}
+ />
+ )}
+ {providersError && <FieldError>{providersError}</FieldError>}
+ </Field>
+
+ <div className="flex w-full justify-end gap-3">
+ <Button
+ type="button"
+ variant="ghost"
+ size="lg"
+ onClick={() => onClose(false)}
+ disabled={isSubmitting}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="submit"
+ size="lg"
+ disabled={isSubmitting || !yamlSyntax.isValid}
+ >
+ {isSubmitting ? "Saving..." : isEdit ? "Update" : "Save"}
+ </Button>
+ </div>
+ </form>
+ );
+}
+
+export function ScanConfigurationEditor({
+ open,
+ onClose,
+ richProviders,
+ existingConfigs,
+ config,
+}: ScanConfigurationEditorProps) {
+ const isEdit = !!config;
+
+ return (
+ <Modal
+ open={open}
+ onOpenChange={(o) => {
+ if (!o) onClose(false);
+ }}
+ title={isEdit ? "Edit Scan Configuration" : "New Scan Configuration"}
+ size="2xl"
+ scrollable
+ >
+ <ScanConfigurationForm
+ key={config?.id ?? "new"}
+ onClose={onClose}
+ richProviders={richProviders}
+ existingConfigs={existingConfigs}
+ config={config}
+ />
+ </Modal>
+ );
+}
diff --git a/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.test.ts b/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.test.ts
new file mode 100644
index 0000000000..d272fd8a49
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+
+import type { ProviderProps } from "@/types/providers";
+import type { ScanConfigurationData } from "@/types/scan-configurations";
+
+import { getSelectableProviders } from "./scan-configuration-providers";
+
+const provider = (id: string, isDynamic = false): ProviderProps =>
+ ({
+ id,
+ type: "providers",
+ attributes: {
+ provider: isDynamic ? "template" : "aws",
+ is_dynamic: isDynamic,
+ },
+ }) as unknown as ProviderProps;
+
+const config = (id: string, providers: string[]): ScanConfigurationData => ({
+ type: "scan-configurations",
+ id,
+ attributes: {
+ inserted_at: "2026-01-01T00:00:00Z",
+ updated_at: "2026-01-01T00:00:00Z",
+ name: id,
+ configuration: {},
+ providers,
+ },
+});
+
+describe("getSelectableProviders", () => {
+ it("excludes dynamic providers (they have no config baseline to override)", () => {
+ const result = getSelectableProviders(
+ [provider("aws-1"), provider("dyn-1", true)],
+ [],
+ null,
+ );
+
+ expect(result.selectableProviders.map((p) => p.id)).toEqual(["aws-1"]);
+ expect(result.configurableCount).toBe(1);
+ expect(result.lockedCount).toBe(0);
+ });
+
+ it("excludes providers already attached to another config", () => {
+ const result = getSelectableProviders(
+ [provider("aws-1"), provider("aws-2")],
+ [config("other", ["aws-2"])],
+ null,
+ );
+
+ expect(result.selectableProviders.map((p) => p.id)).toEqual(["aws-1"]);
+ expect(result.lockedCount).toBe(1);
+ });
+
+ it("keeps providers attached to the config being edited selectable", () => {
+ const result = getSelectableProviders(
+ [provider("aws-1"), provider("aws-2")],
+ [config("current", ["aws-1"])],
+ "current",
+ );
+
+ expect(result.selectableProviders.map((p) => p.id)).toEqual([
+ "aws-1",
+ "aws-2",
+ ]);
+ expect(result.lockedCount).toBe(0);
+ });
+
+ it("lockedCount counts only configurable providers attached elsewhere, not dynamic ones", () => {
+ const result = getSelectableProviders(
+ [provider("aws-1"), provider("aws-2"), provider("dyn-1", true)],
+ [config("other", ["aws-2"])],
+ null,
+ );
+
+ expect(result.selectableProviders.map((p) => p.id)).toEqual(["aws-1"]);
+ expect(result.configurableCount).toBe(2);
+ expect(result.lockedCount).toBe(1);
+ });
+
+ it("reports zero configurable providers when every provider is dynamic", () => {
+ const result = getSelectableProviders(
+ [provider("dyn-1", true), provider("dyn-2", true)],
+ [],
+ null,
+ );
+
+ expect(result.selectableProviders).toEqual([]);
+ expect(result.configurableCount).toBe(0);
+ expect(result.lockedCount).toBe(0);
+ });
+});
diff --git a/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.ts b/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.ts
new file mode 100644
index 0000000000..4e392e249e
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/_components/scan-configuration-providers.ts
@@ -0,0 +1,46 @@
+import { ProviderProps } from "@/types/providers";
+import { ScanConfigurationData } from "@/types/scan-configurations";
+
+export interface SelectableProvidersResult {
+ selectableProviders: ProviderProps[];
+ /** Providers eligible for a Scan Configuration at all (i.e. non-dynamic). */
+ configurableCount: number;
+ /** Configurable providers hidden because another config already owns them. */
+ lockedCount: number;
+}
+
+/**
+ * Providers that can be attached to a Scan Configuration.
+ *
+ * Dynamic providers are SDK-defined and have no `config.yaml` baseline to
+ * override, so a Scan Configuration can't apply to them — they are never
+ * selectable. A provider can also belong to only one config at a time, so those
+ * already attached to *another* config are excluded (the one being edited is
+ * kept selectable).
+ */
+export function getSelectableProviders(
+ richProviders: ProviderProps[],
+ existingConfigs: ScanConfigurationData[],
+ currentConfigId: string | null,
+): SelectableProvidersResult {
+ const attachedElsewhere = new Set<string>();
+ for (const c of existingConfigs) {
+ if (currentConfigId && c.id === currentConfigId) continue;
+ for (const pid of c.attributes.providers || []) {
+ attachedElsewhere.add(pid);
+ }
+ }
+
+ const configurableProviders = richProviders.filter(
+ (p) => !p.attributes.is_dynamic,
+ );
+ const selectableProviders = configurableProviders.filter(
+ (p) => !attachedElsewhere.has(p.id),
+ );
+
+ return {
+ selectableProviders,
+ configurableCount: configurableProviders.length,
+ lockedCount: configurableProviders.length - selectableProviders.length,
+ };
+}
diff --git a/ui/app/(prowler)/scans/config/_components/scan-configurations-columns.tsx b/ui/app/(prowler)/scans/config/_components/scan-configurations-columns.tsx
new file mode 100644
index 0000000000..421962c6fe
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/_components/scan-configurations-columns.tsx
@@ -0,0 +1,90 @@
+"use client";
+
+import { ColumnDef } from "@tanstack/react-table";
+import { Pencil, Trash2 } from "lucide-react";
+
+import {
+ ActionDropdown,
+ ActionDropdownDangerZone,
+ ActionDropdownItem,
+} from "@/components/shadcn/dropdown";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
+import { ScanConfigurationData } from "@/types/scan-configurations";
+
+export const createScanConfigurationsColumns = (
+ onEdit: (config: ScanConfigurationData) => void,
+ onDelete: (config: ScanConfigurationData) => void,
+): ColumnDef<ScanConfigurationData>[] => [
+ {
+ accessorKey: "attributes.name",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Name" />
+ ),
+ cell: ({ row }) => (
+ <div className="max-w-[260px]">
+ <p className="text-text-neutral-primary truncate text-sm font-medium">
+ {row.original.attributes.name}
+ </p>
+ </div>
+ ),
+ },
+ {
+ id: "providers_count",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Providers" />
+ ),
+ cell: ({ row }) => {
+ const count = row.original.attributes.providers?.length ?? 0;
+ return (
+ <span className="text-text-neutral-primary text-sm">
+ {count === 0 ? (
+ <span className="text-text-neutral-tertiary italic">
+ No providers
+ </span>
+ ) : (
+ `${count} ${count === 1 ? "provider" : "providers"}`
+ )}
+ </span>
+ );
+ },
+ enableSorting: false,
+ },
+ {
+ accessorKey: "attributes.updated_at",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Updated" />
+ ),
+ cell: ({ row }) => (
+ <div className="w-[160px]">
+ <DateWithTime dateTime={row.original.attributes.updated_at} />
+ </div>
+ ),
+ },
+ {
+ id: "actions",
+ header: () => null,
+ cell: ({ row }) => (
+ <div className="relative flex items-center justify-end gap-2">
+ <ActionDropdown
+ ariaLabel={`Open actions menu for ${row.original.attributes.name}`}
+ >
+ <ActionDropdownItem
+ icon={<Pencil />}
+ label="Edit"
+ onSelect={() => onEdit(row.original)}
+ />
+ <ActionDropdownDangerZone>
+ <ActionDropdownItem
+ icon={<Trash2 />}
+ label="Delete"
+ destructive
+ onSelect={() => onDelete(row.original)}
+ />
+ </ActionDropdownDangerZone>
+ </ActionDropdown>
+ </div>
+ ),
+ enableSorting: false,
+ },
+];
diff --git a/ui/app/(prowler)/scans/config/_components/scan-configurations-manager.tsx b/ui/app/(prowler)/scans/config/_components/scan-configurations-manager.tsx
new file mode 100644
index 0000000000..2599b7291b
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/_components/scan-configurations-manager.tsx
@@ -0,0 +1,275 @@
+"use client";
+
+import { Info, Plus, Trash2 } from "lucide-react";
+import { useState } from "react";
+
+import {
+ deleteScanConfiguration,
+ listScanConfigurations,
+} from "@/actions/scan-configurations";
+import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
+import { BatchFiltersLayout } from "@/components/filters/batch-filters-layout";
+import { ClearFiltersButton } from "@/components/filters/clear-filters-button";
+import { Button, Card } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { Modal } from "@/components/shadcn/modal";
+import { DataTable } from "@/components/shadcn/table";
+import { DOCS_URLS } from "@/lib/external-urls";
+import { ProviderProps } from "@/types/providers";
+import { ScanConfigurationData } from "@/types/scan-configurations";
+
+import { ScanConfigurationEditor } from "./scan-configuration-editor";
+import { createScanConfigurationsColumns } from "./scan-configurations-columns";
+
+// Same column basis classes as `FindingsFilters` so the controls align across
+// breakpoints with the rest of the product.
+const FILTER_CONTROL_COLUMN_CLASS =
+ "min-w-0 flex-none basis-full sm:basis-[calc((100%_-_0.75rem)/2)] lg:basis-[calc((100%_-_1.5rem)/3)] xl:basis-[calc((100%_-_2.25rem)/4)] 2xl:basis-[calc((100%_-_3rem)/5)]";
+
+interface ScanConfigurationsManagerProps {
+ initialConfigs: ScanConfigurationData[];
+ richProviders: ProviderProps[];
+}
+
+export function ScanConfigurationsManager({
+ initialConfigs,
+ richProviders,
+}: ScanConfigurationsManagerProps) {
+ const [configs, setConfigs] =
+ useState<ScanConfigurationData[]>(initialConfigs);
+ const [editorOpen, setEditorOpen] = useState(false);
+ const [editingConfig, setEditingConfig] =
+ useState<ScanConfigurationData | null>(null);
+ const [pendingDelete, setPendingDelete] =
+ useState<ScanConfigurationData | null>(null);
+ const [isDeleting, setIsDeleting] = useState(false);
+ const [providerFilter, setProviderFilter] = useState<string[]>([]);
+ const [nameSearch, setNameSearch] = useState<string>("");
+ const { toast } = useToast();
+
+ const refresh = async () => {
+ try {
+ const fresh = await listScanConfigurations();
+ setConfigs(fresh);
+ } catch {
+ // Keep the current table on a failed reload instead of clearing it.
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: "Failed to reload Scan Configurations. Please try again.",
+ });
+ }
+ };
+
+ const openCreate = () => {
+ setEditingConfig(null);
+ setEditorOpen(true);
+ };
+
+ const openEdit = (config: ScanConfigurationData) => {
+ setEditingConfig(config);
+ setEditorOpen(true);
+ };
+
+ const handleEditorClose = (saved: boolean) => {
+ setEditorOpen(false);
+ setEditingConfig(null);
+ if (saved) {
+ void refresh();
+ }
+ };
+
+ const handleDelete = async () => {
+ if (!pendingDelete) return;
+ setIsDeleting(true);
+ const formData = new FormData();
+ formData.append("id", pendingDelete.id);
+
+ try {
+ const result = await deleteScanConfiguration(null, formData);
+ if (result?.success) {
+ toast({
+ title: "Scan Configuration deleted",
+ description: result.success,
+ });
+ await refresh();
+ } else if (result?.errors?.general) {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: result.errors.general,
+ });
+ }
+ } catch {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: "Error deleting Scan Configuration. Please try again.",
+ });
+ } finally {
+ setIsDeleting(false);
+ setPendingDelete(null);
+ }
+ };
+
+ const columns = createScanConfigurationsColumns(
+ (cfg) => openEdit(cfg),
+ (cfg) => setPendingDelete(cfg),
+ );
+
+ const filteredConfigs = configs.filter((c) => {
+ if (providerFilter.length > 0) {
+ const attached = c.attributes.providers || [];
+ const overlaps = providerFilter.some((pid) => attached.includes(pid));
+ if (!overlaps) return false;
+ }
+ if (nameSearch) {
+ const needle = nameSearch.trim().toLowerCase();
+ if (!c.attributes.name.toLowerCase().includes(needle)) return false;
+ }
+ return true;
+ });
+
+ const noMatchForProvider =
+ providerFilter.length > 0 &&
+ filteredConfigs.length === 0 &&
+ !nameSearch.trim();
+
+ const hasAnyFilter =
+ providerFilter.length > 0 || nameSearch.trim().length > 0;
+
+ const handleProvidersChange = (_filterKey: string, values: string[]) => {
+ setProviderFilter(values);
+ };
+
+ const clearFilters = () => {
+ setProviderFilter([]);
+ setNameSearch("");
+ };
+
+ return (
+ <>
+ <div className="text-text-neutral-secondary mb-6 flex max-w-3xl items-start gap-2 text-sm">
+ <Info className="mt-0.5 size-4 shrink-0" />
+ <p>
+ By default, every provider uses Prowler's built-in configuration
+ baseline. Create a Scan Configuration to override specific values and
+ attach it to the providers that should use it. Learn more{" "}
+ <CustomLink size="sm" href={DOCS_URLS.SCAN_CONFIGURATION}>
+ here
+ </CustomLink>
+ .
+ </p>
+ </div>
+
+ <div className="mb-6">
+ <BatchFiltersLayout
+ testIdPrefix="scan-configuration"
+ controlsClassName="gap-3"
+ controls={
+ <>
+ <div className={FILTER_CONTROL_COLUMN_CLASS}>
+ <AccountsSelector
+ providers={richProviders}
+ onBatchChange={handleProvidersChange}
+ selectedValues={providerFilter}
+ />
+ </div>
+ {hasAnyFilter && (
+ <ClearFiltersButton
+ showCount
+ pendingCount={
+ providerFilter.length + (nameSearch.trim() ? 1 : 0)
+ }
+ onClear={clearFilters}
+ />
+ )}
+ <div className="md:ml-auto">
+ <Button size="lg" onClick={openCreate}>
+ <Plus className="size-4" />
+ New Scan Configuration
+ </Button>
+ </div>
+ </>
+ }
+ />
+ </div>
+
+ {noMatchForProvider ? (
+ <Card variant="base" padding="xl">
+ <div className="text-center">
+ <p className="text-text-neutral-secondary text-sm font-medium">
+ {providerFilter.length === 1
+ ? "No Scan Configuration is attached to this provider."
+ : "No Scan Configuration is attached to any of the selected providers."}
+ </p>
+ <p className="text-text-neutral-tertiary mt-1 text-sm">
+ The next scan{providerFilter.length === 1 ? "" : "s"} will use the
+ built-in defaults shipped with Prowler. Attach a Scan
+ Configuration from the editor to override them.
+ </p>
+ </div>
+ </Card>
+ ) : (
+ <DataTable
+ columns={columns}
+ data={filteredConfigs}
+ showSearch
+ controlledSearch={nameSearch}
+ onSearchChange={setNameSearch}
+ // No-op commit: presence of this prop disables the 500ms debounce
+ // inside DataTableSearch so the local filter applies on every
+ // keystroke instead of half a second after typing.
+ onSearchCommit={() => undefined}
+ searchPlaceholder="Search by config name..."
+ />
+ )}
+
+ <ScanConfigurationEditor
+ open={editorOpen}
+ onClose={handleEditorClose}
+ richProviders={richProviders}
+ existingConfigs={configs}
+ config={editingConfig}
+ />
+
+ <Modal
+ open={!!pendingDelete}
+ onOpenChange={(open) => !open && setPendingDelete(null)}
+ title="Delete Scan Configuration"
+ size="md"
+ >
+ <div className="flex flex-col gap-4">
+ <p className="text-text-neutral-secondary text-sm">
+ Are you sure you want to delete{" "}
+ <strong>{pendingDelete?.attributes.name}</strong>? Attached
+ providers will fall back to the built-in scan defaults on their next
+ scan.
+ </p>
+ <div className="flex w-full justify-end gap-4">
+ <Button
+ type="button"
+ variant="ghost"
+ size="lg"
+ onClick={() => setPendingDelete(null)}
+ disabled={isDeleting}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="button"
+ variant="destructive"
+ size="lg"
+ disabled={isDeleting}
+ onClick={handleDelete}
+ >
+ <Trash2 className="size-4" />
+ {isDeleting ? "Deleting..." : "Delete"}
+ </Button>
+ </div>
+ </div>
+ </Modal>
+ </>
+ );
+}
diff --git a/ui/app/(prowler)/scans/config/page.test.ts b/ui/app/(prowler)/scans/config/page.test.ts
new file mode 100644
index 0000000000..281ea433e0
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/page.test.ts
@@ -0,0 +1,18 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+describe("scan config page", () => {
+ it("does not block SSR on the full providers crawl", () => {
+ // Given
+ const currentDir = path.dirname(fileURLToPath(import.meta.url));
+ const source = readFileSync(path.join(currentDir, "page.tsx"), "utf8");
+
+ // Then
+ expect(source).not.toContain("getAllProviders");
+ expect(source).toContain("getProviders({ pageSize: 100 })");
+ expect(source).toContain("throw new Error");
+ });
+});
diff --git a/ui/app/(prowler)/scans/config/page.tsx b/ui/app/(prowler)/scans/config/page.tsx
new file mode 100644
index 0000000000..5319bf6ab1
--- /dev/null
+++ b/ui/app/(prowler)/scans/config/page.tsx
@@ -0,0 +1,38 @@
+import { redirect } from "next/navigation";
+
+import { getProviders } from "@/actions/providers";
+import { listScanConfigurations } from "@/actions/scan-configurations";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { isCloud } from "@/lib/shared/env";
+
+import { ScanConfigurationsManager } from "./_components/scan-configurations-manager";
+
+export default async function ScanConfigPage() {
+ // Scan Configuration is a Prowler Cloud-only feature; the OSS API has no
+ // /scan-configurations endpoints, so guard the route before hitting them.
+ if (!isCloud()) {
+ redirect("/");
+ }
+
+ // A failure here propagates to the `(prowler)/error.tsx` boundary instead of
+ // rendering a false "no scan configurations" empty table during SSR.
+ const [configs, providersResponse] = await Promise.all([
+ listScanConfigurations(),
+ getProviders({ pageSize: 100 }),
+ ]);
+
+ if (!providersResponse) {
+ throw new Error("Failed to load Providers for Scan Configuration.");
+ }
+
+ const richProviders = providersResponse.data;
+
+ return (
+ <ContentLayout title="Configuration" icon="lucide:sliders">
+ <ScanConfigurationsManager
+ initialConfigs={configs}
+ richProviders={richProviders}
+ />
+ </ContentLayout>
+ );
+}
diff --git a/ui/app/(prowler)/scans/page.tsx b/ui/app/(prowler)/scans/page.tsx
index 7027445cc1..f307920e52 100644
--- a/ui/app/(prowler)/scans/page.tsx
+++ b/ui/app/(prowler)/scans/page.tsx
@@ -1,8 +1,13 @@
import { redirect } from "next/navigation";
import { Suspense } from "react";
+import { getAllProviderGroups } from "@/actions/manage-groups/manage-groups";
import { getAllProviders } from "@/actions/providers";
import { getScans } from "@/actions/scans";
+import {
+ SCANS_PROVIDER_FILTER_FIELD,
+ type ScansFilterParam,
+} from "@/actions/scans/scans-filters";
import { getSchedules, getSchedulesPage } from "@/actions/schedules";
import { auth } from "@/auth.config";
import { PageReady } from "@/components/onboarding";
@@ -19,7 +24,7 @@ import { ScansPageShell } from "@/components/scans/scans-page-shell";
import { ScansProvidersEmptyState } from "@/components/scans/scans-providers-empty-state";
import { SkeletonTableScans } from "@/components/scans/table";
import { ScanJobsTable } from "@/components/scans/table/scan-jobs-table";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
import {
buildProviderScheduleSummary,
buildSchedulesByProviderId,
@@ -28,7 +33,6 @@ import {
} from "@/lib/schedules";
import { isCloud } from "@/lib/shared/env";
import {
- FilterType,
ProviderProps,
SCAN_JOBS_TAB,
SCAN_TRIGGER,
@@ -41,29 +45,22 @@ import {
} from "@/types/schedules";
const ACTIVE_SCAN_COUNT_PAGE_SIZE = 1;
-// Pending schedule rows must honor the same provider filters as real scan rows.
-// The `__in` keys reuse the shared FilterType; the singular variants have no
-// FilterType equivalent, so they stay as literals.
-const PENDING_ROW_PROVIDER_FILTER = {
- PROVIDER_IN: FilterType.PROVIDER,
- PROVIDER: "provider",
- PROVIDER_TYPE_IN: FilterType.PROVIDER_TYPE,
- PROVIDER_TYPE: "provider_type",
-} as const;
-
-type PendingRowProviderFilter =
- (typeof PENDING_ROW_PROVIDER_FILTER)[keyof typeof PENDING_ROW_PROVIDER_FILTER];
-type PendingRowProviderFilterParam = `filter[${PendingRowProviderFilter}]`;
-
+// Pending schedule rows are derived from provider schedules, but must honor the
+// same provider filters as real scan rows. The filter keys live with the scans
+// action (SCANS_PROVIDER_FILTER_FIELD) so they stay in sync with ScansFilterParam.
const PROVIDER_ID_FILTER_KEYS = [
- `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_IN}]`,
- `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER}]`,
-] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
+ `filter[${SCANS_PROVIDER_FILTER_FIELD.PROVIDER_IN}]`,
+ `filter[${SCANS_PROVIDER_FILTER_FIELD.PROVIDER}]`,
+] as const satisfies ReadonlyArray<ScansFilterParam>;
const PROVIDER_TYPE_FILTER_KEYS = [
- `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE_IN}]`,
- `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE}]`,
-] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
+ `filter[${SCANS_PROVIDER_FILTER_FIELD.PROVIDER_TYPE_IN}]`,
+ `filter[${SCANS_PROVIDER_FILTER_FIELD.PROVIDER_TYPE}]`,
+] as const satisfies ReadonlyArray<ScansFilterParam>;
+
+const PROVIDER_GROUP_FILTER_KEYS = [
+ `filter[${SCANS_PROVIDER_FILTER_FIELD.PROVIDER_GROUPS_IN}]`,
+] as const satisfies ReadonlyArray<ScansFilterParam>;
const getFilterSearchQuery = (
filters: Record<string, string | string[]>,
@@ -86,7 +83,7 @@ const parseCsvParam = (value?: string | string[]): string[] => {
const getFirstSearchParam = (
searchParams: SearchParamsProps,
- keys: ReadonlyArray<PendingRowProviderFilterParam>,
+ keys: ReadonlyArray<ScansFilterParam>,
): string | string[] | undefined => {
for (const key of keys) {
const value = searchParams[key];
@@ -107,11 +104,18 @@ const filterProvidersForPendingRows = (
const types = parseCsvParam(
getFirstSearchParam(searchParams, PROVIDER_TYPE_FILTER_KEYS),
);
+ const groups = parseCsvParam(
+ getFirstSearchParam(searchParams, PROVIDER_GROUP_FILTER_KEYS),
+ );
return providers.filter(
(provider) =>
(ids.length === 0 || ids.includes(provider.id)) &&
- (types.length === 0 || types.includes(provider.attributes.provider)),
+ (types.length === 0 || types.includes(provider.attributes.provider)) &&
+ (groups.length === 0 ||
+ (provider.relationships?.provider_groups?.data ?? []).some((group) =>
+ groups.includes(group.id),
+ )),
);
};
@@ -177,8 +181,12 @@ export default async function Scans({
const session = await auth();
const resolvedSearchParams = await searchParams;
- const providersData = await getAllProviders();
+ const [providersData, providerGroupsData] = await Promise.all([
+ getAllProviders(),
+ getAllProviderGroups(),
+ ]);
const providers = providersData?.data ?? [];
+ const providerGroups = providerGroupsData?.data ?? [];
const connectedProviders = providers.filter(
(provider: ProviderProps) =>
@@ -213,7 +221,7 @@ export default async function Scans({
return (
<ContentLayout
- title="Scan Jobs"
+ title="Scans"
icon="lucide:timer"
onboardingAction={onboardingAction}
>
@@ -229,6 +237,7 @@ export default async function Scans({
) : (
<ScansPageShell
providers={providers}
+ providerGroups={providerGroups}
hasManageScansPermission={hasManageScansPermission}
activeScanCount={activeScanCount}
>
diff --git a/ui/app/(prowler)/services/page.tsx b/ui/app/(prowler)/services/page.tsx
index 78e8ddbccc..fc80e6cb4c 100644
--- a/ui/app/(prowler)/services/page.tsx
+++ b/ui/app/(prowler)/services/page.tsx
@@ -1,7 +1,5 @@
-import { Spacer } from "@heroui/spacer";
-
import { FilterControls } from "@/components/filters";
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
export default async function Services() {
// const searchParamsKey = JSON.stringify(searchParams || {});
@@ -10,9 +8,9 @@ export default async function Services() {
title="Services"
icon="material-symbols:linked-services-outline"
>
- <Spacer y={4} />
+ <div className="h-4" />
<FilterControls />
- <Spacer y={4} />
+ <div className="h-4" />
{/* <Suspense key={searchParamsKey} fallback={<ServiceSkeletonGrid />}>
<SSRServiceGrid />
</Suspense> */}
diff --git a/ui/app/(prowler)/users/page.tsx b/ui/app/(prowler)/users/page.tsx
index fa1e838872..fc7bb8f6f1 100644
--- a/ui/app/(prowler)/users/page.tsx
+++ b/ui/app/(prowler)/users/page.tsx
@@ -4,11 +4,9 @@ import { Suspense } from "react";
import { getRoles } from "@/actions/roles/roles";
import { getCurrentUserTenantRole, getUsers } from "@/actions/users/users";
import { auth } from "@/auth.config";
-import { FilterControls } from "@/components/filters";
-import { AddIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { ContentLayout } from "@/components/ui";
-import { DataTable } from "@/components/ui/table";
+import { ContentLayout } from "@/components/shadcn/content-layout";
+import { DataTable } from "@/components/shadcn/table";
import { ColumnsUser, SkeletonTableUser } from "@/components/users/table";
import { Role, SearchParamsProps, UserProps } from "@/types";
import { TENANT_MEMBERSHIP_ROLE } from "@/types/users";
@@ -23,15 +21,10 @@ export default async function Users({
return (
<ContentLayout title="Users" icon="lucide:user">
- <FilterControls search />
-
<div className="flex flex-col gap-6">
<div className="flex flex-row items-end justify-end">
<Button asChild>
- <Link href="/invitations/new">
- Invite User
- <AddIcon size={20} />
- </Link>
+ <Link href="/invitations/new">Invite User</Link>
</Button>
</div>
@@ -121,6 +114,7 @@ const SSRDataTable = async ({
columns={ColumnsUser}
data={expandedUsers || []}
metadata={usersData?.meta}
+ showSearch
/>
);
};
diff --git a/ui/app/(prowler)/workloads/page.tsx b/ui/app/(prowler)/workloads/page.tsx
index 5ffd6a9802..252e35ef6f 100644
--- a/ui/app/(prowler)/workloads/page.tsx
+++ b/ui/app/(prowler)/workloads/page.tsx
@@ -1,4 +1,4 @@
-import { ContentLayout } from "@/components/ui";
+import { ContentLayout } from "@/components/shadcn/content-layout";
export default async function Workloads() {
return (
diff --git a/ui/app/api/auth/callback/github/route.ts b/ui/app/api/auth/callback/github/route.ts
index dd32951fab..e3bb8a21d4 100644
--- a/ui/app/api/auth/callback/github/route.ts
+++ b/ui/app/api/auth/callback/github/route.ts
@@ -3,15 +3,24 @@
import { NextResponse } from "next/server";
import { signIn } from "@/auth.config";
+import {
+ getInvitationTokenFromCallbackPath,
+ getSafeCallbackPath,
+} from "@/lib/auth-callback-url";
import { apiBaseUrl, baseUrl } from "@/lib/helper";
export async function GET(req: Request) {
const { searchParams } = new URL(req.url);
const code = searchParams.get("code");
+ const callbackPath = getSafeCallbackPath(searchParams);
+ const invitationToken = getInvitationTokenFromCallbackPath(callbackPath);
const params = new URLSearchParams();
params.append("code", code || "");
+ if (invitationToken) {
+ params.append("invitation_token", invitationToken);
+ }
if (!code) {
return NextResponse.json(
@@ -37,18 +46,20 @@ export async function GET(req: Request) {
const { access, refresh } = data.data.attributes;
try {
+ // Invitation tokens are accepted during the social token exchange.
+ const redirectPath = invitationToken ? "/" : callbackPath;
const result = await signIn("social-oauth", {
accessToken: access,
refreshToken: refresh,
redirect: false,
- callbackUrl: `${baseUrl}/`,
+ callbackUrl: new URL(redirectPath, baseUrl).toString(),
});
if (result?.error) {
throw new Error(result.error);
}
- return NextResponse.redirect(new URL("/", baseUrl));
+ return NextResponse.redirect(new URL(redirectPath, baseUrl));
} catch (error) {
console.error("SignIn error:", error);
return NextResponse.redirect(
@@ -57,9 +68,8 @@ export async function GET(req: Request) {
}
} catch (error) {
console.error("Error in Github callback:", error);
- return NextResponse.json(
- { error: (error as Error).message },
- { status: 500 },
+ return NextResponse.redirect(
+ new URL("/sign-in?error=AuthenticationFailed", baseUrl),
);
}
}
diff --git a/ui/app/api/auth/callback/google/route.ts b/ui/app/api/auth/callback/google/route.ts
index 2a02273284..58e18041bb 100644
--- a/ui/app/api/auth/callback/google/route.ts
+++ b/ui/app/api/auth/callback/google/route.ts
@@ -3,15 +3,24 @@
import { NextResponse } from "next/server";
import { signIn } from "@/auth.config";
+import {
+ getInvitationTokenFromCallbackPath,
+ getSafeCallbackPath,
+} from "@/lib/auth-callback-url";
import { apiBaseUrl, baseUrl } from "@/lib/helper";
export async function GET(req: Request) {
const { searchParams } = new URL(req.url);
const code = searchParams.get("code");
+ const callbackPath = getSafeCallbackPath(searchParams);
+ const invitationToken = getInvitationTokenFromCallbackPath(callbackPath);
const params = new URLSearchParams();
params.append("code", code || "");
+ if (invitationToken) {
+ params.append("invitation_token", invitationToken);
+ }
if (!code) {
return NextResponse.json(
@@ -37,18 +46,20 @@ export async function GET(req: Request) {
const { access, refresh } = data.data.attributes;
try {
+ // Invitation tokens are accepted during the social token exchange.
+ const redirectPath = invitationToken ? "/" : callbackPath;
const result = await signIn("social-oauth", {
accessToken: access,
refreshToken: refresh,
redirect: false,
- callbackUrl: `${baseUrl}/`,
+ callbackUrl: new URL(redirectPath, baseUrl).toString(),
});
if (result?.error) {
throw new Error(result.error);
}
- return NextResponse.redirect(new URL("/", baseUrl));
+ return NextResponse.redirect(new URL(redirectPath, baseUrl));
} catch (error) {
console.error("SignIn error:", error);
return NextResponse.redirect(
@@ -57,9 +68,8 @@ export async function GET(req: Request) {
}
} catch (error) {
console.error("Error in Google callback:", error);
- return NextResponse.json(
- { error: (error as Error).message },
- { status: 500 },
+ return NextResponse.redirect(
+ new URL("/sign-in?error=AuthenticationFailed", baseUrl),
);
}
}
diff --git a/ui/app/api/auth/callback/saml/route.ts b/ui/app/api/auth/callback/saml/route.ts
index 239dc98e3e..048d603148 100644
--- a/ui/app/api/auth/callback/saml/route.ts
+++ b/ui/app/api/auth/callback/saml/route.ts
@@ -3,11 +3,13 @@
import { NextResponse } from "next/server";
import { signIn } from "@/auth.config";
+import { getSafeCallbackPath } from "@/lib/auth-callback-url";
import { apiBaseUrl, baseUrl } from "@/lib/helper";
export async function GET(req: Request) {
const { searchParams } = new URL(req.url);
const id = searchParams.get("id");
+ const callbackPath = getSafeCallbackPath(searchParams, "callbackUrl");
if (!id) {
return NextResponse.json(
@@ -40,14 +42,14 @@ export async function GET(req: Request) {
accessToken: access,
refreshToken: refresh,
redirect: false,
- callbackUrl: `${baseUrl}/`,
+ callbackUrl: new URL(callbackPath, baseUrl).toString(),
});
if (result?.error) {
throw new Error(result.error);
}
- return NextResponse.redirect(new URL("/", baseUrl));
+ return NextResponse.redirect(new URL(callbackPath, baseUrl));
} catch (error) {
console.error("SAML authentication failed:", error);
return NextResponse.redirect(new URL("/sign-in", baseUrl));
diff --git a/ui/app/api/lighthouse/analyst/route.ts b/ui/app/api/lighthouse/analyst/route.ts
index d2f3ba5ece..aed006d4d9 100644
--- a/ui/app/api/lighthouse/analyst/route.ts
+++ b/ui/app/api/lighthouse/analyst/route.ts
@@ -1,7 +1,7 @@
import * as Sentry from "@sentry/nextjs";
import { createUIMessageStreamResponse, UIMessage } from "ai";
-import { getTenantConfig } from "@/actions/lighthouse/lighthouse";
+import { getTenantConfig } from "@/actions/lighthouse-v1/lighthouse";
import { auth } from "@/auth.config";
import { getErrorMessage } from "@/lib/helper";
import {
@@ -14,14 +14,14 @@ import {
handleChatModelStreamEvent,
handleToolEvent,
STREAM_MESSAGE_ID,
-} from "@/lib/lighthouse/analyst-stream";
-import { authContextStorage } from "@/lib/lighthouse/auth-context";
-import { getCurrentDataSection } from "@/lib/lighthouse/data";
-import { convertVercelMessageToLangChainMessage } from "@/lib/lighthouse/utils";
+} from "@/lib/lighthouse-v1/analyst-stream";
+import { authContextStorage } from "@/lib/lighthouse-v1/auth-context";
+import { getCurrentDataSection } from "@/lib/lighthouse-v1/data";
+import { convertVercelMessageToLangChainMessage } from "@/lib/lighthouse-v1/utils";
import {
initLighthouseWorkflow,
type RuntimeConfig,
-} from "@/lib/lighthouse/workflow";
+} from "@/lib/lighthouse-v1/workflow";
import { SentryErrorSource, SentryErrorType } from "@/sentry";
export async function POST(req: Request) {
diff --git a/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.test.ts b/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.test.ts
new file mode 100644
index 0000000000..114bd3bd2b
--- /dev/null
+++ b/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.test.ts
@@ -0,0 +1,102 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { GET } from "./route";
+
+const { authMock } = vi.hoisted(() => ({ authMock: vi.fn() }));
+
+vi.mock("@/auth.config", () => ({ auth: authMock }));
+vi.mock("@/lib/helper", () => ({
+ apiBaseUrl: "https://api.example.com/api/v1",
+}));
+
+function callRoute(sessionId = "session-1", url = "http://localhost/api") {
+ return GET(new Request(url), {
+ params: Promise.resolve({ sessionId }),
+ });
+}
+
+describe("GET /api/lighthouse/v2/sessions/[sessionId]/event-stream", () => {
+ beforeEach(() => {
+ authMock.mockResolvedValue({ accessToken: "token-123" });
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ vi.clearAllMocks();
+ });
+
+ it("returns 401 without ever calling upstream when unauthenticated", async () => {
+ authMock.mockResolvedValue(null);
+ const fetchMock = vi.fn();
+ vi.stubGlobal("fetch", fetchMock);
+
+ const response = await callRoute();
+
+ expect(response.status).toBe(401);
+ expect(fetchMock).not.toHaveBeenCalled();
+ });
+
+ it("proxies the upstream SSE body same-origin with bearer auth", async () => {
+ const upstreamBody = new ReadableStream({
+ start(controller) {
+ controller.enqueue(
+ new TextEncoder().encode(
+ 'event: message.delta\ndata: {"content":"hi"}\n\n',
+ ),
+ );
+ controller.close();
+ },
+ });
+ const fetchMock = vi.fn().mockResolvedValue(
+ new Response(upstreamBody, {
+ status: 200,
+ headers: { "content-type": "text/event-stream" },
+ }),
+ );
+ vi.stubGlobal("fetch", fetchMock);
+
+ const response = await callRoute("session-1");
+
+ // Token is attached server-side (Bearer header), never in the URL.
+ expect(fetchMock).toHaveBeenCalledWith(
+ "https://api.example.com/api/v1/lighthouse/sessions/session-1/event-stream",
+ expect.objectContaining({
+ method: "GET",
+ cache: "no-store",
+ headers: expect.objectContaining({
+ Accept: "text/event-stream",
+ Authorization: "Bearer token-123",
+ }),
+ // Client disconnects propagate to the upstream connection.
+ signal: expect.any(AbortSignal),
+ }),
+ );
+ expect(response.status).toBe(200);
+ expect(response.headers.get("content-type")).toBe("text/event-stream");
+ expect(response.headers.get("x-accel-buffering")).toBe("no");
+ // Body is piped through, not buffered.
+ expect(response.body).toBe(upstreamBody);
+ });
+
+ it("forwards the upstream status when the stream cannot be opened", async () => {
+ vi.stubGlobal(
+ "fetch",
+ vi.fn().mockResolvedValue(new Response("not found", { status: 404 })),
+ );
+
+ const response = await callRoute("missing");
+
+ expect(response.status).toBe(404);
+ });
+
+ it("returns 502 when the upstream API is unreachable", async () => {
+ vi.stubGlobal(
+ "fetch",
+ vi.fn().mockRejectedValue(new Error("ECONNREFUSED")),
+ );
+
+ const response = await callRoute();
+
+ expect(response.status).toBe(502);
+ });
+});
diff --git a/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.ts b/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.ts
new file mode 100644
index 0000000000..e6a594cd01
--- /dev/null
+++ b/ui/app/api/lighthouse/v2/sessions/[sessionId]/event-stream/route.ts
@@ -0,0 +1,76 @@
+import { auth } from "@/auth.config";
+import { apiBaseUrl } from "@/lib/helper";
+
+// Always stream live; never cache or statically optimize this route.
+export const dynamic = "force-dynamic";
+
+/**
+ * Reverse-proxy the Django Server-Sent Events stream for a Lighthouse v2
+ * session so the browser EventSource talks to our own origin.
+ *
+ * Why this exists: an EventSource opened directly against the cross-origin API
+ * host fails (CORS / unreachable internal host) and would expose the access
+ * token in the browser URL. Here the request is made server-side with the
+ * Authorization header, and the upstream SSE body is piped straight back.
+ */
+export async function GET(
+ request: Request,
+ { params }: { params: Promise<{ sessionId: string }> },
+) {
+ const { sessionId } = await params;
+
+ const session = await auth();
+ if (!session?.accessToken) {
+ return Response.json({ error: "Unauthorized" }, { status: 401 });
+ }
+
+ if (!apiBaseUrl) {
+ return Response.json(
+ { error: "API base URL is not configured." },
+ { status: 500 },
+ );
+ }
+
+ const upstreamUrl = `${apiBaseUrl}/lighthouse/sessions/${encodeURIComponent(
+ sessionId,
+ )}/event-stream`;
+
+ let upstream: Response;
+ try {
+ upstream = await fetch(upstreamUrl, {
+ method: "GET",
+ headers: {
+ Accept: "text/event-stream",
+ Authorization: `Bearer ${session.accessToken}`,
+ },
+ cache: "no-store",
+ // Abort the upstream connection when the browser closes the EventSource,
+ // so we don't leak open SSE connections to the API.
+ signal: request.signal,
+ });
+ } catch {
+ return Response.json(
+ { error: "Unable to reach the response stream." },
+ { status: 502 },
+ );
+ }
+
+ if (!upstream.ok || !upstream.body) {
+ return Response.json(
+ { error: "Unable to open the response stream." },
+ { status: upstream.status || 502 },
+ );
+ }
+
+ // Pipe the upstream SSE body straight through, disabling any buffering so
+ // tokens flush to the client as they arrive.
+ return new Response(upstream.body, {
+ status: 200,
+ headers: {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache, no-transform",
+ Connection: "keep-alive",
+ "X-Accel-Buffering": "no",
+ },
+ });
+}
diff --git a/ui/app/providers.tsx b/ui/app/providers.tsx
index 41157df06c..6dc47cf42d 100644
--- a/ui/app/providers.tsx
+++ b/ui/app/providers.tsx
@@ -1,25 +1,19 @@
"use client";
-import { HeroUIProvider } from "@heroui/system";
-import { useRouter } from "next/navigation";
import { SessionProvider } from "next-auth/react";
import { ThemeProvider as NextThemesProvider } from "next-themes";
import { ThemeProviderProps } from "next-themes/dist/types";
-import * as React from "react";
+import { ReactNode } from "react";
export interface ProvidersProps {
- children: React.ReactNode;
+ children: ReactNode;
themeProps?: ThemeProviderProps;
}
export function Providers({ children, themeProps }: ProvidersProps) {
- const router = useRouter();
-
return (
<SessionProvider>
- <HeroUIProvider navigate={router.push}>
- <NextThemesProvider {...themeProps}>{children}</NextThemesProvider>
- </HeroUIProvider>
+ <NextThemesProvider {...themeProps}>{children}</NextThemesProvider>
</SessionProvider>
);
}
diff --git a/tests/providers/alibabacloud/services/rds/rds_instance_tde_enabled/__init__.py b/ui/changelog.d/.gitkeep
similarity index 100%
rename from tests/providers/alibabacloud/services/rds/rds_instance_tde_enabled/__init__.py
rename to ui/changelog.d/.gitkeep
diff --git a/ui/changelog.d/README.md b/ui/changelog.d/README.md
new file mode 100644
index 0000000000..0853174f30
--- /dev/null
+++ b/ui/changelog.d/README.md
@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.
diff --git a/ui/changelog.d/enterprise-billing-navigation.fixed.md b/ui/changelog.d/enterprise-billing-navigation.fixed.md
new file mode 100644
index 0000000000..0ea2b4d31e
--- /dev/null
+++ b/ui/changelog.d/enterprise-billing-navigation.fixed.md
@@ -0,0 +1 @@
+Billing navigation is hidden when Cloud billing is disabled, including Enterprise deployments
diff --git a/ui/changelog.d/oci-regionless-provider-e2e.fixed.md b/ui/changelog.d/oci-regionless-provider-e2e.fixed.md
new file mode 100644
index 0000000000..2e413a6fa8
--- /dev/null
+++ b/ui/changelog.d/oci-regionless-provider-e2e.fixed.md
@@ -0,0 +1 @@
+OCI provider E2E tests no longer require or submit a region when adding or updating credentials
diff --git a/ui/components/ThemeSwitch.test.tsx b/ui/components/ThemeSwitch.test.tsx
new file mode 100644
index 0000000000..5d0ffde75b
--- /dev/null
+++ b/ui/components/ThemeSwitch.test.tsx
@@ -0,0 +1,52 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { ThemeSwitch } from "./ThemeSwitch";
+
+const { setThemeMock, themeState } = vi.hoisted(() => ({
+ setThemeMock: vi.fn(),
+ themeState: { current: "light" },
+}));
+
+vi.mock("next-themes", () => ({
+ useTheme: () => ({ theme: themeState.current, setTheme: setThemeMock }),
+}));
+
+describe("ThemeSwitch", () => {
+ beforeEach(() => {
+ setThemeMock.mockClear();
+ themeState.current = "light";
+ });
+
+ it("exposes an accessible switch reflecting the current mode", () => {
+ // Given / When
+ render(<ThemeSwitch />);
+
+ // Then
+ const control = screen.getByRole("switch", {
+ name: "Switch to dark mode",
+ });
+ expect(control).toHaveAttribute("aria-checked", "true");
+ });
+
+ it("toggles to the opposite theme on click", () => {
+ // Given
+ render(<ThemeSwitch />);
+
+ // When
+ fireEvent.click(screen.getByRole("switch"));
+
+ // Then
+ expect(setThemeMock).toHaveBeenCalledWith("dark");
+ });
+
+ it("renders as a shared ghost icon button, matching the navbar cluster", () => {
+ // Given / When
+ render(<ThemeSwitch />);
+
+ // Then: same 32px square treatment as the other navbar actions
+ const control = screen.getByRole("switch");
+ expect(control).toHaveClass("size-8");
+ expect(control).not.toHaveClass("rounded-full");
+ });
+});
diff --git a/ui/components/ThemeSwitch.tsx b/ui/components/ThemeSwitch.tsx
index f9c039db93..8de15b3531 100644
--- a/ui/components/ThemeSwitch.tsx
+++ b/ui/components/ThemeSwitch.tsx
@@ -1,14 +1,9 @@
"use client";
-import type { SwitchProps } from "@heroui/switch";
-import { useSwitch } from "@heroui/switch";
-import { useIsSSR } from "@react-aria/ssr";
-import { VisuallyHidden } from "@react-aria/visually-hidden";
-import clsx from "clsx";
import { useTheme } from "next-themes";
-import { FC } from "react";
-import React from "react";
+import { ComponentProps, useSyncExternalStore } from "react";
+import { Button } from "@/components/shadcn/button/button";
import {
Tooltip,
TooltipContent,
@@ -17,80 +12,45 @@ import {
import { MoonFilledIcon, SunFilledIcon } from "./icons";
-export interface ThemeSwitchProps {
- className?: string;
- classNames?: SwitchProps["classNames"];
-}
+export type ThemeSwitchProps = ComponentProps<"button">;
-export const ThemeSwitch: FC<ThemeSwitchProps> = ({
- className,
- classNames,
-}) => {
+const emptySubscribe = () => () => {};
+
+export function ThemeSwitch({ className, ...props }: ThemeSwitchProps) {
const { theme, setTheme } = useTheme();
- const isSSR = useIsSSR();
+ // Hydration-safe mounted check: false on the server, true after hydration
+ const isHydrated = useSyncExternalStore(
+ emptySubscribe,
+ () => true,
+ () => false,
+ );
- const onChange = () => {
- theme === "light" ? setTheme("dark") : setTheme("light");
- };
-
- const {
- Component,
- slots,
- isSelected,
- getBaseProps,
- getInputProps,
- getWrapperProps,
- } = useSwitch({
- isSelected: theme === "light" || isSSR,
- "aria-label": `Switch to ${theme === "light" || isSSR ? "dark" : "light"} mode`,
- onChange,
- });
+ const isLightMode = theme === "light" || !isHydrated;
return (
<Tooltip>
<TooltipTrigger asChild>
- <Component
- {...getBaseProps({
- className: clsx(
- "px-px transition-opacity hover:opacity-80 cursor-pointer",
- className,
- classNames?.base,
- ),
- })}
+ <Button
+ type="button"
+ {...props}
+ variant="ghost"
+ size="icon-sm"
+ role="switch"
+ aria-checked={isLightMode}
+ aria-label={`Switch to ${isLightMode ? "dark" : "light"} mode`}
+ onClick={() => setTheme(isLightMode ? "dark" : "light")}
+ className={className}
>
- <VisuallyHidden>
- <input {...getInputProps()} />
- </VisuallyHidden>
- <div
- {...getWrapperProps()}
- className={slots.wrapper({
- class: clsx(
- [
- "h-auto w-auto",
- "bg-transparent",
- "rounded-lg",
- "flex items-center justify-center",
- "group-data-[selected=true]:bg-transparent",
- "!text-default-500",
- "pt-px",
- "px-0",
- "mx-0",
- ],
- classNames?.wrapper,
- ),
- })}
- >
- {!isSelected || isSSR ? (
- <SunFilledIcon size={22} />
- ) : (
- <MoonFilledIcon size={22} />
- )}
- </div>
- </Component>
+ {isLightMode && isHydrated ? (
+ <MoonFilledIcon className="size-5" />
+ ) : (
+ <SunFilledIcon className="size-5" />
+ )}
+ </Button>
</TooltipTrigger>
<TooltipContent>
- {isSelected || isSSR ? "Switch to Dark Mode" : "Switch to Light Mode"}
+ {isLightMode ? "Switch to Dark Mode" : "Switch to Light Mode"}
</TooltipContent>
</Tooltip>
);
-};
+}
diff --git a/ui/components/auth/oss/auth-brand.tsx b/ui/components/auth/oss/auth-brand.tsx
new file mode 100644
index 0000000000..396064c52b
--- /dev/null
+++ b/ui/components/auth/oss/auth-brand.tsx
@@ -0,0 +1,14 @@
+import { ProwlerBrand } from "@/components/icons";
+import { cn } from "@/lib/utils";
+
+interface AuthBrandProps {
+ className?: string;
+}
+
+export const AuthBrand = ({ className }: AuthBrandProps) => {
+ return (
+ <div className={cn("relative z-10 w-[200px]", className)}>
+ <ProwlerBrand className="w-full" />
+ </div>
+ );
+};
diff --git a/ui/components/auth/oss/auth-divider.tsx b/ui/components/auth/oss/auth-divider.tsx
index 2951a1a01c..edf4a1c736 100644
--- a/ui/components/auth/oss/auth-divider.tsx
+++ b/ui/components/auth/oss/auth-divider.tsx
@@ -1,11 +1,11 @@
-import { Divider } from "@heroui/divider";
+import { Separator } from "@/components/shadcn";
export const AuthDivider = () => {
return (
- <div className="flex items-center gap-4 py-2">
- <Divider className="flex-1" />
- <p className="text-tiny text-default-500 shrink-0">OR</p>
- <Divider className="flex-1" />
+ <div className="flex items-center gap-3">
+ <Separator className="flex-1" />
+ <p className="text-text-neutral-tertiary shrink-0 text-xs">or</p>
+ <Separator className="flex-1" />
</div>
);
};
diff --git a/ui/components/auth/oss/auth-footer-link.tsx b/ui/components/auth/oss/auth-footer-link.tsx
index 221a48a400..91c6a89c95 100644
--- a/ui/components/auth/oss/auth-footer-link.tsx
+++ b/ui/components/auth/oss/auth-footer-link.tsx
@@ -1,4 +1,4 @@
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
interface AuthFooterLinkProps {
text: string;
@@ -12,7 +12,7 @@ export const AuthFooterLink = ({
href,
}: AuthFooterLinkProps) => {
return (
- <p className="text-small text-center">
+ <p className="text-center text-sm">
{text}
<CustomLink size="md" href={href} target="_self">
{linkText}
diff --git a/ui/components/auth/oss/auth-form.tsx b/ui/components/auth/oss/auth-form.tsx
index 595aea4e18..a9f3e003d3 100644
--- a/ui/components/auth/oss/auth-form.tsx
+++ b/ui/components/auth/oss/auth-form.tsx
@@ -4,6 +4,7 @@ import { SignUpForm } from "@/components/auth/oss/sign-up-form";
export const AuthForm = ({
type,
invitationToken,
+ isCloudEnv,
googleAuthUrl,
githubAuthUrl,
isGoogleOAuthEnabled,
@@ -11,6 +12,7 @@ export const AuthForm = ({
}: {
type: string;
invitationToken?: string | null;
+ isCloudEnv?: boolean;
googleAuthUrl?: string;
githubAuthUrl?: string;
isGoogleOAuthEnabled?: boolean;
@@ -30,6 +32,7 @@ export const AuthForm = ({
return (
<SignUpForm
invitationToken={invitationToken}
+ isCloudEnv={isCloudEnv}
googleAuthUrl={googleAuthUrl}
githubAuthUrl={githubAuthUrl}
isGoogleOAuthEnabled={isGoogleOAuthEnabled}
diff --git a/ui/components/auth/oss/auth-layout.test.tsx b/ui/components/auth/oss/auth-layout.test.tsx
new file mode 100644
index 0000000000..dd144243da
--- /dev/null
+++ b/ui/components/auth/oss/auth-layout.test.tsx
@@ -0,0 +1,39 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { AuthLayout } from "./auth-layout";
+
+describe("AuthLayout", () => {
+ it("renders the Prowler brand directly above the form card", () => {
+ render(
+ <AuthLayout title="Sign in">
+ <p>form content</p>
+ </AuthLayout>,
+ );
+
+ const brand = screen.getByRole("img", { name: /prowler/i });
+ const title = screen.getByText("Sign in");
+
+ expect(
+ brand.compareDocumentPosition(title) & Node.DOCUMENT_POSITION_FOLLOWING,
+ ).toBeTruthy();
+ });
+
+ it("renders the footer outside the form card, below it", () => {
+ render(
+ <AuthLayout title="Sign in" footer={<p>footer link</p>}>
+ <p>form content</p>
+ </AuthLayout>,
+ );
+
+ const content = screen.getByText("form content");
+ const footer = screen.getByText("footer link");
+ const card = content.parentElement!;
+
+ expect(card.contains(footer)).toBe(false);
+ expect(
+ content.compareDocumentPosition(footer) &
+ Node.DOCUMENT_POSITION_FOLLOWING,
+ ).toBeTruthy();
+ });
+});
diff --git a/ui/components/auth/oss/auth-layout.tsx b/ui/components/auth/oss/auth-layout.tsx
index 84d47c218c..8c122aa661 100644
--- a/ui/components/auth/oss/auth-layout.tsx
+++ b/ui/components/auth/oss/auth-layout.tsx
@@ -1,14 +1,16 @@
import { ReactNode } from "react";
-import { ProwlerExtended } from "@/components/icons";
import { ThemeSwitch } from "@/components/ThemeSwitch";
+import { AuthBrand } from "./auth-brand";
+
interface AuthLayoutProps {
title: string;
+ footer?: ReactNode;
children: ReactNode;
}
-export const AuthLayout = ({ title, children }: AuthLayoutProps) => {
+export const AuthLayout = ({ title, footer, children }: AuthLayoutProps) => {
return (
<div className="relative flex min-h-screen w-full overflow-x-hidden overflow-y-auto">
<div className="relative flex w-full flex-col items-center justify-center px-4 py-32">
@@ -21,13 +23,10 @@ export const AuthLayout = ({ title, children }: AuthLayoutProps) => {
}}
></div>
- {/* Prowler Logo */}
- <div className="relative z-10 mb-8 flex w-full max-w-[300px]">
- <ProwlerExtended width={300} className="h-auto w-full" />
- </div>
+ <AuthBrand className="mb-8" />
{/* Auth Form Container */}
- <div className="rounded-large border-divider shadow-small dark:bg-background/85 relative z-10 flex w-full max-w-sm flex-col gap-4 border bg-white/90 px-8 py-10 md:max-w-md">
+ <div className="border-border-neutral-secondary dark:bg-bg-neutral-primary/85 relative z-10 flex w-full max-w-sm flex-col gap-4 rounded-[14px] border bg-white/90 px-8 py-10 shadow-sm md:max-w-md">
{/* Header with Title and Theme Toggle */}
<div className="flex items-center justify-between">
<p className="pb-2 text-xl font-medium">{title}</p>
@@ -37,6 +36,8 @@ export const AuthLayout = ({ title, children }: AuthLayoutProps) => {
{/* Content */}
{children}
</div>
+
+ {footer && <div className="relative z-10 mt-6">{footer}</div>}
</div>
</div>
);
diff --git a/ui/components/auth/oss/sign-in-form.tsx b/ui/components/auth/oss/sign-in-form.tsx
index 89650f56c4..8ebd8f3c0e 100644
--- a/ui/components/auth/oss/sign-in-form.tsx
+++ b/ui/components/auth/oss/sign-in-form.tsx
@@ -12,10 +12,17 @@ import { AuthDivider } from "@/components/auth/oss/auth-divider";
import { AuthFooterLink } from "@/components/auth/oss/auth-footer-link";
import { AuthLayout } from "@/components/auth/oss/auth-layout";
import { SocialButtons } from "@/components/auth/oss/social-buttons";
-import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form } from "@/components/ui/form";
+import {
+ Button,
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form } from "@/components/shadcn/form";
+import { getSafeCallbackPath } from "@/lib/auth-callback-url";
+import { stripPasswordManagerHighlight } from "@/lib/password-manager";
import { SignInFormData, signInSchema } from "@/types";
export const SignInForm = ({
@@ -32,7 +39,7 @@ export const SignInForm = ({
const router = useRouter();
const searchParams = useSearchParams();
const { toast } = useToast();
- const callbackUrl = searchParams.get("callbackUrl") || "/";
+ const callbackUrl = getSafeCallbackPath(searchParams, "callbackUrl");
useEffect(() => {
const samlError = searchParams.get("sso_saml_failed");
@@ -102,7 +109,7 @@ export const SignInForm = ({
form.setValue("password", "");
}
- const result = await initiateSamlAuth(email);
+ const result = await initiateSamlAuth(email, callbackUrl);
if (result.success && result.redirectUrl) {
window.location.href = result.redirectUrl;
@@ -140,12 +147,22 @@ export const SignInForm = ({
}
};
- const title = isSamlMode ? "Sign in with SAML SSO" : "Sign in";
+ const title = isSamlMode ? "Sign in with SAML SSO" : "Welcome back";
return (
- <AuthLayout title={title}>
+ <AuthLayout
+ title={title}
+ footer={
+ <AuthFooterLink
+ text="Need to create an account?"
+ linkText="Sign up"
+ href="/sign-up"
+ />
+ }
+ >
<Form {...form}>
<form
+ ref={stripPasswordManagerHighlight}
noValidate
method="post"
className="flex flex-col gap-4"
@@ -176,38 +193,48 @@ export const SignInForm = ({
<AuthDivider />
- <div className="flex flex-col gap-2">
+ <div className="flex gap-2">
{!isSamlMode && (
<SocialButtons
googleAuthUrl={googleAuthUrl}
githubAuthUrl={githubAuthUrl}
+ callbackUrl={callbackUrl}
isGoogleOAuthEnabled={isGoogleOAuthEnabled}
isGithubOAuthEnabled={isGithubOAuthEnabled}
/>
)}
- <Button
- variant="outline"
- className="w-full gap-2"
- onClick={() => {
- form.setValue("isSamlMode", !isSamlMode);
- }}
- >
- {!isSamlMode && (
- <Icon
- className="text-default-500"
- icon="mdi:shield-key"
- width={24}
- />
- )}
- {isSamlMode ? "Back" : "Continue with SAML SSO"}
- </Button>
+ {isSamlMode ? (
+ <Button
+ variant="outline"
+ className="flex-1"
+ onClick={() => {
+ form.setValue("isSamlMode", false);
+ }}
+ >
+ Back
+ </Button>
+ ) : (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <Button
+ variant="outline"
+ aria-label="Continue with SAML SSO"
+ className="flex-1"
+ onClick={() => {
+ form.setValue("isSamlMode", true);
+ }}
+ >
+ <Icon
+ className="text-text-neutral-tertiary"
+ icon="mdi:shield-key"
+ width={24}
+ />
+ </Button>
+ </TooltipTrigger>
+ <TooltipContent side="top">Continue with SAML SSO</TooltipContent>
+ </Tooltip>
+ )}
</div>
-
- <AuthFooterLink
- text="Need to create an account?"
- linkText="Sign up"
- href="/sign-up"
- />
</AuthLayout>
);
};
diff --git a/ui/components/auth/oss/sign-up-form.tsx b/ui/components/auth/oss/sign-up-form.tsx
index e18ded5845..2127151b73 100644
--- a/ui/components/auth/oss/sign-up-form.tsx
+++ b/ui/components/auth/oss/sign-up-form.tsx
@@ -1,6 +1,5 @@
"use client";
-import { Checkbox } from "@heroui/checkbox";
import { zodResolver } from "@hookform/resolvers/zod";
import { useRouter } from "next/navigation";
import { useForm, useWatch } from "react-hook-form";
@@ -16,16 +15,17 @@ import { AuthFooterLink } from "@/components/auth/oss/auth-footer-link";
import { AuthLayout } from "@/components/auth/oss/auth-layout";
import { PasswordRequirementsMessage } from "@/components/auth/oss/password-validator";
import { SocialButtons } from "@/components/auth/oss/social-buttons";
-import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { Button, Checkbox } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import {
Form,
FormControl,
FormField,
FormMessage,
-} from "@/components/ui/form";
+} from "@/components/shadcn/form";
+import { stripPasswordManagerHighlight } from "@/lib/password-manager";
import { ApiError, SignUpFormData, signUpSchema } from "@/types";
const AUTH_ERROR_PATHS = {
@@ -41,12 +41,14 @@ const FORM_ERROR_TYPE = {
export const SignUpForm = ({
invitationToken,
+ isCloudEnv,
googleAuthUrl,
githubAuthUrl,
isGoogleOAuthEnabled,
isGithubOAuthEnabled,
}: {
invitationToken?: string | null;
+ isCloudEnv?: boolean;
googleAuthUrl?: string;
githubAuthUrl?: string;
isGoogleOAuthEnabled?: boolean;
@@ -54,6 +56,9 @@ export const SignUpForm = ({
}) => {
const router = useRouter();
const { toast } = useToast();
+ const callbackUrl = invitationToken
+ ? `/invitation/accept?invitation_token=${encodeURIComponent(invitationToken)}`
+ : "/";
const form = useForm<SignUpFormData>({
resolver: zodResolver(signUpSchema),
@@ -75,8 +80,14 @@ export const SignUpForm = ({
name: "password",
defaultValue: "",
});
+ const termsAccepted = useWatch({
+ control: form.control,
+ name: "termsAndConditions",
+ defaultValue: false,
+ });
const isLoading = form.formState.isSubmitting;
+ const isSocialAuthDisabled = Boolean(isCloudEnv && !termsAccepted);
const onSubmit = async (data: SignUpFormData) => {
const newUser = await createNewUser(data);
@@ -88,7 +99,7 @@ export const SignUpForm = ({
});
form.reset();
- if (process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true") {
+ if (isCloudEnv) {
router.push("/email-verification");
} else {
router.push("/sign-in");
@@ -150,9 +161,19 @@ export const SignUpForm = ({
};
return (
- <AuthLayout title="Sign up">
+ <AuthLayout
+ title="Get started"
+ footer={
+ <AuthFooterLink
+ text="Already have an account?"
+ linkText="Log in"
+ href="/sign-in"
+ />
+ }
+ >
<Form {...form}>
<form
+ ref={stripPasswordManagerHighlight}
noValidate
method="post"
className="flex flex-col gap-4"
@@ -200,20 +221,24 @@ export const SignUpForm = ({
/>
)}
- {process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true" && (
+ {isCloudEnv && (
<FormField
control={form.control}
name="termsAndConditions"
render={({ field }) => (
<>
- <FormControl>
- <Checkbox
- isRequired
- className="py-4"
- size="sm"
- checked={field.value}
- onChange={(e) => field.onChange(e.target.checked)}
- color="default"
+ <div className="flex items-center gap-2 py-4">
+ <FormControl>
+ <Checkbox
+ id="termsAndConditions"
+ size="sm"
+ checked={field.value}
+ onCheckedChange={field.onChange}
+ />
+ </FormControl>
+ <label
+ htmlFor="termsAndConditions"
+ className="cursor-pointer text-sm"
>
I agree with the
<CustomLink
@@ -223,8 +248,9 @@ export const SignUpForm = ({
Terms of Service
</CustomLink>
of Prowler
- </Checkbox>
- </FormControl>
+ <span className="text-text-error-primary">*</span>
+ </label>
+ </div>
<FormMessage className="text-text-error" />
</>
)}
@@ -243,25 +269,22 @@ export const SignUpForm = ({
</form>
</Form>
- {!invitationToken && (
+ {(!invitationToken || isCloudEnv) && (
<>
<AuthDivider />
- <div className="flex flex-col gap-2">
+ <div className="flex gap-2">
<SocialButtons
googleAuthUrl={googleAuthUrl}
githubAuthUrl={githubAuthUrl}
+ callbackUrl={callbackUrl}
isGoogleOAuthEnabled={isGoogleOAuthEnabled}
isGithubOAuthEnabled={isGithubOAuthEnabled}
+ isDisabled={isSocialAuthDisabled}
+ disabledTooltipContent="Accept the Terms of Service to continue."
/>
</div>
</>
)}
-
- <AuthFooterLink
- text="Already have an account?"
- linkText="Log in"
- href="/sign-in"
- />
</AuthLayout>
);
};
diff --git a/ui/components/auth/oss/social-buttons.test.tsx b/ui/components/auth/oss/social-buttons.test.tsx
new file mode 100644
index 0000000000..7a406f4643
--- /dev/null
+++ b/ui/components/auth/oss/social-buttons.test.tsx
@@ -0,0 +1,41 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { SocialButtons } from "./social-buttons";
+
+// Stub Iconify: the real <Icon> fetches icon data over the network and its
+// retry timers can fire after the jsdom environment is torn down, crashing the
+// worker with "window is not defined".
+vi.mock("@iconify/react", () => ({
+ Icon: ({ icon }: { icon: string }) => <span aria-label={icon} />,
+}));
+
+describe("SocialButtons", () => {
+ it("renders icon-only provider links that keep their accessible names", () => {
+ render(
+ <SocialButtons
+ googleAuthUrl="https://accounts.google.com/auth"
+ githubAuthUrl="https://github.com/login/oauth"
+ isGoogleOAuthEnabled
+ isGithubOAuthEnabled
+ />,
+ );
+
+ const google = screen.getByRole("link", { name: "Continue with Google" });
+ const github = screen.getByRole("link", { name: "Continue with Github" });
+
+ expect(google.textContent).toBe("");
+ expect(github.textContent).toBe("");
+ });
+
+ it("keeps accessible names on disabled providers", () => {
+ render(<SocialButtons />);
+
+ expect(
+ screen.getByRole("button", { name: "Continue with Google" }),
+ ).toBeDisabled();
+ expect(
+ screen.getByRole("button", { name: "Continue with Github" }),
+ ).toBeDisabled();
+ });
+});
diff --git a/ui/components/auth/oss/social-buttons.tsx b/ui/components/auth/oss/social-buttons.tsx
index 0dd92c48c0..fd52d0cfb7 100644
--- a/ui/components/auth/oss/social-buttons.tsx
+++ b/ui/components/auth/oss/social-buttons.tsx
@@ -1,83 +1,157 @@
-import { Tooltip } from "@heroui/tooltip";
import { Icon } from "@iconify/react";
+import type { ReactNode } from "react";
-import { Button } from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import {
+ Button,
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { appendCallbackState } from "@/lib/auth-callback-url";
+
+type SocialProvider = {
+ key: string;
+ label: string;
+ url?: string;
+ isOAuthEnabled?: boolean;
+ enabledIcon: string;
+ disabledIcon: string;
+ disabledDocs: {
+ message: string;
+ href: string;
+ };
+};
+
+const SocialButton = ({
+ provider,
+ isDisabled,
+ disabledTooltipContent,
+}: {
+ provider: SocialProvider;
+ isDisabled: boolean;
+ disabledTooltipContent: ReactNode;
+}) => {
+ const button = (
+ <Button
+ variant="outline"
+ aria-label={provider.label}
+ className={isDisabled ? "w-full" : "flex-1"}
+ asChild={!isDisabled}
+ disabled={isDisabled}
+ >
+ {isDisabled ? (
+ <span className="flex items-center justify-center">
+ <Icon
+ icon={
+ provider.isOAuthEnabled
+ ? provider.enabledIcon
+ : provider.disabledIcon
+ }
+ width={24}
+ />
+ </span>
+ ) : (
+ <a href={provider.url} className="flex items-center justify-center">
+ <Icon icon={provider.enabledIcon} width={24} />
+ </a>
+ )}
+ </Button>
+ );
+
+ if (!isDisabled) {
+ return (
+ <Tooltip>
+ <TooltipTrigger asChild>{button}</TooltipTrigger>
+ <TooltipContent side="top">{provider.label}</TooltipContent>
+ </Tooltip>
+ );
+ }
+
+ return (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span className="flex flex-1">{button}</span>
+ </TooltipTrigger>
+ <TooltipContent side="top" className="w-96">
+ {provider.isOAuthEnabled ? (
+ disabledTooltipContent
+ ) : (
+ <div className="flex-inline text-sm">
+ {provider.disabledDocs.message}{" "}
+ <CustomLink href={provider.disabledDocs.href}>
+ Read the docs
+ </CustomLink>
+ </div>
+ )}
+ </TooltipContent>
+ </Tooltip>
+ );
+};
export const SocialButtons = ({
googleAuthUrl,
githubAuthUrl,
+ callbackUrl = "/",
isGoogleOAuthEnabled,
isGithubOAuthEnabled,
+ isDisabled = false,
+ disabledTooltipContent,
}: {
googleAuthUrl?: string;
githubAuthUrl?: string;
+ callbackUrl?: string;
isGoogleOAuthEnabled?: boolean;
isGithubOAuthEnabled?: boolean;
-}) => (
- <>
- <Tooltip
- content={
- <div className="flex-inline text-small">
- Social Login with Google is not enabled.{" "}
- <CustomLink href="https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-social-login/#google-oauth-configuration">
- Read the docs
- </CustomLink>
- </div>
- }
- placement="top"
- shadow="sm"
- isDisabled={isGoogleOAuthEnabled}
- className="w-96"
- >
- <span>
- <Button
- variant="outline"
- className="w-full"
- asChild={isGoogleOAuthEnabled}
- disabled={!isGoogleOAuthEnabled}
- >
- <a href={googleAuthUrl} className="flex items-center gap-2">
- <Icon
- icon={
- isGoogleOAuthEnabled
- ? "flat-color-icons:google"
- : "simple-icons:google"
- }
- width={24}
- />
- Continue with Google
- </a>
- </Button>
- </span>
- </Tooltip>
- <Tooltip
- content={
- <div className="flex-inline text-small">
- Social Login with Github is not enabled.{" "}
- <CustomLink href="https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-social-login/#github-oauth-configuration">
- Read the docs
- </CustomLink>
- </div>
- }
- placement="top"
- shadow="sm"
- isDisabled={isGithubOAuthEnabled}
- className="w-96"
- >
- <span>
- <Button
- variant="outline"
- className="w-full"
- asChild={isGithubOAuthEnabled}
- disabled={!isGithubOAuthEnabled}
- >
- <a href={githubAuthUrl} className="flex items-center gap-2">
- <Icon icon="simple-icons:github" width={24} />
- Continue with Github
- </a>
- </Button>
- </span>
- </Tooltip>
- </>
-);
+ isDisabled?: boolean;
+ disabledTooltipContent?: ReactNode;
+}) => {
+ const googleUrl = googleAuthUrl
+ ? appendCallbackState(googleAuthUrl, callbackUrl)
+ : undefined;
+ const githubUrl = githubAuthUrl
+ ? appendCallbackState(githubAuthUrl, callbackUrl)
+ : undefined;
+ const socialDisabledTooltip =
+ disabledTooltipContent || "Social login is currently unavailable.";
+
+ const providers: SocialProvider[] = [
+ {
+ key: "google",
+ label: "Continue with Google",
+ url: googleUrl,
+ isOAuthEnabled: isGoogleOAuthEnabled,
+ enabledIcon: "flat-color-icons:google",
+ disabledIcon: "simple-icons:google",
+ disabledDocs: {
+ message: "Social Login with Google is not enabled.",
+ href: "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-social-login/#google-oauth-configuration",
+ },
+ },
+ {
+ key: "github",
+ label: "Continue with Github",
+ url: githubUrl,
+ isOAuthEnabled: isGithubOAuthEnabled,
+ enabledIcon: "simple-icons:github",
+ disabledIcon: "simple-icons:github",
+ disabledDocs: {
+ message: "Social Login with Github is not enabled.",
+ href: "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-social-login/#github-oauth-configuration",
+ },
+ },
+ ];
+
+ return (
+ <>
+ {providers.map((provider) => (
+ <SocialButton
+ key={provider.key}
+ provider={provider}
+ isDisabled={isDisabled || !provider.isOAuthEnabled || !provider.url}
+ disabledTooltipContent={socialDisabledTooltip}
+ />
+ ))}
+ </>
+ );
+};
diff --git a/ui/components/compliance/compliance-accordion/checks-with-providers.tsx b/ui/components/compliance/compliance-accordion/checks-with-providers.tsx
new file mode 100644
index 0000000000..5746805f12
--- /dev/null
+++ b/ui/components/compliance/compliance-accordion/checks-with-providers.tsx
@@ -0,0 +1,36 @@
+"use client";
+
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
+import type { CheckProviderTypesMap } from "@/types/compliance";
+
+interface ChecksWithProvidersProps {
+ checks: string[];
+ checkProviders: CheckProviderTypesMap;
+}
+
+/**
+ * Provider-labeled check list for the cross-provider requirement view: each
+ * check id followed by the icons of the provider types it belongs to. Checks
+ * missing from the map render without icons.
+ */
+export const ChecksWithProviders = ({
+ checks,
+ checkProviders,
+}: ChecksWithProvidersProps) => (
+ <ul className="flex flex-wrap gap-x-4 gap-y-1">
+ {checks.map((checkId) => (
+ <li
+ key={checkId}
+ data-testid={`check-with-providers-${checkId}`}
+ className="flex items-center gap-1.5"
+ >
+ <span className="text-gray-600 dark:text-gray-200">{checkId}</span>
+ <span className="flex items-center gap-1">
+ {(checkProviders[checkId] ?? []).map((type) => (
+ <ProviderTypeIcon key={type} type={type} size={14} />
+ ))}
+ </span>
+ </li>
+ ))}
+ </ul>
+);
diff --git a/ui/components/compliance/compliance-accordion/client-accordion-content.test.ts b/ui/components/compliance/compliance-accordion/client-accordion-content.test.ts
index 7f724e20b7..a036fc0aa8 100644
--- a/ui/components/compliance/compliance-accordion/client-accordion-content.test.ts
+++ b/ui/components/compliance/compliance-accordion/client-accordion-content.test.ts
@@ -13,4 +13,30 @@ describe("client accordion content", () => {
expect(source).toContain("getStandaloneFindingColumns");
expect(source).not.toContain("getColumnFindings");
});
+
+ it("wires triage update and note loading actions into compliance findings", () => {
+ expect(source).toContain("updateFindingTriage");
+ expect(source).toContain("loadLatestFindingTriageNote");
+ expect(source).toContain("onTriageUpdateAction");
+ expect(source).toContain("onTriageNoteLoadAction");
+ });
+
+ it("refetches findings after mutelist-shortcut triage updates like the resource drawer", () => {
+ expect(source).toContain("shouldRefreshAfterTriageUpdate");
+ expect(source).toContain("reload()");
+ });
+
+ it("delegates data fetching to the hook instead of effect/ref choreography", () => {
+ expect(source).toContain("useRequirementFindings");
+ expect(source).not.toContain("useEffect");
+ expect(source).not.toContain("useRef");
+ });
+
+ it("gates the skeleton on the hook loading state and surfaces fetch errors", () => {
+ // A disabled fetch (e.g. "No findings" status) must not skeleton forever,
+ // and a failed fetch must offer a retry instead of hanging.
+ expect(source).toContain("isLoading && requirement.status");
+ expect(source).not.toContain("findings === null");
+ expect(source).toContain("Try again");
+ });
});
diff --git a/ui/components/compliance/compliance-accordion/client-accordion-content.tsx b/ui/components/compliance/compliance-accordion/client-accordion-content.tsx
index 4a0ba6b198..26e6e00585 100644
--- a/ui/components/compliance/compliance-accordion/client-accordion-content.tsx
+++ b/ui/components/compliance/compliance-accordion/client-accordion-content.tsx
@@ -1,127 +1,97 @@
"use client";
+import { AlertTriangle } from "lucide-react";
import { useSearchParams } from "next/navigation";
-import { useEffect, useRef, useState } from "react";
-import { getFindings } from "@/actions/findings/findings";
+import {
+ loadLatestFindingTriageNote,
+ updateFindingTriage,
+} from "@/actions/findings";
import {
getStandaloneFindingColumns,
SkeletonTableFindings,
} from "@/components/findings/table";
-import { Accordion } from "@/components/ui/accordion/Accordion";
-import { DataTable } from "@/components/ui/table";
-import { createDict, FINDINGS_DEFAULT_SORT, MUTED_FILTER } from "@/lib";
+import { Alert, AlertDescription, Button } from "@/components/shadcn";
+import { Accordion } from "@/components/shadcn/accordion/Accordion";
+import { DataTable } from "@/components/shadcn/table";
+import { FINDINGS_DEFAULT_SORT, MUTED_FILTER } from "@/lib";
+import { INVALID_CONFIG_NOTE } from "@/lib/compliance/commons";
import { getComplianceMapper } from "@/lib/compliance/compliance-mapper";
-import { Requirement } from "@/types/compliance";
-import { FindingProps, FindingsResponse } from "@/types/components";
+import { shouldRefreshAfterTriageUpdate } from "@/lib/finding-triage";
+import { CheckProviderTypesMap, Requirement } from "@/types/compliance";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
+
+import { ChecksWithProviders } from "./checks-with-providers";
+import { useRequirementFindings } from "./use-requirement-findings";
interface ClientAccordionContentProps {
requirement: Requirement;
- scanId: string;
+ /** Single scan (per-scan compliance view). Ignored when `scanIds` is set. */
+ scanId?: string;
+ /** All scans to query at once (cross-provider view). */
+ scanIds?: string[];
framework: string;
disableFindings?: boolean;
+ /** When set, the checks list labels each check with its provider icons. */
+ checkProviders?: CheckProviderTypesMap;
}
export const ClientAccordionContent = ({
requirement,
framework,
scanId,
+ scanIds,
disableFindings = false,
+ checkProviders,
}: ClientAccordionContentProps) => {
- const [findings, setFindings] = useState<FindingsResponse | null>(null);
- const [expandedFindings, setExpandedFindings] = useState<FindingProps[]>([]);
const searchParams = useSearchParams();
const pageNumber = searchParams.get("page") || "1";
const pageSize = searchParams.get("pageSize") || "10";
const complianceId = searchParams.get("complianceId");
const openFindingId = searchParams.get("id");
const sort = searchParams.get("sort") || FINDINGS_DEFAULT_SORT;
- const loadedPageRef = useRef<string | null>(null);
- const loadedPageSizeRef = useRef<string | null>(null);
- const loadedSortRef = useRef<string | null>(null);
- const loadedMutedRef = useRef<string | null>(null);
- const isExpandedRef = useRef(false);
const region = searchParams.get("filter[region__in]") || "";
// Respect the user's muted preference from the URL; default to EXCLUDE
// so the requirement view stays consistent with every other findings
// surface in the app (findings page, resource drawer, overview widgets).
const mutedFilter = searchParams.get("filter[muted]") || MUTED_FILTER.EXCLUDE;
- useEffect(() => {
- async function loadFindings() {
- if (
- !disableFindings &&
- requirement.check_ids?.length > 0 &&
- requirement.status !== "No findings" &&
- (loadedPageRef.current !== pageNumber ||
- loadedPageSizeRef.current !== pageSize ||
- loadedSortRef.current !== sort ||
- loadedMutedRef.current !== mutedFilter ||
- !isExpandedRef.current)
- ) {
- loadedPageRef.current = pageNumber;
- loadedPageSizeRef.current = pageSize;
- loadedSortRef.current = sort;
- loadedMutedRef.current = mutedFilter;
- isExpandedRef.current = true;
+ const checks = requirement.check_ids || [];
+ const resolvedScanIds = scanIds ?? (scanId ? [scanId] : []);
- try {
- const checkIds = requirement.check_ids;
- const encodedSort = sort.replace(/^\+/, "");
- const findingsData = await getFindings({
- filters: {
- "filter[check_id__in]": checkIds.join(","),
- "filter[scan]": scanId,
- "filter[muted]": mutedFilter,
- ...(region && { "filter[region__in]": region }),
- },
- page: parseInt(pageNumber, 10),
- pageSize: parseInt(pageSize, 10),
- sort: encodedSort,
- });
-
- setFindings(findingsData);
-
- if (findingsData?.data) {
- // Create dictionaries for resources, scans, and providers
- const resourceDict = createDict("resources", findingsData);
- const scanDict = createDict("scans", findingsData);
- const providerDict = createDict("providers", findingsData);
-
- // Expand each finding with its corresponding resource, scan, and provider
- const expandedData = findingsData.data.map(
- (finding: FindingProps) => {
- const scan = scanDict[finding.relationships?.scan?.data?.id];
- const resource =
- resourceDict[finding.relationships?.resources?.data?.[0]?.id];
- const provider =
- providerDict[scan?.relationships?.provider?.data?.id];
-
- return {
- ...finding,
- relationships: { scan, resource, provider },
- };
- },
- );
- setExpandedFindings(expandedData);
- }
- } catch (error) {
- console.error("Error loading findings:", error);
- }
- }
- }
-
- loadFindings();
- }, [
- requirement,
- scanId,
+ const {
+ findings,
+ expandedFindings,
+ isLoading,
+ error,
+ patchTriageUpdate,
+ reload,
+ } = useRequirementFindings({
+ enabled:
+ !disableFindings &&
+ checks.length > 0 &&
+ requirement.status !== "No findings",
+ checkIds: checks,
+ scanIds: resolvedScanIds,
pageNumber,
pageSize,
sort,
region,
mutedFilter,
- disableFindings,
- ]);
+ });
+
+ const handleTriageUpdate = async (input: UpdateFindingTriageInput) => {
+ await updateFindingTriage(input);
+
+ // Mutelist-shortcut statuses mute the finding server-side; refetch so the
+ // list honors the muted filter, matching the resource drawer behavior.
+ if (shouldRefreshAfterTriageUpdate(input)) {
+ reload();
+ return;
+ }
+
+ patchTriageUpdate(input);
+ };
const renderDetails = () => {
if (!complianceId) {
@@ -145,13 +115,19 @@ export const ClientAccordionContent = ({
);
}
- const checks = requirement.check_ids || [];
const checksList = (
<div className="flex items-center px-2 text-sm">
<div className="w-full flex-col">
<div className="mt-[-8px] mb-1 h-1 w-full border-b border-gray-200 dark:border-gray-800" />
<span className="text-gray-600 dark:text-gray-200" aria-label="Checks">
- {checks.join(", ")}
+ {checkProviders ? (
+ <ChecksWithProviders
+ checks={checks}
+ checkProviders={checkProviders}
+ />
+ ) : (
+ checks.join(", ")
+ )}
</span>
</div>
</div>
@@ -162,7 +138,7 @@ export const ClientAccordionContent = ({
key: "checks",
title: (
<div className="flex items-center gap-2">
- <span className="text-primary">{checks.length}</span>
+ <span className="text-button-primary">{checks.length}</span>
{checks.length > 1 ? <span>Checks</span> : <span>Check</span>}
</div>
),
@@ -171,7 +147,26 @@ export const ClientAccordionContent = ({
];
const renderFindingsTable = () => {
- if (findings === null && requirement.status !== "MANUAL") {
+ if (error) {
+ return (
+ <Alert variant="error" className="mt-3">
+ <AlertTriangle />
+ <AlertDescription className="flex flex-wrap items-center gap-2">
+ <span>{error}</span>
+ <Button
+ variant="link"
+ size="link-sm"
+ className="h-auto p-0"
+ onClick={reload}
+ >
+ Try again
+ </Button>
+ </AlertDescription>
+ </Alert>
+ );
+ }
+
+ if (isLoading && requirement.status !== "MANUAL") {
return <SkeletonTableFindings />;
}
@@ -181,8 +176,12 @@ export const ClientAccordionContent = ({
<h4 className="mb-2 text-sm font-medium">Findings</h4>
<DataTable
- columns={getStandaloneFindingColumns({ openFindingId })}
- data={expandedFindings || []}
+ columns={getStandaloneFindingColumns({
+ openFindingId,
+ onTriageUpdateAction: handleTriageUpdate,
+ onTriageNoteLoadAction: loadLatestFindingTriageNote,
+ })}
+ data={expandedFindings}
metadata={findings?.meta}
disableScroll={true}
/>
@@ -199,6 +198,13 @@ export const ClientAccordionContent = ({
return (
<div className="w-full">
+ {requirement.invalid_config && (
+ <Alert variant="warning" className="mb-3">
+ <AlertTriangle />
+ <AlertDescription>{INVALID_CONFIG_NOTE}</AlertDescription>
+ </Alert>
+ )}
+
{renderDetails()}
{checks.length > 0 && (
@@ -207,7 +213,7 @@ export const ClientAccordionContent = ({
items={accordionChecksItems}
variant="light"
defaultExpandedKeys={[""]}
- className="dark:bg-prowler-blue-400 rounded-lg bg-gray-50"
+ className="dark:bg-bg-neutral-secondary rounded-lg bg-gray-50"
/>
</div>
)}
diff --git a/ui/components/compliance/compliance-accordion/client-accordion-wrapper.tsx b/ui/components/compliance/compliance-accordion/client-accordion-wrapper.tsx
index 4682f039e5..e3ab821a55 100644
--- a/ui/components/compliance/compliance-accordion/client-accordion-wrapper.tsx
+++ b/ui/components/compliance/compliance-accordion/client-accordion-wrapper.tsx
@@ -3,7 +3,8 @@
import { useRef, useState } from "react";
import { Button } from "@/components/shadcn";
-import { Accordion, AccordionItemProps } from "@/components/ui";
+import { Accordion, AccordionItemProps } from "@/components/shadcn";
+import { Card } from "@/components/shadcn/card/card";
export const ClientAccordionWrapper = ({
items,
@@ -71,7 +72,7 @@ export const ClientAccordionWrapper = ({
lastScrolledKeyRef.current = scrollToKey;
// Two nested rAFs: the first lets the accordion children commit to
// the DOM, the second lands after the browser has run a layout pass
- // so HeroUI's framer-motion expand has settled enough for
+ // so the Collapsible CSS expand animation has settled enough for
// scrollIntoView to read a stable offset.
requestAnimationFrame(() => {
requestAnimationFrame(() => {
@@ -83,16 +84,17 @@ export const ClientAccordionWrapper = ({
});
};
+ // Same enclosing-card design as the app's tables: the expand toggle sits
+ // top-right inside the card and the accordion fills the rest.
return (
- <div ref={containerRef}>
+ <Card ref={containerRef} variant="base" className="w-full gap-2">
{!hideExpandButton && (
- <div className="text-text-neutral-tertiary hover:text-text-neutral-primary mt-[-16px] flex justify-end text-xs font-medium transition-colors">
+ <div className="text-text-neutral-tertiary hover:text-text-neutral-primary flex justify-end text-xs font-medium transition-colors">
<Button
onClick={handleToggleExpand}
aria-label={isExpanded ? "Collapse all" : "Expand all"}
variant="ghost"
size="sm"
- className="mb-1"
>
{isExpanded ? "Collapse all" : "Expand all"}
</Button>
@@ -105,6 +107,6 @@ export const ClientAccordionWrapper = ({
selectedKeys={selectedKeys}
onSelectionChange={handleSelectionChange}
/>
- </div>
+ </Card>
);
};
diff --git a/ui/components/compliance/compliance-accordion/compliance-accordion-requeriment-title.tsx b/ui/components/compliance/compliance-accordion/compliance-accordion-requeriment-title.tsx
index 0c408fb099..aeae6bc03c 100644
--- a/ui/components/compliance/compliance-accordion/compliance-accordion-requeriment-title.tsx
+++ b/ui/components/compliance/compliance-accordion/compliance-accordion-requeriment-title.tsx
@@ -1,25 +1,30 @@
-import { FindingStatus, StatusFindingBadge } from "@/components/ui/table";
+import { InfoTooltip } from "@/components/shadcn/info-field/info-field";
+import { FindingStatus, StatusFindingBadge } from "@/components/shadcn/table";
+import { INVALID_CONFIG_NOTE } from "@/lib/compliance/commons";
interface ComplianceAccordionRequirementTitleProps {
type: string;
name: string;
status: FindingStatus;
+ invalidConfig?: boolean;
}
export const ComplianceAccordionRequirementTitle = ({
type,
name,
status,
+ invalidConfig = false,
}: ComplianceAccordionRequirementTitleProps) => {
return (
<div className="flex w-full items-center justify-between gap-2">
<div className="flex w-5/6 items-center gap-2">
{type && (
- <span className="bg-primary/10 text-primary rounded-md px-2 py-0.5 text-xs font-medium">
+ <span className="bg-button-primary/10 text-button-primary rounded-md px-2 py-0.5 text-xs font-medium">
{type}
</span>
)}
<span>{name}</span>
+ {invalidConfig && <InfoTooltip content={INVALID_CONFIG_NOTE} />}
</div>
<StatusFindingBadge status={status} />
</div>
diff --git a/ui/components/compliance/compliance-accordion/compliance-accordion-title.tsx b/ui/components/compliance/compliance-accordion/compliance-accordion-title.tsx
index 97e700e5a5..0469f93daf 100644
--- a/ui/components/compliance/compliance-accordion/compliance-accordion-title.tsx
+++ b/ui/components/compliance/compliance-accordion/compliance-accordion-title.tsx
@@ -1,4 +1,4 @@
-import { Tooltip } from "@heroui/tooltip";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/shadcn";
interface ComplianceAccordionTitleProps {
label: string;
@@ -43,72 +43,63 @@ export const ComplianceAccordionTitle = ({
{total > 0 ? (
<div className="flex w-full">
{pass > 0 && (
- <Tooltip
- content={
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span
+ className="inline-block h-full bg-[#3CEC6D] transition-all duration-200 hover:brightness-110"
+ style={{
+ width: `${passPercentage}%`,
+ marginRight: pass > 0 ? "2px" : "0",
+ }}
+ />
+ </TooltipTrigger>
+ <TooltipContent side="top">
<div className="px-1 py-0.5">
<div className="text-xs font-medium">Pass</div>
- <div className="text-tiny text-default-400">
+ <div className="text-text-neutral-tertiary text-xs">
{pass} ({passPercentage.toFixed(1)}%)
</div>
</div>
- }
- size="sm"
- placement="top"
- delay={0}
- closeDelay={0}
- >
- <span
- className="inline-block h-full bg-[#3CEC6D] transition-all duration-200 hover:brightness-110"
- style={{
- width: `${passPercentage}%`,
- marginRight: pass > 0 ? "2px" : "0",
- }}
- />
+ </TooltipContent>
</Tooltip>
)}
{fail > 0 && (
- <Tooltip
- content={
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span
+ className="inline-block h-full bg-[#FB718F] transition-all duration-200 hover:brightness-110"
+ style={{
+ width: `${failPercentage}%`,
+ marginRight: manual > 0 ? "2px" : "0",
+ }}
+ />
+ </TooltipTrigger>
+ <TooltipContent side="top">
<div className="px-1 py-0.5">
<div className="text-xs font-medium">Fail</div>
- <div className="text-tiny text-default-400">
+ <div className="text-text-neutral-tertiary text-xs">
{fail} ({failPercentage.toFixed(1)}%)
</div>
</div>
- }
- size="sm"
- placement="top"
- delay={0}
- closeDelay={0}
- >
- <span
- className="inline-block h-full bg-[#FB718F] transition-all duration-200 hover:brightness-110"
- style={{
- width: `${failPercentage}%`,
- marginRight: manual > 0 ? "2px" : "0",
- }}
- />
+ </TooltipContent>
</Tooltip>
)}
{manual > 0 && (
- <Tooltip
- content={
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span
+ className="inline-block h-full bg-[#868994] transition-all duration-200 hover:brightness-110"
+ style={{ width: `${manualPercentage}%` }}
+ />
+ </TooltipTrigger>
+ <TooltipContent side="top">
<div className="px-1 py-0.5">
<div className="text-xs font-medium">Manual</div>
- <div className="text-tiny text-default-400">
+ <div className="text-text-neutral-tertiary text-xs">
{manual} ({manualPercentage.toFixed(1)}%)
</div>
</div>
- }
- size="sm"
- placement="top"
- delay={0}
- closeDelay={0}
- >
- <span
- className="inline-block h-full bg-[#868994] transition-all duration-200 hover:brightness-110"
- style={{ width: `${manualPercentage}%` }}
- />
+ </TooltipContent>
</Tooltip>
)}
</div>
@@ -117,19 +108,18 @@ export const ComplianceAccordionTitle = ({
)}
</div>
- <Tooltip
- content={
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span className="text-text-neutral-secondary min-w-[32px] text-center text-xs font-medium">
+ {total > 0 ? total : "—"}
+ </span>
+ </TooltipTrigger>
+ <TooltipContent side="top">
<div className="px-1 py-0.5">
<div className="text-xs font-medium">Total requirements</div>
- <div className="text-tiny text-default-400">{total}</div>
+ <div className="text-text-neutral-tertiary text-xs">{total}</div>
</div>
- }
- size="sm"
- placement="top"
- >
- <span className="text-default-600 min-w-[32px] text-center text-xs font-medium">
- {total > 0 ? total : "—"}
- </span>
+ </TooltipContent>
</Tooltip>
</div>
</div>
diff --git a/ui/components/compliance/compliance-accordion/use-requirement-findings.test.ts b/ui/components/compliance/compliance-accordion/use-requirement-findings.test.ts
new file mode 100644
index 0000000000..3de5bb236c
--- /dev/null
+++ b/ui/components/compliance/compliance-accordion/use-requirement-findings.test.ts
@@ -0,0 +1,348 @@
+import { act, renderHook } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { FINDING_TRIAGE_STATUS } from "@/types/findings-triage";
+
+import { useRequirementFindings } from "./use-requirement-findings";
+
+const findingsActionsMock = vi.hoisted(() => ({
+ getFindings: vi.fn(),
+}));
+
+vi.mock("@/actions/findings", () => findingsActionsMock);
+
+function makeFindingsResponse() {
+ return {
+ data: [
+ {
+ id: "finding-1",
+ attributes: { muted: false, status: "FAIL" },
+ triage: {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ },
+ relationships: {
+ scan: { data: { id: "scan-1" } },
+ resources: { data: [{ id: "resource-1" }] },
+ },
+ },
+ ],
+ included: [
+ {
+ type: "scans",
+ id: "scan-1",
+ relationships: { provider: { data: { id: "provider-1" } } },
+ },
+ { type: "resources", id: "resource-1" },
+ { type: "providers", id: "provider-1" },
+ ],
+ meta: { pagination: { count: 1, pages: 1 } },
+ };
+}
+
+function defaultOptions(overrides?: Record<string, unknown>) {
+ return {
+ enabled: true,
+ checkIds: ["check_1", "check_2"],
+ scanIds: ["scan-1"],
+ pageNumber: "1",
+ pageSize: "10",
+ sort: "+severity",
+ region: "",
+ mutedFilter: "false",
+ ...overrides,
+ };
+}
+
+async function flushAsync() {
+ await act(async () => {
+ await new Promise((resolve) => setTimeout(resolve, 0));
+ });
+}
+
+describe("useRequirementFindings", () => {
+ beforeEach(() => {
+ findingsActionsMock.getFindings.mockReset();
+ findingsActionsMock.getFindings.mockResolvedValue(makeFindingsResponse());
+ });
+
+ it("should fetch findings with the requirement filters and strip the sort plus sign", async () => {
+ // Given / When
+ renderHook(() => useRequirementFindings(defaultOptions()));
+ await flushAsync();
+
+ // Then
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledTimes(1);
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledWith({
+ filters: {
+ "filter[check_id__in]": "check_1,check_2",
+ "filter[scan__in]": "scan-1",
+ "filter[muted]": "false",
+ },
+ page: 1,
+ pageSize: 10,
+ sort: "severity",
+ });
+ });
+
+ it("should query all scans at once when given several scan ids", async () => {
+ // Given / When
+ renderHook(() =>
+ useRequirementFindings(defaultOptions({ scanIds: ["scan-1", "scan-2"] })),
+ );
+ await flushAsync();
+
+ // Then — one combined request, not one per scan.
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledTimes(1);
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledWith(
+ expect.objectContaining({
+ filters: expect.objectContaining({
+ "filter[scan__in]": "scan-1,scan-2",
+ }),
+ }),
+ );
+ });
+
+ it("should expand findings with their included scan, resource, and provider", async () => {
+ // Given / When
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+ await flushAsync();
+
+ // Then
+ const [expanded] = result.current.expandedFindings;
+ expect(expanded.relationships).toEqual({
+ scan: expect.objectContaining({ id: "scan-1" }),
+ resource: expect.objectContaining({ id: "resource-1" }),
+ provider: expect.objectContaining({ id: "provider-1" }),
+ });
+ expect(result.current.findings?.meta?.pagination?.count).toBe(1);
+ });
+
+ it("should not fetch when disabled, without check ids, or without scan ids", async () => {
+ // Given / When
+ renderHook(() =>
+ useRequirementFindings(defaultOptions({ enabled: false })),
+ );
+ renderHook(() => useRequirementFindings(defaultOptions({ checkIds: [] })));
+ renderHook(() => useRequirementFindings(defaultOptions({ scanIds: [] })));
+ await flushAsync();
+
+ // Then
+ expect(findingsActionsMock.getFindings).not.toHaveBeenCalled();
+ });
+
+ it("should not report loading when the fetch is disabled", async () => {
+ // Given / When
+ const disabled = renderHook(() =>
+ useRequirementFindings(defaultOptions({ enabled: false })),
+ );
+ const withoutChecks = renderHook(() =>
+ useRequirementFindings(defaultOptions({ checkIds: [] })),
+ );
+ const withoutScans = renderHook(() =>
+ useRequirementFindings(defaultOptions({ scanIds: [] })),
+ );
+ await flushAsync();
+
+ // Then — a skipped fetch must not look like a pending one.
+ expect(disabled.result.current.isLoading).toBe(false);
+ expect(withoutChecks.result.current.isLoading).toBe(false);
+ expect(withoutScans.result.current.isLoading).toBe(false);
+ });
+
+ it("should report loading until the fetch settles", async () => {
+ // Given
+ let resolveFetch: (value: unknown) => void = () => {};
+ findingsActionsMock.getFindings.mockImplementationOnce(
+ () => new Promise((resolve) => (resolveFetch = resolve)),
+ );
+
+ // When
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+
+ // Then
+ expect(result.current.isLoading).toBe(true);
+
+ // When
+ act(() => {
+ resolveFetch(makeFindingsResponse());
+ });
+ await flushAsync();
+
+ // Then
+ expect(result.current.isLoading).toBe(false);
+ });
+
+ it("should expose an error and stop loading when the fetch fails", async () => {
+ // Given
+ const consoleErrorSpy = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ findingsActionsMock.getFindings.mockRejectedValue(
+ new Error("network down"),
+ );
+
+ // When
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+ await flushAsync();
+
+ // Then — the caller can render an error state instead of a skeleton.
+ expect(result.current.error).toBe("Could not load findings.");
+ expect(result.current.isLoading).toBe(false);
+ expect(result.current.findings).toBeNull();
+
+ consoleErrorSpy.mockRestore();
+ });
+
+ it("should clear the error and recover on reload", async () => {
+ // Given: first fetch fails, retry succeeds
+ const consoleErrorSpy = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ findingsActionsMock.getFindings
+ .mockRejectedValueOnce(new Error("network down"))
+ .mockResolvedValueOnce(makeFindingsResponse());
+
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+ await flushAsync();
+ expect(result.current.error).toBe("Could not load findings.");
+
+ // When
+ act(() => {
+ result.current.reload();
+ });
+ await flushAsync();
+
+ // Then
+ expect(result.current.error).toBeNull();
+ expect(result.current.findings).not.toBeNull();
+
+ consoleErrorSpy.mockRestore();
+ });
+
+ it("should not refetch when only the checkIds array identity changes", async () => {
+ // Given
+ const { rerender } = renderHook((props) => useRequirementFindings(props), {
+ initialProps: defaultOptions(),
+ });
+ await flushAsync();
+
+ // When: same values, fresh array identity (parent re-render)
+ rerender(defaultOptions());
+ await flushAsync();
+
+ // Then
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledTimes(1);
+ });
+
+ it("should refetch when a query parameter changes", async () => {
+ // Given
+ const { rerender } = renderHook((props) => useRequirementFindings(props), {
+ initialProps: defaultOptions(),
+ });
+ await flushAsync();
+
+ // When
+ rerender(defaultOptions({ pageNumber: "2" }));
+ await flushAsync();
+
+ // Then
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledTimes(2);
+ expect(findingsActionsMock.getFindings).toHaveBeenLastCalledWith(
+ expect.objectContaining({ page: 2 }),
+ );
+ });
+
+ it("should refetch on reload keeping previous data visible meanwhile", async () => {
+ // Given
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+ await flushAsync();
+
+ // When
+ act(() => {
+ result.current.reload();
+ });
+
+ // Then: previous data is not cleared while the refetch is in flight
+ expect(result.current.findings).not.toBeNull();
+ await flushAsync();
+ expect(findingsActionsMock.getFindings).toHaveBeenCalledTimes(2);
+ });
+
+ it("should patch the matching row triage optimistically", async () => {
+ // Given
+ const { result } = renderHook(() =>
+ useRequirementFindings(defaultOptions()),
+ );
+ await flushAsync();
+
+ // When
+ act(() => {
+ result.current.patchTriageUpdate({
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ isMuted: false,
+ });
+ });
+
+ // Then
+ expect(result.current.expandedFindings[0]?.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ }),
+ );
+ });
+
+ it("should ignore stale responses after the query changes", async () => {
+ // Given: first request resolves late, second resolves immediately
+ let resolveFirst: (value: unknown) => void = () => {};
+ const staleResponse = {
+ ...makeFindingsResponse(),
+ meta: { pagination: { count: 99, pages: 9 } },
+ };
+ findingsActionsMock.getFindings
+ .mockImplementationOnce(
+ () => new Promise((resolve) => (resolveFirst = resolve)),
+ )
+ .mockResolvedValueOnce(makeFindingsResponse());
+
+ const { result, rerender } = renderHook(
+ (props) => useRequirementFindings(props),
+ { initialProps: defaultOptions() },
+ );
+
+ // When: the query changes before the first request settles
+ rerender(defaultOptions({ pageNumber: "2" }));
+ await flushAsync();
+ act(() => {
+ resolveFirst(staleResponse);
+ });
+ await flushAsync();
+
+ // Then: the stale response never overwrites the fresh one
+ expect(result.current.findings?.meta?.pagination?.count).toBe(1);
+ });
+});
diff --git a/ui/components/compliance/compliance-accordion/use-requirement-findings.ts b/ui/components/compliance/compliance-accordion/use-requirement-findings.ts
new file mode 100644
index 0000000000..cfa2dd2601
--- /dev/null
+++ b/ui/components/compliance/compliance-accordion/use-requirement-findings.ts
@@ -0,0 +1,148 @@
+"use client";
+
+import { useEffect, useState } from "react";
+
+import { getFindings } from "@/actions/findings";
+import { applyOptimisticFindingTriageRowsUpdate } from "@/lib/finding-triage";
+import { createDict } from "@/lib/utils";
+import { FindingProps, FindingsResponse } from "@/types/components";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
+
+interface UseRequirementFindingsOptions {
+ enabled: boolean;
+ checkIds: string[];
+ scanIds: string[];
+ pageNumber: string;
+ pageSize: string;
+ sort: string;
+ region: string;
+ mutedFilter: string;
+}
+
+interface UseRequirementFindingsReturn {
+ findings: FindingsResponse | null;
+ expandedFindings: FindingProps[];
+ isLoading: boolean;
+ error: string | null;
+ patchTriageUpdate: (input: UpdateFindingTriageInput) => void;
+ reload: () => void;
+}
+
+const FINDINGS_LOAD_ERROR = "Could not load findings.";
+
+export function useRequirementFindings({
+ enabled,
+ checkIds,
+ scanIds,
+ pageNumber,
+ pageSize,
+ sort,
+ region,
+ mutedFilter,
+}: UseRequirementFindingsOptions): UseRequirementFindingsReturn {
+ const [findings, setFindings] = useState<FindingsResponse | null>(null);
+ const [expandedFindings, setExpandedFindings] = useState<FindingProps[]>([]);
+ const [error, setError] = useState<string | null>(null);
+ const [reloadNonce, setReloadNonce] = useState(0);
+
+ // Depend on the joined values, not the arrays: the requirement prop gets a
+ // fresh identity on every parent render and must not retrigger the fetch.
+ const checkIdsKey = checkIds.join(",");
+ const scanIdsKey = scanIds.join(",");
+ const isFetchEnabled =
+ enabled && checkIdsKey.length > 0 && scanIdsKey.length > 0;
+ // A skipped fetch is not a pending one; without this the caller would show
+ // a skeleton forever for requirements whose fetch never runs.
+ const isLoading = isFetchEnabled && findings === null && error === null;
+
+ useEffect(() => {
+ if (!isFetchEnabled) {
+ return;
+ }
+
+ let cancelled = false;
+
+ const loadFindings = async () => {
+ setError(null);
+ try {
+ const findingsData = await getFindings({
+ filters: {
+ "filter[check_id__in]": checkIdsKey,
+ "filter[scan__in]": scanIdsKey,
+ "filter[muted]": mutedFilter,
+ ...(region && { "filter[region__in]": region }),
+ },
+ page: parseInt(pageNumber, 10),
+ pageSize: parseInt(pageSize, 10),
+ sort: sort.replace(/^\+/, ""),
+ });
+
+ if (cancelled) return;
+
+ setFindings(findingsData);
+
+ if (findingsData?.data) {
+ const resourceDict = createDict("resources", findingsData);
+ const scanDict = createDict("scans", findingsData);
+ const providerDict = createDict("providers", findingsData);
+
+ const expandedData = findingsData.data.map(
+ (finding: FindingProps) => {
+ const scan = scanDict[finding.relationships?.scan?.data?.id];
+ const resource =
+ resourceDict[finding.relationships?.resources?.data?.[0]?.id];
+ const provider =
+ providerDict[scan?.relationships?.provider?.data?.id ?? ""];
+
+ return {
+ ...finding,
+ relationships: { scan, resource, provider },
+ };
+ },
+ );
+ setExpandedFindings(expandedData);
+ }
+ } catch (error) {
+ if (!cancelled) {
+ console.error("Error loading findings:", error);
+ setError(FINDINGS_LOAD_ERROR);
+ }
+ }
+ };
+
+ loadFindings();
+
+ return () => {
+ cancelled = true;
+ };
+ }, [
+ isFetchEnabled,
+ checkIdsKey,
+ scanIdsKey,
+ pageNumber,
+ pageSize,
+ sort,
+ region,
+ mutedFilter,
+ reloadNonce,
+ ]);
+
+ const patchTriageUpdate = (input: UpdateFindingTriageInput) => {
+ setExpandedFindings((currentFindings) =>
+ applyOptimisticFindingTriageRowsUpdate(currentFindings, input),
+ );
+ };
+
+ const reload = () => {
+ setReloadNonce((value) => value + 1);
+ };
+
+ return {
+ findings,
+ expandedFindings,
+ isLoading,
+ error,
+ patchTriageUpdate,
+ reload,
+ };
+}
diff --git a/ui/components/compliance/compliance-card.test.tsx b/ui/components/compliance/compliance-card.test.tsx
index 996c8cb979..93b8b17db3 100644
--- a/ui/components/compliance/compliance-card.test.tsx
+++ b/ui/components/compliance/compliance-card.test.tsx
@@ -18,11 +18,6 @@ describe("ComplianceCard", () => {
expect(source).not.toContain("sm:flex-row");
});
- it("uses the shadcn progress component instead of Hero UI", () => {
- expect(source).toContain('from "@/components/shadcn/progress"');
- expect(source).not.toContain("@heroui/progress");
- });
-
it("places compact actions in the icon column on larger screens", () => {
expect(source).toContain('orientation="column"');
expect(source).toContain('buttonWidth="icon"');
diff --git a/ui/components/compliance/compliance-card.tsx b/ui/components/compliance/compliance-card.tsx
index 3972bb8db4..6168784f2f 100644
--- a/ui/components/compliance/compliance-card.tsx
+++ b/ui/components/compliance/compliance-card.tsx
@@ -131,7 +131,7 @@ export const ComplianceCard: React.FC<ComplianceCardProps> = ({
<div className="flex min-w-0 flex-1 flex-col">
<Tooltip>
<TooltipTrigger asChild>
- <h4 className="text-small truncate leading-5 font-bold">
+ <h4 className="truncate text-sm leading-5 font-bold">
{formatTitle(title)}
{version ? ` - ${version}` : ""}
</h4>
diff --git a/ui/components/compliance/compliance-charts/heatmap-chart.test.tsx b/ui/components/compliance/compliance-charts/heatmap-chart.test.tsx
new file mode 100644
index 0000000000..409974af77
--- /dev/null
+++ b/ui/components/compliance/compliance-charts/heatmap-chart.test.tsx
@@ -0,0 +1,36 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { HeatmapChart } from "./heatmap-chart";
+
+vi.mock("next-themes", () => ({
+ useTheme: () => ({ theme: "light" }),
+}));
+
+describe("HeatmapChart", () => {
+ it("portals its pointer-positioned tooltip outside layout containers", async () => {
+ // Given
+ const user = userEvent.setup();
+ const { container } = render(
+ <HeatmapChart
+ categories={[
+ {
+ name: "identity",
+ failurePercentage: 25,
+ totalRequirements: 4,
+ failedRequirements: 1,
+ },
+ ]}
+ />,
+ );
+
+ // When
+ await user.hover(screen.getByTitle("Identity"));
+
+ // Then: fixed client coordinates resolve against the viewport, not <main>
+ const tooltip = screen.getByRole("tooltip");
+ expect(container).not.toContainElement(tooltip);
+ expect(tooltip.parentElement).toBe(document.body);
+ });
+});
diff --git a/ui/components/compliance/compliance-charts/heatmap-chart.tsx b/ui/components/compliance/compliance-charts/heatmap-chart.tsx
index ff641a73c2..f57fa70aee 100644
--- a/ui/components/compliance/compliance-charts/heatmap-chart.tsx
+++ b/ui/components/compliance/compliance-charts/heatmap-chart.tsx
@@ -1,9 +1,10 @@
"use client";
-import { cn } from "@heroui/theme";
import { useTheme } from "next-themes";
import { useState } from "react";
+import { createPortal } from "react-dom";
+import { cn } from "@/lib/utils";
import { CategoryData } from "@/types/compliance";
interface HeatmapChartProps {
@@ -115,44 +116,49 @@ export const HeatmapChart = ({ categories = [] }: HeatmapChartProps) => {
</div>
{/* Custom Tooltip */}
- {hoveredItem && (
- <div
- className="pointer-events-none fixed z-50 rounded border px-3 py-2 text-xs shadow-lg"
- style={{
- left: mousePosition.x + 10,
- top: mousePosition.y - 10,
- backgroundColor: theme === "dark" ? "#1e293b" : "white",
- borderColor: theme === "dark" ? "#475569" : "rgba(0, 0, 0, 0.1)",
- color: theme === "dark" ? "white" : "black",
- }}
- >
- <div
- className="mb-1 font-semibold"
- style={{ color: theme === "dark" ? "white" : "black" }}
- >
- {capitalizeFirstLetter(hoveredItem.name)}
- </div>
- <div>
- <span
+ {hoveredItem
+ ? createPortal(
+ <div
+ role="tooltip"
+ className="pointer-events-none fixed z-50 rounded border px-3 py-2 text-xs shadow-lg"
style={{
- color: getHeatmapColor(hoveredItem.failurePercentage),
+ left: mousePosition.x + 10,
+ top: mousePosition.y - 10,
+ backgroundColor: theme === "dark" ? "#1e293b" : "white",
+ borderColor:
+ theme === "dark" ? "#475569" : "rgba(0, 0, 0, 0.1)",
+ color: theme === "dark" ? "white" : "black",
}}
>
- Failure Rate: {hoveredItem.failurePercentage}%
- </span>
- </div>
- <div>
- <span
- style={{
- color: getHeatmapColor(hoveredItem.failurePercentage),
- }}
- >
- Failed: {hoveredItem.failedRequirements}/
- {hoveredItem.totalRequirements}
- </span>
- </div>
- </div>
- )}
+ <div
+ className="mb-1 font-semibold"
+ style={{ color: theme === "dark" ? "white" : "black" }}
+ >
+ {capitalizeFirstLetter(hoveredItem.name)}
+ </div>
+ <div>
+ <span
+ style={{
+ color: getHeatmapColor(hoveredItem.failurePercentage),
+ }}
+ >
+ Failure Rate: {hoveredItem.failurePercentage}%
+ </span>
+ </div>
+ <div>
+ <span
+ style={{
+ color: getHeatmapColor(hoveredItem.failurePercentage),
+ }}
+ >
+ Failed: {hoveredItem.failedRequirements}/
+ {hoveredItem.totalRequirements}
+ </span>
+ </div>
+ </div>,
+ document.body,
+ )
+ : null}
</div>
</div>
);
diff --git a/ui/components/compliance/compliance-charts/threatscore-breakdown-card.tsx b/ui/components/compliance/compliance-charts/threatscore-breakdown-card.tsx
index e919588169..7b5aab2110 100644
--- a/ui/components/compliance/compliance-charts/threatscore-breakdown-card.tsx
+++ b/ui/components/compliance/compliance-charts/threatscore-breakdown-card.tsx
@@ -1,12 +1,12 @@
"use client";
-import { Progress } from "@heroui/progress";
-
import type { SectionScores } from "@/actions/overview/threat-score";
import { RadialChart } from "@/components/graphs/radial-chart";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
+import { Progress } from "@/components/shadcn/progress";
import {
getScoreColor,
+ getScoreIndicatorClass,
getScoreLabel,
getScoreLevel,
getScoreTextClass,
@@ -72,7 +72,7 @@ export function ThreatScoreBreakdownCard({
{/* Pillar Breakdown */}
<Card variant="inner" padding="sm" className="min-w-0 flex-1">
<div className="mb-2">
- <span className="text-default-600 text-xs font-medium tracking-wide uppercase">
+ <span className="text-text-neutral-secondary text-xs font-medium tracking-wide uppercase">
Score by Pillar
</span>
</div>
@@ -80,7 +80,9 @@ export function ThreatScoreBreakdownCard({
{pillars.map(({ name, score, hasData }) => (
<div key={name} className="space-y-0.5">
<div className="flex items-center justify-between text-xs">
- <span className="text-default-700 truncate pr-2">{name}</span>
+ <span className="text-text-neutral-secondary truncate pr-2">
+ {name}
+ </span>
<span
className={`font-semibold ${
hasData
@@ -94,8 +96,9 @@ export function ThreatScoreBreakdownCard({
<Progress
aria-label={`${name} score`}
value={hasData ? score : 0}
- color={getScoreColor(score)}
- size="md"
+ indicatorClassName={getScoreIndicatorClass(
+ getScoreColor(score),
+ )}
className="w-full"
/>
</div>
@@ -113,22 +116,22 @@ export function ThreatScoreBreakdownCardSkeleton() {
return (
<Card variant="base" className="flex h-full w-full animate-pulse flex-col">
<CardHeader>
- <div className="bg-default-200 h-5 w-40 rounded" />
+ <div className="bg-border-neutral-tertiary h-5 w-40 rounded" />
</CardHeader>
{/* Mobile: vertical, Tablet: horizontal, Desktop: vertical */}
<CardContent className="flex flex-1 flex-col gap-4 md:flex-row md:items-stretch lg:flex-col">
<div className="flex w-full flex-col items-center justify-center md:w-[160px] md:flex-shrink-0 lg:w-full">
- <div className="bg-default-200 mx-auto h-[140px] w-[140px] rounded-full" />
+ <div className="bg-border-neutral-tertiary mx-auto h-[140px] w-[140px] rounded-full" />
</div>
<Card variant="inner" padding="sm" className="min-w-0 flex-1">
<div className="space-y-2">
{Array.from({ length: SKELETON_PILLAR_COUNT }, (_, i) => (
<div key={i} className="space-y-0.5">
<div className="flex justify-between">
- <div className="bg-default-200 h-3 w-28 rounded" />
- <div className="bg-default-200 h-3 w-10 rounded" />
+ <div className="bg-border-neutral-tertiary h-3 w-28 rounded" />
+ <div className="bg-border-neutral-tertiary h-3 w-10 rounded" />
</div>
- <div className="bg-default-200 h-2 w-full rounded" />
+ <div className="bg-border-neutral-tertiary h-2 w-full rounded" />
</div>
))}
</div>
diff --git a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.test.tsx b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.test.tsx
index 816b62a262..07c36b42de 100644
--- a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.test.tsx
+++ b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.test.tsx
@@ -6,7 +6,7 @@ import { describe, expect, it, vi } from "vitest";
// `next-auth` (server-only). Stub it with a plain anchor — we only need
// the `<a>` semantics here so the regex/extraction tests can assert on
// `href` and accessible name.
-vi.mock("@/components/ui/custom/custom-link", () => ({
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
CustomLink: ({ href, children }: { href: string; children: ReactNode }) => (
<a href={href}>{children}</a>
),
diff --git a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
index 2cb022a174..975e1557cc 100644
--- a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
@@ -1,6 +1,6 @@
import ReactMarkdown from "react-markdown";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import {
isASDAssessmentStatus,
isASDCloudApplicability,
diff --git a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
index 00aa51e4c5..b9e4baf369 100644
--- a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
@@ -1,5 +1,5 @@
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { SeverityBadge } from "@/components/ui/table";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { SeverityBadge } from "@/components/shadcn/table";
import { Requirement } from "@/types/compliance";
import {
diff --git a/ui/components/compliance/compliance-custom-details/cis-controls-details.tsx b/ui/components/compliance/compliance-custom-details/cis-controls-details.tsx
new file mode 100644
index 0000000000..8b1b6bd7cd
--- /dev/null
+++ b/ui/components/compliance/compliance-custom-details/cis-controls-details.tsx
@@ -0,0 +1,56 @@
+import { Requirement } from "@/types/compliance";
+
+import {
+ ComplianceBadge,
+ ComplianceBadgeContainer,
+ ComplianceDetailContainer,
+ ComplianceDetailSection,
+ ComplianceDetailText,
+} from "./shared-components";
+
+interface CISControlsDetailsProps {
+ requirement: Requirement;
+}
+
+export const CISControlsCustomDetails = ({
+ requirement,
+}: CISControlsDetailsProps) => {
+ const implementationGroups = Array.isArray(requirement.implementation_groups)
+ ? (requirement.implementation_groups as string[])
+ : [];
+
+ return (
+ <ComplianceDetailContainer>
+ {requirement.description && (
+ <ComplianceDetailSection title="Description">
+ <ComplianceDetailText>{requirement.description}</ComplianceDetailText>
+ </ComplianceDetailSection>
+ )}
+
+ <ComplianceBadgeContainer>
+ {requirement.function && (
+ <ComplianceBadge
+ label="Security Function"
+ value={requirement.function as string}
+ variant="info"
+ />
+ )}
+ {requirement.asset_type && (
+ <ComplianceBadge
+ label="Asset Type"
+ value={requirement.asset_type as string}
+ variant="secondary"
+ />
+ )}
+ {implementationGroups.map((group) => (
+ <ComplianceBadge
+ key={group}
+ label="Implementation Group"
+ value={group}
+ variant="tag"
+ />
+ ))}
+ </ComplianceBadgeContainer>
+ </ComplianceDetailContainer>
+ );
+};
diff --git a/ui/components/compliance/compliance-custom-details/cis-details.tsx b/ui/components/compliance/compliance-custom-details/cis-details.tsx
index 25823038d5..31f32576b0 100644
--- a/ui/components/compliance/compliance-custom-details/cis-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/cis-details.tsx
@@ -1,6 +1,6 @@
import ReactMarkdown from "react-markdown";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Requirement } from "@/types/compliance";
import {
diff --git a/ui/components/compliance/compliance-custom-details/mitre-details.tsx b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
index 53fc583f2c..be53382036 100644
--- a/ui/components/compliance/compliance-custom-details/mitre-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
@@ -1,4 +1,4 @@
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Requirement } from "@/types/compliance";
import {
diff --git a/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
index 0869b7f390..695b39bdcd 100644
--- a/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
@@ -1,4 +1,4 @@
-import { Severity, SeverityBadge } from "@/components/ui/table";
+import { Severity, SeverityBadge } from "@/components/shadcn/table";
import { Requirement } from "@/types/compliance";
import {
diff --git a/ui/components/compliance/compliance-download-container.test.tsx b/ui/components/compliance/compliance-download-container.test.tsx
index 31c68fb1fc..34f877a789 100644
--- a/ui/components/compliance/compliance-download-container.test.tsx
+++ b/ui/components/compliance/compliance-download-container.test.tsx
@@ -22,7 +22,8 @@ vi.mock("@/lib/helper", () => ({
downloadCompliancePdf: downloadCompliancePdfMock,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
toast: {},
}));
@@ -39,7 +40,6 @@ describe("ComplianceDownloadContainer", () => {
it("uses the shared action dropdown for the card actions mode", () => {
expect(source).toContain("ActionDropdown");
- expect(source).not.toContain("@heroui/button");
});
it("should expose an accessible actions menu trigger", () => {
diff --git a/ui/components/compliance/compliance-download-container.tsx b/ui/components/compliance/compliance-download-container.tsx
index 6e29acc213..9c49b1df80 100644
--- a/ui/components/compliance/compliance-download-container.tsx
+++ b/ui/components/compliance/compliance-download-container.tsx
@@ -3,6 +3,7 @@
import { DownloadIcon, FileJsonIcon, FileTextIcon } from "lucide-react";
import { useState } from "react";
+import { toast } from "@/components/shadcn";
import { Button } from "@/components/shadcn/button/button";
import {
ActionDropdown,
@@ -13,7 +14,6 @@ import {
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn/tooltip";
-import { toast } from "@/components/ui";
import {
type ComplianceReportType,
isOcsfSupported,
@@ -34,6 +34,9 @@ interface ComplianceDownloadContainerProps {
orientation?: "row" | "column";
buttonWidth?: "auto" | "icon";
presentation?: "buttons" | "dropdown";
+ /** Custom dropdown trigger (e.g. an outline "Report" button); only used
+ * when presentation is "dropdown". Defaults to the dots icon. */
+ dropdownTrigger?: React.ReactNode;
}
export const ComplianceDownloadContainer = ({
@@ -45,6 +48,7 @@ export const ComplianceDownloadContainer = ({
orientation = "row",
buttonWidth = "auto",
presentation = "buttons",
+ dropdownTrigger,
}: ComplianceDownloadContainerProps) => {
const [isDownloadingCsv, setIsDownloadingCsv] = useState(false);
const [isDownloadingOcsf, setIsDownloadingOcsf] = useState(false);
@@ -116,6 +120,7 @@ export const ComplianceDownloadContainer = ({
<ActionDropdown
variant={isIconWidth ? "bordered" : "table"}
ariaLabel="Open compliance export actions"
+ trigger={dropdownTrigger}
>
<ActionDropdownItem
icon={
diff --git a/ui/components/compliance/compliance-header/compliance-header.tsx b/ui/components/compliance/compliance-header/compliance-header.tsx
index c53a5309a5..049a91ea1a 100644
--- a/ui/components/compliance/compliance-header/compliance-header.tsx
+++ b/ui/components/compliance/compliance-header/compliance-header.tsx
@@ -2,7 +2,7 @@
import Image from "next/image";
-import { DataTableFilterCustom } from "@/components/ui/table/data-table-filter-custom";
+import { DataTableFilterCustom } from "@/components/shadcn/table/data-table-filter-custom";
import { ScanEntity } from "@/types/scans";
import { ComplianceScanInfo } from "./compliance-scan-info";
@@ -76,31 +76,31 @@ export const ComplianceHeader = ({
return (
<>
{hasContent && (
- <div className="flex w-full items-start justify-between gap-6 sm:mb-8">
- <div className="flex flex-1 flex-col justify-end gap-4">
- {/* Showed in the details page */}
- {selectedScan && <ComplianceScanInfo scan={selectedScan} />}
-
- {/* Showed in the compliance page */}
- {!hideFilters && (allFilters.length > 0 || showProviders) && (
- <DataTableFilterCustom
- filters={allFilters}
- prependElement={prependElement}
- />
- )}
- </div>
- {logoPath && complianceTitle && (
- <div className="hidden shrink-0 sm:block">
- <div className="relative h-24 w-24">
- <Image
- src={logoPath}
- alt={`${complianceTitle} logo`}
- fill
- className="rounded-lg border border-gray-300 bg-white object-contain p-0"
- />
- </div>
+ <div className="flex w-full flex-col gap-4">
+ {/* Identity row: framework logo anchoring the scan context. */}
+ {(selectedScan || (logoPath && complianceTitle)) && (
+ <div className="flex w-full items-center gap-4">
+ {logoPath && complianceTitle && (
+ <div className="relative h-12 w-12 shrink-0">
+ <Image
+ src={logoPath}
+ alt={`${complianceTitle} logo`}
+ fill
+ className="rounded-lg border border-gray-300 bg-white object-contain p-0"
+ />
+ </div>
+ )}
+ {selectedScan && <ComplianceScanInfo scan={selectedScan} />}
</div>
)}
+
+ {/* Filters row */}
+ {!hideFilters && (allFilters.length > 0 || showProviders) && (
+ <DataTableFilterCustom
+ filters={allFilters}
+ prependElement={prependElement}
+ />
+ )}
</div>
)}
</>
diff --git a/ui/components/compliance/compliance-header/compliance-scan-info.tsx b/ui/components/compliance/compliance-header/compliance-scan-info.tsx
index da1caa5ee9..f596b486e4 100644
--- a/ui/components/compliance/compliance-header/compliance-scan-info.tsx
+++ b/ui/components/compliance/compliance-header/compliance-scan-info.tsx
@@ -1,7 +1,10 @@
-import { Divider } from "@heroui/divider";
-import { Tooltip } from "@heroui/tooltip";
-
-import { DateWithTime, EntityInfo } from "@/components/ui/entities";
+import {
+ Separator,
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn";
+import { DateWithTime, EntityInfo } from "@/components/shadcn/entities";
import { ProviderType } from "@/types";
interface ComplianceScanInfoProps {
@@ -29,16 +32,17 @@ export const ComplianceScanInfo = ({ scan }: ComplianceScanInfoProps) => {
showCopyAction={false}
/>
</div>
- <Divider orientation="vertical" className="h-8 shrink-0" />
+ <Separator orientation="vertical" className="h-8 shrink-0" />
<div className="flex min-w-0 basis-1/2 flex-col items-start overflow-hidden">
- <Tooltip
- content={scan.attributes.name || "- -"}
- placement="top"
- size="sm"
- >
- <p className="text-default-500 truncate text-xs">
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <p className="text-text-neutral-tertiary truncate text-xs">
+ {scan.attributes.name || "- -"}
+ </p>
+ </TooltipTrigger>
+ <TooltipContent side="top">
{scan.attributes.name || "- -"}
- </p>
+ </TooltipContent>
</Tooltip>
<DateWithTime inline dateTime={scan.attributes.completed_at} />
</div>
diff --git a/ui/components/compliance/compliance-header/scan-selector.tsx b/ui/components/compliance/compliance-header/scan-selector.tsx
index ae8f5fb928..09255f7761 100644
--- a/ui/components/compliance/compliance-header/scan-selector.tsx
+++ b/ui/components/compliance/compliance-header/scan-selector.tsx
@@ -60,11 +60,7 @@ export const ScanSelector = ({
</SelectTrigger>
<SelectContent>
{scans.map((scan) => (
- <SelectItem
- key={scan.id}
- value={scan.id}
- className="data-[state=checked]:bg-bg-neutral-tertiary [&_svg:not([class*='size-'])]:size-6"
- >
+ <SelectItem key={scan.id} value={scan.id}>
<ComplianceScanInfo scan={scan} />
</SelectItem>
))}
diff --git a/ui/components/compliance/compliance-overview-grid.tsx b/ui/components/compliance/compliance-overview-grid.tsx
index b042ccc658..5900b23a86 100644
--- a/ui/components/compliance/compliance-overview-grid.tsx
+++ b/ui/components/compliance/compliance-overview-grid.tsx
@@ -5,7 +5,7 @@ import { Suspense, useState } from "react";
import { ComplianceCard } from "@/components/compliance/compliance-card";
import { OnboardingTrigger, PageReady } from "@/components/onboarding";
-import { DataTableSearch } from "@/components/ui/table/data-table-search";
+import { DataTableSearch } from "@/components/shadcn/table/data-table-search";
import { buildComplianceDetailPath } from "@/lib/compliance/compliance-detail-url";
import { getFlowById } from "@/lib/onboarding";
import { createViewComplianceTourStepHandlers } from "@/lib/tours/view-compliance.tour";
diff --git a/ui/components/compliance/skeletons/bar-chart-skeleton.tsx b/ui/components/compliance/skeletons/bar-chart-skeleton.tsx
index e83813edfe..bcbe3c9198 100644
--- a/ui/components/compliance/skeletons/bar-chart-skeleton.tsx
+++ b/ui/components/compliance/skeletons/bar-chart-skeleton.tsx
@@ -1,14 +1,12 @@
"use client";
-import { Skeleton } from "@heroui/skeleton";
+import { Skeleton } from "@/components/shadcn";
export const BarChartSkeleton = () => {
return (
<div className="flex w-[400px] flex-col items-center justify-between">
{/* Title skeleton */}
- <Skeleton className="h-4 w-40 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
+ <Skeleton className="h-4 w-40 rounded-lg" />
{/* Chart area skeleton */}
<div className="ml-24 flex h-full flex-col justify-center gap-2 p-4">
@@ -28,9 +26,7 @@ export const BarChartSkeleton = () => {
? "w-24"
: "w-16"
}`}
- >
- <div className="bg-default-200 h-6" />
- </Skeleton>
+ />
</div>
))}
@@ -38,12 +34,8 @@ export const BarChartSkeleton = () => {
<div className="flex justify-center gap-4 pt-2">
{Array.from({ length: 3 }).map((_, index) => (
<div key={index} className="flex items-center gap-1">
- <Skeleton className="h-3 w-3 rounded-full">
- <div className="bg-default-200 h-3 w-3" />
- </Skeleton>
- <Skeleton className="h-3 w-16 rounded-lg">
- <div className="bg-default-200 h-3" />
- </Skeleton>
+ <Skeleton className="h-3 w-3 rounded-full" />
+ <Skeleton className="h-3 w-16 rounded-lg" />
</div>
))}
</div>
diff --git a/ui/components/compliance/skeletons/compliance-accordion-skeleton.tsx b/ui/components/compliance/skeletons/compliance-accordion-skeleton.tsx
index 322336bd94..5ea3e56633 100644
--- a/ui/components/compliance/skeletons/compliance-accordion-skeleton.tsx
+++ b/ui/components/compliance/skeletons/compliance-accordion-skeleton.tsx
@@ -1,5 +1,4 @@
-import { Skeleton } from "@heroui/skeleton";
-import React from "react";
+import { Skeleton } from "@/components/shadcn";
interface SkeletonAccordionProps {
itemCount?: number;
@@ -19,9 +18,7 @@ export const SkeletonAccordion = ({
className={`flex w-full flex-col gap-2 ${className} rounded-xl border border-gray-300 p-2 dark:border-gray-700`}
>
{[...Array(itemCount)].map((_, index) => (
- <Skeleton key={index} className="rounded-lg">
- <div className={`${itemHeight} bg-default-300`}></div>
- </Skeleton>
+ <Skeleton key={index} className={`${itemHeight} rounded-lg`} />
))}
</div>
);
diff --git a/ui/components/compliance/skeletons/compliance-grid-skeleton.test.tsx b/ui/components/compliance/skeletons/compliance-grid-skeleton.test.tsx
deleted file mode 100644
index c7621aab04..0000000000
--- a/ui/components/compliance/skeletons/compliance-grid-skeleton.test.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-describe("ComplianceSkeletonGrid", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const filePath = path.join(currentDir, "compliance-grid-skeleton.tsx");
- const source = readFileSync(filePath, "utf8");
-
- it("uses shadcn skeletons instead of Hero UI", () => {
- expect(source).toContain('from "@/components/shadcn/skeleton/skeleton"');
- expect(source).not.toContain("@heroui/card");
- expect(source).not.toContain("@heroui/skeleton");
- });
-});
diff --git a/ui/components/compliance/skeletons/heatmap-chart-skeleton.tsx b/ui/components/compliance/skeletons/heatmap-chart-skeleton.tsx
index dbc8a5e389..beaea5dd93 100644
--- a/ui/components/compliance/skeletons/heatmap-chart-skeleton.tsx
+++ b/ui/components/compliance/skeletons/heatmap-chart-skeleton.tsx
@@ -1,25 +1,18 @@
"use client";
-import { Skeleton } from "@heroui/skeleton";
+import { Skeleton } from "@/components/shadcn";
export const HeatmapChartSkeleton = () => {
return (
<div className="flex h-[320px] w-[400px] flex-col items-center justify-between lg:w-[400px]">
{/* Title skeleton */}
- <Skeleton className="h-4 w-36 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
+ <Skeleton className="h-4 w-36 rounded-lg" />
{/* Heatmap area skeleton - 3x3 grid like the real component */}
<div className="h-full w-full p-4">
<div className="grid h-full w-full grid-cols-3 gap-1">
{Array.from({ length: 9 }).map((_, index) => (
- <Skeleton
- key={index}
- className="flex items-center justify-center rounded border"
- >
- <div className="bg-default-200 h-full w-full" />
- </Skeleton>
+ <Skeleton key={index} className="rounded border" />
))}
</div>
</div>
diff --git a/ui/components/compliance/skeletons/pie-chart-skeleton.tsx b/ui/components/compliance/skeletons/pie-chart-skeleton.tsx
index c819f486ae..6c0035aec6 100644
--- a/ui/components/compliance/skeletons/pie-chart-skeleton.tsx
+++ b/ui/components/compliance/skeletons/pie-chart-skeleton.tsx
@@ -1,61 +1,41 @@
"use client";
-import { Skeleton } from "@heroui/skeleton";
+import { Skeleton } from "@/components/shadcn";
export const PieChartSkeleton = () => {
return (
<div className="flex h-[320px] flex-col items-center justify-between">
{/* Title skeleton */}
- <Skeleton className="h-4 w-32 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
+ <Skeleton className="h-4 w-32 rounded-lg" />
{/* Pie chart skeleton */}
<div className="relative flex aspect-square w-[200px] min-w-[200px] items-center justify-center">
{/* Outer circle */}
- <Skeleton className="absolute h-[200px] w-[200px] rounded-full">
- <div className="bg-default-200 h-[200px] w-[200px]" />
- </Skeleton>
+ <Skeleton className="absolute h-[200px] w-[200px] rounded-full" />
{/* Inner circle (donut hole) */}
- <div className="bg-background absolute h-[140px] w-[140px] rounded-full"></div>
+ <div className="bg-bg-neutral-primary absolute h-[140px] w-[140px] rounded-full"></div>
{/* Center text skeleton */}
<div className="absolute flex flex-col items-center">
- <Skeleton className="h-6 w-8 rounded-lg">
- <div className="bg-default-300 h-6" />
- </Skeleton>
- <Skeleton className="mt-1 h-3 w-6 rounded-lg">
- <div className="bg-default-300 h-3" />
- </Skeleton>
+ <Skeleton className="h-6 w-8 rounded-lg" />
+ <Skeleton className="mt-1 h-3 w-6 rounded-lg" />
</div>
</div>
{/* Bottom stats skeleton */}
<div className="mt-2 grid grid-cols-3 gap-4">
<div className="flex flex-col items-center">
- <Skeleton className="h-4 w-8 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
- <Skeleton className="mt-1 h-5 w-6 rounded-lg">
- <div className="bg-default-200 h-5" />
- </Skeleton>
+ <Skeleton className="h-4 w-8 rounded-lg" />
+ <Skeleton className="mt-1 h-5 w-6 rounded-lg" />
</div>
<div className="flex flex-col items-center">
- <Skeleton className="h-4 w-6 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
- <Skeleton className="mt-1 h-5 w-6 rounded-lg">
- <div className="bg-default-200 h-5" />
- </Skeleton>
+ <Skeleton className="h-4 w-6 rounded-lg" />
+ <Skeleton className="mt-1 h-5 w-6 rounded-lg" />
</div>
<div className="flex flex-col items-center">
- <Skeleton className="h-4 w-12 rounded-lg">
- <div className="bg-default-200 h-4" />
- </Skeleton>
- <Skeleton className="mt-1 h-5 w-6 rounded-lg">
- <div className="bg-default-200 h-5" />
- </Skeleton>
+ <Skeleton className="h-4 w-12 rounded-lg" />
+ <Skeleton className="mt-1 h-5 w-6 rounded-lg" />
</div>
</div>
</div>
diff --git a/ui/components/compliance/threatscore-badge.test.tsx b/ui/components/compliance/threatscore-badge.test.tsx
index 2151f9bbf0..94ddf6d0df 100644
--- a/ui/components/compliance/threatscore-badge.test.tsx
+++ b/ui/components/compliance/threatscore-badge.test.tsx
@@ -9,13 +9,6 @@ describe("ThreatScoreBadge", () => {
const filePath = path.join(currentDir, "threatscore-badge.tsx");
const source = readFileSync(filePath, "utf8");
- it("uses shadcn card and progress components instead of Hero UI", () => {
- expect(source).toContain('from "@/components/shadcn/card/card"');
- expect(source).toContain('from "@/components/shadcn/progress"');
- expect(source).not.toContain("@heroui/card");
- expect(source).not.toContain("@heroui/progress");
- });
-
it("uses ActionDropdown for downloads instead of ComplianceDownloadContainer", () => {
expect(source).toContain("ActionDropdown");
expect(source).toContain("ActionDropdownItem");
diff --git a/ui/components/compliance/threatscore-badge.tsx b/ui/components/compliance/threatscore-badge.tsx
index 01bf180c9f..f3e526fc3b 100644
--- a/ui/components/compliance/threatscore-badge.tsx
+++ b/ui/components/compliance/threatscore-badge.tsx
@@ -6,13 +6,13 @@ import { useState } from "react";
import type { SectionScores } from "@/actions/overview/threat-score";
import { ThreatScoreLogo } from "@/components/compliance/threatscore-logo";
+import { toast } from "@/components/shadcn";
import { Card, CardContent } from "@/components/shadcn/card/card";
import {
ActionDropdown,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
import { Progress } from "@/components/shadcn/progress";
-import { toast } from "@/components/ui";
import { COMPLIANCE_REPORT_TYPES } from "@/lib/compliance/compliance-report-types";
import {
getScoreColor,
diff --git a/ui/components/feeds/feeds-client.tsx b/ui/components/feeds/feeds-client.tsx
index e91e16b6d6..6b0e45e367 100644
--- a/ui/components/feeds/feeds-client.tsx
+++ b/ui/components/feeds/feeds-client.tsx
@@ -58,8 +58,9 @@ export function FeedsClient({ feedData, error }: FeedsClientProps) {
<TooltipTrigger asChild>
<DropdownMenuTrigger asChild>
<Button
- variant="outline"
- className="border-border-input-primary-fill relative h-8 w-8 rounded-full bg-transparent p-2"
+ variant="ghost"
+ size="icon-sm"
+ className="relative"
aria-label={
hasUnseenFeeds
? "New updates available - Click to view"
@@ -67,15 +68,15 @@ export function FeedsClient({ feedData, error }: FeedsClientProps) {
}
>
<BellRing
- size={18}
className={cn(
+ "size-5",
hasFeeds &&
hasUnseenFeeds &&
"text-button-primary animate-pulse",
)}
/>
{hasFeeds && hasUnseenFeeds && (
- <span className="absolute top-0 right-0 flex h-2 w-2">
+ <span className="absolute top-1 right-1 flex h-2 w-2">
<span className="bg-button-primary absolute inline-flex h-full w-full animate-ping rounded-full opacity-75"></span>
<span className="bg-button-primary relative inline-flex h-2 w-2 rounded-full"></span>
</span>
diff --git a/ui/components/filters/apply-filters-button.test.tsx b/ui/components/filters/apply-filters-button.test.tsx
index fb6be26b57..81d36690a3 100644
--- a/ui/components/filters/apply-filters-button.test.tsx
+++ b/ui/components/filters/apply-filters-button.test.tsx
@@ -8,7 +8,8 @@ vi.mock("lucide-react", () => ({
}));
// Mock @/components/shadcn to avoid next-auth import chain
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Button: ({
children,
disabled,
diff --git a/ui/components/filters/custom-search-input.tsx b/ui/components/filters/custom-search-input.tsx
index f7b1366f4b..ccf96b0a4b 100644
--- a/ui/components/filters/custom-search-input.tsx
+++ b/ui/components/filters/custom-search-input.tsx
@@ -1,38 +1,31 @@
-import { Input } from "@heroui/input";
-import { SearchIcon, XCircle } from "lucide-react";
import { useSearchParams } from "next/navigation";
-import React, { useCallback, useEffect, useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";
+import { SearchInput } from "@/components/shadcn";
import { useUrlFilters } from "@/hooks/use-url-filters";
-export const CustomSearchInput: React.FC = () => {
+export const CustomSearchInput = () => {
const searchParams = useSearchParams();
const { updateFilter } = useUrlFilters();
const [searchQuery, setSearchQuery] = useState("");
const debounceTimeoutRef = useRef<NodeJS.Timeout | null>(null);
- const applySearch = useCallback(
- (query: string) => {
- if (query) {
- updateFilter("search", query);
- } else {
- updateFilter("search", null);
- }
- },
- [updateFilter],
- );
+ const applySearch = (query: string) => {
+ if (query) {
+ updateFilter("search", query);
+ } else {
+ updateFilter("search", null);
+ }
+ };
- const debouncedChangeHandler = useCallback(
- (value: string) => {
- if (debounceTimeoutRef.current) {
- clearTimeout(debounceTimeoutRef.current);
- }
- debounceTimeoutRef.current = setTimeout(() => {
- applySearch(value);
- }, 300);
- },
- [applySearch],
- );
+ const debouncedChangeHandler = (value: string) => {
+ if (debounceTimeoutRef.current) {
+ clearTimeout(debounceTimeoutRef.current);
+ }
+ debounceTimeoutRef.current = setTimeout(() => {
+ applySearch(value);
+ }, 300);
+ };
const clearIconSearch = () => {
setSearchQuery("");
@@ -53,39 +46,16 @@ export const CustomSearchInput: React.FC = () => {
}, []);
return (
- <Input
- style={{
- borderRadius: "0.5rem",
- }}
- classNames={{
- base: "w-full [&]:!rounded-lg [&>*]:!rounded-lg",
- input:
- "text-bg-button-secondary placeholder:text-bg-button-secondary text-sm",
- inputWrapper:
- "!border-border-input-primary !bg-bg-input-primary dark:!bg-input/30 dark:hover:!bg-input/50 hover:!bg-bg-neutral-secondary !border [&]:!rounded-lg !shadow-xs !transition-[color,box-shadow] focus-within:!border-border-input-primary-press focus-within:!ring-1 focus-within:!ring-border-input-primary-press focus-within:!ring-offset-1 !h-10 !px-4 !py-3 !outline-none",
- clearButton: "text-bg-button-secondary",
- }}
+ <SearchInput
aria-label="Search"
placeholder="Search..."
value={searchQuery}
- startContent={
- <SearchIcon className="text-bg-button-secondary shrink-0" width={16} />
- }
onChange={(e) => {
const value = e.target.value;
setSearchQuery(value);
debouncedChangeHandler(value);
}}
- endContent={
- searchQuery && (
- <button
- onClick={clearIconSearch}
- className="text-bg-button-secondary shrink-0 focus:outline-none"
- >
- <XCircle className="text-bg-button-secondary h-4 w-4" />
- </button>
- )
- }
+ onClear={clearIconSearch}
/>
);
};
diff --git a/ui/components/filters/data-filters.ts b/ui/components/filters/data-filters.ts
index 2457b1a8b2..83969d0362 100644
--- a/ui/components/filters/data-filters.ts
+++ b/ui/components/filters/data-filters.ts
@@ -1,5 +1,5 @@
import { CONNECTION_STATUS_MAPPING } from "@/lib/helper-filters";
-import { FilterOption, FilterType } from "@/types/filters";
+import { FILTER_FIELD, FilterOption } from "@/types/filters";
import {
PROVIDER_DISPLAY_NAMES,
PROVIDER_TYPES,
@@ -64,19 +64,19 @@ export const filterScans = [
//Static filters for findings
export const filterFindings = [
{
- key: FilterType.SEVERITY,
+ key: FILTER_FIELD.SEVERITY,
labelCheckboxGroup: "Severity",
values: ["critical", "high", "medium", "low", "informational"],
index: 0,
},
{
- key: FilterType.STATUS,
+ key: FILTER_FIELD.STATUS,
labelCheckboxGroup: "Status",
values: ["PASS", "FAIL", "MANUAL"],
index: 1,
},
{
- key: FilterType.DELTA,
+ key: FILTER_FIELD.DELTA,
labelCheckboxGroup: "Delta",
values: ["new", "changed"],
index: 2,
diff --git a/ui/components/filters/filter-controls.tsx b/ui/components/filters/filter-controls.tsx
index b0403a9a66..94072d8c38 100644
--- a/ui/components/filters/filter-controls.tsx
+++ b/ui/components/filters/filter-controls.tsx
@@ -1,8 +1,8 @@
"use client";
+import { DataTableFilterCustom } from "@/components/shadcn/table";
import { FilterOption } from "@/types";
-import { DataTableFilterCustom } from "../ui/table";
import { CustomSearchInput } from "./custom-search-input";
export interface FilterControlsProps {
diff --git a/ui/components/filters/filter-summary-strip.test.tsx b/ui/components/filters/filter-summary-strip.test.tsx
index 57bfca2e14..75d02b7ae3 100644
--- a/ui/components/filters/filter-summary-strip.test.tsx
+++ b/ui/components/filters/filter-summary-strip.test.tsx
@@ -8,7 +8,8 @@ vi.mock("lucide-react", () => ({
}));
// Mock @/components/shadcn to avoid next-auth import chain
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Badge: ({
children,
className,
diff --git a/ui/components/filters/provider-account-selectors.test.tsx b/ui/components/filters/provider-account-selectors.test.tsx
index a8b8bd1689..c30397eed4 100644
--- a/ui/components/filters/provider-account-selectors.test.tsx
+++ b/ui/components/filters/provider-account-selectors.test.tsx
@@ -1,7 +1,7 @@
import { render } from "@testing-library/react";
import { beforeEach, describe, expect, it, vi } from "vitest";
-import { FilterType } from "@/types/filters";
+import { FILTER_FIELD } from "@/types/filters";
import type { ProviderProps } from "@/types/providers";
import { ProviderAccountSelectors } from "./provider-account-selectors";
@@ -77,6 +77,7 @@ const makeProvider = ({
type: "providers",
attributes: {
provider,
+ is_dynamic: false,
uid,
alias,
status: "completed",
@@ -171,7 +172,7 @@ describe("ProviderAccountSelectors", () => {
render(
<ProviderAccountSelectors
providers={providers}
- accountFilterKey={FilterType.PROVIDER_UID}
+ accountFilterKey={FILTER_FIELD.PROVIDER_UID}
accountValue="uid"
paramsToDeleteOnChange={["page", "scanId"]}
/>,
@@ -230,7 +231,7 @@ describe("ProviderAccountSelectors", () => {
<ProviderAccountSelectors
providers={providers}
mode="batch"
- accountFilterKey={FilterType.PROVIDER_UID}
+ accountFilterKey={FILTER_FIELD.PROVIDER_UID}
accountValue="uid"
selectedProviderTypes={["aws"]}
selectedAccounts={["123456789012", "prowler-project"]}
diff --git a/ui/components/filters/provider-account-selectors.tsx b/ui/components/filters/provider-account-selectors.tsx
index b689e54ca1..5b025412fc 100644
--- a/ui/components/filters/provider-account-selectors.tsx
+++ b/ui/components/filters/provider-account-selectors.tsx
@@ -5,7 +5,7 @@ import { useSearchParams } from "next/navigation";
import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
import { ProviderTypeSelector } from "@/app/(prowler)/_overview/_components/provider-type-selector";
import { useUrlFilters } from "@/hooks/use-url-filters";
-import { type AccountFilterKey, FilterType } from "@/types/filters";
+import { type AccountFilterKey, FILTER_FIELD } from "@/types/filters";
import type { ProviderProps } from "@/types/providers";
const ACCOUNT_VALUE = {
@@ -91,7 +91,7 @@ const getCompatibleAccounts = ({
export function ProviderAccountSelectors({
providers,
- accountFilterKey = FilterType.PROVIDER_ID,
+ accountFilterKey = FILTER_FIELD.PROVIDER_ID,
accountValue = ACCOUNT_VALUE.ID,
providerSelectorClassName,
accountSelectorClassName,
diff --git a/ui/components/filters/provider-group-selector.test.tsx b/ui/components/filters/provider-group-selector.test.tsx
new file mode 100644
index 0000000000..68b7d88739
--- /dev/null
+++ b/ui/components/filters/provider-group-selector.test.tsx
@@ -0,0 +1,236 @@
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { ProviderGroup } from "@/types/components";
+
+import { ProviderGroupSelector } from "./provider-group-selector";
+
+const multiSelectContentSpy = vi.fn();
+
+const { navigateWithParamsMock } = vi.hoisted(() => ({
+ navigateWithParamsMock: vi.fn(),
+}));
+
+let currentSearchParams = new URLSearchParams();
+
+vi.mock("next/navigation", () => ({
+ useSearchParams: () => currentSearchParams,
+}));
+
+vi.mock("@/hooks/use-url-filters", () => ({
+ useUrlFilters: () => ({
+ navigateWithParams: navigateWithParamsMock,
+ }),
+}));
+
+vi.mock("@/components/shadcn/select/multiselect", () => ({
+ MultiSelect: ({
+ children,
+ onValuesChange,
+ }: {
+ children: React.ReactNode;
+ onValuesChange: (values: string[]) => void;
+ }) => (
+ <div>
+ <button
+ data-testid="mock-select-group-2"
+ onClick={() => onValuesChange(["group-2"])}
+ />
+ {children}
+ </div>
+ ),
+ MultiSelectTrigger: ({ children }: { children: React.ReactNode }) => (
+ <div data-testid="trigger">{children}</div>
+ ),
+ MultiSelectValue: ({ placeholder }: { placeholder: string }) => (
+ <span>{placeholder}</span>
+ ),
+ MultiSelectContent: ({
+ children,
+ search,
+ }: {
+ children: React.ReactNode;
+ search?: unknown;
+ }) => {
+ multiSelectContentSpy(search);
+ return <div>{children}</div>;
+ },
+ MultiSelectItem: ({
+ children,
+ value,
+ keywords,
+ }: {
+ children: React.ReactNode;
+ value: string;
+ keywords?: string[];
+ }) => (
+ <div data-value={value} data-keywords={keywords?.join("|")}>
+ {children}
+ </div>
+ ),
+}));
+
+const makeGroup = (id: string, name: string): ProviderGroup => ({
+ type: "provider-groups",
+ id,
+ attributes: { name, inserted_at: "", updated_at: "" },
+ relationships: {
+ providers: { meta: { count: 0 }, data: [] },
+ roles: { meta: { count: 0 }, data: [] },
+ },
+ links: { self: "" },
+});
+
+const groups = [
+ makeGroup("group-1", "Production"),
+ makeGroup("group-2", "Dev"),
+];
+
+describe("ProviderGroupSelector", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ currentSearchParams = new URLSearchParams();
+ });
+
+ it("stays visible with the placeholder and empty message when there are no provider groups", () => {
+ render(<ProviderGroupSelector groups={[]} />);
+
+ // Control is still rendered (visible even with zero groups)...
+ expect(screen.getByText("All Provider Groups")).toBeInTheDocument();
+ // ...and the single empty state is the MultiSelect's own emptyMessage,
+ // not a duplicate custom message.
+ expect(multiSelectContentSpy).toHaveBeenCalledWith({
+ placeholder: "Search Provider Groups...",
+ emptyMessage: "No Provider Groups found.",
+ });
+ expect(
+ screen.queryByText("No Provider Groups available"),
+ ).not.toBeInTheDocument();
+ });
+
+ it("passes searchable dropdown defaults to MultiSelectContent and lists groups", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ expect(multiSelectContentSpy).toHaveBeenCalledWith({
+ placeholder: "Search Provider Groups...",
+ emptyMessage: "No Provider Groups found.",
+ });
+ expect(screen.getByText("Production")).toBeInTheDocument();
+ expect(screen.getByText("Dev")).toBeInTheDocument();
+ });
+
+ it("allows disabling search explicitly", () => {
+ render(<ProviderGroupSelector groups={groups} search={false} />);
+
+ expect(multiSelectContentSpy).toHaveBeenLastCalledWith(false);
+ });
+
+ it("passes the group name as a search keyword", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ expect(
+ screen.getByText("Production").closest("[data-value]"),
+ ).toHaveAttribute("data-keywords", expect.stringContaining("Production"));
+ });
+
+ it("disables select all when nothing is selected", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ expect(
+ screen.getByRole("option", { name: /select all Provider Groups/i }),
+ ).toHaveAttribute("aria-disabled", "true");
+ expect(screen.getByText("All selected")).toBeInTheDocument();
+ });
+
+ it("shows the selected count in the trigger when multiple groups are selected", () => {
+ render(
+ <ProviderGroupSelector
+ groups={groups}
+ onBatchChange={vi.fn()}
+ selectedValues={["group-1", "group-2"]}
+ />,
+ );
+
+ const trigger = screen.getByTestId("trigger");
+ expect(
+ within(trigger).getByText("2 Provider Groups selected"),
+ ).toBeInTheDocument();
+ });
+
+ it("shows the single group name in the trigger when one group is selected", () => {
+ render(
+ <ProviderGroupSelector
+ groups={groups}
+ onBatchChange={vi.fn()}
+ selectedValues={["group-1"]}
+ />,
+ );
+
+ const trigger = screen.getByTestId("trigger");
+ expect(within(trigger).getByText("Production")).toBeInTheDocument();
+ });
+
+ it("instant mode: writes the selection to filter[provider_groups__in] in the URL", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ fireEvent.click(screen.getByTestId("mock-select-group-2"));
+
+ expect(navigateWithParamsMock).toHaveBeenCalledTimes(1);
+ const params = new URLSearchParams();
+ navigateWithParamsMock.mock.calls[0][0](params);
+ expect(params.get("filter[provider_groups__in]")).toBe("group-2");
+ });
+
+ it("instant mode: clearing deletes the filter key and the extra paramsToDeleteOnChange keys", () => {
+ currentSearchParams = new URLSearchParams(
+ "filter[provider_groups__in]=group-1&page=3&scanId=abc",
+ );
+ render(
+ <ProviderGroupSelector
+ groups={groups}
+ paramsToDeleteOnChange={["page", "scanId"]}
+ />,
+ );
+
+ fireEvent.click(
+ screen.getByRole("option", { name: /select all Provider Groups/i }),
+ );
+
+ expect(navigateWithParamsMock).toHaveBeenCalledTimes(1);
+ const params = new URLSearchParams(
+ "filter[provider_groups__in]=group-1&page=3&scanId=abc",
+ );
+ navigateWithParamsMock.mock.calls[0][0](params);
+ expect(params.has("filter[provider_groups__in]")).toBe(false);
+ expect(params.has("page")).toBe(false);
+ expect(params.has("scanId")).toBe(false);
+ });
+
+ it("defaults the control id and links the sr-only label to it", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ const label = screen.getByText(/Filter by Provider Group/i);
+ expect(label).toHaveAttribute("for", "provider-group-selector");
+ expect(label).toHaveAttribute("id", "provider-group-selector-label");
+ });
+
+ it("applies a custom id so multiple instances don't collide", () => {
+ render(
+ <ProviderGroupSelector groups={groups} id="resources-provider-group" />,
+ );
+
+ const label = screen.getByText(/Filter by Provider Group/i);
+ expect(label).toHaveAttribute("for", "resources-provider-group");
+ expect(label).toHaveAttribute("id", "resources-provider-group-label");
+ });
+
+ it("does not navigate on clear when nothing is selected", () => {
+ render(<ProviderGroupSelector groups={groups} />);
+
+ fireEvent.click(
+ screen.getByRole("option", { name: /select all Provider Groups/i }),
+ );
+
+ expect(navigateWithParamsMock).not.toHaveBeenCalled();
+ });
+});
diff --git a/ui/components/filters/provider-group-selector.tsx b/ui/components/filters/provider-group-selector.tsx
new file mode 100644
index 0000000000..e7194d694b
--- /dev/null
+++ b/ui/components/filters/provider-group-selector.tsx
@@ -0,0 +1,171 @@
+"use client";
+
+import { useSearchParams } from "next/navigation";
+
+import {
+ MultiSelect,
+ MultiSelectContent,
+ MultiSelectItem,
+ type MultiSelectSearchProp,
+ MultiSelectTrigger,
+ MultiSelectValue,
+} from "@/components/shadcn/select/multiselect";
+import { useUrlFilters } from "@/hooks/use-url-filters";
+import type { ProviderGroup } from "@/types/components";
+import { FILTER_FIELD } from "@/types/filters";
+
+const PROVIDER_GROUP_FILTER_KEY = FILTER_FIELD.PROVIDER_GROUPS;
+const URL_FILTER_KEY = `filter[${PROVIDER_GROUP_FILTER_KEY}]`;
+
+/** Common props shared by both batch and instant modes. */
+interface ProviderGroupSelectorBaseProps {
+ groups: ProviderGroup[];
+ search?: MultiSelectSearchProp;
+ /** DOM id for the control; pass a unique one when rendering more than one. */
+ id?: string;
+ /**
+ * Instant mode only: extra URL params to delete when the selection changes
+ * (e.g. ["page", "scanId"]), mirroring ProviderAccountSelectors. Ignored in
+ * batch mode, where the parent owns URL updates.
+ */
+ paramsToDeleteOnChange?: string[];
+}
+
+/** Batch mode: caller controls both pending state and notification callback (all-or-nothing). */
+interface ProviderGroupSelectorBatchProps
+ extends ProviderGroupSelectorBaseProps {
+ /**
+ * Called instead of navigating immediately.
+ * Use this on pages that batch filter changes (e.g. Findings).
+ *
+ * @param filterKey - The raw filter key without "filter[]" wrapper, e.g. "provider_groups__in"
+ * @param values - The selected values array
+ */
+ onBatchChange: (filterKey: string, values: string[]) => void;
+ /**
+ * Pending selected values controlled by the parent.
+ * Reflects pending state before Apply is clicked.
+ */
+ selectedValues: string[];
+}
+
+/** Instant mode: URL-driven — neither callback nor controlled value. */
+interface ProviderGroupSelectorInstantProps
+ extends ProviderGroupSelectorBaseProps {
+ onBatchChange?: never;
+ selectedValues?: never;
+}
+
+type ProviderGroupSelectorProps =
+ | ProviderGroupSelectorBatchProps
+ | ProviderGroupSelectorInstantProps;
+
+export function ProviderGroupSelector({
+ groups,
+ onBatchChange,
+ selectedValues,
+ id = "provider-group-selector",
+ search = {
+ placeholder: "Search Provider Groups...",
+ emptyMessage: "No Provider Groups found.",
+ },
+ paramsToDeleteOnChange = [],
+}: ProviderGroupSelectorProps) {
+ const searchParams = useSearchParams();
+ const { navigateWithParams } = useUrlFilters();
+ const labelId = `${id}-label`;
+
+ const current = searchParams.get(URL_FILTER_KEY) || "";
+ const urlSelectedIds = current ? current.split(",").filter(Boolean) : [];
+
+ // In batch mode, use the parent-controlled pending values; otherwise, use URL state.
+ const selectedIds = onBatchChange ? selectedValues : urlSelectedIds;
+
+ const handleMultiValueChange = (ids: string[]) => {
+ if (onBatchChange) {
+ onBatchChange(PROVIDER_GROUP_FILTER_KEY, ids);
+ return;
+ }
+ navigateWithParams((params) => {
+ if (ids.length > 0) {
+ params.set(URL_FILTER_KEY, ids.join(","));
+ } else {
+ params.delete(URL_FILTER_KEY);
+ }
+ paramsToDeleteOnChange.forEach((key) => params.delete(key));
+ });
+ };
+
+ const selectedLabel = () => {
+ if (selectedIds.length === 0) return null;
+ if (selectedIds.length === 1) {
+ const group = groups.find((g) => g.id === selectedIds[0]);
+ return (
+ <span className="truncate">
+ {group ? group.attributes.name : selectedIds[0]}
+ </span>
+ );
+ }
+ return (
+ <span className="truncate">
+ {selectedIds.length} Provider Groups selected
+ </span>
+ );
+ };
+
+ return (
+ <div className="relative">
+ <label htmlFor={id} className="sr-only" id={labelId}>
+ Filter by Provider Group. Select one or more Provider Groups to filter
+ results.
+ </label>
+ <MultiSelect values={selectedIds} onValuesChange={handleMultiValueChange}>
+ <MultiSelectTrigger id={id} aria-labelledby={labelId}>
+ {selectedLabel() || (
+ <MultiSelectValue placeholder="All Provider Groups" />
+ )}
+ </MultiSelectTrigger>
+ <MultiSelectContent search={search}>
+ {/* No items when empty: the MultiSelect's own emptyMessage is the
+ single empty state (avoids a duplicate "none" message). */}
+ {groups.length > 0 && (
+ <>
+ <div
+ role="option"
+ aria-selected={selectedIds.length === 0}
+ aria-disabled={selectedIds.length === 0}
+ aria-label="Select all Provider Groups (clears current selection to show all)"
+ tabIndex={0}
+ className="text-text-neutral-secondary flex w-full cursor-pointer items-center gap-3 rounded-lg px-4 py-3 text-sm font-semibold hover:bg-slate-200 aria-disabled:cursor-not-allowed aria-disabled:opacity-50 dark:hover:bg-slate-700/50"
+ onClick={() => {
+ if (selectedIds.length === 0) return;
+ handleMultiValueChange([]);
+ }}
+ onKeyDown={(e) => {
+ if (e.key === "Enter" || e.key === " ") {
+ e.preventDefault();
+ if (selectedIds.length === 0) return;
+ handleMultiValueChange([]);
+ }
+ }}
+ >
+ {selectedIds.length === 0 ? "All selected" : "Select All"}
+ </div>
+ {groups.map((group) => (
+ <MultiSelectItem
+ key={group.id}
+ value={group.id}
+ badgeLabel={group.attributes.name}
+ keywords={[group.attributes.name]}
+ aria-label={`${group.attributes.name} Provider Group`}
+ >
+ <span className="truncate">{group.attributes.name}</span>
+ </MultiSelectItem>
+ ))}
+ </>
+ )}
+ </MultiSelectContent>
+ </MultiSelect>
+ </div>
+ );
+}
diff --git a/ui/components/findings/findings-filters.tsx b/ui/components/findings/findings-filters.tsx
index 349769f3ad..608ad97cd6 100644
--- a/ui/components/findings/findings-filters.tsx
+++ b/ui/components/findings/findings-filters.tsx
@@ -14,12 +14,14 @@ import {
FilterSummaryStrip,
} from "@/components/filters/filter-summary-strip";
import { ProviderAccountSelectors } from "@/components/filters/provider-account-selectors";
+import { ProviderGroupSelector } from "@/components/filters/provider-group-selector";
import { Button } from "@/components/shadcn";
-import { ExpandableSection } from "@/components/ui/expandable-section";
-import { DataTableFilterCustom } from "@/components/ui/table/data-table-filter-custom";
+import { ExpandableSection } from "@/components/shadcn/expandable-section";
+import { DataTableFilterCustom } from "@/components/shadcn/table/data-table-filter-custom";
import { useFilterBatch } from "@/hooks/use-filter-batch";
import { getCategoryLabel, getGroupLabel } from "@/lib/categories";
-import { FilterType, ScanEntity } from "@/types";
+import { FILTER_FIELD, ScanEntity } from "@/types";
+import { ProviderGroup } from "@/types/components";
import { DATA_TABLE_FILTER_MODE } from "@/types/filters";
import { ProviderProps } from "@/types/providers";
@@ -31,6 +33,8 @@ import {
interface FindingsFiltersProps {
/** Provider data for provider/account filter controls. */
providers: ProviderProps[];
+ /** Provider groups for the provider group filter control. */
+ providerGroups?: ProviderGroup[];
completedScanIds: string[];
scanDetails: { [key: string]: ScanEntity }[];
uniqueRegions: string[];
@@ -70,6 +74,10 @@ const FILTER_GRID_ITEM_CLASS = "min-w-0";
export const FindingsFilterBatchControls = ({
providers,
+ // Undefined = caller opted out (the alert editor shares this component but
+ // loads no groups); an empty array still renders the control, so it stays
+ // visible even when a tenant has no groups yet.
+ providerGroups,
completedScanIds,
scanDetails,
uniqueRegions,
@@ -97,7 +105,7 @@ export const FindingsFilterBatchControls = ({
const customFilters = [
...filterFindings
- .filter((filter) => !isAlertsEdit || filter.key !== FilterType.STATUS)
+ .filter((filter) => !isAlertsEdit || filter.key !== FILTER_FIELD.STATUS)
.map((filter) => ({
...filter,
labelFormatter: (value: string) =>
@@ -107,32 +115,32 @@ export const FindingsFilterBatchControls = ({
}),
})),
{
- key: FilterType.REGION,
+ key: FILTER_FIELD.REGION,
labelCheckboxGroup: "Regions",
values: uniqueRegions,
index: 3,
},
{
- key: FilterType.SERVICE,
+ key: FILTER_FIELD.SERVICE,
labelCheckboxGroup: "Services",
values: uniqueServices,
index: 4,
},
{
- key: FilterType.RESOURCE_TYPE,
+ key: FILTER_FIELD.RESOURCE_TYPE,
labelCheckboxGroup: "Resource Type",
values: uniqueResourceTypes,
index: 8,
},
{
- key: FilterType.CATEGORY,
+ key: FILTER_FIELD.CATEGORY,
labelCheckboxGroup: "Category",
values: uniqueCategories,
labelFormatter: getCategoryLabel,
index: 5,
},
{
- key: FilterType.RESOURCE_GROUPS,
+ key: FILTER_FIELD.RESOURCE_GROUPS,
labelCheckboxGroup: "Resource Group",
values: uniqueGroups,
labelFormatter: getGroupLabel,
@@ -142,14 +150,14 @@ export const FindingsFilterBatchControls = ({
? []
: [
{
- key: FilterType.SCAN,
+ key: FILTER_FIELD.SCAN,
labelCheckboxGroup: "Scan ID",
values: completedScanIds,
width: "wide" as const,
valueLabelMapping: scanDetails,
labelFormatter: (value: string) =>
getFindingsFilterDisplayValue(
- `filter[${FilterType.SCAN}]`,
+ `filter[${FILTER_FIELD.SCAN}]`,
value,
{
providers,
@@ -167,6 +175,7 @@ export const FindingsFilterBatchControls = ({
appliedFilters,
{
providers,
+ providerGroups,
scans: scanDetails,
},
);
@@ -174,6 +183,7 @@ export const FindingsFilterBatchControls = ({
changedFilters,
{
providers,
+ providerGroups,
scans: scanDetails,
},
);
@@ -199,15 +209,26 @@ export const FindingsFilterBatchControls = ({
: undefined;
const providerAccountControls = (className: string) => (
- <ProviderAccountSelectors
- providers={providers}
- mode="batch"
- selectedProviderTypes={getFilterValue("filter[provider_type__in]")}
- selectedAccounts={getFilterValue("filter[provider_id__in]")}
- onBatchChange={setPending}
- providerSelectorClassName={className}
- accountSelectorClassName={className}
- />
+ <>
+ <ProviderAccountSelectors
+ providers={providers}
+ mode="batch"
+ selectedProviderTypes={getFilterValue("filter[provider_type__in]")}
+ selectedAccounts={getFilterValue("filter[provider_id__in]")}
+ onBatchChange={setPending}
+ providerSelectorClassName={className}
+ accountSelectorClassName={className}
+ />
+ {providerGroups !== undefined && (
+ <div className={className}>
+ <ProviderGroupSelector
+ groups={providerGroups}
+ selectedValues={getFilterValue("filter[provider_groups__in]")}
+ onBatchChange={setPending}
+ />
+ </div>
+ )}
+ </>
);
const alertEditFilterGrid = hasCustomFilters ? (
diff --git a/ui/components/findings/findings-filters.utils.test.ts b/ui/components/findings/findings-filters.utils.test.ts
index aa376f360d..69ce0605d2 100644
--- a/ui/components/findings/findings-filters.utils.test.ts
+++ b/ui/components/findings/findings-filters.utils.test.ts
@@ -1,5 +1,6 @@
import { describe, expect, it } from "vitest";
+import { ProviderGroup } from "@/types/components";
import { ProviderProps } from "@/types/providers";
import { ScanEntity } from "@/types/scans";
@@ -8,6 +9,19 @@ import {
getFindingsFilterDisplayValue,
} from "./findings-filters.utils";
+const providerGroups: ProviderGroup[] = [
+ {
+ type: "provider-groups",
+ id: "group-1",
+ attributes: { name: "Production", inserted_at: "", updated_at: "" },
+ relationships: {
+ providers: { meta: { count: 0 }, data: [] },
+ roles: { meta: { count: 0 }, data: [] },
+ },
+ links: { self: "" },
+ },
+];
+
function makeProvider(
overrides: Partial<ProviderProps> & { id: string },
): ProviderProps {
@@ -98,6 +112,24 @@ describe("getFindingsFilterDisplayValue", () => {
).toBe("missing-provider");
});
+ it("shows the provider group name for provider_groups filters instead of the raw group id", () => {
+ expect(
+ getFindingsFilterDisplayValue("filter[provider_groups__in]", "group-1", {
+ providerGroups,
+ }),
+ ).toBe("Production");
+ });
+
+ it("keeps the raw value when the provider group cannot be resolved", () => {
+ expect(
+ getFindingsFilterDisplayValue(
+ "filter[provider_groups__in]",
+ "missing-group",
+ { providerGroups },
+ ),
+ ).toBe("missing-group");
+ });
+
it("shows the resolved scan badge label for scan filters instead of formatting the raw scan id", () => {
expect(
getFindingsFilterDisplayValue("filter[scan__in]", "scan-1", { scans }),
@@ -230,6 +262,22 @@ describe("buildFindingsFilterChips", () => {
]);
});
+ it("labels provider group chips and resolves their names", () => {
+ const chips = buildFindingsFilterChips(
+ { "filter[provider_groups__in]": ["group-1"] },
+ { providerGroups },
+ );
+
+ expect(chips).toEqual([
+ {
+ key: "filter[provider_groups__in]",
+ label: "Provider Group",
+ value: "group-1",
+ displayValue: "Production",
+ },
+ ]);
+ });
+
it("treats filter[delta] and filter[delta__in] identically", () => {
// Given
const chipsSingular = buildFindingsFilterChips({
diff --git a/ui/components/findings/findings-filters.utils.ts b/ui/components/findings/findings-filters.utils.ts
index b2a935aec0..4cb9eef394 100644
--- a/ui/components/findings/findings-filters.utils.ts
+++ b/ui/components/findings/findings-filters.utils.ts
@@ -1,8 +1,12 @@
+import type { FindingsFilterParam } from "@/actions/findings/findings-filters";
import type { FilterChip } from "@/components/filters/filter-summary-strip";
import { formatLabel, getCategoryLabel, getGroupLabel } from "@/lib/categories";
-import { getScanEntityLabel } from "@/lib/helper-filters";
+import {
+ getProviderGroupDisplayValue,
+ getScanEntityLabel,
+} from "@/lib/helper-filters";
import { FINDING_STATUS_DISPLAY_NAMES } from "@/types";
-import { FilterParam } from "@/types/filters";
+import { ProviderGroup } from "@/types/components";
import { getProviderDisplayName, ProviderProps } from "@/types/providers";
import { ScanEntity } from "@/types/scans";
import { SEVERITY_DISPLAY_NAMES } from "@/types/severities";
@@ -10,6 +14,7 @@ import { SEVERITY_DISPLAY_NAMES } from "@/types/severities";
interface GetFindingsFilterDisplayValueOptions {
providers?: ProviderProps[];
scans?: Array<{ [scanId: string]: ScanEntity }>;
+ providerGroups?: ProviderGroup[];
}
const FINDING_DELTA_DISPLAY_NAMES: Record<string, string> = {
@@ -42,7 +47,7 @@ function getScanDisplayValue(
}
export function getFindingsFilterDisplayValue(
- filterKey: string,
+ filterKey: FindingsFilterParam,
value: string,
options: GetFindingsFilterDisplayValueOptions = {},
): string {
@@ -53,6 +58,9 @@ export function getFindingsFilterDisplayValue(
if (filterKey === "filter[provider_id__in]") {
return getProviderAccountDisplayValue(value, options.providers || []);
}
+ if (filterKey === "filter[provider_groups__in]") {
+ return getProviderGroupDisplayValue(value, options.providerGroups || []);
+ }
if (filterKey === "filter[scan__in]" || filterKey === "filter[scan]") {
return getScanDisplayValue(value, options.scans || []);
}
@@ -95,12 +103,14 @@ export function getFindingsFilterDisplayValue(
/**
* Maps raw filter param keys (e.g. "filter[severity__in]") to human-readable labels.
* Used to render chips in the FilterSummaryStrip.
- * Typed as Record<FilterParam, string> so TypeScript enforces exhaustiveness — any
- * addition to FilterParam will cause a compile error here if the label is missing.
+ * Typed as Record<FindingsFilterParam, string> so TypeScript enforces exhaustiveness
+ * — any addition to the findings filter set will cause a compile error here if the
+ * label is missing.
*/
-export const FILTER_KEY_LABELS: Record<FilterParam, string> = {
+export const FILTER_KEY_LABELS: Record<FindingsFilterParam, string> = {
"filter[provider_type__in]": "Provider",
"filter[provider_id__in]": "Account",
+ "filter[provider_groups__in]": "Provider Group",
"filter[severity__in]": "Severity",
"filter[status__in]": "Status",
"filter[delta__in]": "Delta",
@@ -115,12 +125,15 @@ export const FILTER_KEY_LABELS: Record<FilterParam, string> = {
"filter[scan_id]": "Scan",
"filter[scan_id__in]": "Scan",
"filter[inserted_at]": "Date",
+ "filter[inserted_at__gte]": "Date",
+ "filter[inserted_at__lte]": "Date",
"filter[muted]": "Muted",
};
interface BuildFindingsFilterChipsOptions {
providers?: ProviderProps[];
scans?: Array<{ [scanId: string]: ScanEntity }>;
+ providerGroups?: ProviderGroup[];
includeMuted?: boolean;
}
@@ -142,13 +155,13 @@ export function buildFindingsFilterChips(
Object.entries(pendingFilters).forEach(([key, values]) => {
if (!values || values.length === 0) return;
if (key === "filter[muted]" && !options.includeMuted) return;
- const label = FILTER_KEY_LABELS[key as FilterParam] ?? key;
+ const label = FILTER_KEY_LABELS[key as FindingsFilterParam] ?? key;
const visibleValues = values;
if (visibleValues.length === 0) return;
const displayValues = visibleValues.map((value) =>
- getFindingsFilterDisplayValue(key, value, options),
+ getFindingsFilterDisplayValue(key as FindingsFilterParam, value, options),
);
const chip: FilterChip = {
diff --git a/ui/components/findings/floating-mute-button.tsx b/ui/components/findings/floating-mute-button.tsx
index b6c779370e..68c0afa95e 100644
--- a/ui/components/findings/floating-mute-button.tsx
+++ b/ui/components/findings/floating-mute-button.tsx
@@ -2,6 +2,7 @@
import { VolumeX } from "lucide-react";
import { useState } from "react";
+import { createPortal } from "react-dom";
import { Button } from "@/components/shadcn";
import { Spinner } from "@/components/shadcn/spinner/spinner";
@@ -97,21 +98,29 @@ export function FloatingMuteButton({
preparationError={mutePreparationError}
/>
- <div className="animate-in fade-in slide-in-from-bottom-4 fixed right-6 bottom-6 z-50 duration-300">
- <Button
- onClick={handleClick}
- disabled={isResolving}
- size="lg"
- className="shadow-lg"
- >
- {isResolving ? (
- <Spinner className="size-5" />
- ) : (
- <VolumeX className="size-5" />
- )}
- {label ?? `Mute (${selectedCount})`}
- </Button>
- </div>
+ {/* Portaled to body: <main> is a layout container (container queries),
+ which would otherwise capture this fixed button and scroll it away
+ with the content. */}
+ {typeof document !== "undefined"
+ ? createPortal(
+ <div className="animate-in fade-in slide-in-from-bottom-4 fixed right-6 bottom-6 z-50 duration-300">
+ <Button
+ onClick={handleClick}
+ disabled={isResolving}
+ size="lg"
+ className="shadow-lg"
+ >
+ {isResolving ? (
+ <Spinner className="size-5" />
+ ) : (
+ <VolumeX className="size-5" />
+ )}
+ {label ?? `Mute (${selectedCount})`}
+ </Button>
+ </div>,
+ document.body,
+ )
+ : null}
</>
);
}
diff --git a/ui/components/findings/mute-findings-modal.test.tsx b/ui/components/findings/mute-findings-modal.test.tsx
index 7f323da7cc..d80305c473 100644
--- a/ui/components/findings/mute-findings-modal.test.tsx
+++ b/ui/components/findings/mute-findings-modal.test.tsx
@@ -12,7 +12,9 @@ vi.mock("@/actions/mute-rules", () => ({
createMuteRule: createMuteRuleMock,
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: toastMock }),
Button: ({
children,
...props
@@ -56,13 +58,7 @@ vi.mock("@/components/shadcn/spinner/spinner", () => ({
),
}));
-vi.mock("@/components/ui", () => ({
- useToast: () => ({
- toast: toastMock,
- }),
-}));
-
-vi.mock("@/components/ui/form", () => ({
+vi.mock("@/components/shadcn/form", () => ({
FormButtons: ({
onCancel,
submitText = "Save",
diff --git a/ui/components/findings/mute-findings-modal.tsx b/ui/components/findings/mute-findings-modal.tsx
index 999f0dead9..a46a0d8ab2 100644
--- a/ui/components/findings/mute-findings-modal.tsx
+++ b/ui/components/findings/mute-findings-modal.tsx
@@ -5,10 +5,10 @@ import { Dispatch, SetStateAction, useState } from "react";
import { createMuteRule } from "@/actions/mute-rules";
import { MuteRuleActionState } from "@/actions/mute-rules/types";
import { Button, Input, Textarea } from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
+import { Label } from "@/components/shadcn/form/Label";
import { Modal } from "@/components/shadcn/modal";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-import { FormButtons } from "@/components/ui/form";
-import { Label } from "@/components/ui/form/Label";
import { useMuteRuleAction } from "@/hooks/use-mute-rule-action";
import {
enforceMuteRuleNameLimit,
diff --git a/ui/components/findings/send-to-jira-modal.tsx b/ui/components/findings/send-to-jira-modal.tsx
index cee45c9464..aa6774da45 100644
--- a/ui/components/findings/send-to-jira-modal.tsx
+++ b/ui/components/findings/send-to-jira-modal.tsx
@@ -12,13 +12,13 @@ import {
pollJiraDispatchTask,
sendFindingToJira,
} from "@/actions/integrations/jira-dispatch";
+import { useToast } from "@/components/shadcn";
+import { CustomBanner } from "@/components/shadcn/custom/custom-banner";
+import { Form, FormField, FormMessage } from "@/components/shadcn/form";
+import { FormButtons } from "@/components/shadcn/form/form-buttons";
import { Modal } from "@/components/shadcn/modal";
import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-import { useToast } from "@/components/ui";
-import { CustomBanner } from "@/components/ui/custom/custom-banner";
-import { Form, FormField, FormMessage } from "@/components/ui/form";
-import { FormButtons } from "@/components/ui/form/form-buttons";
import { IntegrationProps } from "@/types/integrations";
interface SendToJiraModalProps {
diff --git a/ui/components/findings/table/column-finding-groups.test.tsx b/ui/components/findings/table/column-finding-groups.test.tsx
index eefbcb5a45..ca6e01bb7b 100644
--- a/ui/components/findings/table/column-finding-groups.test.tsx
+++ b/ui/components/findings/table/column-finding-groups.test.tsx
@@ -18,7 +18,11 @@ vi.mock("next/navigation", () => ({
useSearchParams: () => new URLSearchParams(),
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ Button: ({ children, ...props }: { children: ReactNode }) => (
+ <button {...props}>{children}</button>
+ ),
Checkbox: ({
"aria-label": ariaLabel,
onCheckedChange,
@@ -35,9 +39,12 @@ vi.mock("@/components/shadcn", () => ({
{...props}
/>
),
+ Textarea: (props: InputHTMLAttributes<HTMLTextAreaElement>) => (
+ <textarea {...props} />
+ ),
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTableColumnHeader: ({
title,
}: {
@@ -78,6 +85,44 @@ vi.mock("./notification-indicator", () => ({
},
}));
+vi.mock("@/components/shadcn/modal", () => ({
+ Modal: ({
+ children,
+ open,
+ title,
+ }: {
+ children: ReactNode;
+ open: boolean;
+ title?: string;
+ }) =>
+ open ? (
+ <div role="dialog" aria-label={title}>
+ {children}
+ </div>
+ ) : null,
+}));
+
+vi.mock("@/components/shadcn/select/select", () => ({
+ Select: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectContent: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ SelectItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectTrigger: ({
+ children,
+ disabled,
+ "aria-label": ariaLabel,
+ }: {
+ children: ReactNode;
+ disabled?: boolean;
+ "aria-label"?: string;
+ }) => (
+ <button aria-label={ariaLabel} disabled={disabled}>
+ {children}
+ </button>
+ ),
+}));
+
vi.mock("@/components/shadcn/tooltip", () => ({
Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
TooltipContent: ({ children }: { children: ReactNode }) => <>{children}</>,
@@ -248,7 +293,7 @@ function renderSelectCell(overrides?: Partial<FindingGroupRow>) {
// ---------------------------------------------------------------------------
describe("column-finding-groups — accessibility of check title cell", () => {
- it("should not expose an impacted providers column", () => {
+ it("should not expose triage and notes columns on group-level rows", () => {
// Given
const columns = getColumnFindingGroups({
rowSelection: {},
@@ -257,12 +302,16 @@ describe("column-finding-groups — accessibility of check title cell", () => {
});
// When
- const impactedProvidersColumn = columns.find(
- (col) => (col as { id?: string }).id === "impactedProviders",
+ const columnIds = columns.map(
+ (column) =>
+ (column as { id?: string; accessorKey?: string }).id ??
+ (column as { id?: string; accessorKey?: string }).accessorKey,
);
// Then
- expect(impactedProvidersColumn).toBeUndefined();
+ expect(columnIds).not.toContain("triage");
+ expect(columnIds).not.toContain("notes");
+ expect(columnIds.at(-1)).toBe("actions");
});
it("should render the first provider icon with its provider name", () => {
@@ -290,22 +339,6 @@ describe("column-finding-groups — accessibility of check title cell", () => {
expect(button.tagName.toLowerCase()).toBe("button");
});
- it("should NOT render the check title as a <p> element", () => {
- // Given
- const onDrillDown =
- vi.fn<(checkId: string, group: FindingGroupRow) => void>();
-
- // When
- renderFindingCell("S3 Bucket Public Access", onDrillDown);
-
- // Then — <p> should not exist as the interactive element
- const paragraphs = document.querySelectorAll("p");
- const clickableParagraph = Array.from(paragraphs).find(
- (p) => p.textContent === "S3 Bucket Public Access",
- );
- expect(clickableParagraph).toBeUndefined();
- });
-
it("should call onDrillDown when the button is clicked", async () => {
// Given
const onDrillDown =
@@ -328,23 +361,6 @@ describe("column-finding-groups — accessibility of check title cell", () => {
);
});
- it("should call onDrillDown when Enter key is pressed on the button", async () => {
- // Given
- const onDrillDown =
- vi.fn<(checkId: string, group: FindingGroupRow) => void>();
- const user = userEvent.setup();
-
- renderFindingCell("My Check Title", onDrillDown);
-
- // When — tab to button and press Enter
- const button = screen.getByRole("button", { name: "My Check Title" });
- button.focus();
- await user.keyboard("{Enter}");
-
- // Then — native button handles Enter natively
- expect(onDrillDown).toHaveBeenCalledTimes(1);
- });
-
it("should allow expanding a group that only has PASS resources", async () => {
// Given
const user = userEvent.setup();
@@ -393,29 +409,11 @@ describe("column-finding-groups — accessibility of check title cell", () => {
expect(
screen.queryByRole("button", { name: "Fallback IaC Check" }),
).not.toBeInTheDocument();
- expect(screen.getByText("Fallback IaC Check")).toBeInTheDocument();
+ // The title renders as plain (non-clickable) text and the inline-mocked
+ // tooltip duplicates it, so exactly both copies must exist.
+ expect(screen.getAllByText("Fallback IaC Check")).toHaveLength(2);
expect(onDrillDown).not.toHaveBeenCalled();
});
-
- it("should keep fallback groups non-clickable when the displayed total is zero", () => {
- // Given
- const onDrillDown =
- vi.fn<(checkId: string, group: FindingGroupRow) => void>();
-
- // When
- renderFindingCell("No failing findings", onDrillDown, {
- resourcesTotal: 0,
- resourcesFail: 0,
- failCount: 0,
- passCount: 0,
- });
-
- // Then
- expect(
- screen.queryByRole("button", { name: "No failing findings" }),
- ).not.toBeInTheDocument();
- expect(screen.getByText("No failing findings")).toBeInTheDocument();
- });
});
describe("column-finding-groups — impacted resources count", () => {
@@ -490,23 +488,6 @@ describe("column-finding-groups — group selection", () => {
).not.toBeInTheDocument();
expect(onDrillDown).not.toHaveBeenCalled();
});
-
- it("should hide the chevron for zero-resource groups when the displayed total is zero", () => {
- // Given/When
- renderSelectCell({
- resourcesTotal: 0,
- resourcesFail: 0,
- failCount: 0,
- passCount: 0,
- });
-
- // Then
- expect(
- screen.queryByRole("button", {
- name: "Expand S3 Bucket Public Access",
- }),
- ).not.toBeInTheDocument();
- });
});
describe("column-finding-groups — indicators", () => {
diff --git a/ui/components/findings/table/column-finding-groups.tsx b/ui/components/findings/table/column-finding-groups.tsx
index 79b584edcc..e5cd81cb4d 100644
--- a/ui/components/findings/table/column-finding-groups.tsx
+++ b/ui/components/findings/table/column-finding-groups.tsx
@@ -4,16 +4,16 @@ import { ColumnDef, RowSelectionState } from "@tanstack/react-table";
import { ChevronRight } from "lucide-react";
import { Checkbox } from "@/components/shadcn";
+import {
+ DataTableColumnHeader,
+ SeverityBadge,
+ StatusFindingBadge,
+} from "@/components/shadcn/table";
import {
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn/tooltip";
-import {
- DataTableColumnHeader,
- SeverityBadge,
- StatusFindingBadge,
-} from "@/components/ui/table";
import { cn } from "@/lib";
import {
canDrillDownFindingGroup,
@@ -199,20 +199,29 @@ export function getColumnFindingGroups({
<TooltipContent side="top">{providerName}</TooltipContent>
</Tooltip>
) : null}
- <div>
- {canExpand ? (
- <button
- type="button"
- className="text-text-neutral-primary hover:text-button-tertiary w-full cursor-pointer border-none bg-transparent p-0 text-left text-sm break-words whitespace-normal hover:underline"
- onClick={() => onDrillDown(group.checkId, group)}
- >
+ {/* Single line always: min room to stay readable, ellipsis beyond
+ the max, full title in the tooltip. */}
+ <div className="min-w-0">
+ <Tooltip>
+ <TooltipTrigger asChild>
+ {canExpand ? (
+ <button
+ type="button"
+ className="text-text-neutral-primary hover:text-button-tertiary block max-w-[500px] min-w-[120px] cursor-pointer truncate border-none bg-transparent p-0 text-left text-sm hover:underline"
+ onClick={() => onDrillDown(group.checkId, group)}
+ >
+ {group.checkTitle}
+ </button>
+ ) : (
+ <span className="text-text-neutral-primary block max-w-[500px] min-w-[120px] truncate text-left text-sm">
+ {group.checkTitle}
+ </span>
+ )}
+ </TooltipTrigger>
+ <TooltipContent side="top" maxWidth="md">
{group.checkTitle}
- </button>
- ) : (
- <span className="text-text-neutral-primary w-full text-left text-sm break-words whitespace-normal">
- {group.checkTitle}
- </span>
- )}
+ </TooltipContent>
+ </Tooltip>
</div>
</div>
);
diff --git a/ui/components/findings/table/column-finding-resources.test.tsx b/ui/components/findings/table/column-finding-resources.test.tsx
index 38a2b4bb20..877d83c186 100644
--- a/ui/components/findings/table/column-finding-resources.test.tsx
+++ b/ui/components/findings/table/column-finding-resources.test.tsx
@@ -1,9 +1,24 @@
import { render, screen } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
-import type { InputHTMLAttributes, ReactNode } from "react";
+import type {
+ ButtonHTMLAttributes,
+ InputHTMLAttributes,
+ ReactNode,
+} from "react";
import { describe, expect, it, vi } from "vitest";
-vi.mock("@/components/shadcn", () => ({
+// CustomLink pulls the "@/lib" barrel (and next-auth with it) into the unit env.
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
+ CustomLink: ({ href, children }: { href: string; children: ReactNode }) => (
+ <a href={href}>{children}</a>
+ ),
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ Button: ({ children, ...props }: ButtonHTMLAttributes<HTMLButtonElement>) => (
+ <button {...props}>{children}</button>
+ ),
Checkbox: ({
"aria-label": ariaLabel,
onCheckedChange,
@@ -66,18 +81,68 @@ vi.mock("@/components/shadcn/dropdown", () => ({
}));
vi.mock("@/components/shadcn/info-field/info-field", () => ({
- InfoField: () => null,
+ InfoField: ({
+ children,
+ label,
+ }: {
+ children: ReactNode;
+ label: string;
+ variant?: string;
+ }) => (
+ <div>
+ <span>{label}</span>
+ <div>{children}</div>
+ </div>
+ ),
}));
vi.mock("@/components/shadcn/spinner/spinner", () => ({
Spinner: () => null,
}));
-vi.mock("@/components/ui/entities", () => ({
- DateWithTime: () => null,
+vi.mock("@/components/shadcn/select/select", () => ({
+ Select: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectContent: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ SelectItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectTrigger: ({
+ children,
+ disabled,
+ "aria-label": ariaLabel,
+ }: {
+ children: ReactNode;
+ disabled?: boolean;
+ "aria-label"?: string;
+ }) => (
+ <button aria-label={ariaLabel} disabled={disabled}>
+ {children}
+ </button>
+ ),
+ SelectValue: ({ children }: { children?: ReactNode }) => (
+ <span>{children}</span>
+ ),
}));
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/tooltip", () => ({
+ Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
+ TooltipContent: ({ children }: { children: ReactNode }) => (
+ <span>{children}</span>
+ ),
+ TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+}));
+
+vi.mock("@/components/shadcn/entities", () => ({
+ DateWithTime: ({
+ dateTime,
+ inline,
+ }: {
+ dateTime: string | null;
+ inline?: boolean;
+ }) => <time data-inline={inline ? "true" : "false"}>{dateTime ?? "-"}</time>,
+}));
+
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: ({
entityAlias,
entityId,
@@ -92,17 +157,17 @@ vi.mock("@/components/ui/entities/entity-info", () => ({
),
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
SeverityBadge: ({ severity }: { severity: string }) => (
<span>{severity}</span>
),
}));
-vi.mock("@/components/ui/table/data-table-column-header", () => ({
+vi.mock("@/components/shadcn/table/data-table-column-header", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
}));
-vi.mock("@/components/ui/table/status-finding-badge", () => ({
+vi.mock("@/components/shadcn/table/status-finding-badge", () => ({
StatusFindingBadge: ({ status }: { status: string }) => <span>{status}</span>,
}));
@@ -120,8 +185,35 @@ vi.mock("./notification-indicator", () => ({
}));
import type { FindingResourceRow } from "@/types";
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
import { getColumnFindingResources } from "./column-finding-resources";
+import {
+ CLOUD_ONLY_TOOLTIP_COPY,
+ EDITING_UNAVAILABLE_COPY,
+} from "./finding-triage-cells";
+
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
function makeResource(
overrides?: Partial<FindingResourceRow>,
@@ -150,78 +242,235 @@ function makeResource(
};
}
-describe("column-finding-resources", () => {
- it("should pass delta to NotificationIndicator for resource rows", () => {
- const columns = getColumnFindingResources({
- rowSelection: {},
- selectableRowCount: 1,
- });
+function getColumnIds(columns: ReturnType<typeof getColumnFindingResources>) {
+ return columns.map(
+ (column) =>
+ (column as { id?: string; accessorKey?: string }).id ??
+ (column as { id?: string; accessorKey?: string }).accessorKey,
+ );
+}
- const selectColumn = columns.find(
- (col) => (col as { id?: string }).id === "select",
- );
- if (!selectColumn?.cell) {
- throw new Error("select column not found");
- }
-
- const CellComponent = selectColumn.cell as (props: {
- row: {
- id: string;
- original: FindingResourceRow;
- toggleSelected: (selected: boolean) => void;
- };
- }) => ReactNode;
-
- render(
- <div>
- {CellComponent({
- row: {
- id: "0",
- original: makeResource(),
- toggleSelected: vi.fn(),
- },
- })}
- </div>,
- );
-
- expect(screen.getByLabelText("Select resource")).toBeInTheDocument();
- expect(notificationIndicatorMock).toHaveBeenCalledWith(
- expect.objectContaining({
- delta: "new",
- isMuted: false,
- }),
- );
+function renderResourceActionsCell({
+ resource = makeResource(),
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
+}: {
+ resource?: FindingResourceRow;
+ onTriageUpdateAction?: Parameters<
+ typeof getColumnFindingResources
+ >[0]["onTriageUpdateAction"];
+ onTriageNoteLoadAction?: Parameters<
+ typeof getColumnFindingResources
+ >[0]["onTriageNoteLoadAction"];
+} = {}) {
+ const columns = getColumnFindingResources({
+ rowSelection: {},
+ selectableRowCount: 1,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
});
- it("should render the resource EntityInfo with resourceName as alias", () => {
+ const actionsColumn = columns.find(
+ (col) => (col as { id?: string }).id === "actions",
+ );
+ if (!actionsColumn?.cell) {
+ throw new Error("actions column not found");
+ }
+ const CellComponent = actionsColumn.cell as (props: {
+ row: { original: FindingResourceRow };
+ }) => ReactNode;
+
+ render(<div>{CellComponent({ row: { original: resource } })}</div>);
+}
+
+describe("column-finding-resources", () => {
+ it("should render actions as the last visible column after Triage without Notes", () => {
+ // Given
const columns = getColumnFindingResources({
rowSelection: {},
selectableRowCount: 1,
});
- const resourceColumn = columns.find(
- (col) => (col as { id?: string }).id === "resource",
- );
- if (!resourceColumn?.cell) {
- throw new Error("resource column not found");
- }
+ // When
+ const columnIds = getColumnIds(columns);
- const CellComponent = resourceColumn.cell as (props: {
+ // Then
+ expect(columnIds.slice(-2)).toEqual(["triage", "actions"]);
+ expect(columnIds).not.toContain("notes");
+ expect(
+ (columns.at(-1) as { id?: string; size?: number } | undefined)?.size,
+ ).toBe(56);
+ });
+
+ it("should render Open note in resource actions without exposing note preview metadata", () => {
+ // Given
+ renderResourceActionsCell({
+ resource: makeResource({
+ triage: makeTriageSummary({ hasVisibleNote: true }),
+ }),
+ onTriageUpdateAction: vi.fn(),
+ onTriageNoteLoadAction: vi.fn(),
+ });
+
+ // Then
+ expect(screen.getByRole("button", { name: "Open note" })).toBeEnabled();
+ expect(screen.queryByText("Sensitive note body")).not.toBeInTheDocument();
+ expect(screen.queryByText(/author/i)).not.toBeInTheDocument();
+ expect(screen.queryByText(/timestamp/i)).not.toBeInTheDocument();
+ });
+
+ it("should disable Add Triage Note when no update handler is wired", () => {
+ // Given
+ renderResourceActionsCell({
+ resource: makeResource({
+ triage: makeTriageSummary({ hasVisibleNote: false }),
+ }),
+ });
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeDisabled();
+ });
+
+ it("should enable Add Triage Note when an update handler is wired", () => {
+ // Given
+ renderResourceActionsCell({
+ resource: makeResource({
+ triage: makeTriageSummary({ hasVisibleNote: false }),
+ }),
+ onTriageUpdateAction: vi.fn(),
+ });
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeEnabled();
+ });
+
+ it("should enable Add Triage Note for Cloud-only rows so users can open the billing upsell modal", () => {
+ // Given
+ renderResourceActionsCell({
+ resource: makeResource({
+ triage: makeTriageSummary({
+ canEdit: false,
+ hasVisibleNote: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ }),
+ }),
+ });
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeEnabled();
+ });
+
+ it("should disable editable triage control when no update handler is wired", () => {
+ // Given
+ const columns = getColumnFindingResources({
+ rowSelection: {},
+ selectableRowCount: 1,
+ });
+ const triageColumn = columns.find(
+ (col) => (col as { id?: string }).id === "triage",
+ );
+ if (!triageColumn?.cell) {
+ throw new Error("triage column not found");
+ }
+ const CellComponent = triageColumn.cell as (props: {
row: { original: FindingResourceRow };
}) => ReactNode;
+ // When
render(
<div>
{CellComponent({
row: {
- original: makeResource(),
+ original: makeResource({
+ triage: makeTriageSummary({ canEdit: true }),
+ }),
},
})}
</div>,
);
- expect(screen.getByText("my-bucket")).toBeInTheDocument();
- expect(screen.getByText("arn:aws:s3:::my-bucket")).toBeInTheDocument();
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Triage status" }),
+ ).toBeDisabled();
+ expect(screen.getByText(EDITING_UNAVAILABLE_COPY)).toBeInTheDocument();
+ });
+
+ it("should keep the compact Triage label on resource cells for headerless nested rows", () => {
+ // Given
+ const columns = getColumnFindingResources({
+ rowSelection: {},
+ selectableRowCount: 1,
+ });
+ const triageColumn = columns.find(
+ (col) => (col as { id?: string }).id === "triage",
+ );
+ if (!triageColumn?.cell) {
+ throw new Error("triage column not found");
+ }
+ const CellComponent = triageColumn.cell as (props: {
+ row: { original: FindingResourceRow };
+ }) => ReactNode;
+
+ // When
+ render(
+ <div>
+ {CellComponent({
+ row: {
+ original: makeResource({ triage: makeTriageSummary() }),
+ },
+ })}
+ </div>,
+ );
+
+ // Then — expanded finding-group rows render without a header row, so the
+ // cell itself must carry the label, like Service/Region/Last seen do.
+ expect(screen.getByText("Triage")).toBeInTheDocument();
+ });
+
+ it("should disable non-paying Cloud triage control with only-in-Cloud tooltip copy", () => {
+ // Given
+ const columns = getColumnFindingResources({
+ rowSelection: {},
+ selectableRowCount: 1,
+ });
+ const triageColumn = columns.find(
+ (col) => (col as { id?: string }).id === "triage",
+ );
+ if (!triageColumn?.cell) {
+ throw new Error("triage column not found");
+ }
+ const CellComponent = triageColumn.cell as (props: {
+ row: { original: FindingResourceRow };
+ }) => ReactNode;
+
+ // When
+ render(
+ <div>
+ {CellComponent({
+ row: {
+ original: makeResource({
+ triage: makeTriageSummary({
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ }),
+ }),
+ },
+ })}
+ </div>,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Triage status" }),
+ ).toBeDisabled();
+ expect(screen.getByText(CLOUD_ONLY_TOOLTIP_COPY)).toBeInTheDocument();
});
it("should open Send to Jira modal with finding UUID directly", async () => {
diff --git a/ui/components/findings/table/column-finding-resources.tsx b/ui/components/findings/table/column-finding-resources.tsx
index 5789b8a96b..255abea929 100644
--- a/ui/components/findings/table/column-finding-resources.tsx
+++ b/ui/components/findings/table/column-finding-resources.tsx
@@ -12,27 +12,48 @@ import {
ActionDropdown,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import { InfoField } from "@/components/shadcn/info-field/info-field";
import { Spinner } from "@/components/shadcn/spinner/spinner";
-import { DateWithTime } from "@/components/ui/entities";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
-import { SeverityBadge } from "@/components/ui/table";
-import { DataTableColumnHeader } from "@/components/ui/table/data-table-column-header";
+import { SeverityBadge } from "@/components/shadcn/table";
+import { DataTableColumnHeader } from "@/components/shadcn/table/data-table-column-header";
import {
type FindingStatus,
StatusFindingBadge,
-} from "@/components/ui/table/status-finding-badge";
+} from "@/components/shadcn/table/status-finding-badge";
import { getFailingForLabel } from "@/lib/date-utils";
import { FindingResourceRow } from "@/types";
+import type {
+ FindingTriageLoadedNote,
+ FindingTriageSummary,
+} from "@/types/findings-triage";
import { canMuteFindingResource } from "./finding-resource-selection";
+import {
+ FindingNoteActionItem,
+ FindingTriageStatusCell,
+} from "./finding-triage-cells";
+import type { FindingTriageUpdateHandler } from "./finding-triage-status-control";
import { FindingsSelectionContext } from "./findings-selection-context";
import {
type DeltaType,
NotificationIndicator,
} from "./notification-indicator";
-const ResourceRowActions = ({ row }: { row: Row<FindingResourceRow> }) => {
+const ResourceRowActions = ({
+ row,
+ findingTitle,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
+}: {
+ row: Row<FindingResourceRow>;
+ findingTitle?: string;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
+}) => {
const resource = row.original;
const canMute = canMuteFindingResource(resource);
const [isMuteModalOpen, setIsMuteModalOpen] = useState(false);
@@ -113,6 +134,17 @@ const ResourceRowActions = ({ row }: { row: Row<FindingResourceRow> }) => {
onClick={(e) => e.stopPropagation()}
>
<ActionDropdown ariaLabel="Resource actions">
+ <FindingNoteActionItem
+ triage={resource.triage}
+ findingContext={{
+ title: findingTitle || resource.checkId,
+ resource: resource.resourceName,
+ provider: resource.providerAlias,
+ providerType: resource.providerType,
+ }}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
<ActionDropdownItem
icon={
resource.isMuted ? (
@@ -141,11 +173,19 @@ const ResourceRowActions = ({ row }: { row: Row<FindingResourceRow> }) => {
interface GetColumnFindingResourcesOptions {
rowSelection: RowSelectionState;
selectableRowCount: number;
+ findingTitle?: string;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
}
export function getColumnFindingResources({
rowSelection,
selectableRowCount,
+ findingTitle,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
}: GetColumnFindingResourcesOptions): ColumnDef<FindingResourceRow>[] {
const selectedCount = Object.values(rowSelection).filter(Boolean).length;
const isAllSelected =
@@ -278,7 +318,9 @@ export function getColumnFindingResources({
),
cell: ({ row }) => (
<InfoField label="Region" variant="compact">
- {row.original.region || "-"}
+ <span className="block truncate whitespace-nowrap">
+ {row.original.region || "-"}
+ </span>
</InfoField>
),
enableSorting: false,
@@ -291,7 +333,7 @@ export function getColumnFindingResources({
),
cell: ({ row }) => (
<InfoField label="Last seen" variant="compact">
- <DateWithTime dateTime={row.original.lastSeenAt} inline />
+ <DateWithTime dateTime={row.original.lastSeenAt} />
</InfoField>
),
enableSorting: false,
@@ -312,11 +354,36 @@ export function getColumnFindingResources({
},
enableSorting: false,
},
- // Actions column — mute only
+ // Triage — keep the compact label: these cells also render inside
+ // expanded finding-group rows, which have no header row of their own.
+ {
+ id: "triage",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Triage" />
+ ),
+ cell: ({ row }) => (
+ <InfoField label="Triage" variant="compact">
+ <FindingTriageStatusCell
+ triage={row.original.triage}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />
+ </InfoField>
+ ),
+ enableSorting: false,
+ },
+ // Actions column — utility actions are kept last.
{
id: "actions",
+ size: 56,
header: () => <div className="w-10" />,
- cell: ({ row }) => <ResourceRowActions row={row} />,
+ cell: ({ row }) => (
+ <ResourceRowActions
+ row={row}
+ findingTitle={findingTitle}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
+ ),
enableSorting: false,
},
];
diff --git a/ui/components/findings/table/column-standalone-findings.test.tsx b/ui/components/findings/table/column-standalone-findings.test.tsx
new file mode 100644
index 0000000000..fdd7ec0c3e
--- /dev/null
+++ b/ui/components/findings/table/column-standalone-findings.test.tsx
@@ -0,0 +1,132 @@
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("next/navigation", () => ({
+ useRouter: () => ({ refresh: vi.fn() }),
+}));
+
+// CustomLink pulls the "@/lib" barrel (and next-auth with it) into the unit env.
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
+ CustomLink: ({ href, children }: { href: string; children: ReactNode }) => (
+ <a href={href}>{children}</a>
+ ),
+}));
+
+vi.mock("@/components/findings/mute-findings-modal", () => ({
+ MuteFindingsModal: () => null,
+}));
+
+vi.mock("@/components/findings/send-to-jira-modal", () => ({
+ SendToJiraModal: () => null,
+}));
+
+vi.mock("@/components/icons/services/IconServices", () => ({
+ JiraIcon: () => null,
+}));
+
+vi.mock("@/components/shadcn/dropdown", () => ({
+ ActionDropdown: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ ActionDropdownItem: ({
+ label,
+ onSelect,
+ disabled,
+ }: {
+ label: string;
+ onSelect?: () => void;
+ disabled?: boolean;
+ }) => (
+ <button disabled={disabled} onClick={onSelect}>
+ {label}
+ </button>
+ ),
+}));
+
+vi.mock("@/components/shadcn/spinner/spinner", () => ({
+ Spinner: () => null,
+}));
+
+vi.mock("@/components/shadcn/entities", () => ({
+ DateWithTime: ({ dateTime }: { dateTime: string | null }) => (
+ <time>{dateTime ?? "-"}</time>
+ ),
+ EntityInfo: () => null,
+}));
+
+vi.mock("@/components/shadcn/table", () => ({
+ DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
+ SeverityBadge: ({ severity }: { severity: string }) => (
+ <span>{severity}</span>
+ ),
+ StatusFindingBadge: ({ status }: { status: string }) => <span>{status}</span>,
+}));
+
+vi.mock("@/components/shadcn/select/select", () => ({
+ Select: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectContent: ({ children }: { children: ReactNode }) => (
+ <div>{children}</div>
+ ),
+ SelectItem: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+ SelectTrigger: ({
+ children,
+ disabled,
+ "aria-label": ariaLabel,
+ }: {
+ children: ReactNode;
+ disabled?: boolean;
+ "aria-label"?: string;
+ }) => (
+ <button aria-label={ariaLabel} disabled={disabled}>
+ {children}
+ </button>
+ ),
+}));
+
+vi.mock("@/components/shadcn/tooltip", () => ({
+ Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
+ TooltipContent: ({ children }: { children: ReactNode }) => (
+ <span>{children}</span>
+ ),
+ TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+}));
+
+vi.mock("@/lib/region-flags", () => ({
+ getRegionFlag: () => "",
+}));
+
+vi.mock("./finding-detail-drawer", () => ({
+ FindingDetailDrawer: ({ trigger }: { trigger: ReactNode }) => <>{trigger}</>,
+}));
+
+vi.mock("./notification-indicator", () => ({
+ DeltaValues: { NEW: "new", CHANGED: "changed", NONE: "none" },
+ NotificationIndicator: () => null,
+}));
+
+vi.mock("./provider-icon-cell", () => ({
+ ProviderIconCell: () => null,
+}));
+
+import { getStandaloneFindingColumns } from "./column-standalone-findings";
+
+describe("column-standalone-findings", () => {
+ it("should render Triage and Actions as the last visible data columns without Notes", () => {
+ // Given
+ const columns = getStandaloneFindingColumns({ includeUpdatedAt: true });
+
+ // When
+ const columnIds = columns.map(
+ (column) =>
+ (column as { id?: string; accessorKey?: string }).id ??
+ (column as { id?: string; accessorKey?: string }).accessorKey,
+ );
+
+ // Then
+ expect(columnIds.slice(-2)).toEqual(["triage", "actions"]);
+ expect(columnIds).not.toContain("notes");
+ expect(
+ (columns.at(-1) as { id?: string; size?: number } | undefined)?.size,
+ ).toBe(56);
+ });
+});
diff --git a/ui/components/findings/table/column-standalone-findings.tsx b/ui/components/findings/table/column-standalone-findings.tsx
index 0f457140f1..30facaf97f 100644
--- a/ui/components/findings/table/column-standalone-findings.tsx
+++ b/ui/components/findings/table/column-standalone-findings.tsx
@@ -3,22 +3,39 @@
import { ColumnDef } from "@tanstack/react-table";
import { Container } from "lucide-react";
-import { DateWithTime, EntityInfo } from "@/components/ui/entities";
+import { DateWithTime, EntityInfo } from "@/components/shadcn/entities";
import {
DataTableColumnHeader,
SeverityBadge,
StatusFindingBadge,
-} from "@/components/ui/table";
+} from "@/components/shadcn/table";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
import { getRegionFlag } from "@/lib/region-flags";
+import { getOptionalText } from "@/lib/utils";
import { FindingProps, ProviderType } from "@/types";
+import type {
+ FindingTriageLoadedNote,
+ FindingTriageSummary,
+} from "@/types/findings-triage";
+import { DataTableRowActions } from "./data-table-row-actions";
import { FindingDetailDrawer } from "./finding-detail-drawer";
+import { FindingTriageStatusCell } from "./finding-triage-cells";
+import type { FindingTriageUpdateHandler } from "./finding-triage-status-control";
import { DeltaValues, NotificationIndicator } from "./notification-indicator";
import { ProviderIconCell } from "./provider-icon-cell";
interface GetStandaloneFindingColumnsOptions {
includeUpdatedAt?: boolean;
openFindingId?: string | null;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
}
const getFindingsData = (row: { original: FindingProps }) => {
@@ -55,11 +72,17 @@ function FindingTitleCell({
finding={finding}
defaultOpen={defaultOpen}
trigger={
- <div className="max-w-[500px]">
- <p className="text-text-neutral-primary hover:text-button-tertiary cursor-pointer text-left text-sm break-words whitespace-normal hover:underline">
+ // Single line always: ellipsis beyond the max, full title in the tooltip.
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <p className="text-text-neutral-primary hover:text-button-tertiary max-w-[500px] min-w-[120px] cursor-pointer truncate text-left text-sm hover:underline">
+ {finding.attributes.check_metadata.checktitle}
+ </p>
+ </TooltipTrigger>
+ <TooltipContent side="top" maxWidth="md">
{finding.attributes.check_metadata.checktitle}
- </p>
- </div>
+ </TooltipContent>
+ </Tooltip>
}
/>
);
@@ -68,6 +91,8 @@ function FindingTitleCell({
export function getStandaloneFindingColumns({
includeUpdatedAt = false,
openFindingId = null,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
}: GetStandaloneFindingColumnsOptions = {}): ColumnDef<FindingProps>[] {
const columns: ColumnDef<FindingProps>[] = [
{
@@ -129,14 +154,8 @@ export function getStandaloneFindingColumns({
cell: ({ row }) => {
const name = getResourceData(row, "name");
const uid = getResourceData(row, "uid");
- const entityAlias =
- typeof name === "string" && name.trim().length > 0 && name !== "-"
- ? name
- : undefined;
- const entityId =
- typeof uid === "string" && uid.trim().length > 0 && uid !== "-"
- ? uid
- : undefined;
+ const entityAlias = getOptionalText(name);
+ const entityId = getOptionalText(uid);
return (
<div className="max-w-[240px]">
@@ -209,7 +228,7 @@ export function getStandaloneFindingColumns({
const regionFlag =
typeof region === "string" ? getRegionFlag(region) : "";
return (
- <span className="text-text-neutral-primary flex max-w-[140px] items-center gap-1.5 truncate text-sm">
+ <span className="text-text-neutral-primary flex max-w-[140px] min-w-0 items-center gap-1.5 truncate text-sm whitespace-nowrap">
{regionFlag && (
<span className="translate-y-px text-base leading-none">
{regionFlag}
@@ -242,5 +261,48 @@ export function getStandaloneFindingColumns({
});
}
+ columns.push(
+ {
+ id: "triage",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Triage" />
+ ),
+ cell: ({ row }) => (
+ <FindingTriageStatusCell
+ triage={row.original.triage}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />
+ ),
+ enableSorting: false,
+ },
+ {
+ id: "actions",
+ size: 56,
+ header: () => <div className="w-10" />,
+ cell: ({ row }) => {
+ const resourceName = getResourceData(row, "name");
+ const providerAlias = getProviderData(row, "alias");
+ const providerType = getProviderData(row, "provider");
+
+ return (
+ <DataTableRowActions
+ row={row}
+ findingContext={{
+ title: row.original.attributes.check_metadata.checktitle,
+ resource: getOptionalText(resourceName),
+ provider: getOptionalText(providerAlias),
+ providerType: getOptionalText(providerType) as
+ | ProviderType
+ | undefined,
+ }}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
+ );
+ },
+ enableSorting: false,
+ },
+ );
+
return columns;
}
diff --git a/ui/components/findings/table/data-table-row-actions.test.tsx b/ui/components/findings/table/data-table-row-actions.test.tsx
index 5df6a95df0..5f63d640b9 100644
--- a/ui/components/findings/table/data-table-row-actions.test.tsx
+++ b/ui/components/findings/table/data-table-row-actions.test.tsx
@@ -32,7 +32,7 @@ vi.mock("@/components/shadcn/dropdown", () => ({
disabled,
}: {
label: string;
- onSelect: () => void;
+ onSelect?: () => void;
disabled?: boolean;
}) => (
<button onClick={onSelect} disabled={disabled}>
@@ -45,7 +45,45 @@ vi.mock("@/components/shadcn/spinner/spinner", () => ({
Spinner: () => <span>Loading</span>,
}));
-import { DataTableRowActions } from "./data-table-row-actions";
+vi.mock("./finding-note-modal", () => ({
+ FindingNoteModal: ({
+ open,
+ triage,
+ }: {
+ open: boolean;
+ triage: {
+ noteBody: string;
+ canEdit: boolean;
+ disabledReason?: string;
+ billingHref: string;
+ };
+ }) =>
+ open ? (
+ <div role="dialog" aria-label="Note">
+ <textarea
+ aria-label="Note text"
+ value={triage.noteBody}
+ disabled={!triage.canEdit}
+ readOnly
+ />
+ {triage.disabledReason === "cloud_only" && (
+ <a href={triage.billingHref}>Available in Prowler Cloud</a>
+ )}
+ <button disabled={!triage.canEdit}>Save changes</button>
+ </div>
+ ) : null,
+}));
+
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+import {
+ DataTableRowActions,
+ type FindingRowData,
+} from "./data-table-row-actions";
import { FindingsSelectionContext } from "./findings-selection-context";
function deferredPromise<T>() {
@@ -59,6 +97,40 @@ function deferredPromise<T>() {
return { promise, resolve, reject };
}
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
+function makeFindingRow(overrides?: Partial<FindingRowData>) {
+ return {
+ original: {
+ id: "finding-1",
+ attributes: {
+ muted: false,
+ check_metadata: {
+ checktitle: "S3 public access",
+ },
+ },
+ triage: makeTriageSummary(),
+ ...overrides,
+ },
+ } as never;
+}
+
describe("DataTableRowActions", () => {
beforeEach(() => {
vi.clearAllMocks();
@@ -179,4 +251,76 @@ describe("DataTableRowActions", () => {
screen.getByRole("button", { name: "Mute Finding Group" }),
).toBeDisabled();
});
+
+ it("shows Add Triage Note for editable findings without a note", () => {
+ // Given / When
+ render(
+ <DataTableRowActions
+ row={makeFindingRow()}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeEnabled();
+ });
+
+ it("loads an existing note before opening the note modal", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageNoteLoadAction = vi.fn().mockResolvedValue({
+ noteId: "note-1",
+ noteBody: "Loaded existing note",
+ });
+ render(
+ <DataTableRowActions
+ row={makeFindingRow({
+ triage: makeTriageSummary({ hasVisibleNote: true, notesCount: 1 }),
+ })}
+ onTriageUpdateAction={vi.fn()}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Open note" }));
+
+ // Then
+ expect(onTriageNoteLoadAction).toHaveBeenCalledWith(
+ expect.objectContaining({ triageId: "triage-1", notesCount: 1 }),
+ );
+ expect(await screen.findByRole("dialog", { name: "Note" })).toBeVisible();
+ expect(screen.getByLabelText("Note text")).toHaveValue(
+ "Loaded existing note",
+ );
+ });
+
+ it("opens a disabled Cloud-only note modal from finding actions", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <DataTableRowActions
+ row={makeFindingRow({
+ triage: makeTriageSummary({
+ canEdit: false,
+ hasVisibleNote: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ }),
+ })}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Add Triage Note" }));
+
+ // Then
+ expect(screen.getByRole("dialog", { name: "Note" })).toBeVisible();
+ expect(screen.getByLabelText("Note text")).toBeDisabled();
+ expect(screen.getByRole("button", { name: "Save changes" })).toBeDisabled();
+ expect(
+ screen.getByRole("link", { name: "Available in Prowler Cloud" }),
+ ).toHaveAttribute("href", "https://prowler.com/pricing");
+ });
});
diff --git a/ui/components/findings/table/data-table-row-actions.tsx b/ui/components/findings/table/data-table-row-actions.tsx
index 4041fe728d..f0d6f10e6f 100644
--- a/ui/components/findings/table/data-table-row-actions.tsx
+++ b/ui/components/findings/table/data-table-row-actions.tsx
@@ -14,8 +14,17 @@ import {
} from "@/components/shadcn/dropdown";
import { Spinner } from "@/components/shadcn/spinner/spinner";
import { isFindingGroupMuted } from "@/lib/findings-groups";
+import { getOptionalText } from "@/lib/utils";
+import type {
+ FindingTriageLoadedNote,
+ FindingTriageSummary,
+} from "@/types/findings-triage";
+import type { ProviderType } from "@/types/providers";
import { canMuteFindingGroup } from "./finding-group-selection";
+import type { FindingTriageContext } from "./finding-note-modal";
+import { FindingNoteActionItem } from "./finding-triage-cells";
+import type { FindingTriageUpdateHandler } from "./finding-triage-status-control";
import { FindingsSelectionContext } from "./findings-selection-context";
export interface FindingRowData {
@@ -26,6 +35,20 @@ export interface FindingRowData {
checktitle?: string;
};
};
+ triage?: FindingTriageSummary;
+ relationships?: {
+ resource?: {
+ attributes?: {
+ name?: string;
+ };
+ };
+ provider?: {
+ attributes?: {
+ alias?: string;
+ provider?: string;
+ };
+ };
+ };
// Flat shape for FindingGroupRow
rowType?: string;
checkId?: string;
@@ -70,11 +93,19 @@ function extractRowInfo(data: FindingRowData) {
interface DataTableRowActionsProps<T extends FindingRowData> {
row: Row<T>;
onMuteComplete?: (findingIds: string[]) => void;
+ findingContext?: FindingTriageContext;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
}
export function DataTableRowActions<T extends FindingRowData>({
row,
onMuteComplete,
+ findingContext,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
}: DataTableRowActionsProps<T>) {
const router = useRouter();
const finding = row.original;
@@ -86,6 +117,18 @@ export function DataTableRowActions<T extends FindingRowData>({
>(null);
const { isMuted, canMute, title: findingTitle } = extractRowInfo(finding);
+ const resolvedFindingContext = findingContext ?? {
+ title: findingTitle,
+ resource: getOptionalText(
+ finding.relationships?.resource?.attributes?.name,
+ ),
+ provider: getOptionalText(
+ finding.relationships?.provider?.attributes?.alias,
+ ),
+ providerType: getOptionalText(
+ finding.relationships?.provider?.attributes?.provider,
+ ) as ProviderType | undefined,
+ };
// Get selection context - if there are other selected rows, include them
const selectionContext = useContext(FindingsSelectionContext);
@@ -204,8 +247,19 @@ export function DataTableRowActions<T extends FindingRowData>({
preparationError={mutePreparationError}
/>
- <div className="flex items-center justify-end">
+ <div
+ className="flex items-center justify-end"
+ onClick={(event) => event.stopPropagation()}
+ >
<ActionDropdown ariaLabel="Finding actions">
+ {!isGroup && (
+ <FindingNoteActionItem
+ triage={finding.triage}
+ findingContext={resolvedFindingContext}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
+ )}
<ActionDropdownItem
icon={
isMuted ? (
diff --git a/ui/components/findings/table/delta-indicator.tsx b/ui/components/findings/table/delta-indicator.tsx
index 7f79d1ede2..9bd2392210 100644
--- a/ui/components/findings/table/delta-indicator.tsx
+++ b/ui/components/findings/table/delta-indicator.tsx
@@ -19,9 +19,9 @@ export const DeltaIndicator = ({ delta }: DeltaIndicatorProps) => {
className={cn(
"h-2 w-2 min-w-2 cursor-pointer rounded-full",
delta === "new"
- ? "bg-system-severity-high"
+ ? "bg-bg-data-high"
: delta === "changed"
- ? "bg-system-severity-low"
+ ? "bg-bg-data-low"
: "bg-text-neutral-tertiary",
)}
/>
diff --git a/ui/components/findings/table/finding-detail-drawer.tsx b/ui/components/findings/table/finding-detail-drawer.tsx
index 93f8dd0438..f5db7c9ca1 100644
--- a/ui/components/findings/table/finding-detail-drawer.tsx
+++ b/ui/components/findings/table/finding-detail-drawer.tsx
@@ -68,6 +68,7 @@ export function FindingDetailDrawer({
onNavigatePrev={drawer.navigatePrev}
onNavigateNext={drawer.navigateNext}
onMuteComplete={handleMuteComplete}
+ onTriageUpdate={drawer.patchTriageUpdate}
/>
);
}
@@ -93,6 +94,7 @@ export function FindingDetailDrawer({
onNavigatePrev={drawer.navigatePrev}
onNavigateNext={drawer.navigateNext}
onMuteComplete={handleMuteComplete}
+ onTriageUpdate={drawer.patchTriageUpdate}
/>
</>
);
diff --git a/ui/components/findings/table/finding-note-modal.test.tsx b/ui/components/findings/table/finding-note-modal.test.tsx
new file mode 100644
index 0000000000..7004678394
--- /dev/null
+++ b/ui/components/findings/table/finding-note-modal.test.tsx
@@ -0,0 +1,406 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/components/icons/providers-badge/provider-type-icon", () => ({
+ ProviderTypeIcon: ({ type }: { type: string }) => (
+ <span data-testid={`${type}-provider-badge`}>{type} icon</span>
+ ),
+}));
+
+// CustomLink pulls the "@/lib" barrel (and next-auth with it) into the unit env.
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
+ CustomLink: ({ href, children }: { href: string; children: ReactNode }) => (
+ <a href={href}>{children}</a>
+ ),
+}));
+
+vi.mock("@/components/shadcn/modal", () => ({
+ Modal: ({
+ children,
+ open,
+ title,
+ }: {
+ children: ReactNode;
+ open: boolean;
+ title?: string;
+ }) =>
+ open ? (
+ <div role="dialog" aria-label={title}>
+ <h2>{title}</h2>
+ {children}
+ </div>
+ ) : null,
+}));
+
+beforeAll(() => {
+ Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+ configurable: true,
+ value: vi.fn(() => false),
+ });
+ Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+});
+
+import { DOCS_URLS } from "@/lib/external-urls";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageDetail,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+import {
+ FindingNoteModal,
+ type FindingTriageContext,
+} from "./finding-note-modal";
+
+function makeTriageDetail(
+ overrides?: Partial<FindingTriageDetail>,
+): FindingTriageDetail {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ noteId: "note-1",
+ noteBody: "Existing investigation note",
+ maxNoteLength: 500,
+ ...overrides,
+ };
+}
+
+afterEach(() => {
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+});
+
+function renderNoteModal({
+ triage = makeTriageDetail(),
+ onTriageUpdateAction = vi.fn(),
+ onOpenChange = vi.fn(),
+ findingContext = {
+ title: "S3 bucket allows public reads",
+ resource: "production-bucket",
+ provider: "production-account",
+ },
+}: {
+ triage?: FindingTriageDetail;
+ onTriageUpdateAction?: (input: UpdateFindingTriageInput) => void;
+ onOpenChange?: (open: boolean) => void;
+ findingContext?: FindingTriageContext;
+} = {}) {
+ render(
+ <FindingNoteModal
+ open
+ onOpenChange={onOpenChange}
+ triage={triage}
+ findingContext={findingContext}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ return { onTriageUpdateAction, onOpenChange };
+}
+
+describe("FindingNoteModal", () => {
+ it("should render the provider badge from the row provider type", () => {
+ // Given / When
+ renderNoteModal({
+ findingContext: {
+ title: "Azure finding",
+ provider: "azure-subscription",
+ providerType: "azure",
+ },
+ });
+
+ // Then
+ expect(screen.getByTestId("azure-provider-badge")).toBeVisible();
+ expect(screen.queryByText("AWS")).not.toBeInTheDocument();
+ });
+
+ it("should open with title Add Triage Note and current status preselected", () => {
+ // Given / When
+ renderNoteModal({
+ triage: makeTriageDetail({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ }),
+ });
+
+ // Then
+ const dialog = screen.getByRole("dialog", { name: "Add Triage Note" });
+ expect(dialog).toBeInTheDocument();
+ expect(within(dialog).getByText("S3 bucket allows public reads"));
+ expect(
+ within(dialog).getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Remediating");
+ expect(
+ within(dialog).getByText(/automatically changed to Resolved/i),
+ ).toBeVisible();
+ });
+
+ it("should render a documentation link without requiring Remediating status", () => {
+ // Given / When
+ renderNoteModal();
+
+ // Then
+ const docsLink = screen.getByRole("link", {
+ name: /triage documentation/i,
+ });
+ expect(docsLink).toHaveAttribute("href", DOCS_URLS.FINDINGS_TRIAGE);
+ expect(docsLink).toHaveAttribute("target", "_blank");
+ expect(
+ screen.queryByText(/automatically changed to Resolved/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should send existing note changes with noteId and without duplicate-note status payload", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ renderNoteModal({ onTriageUpdateAction });
+
+ // When
+ const textarea = screen.getByLabelText("Note text");
+ await user.clear(textarea);
+ await user.type(textarea, "Documented owner follow-up.");
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ expect(onTriageUpdateAction).toHaveBeenCalledWith({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ note: "Documented owner follow-up.",
+ });
+ });
+
+ it("should send status plus note only when creating the first note", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ renderNoteModal({
+ triage: makeTriageDetail({
+ triageId: null,
+ notesCount: 0,
+ noteId: null,
+ noteBody: "",
+ hasVisibleNote: false,
+ }),
+ onTriageUpdateAction,
+ });
+
+ // When
+ const textarea = screen.getByLabelText("Note text");
+ await user.type(textarea, " Initial triage note. ");
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ expect(onTriageUpdateAction).toHaveBeenCalledWith({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: null,
+ notesCount: 0,
+ noteId: null,
+ isMuted: false,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "Initial triage note.",
+ });
+ });
+
+ it("should send an empty body when an existing note is cleared", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onOpenChange = vi.fn();
+ const onTriageUpdateAction = vi.fn();
+ renderNoteModal({ onOpenChange, onTriageUpdateAction });
+
+ // When
+ await user.clear(screen.getByLabelText("Note text"));
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ expect(onTriageUpdateAction).toHaveBeenCalledWith({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ note: "",
+ });
+ expect(onOpenChange).toHaveBeenCalledWith(false);
+ });
+
+ it("should keep the modal open and show an error when note update fails", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onOpenChange = vi.fn();
+ const onTriageUpdateAction = vi.fn().mockRejectedValue(new Error("fail"));
+ renderNoteModal({ onOpenChange, onTriageUpdateAction });
+
+ // When
+ await user.clear(screen.getByLabelText("Note text"));
+ await user.type(screen.getByLabelText("Note text"), "Changed note");
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ expect(
+ await screen.findByText("Could not update the note. Please try again."),
+ ).toBeVisible();
+ expect(
+ screen.getByRole("dialog", { name: "Add Triage Note" }),
+ ).toBeInTheDocument();
+ expect(onOpenChange).not.toHaveBeenCalledWith(false);
+ });
+
+ it("should lock the status picker for resolved findings while keeping the note editable", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ renderNoteModal({
+ triage: makeTriageDetail({
+ status: FINDING_TRIAGE_STATUS.RESOLVED,
+ label: "Resolved",
+ }),
+ onTriageUpdateAction,
+ });
+
+ // Then — automation owns the transition out of Resolved.
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toBeDisabled();
+ expect(
+ screen.getByText(
+ "Triage status is managed automatically once the finding is resolved.",
+ ),
+ ).toBeVisible();
+ expect(screen.getByLabelText("Note text")).toBeEnabled();
+
+ // When — the note itself can still be updated.
+ const textarea = screen.getByLabelText("Note text");
+ await user.clear(textarea);
+ await user.type(textarea, "Documenting the resolution.");
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ expect(onTriageUpdateAction).toHaveBeenCalledWith(
+ expect.objectContaining({ note: "Documenting the resolution." }),
+ );
+ expect(onTriageUpdateAction).toHaveBeenCalledWith(
+ expect.not.objectContaining({ status: expect.anything() }),
+ );
+ });
+
+ it("should render counter and cancel/update actions without privacy copy", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onOpenChange = vi.fn();
+ renderNoteModal({ onOpenChange });
+
+ // When
+ await user.clear(screen.getByLabelText("Note text"));
+ await user.type(screen.getByLabelText("Note text"), "abc");
+
+ // Then
+ expect(screen.getByText("3/500")).toBeInTheDocument();
+ expect(
+ screen.queryByText("This note is only visible to your team."),
+ ).not.toBeInTheDocument();
+ await user.click(screen.getByRole("button", { name: "Cancel" }));
+ expect(onOpenChange).toHaveBeenCalledWith(false);
+ expect(screen.getByRole("button", { name: "Save" })).toBeInTheDocument();
+ });
+
+ it("should keep controls read-only and open the finding triage upgrade", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderNoteModal({
+ triage: makeTriageDetail({
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ }),
+ });
+
+ // Then
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveAttribute("data-disabled", "");
+ expect(screen.getByLabelText("Note text")).toBeDisabled();
+ const saveUpgrade = screen.getByRole("button", {
+ name: "Save - available in Prowler Cloud",
+ });
+ expect(saveUpgrade).not.toBeDisabled();
+
+ await user.click(saveUpgrade);
+
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE,
+ );
+ expect(screen.queryByText(/will be muted/i)).not.toBeInTheDocument();
+ });
+
+ it("should show modal-origin Mutelist info and still save accepted-risk statuses", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ renderNoteModal({
+ triage: makeTriageDetail({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ noteBody: "",
+ }),
+ onTriageUpdateAction,
+ });
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+ await user.click(screen.getByRole("option", { name: "Risk Accepted" }));
+
+ // Then
+ expect(
+ screen.getByText(
+ "Changing triage to Risk Accepted will mute the finding",
+ ),
+ ).toBeVisible();
+ await waitFor(() =>
+ expect(screen.queryByRole("listbox")).not.toBeInTheDocument(),
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Save" }));
+
+ // Then
+ await waitFor(() =>
+ expect(onTriageUpdateAction).toHaveBeenCalledWith({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ }),
+ );
+ });
+});
diff --git a/ui/components/findings/table/finding-note-modal.tsx b/ui/components/findings/table/finding-note-modal.tsx
new file mode 100644
index 0000000000..83e3c34031
--- /dev/null
+++ b/ui/components/findings/table/finding-note-modal.tsx
@@ -0,0 +1,289 @@
+"use client";
+
+import { ExternalLink, Info } from "lucide-react";
+import { type FormEvent, useRef, useState } from "react";
+
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
+import {
+ Alert,
+ AlertDescription,
+ Badge,
+ Button,
+ Textarea,
+} from "@/components/shadcn";
+import { Modal } from "@/components/shadcn/modal";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { DOCS_URLS } from "@/lib/external-urls";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_ORIGIN,
+ FINDING_TRIAGE_RESOLVED_LOCKED_COPY,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageDetail,
+ type FindingTriageStatus,
+ getFindingTriageMuteInfoCopy,
+ isMutelistShortcutStatus,
+ isTriageStatusLocked,
+} from "@/types/findings-triage";
+import type { ProviderType } from "@/types/providers";
+
+import {
+ FindingTriageStatusControl,
+ type FindingTriageUpdateHandler,
+} from "./finding-triage-status-control";
+import { buildFindingTriageUpdateInput } from "./finding-triage-submit";
+
+export interface FindingTriageContext {
+ title: string;
+ resource?: string;
+ provider?: string;
+ providerType?: ProviderType;
+}
+
+interface FindingNoteModalProps {
+ open: boolean;
+ onOpenChange: (open: boolean) => void;
+ triage: FindingTriageDetail;
+ findingContext: FindingTriageContext;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+}
+
+const REMEDIATING_INFO_COPY =
+ "Once this finding is remediated, if in the following scan its status changes to Pass, it will be automatically changed to Resolved";
+
+export function FindingNoteModal({
+ open,
+ onOpenChange,
+ triage,
+ findingContext,
+ onTriageUpdateAction,
+}: FindingNoteModalProps) {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+ // Local state needed: modal edits are buffered until the user chooses Update.
+ const [selectedStatus, setSelectedStatus] = useState<FindingTriageStatus>(
+ triage.status,
+ );
+ const [note, setNote] = useState(triage.noteBody);
+ const [submitError, setSubmitError] = useState<string | null>(null);
+ const [isSubmitting, setIsSubmitting] = useState(false);
+ const noteTextareaRef = useRef<HTMLTextAreaElement>(null);
+ const canSubmit =
+ triage.canEdit && Boolean(onTriageUpdateAction) && !isSubmitting;
+ const isCloudOnly =
+ triage.disabledReason === FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY;
+ const shouldShowMutelistInfo =
+ canSubmit &&
+ !triage.isMuted &&
+ selectedStatus !== triage.status &&
+ isMutelistShortcutStatus(selectedStatus);
+ const shouldShowRemediatingInfo =
+ selectedStatus === FINDING_TRIAGE_STATUS.REMEDIATING;
+ const isStatusLocked = isTriageStatusLocked(triage.status);
+ // Opened from a dropdown item: move focus into the dialog on mount so Radix's
+ // aria-hidden is not applied to the still-focused dropdown that opened it.
+ const handleOpenAutoFocus = (event: Event) => {
+ const textarea = noteTextareaRef.current;
+ if (textarea && !textarea.disabled) {
+ event.preventDefault();
+ textarea.focus();
+ }
+ // Otherwise let Radix auto-focus the first control inside the dialog.
+ };
+
+ const handleSubmit = async (event: FormEvent<HTMLFormElement>) => {
+ event.preventDefault();
+
+ if (!canSubmit) {
+ return;
+ }
+
+ setSubmitError(null);
+ setIsSubmitting(true);
+
+ try {
+ const updateInput = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus,
+ noteBody: note,
+ });
+
+ if (!updateInput) {
+ onOpenChange(false);
+ return;
+ }
+
+ await onTriageUpdateAction?.(updateInput);
+ onOpenChange(false);
+ } catch {
+ setSubmitError("Could not update the note. Please try again.");
+ } finally {
+ setIsSubmitting(false);
+ }
+ };
+
+ return (
+ <Modal
+ open={open}
+ onOpenChange={onOpenChange}
+ onOpenAutoFocus={handleOpenAutoFocus}
+ title="Add Triage Note"
+ size="lg"
+ >
+ {/* min-w-0: the form is a grid item of DialogContent; without it, long
+ unbreakable content (e.g. resource UIDs) widens the grid track past
+ the modal instead of truncating. */}
+ <form className="flex min-w-0 flex-col gap-5" onSubmit={handleSubmit}>
+ <div className="text-text-neutral-secondary flex flex-wrap items-center gap-2 text-sm">
+ <Info className="size-4 shrink-0" />
+ <span>Learn how triage states work in the</span>
+ <Button variant="link" size="link-sm" className="h-auto p-0" asChild>
+ <a
+ href={DOCS_URLS.FINDINGS_TRIAGE}
+ target="_blank"
+ rel="noopener noreferrer"
+ >
+ <ExternalLink className="size-3.5 shrink-0" />
+ <span>Triage documentation</span>
+ </a>
+ </Button>
+ </div>
+
+ <div className="border-border-input-primary flex items-center gap-4 rounded-lg border p-3">
+ <div className="bg-bg-neutral-tertiary flex size-9 shrink-0 items-center justify-center overflow-hidden rounded-lg">
+ {findingContext.providerType ? (
+ <ProviderTypeIcon type={findingContext.providerType} size={36} />
+ ) : (
+ <span className="text-text-neutral-secondary text-xs font-semibold">
+ {findingContext.provider?.slice(0, 3).toUpperCase() ?? "—"}
+ </span>
+ )}
+ </div>
+ <div className="min-w-0">
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <p className="text-text-neutral-primary truncate text-sm font-semibold">
+ {findingContext.title}
+ </p>
+ </TooltipTrigger>
+ <TooltipContent>{findingContext.title}</TooltipContent>
+ </Tooltip>
+ {(findingContext.resource || findingContext.provider) && (
+ <p className="text-text-neutral-secondary mt-1 truncate text-xs">
+ {[findingContext.resource, findingContext.provider]
+ .filter(Boolean)
+ .join(" · ")}
+ </p>
+ )}
+ </div>
+ </div>
+
+ <div className="flex items-center justify-end gap-3">
+ <span className="text-text-neutral-primary text-sm font-semibold">
+ Status:
+ </span>
+ <div className="w-1/2 min-w-44">
+ <FindingTriageStatusControl
+ origin={FINDING_TRIAGE_ORIGIN.MODAL}
+ triage={triage}
+ value={selectedStatus}
+ onValueChange={setSelectedStatus}
+ />
+ </div>
+ </div>
+
+ {isStatusLocked && (
+ <Alert variant="info">
+ <AlertDescription>
+ {FINDING_TRIAGE_RESOLVED_LOCKED_COPY}
+ </AlertDescription>
+ </Alert>
+ )}
+
+ {shouldShowMutelistInfo && (
+ <Alert variant="warning">
+ <AlertDescription>
+ {getFindingTriageMuteInfoCopy(selectedStatus)}
+ </AlertDescription>
+ </Alert>
+ )}
+
+ {shouldShowRemediatingInfo && (
+ <Alert variant="info">
+ <AlertDescription>{REMEDIATING_INFO_COPY}.</AlertDescription>
+ </Alert>
+ )}
+
+ {submitError && (
+ <Alert variant="error">
+ <AlertDescription>{submitError}</AlertDescription>
+ </Alert>
+ )}
+
+ <div className="space-y-2">
+ <Textarea
+ ref={noteTextareaRef}
+ id="finding-triage-note"
+ aria-label="Note text"
+ value={note}
+ maxLength={triage.maxNoteLength}
+ disabled={!canSubmit}
+ textareaSize="lg"
+ onChange={(event) => setNote(event.target.value)}
+ />
+ <div className="flex items-center justify-end">
+ <p className="text-text-neutral-tertiary shrink-0 text-xs">
+ {note.length}/{triage.maxNoteLength}
+ </p>
+ </div>
+ </div>
+
+ {/* mt-3 lifts the gap-5 form spacing to 32px so the distance to the
+ footer matches the launch scan and alert modals. */}
+ <div className="mt-3 flex w-full justify-between gap-4">
+ <Button
+ type="button"
+ variant="outline"
+ size="lg"
+ onClick={() => onOpenChange(false)}
+ >
+ Cancel
+ </Button>
+ <span className="relative inline-flex">
+ {isCloudOnly && (
+ <span className="pointer-events-none absolute top-0 right-0 z-10 translate-x-1/3 -translate-y-1/2">
+ <Badge variant="cloud">Cloud</Badge>
+ </span>
+ )}
+ <Button
+ type={canSubmit ? "submit" : "button"}
+ size="lg"
+ aria-label={
+ isCloudOnly ? "Save - available in Prowler Cloud" : undefined
+ }
+ disabled={!canSubmit && !isCloudOnly}
+ onClick={
+ isCloudOnly
+ ? () => openCloudUpgrade(CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE)
+ : undefined
+ }
+ >
+ {isSubmitting
+ ? "Saving..."
+ : canSubmit || isCloudOnly
+ ? "Save"
+ : "Unavailable"}
+ </Button>
+ </span>
+ </div>
+ </form>
+ </Modal>
+ );
+}
diff --git a/ui/components/findings/table/finding-triage-cells.test.tsx b/ui/components/findings/table/finding-triage-cells.test.tsx
new file mode 100644
index 0000000000..b0882427d4
--- /dev/null
+++ b/ui/components/findings/table/finding-triage-cells.test.tsx
@@ -0,0 +1,805 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/components/shadcn/modal", () => ({
+ Modal: ({
+ children,
+ open,
+ title,
+ description,
+ }: {
+ children: ReactNode;
+ open: boolean;
+ title?: string;
+ description?: string;
+ }) =>
+ open ? (
+ <div role="dialog" aria-label={title}>
+ <h2>{title}</h2>
+ {description && <p>{description}</p>}
+ {children}
+ </div>
+ ) : null,
+}));
+
+vi.mock("next/navigation", () => ({
+ useRouter: () => ({
+ push: vi.fn(),
+ }),
+}));
+
+// CustomLink pulls the "@/lib" barrel (and next-auth with it) into the unit env.
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
+ CustomLink: ({ href, children }: { href: string; children: ReactNode }) => (
+ <a href={href}>{children}</a>
+ ),
+}));
+
+vi.mock("@/components/shadcn/dropdown", () => ({
+ ActionDropdownItem: ({
+ label,
+ onSelect,
+ disabled,
+ }: {
+ label: ReactNode;
+ onSelect?: () => void;
+ disabled?: boolean;
+ }) => (
+ <button disabled={disabled} onClick={onSelect}>
+ {label}
+ </button>
+ ),
+}));
+
+beforeAll(() => {
+ Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+ configurable: true,
+ value: vi.fn(() => false),
+ });
+ Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+});
+
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+import {
+ FindingNoteActionItem,
+ FindingTriageStatusBadge,
+ FindingTriageStatusCell,
+} from "./finding-triage-cells";
+
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
+afterEach(() => {
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+});
+
+it("should open finding triage upgrade from a Cloud-only status cell", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ })}
+ />,
+ );
+
+ // When
+ await user.click(
+ screen.getByRole("button", {
+ name: "Change triage status - available in Prowler Cloud",
+ }),
+ );
+
+ // Then
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE,
+ );
+});
+
+it("should render the Cloud-only triage action with the shared button", () => {
+ // Given / When
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ canEdit: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ })}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("button", {
+ name: "Change triage status - available in Prowler Cloud",
+ }),
+ ).toHaveAttribute("data-slot", "button");
+});
+
+describe("finding triage cells", () => {
+ it("should open the Note modal from the note action with the current status preselected", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ // When
+ const addNoteButton = screen.getByRole("button", {
+ name: "Add Triage Note",
+ });
+ expect(addNoteButton).toHaveTextContent("Add Triage Note");
+ await user.click(addNoteButton);
+
+ // Then
+ expect(
+ screen.getByRole("dialog", { name: "Add Triage Note" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Remediating");
+ });
+
+ it("should not propagate table status clicks to the row", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onRowClick = vi.fn();
+ render(
+ <div onClick={onRowClick}>
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={vi.fn()}
+ />
+ </div>,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+
+ // Then
+ expect(onRowClick).not.toHaveBeenCalled();
+ });
+
+ it("should render status picker with fixed width and colored options", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ })}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When
+ await user.click(statusControl);
+
+ // Then
+ expect(statusControl.parentElement).toHaveClass("w-32");
+ expect(statusControl).toHaveAttribute("data-size", "xs");
+ expect(within(statusControl).getByText("Under Review")).toHaveClass(
+ "text-text-warning-primary",
+ );
+ expect(
+ within(screen.getByRole("option", { name: "Open" })).getByText("Open"),
+ ).toHaveClass("text-text-error-primary");
+ expect(
+ within(screen.getByRole("option", { name: "Under Review" })).getByText(
+ "Under Review",
+ ),
+ ).toHaveClass("text-text-warning-primary");
+ expect(
+ within(screen.getByRole("option", { name: "Remediating" })).getByText(
+ "Remediating",
+ ),
+ ).toHaveClass("text-bg-data-info");
+ expect(
+ within(screen.getByRole("option", { name: "Risk Accepted" })).getByText(
+ "Risk Accepted",
+ ),
+ ).toHaveClass("text-bg-pass");
+ expect(
+ within(screen.getByRole("option", { name: "False Positive" })).getByText(
+ "False Positive",
+ ),
+ ).toHaveClass("text-text-neutral-secondary");
+ });
+
+ it("renders a read-only triage status badge with the status color", () => {
+ // Given / When
+ render(
+ <FindingTriageStatusBadge
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ })}
+ />,
+ );
+
+ // Then
+ expect(screen.getByText("Triage:")).toBeInTheDocument();
+ expect(screen.getByText("Remediating")).toHaveClass("text-bg-data-info");
+ });
+
+ it("should disable table status mutation when no update handler is wired", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ canEdit: true,
+ })}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When
+ await user.click(statusControl);
+
+ // Then
+ expect(statusControl).toBeDisabled();
+ expect(screen.queryByRole("listbox")).not.toBeInTheDocument();
+ });
+
+ it("should lock the table status picker for resolved findings", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.RESOLVED,
+ label: "Resolved",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When
+ await user.click(statusControl);
+
+ // Then — automation owns the transition out of Resolved.
+ expect(statusControl).toBeDisabled();
+ expect(screen.queryByRole("listbox")).not.toBeInTheDocument();
+ expect(
+ screen.getAllByText(
+ "Triage status is managed automatically once the finding is resolved.",
+ ).length,
+ ).toBeGreaterThan(0);
+ expect(onTriageUpdateAction).not.toHaveBeenCalled();
+ });
+
+ it("should keep the note action available for resolved findings", () => {
+ // Given
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.RESOLVED,
+ label: "Resolved",
+ hasVisibleNote: false,
+ })}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ // Then — the lock only applies to status transitions, not notes.
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeEnabled();
+ });
+
+ it("should not open an editable empty-note modal for an existing note without a loader", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({ hasVisibleNote: true })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ const existingNoteButton = screen.getByRole("button", {
+ name: "Open note",
+ });
+
+ // When
+ await user.click(existingNoteButton);
+
+ // Then
+ expect(existingNoteButton).toBeDisabled();
+ expect(
+ screen.queryByRole("dialog", { name: "Add Triage Note" }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should load an existing note before opening the modal", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageNoteLoadAction = vi.fn().mockResolvedValue({
+ noteId: "note-1",
+ noteBody: "Loaded existing note",
+ });
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({ hasVisibleNote: true, notesCount: 1 })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ onTriageUpdateAction={vi.fn()}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Open note" }));
+
+ // Then
+ expect(onTriageNoteLoadAction).toHaveBeenCalledWith(
+ expect.objectContaining({ triageId: "triage-1", notesCount: 1 }),
+ );
+ expect(
+ await screen.findByRole("dialog", { name: "Add Triage Note" }),
+ ).toBeVisible();
+ expect(screen.getByLabelText("Note text")).toHaveValue(
+ "Loaded existing note",
+ );
+ });
+
+ it("should open a disabled billing upsell modal for Cloud-only Add Triage Note", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({
+ canEdit: false,
+ hasVisibleNote: false,
+ disabledReason: FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY,
+ })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Add Triage Note" }));
+
+ // Then
+ expect(
+ screen.getByRole("dialog", { name: "Add Triage Note" }),
+ ).toBeVisible();
+ expect(screen.getByLabelText("Note text")).toBeDisabled();
+ const saveUpgrade = screen.getByRole("button", {
+ name: "Save - available in Prowler Cloud",
+ });
+ expect(saveUpgrade).not.toBeDisabled();
+
+ await user.click(saveUpgrade);
+
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE,
+ );
+ });
+
+ it("should disable Add Triage Note when no update handler is wired", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({ hasVisibleNote: false, canEdit: true })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ />,
+ );
+
+ const addNoteButton = screen.getByRole("button", {
+ name: "Add Triage Note",
+ });
+
+ // When
+ await user.click(addNoteButton);
+
+ // Then
+ expect(addNoteButton).toBeDisabled();
+ expect(
+ screen.queryByRole("dialog", { name: "Add Triage Note" }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should expose a screen-reader error when an existing note cannot load", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageNoteLoadAction = vi
+ .fn()
+ .mockRejectedValue(new Error("load failed"));
+ render(
+ <FindingNoteActionItem
+ triage={makeTriageSummary({ hasVisibleNote: true, notesCount: 1 })}
+ findingContext={{ title: "S3 bucket allows public reads" }}
+ onTriageUpdateAction={vi.fn()}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Open note" }));
+
+ // Then
+ expect(await screen.findByRole("alert")).toHaveTextContent(
+ "Could not load the existing note.",
+ );
+ expect(
+ screen.queryByRole("dialog", { name: "Add Triage Note" }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should keep the optimistic table status while stale props are rendered during update", async () => {
+ // Given
+ const user = userEvent.setup();
+ let resolveUpdate: () => void = () => {};
+ const onTriageUpdateAction = vi.fn(
+ () =>
+ new Promise<void>((resolve) => {
+ resolveUpdate = resolve;
+ }),
+ );
+ const { rerender } = render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When: user selects a new status.
+ await user.click(statusControl);
+ await user.click(screen.getByRole("option", { name: "Under Review" }));
+
+ // Then: the optimistic status is visible immediately.
+ expect(statusControl).toHaveTextContent("Under Review");
+
+ // When: the parent renders stale data while the request is still pending.
+ rerender(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // Then: the control must not flicker back to Open.
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Under Review");
+
+ // When: backend completes and fresh props arrive.
+ resolveUpdate();
+ await waitFor(() => expect(onTriageUpdateAction).toHaveBeenCalled());
+ rerender(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Under Review");
+ });
+
+ it("should not resurrect a stale optimistic status after the server later returns the previous status", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn().mockResolvedValue(undefined);
+ const { rerender } = render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // When: user optimistically moves Open -> Under Review and it succeeds.
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+ await user.click(screen.getByRole("option", { name: "Under Review" }));
+ await waitFor(() => expect(onTriageUpdateAction).toHaveBeenCalled());
+
+ // And: fresh props converge on the optimistic status (server confirmed).
+ rerender(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // When: a later refetch legitimately returns the previous status again.
+ rerender(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // Then: the real server status wins; the stale optimistic value is gone.
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Open");
+ });
+
+ it("should refresh the visible table status when triage props change", () => {
+ // Given
+ const { rerender } = render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Open");
+
+ // When
+ rerender(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ })}
+ onTriageUpdateAction={vi.fn()}
+ />,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("combobox", { name: "Triage status" }),
+ ).toHaveTextContent("Remediating");
+ });
+
+ it("should not submit when table status selection matches the current status", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+ await user.click(screen.getByRole("option", { name: "Open" }));
+
+ // Then
+ expect(onTriageUpdateAction).not.toHaveBeenCalled();
+ });
+
+ it("should rollback table status and expose an error when update fails", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn().mockRejectedValue(new Error("fail"));
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When
+ await user.click(statusControl);
+ await user.click(screen.getByRole("option", { name: "Remediating" }));
+
+ // Then
+ expect(await screen.findByRole("alert")).toHaveTextContent(
+ "Could not update triage status.",
+ );
+ expect(statusControl).toHaveTextContent("Open");
+ });
+
+ it("should not confirm when moving between Mutelist shortcut statuses", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ label: "Risk Accepted",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+ await user.click(screen.getByRole("option", { name: "False Positive" }));
+
+ // Then
+ expect(screen.queryByRole("dialog", { name: "Mute finding?" })).toBeNull();
+ await waitFor(() =>
+ expect(onTriageUpdateAction).toHaveBeenCalledWith(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+ previousStatus: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ isMuted: false,
+ }),
+ ),
+ );
+ });
+
+ it("should not confirm or mute again when an already muted finding enters a shortcut status", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onTriageUpdateAction = vi.fn();
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ isMuted: true,
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+ await user.click(screen.getByRole("option", { name: "Risk Accepted" }));
+
+ // Then
+ expect(screen.queryByRole("dialog", { name: "Mute finding?" })).toBeNull();
+ await waitFor(() =>
+ expect(onTriageUpdateAction).toHaveBeenCalledWith(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ isMuted: true,
+ }),
+ ),
+ );
+ });
+
+ it("should confirm before applying Mutelist shortcut statuses from the table", async () => {
+ // Given
+ const user = userEvent.setup();
+ let resolveUpdate: () => void = () => {};
+ const onTriageUpdateAction = vi.fn(
+ () =>
+ new Promise<void>((resolve) => {
+ resolveUpdate = resolve;
+ }),
+ );
+ render(
+ <FindingTriageStatusCell
+ triage={makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ })}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />,
+ );
+
+ const statusControl = screen.getByRole("combobox", {
+ name: "Triage status",
+ });
+
+ // When: user selects a Mutelist shortcut.
+ await user.click(statusControl);
+ await user.click(screen.getByRole("option", { name: "False Positive" }));
+
+ // Then: the user is warned before the server action handles muting.
+ expect(screen.getByRole("dialog", { name: "Mute finding?" })).toBeVisible();
+ expect(
+ screen.getByText(
+ "Changing triage to False Positive will mute the finding",
+ ),
+ ).toBeVisible();
+ expect(onTriageUpdateAction).not.toHaveBeenCalled();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Mute finding" }));
+
+ // Then
+ await waitFor(() =>
+ expect(onTriageUpdateAction).toHaveBeenCalledWith({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ isMuted: false,
+ }),
+ );
+ expect(statusControl).toHaveTextContent("False Positive");
+
+ resolveUpdate();
+ });
+});
diff --git a/ui/components/findings/table/finding-triage-cells.tsx b/ui/components/findings/table/finding-triage-cells.tsx
new file mode 100644
index 0000000000..5e28b258f0
--- /dev/null
+++ b/ui/components/findings/table/finding-triage-cells.tsx
@@ -0,0 +1,365 @@
+"use client";
+
+import { MessageSquareText } from "lucide-react";
+import { useState } from "react";
+
+import { Button } from "@/components/shadcn/button/button";
+import { ActionDropdownItem } from "@/components/shadcn/dropdown";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { cn } from "@/lib/utils";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import {
+ FINDING_TRIAGE_DISABLED_REASON,
+ FINDING_TRIAGE_NOTE_MAX_LENGTH,
+ FINDING_TRIAGE_ORIGIN,
+ FINDING_TRIAGE_RESOLVED_LOCKED_COPY,
+ FINDING_TRIAGE_STATUS_LABELS,
+ type FindingTriageDetail,
+ type FindingTriageLoadedNote,
+ type FindingTriageStatus,
+ type FindingTriageSummary,
+ isTriageStatusLocked,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+import {
+ FindingNoteModal,
+ type FindingTriageContext,
+} from "./finding-note-modal";
+import {
+ FindingTriageStatusControl,
+ type FindingTriageUpdateHandler,
+ TRIAGE_STATUS_TEXT_CLASS,
+} from "./finding-triage-status-control";
+
+export const CLOUD_ONLY_TOOLTIP_COPY = "Available in Prowler Cloud";
+export const EDITING_UNAVAILABLE_COPY = "Editing is currently unavailable.";
+
+const getDisabledCopy = ({
+ triage,
+ hasUpdateHandler,
+ lockResolved = false,
+}: {
+ triage: FindingTriageSummary;
+ hasUpdateHandler: boolean;
+ lockResolved?: boolean;
+}): string | undefined => {
+ if (triage.disabledReason === FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY) {
+ return CLOUD_ONLY_TOOLTIP_COPY;
+ }
+
+ // Status-picker only: notes stay available on resolved findings.
+ if (lockResolved && isTriageStatusLocked(triage.status)) {
+ return FINDING_TRIAGE_RESOLVED_LOCKED_COPY;
+ }
+
+ if (triage.canEdit && !hasUpdateHandler) {
+ return EDITING_UNAVAILABLE_COPY;
+ }
+
+ return undefined;
+};
+
+const getTriageDetailFromSummary = (
+ triage: FindingTriageSummary,
+ loadedNote?: FindingTriageLoadedNote,
+): FindingTriageDetail => ({
+ ...triage,
+ noteId: loadedNote?.noteId ?? null,
+ noteBody: loadedNote?.noteBody ?? "",
+ maxNoteLength: FINDING_TRIAGE_NOTE_MAX_LENGTH,
+});
+
+export function FindingTriageStatusCell({
+ triage,
+ onTriageUpdateAction,
+}: {
+ triage?: FindingTriageSummary;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+}) {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+ const [optimisticStatus, setOptimisticStatus] = useState<{
+ token: string;
+ findingId: string;
+ triageId: string | null;
+ previousStatus: FindingTriageStatus;
+ status: FindingTriageStatus;
+ } | null>(null);
+
+ // Retire the optimistic status once the server converges or the row changes, so a stale value can't resurface.
+ if (
+ optimisticStatus &&
+ (!triage ||
+ optimisticStatus.findingId !== triage.findingId ||
+ optimisticStatus.triageId !== triage.triageId ||
+ triage.status === optimisticStatus.status)
+ ) {
+ setOptimisticStatus(null);
+ }
+
+ const optimisticMatchesCurrentTriage =
+ Boolean(triage) &&
+ optimisticStatus?.findingId === triage?.findingId &&
+ optimisticStatus?.triageId === triage?.triageId &&
+ optimisticStatus?.previousStatus === triage?.status &&
+ optimisticStatus?.status !== triage?.status;
+
+ if (!triage) {
+ return <span className="text-text-neutral-tertiary text-sm">-</span>;
+ }
+
+ const displayedTriage =
+ optimisticMatchesCurrentTriage && optimisticStatus
+ ? {
+ ...triage,
+ status: optimisticStatus.status,
+ label: FINDING_TRIAGE_STATUS_LABELS[optimisticStatus.status],
+ }
+ : triage;
+
+ const handleTriageUpdate = async (input: UpdateFindingTriageInput) => {
+ const optimisticToken = input.status ? crypto.randomUUID() : null;
+
+ if (input.status && optimisticToken) {
+ setOptimisticStatus({
+ token: optimisticToken,
+ findingId: input.findingId,
+ triageId: input.triageId,
+ previousStatus: input.previousStatus ?? triage.status,
+ status: input.status,
+ });
+ }
+
+ try {
+ await onTriageUpdateAction?.(input);
+ } catch (error) {
+ setOptimisticStatus((current) =>
+ current?.token === optimisticToken ? null : current,
+ );
+ throw error;
+ }
+ };
+
+ const control = (
+ <div
+ onClick={(event) => event.stopPropagation()}
+ onPointerDown={(event) => event.stopPropagation()}
+ >
+ <FindingTriageStatusControl
+ key={displayedTriage.findingId}
+ origin={FINDING_TRIAGE_ORIGIN.TABLE}
+ triage={displayedTriage}
+ onTriageUpdateAction={
+ onTriageUpdateAction ? handleTriageUpdate : undefined
+ }
+ />
+ </div>
+ );
+
+ const disabledCopy = getDisabledCopy({
+ triage,
+ hasUpdateHandler: Boolean(onTriageUpdateAction),
+ lockResolved: true,
+ });
+ if (!disabledCopy) {
+ return control;
+ }
+
+ if (triage.disabledReason === FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY) {
+ return (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span className="relative flex">
+ {control}
+ <Button
+ type="button"
+ variant="bare"
+ size="link-xs"
+ aria-label="Change triage status - available in Prowler Cloud"
+ className="absolute inset-0 h-auto w-auto rounded-lg"
+ onPointerDown={(event) => event.stopPropagation()}
+ onClick={(event) => {
+ event.stopPropagation();
+ openCloudUpgrade(CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE);
+ }}
+ />
+ </span>
+ </TooltipTrigger>
+ <TooltipContent>{disabledCopy}</TooltipContent>
+ </Tooltip>
+ );
+ }
+
+ return (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ {/* Block-level wrapper keeps the picker aligned with the sibling columns. */}
+ <span className="flex">{control}</span>
+ </TooltipTrigger>
+ <TooltipContent>{disabledCopy}</TooltipContent>
+ </Tooltip>
+ );
+}
+
+// Read-only triage status indicator, e.g. for the side drawer header where the
+// editable picker would be out of place among the status/severity badges.
+export function FindingTriageStatusBadge({
+ triage,
+}: {
+ triage: FindingTriageSummary;
+}) {
+ return (
+ <div className="flex items-center gap-1">
+ <span className="text-text-neutral-tertiary text-xs">Triage:</span>
+ <span
+ className={cn(
+ "text-xs font-medium",
+ TRIAGE_STATUS_TEXT_CLASS[triage.status],
+ )}
+ >
+ {triage.label}
+ </span>
+ </div>
+ );
+}
+
+export function FindingNoteActionItem({
+ triage,
+ findingContext = { title: "Finding" },
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
+}: {
+ triage?: FindingTriageSummary;
+ findingContext?: FindingTriageContext;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
+}) {
+ if (!triage) {
+ return <span className="text-text-neutral-tertiary text-sm">-</span>;
+ }
+
+ const triageIdentity = `${triage.findingId}:${triage.triageId ?? "virtual"}`;
+
+ return (
+ <FindingNoteActionItemContent
+ key={triageIdentity}
+ triage={triage}
+ findingContext={findingContext}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
+ );
+}
+
+function FindingNoteActionItemContent({
+ triage,
+ findingContext,
+ onTriageUpdateAction,
+ onTriageNoteLoadAction,
+}: {
+ triage: FindingTriageSummary;
+ findingContext: FindingTriageContext;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>;
+}) {
+ const [isNoteModalOpen, setIsNoteModalOpen] = useState(false);
+ const [loadedNote, setLoadedNote] = useState<FindingTriageLoadedNote>();
+ const [isLoadingNote, setIsLoadingNote] = useState(false);
+ const [loadError, setLoadError] = useState<string | null>(null);
+
+ const hasUpdateHandler = Boolean(onTriageUpdateAction);
+ const isCloudOnly =
+ triage.disabledReason === FINDING_TRIAGE_DISABLED_REASON.CLOUD_ONLY;
+ const canOpenNewNoteModal =
+ !triage.hasVisibleNote &&
+ ((triage.canEdit && hasUpdateHandler) || isCloudOnly);
+ const canOpenExistingNoteModal =
+ triage.hasVisibleNote &&
+ triage.canEdit &&
+ hasUpdateHandler &&
+ Boolean(onTriageNoteLoadAction) &&
+ !isLoadingNote;
+ const disabledCopy = getDisabledCopy({ triage, hasUpdateHandler });
+ const canOpenNoteModal = triage.hasVisibleNote
+ ? canOpenExistingNoteModal
+ : canOpenNewNoteModal;
+ const label = isLoadingNote
+ ? "Loading note..."
+ : triage.hasVisibleNote
+ ? "Open note"
+ : "Add Triage Note";
+
+ const handleNoteSelect = async () => {
+ if (!canOpenNoteModal) {
+ return;
+ }
+
+ if (!triage.hasVisibleNote) {
+ setIsNoteModalOpen(true);
+ return;
+ }
+
+ if (!onTriageNoteLoadAction) {
+ return;
+ }
+
+ setLoadError(null);
+ setIsLoadingNote(true);
+
+ try {
+ const note = await onTriageNoteLoadAction(triage);
+ setLoadedNote(note);
+ setIsNoteModalOpen(true);
+ } catch {
+ setLoadError("Could not load the existing note.");
+ } finally {
+ setIsLoadingNote(false);
+ }
+ };
+
+ const noteModal = isNoteModalOpen ? (
+ <FindingNoteModal
+ open={isNoteModalOpen}
+ onOpenChange={setIsNoteModalOpen}
+ triage={getTriageDetailFromSummary(triage, loadedNote)}
+ findingContext={findingContext}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />
+ ) : null;
+
+ return (
+ <>
+ <ActionDropdownItem
+ icon={<MessageSquareText className="size-5" />}
+ label={label}
+ disabled={!canOpenNoteModal}
+ title={
+ triage.hasVisibleNote && !canOpenExistingNoteModal
+ ? "Existing note cannot be loaded from the table."
+ : disabledCopy
+ }
+ onSelect={(event) => {
+ event.preventDefault();
+ void handleNoteSelect();
+ }}
+ />
+ {loadError && (
+ <span className="sr-only" role="alert">
+ {loadError}
+ </span>
+ )}
+ {noteModal}
+ </>
+ );
+}
diff --git a/ui/components/findings/table/finding-triage-status-control.tsx b/ui/components/findings/table/finding-triage-status-control.tsx
new file mode 100644
index 0000000000..2b6a7a2407
--- /dev/null
+++ b/ui/components/findings/table/finding-triage-status-control.tsx
@@ -0,0 +1,231 @@
+"use client";
+
+import { type ComponentProps, useState } from "react";
+
+import { Button } from "@/components/shadcn";
+import { Modal } from "@/components/shadcn/modal";
+import {
+ Select,
+ SelectContent,
+ SelectItem,
+ SelectTrigger,
+} from "@/components/shadcn/select/select";
+import { cn } from "@/lib/utils";
+import {
+ FINDING_TRIAGE_MANUAL_STATUS_VALUES,
+ FINDING_TRIAGE_ORIGIN,
+ FINDING_TRIAGE_STATUS_LABELS,
+ type FindingTriageManualStatus,
+ type FindingTriageStatus,
+ type FindingTriageSummary,
+ getFindingTriageMuteInfoCopy,
+ isManualStatus,
+ isMutelistShortcutStatus,
+ isTriageStatusLocked,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+export type FindingTriageUpdateHandler = (
+ input: UpdateFindingTriageInput,
+) => void | Promise<void>;
+
+type TriageStatusPickerSize = NonNullable<
+ ComponentProps<typeof SelectTrigger>["size"]
+>;
+
+export const TRIAGE_STATUS_TEXT_CLASS = {
+ open: "text-text-error-primary",
+ under_review: "text-text-warning-primary",
+ remediating: "text-bg-data-info",
+ resolved: "text-bg-pass",
+ risk_accepted: "text-bg-pass",
+ false_positive: "text-text-neutral-secondary",
+ reopened: "text-text-error-primary",
+} as const satisfies Record<FindingTriageStatus, string>;
+
+const MUTELIST_CONFIRMATION_TITLE = "Mute finding?";
+
+function TriageStatusPicker({
+ disabled,
+ size = "sm",
+ value,
+ onValueChange,
+}: {
+ disabled: boolean;
+ size?: TriageStatusPickerSize;
+ value: FindingTriageStatus;
+ onValueChange: (status: FindingTriageManualStatus) => void;
+}) {
+ return (
+ <Select
+ value={value}
+ disabled={disabled}
+ onValueChange={(nextStatus) => {
+ if (isManualStatus(nextStatus as FindingTriageStatus)) {
+ onValueChange(nextStatus as FindingTriageManualStatus);
+ }
+ }}
+ >
+ <SelectTrigger
+ aria-label="Triage status"
+ disabled={disabled}
+ size={size}
+ iconSize="sm"
+ >
+ <span className={cn("truncate", TRIAGE_STATUS_TEXT_CLASS[value])}>
+ {FINDING_TRIAGE_STATUS_LABELS[value]}
+ </span>
+ </SelectTrigger>
+ <SelectContent>
+ {FINDING_TRIAGE_MANUAL_STATUS_VALUES.map((status) => (
+ <SelectItem key={status} value={status}>
+ <span className={cn("truncate", TRIAGE_STATUS_TEXT_CLASS[status])}>
+ {FINDING_TRIAGE_STATUS_LABELS[status]}
+ </span>
+ </SelectItem>
+ ))}
+ </SelectContent>
+ </Select>
+ );
+}
+
+type TableStatusControlProps = {
+ origin: typeof FINDING_TRIAGE_ORIGIN.TABLE;
+ triage: FindingTriageSummary;
+ onTriageUpdateAction?: FindingTriageUpdateHandler;
+};
+
+type ModalStatusControlProps = {
+ origin: typeof FINDING_TRIAGE_ORIGIN.MODAL;
+ triage: FindingTriageSummary;
+ value: FindingTriageStatus;
+ onValueChange: (status: FindingTriageManualStatus) => void;
+};
+
+type FindingTriageStatusControlProps =
+ | TableStatusControlProps
+ | ModalStatusControlProps;
+
+export function FindingTriageStatusControl(
+ props: FindingTriageStatusControlProps,
+) {
+ const [tableUpdateError, setTableUpdateError] = useState<string | null>(null);
+ const [isTableUpdating, setIsTableUpdating] = useState(false);
+ const [pendingShortcutStatus, setPendingShortcutStatus] =
+ useState<FindingTriageManualStatus | null>(null);
+ const triage = props.triage;
+
+ if (props.origin === FINDING_TRIAGE_ORIGIN.MODAL) {
+ return (
+ <TriageStatusPicker
+ disabled={!triage.canEdit || isTriageStatusLocked(triage.status)}
+ value={props.value}
+ onValueChange={props.onValueChange}
+ />
+ );
+ }
+
+ const canMutateFromTable =
+ triage.canEdit &&
+ Boolean(props.onTriageUpdateAction) &&
+ !isTableUpdating &&
+ !isTriageStatusLocked(triage.status);
+
+ const applyTableStatus = async (status: FindingTriageManualStatus) => {
+ if (!props.onTriageUpdateAction || status === triage.status) {
+ return;
+ }
+
+ setTableUpdateError(null);
+ setIsTableUpdating(true);
+
+ try {
+ await props.onTriageUpdateAction({
+ findingId: triage.findingId,
+ findingUid: triage.findingUid,
+ triageId: triage.triageId,
+ notesCount: triage.notesCount,
+ status,
+ previousStatus: triage.status,
+ isMuted: triage.isMuted,
+ });
+ } catch {
+ setTableUpdateError("Could not update triage status.");
+ } finally {
+ setIsTableUpdating(false);
+ }
+ };
+
+ const shouldConfirmMute = (status: FindingTriageManualStatus) =>
+ !triage.isMuted &&
+ isMutelistShortcutStatus(status) &&
+ !isMutelistShortcutStatus(triage.status);
+
+ const handleTableValueChange = (status: FindingTriageManualStatus) => {
+ if (!props.onTriageUpdateAction || status === triage.status) {
+ return;
+ }
+
+ if (shouldConfirmMute(status)) {
+ setPendingShortcutStatus(status);
+ return;
+ }
+
+ void applyTableStatus(status);
+ };
+
+ return (
+ <>
+ <div className="w-32">
+ <TriageStatusPicker
+ disabled={!canMutateFromTable}
+ size="xs"
+ value={triage.status}
+ onValueChange={handleTableValueChange}
+ />
+ </div>
+ {tableUpdateError && (
+ <span className="sr-only" role="alert">
+ {tableUpdateError}
+ </span>
+ )}
+ <Modal
+ open={pendingShortcutStatus !== null}
+ onOpenChange={(open) => {
+ if (!open) {
+ setPendingShortcutStatus(null);
+ }
+ }}
+ title={MUTELIST_CONFIRMATION_TITLE}
+ description={
+ pendingShortcutStatus
+ ? getFindingTriageMuteInfoCopy(pendingShortcutStatus)
+ : undefined
+ }
+ size="sm"
+ >
+ <div className="flex justify-end gap-2 pt-2">
+ <Button
+ type="button"
+ variant="outline"
+ onClick={() => setPendingShortcutStatus(null)}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="button"
+ onClick={() => {
+ const status = pendingShortcutStatus;
+ setPendingShortcutStatus(null);
+ if (status) {
+ void applyTableStatus(status);
+ }
+ }}
+ >
+ Mute finding
+ </Button>
+ </div>
+ </Modal>
+ </>
+ );
+}
diff --git a/ui/components/findings/table/finding-triage-submit.test.ts b/ui/components/findings/table/finding-triage-submit.test.ts
new file mode 100644
index 0000000000..12315129f0
--- /dev/null
+++ b/ui/components/findings/table/finding-triage-submit.test.ts
@@ -0,0 +1,148 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ FINDING_TRIAGE_NOTE_MAX_LENGTH,
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageDetail,
+} from "@/types/findings-triage";
+
+import { buildFindingTriageUpdateInput } from "./finding-triage-submit";
+
+function makeTriageDetail(
+ overrides?: Partial<FindingTriageDetail>,
+): FindingTriageDetail {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: true,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ noteId: "note-1",
+ noteBody: "Existing investigation note",
+ maxNoteLength: FINDING_TRIAGE_NOTE_MAX_LENGTH,
+ ...overrides,
+ };
+}
+
+describe("buildFindingTriageUpdateInput", () => {
+ it("should return null when neither status nor note changed", () => {
+ // Given
+ const triage = makeTriageDetail();
+
+ // When
+ const result = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ noteBody: "Existing investigation note",
+ });
+
+ // Then
+ expect(result).toBeNull();
+ });
+
+ it("should update an existing note through noteId without duplicating note creation", () => {
+ // Given
+ const triage = makeTriageDetail();
+
+ // When
+ const result = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ noteBody: " Updated existing note ",
+ });
+
+ // Then
+ expect(result).toEqual({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ note: "Updated existing note",
+ });
+ });
+
+ it("should send status plus note only when creating the first note", () => {
+ // Given
+ const triage = makeTriageDetail({
+ triageId: null,
+ notesCount: 0,
+ noteId: null,
+ noteBody: "",
+ hasVisibleNote: false,
+ });
+
+ // When
+ const result = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ noteBody: " First note ",
+ });
+
+ // Then
+ expect(result).toEqual({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: null,
+ notesCount: 0,
+ noteId: null,
+ isMuted: false,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ note: "First note",
+ });
+ });
+
+ it("should send only status when status changes and an existing note is unchanged", () => {
+ // Given
+ const triage = makeTriageDetail();
+
+ // When
+ const result = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ noteBody: "Existing investigation note",
+ });
+
+ // Then
+ expect(result).toEqual({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ });
+ });
+
+ it("should send an empty note when an existing note is cleared", () => {
+ // Given
+ const triage = makeTriageDetail();
+
+ // When
+ const result = buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ noteBody: " ",
+ });
+
+ // Then
+ expect(result).toEqual({
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 1,
+ noteId: "note-1",
+ isMuted: false,
+ note: "",
+ });
+ });
+});
diff --git a/ui/components/findings/table/finding-triage-submit.ts b/ui/components/findings/table/finding-triage-submit.ts
new file mode 100644
index 0000000000..85e765e501
--- /dev/null
+++ b/ui/components/findings/table/finding-triage-submit.ts
@@ -0,0 +1,56 @@
+import {
+ type FindingTriageDetail,
+ type FindingTriageManualStatus,
+ type FindingTriageStatus,
+ isManualStatus,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+export interface BuildFindingTriageUpdateInputParams {
+ triage: FindingTriageDetail;
+ selectedStatus: FindingTriageStatus;
+ noteBody: string;
+}
+
+export function buildFindingTriageUpdateInput({
+ triage,
+ selectedStatus,
+ noteBody,
+}: BuildFindingTriageUpdateInputParams): UpdateFindingTriageInput | null {
+ const trimmedNote = noteBody.trim();
+ const statusChanged = selectedStatus !== triage.status;
+ const shouldCreateFirstNote =
+ triage.notesCount === 0 && trimmedNote.length > 0;
+ const shouldUpdateExistingNote =
+ triage.notesCount > 0 &&
+ triage.noteId !== null &&
+ trimmedNote !== triage.noteBody;
+ const shouldIncludeStatus =
+ isManualStatus(selectedStatus) && (statusChanged || shouldCreateFirstNote);
+
+ if (
+ !shouldIncludeStatus &&
+ !shouldCreateFirstNote &&
+ !shouldUpdateExistingNote
+ ) {
+ return null;
+ }
+
+ return {
+ findingId: triage.findingId,
+ findingUid: triage.findingUid,
+ triageId: triage.triageId,
+ notesCount: triage.notesCount,
+ noteId: triage.noteId,
+ isMuted: triage.isMuted,
+ ...(shouldIncludeStatus
+ ? {
+ status: selectedStatus as FindingTriageManualStatus,
+ previousStatus: triage.status,
+ }
+ : {}),
+ ...(shouldCreateFirstNote || shouldUpdateExistingNote
+ ? { note: trimmedNote }
+ : {}),
+ };
+}
diff --git a/ui/components/findings/table/findings-group-drill-down.tsx b/ui/components/findings/table/findings-group-drill-down.tsx
index 2bee7d5667..0b96a9657e 100644
--- a/ui/components/findings/table/findings-group-drill-down.tsx
+++ b/ui/components/findings/table/findings-group-drill-down.tsx
@@ -8,6 +8,10 @@ import {
import { ChevronLeft } from "lucide-react";
import { useSearchParams } from "next/navigation";
+import {
+ loadLatestFindingTriageNote,
+ updateFindingTriage,
+} from "@/actions/findings";
import { LoadingState } from "@/components/shadcn/spinner/loading-state";
import {
Table,
@@ -16,8 +20,8 @@ import {
TableHead,
TableHeader,
TableRow,
-} from "@/components/ui/table";
-import { SeverityBadge, StatusFindingBadge } from "@/components/ui/table";
+} from "@/components/shadcn/table";
+import { SeverityBadge, StatusFindingBadge } from "@/components/shadcn/table";
import { useFindingGroupResourceState } from "@/hooks/use-finding-group-resource-state";
import { cn, hasHistoricalFindingFilter } from "@/lib";
import {
@@ -73,6 +77,7 @@ export function FindingsGroupDrillDown({
handleMuteComplete,
handleRowSelectionChange,
resolveSelectedFindingIds,
+ updateTriageOptimistically,
} = useFindingGroupResourceState({
group,
filters,
@@ -82,6 +87,10 @@ export function FindingsGroupDrillDown({
const columns = getColumnFindingResources({
rowSelection,
selectableRowCount,
+ findingTitle: group.checkTitle,
+ onTriageUpdateAction: (input) =>
+ updateTriageOptimistically(input, updateFindingTriage),
+ onTriageNoteLoadAction: loadLatestFindingTriageNote,
});
const table = useReactTable({
@@ -116,7 +125,7 @@ export function FindingsGroupDrillDown({
>
<div
className={cn(
- "minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary",
+ "minimal-scrollbar border-border-neutral-secondary bg-bg-neutral-secondary rounded-[14px] shadow-sm",
"flex w-full flex-col overflow-auto border",
)}
>
@@ -249,6 +258,7 @@ export function FindingsGroupDrillDown({
onNavigatePrev={drawer.navigatePrev}
onNavigateNext={drawer.navigateNext}
onMuteComplete={handleDrawerMuteComplete}
+ onTriageUpdate={drawer.patchTriageUpdate}
/>
</FindingsSelectionContext.Provider>
);
diff --git a/ui/components/findings/table/findings-group-table.test.tsx b/ui/components/findings/table/findings-group-table.test.tsx
index 411f7a64f7..3d31ac0fb2 100644
--- a/ui/components/findings/table/findings-group-table.test.tsx
+++ b/ui/components/findings/table/findings-group-table.test.tsx
@@ -12,7 +12,7 @@ vi.mock("next/navigation", () => ({
usePathname: () => "/findings",
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTable: ({
data,
toolbarRightContent,
diff --git a/ui/components/findings/table/findings-group-table.tsx b/ui/components/findings/table/findings-group-table.tsx
index 86de935873..10eeff0b62 100644
--- a/ui/components/findings/table/findings-group-table.tsx
+++ b/ui/components/findings/table/findings-group-table.tsx
@@ -7,7 +7,7 @@ import { Suspense, useRef, useState } from "react";
import { resolveFindingIdsByVisibleGroupResources } from "@/actions/findings/findings-by-resource";
import { CustomCheckboxMutedFindings } from "@/components/filters/custom-checkbox-muted-findings";
import { OnboardingTrigger, PageReady } from "@/components/onboarding";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import { canDrillDownFindingGroup } from "@/lib/findings-groups";
import { getFlowById } from "@/lib/onboarding";
import { createExploreFindingsTourStepHandlers } from "@/lib/tours/explore-findings.tour";
diff --git a/ui/components/findings/table/index.ts b/ui/components/findings/table/index.ts
index f8b6b4fdbe..f474e7ec61 100644
--- a/ui/components/findings/table/index.ts
+++ b/ui/components/findings/table/index.ts
@@ -3,6 +3,7 @@ export * from "./column-finding-resources";
export * from "./column-standalone-findings";
export * from "./data-table-row-actions";
export * from "./finding-detail-drawer";
+export * from "./finding-triage-cells";
export * from "./findings-group-drill-down";
export * from "./findings-group-table";
export * from "./findings-selection-context";
diff --git a/ui/components/findings/table/inline-resource-container.test.ts b/ui/components/findings/table/inline-resource-container.test.ts
deleted file mode 100644
index 3acafa8ee5..0000000000
--- a/ui/components/findings/table/inline-resource-container.test.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-describe("inline resource container", () => {
- const currentDir = path.dirname(fileURLToPath(import.meta.url));
- const filePath = path.join(currentDir, "inline-resource-container.tsx");
- const source = readFileSync(filePath, "utf8");
-
- it("uses the shared finding-group resource state hook", () => {
- expect(source).toContain("useFindingGroupResourceState");
- expect(source).not.toContain("useInfiniteResources");
- });
-});
diff --git a/ui/components/findings/table/inline-resource-container.tsx b/ui/components/findings/table/inline-resource-container.tsx
index 29115bca98..91c4f3b225 100644
--- a/ui/components/findings/table/inline-resource-container.tsx
+++ b/ui/components/findings/table/inline-resource-container.tsx
@@ -9,11 +9,16 @@ import { AnimatePresence, motion } from "framer-motion";
import { ChevronsDown } from "lucide-react";
import { useImperativeHandle, useRef } from "react";
+import {
+ loadLatestFindingTriageNote,
+ updateFindingTriage,
+} from "@/actions/findings";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
import { LoadingState } from "@/components/shadcn/spinner/loading-state";
-import { TableCell, TableRow } from "@/components/ui/table";
+import { TableCell, TableRow } from "@/components/shadcn/table";
import { useFindingGroupResourceState } from "@/hooks/use-finding-group-resource-state";
import { useScrollHint } from "@/hooks/use-scroll-hint";
+import { cn } from "@/lib/utils";
import { FindingGroupRow } from "@/types";
import { getColumnFindingResources } from "./column-finding-resources";
@@ -52,6 +57,22 @@ interface InlineResourceContainerProps {
/** Max skeleton rows that fit in the 440px scroll container */
const MAX_SKELETON_ROWS = 7;
+const ACTIONS_COLUMN_ID = "actions";
+const COMPACT_LABELED_COLUMN_IDS = new Set([
+ "service",
+ "region",
+ "lastSeen",
+ "failingFor",
+ "triage",
+]);
+const STICKY_RESOURCE_ACTION_CELL_CLASS =
+ "sticky right-0 z-20 min-w-12 last:rounded-r-none! overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary group-data-[state=selected]:bg-bg-neutral-tertiary group-data-[state=selected]:before:to-bg-neutral-tertiary";
+
+const getResourceCellClassName = (columnId: string) =>
+ cn(
+ COMPACT_LABELED_COLUMN_IDS.has(columnId) && "align-top",
+ columnId === ACTIONS_COLUMN_ID && STICKY_RESOURCE_ACTION_CELL_CLASS,
+ );
function ResourceSkeletonRow({
isEmptyStateSized = false,
@@ -111,9 +132,17 @@ function ResourceSkeletonRow({
<TableCell className={cellClassName}>
<Skeleton className="h-4.5 w-16 rounded" />
</TableCell>
- {/* Actions */}
+ {/* Triage */}
<TableCell className={cellClassName}>
- <Skeleton className="size-8 rounded-md" />
+ <Skeleton className="h-8 w-20 rounded-lg" />
+ </TableCell>
+ {/* Actions */}
+ <TableCell
+ className={cn(cellClassName, STICKY_RESOURCE_ACTION_CELL_CLASS)}
+ >
+ <div className="flex justify-end">
+ <Skeleton className="size-8 rounded-md" />
+ </div>
</TableCell>
</TableRow>
);
@@ -160,6 +189,7 @@ export function InlineResourceContainer({
handleMuteComplete,
handleRowSelectionChange,
resolveSelectedFindingIds,
+ updateTriageOptimistically,
} = useFindingGroupResourceState({
group,
filters,
@@ -186,6 +216,10 @@ export function InlineResourceContainer({
const columns = getColumnFindingResources({
rowSelection,
selectableRowCount,
+ findingTitle: group.checkTitle,
+ onTriageUpdateAction: (input) =>
+ updateTriageOptimistically(input, updateFindingTriage),
+ onTriageNoteLoadAction: loadLatestFindingTriageNote,
});
const table = useReactTable({
@@ -214,7 +248,7 @@ export function InlineResourceContainer({
}}
>
<tr>
- <td colSpan={columnCount} className="p-0">
+ <td colSpan={columnCount} className="max-w-0 p-0">
<AnimatePresence initial>
<motion.div
// Onboarding anchor: the "Review the affected resources" tour step.
@@ -228,10 +262,10 @@ export function InlineResourceContainer({
<div className="relative">
<div
ref={combinedScrollRef}
- className="max-h-[440px] overflow-y-auto pl-6"
+ className="minimal-scrollbar max-h-[440px] overflow-auto pl-6"
>
{/* Resource rows or skeleton placeholder */}
- <table className="-mt-2.5 w-full border-separate border-spacing-y-4">
+ <table className="-mt-2.5 w-max min-w-full border-separate border-spacing-y-4">
<tbody>
{isLoading && rows.length === 0 ? (
Array.from({ length: skeletonRowCount }).map((_, i) => (
@@ -245,7 +279,7 @@ export function InlineResourceContainer({
<TableRow
key={row.id}
data-state={row.getIsSelected() && "selected"}
- className="cursor-pointer"
+ className="group cursor-pointer"
onClick={(e) => {
// Don't open drawer if clicking interactive elements
// (links, buttons, checkboxes, dropdown items)
@@ -260,7 +294,12 @@ export function InlineResourceContainer({
}}
>
{row.getVisibleCells().map((cell) => (
- <TableCell key={cell.id}>
+ <TableCell
+ key={cell.id}
+ className={getResourceCellClassName(
+ cell.column.id,
+ )}
+ >
{flexRender(
cell.column.columnDef.cell,
cell.getContext(),
@@ -336,6 +375,7 @@ export function InlineResourceContainer({
onNavigatePrev={drawer.navigatePrev}
onNavigateNext={drawer.navigateNext}
onMuteComplete={handleDrawerMuteComplete}
+ onTriageUpdate={drawer.patchTriageUpdate}
/>
</FindingsSelectionContext.Provider>
);
diff --git a/ui/components/findings/table/notification-indicator.test.tsx b/ui/components/findings/table/notification-indicator.test.tsx
index 093db2f3c6..9c35e3a22f 100644
--- a/ui/components/findings/table/notification-indicator.test.tsx
+++ b/ui/components/findings/table/notification-indicator.test.tsx
@@ -23,7 +23,8 @@ vi.mock("@/components/icons", () => ({
),
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Button: ({
children,
asChild,
diff --git a/ui/components/findings/table/notification-indicator.tsx b/ui/components/findings/table/notification-indicator.tsx
index 1691694816..d5b212a3bd 100644
--- a/ui/components/findings/table/notification-indicator.tsx
+++ b/ui/components/findings/table/notification-indicator.tsx
@@ -101,9 +101,7 @@ function DeltaIndicator({
<div
className={cn(
"size-1.5 rounded-full",
- delta === DeltaValues.NEW
- ? "bg-system-severity-high"
- : "bg-system-severity-low",
+ delta === DeltaValues.NEW ? "bg-bg-data-high" : "bg-bg-data-low",
)}
/>
</button>
diff --git a/ui/components/findings/table/provider-icon-cell.test.tsx b/ui/components/findings/table/provider-icon-cell.test.tsx
index 593122d33a..2d7082b120 100644
--- a/ui/components/findings/table/provider-icon-cell.test.tsx
+++ b/ui/components/findings/table/provider-icon-cell.test.tsx
@@ -33,13 +33,15 @@ describe("ProviderIconCell", () => {
expect(await screen.findByText("AWS")).toBeInTheDocument();
});
- it("renders a '?' placeholder for a provider type missing from the map", () => {
- render(
+ it("renders the neutral generic glyph for a provider missing from the map", () => {
+ // Dynamic/unknown providers render the shared generic glyph, not a "?".
+ const { container } = render(
<ProviderIconCell
provider={"future-provider" as unknown as ProviderType}
/>,
);
- expect(screen.getByText("?")).toBeInTheDocument();
+ expect(screen.queryByText("?")).not.toBeInTheDocument();
+ expect(container.querySelector("svg")).toBeInTheDocument();
});
});
diff --git a/ui/components/findings/table/provider-icon-cell.tsx b/ui/components/findings/table/provider-icon-cell.tsx
index 350e730e78..5a996415e6 100644
--- a/ui/components/findings/table/provider-icon-cell.tsx
+++ b/ui/components/findings/table/provider-icon-cell.tsx
@@ -1,7 +1,4 @@
-import {
- PROVIDER_TYPE_DATA,
- ProviderTypeIcon,
-} from "@/components/icons/providers-badge/provider-type-icon";
+import { ProviderTypeIcon } from "@/components/icons/providers-badge/provider-type-icon";
import { cn } from "@/lib/utils";
import { ProviderType } from "@/types";
@@ -16,16 +13,6 @@ export const ProviderIconCell = ({
size = 26,
className = "size-8 rounded-md bg-white",
}: ProviderIconCellProps) => {
- // Unknown provider types (present in the data but missing from the shared
- // PROVIDER_TYPE_DATA map) render an explicit "?" rather than an empty icon.
- if (!(provider in PROVIDER_TYPE_DATA)) {
- return (
- <div className={cn("flex items-center justify-center", className)}>
- <span className="text-text-neutral-secondary text-xs">?</span>
- </div>
- );
- }
-
return (
<div
className={cn(
diff --git a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.test.tsx b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.test.tsx
index 368a6b7dc3..afedde6c55 100644
--- a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.test.tsx
+++ b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.test.tsx
@@ -22,6 +22,8 @@ const {
mockClipboardWriteText,
mockSearchParamsState,
mockNotificationIndicator,
+ mockUpdateFindingTriage,
+ mockLoadLatestFindingTriageNote,
} = vi.hoisted(() => ({
mockGetComplianceIcon: vi.fn((_: string) => null as string | null),
mockGetCompliancesOverview: vi.fn(),
@@ -29,6 +31,8 @@ const {
mockClipboardWriteText: vi.fn(),
mockSearchParamsState: { value: "" },
mockNotificationIndicator: vi.fn(),
+ mockUpdateFindingTriage: vi.fn(),
+ mockLoadLatestFindingTriageNote: vi.fn(),
}));
vi.mock("next/navigation", () => ({
@@ -60,11 +64,12 @@ vi.mock("next/link", () => ({
}));
// Mock the entire shadcn barrel to avoid auth import chain
-vi.mock("@/components/shadcn", () => {
+vi.mock("@/components/shadcn", async (importOriginal) => {
const Passthrough = ({ children }: { children?: ReactNode }) => (
<>{children}</>
);
return {
+ ...(await importOriginal<Record<string, unknown>>()),
Badge: ({
children,
className,
@@ -125,7 +130,8 @@ vi.mock("@/components/shadcn", () => {
};
});
-vi.mock("@/components/shadcn/card/card", () => ({
+vi.mock("@/components/shadcn/card/card", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Card: ({ children, variant }: { children: ReactNode; variant?: string }) => (
<div data-slot="card" data-variant={variant}>
{children}
@@ -255,6 +261,11 @@ vi.mock("@/actions/compliances", () => ({
getCompliancesOverview: mockGetCompliancesOverview,
}));
+vi.mock("@/actions/findings", () => ({
+ updateFindingTriage: mockUpdateFindingTriage,
+ loadLatestFindingTriageNote: mockLoadLatestFindingTriageNote,
+}));
+
vi.mock("@/components/icons", () => ({
getComplianceIcon: mockGetComplianceIcon,
}));
@@ -263,7 +274,7 @@ vi.mock("@/components/icons/services/IconServices", () => ({
JiraIcon: () => null,
}));
-vi.mock("@/components/ui/code-snippet/code-snippet", () => ({
+vi.mock("@/components/shadcn/code-snippet/code-snippet", () => ({
CodeSnippet: ({
value,
formatter,
@@ -282,11 +293,11 @@ vi.mock("@/components/ui/code-snippet/code-snippet", () => ({
),
}));
-vi.mock("@/components/ui/entities/date-with-time", () => ({
+vi.mock("@/components/shadcn/entities/date-with-time", () => ({
DateWithTime: ({ dateTime }: { dateTime: string }) => <span>{dateTime}</span>,
}));
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: ({
nameAction,
idAction,
@@ -304,13 +315,17 @@ vi.mock("@/components/ui/entities/entity-info", () => ({
) : null,
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
TableBody: ({ children }: { children: ReactNode }) => (
<tbody>{children}</tbody>
),
- TableCell: ({ children }: { children: ReactNode }) => <td>{children}</td>,
- TableHead: ({ children }: { children: ReactNode }) => <th>{children}</th>,
+ TableCell: ({ children, ...props }: HTMLAttributes<HTMLTableCellElement>) => (
+ <td {...props}>{children}</td>
+ ),
+ TableHead: ({ children, ...props }: HTMLAttributes<HTMLTableCellElement>) => (
+ <th {...props}>{children}</th>
+ ),
TableHeader: ({ children }: { children: ReactNode }) => (
<thead>{children}</thead>
),
@@ -319,13 +334,13 @@ vi.mock("@/components/ui/table", () => ({
),
}));
-vi.mock("@/components/ui/table/severity-badge", () => ({
+vi.mock("@/components/shadcn/table/severity-badge", () => ({
SeverityBadge: ({ severity }: { severity: string }) => (
<span>{severity}</span>
),
}));
-vi.mock("@/components/ui/table/status-finding-badge", () => ({
+vi.mock("@/components/shadcn/table/status-finding-badge", () => ({
FindingStatus: {},
StatusFindingBadge: ({ status }: { status: string }) => <span>{status}</span>,
}));
@@ -360,6 +375,102 @@ vi.mock("../notification-indicator", () => ({
DeltaValues: { NEW: "new", CHANGED: "changed", NONE: "none" } as const,
}));
+vi.mock("../finding-triage-cells", () => ({
+ FindingNoteActionItem: ({
+ triage,
+ onTriageUpdateAction,
+ }: {
+ triage?: {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ status: string;
+ label: string;
+ isMuted: boolean;
+ };
+ onTriageUpdateAction?: (input: {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ status: string;
+ previousStatus: string;
+ isMuted: boolean;
+ note: string;
+ }) => Promise<void>;
+ }) =>
+ triage ? (
+ <button
+ type="button"
+ onClick={() =>
+ onTriageUpdateAction?.({
+ findingId: triage.findingId,
+ findingUid: triage.findingUid,
+ triageId: triage.triageId,
+ notesCount: triage.notesCount,
+ status: "remediating",
+ previousStatus: triage.status,
+ isMuted: triage.isMuted,
+ note: "Investigating",
+ })
+ }
+ >
+ Add Triage Note
+ </button>
+ ) : null,
+ FindingTriageStatusCell: ({
+ triage,
+ onTriageUpdateAction,
+ }: {
+ triage?: {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ status: string;
+ label: string;
+ isMuted: boolean;
+ };
+ onTriageUpdateAction?: (input: {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ status: string;
+ previousStatus: string;
+ isMuted: boolean;
+ }) => Promise<void>;
+ }) =>
+ triage ? (
+ <button
+ type="button"
+ aria-label="Triage status"
+ onClick={() =>
+ onTriageUpdateAction?.({
+ findingId: triage.findingId,
+ findingUid: triage.findingUid,
+ triageId: triage.triageId,
+ notesCount: triage.notesCount,
+ status: "remediating",
+ previousStatus: triage.status,
+ isMuted: triage.isMuted,
+ })
+ }
+ >
+ {triage.label}
+ </button>
+ ) : (
+ <span>-</span>
+ ),
+ FindingTriageStatusBadge: ({ triage }: { triage: { label: string } }) => (
+ <div>
+ <span>Triage:</span>
+ <span>{triage.label}</span>
+ </div>
+ ),
+}));
+
vi.mock("./resource-detail-skeleton", () => ({
ResourceDetailSkeleton: () => <div data-testid="skeleton" />,
}));
@@ -374,6 +485,10 @@ vi.mock("../../muted", () => ({
import type { ResourceDrawerFinding } from "@/actions/findings";
import type { FindingResourceRow } from "@/types";
+import {
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
import { ResourceDetailDrawerContent } from "./resource-detail-drawer-content";
import type { CheckMeta } from "./use-resource-detail-drawer";
@@ -404,6 +519,24 @@ const mockCheckMeta: CheckMeta = {
additionalUrls: [],
};
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
const mockFinding: ResourceDrawerFinding = {
id: "finding-1",
uid: "uid-1",
@@ -479,6 +612,147 @@ describe("ResourceDetailDrawerContent — resource navigation", () => {
expect(srOnlyLabel).toHaveTextContent("View Resource");
});
});
+
+describe("ResourceDetailDrawerContent — triage drawer actions", () => {
+ it("should render Triage and Add Triage Note for other findings rows", () => {
+ // Given
+ const otherFinding: ResourceDrawerFinding = {
+ ...mockFinding,
+ id: "finding-2",
+ uid: "uid-2",
+ checkId: "ec2_check",
+ checkTitle: "EC2 Check",
+ triage: makeTriageSummary({
+ findingId: "finding-2",
+ findingUid: "uid-2",
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ }),
+ };
+
+ render(
+ <ResourceDetailDrawerContent
+ isLoading={false}
+ isNavigating={false}
+ checkMeta={mockCheckMeta}
+ currentIndex={0}
+ totalResources={1}
+ currentFinding={mockFinding}
+ otherFindings={[otherFinding]}
+ onNavigatePrev={vi.fn()}
+ onNavigateNext={vi.fn()}
+ onMuteComplete={vi.fn()}
+ />,
+ );
+
+ // When
+ const row = screen.getByText("EC2 Check").closest("tr");
+ expect(row).not.toBeNull();
+
+ // Then
+ expect(screen.getByText("Triage")).toBeInTheDocument();
+ expect(
+ within(row as HTMLElement).getByRole("button", {
+ name: "Triage status",
+ }),
+ ).toHaveTextContent("Remediating");
+ expect(
+ within(row as HTMLElement).getByRole("button", {
+ name: "Add Triage Note",
+ }),
+ ).toBeInTheDocument();
+ expect(
+ within(row as HTMLElement).getByRole("button", { name: "Mute" }),
+ ).toBeInTheDocument();
+ expect(
+ within(row as HTMLElement).getByRole("button", { name: "Send to Jira" }),
+ ).toBeInTheDocument();
+ });
+
+ it("should keep the other findings actions cell sticky on the right edge", () => {
+ // Given
+ const otherFinding: ResourceDrawerFinding = {
+ ...mockFinding,
+ id: "finding-2",
+ uid: "uid-2",
+ checkId: "ec2_check",
+ checkTitle: "EC2 Check",
+ triage: makeTriageSummary({
+ findingId: "finding-2",
+ findingUid: "uid-2",
+ }),
+ };
+
+ render(
+ <ResourceDetailDrawerContent
+ isLoading={false}
+ isNavigating={false}
+ checkMeta={mockCheckMeta}
+ currentIndex={0}
+ totalResources={1}
+ currentFinding={mockFinding}
+ otherFindings={[otherFinding]}
+ onNavigatePrev={vi.fn()}
+ onNavigateNext={vi.fn()}
+ onMuteComplete={vi.fn()}
+ />,
+ );
+
+ // When
+ const row = screen.getByText("EC2 Check").closest("tr");
+ expect(row).not.toBeNull();
+ const actionsCell = within(row as HTMLElement)
+ .getByRole("button", { name: "Send to Jira" })
+ .closest("td");
+
+ // Then
+ expect(actionsCell).toHaveClass("sticky");
+ expect(actionsCell).toHaveClass("right-0");
+ expect(actionsCell).toHaveClass("z-20");
+ expect(actionsCell).toHaveClass("bg-bg-neutral-secondary");
+ expect(actionsCell).toHaveClass("before:bg-gradient-to-r");
+ expect(actionsCell).toHaveClass("before:to-bg-neutral-secondary");
+ });
+
+ it("should update simple drawer triage without using the mute refresh path", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onMuteComplete = vi.fn();
+ mockUpdateFindingTriage.mockResolvedValue(undefined);
+
+ render(
+ <ResourceDetailDrawerContent
+ isLoading={false}
+ isNavigating={false}
+ checkMeta={mockCheckMeta}
+ currentIndex={0}
+ totalResources={1}
+ currentFinding={{
+ ...mockFinding,
+ triage: makeTriageSummary(),
+ }}
+ otherFindings={[]}
+ onNavigatePrev={vi.fn()}
+ onNavigateNext={vi.fn()}
+ onMuteComplete={onMuteComplete}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Add Triage Note" }));
+
+ // Then
+ expect(mockUpdateFindingTriage).toHaveBeenCalledWith(
+ expect.objectContaining({
+ findingId: "finding-1",
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ note: "Investigating",
+ }),
+ );
+ expect(onMuteComplete).not.toHaveBeenCalled();
+ });
+});
+
const mockResourceRow: FindingResourceRow = {
id: "row-1",
rowType: "resource",
@@ -1002,69 +1276,6 @@ describe("ResourceDetailDrawerContent — Risk section styling", () => {
});
});
-// ---------------------------------------------------------------------------
-// Fix 4: Compliance icon styling should match master
-// ---------------------------------------------------------------------------
-
-describe("ResourceDetailDrawerContent — compliance icon styling", () => {
- it("should render framework icons inside the same white chip used in master", () => {
- // Given
- mockGetComplianceIcon.mockImplementation((framework: string) =>
- framework === "CIS-1.4" ? "/cis.svg" : null,
- );
-
- render(
- <ResourceDetailDrawerContent
- isLoading={false}
- isNavigating={false}
- checkMeta={mockCheckMeta}
- currentIndex={0}
- totalResources={1}
- currentFinding={mockFinding}
- otherFindings={[]}
- onNavigatePrev={vi.fn()}
- onNavigateNext={vi.fn()}
- onMuteComplete={vi.fn()}
- />,
- );
-
- // When
- const icon = screen.getByRole("img", { name: "CIS-1.4" });
- const chip = icon.closest("div");
-
- // Then
- expect(chip).toHaveClass("bg-white");
- expect(chip).toHaveClass("border-gray-300");
- });
-
- it("should render framework fallback pills with the same master styling", () => {
- // Given
- mockGetComplianceIcon.mockReturnValue(null);
-
- render(
- <ResourceDetailDrawerContent
- isLoading={false}
- isNavigating={false}
- checkMeta={mockCheckMeta}
- currentIndex={0}
- totalResources={1}
- currentFinding={mockFinding}
- otherFindings={[]}
- onNavigatePrev={vi.fn()}
- onNavigateNext={vi.fn()}
- onMuteComplete={vi.fn()}
- />,
- );
-
- // When
- const chip = screen.getByText("PCI-DSS");
-
- // Then
- expect(chip).toHaveClass("bg-white");
- expect(chip).toHaveClass("border-gray-300");
- });
-});
-
describe("ResourceDetailDrawerContent — compliance navigation", () => {
afterEach(() => {
vi.unstubAllGlobals();
diff --git a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.tsx b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.tsx
index 096b4f030c..1d2716985f 100644
--- a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.tsx
+++ b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer-content.tsx
@@ -16,7 +16,11 @@ import { useSearchParams } from "next/navigation";
import { useState } from "react";
import { getCompliancesOverview } from "@/actions/compliances";
-import type { ResourceDrawerFinding } from "@/actions/findings";
+import {
+ loadLatestFindingTriageNote,
+ type ResourceDrawerFinding,
+ updateFindingTriage,
+} from "@/actions/findings";
import { MarkdownContainer } from "@/components/findings/markdown-container";
import { MuteFindingsModal } from "@/components/findings/mute-findings-modal";
import { SendToJiraModal } from "@/components/findings/send-to-jira-modal";
@@ -32,12 +36,28 @@ import {
TabsTrigger,
} from "@/components/shadcn";
import { Card } from "@/components/shadcn/card/card";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
import {
ActionDropdown,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
+import { DateWithTime } from "@/components/shadcn/entities/date-with-time";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
import { LoadingState } from "@/components/shadcn/spinner/loading-state";
+import {
+ Table,
+ TableBody,
+ TableCell,
+ TableHead,
+ TableHeader,
+ TableRow,
+} from "@/components/shadcn/table";
+import { SeverityBadge } from "@/components/shadcn/table/severity-badge";
+import {
+ type FindingStatus,
+ StatusFindingBadge,
+} from "@/components/shadcn/table/status-finding-badge";
import {
Tooltip,
TooltipContent,
@@ -51,35 +71,30 @@ import {
type QueryEditorLanguage,
} from "@/components/shared/query-code-editor";
import { ResourceMetadataPanel } from "@/components/shared/resource-metadata-panel";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { DateWithTime } from "@/components/ui/entities/date-with-time";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
-import {
- Table,
- TableBody,
- TableCell,
- TableHead,
- TableHeader,
- TableRow,
-} from "@/components/ui/table";
-import { SeverityBadge } from "@/components/ui/table/severity-badge";
-import {
- type FindingStatus,
- StatusFindingBadge,
-} from "@/components/ui/table/status-finding-badge";
import { getFailingForLabel } from "@/lib/date-utils";
import { formatDuration } from "@/lib/date-utils";
+import { shouldRefreshAfterTriageUpdate } from "@/lib/finding-triage";
+import { buildFindingAnalysisPrompt } from "@/lib/lighthouse/prompts";
import { getRegionFlag } from "@/lib/region-flags";
import { getRecommendationLinkLabel } from "@/lib/vulnerability-references";
import type { ComplianceOverviewData } from "@/types/compliance";
import type { FindingResourceRow } from "@/types/findings-table";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
import { Muted } from "../../muted";
import { DeltaIndicator } from "../delta-indicator";
+import {
+ FindingNoteActionItem,
+ FindingTriageStatusBadge,
+ FindingTriageStatusCell,
+} from "../finding-triage-cells";
import { DeltaValues, NotificationIndicator } from "../notification-indicator";
import { ResourceDetailSkeleton } from "./resource-detail-skeleton";
import type { CheckMeta } from "./use-resource-detail-drawer";
+const OTHER_FINDINGS_ACTION_CELL_CLASS =
+ "sticky right-0 z-20 min-w-12 last:rounded-r-none! overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary";
+
/** Strip markdown code fences (```lang ... ```) so CodeSnippet shows clean code. */
function stripCodeFences(code: string): string {
return code
@@ -326,6 +341,7 @@ interface ResourceDetailDrawerContentProps {
onNavigatePrev: () => void;
onNavigateNext: () => void;
onMuteComplete: () => void;
+ onTriageUpdate?: (input: UpdateFindingTriageInput) => void;
}
export function ResourceDetailDrawerContent({
@@ -341,6 +357,7 @@ export function ResourceDetailDrawerContent({
onNavigatePrev,
onNavigateNext,
onMuteComplete,
+ onTriageUpdate,
}: ResourceDetailDrawerContentProps) {
const searchParams = useSearchParams();
const [isMuteModalOpen, setIsMuteModalOpen] = useState(false);
@@ -410,6 +427,7 @@ export function ResourceDetailDrawerContent({
const resourceUid = currentResource?.resourceUid ?? f?.resourceUid;
const resourceService = currentResource?.service ?? f?.resourceService;
const resourceRegion = currentResource?.region ?? f?.resourceRegion;
+ const findingTriage = f?.triage ?? currentResource?.triage;
const resourceRegionLabel = resourceRegion || "-";
const firstSeenAt = currentResource?.firstSeenAt ?? f?.firstSeenAt ?? null;
const lastSeenAt = currentResource?.lastSeenAt ?? f?.updatedAt ?? null;
@@ -454,6 +472,26 @@ export function ResourceDetailDrawerContent({
const overviewStatusExtended =
currentResource?.statusExtended || f?.statusExtended;
const showOverviewStatusExtended = Boolean(overviewStatusExtended);
+ const findingAnalysisPrompt = buildFindingAnalysisPrompt({
+ findingId: currentResource?.findingId ?? f?.id,
+ providerUid,
+ resourceUid,
+ checkId: currentResource?.checkId ?? checkMeta.checkId,
+ severity: findingSeverity,
+ status: findingStatus,
+ detail: overviewStatusExtended,
+ risk: f?.risk || checkMeta.risk,
+ });
+
+ const handleDrawerTriageUpdate = async (input: UpdateFindingTriageInput) => {
+ await updateFindingTriage(input);
+ if (shouldRefreshAfterTriageUpdate(input)) {
+ onMuteComplete();
+ return;
+ }
+
+ onTriageUpdate?.(input);
+ };
const handleOpenCompliance = async (framework: string) => {
if (!complianceScanId || resolvingFramework) {
@@ -534,6 +572,7 @@ export function ResourceDetailDrawerContent({
{findingIsMuted !== undefined && (
<Muted isMuted={findingIsMuted} mutedReason={findingMutedReason} />
)}
+ {findingTriage && <FindingTriageStatusBadge triage={findingTriage} />}
</div>
{showCheckMetaContent ? (
@@ -684,7 +723,10 @@ export function ResourceDetailDrawerContent({
<>
<div className="flex items-start gap-4">
{/* Resource info grid — 4 data columns */}
- <div className="@container flex min-w-0 flex-1 flex-col gap-4">
+ <div
+ data-responsive-container
+ className="@container flex min-w-0 flex-1 flex-col gap-4"
+ >
{/* Row 1: Provider, Resource, Service, Region */}
<div
className="grid min-w-0 grid-cols-2 gap-4 @md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_minmax(0,0.55fr)_minmax(0,0.7fr)] @md:gap-x-8"
@@ -800,6 +842,19 @@ export function ResourceDetailDrawerContent({
variant="bordered"
ariaLabel="Resource actions"
>
+ {findingTriage && (
+ <FindingNoteActionItem
+ triage={findingTriage}
+ findingContext={{
+ title: checkMeta.checkTitle,
+ resource: resourceName,
+ provider: providerAlias,
+ providerType,
+ }}
+ onTriageUpdateAction={handleDrawerTriageUpdate}
+ onTriageNoteLoadAction={loadLatestFindingTriageNote}
+ />
+ )}
<ActionDropdownItem
icon={
f.isMuted ? (
@@ -1194,6 +1249,11 @@ export function ResourceDetailDrawerContent({
Time
</span>
</TableHead>
+ <TableHead>
+ <span className="text-text-neutral-secondary text-sm font-medium">
+ Triage
+ </span>
+ </TableHead>
<TableHead className="w-10" />
</TableRow>
</TableHeader>
@@ -1213,11 +1273,12 @@ export function ResourceDetailDrawerContent({
new Set(prev).add(finding.id),
)
}
+ onTriageUpdateAction={handleDrawerTriageUpdate}
/>
))
) : (
<TableRow>
- <TableCell colSpan={6} className="h-16 text-center">
+ <TableCell colSpan={7} className="h-16 text-center">
<span className="text-text-neutral-tertiary text-sm">
{showSyntheticResourceHint
? "No other findings are available for this IaC resource."
@@ -1329,7 +1390,7 @@ export function ResourceDetailDrawerContent({
{/* Lighthouse AI button */}
{!isNavigating && (
<a
- href={`/lighthouse?${new URLSearchParams({ prompt: `Analyze this security finding and provide remediation guidance:\n\n- **Finding**: ${checkMeta.checkTitle}\n- **Check ID**: ${checkMeta.checkId}\n- **Severity**: ${f?.severity ?? "unknown"}\n- **Status**: ${f?.status ?? "unknown"}${f?.statusExtended ? `\n- **Detail**: ${f.statusExtended}` : ""}${checkMeta.risk ? `\n- **Risk**: ${checkMeta.risk}` : ""}` }).toString()}`}
+ href={`/lighthouse?${new URLSearchParams({ prompt: findingAnalysisPrompt }).toString()}`}
className="flex items-center gap-1.5 rounded-lg px-4 py-3 text-sm font-bold text-slate-900 transition-opacity hover:opacity-90"
style={{
background: "var(--gradient-lighthouse)",
@@ -1403,7 +1464,10 @@ function OtherFindingsNavigationSkeletonRows() {
<TableCell>
<Skeleton className="h-5 w-20 rounded" />
</TableCell>
- <TableCell className="w-10">
+ <TableCell>
+ <Skeleton className="h-8 w-20 rounded-lg" />
+ </TableCell>
+ <TableCell className={OTHER_FINDINGS_ACTION_CELL_CLASS}>
<Skeleton className="h-5 w-5 rounded" />
</TableCell>
</TableRow>
@@ -1495,10 +1559,12 @@ function OtherFindingRow({
finding,
isOptimisticallyMuted,
onMuted,
+ onTriageUpdateAction,
}: {
finding: ResourceDrawerFinding;
isOptimisticallyMuted: boolean;
onMuted: () => void;
+ onTriageUpdateAction: (input: UpdateFindingTriageInput) => Promise<void>;
}) {
const [isMuteModalOpen, setIsMuteModalOpen] = useState(false);
const [isJiraModalOpen, setIsJiraModalOpen] = useState(false);
@@ -1526,7 +1592,7 @@ function OtherFindingRow({
findingTitle={finding.checkTitle}
/>
<TableRow
- className="cursor-pointer"
+ className="group cursor-pointer"
onClick={() => window.open(findingUrl, "_blank", "noopener,noreferrer")}
>
<TableCell className="w-14">
@@ -1559,9 +1625,28 @@ function OtherFindingRow({
<TableCell>
<DateWithTime dateTime={finding.updatedAt} />
</TableCell>
- <TableCell className="w-10">
+ <TableCell>
+ <FindingTriageStatusCell
+ triage={finding.triage}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />
+ </TableCell>
+ <TableCell className={OTHER_FINDINGS_ACTION_CELL_CLASS}>
<div onClick={(e) => e.stopPropagation()}>
<ActionDropdown ariaLabel="Finding actions">
+ {finding.triage && (
+ <FindingNoteActionItem
+ triage={finding.triage}
+ findingContext={{
+ title: finding.checkTitle,
+ resource: finding.resourceName,
+ provider: finding.providerAlias,
+ providerType: finding.providerType,
+ }}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={loadLatestFindingTriageNote}
+ />
+ )}
<ActionDropdownItem
icon={
isMuted ? (
diff --git a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer.tsx b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer.tsx
index 65ad4e734c..c2c4629d63 100644
--- a/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer.tsx
+++ b/ui/components/findings/table/resource-detail-drawer/resource-detail-drawer.tsx
@@ -1,17 +1,9 @@
"use client";
-import { X } from "lucide-react";
-
import type { ResourceDrawerFinding } from "@/actions/findings";
-import {
- Drawer,
- DrawerClose,
- DrawerContent,
- DrawerDescription,
- DrawerHeader,
- DrawerTitle,
-} from "@/components/shadcn";
+import { DetailSidePanel } from "@/components/side-panel/detail-side-panel";
import type { FindingResourceRow } from "@/types";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
import { ResourceDetailDrawerContent } from "./resource-detail-drawer-content";
import type { CheckMeta } from "./use-resource-detail-drawer";
@@ -31,6 +23,7 @@ interface ResourceDetailDrawerProps {
onNavigatePrev: () => void;
onNavigateNext: () => void;
onMuteComplete: () => void;
+ onTriageUpdate?: (input: UpdateFindingTriageInput) => void;
}
export function ResourceDetailDrawer({
@@ -48,37 +41,30 @@ export function ResourceDetailDrawer({
onNavigatePrev,
onNavigateNext,
onMuteComplete,
+ onTriageUpdate,
}: ResourceDetailDrawerProps) {
return (
- <Drawer direction="right" open={open} onOpenChange={onOpenChange}>
- <DrawerContent className="3xl:w-1/3 h-full w-full overflow-hidden p-6 outline-none md:w-1/2 md:max-w-none md:min-w-[720px]">
- <DrawerHeader className="sr-only">
- <DrawerTitle>Resource Finding Details</DrawerTitle>
- <DrawerDescription>
- View finding details for the selected resource
- </DrawerDescription>
- </DrawerHeader>
- <DrawerClose className="ring-offset-background focus:ring-ring absolute top-4 right-4 rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-none">
- <X className="size-4" />
- <span className="sr-only">Close</span>
- </DrawerClose>
- {open && (
- <ResourceDetailDrawerContent
- isLoading={isLoading}
- isNavigating={isNavigating}
- checkMeta={checkMeta}
- currentIndex={currentIndex}
- totalResources={totalResources}
- currentResource={currentResource}
- currentFinding={currentFinding}
- otherFindings={otherFindings}
- showSyntheticResourceHint={showSyntheticResourceHint}
- onNavigatePrev={onNavigatePrev}
- onNavigateNext={onNavigateNext}
- onMuteComplete={onMuteComplete}
- />
- )}
- </DrawerContent>
- </Drawer>
+ <DetailSidePanel
+ open={open}
+ onOpenChange={onOpenChange}
+ title="Resource Finding Details"
+ description="View finding details for the selected resource"
+ >
+ <ResourceDetailDrawerContent
+ isLoading={isLoading}
+ isNavigating={isNavigating}
+ checkMeta={checkMeta}
+ currentIndex={currentIndex}
+ totalResources={totalResources}
+ currentResource={currentResource}
+ currentFinding={currentFinding}
+ otherFindings={otherFindings}
+ showSyntheticResourceHint={showSyntheticResourceHint}
+ onNavigatePrev={onNavigatePrev}
+ onNavigateNext={onNavigateNext}
+ onMuteComplete={onMuteComplete}
+ onTriageUpdate={onTriageUpdate}
+ />
+ </DetailSidePanel>
);
}
diff --git a/ui/components/findings/table/resource-detail-drawer/resource-detail-skeleton.tsx b/ui/components/findings/table/resource-detail-drawer/resource-detail-skeleton.tsx
index 938b4bc35a..163a2dbd54 100644
--- a/ui/components/findings/table/resource-detail-drawer/resource-detail-skeleton.tsx
+++ b/ui/components/findings/table/resource-detail-drawer/resource-detail-skeleton.tsx
@@ -8,7 +8,10 @@ import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
export function ResourceDetailSkeleton() {
return (
<div className="flex items-start gap-4">
- <div className="@container flex min-w-0 flex-1 flex-col gap-4">
+ <div
+ data-responsive-container
+ className="@container flex min-w-0 flex-1 flex-col gap-4"
+ >
{/* Row 1: Provider, Resource, Service, Region */}
<div className="grid min-w-0 grid-cols-2 gap-4 @md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_minmax(0,0.55fr)_minmax(0,0.7fr)] @md:gap-x-8">
<div className="col-span-2 @md:col-span-1">
diff --git a/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.test.ts b/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.test.ts
index b7d6347adc..d86cf3121d 100644
--- a/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.test.ts
+++ b/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.test.ts
@@ -31,6 +31,10 @@ vi.mock("next/navigation", () => ({
import type { ResourceDrawerFinding } from "@/actions/findings";
import type { FindingResourceRow } from "@/types";
+import {
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
import { useResourceDetailDrawer } from "./use-resource-detail-drawer";
@@ -106,6 +110,24 @@ function makeDrawerFinding(
};
}
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
// ---------------------------------------------------------------------------
// Fix 2: AbortController cleanup on unmount
// ---------------------------------------------------------------------------
@@ -811,4 +833,82 @@ describe("useResourceDetailDrawer — other findings filtering", () => {
"finding-4",
]);
});
+
+ it("should patch current and other finding triage locally without refetching", async () => {
+ const resources = [makeResource()];
+
+ // Given
+ getFindingByIdMock.mockResolvedValue({ data: ["detail"] });
+ getLatestFindingsByResourceUidMock.mockResolvedValue({
+ data: ["resource"],
+ });
+ adaptFindingsByResourceResponseMock.mockImplementation(
+ (response: { data: string[] }) =>
+ response.data[0] === "detail"
+ ? [
+ makeDrawerFinding({
+ id: "finding-1",
+ triage: makeTriageSummary(),
+ }),
+ ]
+ : [
+ makeDrawerFinding({
+ id: "finding-2",
+ uid: "uid-2",
+ triage: makeTriageSummary({
+ findingId: "finding-2",
+ findingUid: "uid-2",
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ }),
+ }),
+ ],
+ );
+
+ const { result } = renderHook(() =>
+ useResourceDetailDrawer({
+ resources,
+ }),
+ );
+
+ await act(async () => {
+ result.current.openDrawer(0);
+ await Promise.resolve();
+ });
+
+ const findingFetchCount = getFindingByIdMock.mock.calls.length;
+ const resourceFetchCount =
+ getLatestFindingsByResourceUidMock.mock.calls.length;
+
+ // When
+ act(() => {
+ result.current.patchTriageUpdate({
+ findingId: "finding-2",
+ findingUid: "uid-2",
+ triageId: "triage-2",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ isMuted: false,
+ note: "Investigating",
+ });
+ });
+
+ // Then
+ expect(result.current.otherFindings[0]?.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ hasVisibleNote: true,
+ notesCount: 1,
+ }),
+ );
+ expect(result.current.currentFinding?.triage?.status).toBe(
+ FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ );
+ expect(getFindingByIdMock).toHaveBeenCalledTimes(findingFetchCount);
+ expect(getLatestFindingsByResourceUidMock).toHaveBeenCalledTimes(
+ resourceFetchCount,
+ );
+ });
});
diff --git a/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.ts b/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.ts
index 1a4a9c37f9..ca972304b6 100644
--- a/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.ts
+++ b/ui/components/findings/table/resource-detail-drawer/use-resource-detail-drawer.ts
@@ -8,7 +8,13 @@ import {
getLatestFindingsByResourceUid,
type ResourceDrawerFinding,
} from "@/actions/findings";
+import {
+ applyOptimisticTriageSummaryUpdate,
+ getOptimisticTriageMutedReason,
+ shouldMarkFindingMutedForTriageUpdate,
+} from "@/lib/finding-triage";
import { FindingResourceRow } from "@/types";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
// Keep fast carousel navigations in a loading state for one short beat so
// React doesn't batch away the skeleton frame when switching resources.
@@ -67,6 +73,8 @@ interface UseResourceDetailDrawerReturn {
navigateNext: () => void;
/** Clear cache for current resource and re-fetch (e.g. after muting). */
refetchCurrent: () => void;
+ /** Patch triage state locally after a successful lightweight triage update. */
+ patchTriageUpdate: (input: UpdateFindingTriageInput) => void;
}
/**
@@ -287,6 +295,62 @@ export function useResourceDetailDrawer({
fetchFindings(resource);
};
+ const patchFindingTriage = (
+ finding: ResourceDrawerFinding | null,
+ input: UpdateFindingTriageInput,
+ ): ResourceDrawerFinding | null => {
+ if (!finding?.triage || finding.triage.findingId !== input.findingId) {
+ return finding;
+ }
+
+ const shouldMarkMuted = shouldMarkFindingMutedForTriageUpdate(input);
+
+ return {
+ ...finding,
+ isMuted: shouldMarkMuted ? true : finding.isMuted,
+ mutedReason:
+ shouldMarkMuted && input.isMuted !== true && input.status
+ ? getOptimisticTriageMutedReason(input.status)
+ : finding.mutedReason,
+ triage: applyOptimisticTriageSummaryUpdate(finding.triage, input),
+ };
+ };
+
+ const patchTriageUpdate = (input: UpdateFindingTriageInput) => {
+ currentFindingCacheRef.current.forEach((finding, key) => {
+ const patchedFinding = patchFindingTriage(finding, input);
+ if (patchedFinding !== finding) {
+ currentFindingCacheRef.current.set(key, patchedFinding);
+ }
+ });
+
+ otherFindingsCacheRef.current.forEach((findings, key) => {
+ const patchedFindings = findings.map((finding) =>
+ patchFindingTriage(finding, input),
+ );
+
+ if (
+ patchedFindings.some((finding, index) => finding !== findings[index])
+ ) {
+ otherFindingsCacheRef.current.set(
+ key,
+ patchedFindings.filter(
+ (finding): finding is ResourceDrawerFinding => finding !== null,
+ ),
+ );
+ }
+ });
+
+ setCurrentFinding((finding) => patchFindingTriage(finding, input));
+ setOtherFindings((findings) =>
+ findings
+ .map((finding) => patchFindingTriage(finding, input))
+ .filter(
+ (finding): finding is ResourceDrawerFinding => finding !== null,
+ ),
+ );
+ };
+
const navigateTo = (index: number) => {
const resource = resources[index];
if (!resource) return;
@@ -335,5 +399,6 @@ export function useResourceDetailDrawer({
navigatePrev,
navigateNext,
refetchCurrent,
+ patchTriageUpdate,
};
}
diff --git a/ui/components/findings/table/skeleton-table-findings.tsx b/ui/components/findings/table/skeleton-table-findings.tsx
index 79654d554c..98fd17ee65 100644
--- a/ui/components/findings/table/skeleton-table-findings.tsx
+++ b/ui/components/findings/table/skeleton-table-findings.tsx
@@ -58,7 +58,7 @@ export const SkeletonTableFindings = () => {
const rows = 10;
return (
- <div className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden border p-4">
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
{/* Toolbar: Search + Total entries */}
<div className="flex items-center justify-between">
{/* Search icon button */}
diff --git a/ui/components/graphs/donut-chart.tsx b/ui/components/graphs/donut-chart.tsx
index 796e2d9bc2..0111a2936c 100644
--- a/ui/components/graphs/donut-chart.tsx
+++ b/ui/components/graphs/donut-chart.tsx
@@ -11,7 +11,7 @@ import {
Tooltip,
} from "recharts";
-import { ChartConfig, ChartContainer } from "@/components/ui/chart/Chart";
+import { ChartConfig, ChartContainer } from "@/components/shadcn/chart/Chart";
import { ChartLegend } from "./shared/chart-legend";
import { DonutDataPoint } from "./types";
diff --git a/ui/components/graphs/line-chart.tsx b/ui/components/graphs/line-chart.tsx
index 9b9b676f18..eab0551bb6 100644
--- a/ui/components/graphs/line-chart.tsx
+++ b/ui/components/graphs/line-chart.tsx
@@ -15,7 +15,7 @@ import {
ChartConfig,
ChartContainer,
ChartTooltip,
-} from "@/components/ui/chart/Chart";
+} from "@/components/shadcn/chart/Chart";
import { AlertPill } from "./shared/alert-pill";
import { ChartLegend } from "./shared/chart-legend";
diff --git a/ui/components/graphs/map-region-filter.tsx b/ui/components/graphs/map-region-filter.tsx
index 3b483d1c62..3b779454a8 100644
--- a/ui/components/graphs/map-region-filter.tsx
+++ b/ui/components/graphs/map-region-filter.tsx
@@ -6,7 +6,7 @@ import {
SelectItem,
SelectTrigger,
SelectValue,
-} from "../ui/select/Select";
+} from "@/components/shadcn/select/select";
interface MapRegionFilterProps {
regions: string[];
diff --git a/ui/components/graphs/radar-chart.tsx b/ui/components/graphs/radar-chart.tsx
index 6acd773e39..4fe807b6fd 100644
--- a/ui/components/graphs/radar-chart.tsx
+++ b/ui/components/graphs/radar-chart.tsx
@@ -12,7 +12,7 @@ import {
ChartConfig,
ChartContainer,
ChartTooltip,
-} from "@/components/ui/chart/Chart";
+} from "@/components/shadcn/chart/Chart";
import { AlertPill } from "./shared/alert-pill";
import { RadarDataPoint } from "./types";
diff --git a/ui/components/graphs/sankey-chart.tsx b/ui/components/graphs/sankey-chart.tsx
index f65647d73e..a574954506 100644
--- a/ui/components/graphs/sankey-chart.tsx
+++ b/ui/components/graphs/sankey-chart.tsx
@@ -627,7 +627,7 @@ export function SankeyChart({
</div>
)}
{zeroDataProviders.length > 0 && (
- <div className="border-divider-primary mt-4 border-t pt-4">
+ <div className="border-border-neutral-secondary mt-4 border-t pt-4">
<p className="text-text-neutral-tertiary mb-3 text-xs font-medium tracking-wide uppercase">
Providers with no failed findings
</p>
diff --git a/ui/components/icons/Icons.tsx b/ui/components/icons/Icons.tsx
index 4fc61dec6b..0a2edb0526 100644
--- a/ui/components/icons/Icons.tsx
+++ b/ui/components/icons/Icons.tsx
@@ -1118,12 +1118,25 @@ export const KubernetesIcon: React.FC<IconSvgProps> = ({
);
};
-export const LighthouseIcon: React.FC<IconSvgProps> = ({
+interface LighthouseIconProps extends IconSvgProps {
+ animatedAura?: boolean;
+}
+
+export const LighthouseIcon: React.FC<LighthouseIconProps> = ({
+ animatedAura = false,
size = 19,
width,
height,
...props
}) => {
+ // Gradient defs are referenced by id, and this icon renders many times per
+ // page. Duplicate ids resolve against the FIRST instance in the document —
+ // if that one sits in a display:none subtree (e.g. the desktop sidebar on
+ // mobile), every other copy loses its fill and turns invisible. useId keeps
+ // each instance self-contained; strip its delimiters for url(#...) safety.
+ const uid = React.useId().replace(/[«»:]/g, "");
+ const gradientId = (id: string) => `${id}_${uid}`;
+
return (
<svg
xmlns="http://www.w3.org/2000/svg"
@@ -1135,56 +1148,64 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
>
<path
d="M16.792 11.6488H17.2955L17.4214 12.404L18.0508 12.6557L17.4214 13.0333L17.2955 13.6627H16.792V11.6488Z"
- fill="url(#paint0_linear_10004_99259)"
+ fill={`url(#${gradientId("paint0_linear_10004_99259")})`}
/>
<path
d="M17.295 11.6488H16.7915L16.6657 12.404L15.7845 12.5299L16.6657 13.0333L16.7915 13.6627H17.295V11.6488Z"
- fill="url(#paint1_linear_10004_99259)"
+ fill={`url(#${gradientId("paint1_linear_10004_99259")})`}
/>
<path
d="M16.6985 13.1295C16.6854 13.0787 16.6589 13.0323 16.6218 12.9952C16.5847 12.9581 16.5383 12.9316 16.4875 12.9185L15.5865 12.6862C15.5711 12.6818 15.5576 12.6725 15.548 12.6598C15.5384 12.647 15.5331 12.6315 15.5331 12.6155C15.5331 12.5995 15.5384 12.584 15.548 12.5713C15.5576 12.5585 15.5711 12.5493 15.5865 12.5449L16.4875 12.3124C16.5383 12.2993 16.5847 12.2729 16.6218 12.2358C16.6589 12.1987 16.6854 12.1524 16.6985 12.1016L16.9309 11.2007C16.9352 11.1852 16.9444 11.1716 16.9572 11.162C16.97 11.1523 16.9855 11.147 17.0016 11.147C17.0176 11.147 17.0332 11.1523 17.0459 11.162C17.0587 11.1716 17.068 11.1852 17.0723 11.2007L17.3045 12.1016C17.3176 12.1524 17.3441 12.1988 17.3812 12.2359C17.4183 12.273 17.4647 12.2995 17.5155 12.3126L18.4165 12.5447C18.432 12.549 18.4456 12.5583 18.4554 12.571C18.4651 12.5838 18.4704 12.5995 18.4704 12.6155C18.4704 12.6316 18.4651 12.6472 18.4554 12.66C18.4456 12.6728 18.432 12.682 18.4165 12.6863L17.5155 12.9185C17.4647 12.9316 17.4183 12.9581 17.3812 12.9952C17.3441 13.0323 17.3176 13.0787 17.3045 13.1295L17.0721 14.0304C17.0678 14.0458 17.0586 14.0594 17.0458 14.0691C17.033 14.0788 17.0174 14.084 17.0014 14.084C16.9854 14.084 16.9698 14.0788 16.957 14.0691C16.9443 14.0594 16.935 14.0458 16.9307 14.0304L16.6985 13.1295Z"
- stroke="url(#paint2_linear_10004_99259)"
+ stroke={`url(#${gradientId("paint2_linear_10004_99259")})`}
strokeWidth="0.643499"
strokeLinecap="round"
strokeLinejoin="round"
/>
<path
d="M2.31079 4.89459H3.04694L3.23098 5.99873L4.15116 6.36677L3.23098 6.91884L3.04694 7.83895H2.31079V4.89459Z"
- fill="url(#paint3_linear_10004_99259)"
+ fill={`url(#${gradientId("paint3_linear_10004_99259")})`}
/>
<path
d="M3.04706 4.89459H2.31091L2.12687 5.99873L0.838614 6.18275L2.12687 6.91884L2.31091 7.83895H3.04706V4.89459Z"
- fill="url(#paint4_linear_10004_99259)"
+ fill={`url(#${gradientId("paint4_linear_10004_99259")})`}
/>
<path
d="M2.17422 7.05874C2.15505 6.98444 2.11632 6.91664 2.06206 6.86238C2.0078 6.80812 1.93999 6.7694 1.86568 6.75023L0.54844 6.41059C0.525966 6.40421 0.506187 6.39067 0.492102 6.37204C0.478018 6.3534 0.470398 6.33068 0.470398 6.30732C0.470398 6.28396 0.478018 6.26124 0.492102 6.2426C0.506187 6.22396 0.525966 6.21043 0.54844 6.20405L1.86568 5.86419C1.93996 5.84504 2.00776 5.80635 2.06202 5.75213C2.11628 5.69792 2.15502 5.63015 2.17422 5.5559L2.51389 4.23876C2.52021 4.2162 2.53373 4.19632 2.5524 4.18216C2.57106 4.168 2.59385 4.16034 2.61728 4.16034C2.64071 4.16034 2.66349 4.168 2.68216 4.18216C2.70082 4.19632 2.71435 4.2162 2.72066 4.23876L3.06012 5.5559C3.07928 5.63019 3.11801 5.698 3.17228 5.75226C3.22654 5.80651 3.29435 5.84524 3.36865 5.86441L4.6859 6.20384C4.70855 6.21009 4.72853 6.22359 4.74276 6.24228C4.757 6.26098 4.76471 6.28382 4.76471 6.30732C4.76471 6.33082 4.757 6.35366 4.74276 6.37235C4.72853 6.39105 4.70855 6.40455 4.6859 6.4108L3.36865 6.75023C3.29435 6.7694 3.22654 6.80812 3.17228 6.86238C3.11801 6.91664 3.07928 6.98444 3.06012 7.05874L2.72044 8.37588C2.71413 8.39844 2.70061 8.41832 2.68194 8.43248C2.66328 8.44664 2.64049 8.4543 2.61706 8.4543C2.59363 8.4543 2.57085 8.44664 2.55218 8.43248C2.53351 8.41832 2.51999 8.39844 2.51368 8.37588L2.17422 7.05874Z"
- stroke="url(#paint5_linear_10004_99259)"
+ stroke={`url(#${gradientId("paint5_linear_10004_99259")})`}
strokeWidth="0.940817"
strokeLinecap="round"
strokeLinejoin="round"
/>
<path
- d="M7.42609 2.81921C11.9573 2.81921 13.3237 2.85331 13.7679 2.97546C16.3331 3.65291 18.0099 6.18425 17.5882 8.73816C17.4875 9.31539 17.2796 9.8738 16.9905 10.3885L16.9407 10.1913L16.9378 10.1825L16.9105 10.1073C16.8878 10.0584 16.8567 10.0136 16.8196 9.97449L16.7591 9.9198L16.6907 9.87683C16.6195 9.83923 16.5397 9.81922 16.4583 9.81921C16.3769 9.81924 16.2972 9.83916 16.2259 9.87683L16.1575 9.9198C16.0926 9.96912 16.0412 10.0341 16.0071 10.1073L15.9788 10.1825L15.9769 10.1913L15.6888 11.3055L14.5735 11.5936L14.5648 11.5966C14.4866 11.6187 14.415 11.6592 14.3568 11.7147L14.303 11.7753C14.2379 11.8616 14.2025 11.9669 14.2025 12.0751C14.2025 12.1833 14.2378 12.2895 14.303 12.3759C14.3684 12.462 14.4607 12.5241 14.5648 12.5536L14.5638 12.5546L14.5735 12.5565L14.6956 12.5878C14.6713 12.5997 14.6479 12.6133 14.6234 12.6249C13.8904 12.9691 13.8233 12.9802 12.0911 13.0135L10.3138 13.0585L9.75812 12.4921C9.45833 12.1812 9.16972 11.9257 9.12531 11.9257C9.08095 11.9293 9.03644 13.1718 9.03644 14.702V17.4784H5.14972V7.47644L5.29523 7.38855L6.25714 7.14148L6.26984 7.13757C6.46419 7.08384 6.63587 6.96787 6.75812 6.8075C6.88031 6.64687 6.94757 6.44974 6.94757 6.24792C6.94746 6.09685 6.91016 5.94847 6.84015 5.81628L6.75812 5.68933L6.65753 5.57703C6.58501 5.50863 6.50193 5.45184 6.41144 5.41003L6.26984 5.35828L6.25714 5.35535L4.19073 4.82214L3.67413 2.81921H7.42609ZM9.0589 7.95007L9.0921 9.09363L10.7581 9.12683C11.7576 9.14904 12.5906 9.1157 12.846 9.03796C13.3013 8.90462 13.7015 8.39421 13.7015 7.95007C13.7014 7.58362 13.3897 7.08369 13.0677 6.93933C12.9111 6.86172 12.0341 6.81726 10.9134 6.81726H9.0257L9.0589 7.95007ZM1.81476 2.9823L1.65167 2.81921H1.85675L1.81476 2.9823Z"
- fill="url(#paint6_linear_10004_99259)"
+ d="M7.42609 2.81921C11.9573 2.81921 13.3237 2.85331 13.7679 2.97546C16.3331 3.65291 18.0099 6.18425 17.5882 8.73816C17.4875 9.31539 17.2796 9.8738 16.9905 10.3885L16.9407 10.1913L16.9378 10.1825L16.9105 10.1073C16.8878 10.0584 16.8567 10.0136 16.8196 9.97449L16.7591 9.9198L16.6907 9.87683C16.6195 9.83923 16.5397 9.81922 16.4583 9.81921C16.3769 9.81924 16.2972 9.83916 16.2259 9.87683L16.1575 9.9198C16.0926 9.96912 16.0412 10.0341 16.0071 10.1073L15.9788 10.1825L15.9769 10.1913L15.6888 11.3055L14.5735 11.5936L14.5648 11.5966C14.4866 11.6187 14.415 11.6592 14.3568 11.7147L14.303 11.7753C14.2379 11.8616 14.2025 11.9669 14.2025 12.0751C14.2025 12.1833 14.2378 12.2895 14.303 12.3759C14.3684 12.462 14.4607 12.5241 14.5648 12.5536L14.5638 12.5546L14.5735 12.5565L14.6956 12.5878C14.6713 12.5997 14.6479 12.6133 14.6234 12.6249C13.8904 12.9691 13.8233 12.9802 12.0911 13.0135L10.3138 13.0585L9.75812 12.4921C9.45833 12.1812 9.16972 11.9257 9.12531 11.9257C9.08095 11.9293 9.03644 13.1718 9.03644 14.702V17.4784H5.14972V7.47644L5.29523 7.38855L6.25714 7.14148L6.26984 7.13757C6.46419 7.08384 6.63587 6.96787 6.75812 6.8075C6.88031 6.64687 6.94757 6.44974 6.94757 6.24792C6.94746 6.09685 6.91016 5.94847 6.84015 5.81628L6.75812 5.68933L6.65753 5.57703C6.58501 5.50863 6.50193 5.45184 6.41144 5.41003L6.26984 5.35828L6.25714 5.35535L4.19073 4.82214L3.67413 2.81921H7.42609ZM9.0589 7.95007L9.0921 9.09363L10.7581 9.12683C11.7576 9.14904 12.5906 9.1157 12.846 9.03796C13.3013 8.90462 13.7015 8.39421 13.7015 7.95007C13.7014 7.58362 13.3897 7.08369 13.0677 6.93933C12.9111 6.86172 12.0341 6.81726 10.9134 6.81726H9.0257L9.0589 7.95007Z"
+ fill={`url(#${gradientId("paint6_linear_10004_99259")})`}
/>
+ {animatedAura ? (
+ <path
+ d="M7.42609 2.81921C11.9573 2.81921 13.3237 2.85331 13.7679 2.97546C16.3331 3.65291 18.0099 6.18425 17.5882 8.73816C17.4875 9.31539 17.2796 9.8738 16.9905 10.3885L16.9407 10.1913L16.9378 10.1825L16.9105 10.1073C16.8878 10.0584 16.8567 10.0136 16.8196 9.97449L16.7591 9.9198L16.6907 9.87683C16.6195 9.83923 16.5397 9.81922 16.4583 9.81921C16.3769 9.81924 16.2972 9.83916 16.2259 9.87683L16.1575 9.9198C16.0926 9.96912 16.0412 10.0341 16.0071 10.1073L15.9788 10.1825L15.9769 10.1913L15.6888 11.3055L14.5735 11.5936L14.5648 11.5966C14.4866 11.6187 14.415 11.6592 14.3568 11.7147L14.303 11.7753C14.2379 11.8616 14.2025 11.9669 14.2025 12.0751C14.2025 12.1833 14.2378 12.2895 14.303 12.3759C14.3684 12.462 14.4607 12.5241 14.5648 12.5536L14.5638 12.5546L14.5735 12.5565L14.6956 12.5878C14.6713 12.5997 14.6479 12.6133 14.6234 12.6249C13.8904 12.9691 13.8233 12.9802 12.0911 13.0135L10.3138 13.0585L9.75812 12.4921C9.45833 12.1812 9.16972 11.9257 9.12531 11.9257C9.08095 11.9293 9.03644 13.1718 9.03644 14.702V17.4784H5.14972V7.47644L5.29523 7.38855L6.25714 7.14148L6.26984 7.13757C6.46419 7.08384 6.63587 6.96787 6.75812 6.8075C6.88031 6.64687 6.94757 6.44974 6.94757 6.24792C6.94746 6.09685 6.91016 5.94847 6.84015 5.81628L6.75812 5.68933L6.65753 5.57703C6.58501 5.50863 6.50193 5.45184 6.41144 5.41003L6.26984 5.35828L6.25714 5.35535L4.19073 4.82214L3.67413 2.81921H7.42609ZM9.0589 7.95007L9.0921 9.09363L10.7581 9.12683C11.7576 9.14904 12.5906 9.1157 12.846 9.03796C13.3013 8.90462 13.7015 8.39421 13.7015 7.95007C13.7014 7.58362 13.3897 7.08369 13.0677 6.93933C12.9111 6.86172 12.0341 6.81726 10.9134 6.81726H9.0257L9.0589 7.95007Z"
+ fill={`url(#${gradientId("paint10_radial_10004_99259")})`}
+ opacity="0.58"
+ style={{ mixBlendMode: "screen" }}
+ />
+ ) : null}
<path
d="M16.7691 0.565186H17.114L17.2002 1.08243L17.6313 1.25485L17.2002 1.51347L17.114 1.94451H16.7691V0.565186Z"
- fill="url(#paint7_linear_10004_99259)"
+ fill={`url(#${gradientId("paint7_linear_10004_99259")})`}
/>
<path
d="M17.1139 0.565186H16.769L16.6828 1.08243L16.0793 1.16864L16.6828 1.51347L16.769 1.94451H17.1139V0.565186Z"
- fill="url(#paint8_linear_10004_99259)"
+ fill={`url(#${gradientId("paint8_linear_10004_99259")})`}
/>
<path
d="M16.7049 1.5782C16.6959 1.54339 16.6778 1.51163 16.6524 1.48621C16.627 1.46079 16.5952 1.44265 16.5604 1.43367L15.9433 1.27456C15.9328 1.27157 15.9235 1.26523 15.9169 1.2565C15.9103 1.24777 15.9067 1.23713 15.9067 1.22618C15.9067 1.21524 15.9103 1.2046 15.9169 1.19586C15.9235 1.18713 15.9328 1.18079 15.9433 1.17781L16.5604 1.01859C16.5952 1.00962 16.6269 0.991496 16.6524 0.966097C16.6778 0.940698 16.6959 0.908955 16.7049 0.874167L16.864 0.257133C16.867 0.246565 16.8733 0.237254 16.8821 0.230621C16.8908 0.223988 16.9015 0.220398 16.9125 0.220398C16.9235 0.220398 16.9341 0.223988 16.9429 0.230621C16.9516 0.237254 16.9579 0.246565 16.9609 0.257133L17.1199 0.874167C17.1289 0.908973 17.1471 0.940738 17.1725 0.966155C17.1979 0.991573 17.2297 1.00972 17.2645 1.01869L17.8816 1.1777C17.8922 1.18063 17.9015 1.18696 17.9082 1.19572C17.9149 1.20447 17.9185 1.21518 17.9185 1.22618C17.9185 1.23719 17.9149 1.24789 17.9082 1.25665C17.9015 1.26541 17.8922 1.27173 17.8816 1.27466L17.2645 1.43367C17.2297 1.44265 17.1979 1.46079 17.1725 1.48621C17.1471 1.51163 17.1289 1.54339 17.1199 1.5782L16.9608 2.19523C16.9578 2.2058 16.9515 2.21511 16.9428 2.22174C16.934 2.22838 16.9234 2.23197 16.9124 2.23197C16.9014 2.23197 16.8907 2.22838 16.882 2.22174C16.8732 2.21511 16.8669 2.2058 16.8639 2.19523L16.7049 1.5782Z"
- stroke="url(#paint9_linear_10004_99259)"
+ stroke={`url(#${gradientId("paint9_linear_10004_99259")})`}
strokeWidth="0.44074"
strokeLinecap="round"
strokeLinejoin="round"
/>
<defs>
<linearGradient
- id="paint0_linear_10004_99259"
+ id={gradientId("paint0_linear_10004_99259")}
x1="16.8241"
y1="11.8964"
x2="18.1535"
@@ -1195,7 +1216,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="1" stopColor="#62DFF0" />
</linearGradient>
<linearGradient
- id="paint1_linear_10004_99259"
+ id={gradientId("paint1_linear_10004_99259")}
x1="17.2565"
y1="11.8964"
x2="15.6648"
@@ -1206,7 +1227,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="1" stopColor="#62DFF0" />
</linearGradient>
<linearGradient
- id="paint2_linear_10004_99259"
+ id={gradientId("paint2_linear_10004_99259")}
x1="15.6082"
y1="11.5082"
x2="18.6858"
@@ -1217,7 +1238,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="1" stopColor="#62DFF0" />
</linearGradient>
<linearGradient
- id="paint3_linear_10004_99259"
+ id={gradientId("paint3_linear_10004_99259")}
x1="3.23098"
y1="4.89459"
x2="3.23098"
@@ -1228,7 +1249,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="0.831731" stopColor="#23C176" />
</linearGradient>
<linearGradient
- id="paint4_linear_10004_99259"
+ id={gradientId("paint4_linear_10004_99259")}
x1="1.94284"
y1="4.89459"
x2="1.94284"
@@ -1239,7 +1260,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="0.831731" stopColor="#23C176" />
</linearGradient>
<linearGradient
- id="paint5_linear_10004_99259"
+ id={gradientId("paint5_linear_10004_99259")}
x1="0.580082"
y1="4.68836"
x2="5.07973"
@@ -1250,18 +1271,36 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="1" stopColor="#62DFF0" />
</linearGradient>
<linearGradient
- id="paint6_linear_10004_99259"
+ id={gradientId("paint6_linear_10004_99259")}
x1="2.06038"
y1="4.62182"
x2="18.786"
y2="6.69814"
gradientUnits="userSpaceOnUse"
>
- <stop stopColor="#2EE59B" />
- <stop offset="1" stopColor="#62DFF0" />
+ <stop stopColor="#2EE59B">
+ {animatedAura ? (
+ <animate
+ attributeName="stop-color"
+ values="#2EE59B;#62DFF0;#23C176;#2EE59B"
+ dur="7s"
+ repeatCount="indefinite"
+ />
+ ) : null}
+ </stop>
+ <stop offset="1" stopColor="#62DFF0">
+ {animatedAura ? (
+ <animate
+ attributeName="stop-color"
+ values="#62DFF0;#2EE59B;#0A776E;#62DFF0"
+ dur="7s"
+ repeatCount="indefinite"
+ />
+ ) : null}
+ </stop>
</linearGradient>
<linearGradient
- id="paint7_linear_10004_99259"
+ id={gradientId("paint7_linear_10004_99259")}
x1="17.2002"
y1="0.565186"
x2="17.2002"
@@ -1272,7 +1311,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="0.831731" stopColor="#23C176" />
</linearGradient>
<linearGradient
- id="paint8_linear_10004_99259"
+ id={gradientId("paint8_linear_10004_99259")}
x1="16.5966"
y1="0.565186"
x2="16.5966"
@@ -1283,7 +1322,7 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop offset="0.831731" stopColor="#23C176" />
</linearGradient>
<linearGradient
- id="paint9_linear_10004_99259"
+ id={gradientId("paint9_linear_10004_99259")}
x1="15.9581"
y1="0.467756"
x2="18.0661"
@@ -1293,6 +1332,25 @@ export const LighthouseIcon: React.FC<IconSvgProps> = ({
<stop stopColor="#2EE59B" />
<stop offset="1" stopColor="#62DFF0" />
</linearGradient>
+ {animatedAura ? (
+ <radialGradient id={gradientId("paint10_radial_10004_99259")}>
+ <stop offset="0" stopColor="#62DFF0" stopOpacity="0.95" />
+ <stop offset="0.45" stopColor="#2EE59B" stopOpacity="0.75" />
+ <stop offset="1" stopColor="#0A776E" stopOpacity="0" />
+ <animate
+ attributeName="cx"
+ values="20%;78%;35%;20%"
+ dur="9s"
+ repeatCount="indefinite"
+ />
+ <animate
+ attributeName="cy"
+ values="30%;42%;82%;30%"
+ dur="9s"
+ repeatCount="indefinite"
+ />
+ </radialGradient>
+ ) : null}
</defs>
</svg>
);
diff --git a/ui/components/icons/index.ts b/ui/components/icons/index.ts
index 7912d466fd..649e0c1b4c 100644
--- a/ui/components/icons/index.ts
+++ b/ui/components/icons/index.ts
@@ -1,4 +1,5 @@
export * from "./compliance/IconCompliance";
export * from "./Icons";
+export * from "./lighthouse-icon-with-aura";
export * from "./prowler/ProwlerIcons";
export * from "./services/IconServices";
diff --git a/ui/components/icons/lighthouse-icon-with-aura.tsx b/ui/components/icons/lighthouse-icon-with-aura.tsx
new file mode 100644
index 0000000000..4bf51c4e6e
--- /dev/null
+++ b/ui/components/icons/lighthouse-icon-with-aura.tsx
@@ -0,0 +1,7 @@
+import type { IconSvgProps } from "@/types";
+
+import { LighthouseIcon } from "./Icons";
+
+export function LighthouseIconWithAura(props: IconSvgProps) {
+ return <LighthouseIcon animatedAura {...props} />;
+}
diff --git a/ui/components/icons/lighthouse-icon.test.tsx b/ui/components/icons/lighthouse-icon.test.tsx
new file mode 100644
index 0000000000..6422da5787
--- /dev/null
+++ b/ui/components/icons/lighthouse-icon.test.tsx
@@ -0,0 +1,51 @@
+import { render } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { LighthouseIcon } from "./Icons";
+
+describe("LighthouseIcon", () => {
+ it("keeps gradient ids unique across instances", () => {
+ // Given: the icon rendered several times on one page (sidebar, navbar,
+ // overview banner) — with duplicate ids, browsers resolve url(#...)
+ // against the first instance, which may sit in a display:none subtree
+ // (the desktop sidebar on mobile) and leave the others unpainted.
+ const { container } = render(
+ <>
+ <LighthouseIcon />
+ <LighthouseIcon />
+ <LighthouseIcon animatedAura />
+ </>,
+ );
+
+ // Then: every gradient id is unique document-wide
+ const ids = Array.from(
+ container.querySelectorAll("linearGradient, radialGradient"),
+ ).map((gradient) => gradient.id);
+ expect(ids.length).toBeGreaterThan(0);
+ expect(new Set(ids).size).toBe(ids.length);
+ });
+
+ it("paints every path from its own instance's defs", () => {
+ // Given
+ const { container } = render(<LighthouseIcon />);
+ const svg = container.querySelector("svg") as SVGElement;
+ const localIds = new Set(
+ Array.from(svg.querySelectorAll("linearGradient, radialGradient")).map(
+ (gradient) => gradient.id,
+ ),
+ );
+
+ // Then: every fill/stroke reference resolves inside this same svg
+ const references = Array.from(svg.querySelectorAll("path"))
+ .flatMap((path) => [
+ path.getAttribute("fill"),
+ path.getAttribute("stroke"),
+ ])
+ .filter((paint): paint is string => paint?.startsWith("url(#") ?? false);
+ expect(references.length).toBeGreaterThan(0);
+ for (const reference of references) {
+ const id = reference.slice("url(#".length, -1);
+ expect(localIds.has(id)).toBe(true);
+ }
+ });
+});
diff --git a/ui/components/icons/providers-badge/generic-provider-badge.tsx b/ui/components/icons/providers-badge/generic-provider-badge.tsx
new file mode 100644
index 0000000000..50f37acbd6
--- /dev/null
+++ b/ui/components/icons/providers-badge/generic-provider-badge.tsx
@@ -0,0 +1,22 @@
+import { Boxes } from "lucide-react";
+import { type FC } from "react";
+
+import { IconSvgProps } from "@/types";
+
+/**
+ * Neutral fallback glyph for any dynamic provider
+ */
+export const GenericProviderBadge: FC<IconSvgProps> = ({
+ size,
+ width,
+ height,
+ ...props
+}) => (
+ <Boxes
+ aria-hidden="true"
+ focusable="false"
+ width={size ?? width}
+ height={size ?? height}
+ {...props}
+ />
+);
diff --git a/ui/components/icons/providers-badge/provider-type-icon.test.tsx b/ui/components/icons/providers-badge/provider-type-icon.test.tsx
index 96b4f5f4d4..c9e6ae3c2a 100644
--- a/ui/components/icons/providers-badge/provider-type-icon.test.tsx
+++ b/ui/components/icons/providers-badge/provider-type-icon.test.tsx
@@ -29,7 +29,8 @@ vi.mock("@/components/icons/providers-badge", () => ({
}));
// Render the tooltip pieces inline so the hover content is queryable in jsdom.
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Badge: ({ children }: { children: React.ReactNode }) => (
<span data-testid="badge">{children}</span>
),
@@ -49,17 +50,17 @@ describe("ProviderTypeIcon", () => {
expect(await screen.findByText("AWS")).toBeInTheDocument();
});
- it("renders a sized placeholder instead of crashing for an unknown type", () => {
- // Regression guard for #9991: an unknown provider type must not throw.
+ it("renders the neutral generic glyph for an unknown type (no crash)", () => {
+ // Regression guard for #9991 + dynamic providers: an unknown provider type
+ // renders the shared generic glyph, not a brand badge or an empty box.
const { container } = render(
<ProviderTypeIcon type={UNKNOWN_TYPE} size={24} />,
);
expect(screen.queryByText("AWS")).not.toBeInTheDocument();
- expect(container.querySelector("div")).toHaveStyle({
- width: "24px",
- height: "24px",
- });
+ const glyph = container.querySelector("svg");
+ expect(glyph).toBeInTheDocument();
+ expect(glyph).toHaveAttribute("width", "24");
});
});
@@ -110,9 +111,10 @@ describe("ProviderTypeIconStack", () => {
expect(screen.queryByText("Okta")).not.toBeInTheDocument();
});
- it("renders known icons and skips unknown types without crashing", async () => {
- // Regression guard for #9991: an unknown type in the stack must not throw.
- render(
+ it("renders known icons and the generic glyph for unknown types without crashing", async () => {
+ // Regression guard for #9991: an unknown type in the stack must not throw;
+ // it now renders the neutral generic glyph alongside the known badge.
+ const { container } = render(
<ProviderTypeIconStack
items={[
{ key: "a", type: "aws", tooltip: "111" },
@@ -122,5 +124,7 @@ describe("ProviderTypeIconStack", () => {
);
expect(await screen.findByText("AWS")).toBeInTheDocument();
+ // The unknown item renders the generic glyph (an svg), not an empty slot.
+ expect(container.querySelector("svg")).toBeInTheDocument();
});
});
diff --git a/ui/components/icons/providers-badge/provider-type-icon.tsx b/ui/components/icons/providers-badge/provider-type-icon.tsx
index c3915f7d40..d042f61d3d 100644
--- a/ui/components/icons/providers-badge/provider-type-icon.tsx
+++ b/ui/components/icons/providers-badge/provider-type-icon.tsx
@@ -9,7 +9,13 @@ import {
TooltipTrigger,
} from "@/components/shadcn";
import { cn } from "@/lib/utils";
-import type { ProviderType } from "@/types/providers";
+import {
+ isKnownProviderType,
+ type KnownProviderType,
+ type ProviderType,
+} from "@/types/providers";
+
+import { GenericProviderBadge } from "./generic-provider-badge";
type IconProps = { width: number; height: number };
@@ -106,7 +112,7 @@ const OktaProviderBadge = lazy(() =>
* selectors so both stay in sync on labels, icons, and sizing.
*/
export const PROVIDER_TYPE_DATA: Record<
- ProviderType,
+ KnownProviderType,
{ label: string; icon: ComponentType<IconProps> }
> = {
aws: { label: "Amazon Web Services", icon: AWSProviderBadge },
@@ -139,21 +145,21 @@ interface ProviderTypeIconProps {
}
/**
- * Renders a single provider-type badge with a sized placeholder fallback.
+ * Renders a single provider-type badge.
*
- * Falls back to the placeholder for provider types missing from
- * `PROVIDER_TYPE_DATA` (e.g. a brand-new provider the API knows but this UI
- * build does not). The `type` is statically typed as `ProviderType`, so this
- * only guards the runtime case — see #9991, which fixed the same crash class.
+ * Providers outside the known set — a dynamic SDK plug-in — render the neutral
+ * generic glyph instead of a bespoke brand badge. The widened `ProviderType`
+ * forces this fallback branch to be handled at compile time.
*/
export const ProviderTypeIcon = ({
type,
size = 18,
}: ProviderTypeIconProps) => {
- const data = PROVIDER_TYPE_DATA[type];
- if (!data) return <IconPlaceholder width={size} height={size} />;
+ if (!isKnownProviderType(type)) {
+ return <GenericProviderBadge size={size} />;
+ }
- const Icon = data.icon;
+ const Icon = PROVIDER_TYPE_DATA[type].icon;
return (
<Suspense fallback={<IconPlaceholder width={size} height={size} />}>
<Icon width={size} height={size} />
diff --git a/ui/components/icons/prowler/ProwlerIcons.test.tsx b/ui/components/icons/prowler/ProwlerIcons.test.tsx
new file mode 100644
index 0000000000..5fca4420e4
--- /dev/null
+++ b/ui/components/icons/prowler/ProwlerIcons.test.tsx
@@ -0,0 +1,49 @@
+import { cleanup, render, screen } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { ProwlerBrand } from "./ProwlerIcons";
+
+describe("ProwlerBrand", () => {
+ afterEach(() => {
+ cleanup();
+ vi.unstubAllEnvs();
+ });
+
+ it("should render the Local Server lockups outside Cloud", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ render(<ProwlerBrand />);
+
+ // Then
+ const logo = screen.getByRole("img", { name: "Prowler Local Server" });
+ const sources = Array.from(logo.querySelectorAll("img"), (image) =>
+ image.getAttribute("src"),
+ );
+
+ expect(sources).toEqual([
+ "/logos/prowler-local-server-light.svg",
+ "/logos/prowler-local-server-dark.svg",
+ ]);
+ });
+
+ it("should render the Prowler Cloud lockups in Cloud", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ render(<ProwlerBrand />);
+
+ // Then
+ const logo = screen.getByRole("img", { name: "Prowler Cloud" });
+ const sources = Array.from(logo.querySelectorAll("img"), (image) =>
+ image.getAttribute("src"),
+ );
+
+ expect(sources).toEqual([
+ "/logos/prowler-cloud-light.svg",
+ "/logos/prowler-cloud-dark.svg",
+ ]);
+ });
+});
diff --git a/ui/components/icons/prowler/ProwlerIcons.tsx b/ui/components/icons/prowler/ProwlerIcons.tsx
index 4a616553a4..795b040a28 100644
--- a/ui/components/icons/prowler/ProwlerIcons.tsx
+++ b/ui/components/icons/prowler/ProwlerIcons.tsx
@@ -1,7 +1,59 @@
+import Image from "next/image";
import React from "react";
+import { isCloud } from "@/lib/shared/env";
+import { cn } from "@/lib/utils";
+
import { IconSvgProps } from "../../../types/index";
+const PROWLER_BRAND = {
+ CLOUD: {
+ name: "Prowler Cloud",
+ lightLogo: "/logos/prowler-cloud-light.svg",
+ darkLogo: "/logos/prowler-cloud-dark.svg",
+ },
+ LOCAL_SERVER: {
+ name: "Prowler Local Server",
+ lightLogo: "/logos/prowler-local-server-light.svg",
+ darkLogo: "/logos/prowler-local-server-dark.svg",
+ },
+} as const;
+
+interface ProwlerBrandProps {
+ className?: string;
+}
+
+export const ProwlerBrand = ({ className }: ProwlerBrandProps) => {
+ const brand = isCloud() ? PROWLER_BRAND.CLOUD : PROWLER_BRAND.LOCAL_SERVER;
+
+ return (
+ <span
+ role="img"
+ aria-label={brand.name}
+ className={cn("inline-grid", className)}
+ >
+ <Image
+ src={brand.lightLogo}
+ alt=""
+ aria-hidden="true"
+ width={200}
+ height={63.14}
+ unoptimized
+ className="col-start-1 row-start-1 h-auto w-full dark:hidden"
+ />
+ <Image
+ src={brand.darkLogo}
+ alt=""
+ aria-hidden="true"
+ width={200}
+ height={63.14}
+ unoptimized
+ className="col-start-1 row-start-1 hidden h-auto w-full dark:block"
+ />
+ </span>
+ );
+};
+
export const ProwlerExtended: React.FC<IconSvgProps> = ({
size,
width = 216,
@@ -10,7 +62,7 @@ export const ProwlerExtended: React.FC<IconSvgProps> = ({
}) => {
return (
<svg
- className="text-prowler-black dark:text-prowler-white"
+ className="text-black dark:text-white"
xmlns="http://www.w3.org/2000/svg"
viewBox="0 0 1233.67 204.4"
fill="none"
@@ -37,7 +89,7 @@ export const ProwlerShort: React.FC<IconSvgProps> = ({
...props
}) => (
<svg
- className="text-prowler-black dark:text-prowler-white"
+ className="text-black dark:text-white"
xmlns="http://www.w3.org/2000/svg"
viewBox="0 0 432.08 396.77"
fill="none"
diff --git a/ui/components/integrations/api-key/api-key-link-card.test.tsx b/ui/components/integrations/api-key/api-key-link-card.test.tsx
new file mode 100644
index 0000000000..c0c8c3fe28
--- /dev/null
+++ b/ui/components/integrations/api-key/api-key-link-card.test.tsx
@@ -0,0 +1,16 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { ApiKeyLinkCard } from "./api-key-link-card";
+
+describe("ApiKeyLinkCard", () => {
+ it("links directly to the API Keys section in the user profile", () => {
+ // Given / When
+ render(<ApiKeyLinkCard />);
+
+ // Then
+ expect(
+ screen.getByRole("link", { name: /go to profile/i }),
+ ).toHaveAttribute("href", "/profile#api-keys");
+ });
+});
diff --git a/ui/components/integrations/api-key/api-key-link-card.tsx b/ui/components/integrations/api-key/api-key-link-card.tsx
index 7196b533b9..b54c764f4e 100644
--- a/ui/components/integrations/api-key/api-key-link-card.tsx
+++ b/ui/components/integrations/api-key/api-key-link-card.tsx
@@ -13,7 +13,7 @@ export const ApiKeyLinkCard = () => {
learnMoreUrl="https://docs.prowler.com/user-guide/tutorials/prowler-app-api-keys"
learnMoreAriaLabel="Learn more about API Keys"
bodyText="API Key management is available in your User Profile. Create and manage API keys to authenticate with the Prowler API for automation and integrations."
- linkHref="/profile"
+ linkHref="/profile#api-keys"
linkText="Go to Profile"
/>
);
diff --git a/ui/components/integrations/jira/jira-integration-card.tsx b/ui/components/integrations/jira/jira-integration-card.tsx
index 1aa391e4b4..4629215f5e 100644
--- a/ui/components/integrations/jira/jira-integration-card.tsx
+++ b/ui/components/integrations/jira/jira-integration-card.tsx
@@ -5,7 +5,7 @@ import Link from "next/link";
import { JiraIcon } from "@/components/icons/services/IconServices";
import { Button } from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Card, CardContent, CardHeader } from "../../shadcn";
diff --git a/ui/components/integrations/jira/jira-integration-form.tsx b/ui/components/integrations/jira/jira-integration-form.tsx
index eee4412cf3..8068d010ff 100644
--- a/ui/components/integrations/jira/jira-integration-form.tsx
+++ b/ui/components/integrations/jira/jira-integration-form.tsx
@@ -4,11 +4,11 @@ import { zodResolver } from "@hookform/resolvers/zod";
import { useForm } from "react-hook-form";
import { createIntegration, updateIntegration } from "@/actions/integrations";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { Form } from "@/components/ui/form";
-import { FormButtons } from "@/components/ui/form/form-buttons";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { Form } from "@/components/shadcn/form";
+import { FormButtons } from "@/components/shadcn/form/form-buttons";
import {
type CreateValues,
editJiraIntegrationFormSchema,
@@ -222,7 +222,7 @@ export const JiraIntegrationForm = ({
>
<div className="flex flex-col gap-4">
<div className="flex flex-col items-start gap-2 sm:flex-row sm:items-center">
- <p className="text-default-500 flex items-center gap-2 text-sm">
+ <p className="text-text-neutral-tertiary flex items-center gap-2 text-sm">
Need help configuring your Jira integration?
</p>
<CustomLink
diff --git a/ui/components/integrations/jira/jira-integrations-manager.tsx b/ui/components/integrations/jira/jira-integrations-manager.tsx
index e2583f158e..c3f3a1412f 100644
--- a/ui/components/integrations/jira/jira-integrations-manager.tsx
+++ b/ui/components/integrations/jira/jira-integrations-manager.tsx
@@ -16,9 +16,9 @@ import {
IntegrationSkeleton,
} from "@/components/integrations/shared";
import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { DataTablePagination } from "@/components/ui/table/data-table-pagination";
+import { DataTablePagination } from "@/components/shadcn/table/data-table-pagination";
import { triggerTestConnectionWithDelay } from "@/lib/integrations/test-connection-helper";
import { MetaDataProps } from "@/types";
import { IntegrationProps } from "@/types/integrations";
diff --git a/ui/components/integrations/s3/s3-integration-card.tsx b/ui/components/integrations/s3/s3-integration-card.tsx
index e777a729de..7e2be1890d 100644
--- a/ui/components/integrations/s3/s3-integration-card.tsx
+++ b/ui/components/integrations/s3/s3-integration-card.tsx
@@ -5,7 +5,7 @@ import Link from "next/link";
import { AmazonS3Icon } from "@/components/icons/services/IconServices";
import { Button } from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Card, CardContent, CardHeader } from "../../shadcn";
diff --git a/ui/components/integrations/s3/s3-integration-form.test.tsx b/ui/components/integrations/s3/s3-integration-form.test.tsx
new file mode 100644
index 0000000000..7186cc42ed
--- /dev/null
+++ b/ui/components/integrations/s3/s3-integration-form.test.tsx
@@ -0,0 +1,244 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ComponentProps } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { IntegrationProps } from "@/types/integrations";
+import type { ProviderProps } from "@/types/providers";
+
+import { S3IntegrationForm } from "./s3-integration-form";
+
+const { createIntegrationMock, toastMock, updateIntegrationMock } = vi.hoisted(
+ () => ({
+ createIntegrationMock: vi.fn(),
+ toastMock: vi.fn(),
+ updateIntegrationMock: vi.fn(),
+ }),
+);
+
+vi.mock("@/actions/integrations", () => ({
+ createIntegration: createIntegrationMock,
+ updateIntegration: updateIntegrationMock,
+}));
+
+vi.mock("next-auth/react", () => ({
+ useSession: () => ({
+ data: {
+ tenantId: "tenant-id",
+ },
+ }),
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({
+ toast: toastMock,
+ }),
+}));
+
+interface MockEnhancedMultiSelectProps {
+ onValueChange: (values: string[]) => void;
+ options: Array<{ value: string }>;
+}
+
+vi.mock("@/components/shadcn/select/enhanced-multi-select", () => ({
+ EnhancedMultiSelect: ({
+ onValueChange,
+ options,
+ }: MockEnhancedMultiSelectProps) => (
+ <button
+ type="button"
+ onClick={() => onValueChange(options[0] ? [options[0].value] : [])}
+ >
+ Select first provider
+ </button>
+ ),
+}));
+
+vi.mock(
+ "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form",
+ () => ({
+ AWSRoleCredentialsForm: ({
+ templateLinks,
+ }: {
+ templateLinks: { cloudformationQuickLink: string };
+ }) => (
+ <output aria-label="CloudFormation quick link">
+ {templateLinks.cloudformationQuickLink}
+ </output>
+ ),
+ }),
+);
+
+vi.mock("@/lib", () => ({
+ getAWSCredentialsTemplateLinks: (
+ _externalId: string,
+ _bucketName: string,
+ _integrationType: string,
+ bucketAccountId?: string,
+ ) => ({
+ cloudformation: "https://example.com/cloudformation",
+ terraform: "https://example.com/terraform",
+ cloudformationQuickLink: `https://example.com/quick-create?bucketAccountId=${bucketAccountId ?? ""}`,
+ }),
+}));
+
+function createProvider(
+ provider: ProviderProps["attributes"]["provider"],
+ uid: string,
+): ProviderProps {
+ return {
+ id: `${provider}-provider`,
+ type: "providers",
+ attributes: {
+ provider,
+ is_dynamic: false,
+ uid,
+ alias: `${provider} provider`,
+ status: "completed",
+ resources: 0,
+ connection: {
+ connected: true,
+ last_checked_at: "2026-07-16T00:00:00Z",
+ },
+ scanner_args: {
+ only_logs: false,
+ excluded_checks: [],
+ aws_retries_max_attempts: 3,
+ },
+ inserted_at: "2026-07-16T00:00:00Z",
+ updated_at: "2026-07-16T00:00:00Z",
+ created_by: {
+ object: "users",
+ id: "user-1",
+ },
+ },
+ relationships: {
+ secret: {
+ data: null,
+ },
+ provider_groups: {
+ meta: {
+ count: 0,
+ },
+ data: [],
+ },
+ },
+ };
+}
+
+function renderS3IntegrationForm(
+ props?: Partial<ComponentProps<typeof S3IntegrationForm>>,
+) {
+ return render(
+ <S3IntegrationForm
+ providers={[]}
+ onSuccess={vi.fn()}
+ onCancel={vi.fn()}
+ {...props}
+ />,
+ );
+}
+
+const integration: IntegrationProps = {
+ type: "integrations",
+ id: "integration-1",
+ attributes: {
+ inserted_at: "2026-07-16T00:00:00Z",
+ updated_at: "2026-07-16T00:00:00Z",
+ enabled: true,
+ connected: true,
+ connection_last_checked_at: "2026-07-16T00:00:00Z",
+ integration_type: "amazon_s3",
+ configuration: {
+ bucket_name: "prowler-reports",
+ output_directory: "output",
+ },
+ },
+ relationships: {
+ providers: {
+ data: [{ type: "providers", id: "aws-provider" }],
+ },
+ },
+ links: {
+ self: "/integrations/integration-1",
+ },
+};
+
+describe("S3IntegrationForm", () => {
+ beforeEach(() => {
+ createIntegrationMock.mockReset();
+ toastMock.mockReset();
+ updateIntegrationMock.mockReset();
+ });
+
+ it("should require the bucket owner account ID when it cannot derive one", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderS3IntegrationForm({
+ providers: [createProvider("azure", "subscription-id")],
+ });
+
+ // When
+ await user.type(screen.getByLabelText(/Bucket name/i), "prowler-reports");
+ await user.click(screen.getByRole("button", { name: "Next" }));
+
+ // Then
+ expect(
+ await screen.findByText(
+ "Bucket owner account ID is required when no AWS account is selected",
+ ),
+ ).toBeVisible();
+ expect(
+ screen.queryByLabelText("CloudFormation quick link"),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should derive the bucket owner account ID from the selected AWS provider", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderS3IntegrationForm({
+ providers: [createProvider("aws", "123456789012")],
+ });
+
+ // When
+ await user.click(
+ screen.getByRole("button", { name: "Select first provider" }),
+ );
+ await user.type(screen.getByLabelText(/Bucket name/i), "prowler-reports");
+ await user.click(screen.getByRole("button", { name: "Next" }));
+
+ // Then
+ expect(
+ await screen.findByLabelText("CloudFormation quick link"),
+ ).toHaveTextContent("bucketAccountId=123456789012");
+ });
+
+ it("should not show a bucket account field that configuration updates cannot persist", () => {
+ // When
+ renderS3IntegrationForm({
+ integration,
+ providers: [createProvider("aws", "123456789012")],
+ editMode: "configuration",
+ });
+
+ // Then
+ expect(
+ screen.queryByLabelText(/Bucket owner account ID/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should allow changing the bucket owner account for credential updates", () => {
+ // When
+ renderS3IntegrationForm({
+ integration,
+ providers: [createProvider("aws", "123456789012")],
+ editMode: "credentials",
+ });
+
+ // Then
+ expect(
+ screen.getByLabelText(/Bucket owner account ID/i),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/components/integrations/s3/s3-integration-form.tsx b/ui/components/integrations/s3/s3-integration-form.tsx
index 23be644570..555e7d0d1f 100644
--- a/ui/components/integrations/s3/s3-integration-form.tsx
+++ b/ui/components/integrations/s3/s3-integration-form.tsx
@@ -1,11 +1,11 @@
"use client";
-import { Divider } from "@heroui/divider";
import { zodResolver } from "@hookform/resolvers/zod";
import { ArrowLeftIcon, ArrowRightIcon } from "lucide-react";
import { useSession } from "next-auth/react";
import { useState } from "react";
-import { Control, useForm } from "react-hook-form";
+import type { Control } from "react-hook-form";
+import { useForm } from "react-hook-form";
import { createIntegration, updateIntegration } from "@/actions/integrations";
import {
@@ -13,25 +13,26 @@ import {
ProviderTypeIcon,
} from "@/components/icons/providers-badge/provider-type-icon";
import { AWSRoleCredentialsForm } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { Separator } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import {
Form,
FormControl,
FormField,
FormMessage,
-} from "@/components/ui/form";
-import { FormButtons } from "@/components/ui/form/form-buttons";
+} from "@/components/shadcn/form";
+import { FormButtons } from "@/components/shadcn/form/form-buttons";
+import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
import { getAWSCredentialsTemplateLinks } from "@/lib";
-import { AWSCredentialsRole } from "@/types";
+import type { AWSCredentialsRole } from "@/types";
+import type { IntegrationProps } from "@/types/integrations";
import {
editS3IntegrationFormSchema,
- IntegrationProps,
s3IntegrationFormSchema,
} from "@/types/integrations";
-import { ProviderProps } from "@/types/providers";
+import type { ProviderProps } from "@/types/providers";
interface S3IntegrationFormProps {
integration?: IntegrationProps | null;
@@ -41,6 +42,25 @@ interface S3IntegrationFormProps {
editMode?: "configuration" | "credentials" | null; // null means creating new
}
+const getSelectedAWSAccountId = (
+ selectedProviderIds: string[],
+ providers: ProviderProps[],
+): string => {
+ for (const providerId of selectedProviderIds) {
+ const provider = providers.find(({ id }) => id === providerId);
+ const uid = provider?.attributes.uid;
+ if (
+ provider?.attributes.provider === "aws" &&
+ uid &&
+ /^\d{12}$/.test(uid)
+ ) {
+ return uid;
+ }
+ }
+
+ return "";
+};
+
export const S3IntegrationForm = ({
integration,
providers,
@@ -75,6 +95,7 @@ export const S3IntegrationForm = ({
defaultValues: {
integration_type: "amazon_s3" as const,
bucket_name: integration?.attributes.configuration.bucket_name || "",
+ bucket_account_id: "",
output_directory:
integration?.attributes.configuration.output_directory || "output",
providers:
@@ -94,6 +115,14 @@ export const S3IntegrationForm = ({
});
const isLoading = form.formState.isSubmitting;
+ const selectedProviderIds = form.watch("providers") || [];
+ const bucketAccountIdOverride = form.watch("bucket_account_id")?.trim() || "";
+ const derivedBucketAccountId = getSelectedAWSAccountId(
+ selectedProviderIds,
+ providers,
+ );
+ const resolvedBucketAccountId =
+ bucketAccountIdOverride || derivedBucketAccountId;
const handleNext = async (e: React.FormEvent) => {
e.preventDefault();
@@ -103,18 +132,36 @@ export const S3IntegrationForm = ({
return;
}
- // Validate current step fields for creation flow
+ // Validate current step fields for creation flow. bucket_account_id is
+ // validated here, while its input is visible, so a malformed value surfaces
+ // its error instead of silently blocking the step 1 submit.
const stepFields =
currentStep === 0
- ? (["bucket_name", "output_directory", "providers"] as const)
+ ? ([
+ "bucket_name",
+ "output_directory",
+ "providers",
+ "bucket_account_id",
+ ] as const)
: // Step 1: No required fields since role_arn and external_id are optional
[];
const isValid = stepFields.length === 0 || (await form.trigger(stepFields));
- if (isValid) {
- setCurrentStep(1);
+ if (!isValid) {
+ return;
}
+
+ if (!resolvedBucketAccountId) {
+ form.setError("bucket_account_id", {
+ message:
+ "Bucket owner account ID is required when no AWS account is selected",
+ });
+ return;
+ }
+
+ form.clearErrors("bucket_account_id");
+ setCurrentStep(1);
};
const handleBack = () => {
@@ -255,6 +302,30 @@ export const S3IntegrationForm = ({
}
};
+ const renderBucketAccountIdField = () => (
+ <div className="flex flex-col gap-1">
+ <CustomInput
+ control={form.control}
+ name="bucket_account_id"
+ type="text"
+ label="Bucket owner account ID"
+ labelPlacement="inside"
+ placeholder={
+ derivedBucketAccountId
+ ? `Defaults to ${derivedBucketAccountId}`
+ : "12-digit AWS account ID"
+ }
+ variant="bordered"
+ isRequired={false}
+ />
+ <p className="text-text-neutral-tertiary text-xs">
+ {derivedBucketAccountId
+ ? `Leave empty to use selected AWS account ${derivedBucketAccountId}, or enter another bucket owner account ID.`
+ : "Required because the selected provider does not identify the AWS account that owns the bucket."}
+ </p>
+ </div>
+ );
+
const renderStepContent = () => {
// If editing credentials, show only credentials form
if (isEditingCredentials || currentStep === 1) {
@@ -265,17 +336,21 @@ export const S3IntegrationForm = ({
externalId,
bucketName,
"amazon_s3",
+ resolvedBucketAccountId,
);
return (
- <AWSRoleCredentialsForm
- control={form.control as unknown as Control<AWSCredentialsRole>}
- setValue={form.setValue as any}
- externalId={externalId}
- templateLinks={templateLinks}
- type="integrations"
- integrationType="amazon_s3"
- />
+ <div className="flex flex-col gap-4">
+ {isEditingCredentials && renderBucketAccountIdField()}
+ <AWSRoleCredentialsForm
+ control={form.control as unknown as Control<AWSCredentialsRole>}
+ setValue={form.setValue as any}
+ externalId={externalId}
+ templateLinks={templateLinks}
+ type="integrations"
+ integrationType="amazon_s3"
+ />
+ </div>
);
}
@@ -321,7 +396,7 @@ export const S3IntegrationForm = ({
/>
</div>
- <Divider />
+ <Separator />
{/* S3 Configuration */}
<div className="flex flex-col gap-4">
@@ -346,6 +421,8 @@ export const S3IntegrationForm = ({
variant="bordered"
isRequired
/>
+
+ {!isEditingConfig && renderBucketAccountIdField()}
</div>
</>
);
@@ -421,7 +498,7 @@ export const S3IntegrationForm = ({
>
<div className="flex flex-col gap-4">
<div className="flex flex-col items-start gap-2 sm:flex-row sm:items-center">
- <p className="text-default-500 flex items-center gap-2 text-sm">
+ <p className="text-text-neutral-tertiary flex items-center gap-2 text-sm">
Need help configuring your Amazon S3 integration?
</p>
<CustomLink
diff --git a/ui/components/integrations/s3/s3-integrations-manager.tsx b/ui/components/integrations/s3/s3-integrations-manager.tsx
index 416919e7bd..1e75d1b43c 100644
--- a/ui/components/integrations/s3/s3-integrations-manager.tsx
+++ b/ui/components/integrations/s3/s3-integrations-manager.tsx
@@ -16,9 +16,9 @@ import {
IntegrationSkeleton,
} from "@/components/integrations/shared";
import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { DataTablePagination } from "@/components/ui/table/data-table-pagination";
+import { DataTablePagination } from "@/components/shadcn/table/data-table-pagination";
import { triggerTestConnectionWithDelay } from "@/lib/integrations/test-connection-helper";
import { MetaDataProps } from "@/types";
import { IntegrationProps } from "@/types/integrations";
diff --git a/ui/components/integrations/saml/saml-config-form.tsx b/ui/components/integrations/saml/saml-config-form.tsx
index 935f5412e9..db713252a8 100644
--- a/ui/components/integrations/saml/saml-config-form.tsx
+++ b/ui/components/integrations/saml/saml-config-form.tsx
@@ -13,11 +13,11 @@ import { z } from "zod";
import { createSamlConfig, updateSamlConfig } from "@/actions/integrations";
import { AddIcon } from "@/components/icons";
import { Button, Card, CardContent, CardHeader } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { CustomServerInput } from "@/components/ui/custom";
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { FormButtons } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { CustomServerInput } from "@/components/shadcn/custom";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { FormButtons } from "@/components/shadcn/form";
import { useRuntimeConfig } from "@/hooks/use-runtime-config";
const validateXMLContent = (
diff --git a/ui/components/integrations/saml/saml-integration-card.test.tsx b/ui/components/integrations/saml/saml-integration-card.test.tsx
new file mode 100644
index 0000000000..0a10df5d97
--- /dev/null
+++ b/ui/components/integrations/saml/saml-integration-card.test.tsx
@@ -0,0 +1,53 @@
+import { render, screen, within } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { SamlIntegrationCard } from "./saml-integration-card";
+
+vi.mock("@/actions/integrations", () => ({
+ deleteSamlConfig: vi.fn(),
+}));
+
+vi.mock("./saml-config-form", () => ({
+ SamlConfigForm: () => <div>SAML form</div>,
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: vi.fn() }),
+}));
+
+describe("SamlIntegrationCard", () => {
+ it("shows the disabled status as a header badge without a status label", () => {
+ // When
+ render(<SamlIntegrationCard />);
+
+ // Then
+ const title = screen.getByRole("heading", {
+ name: "SAML SSO Integration",
+ });
+ const header = title.closest('[data-slot="card-header"]');
+
+ expect(header).toBeInTheDocument();
+ expect(header).not.toHaveTextContent("Status:");
+ expect(within(header as HTMLElement).getByText("Disabled")).toHaveAttribute(
+ "data-slot",
+ "badge",
+ );
+ });
+
+ it("shows the enabled status as a success header badge", () => {
+ // When
+ render(<SamlIntegrationCard samlConfig={{ id: "saml-1" }} />);
+
+ // Then
+ const title = screen.getByRole("heading", {
+ name: "SAML SSO Integration",
+ });
+ const header = title.closest('[data-slot="card-header"]');
+ const badge = within(header as HTMLElement).getByText("Enabled");
+
+ expect(header).not.toHaveTextContent("Status:");
+ expect(badge).toHaveAttribute("data-slot", "badge");
+ expect(badge).toHaveClass("bg-bg-pass-secondary");
+ });
+});
diff --git a/ui/components/integrations/saml/saml-integration-card.tsx b/ui/components/integrations/saml/saml-integration-card.tsx
index f1b5c2c966..87bee0f55d 100644
--- a/ui/components/integrations/saml/saml-integration-card.tsx
+++ b/ui/components/integrations/saml/saml-integration-card.tsx
@@ -1,15 +1,21 @@
"use client";
-import { CheckIcon, Trash2Icon } from "lucide-react";
+import { Trash2Icon } from "lucide-react";
import { useState } from "react";
import { deleteSamlConfig } from "@/actions/integrations";
-import { Button } from "@/components/shadcn";
+import {
+ Badge,
+ Button,
+ Card,
+ CardAction,
+ CardContent,
+ CardHeader,
+ useToast,
+} from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { Card, CardContent, CardHeader } from "../../shadcn";
import { SamlConfigForm } from "./saml-config-form";
export const SamlIntegrationCard = ({ samlConfig }: { samlConfig?: any }) => {
@@ -18,6 +24,7 @@ export const SamlIntegrationCard = ({ samlConfig }: { samlConfig?: any }) => {
const [isDeleting, setIsDeleting] = useState(false);
const { toast } = useToast();
const id = samlConfig?.id;
+ const statusLabel = id ? "Enabled" : "Disabled";
const handleRemoveSaml = async () => {
if (!id) return;
@@ -72,7 +79,7 @@ export const SamlIntegrationCard = ({ samlConfig }: { samlConfig?: any }) => {
size="md"
>
<div className="flex flex-col gap-4">
- <p className="text-default-600 text-sm">
+ <p className="text-text-neutral-secondary text-sm">
Are you sure you want to remove the SAML SSO configuration? Users
will no longer be able to sign in using SAML.
</p>
@@ -100,13 +107,10 @@ export const SamlIntegrationCard = ({ samlConfig }: { samlConfig?: any }) => {
</div>
</Modal>
- <Card variant="base" padding="lg">
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
<CardHeader>
<div className="flex flex-col gap-1">
- <div className="flex items-center gap-2">
- <h4 className="text-lg font-bold">SAML SSO Integration</h4>
- {id && <CheckIcon className="text-button-primary" size={20} />}
- </div>
+ <h4 className="text-lg font-bold">SAML SSO Integration</h4>
<p className="text-xs text-gray-500">
{id ? (
"SAML Single Sign-On is enabled for this organization"
@@ -120,30 +124,25 @@ export const SamlIntegrationCard = ({ samlConfig }: { samlConfig?: any }) => {
)}
</p>
</div>
+ <CardAction className="pt-2">
+ <Badge variant={id ? "success" : "outline"}>{statusLabel}</Badge>
+ </CardAction>
</CardHeader>
<CardContent>
- <div className="flex items-center justify-between">
- <div className="text-sm">
- <span className="font-medium">Status: </span>
- <span className={id ? "text-button-primary" : "text-gray-500"}>
- {id ? "Enabled" : "Disabled"}
- </span>
- </div>
- <div className="flex gap-2">
- <Button size="sm" onClick={() => setIsSamlModalOpen(true)}>
- {id ? "Update" : "Enable"}
+ <div className="flex justify-end gap-2">
+ <Button size="sm" onClick={() => setIsSamlModalOpen(true)}>
+ {id ? "Update" : "Enable"}
+ </Button>
+ {id && (
+ <Button
+ size="sm"
+ variant="destructive"
+ onClick={() => setIsDeleteModalOpen(true)}
+ >
+ <Trash2Icon size={16} />
+ Remove
</Button>
- {id && (
- <Button
- size="sm"
- variant="destructive"
- onClick={() => setIsDeleteModalOpen(true)}
- >
- <Trash2Icon size={16} />
- Remove
- </Button>
- )}
- </div>
+ )}
</div>
</CardContent>
</Card>
diff --git a/ui/components/integrations/security-hub/security-hub-integration-card.tsx b/ui/components/integrations/security-hub/security-hub-integration-card.tsx
index bce91812f4..4003f8c286 100644
--- a/ui/components/integrations/security-hub/security-hub-integration-card.tsx
+++ b/ui/components/integrations/security-hub/security-hub-integration-card.tsx
@@ -5,7 +5,7 @@ import Link from "next/link";
import { AWSSecurityHubIcon } from "@/components/icons/services/IconServices";
import { Button } from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Card, CardContent, CardHeader } from "../../shadcn";
diff --git a/ui/components/integrations/security-hub/security-hub-integration-form.tsx b/ui/components/integrations/security-hub/security-hub-integration-form.tsx
index 1c3b436832..b7fac10706 100644
--- a/ui/components/integrations/security-hub/security-hub-integration-form.tsx
+++ b/ui/components/integrations/security-hub/security-hub-integration-form.tsx
@@ -1,8 +1,5 @@
"use client";
-import { Checkbox } from "@heroui/checkbox";
-import { Divider } from "@heroui/divider";
-import { Radio, RadioGroup } from "@heroui/radio";
import { zodResolver } from "@hookform/resolvers/zod";
import { ArrowLeftIcon, ArrowRightIcon } from "lucide-react";
import { useSession } from "next-auth/react";
@@ -15,16 +12,21 @@ import {
ProviderTypeIcon,
} from "@/components/icons/providers-badge/provider-type-icon";
import { AWSRoleCredentialsForm } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { Checkbox, Separator } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import {
Form,
FormControl,
FormField,
FormMessage,
-} from "@/components/ui/form";
-import { FormButtons } from "@/components/ui/form/form-buttons";
+} from "@/components/shadcn/form";
+import { FormButtons } from "@/components/shadcn/form/form-buttons";
+import {
+ RadioGroup,
+ RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";
+import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
import { getAWSCredentialsTemplateLinks } from "@/lib";
import { AWSCredentialsRole } from "@/types";
import {
@@ -289,8 +291,8 @@ export const SecurityHubIntegrationForm = ({
return (
<div className="flex flex-col gap-4">
<RadioGroup
- size="sm"
aria-label="Credential type"
+ className="gap-2"
value={useCustomCredentials ? "custom" : "provider"}
onValueChange={(value) => {
form.setValue("use_custom_credentials", value === "custom", {
@@ -299,17 +301,29 @@ export const SecurityHubIntegrationForm = ({
});
}}
>
- <Radio value="provider">
- <span className="text-sm">Use provider credentials</span>
- </Radio>
- <Radio value="custom">
- <span className="text-sm">Use custom credentials</span>
- </Radio>
+ <div className="flex items-center gap-2">
+ <RadioGroupItem value="provider" id="credentials-provider" />
+ <label
+ htmlFor="credentials-provider"
+ className="cursor-pointer text-sm"
+ >
+ Use provider credentials
+ </label>
+ </div>
+ <div className="flex items-center gap-2">
+ <RadioGroupItem value="custom" id="credentials-custom" />
+ <label
+ htmlFor="credentials-custom"
+ className="cursor-pointer text-sm"
+ >
+ Use custom credentials
+ </label>
+ </div>
</RadioGroup>
{useCustomCredentials && (
<>
- <Divider />
+ <Separator />
<AWSRoleCredentialsForm
control={form.control as unknown as Control<AWSCredentialsRole>}
setValue={form.setValue as any}
@@ -382,7 +396,7 @@ export const SecurityHubIntegrationForm = ({
)}
/>
</div>
- <Divider />
+ <Separator />
</>
)}
@@ -392,16 +406,20 @@ export const SecurityHubIntegrationForm = ({
name="send_only_fails"
render={({ field }) => (
<FormControl>
- <Checkbox
- isSelected={Boolean(field.value)}
- onValueChange={field.onChange}
- size="sm"
- color="default"
- >
- <span className="text-sm">
+ <div className="flex items-center gap-2">
+ <Checkbox
+ id="send_only_fails"
+ size="sm"
+ checked={Boolean(field.value)}
+ onCheckedChange={field.onChange}
+ />
+ <label
+ htmlFor="send_only_fails"
+ className="cursor-pointer text-sm"
+ >
Send only findings with status FAIL
- </span>
- </Checkbox>
+ </label>
+ </div>
</FormControl>
)}
/>
@@ -411,14 +429,20 @@ export const SecurityHubIntegrationForm = ({
name="archive_previous_findings"
render={({ field }) => (
<FormControl>
- <Checkbox
- isSelected={Boolean(field.value)}
- onValueChange={field.onChange}
- size="sm"
- color="default"
- >
- <span className="text-sm">Archive previous findings</span>
- </Checkbox>
+ <div className="flex items-center gap-2">
+ <Checkbox
+ id="archive_previous_findings"
+ size="sm"
+ checked={Boolean(field.value)}
+ onCheckedChange={field.onChange}
+ />
+ <label
+ htmlFor="archive_previous_findings"
+ className="cursor-pointer text-sm"
+ >
+ Archive previous findings
+ </label>
+ </div>
</FormControl>
)}
/>
@@ -429,17 +453,21 @@ export const SecurityHubIntegrationForm = ({
name="use_custom_credentials"
render={({ field }) => (
<FormControl>
- <Checkbox
- isSelected={field.value}
- onValueChange={field.onChange}
- size="sm"
- color="default"
- >
- <span className="text-sm">
+ <div className="flex items-center gap-2">
+ <Checkbox
+ id="use_custom_credentials"
+ size="sm"
+ checked={field.value}
+ onCheckedChange={field.onChange}
+ />
+ <label
+ htmlFor="use_custom_credentials"
+ className="cursor-pointer text-sm"
+ >
Use custom credentials (By default, AWS account ones
will be used)
- </span>
- </Checkbox>
+ </label>
+ </div>
</FormControl>
)}
/>
@@ -529,7 +557,7 @@ export const SecurityHubIntegrationForm = ({
>
<div className="flex flex-col gap-4">
<div className="flex flex-col items-start gap-2 sm:flex-row sm:items-center">
- <p className="text-default-500 flex items-center gap-2 text-sm">
+ <p className="text-text-neutral-tertiary flex items-center gap-2 text-sm">
Need help configuring your AWS Security Hub integration?
</p>
<CustomLink
diff --git a/ui/components/integrations/security-hub/security-hub-integrations-manager.tsx b/ui/components/integrations/security-hub/security-hub-integrations-manager.tsx
index a1bd977b1b..34c2d9e303 100644
--- a/ui/components/integrations/security-hub/security-hub-integrations-manager.tsx
+++ b/ui/components/integrations/security-hub/security-hub-integrations-manager.tsx
@@ -16,9 +16,9 @@ import {
IntegrationSkeleton,
} from "@/components/integrations/shared";
import { Badge, Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { DataTablePagination } from "@/components/ui/table/data-table-pagination";
+import { DataTablePagination } from "@/components/shadcn/table/data-table-pagination";
import { triggerTestConnectionWithDelay } from "@/lib/integrations/test-connection-helper";
import { MetaDataProps } from "@/types";
import { IntegrationProps } from "@/types/integrations";
diff --git a/ui/components/integrations/shared/integration-card-header.tsx b/ui/components/integrations/shared/integration-card-header.tsx
index ab0a252585..6b14ee482e 100644
--- a/ui/components/integrations/shared/integration-card-header.tsx
+++ b/ui/components/integrations/shared/integration-card-header.tsx
@@ -76,7 +76,7 @@ export const IntegrationCardHeader = ({
"text-xs font-normal",
connectionStatus.connected
? "bg-bg-pass-secondary text-text-success-primary border-transparent"
- : "bg-bg-danger-secondary text-text-danger border-transparent",
+ : "bg-bg-fail-secondary text-text-error-primary border-transparent",
)}
>
{connectionStatus.label ||
diff --git a/ui/components/integrations/shared/integration-skeleton.tsx b/ui/components/integrations/shared/integration-skeleton.tsx
index 245085ca70..469dbb6f22 100644
--- a/ui/components/integrations/shared/integration-skeleton.tsx
+++ b/ui/components/integrations/shared/integration-skeleton.tsx
@@ -1,9 +1,9 @@
"use client";
-import { Card, CardBody, CardHeader } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
import { ReactNode } from "react";
+import { Card, CardContent, CardHeader, Skeleton } from "@/components/shadcn";
+
interface IntegrationSkeletonProps {
variant?: "main" | "manager";
count?: number;
@@ -21,8 +21,8 @@ export const IntegrationSkeleton = ({
}: IntegrationSkeletonProps) => {
if (variant === "main") {
return (
- <Card className="dark:bg-prowler-blue-400">
- <CardHeader className="gap-2">
+ <Card className="dark:bg-bg-neutral-secondary gap-0">
+ <CardHeader className="mb-0 flex items-center gap-2 p-3">
<div className="flex w-full items-center justify-between">
<div className="flex items-center gap-3">
{icon}
@@ -39,12 +39,12 @@ export const IntegrationSkeleton = ({
</div>
</div>
</CardHeader>
- <CardBody>
+ <CardContent className="p-3">
<div className="flex flex-col gap-4">
<Skeleton className="h-4 w-full rounded" />
<Skeleton className="h-4 w-3/4 rounded" />
</div>
- </CardBody>
+ </CardContent>
</Card>
);
}
@@ -53,8 +53,8 @@ export const IntegrationSkeleton = ({
return (
<div className="grid gap-4">
{Array.from({ length: count }).map((_, index) => (
- <Card key={index} className="dark:bg-prowler-blue-400">
- <CardHeader className="pb-2">
+ <Card key={index} className="dark:bg-bg-neutral-secondary gap-0">
+ <CardHeader className="mb-0 flex items-center p-3 pb-2">
<div className="flex w-full flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
<div className="flex items-center gap-3">
{icon}
@@ -70,7 +70,7 @@ export const IntegrationSkeleton = ({
</div>
</div>
</CardHeader>
- <CardBody className="pt-0">
+ <CardContent className="p-3 pt-0">
<div className="flex flex-col gap-3">
{/* Region chips skeleton */}
<div className="flex flex-wrap gap-1">
@@ -89,7 +89,7 @@ export const IntegrationSkeleton = ({
</div>
</div>
</div>
- </CardBody>
+ </CardContent>
</Card>
))}
</div>
diff --git a/ui/components/integrations/shared/link-card.tsx b/ui/components/integrations/shared/link-card.tsx
index 5721f3a3b5..ceb74d6a1b 100644
--- a/ui/components/integrations/shared/link-card.tsx
+++ b/ui/components/integrations/shared/link-card.tsx
@@ -4,7 +4,7 @@ import { ExternalLinkIcon, LucideIcon } from "lucide-react";
import Link from "next/link";
import { Button } from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { Card, CardContent, CardHeader } from "../../shadcn";
@@ -34,7 +34,7 @@ export const LinkCard = ({
<CardHeader>
<div className="flex w-full flex-col items-start gap-2 sm:flex-row sm:items-center sm:justify-between">
<div className="flex items-center gap-3">
- <div className="dark:bg-prowler-blue-800 flex h-10 w-10 items-center justify-center rounded-lg bg-gray-100">
+ <div className="bg-bg-neutral-tertiary flex h-10 w-10 items-center justify-center rounded-lg">
<Icon size={24} className="text-gray-700 dark:text-gray-200" />
</div>
<div className="flex flex-col gap-1">
diff --git a/ui/components/invitations/forms/delete-form.tsx b/ui/components/invitations/forms/delete-form.tsx
index 097ad9620d..58618b9dc6 100644
--- a/ui/components/invitations/forms/delete-form.tsx
+++ b/ui/components/invitations/forms/delete-form.tsx
@@ -8,8 +8,8 @@ import * as z from "zod";
import { revokeInvite } from "@/actions/invitations/invitation";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
const formSchema = z.object({
invitationId: z.string(),
diff --git a/ui/components/invitations/forms/edit-form.tsx b/ui/components/invitations/forms/edit-form.tsx
index 57f0717313..b8bfaf6f70 100644
--- a/ui/components/invitations/forms/edit-form.tsx
+++ b/ui/components/invitations/forms/edit-form.tsx
@@ -5,6 +5,9 @@ import { Controller, useForm } from "react-hook-form";
import * as z from "zod";
import { updateInvite } from "@/actions/invitations/invitation";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form, FormButtons } from "@/components/shadcn/form";
import {
Select,
SelectContent,
@@ -12,9 +15,6 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn/select/select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
import { editInviteFormSchema } from "@/types";
import { Card, CardContent } from "../../shadcn";
@@ -103,14 +103,14 @@ export const EditForm = ({
>
<Card variant="inner">
<CardContent className="flex flex-row justify-center gap-4">
- <div className="text-small text-text-neutral-secondary flex items-center">
+ <div className="text-text-neutral-secondary flex items-center text-sm">
<MailIcon className="text-text-neutral-secondary mr-2 h-4 w-4" />
<span className="text-text-neutral-secondary">Email:</span>
<span className="text-text-neutral-secondary ml-2 font-semibold">
{invitationEmail}
</span>
</div>
- <div className="text-small flex items-center text-gray-600">
+ <div className="flex items-center text-sm text-gray-600">
<ShieldIcon className="text-text-neutral-secondary mr-2 h-4 w-4" />
<span className="text-text-neutral-secondary">Role:</span>
<span className="text-text-neutral-secondary ml-2 font-semibold">
diff --git a/ui/components/invitations/invitation-details.tsx b/ui/components/invitations/invitation-details.tsx
index 0cc8e2b919..259a1de0a4 100644
--- a/ui/components/invitations/invitation-details.tsx
+++ b/ui/components/invitations/invitation-details.tsx
@@ -2,11 +2,12 @@
import Link from "next/link";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { DateWithTime } from "@/components/shadcn/entities";
+
import { AddIcon } from "../icons";
import { Button, Card, CardContent, CardHeader } from "../shadcn";
import { Separator } from "../shadcn/separator/separator";
-import { CodeSnippet } from "../ui/code-snippet/code-snippet";
-import { DateWithTime } from "../ui/entities";
interface InvitationDetailsProps {
attributes: {
@@ -39,7 +40,7 @@ const InfoField = ({
{label}
</span>
<div className="border-border-input-primary bg-bg-input-primary flex min-w-0 items-center overflow-hidden rounded-lg border p-3">
- <span className="text-small text-text-neutral-primary min-w-0 truncate">
+ <span className="text-text-neutral-primary min-w-0 truncate text-sm">
{children}
</span>
</div>
diff --git a/ui/components/invitations/table/column-invitations.tsx b/ui/components/invitations/table/column-invitations.tsx
index 2af64ef6fd..628f0c2788 100644
--- a/ui/components/invitations/table/column-invitations.tsx
+++ b/ui/components/invitations/table/column-invitations.tsx
@@ -2,8 +2,8 @@
import { ColumnDef } from "@tanstack/react-table";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { InvitationProps } from "@/types";
import { DataTableRowActions } from "./data-table-row-actions";
diff --git a/ui/components/invitations/table/skeleton-table-invitations.tsx b/ui/components/invitations/table/skeleton-table-invitations.tsx
index 1117358e32..2533655a1d 100644
--- a/ui/components/invitations/table/skeleton-table-invitations.tsx
+++ b/ui/components/invitations/table/skeleton-table-invitations.tsx
@@ -1,37 +1,102 @@
-import React from "react";
-
-import { Card } from "@/components/shadcn/card/card";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-export const SkeletonTableInvitation = () => {
+const SkeletonTableRow = () => {
return (
- <Card variant="base" padding="md" className="flex flex-col gap-4">
- {/* Table headers */}
- <div className="hidden gap-4 md:flex">
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-1/12" />
- </div>
-
- {/* Table body */}
- <div className="flex flex-col gap-3">
- {[...Array(10)].map((_, index) => (
- <div
- key={index}
- className="flex flex-col gap-4 md:flex-row md:items-center"
- >
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-1/12" />
- </div>
- ))}
- </div>
- </Card>
+ <tr className="border-border-neutral-secondary border-b last:border-b-0">
+ {/* Email */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-32 rounded" />
+ </td>
+ {/* State - text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-16 rounded" />
+ </td>
+ {/* Role - text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-20 rounded" />
+ </td>
+ {/* Inserted At - date */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Expires At - date */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Actions */}
+ <td className="px-2 py-4">
+ <Skeleton className="size-6 rounded" />
+ </td>
+ </tr>
+ );
+};
+
+export const SkeletonTableInvitation = () => {
+ const rows = 10;
+
+ return (
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
+ {/* Toolbar: Search + Total entries */}
+ <div className="flex items-center justify-between">
+ {/* Search icon button */}
+ <Skeleton className="size-10 rounded-md" />
+ {/* Total entries */}
+ <Skeleton className="h-4 w-28 rounded" />
+ </div>
+
+ {/* Table */}
+ <table className="w-full">
+ <thead>
+ <tr className="border-border-neutral-secondary border-b">
+ {/* Email */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-16 rounded" />
+ </th>
+ {/* State */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-12 rounded" />
+ </th>
+ {/* Role */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-12 rounded" />
+ </th>
+ {/* Inserted At */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-24 rounded" />
+ </th>
+ {/* Expires At */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-24 rounded" />
+ </th>
+ {/* Actions - empty header */}
+ <th className="w-10 py-3" />
+ </tr>
+ </thead>
+ <tbody>
+ {Array.from({ length: rows }).map((_, i) => (
+ <SkeletonTableRow key={i} />
+ ))}
+ </tbody>
+ </table>
+
+ {/* Pagination */}
+ <div className="flex items-center justify-between pt-2">
+ {/* Rows per page */}
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-4 w-24 rounded" />
+ <Skeleton className="h-9 w-16 rounded-md" />
+ </div>
+ {/* Page info + navigation */}
+ <div className="flex items-center gap-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ <div className="flex gap-1">
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ </div>
+ </div>
+ </div>
+ </div>
);
};
diff --git a/ui/components/invitations/workflow/forms/send-invitation-form.tsx b/ui/components/invitations/workflow/forms/send-invitation-form.tsx
index 729dc89d28..67e6938d4a 100644
--- a/ui/components/invitations/workflow/forms/send-invitation-form.tsx
+++ b/ui/components/invitations/workflow/forms/send-invitation-form.tsx
@@ -8,6 +8,9 @@ import * as z from "zod";
import { sendInvite } from "@/actions/invitations/invitation";
import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form } from "@/components/shadcn/form";
import {
Select,
SelectContent,
@@ -15,9 +18,6 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn/select/select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form } from "@/components/ui/form";
import { ApiError } from "@/types";
const sendInvitationFormSchema = z.object({
diff --git a/ui/components/invitations/workflow/skeleton-invitation-info.tsx b/ui/components/invitations/workflow/skeleton-invitation-info.tsx
index b83568d054..4ab48ddcfc 100644
--- a/ui/components/invitations/workflow/skeleton-invitation-info.tsx
+++ b/ui/components/invitations/workflow/skeleton-invitation-info.tsx
@@ -1,33 +1,17 @@
-import { Card } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
-import React from "react";
+import { Card, Skeleton } from "@/components/shadcn";
export const SkeletonInvitationInfo = () => {
return (
- <Card className="flex h-full w-full flex-col gap-5 p-4" radius="sm">
+ <Card className="flex h-full w-full flex-col gap-5 rounded-lg p-4">
{/* Table headers */}
<div className="hidden justify-between md:flex">
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
</div>
{/* Table body */}
@@ -37,27 +21,13 @@ export const SkeletonInvitationInfo = () => {
key={index}
className="flex flex-col items-center justify-between md:flex-row md:gap-4"
>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
</div>
))}
</div>
diff --git a/ui/components/invitations/workflow/vertical-steps.tsx b/ui/components/invitations/workflow/vertical-steps.tsx
index 16dd7c9647..17abec63d2 100644
--- a/ui/components/invitations/workflow/vertical-steps.tsx
+++ b/ui/components/invitations/workflow/vertical-steps.tsx
@@ -1,11 +1,12 @@
"use client";
-import { cn } from "@heroui/theme";
import { useControlledState } from "@react-stately/utils";
import { domAnimation, LazyMotion, m } from "framer-motion";
import type { ComponentProps } from "react";
import React from "react";
+import { cn } from "@/lib/utils";
+
export type VerticalStepProps = {
className?: string;
description?: React.ReactNode;
@@ -122,38 +123,37 @@ export const VerticalSteps = React.forwardRef<
"[--active-color:var(--step-color)]",
"[--complete-background-color:var(--step-color)]",
"[--complete-border-color:var(--step-color)]",
- "[--inactive-border-color:hsl(var(--heroui-default-300))]",
- "[--inactive-color:hsl(var(--heroui-default-300))]",
+ "[--inactive-border-color:var(--border-neutral-tertiary)]",
+ "[--inactive-color:var(--border-neutral-tertiary)]",
];
switch (color) {
- case "primary":
- userColor = "[--step-color:var(--bg-button-primary)]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
- break;
case "secondary":
- userColor = "[--step-color:hsl(var(--heroui-secondary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-secondary-foreground))]";
+ userColor =
+ "[--step-color:var(--color-violet-600)] dark:[--step-color:var(--color-violet-400)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "success":
- userColor = "[--step-color:hsl(var(--heroui-success))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-success-foreground))]";
+ userColor = "[--step-color:var(--bg-pass-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "warning":
- userColor = "[--step-color:hsl(var(--heroui-warning))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-warning-foreground))]";
+ userColor = "[--step-color:var(--bg-warning-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "danger":
- userColor = "[--step-color:hsl(var(--heroui-error))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-error-foreground))]";
+ userColor = "[--step-color:var(--bg-fail-primary)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "default":
- userColor = "[--step-color:hsl(var(--heroui-default))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-default-foreground))]";
+ userColor =
+ "[--step-color:var(--color-zinc-300)] dark:[--step-color:var(--color-zinc-600)]";
+ fgColor = "[--step-fg-color:var(--text-neutral-primary)]";
break;
+ case "primary":
default:
- userColor = "[--step-color:hsl(var(--heroui-primary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
+ userColor = "[--step-color:var(--bg-button-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
}
@@ -161,7 +161,7 @@ export const VerticalSteps = React.forwardRef<
if (!className?.includes("--step-color")) colorsVars.unshift(userColor);
if (!className?.includes("--inactive-bar-color"))
colorsVars.push(
- "[--inactive-bar-color:hsl(var(--heroui-default-300))]",
+ "[--inactive-bar-color:var(--border-neutral-tertiary)]",
);
return colorsVars;
@@ -186,7 +186,7 @@ export const VerticalSteps = React.forwardRef<
ref={ref}
aria-current={status === "active" ? "step" : undefined}
className={cn(
- "group rounded-large flex w-full cursor-pointer items-center justify-center gap-4 px-3 py-2.5",
+ "group flex w-full cursor-pointer items-center justify-center gap-4 rounded-[14px] px-3 py-2.5",
stepClassName,
)}
onClick={() => setCurrentStep(stepIdx)}
@@ -197,12 +197,9 @@ export const VerticalSteps = React.forwardRef<
<div className="relative">
<m.div
animate={status}
- className={cn(
- "border-medium text-large text-default-foreground relative flex h-[34px] w-[34px] items-center justify-center rounded-full font-semibold",
- {
- "shadow-lg": status === "complete",
- },
- )}
+ className={`text-text-neutral-primary relative flex h-[34px] w-[34px] items-center justify-center rounded-full border-2 text-lg font-semibold ${
+ status === "complete" ? "shadow-lg" : ""
+ }`}
data-status={status}
initial={false}
transition={{ duration: 0.25 }}
@@ -238,22 +235,20 @@ export const VerticalSteps = React.forwardRef<
<div className="flex-1 text-left">
<div>
<div
- className={cn(
- "text-medium text-default-foreground font-medium transition-[color,opacity] duration-300 group-active:opacity-70",
- {
- "text-default-500": status === "inactive",
- },
- )}
+ className={`text-base font-medium transition-[color,opacity] duration-300 group-active:opacity-70 ${
+ status === "inactive"
+ ? "text-text-neutral-tertiary"
+ : "text-text-neutral-primary"
+ }`}
>
{step.title}
</div>
<div
- className={cn(
- "text-tiny text-default-600 lg:text-small transition-[color,opacity] duration-300 group-active:opacity-70",
- {
- "text-default-500": status === "inactive",
- },
- )}
+ className={`text-xs transition-[color,opacity] duration-300 group-active:opacity-70 lg:text-sm ${
+ status === "inactive"
+ ? "text-text-neutral-tertiary"
+ : "text-text-neutral-secondary"
+ }`}
>
{step.description}
</div>
diff --git a/ui/components/invitations/workflow/workflow-send-invite.tsx b/ui/components/invitations/workflow/workflow-send-invite.tsx
index 9183c27a8d..879a96b83f 100644
--- a/ui/components/invitations/workflow/workflow-send-invite.tsx
+++ b/ui/components/invitations/workflow/workflow-send-invite.tsx
@@ -1,10 +1,10 @@
"use client";
-import { Progress } from "@heroui/progress";
-import { Spacer } from "@heroui/spacer";
import { usePathname } from "next/navigation";
import React from "react";
+import { Progress } from "@/components/shadcn/progress";
+
import { VerticalSteps } from "./vertical-steps";
const steps = [
@@ -36,24 +36,23 @@ export const WorkflowSendInvite = () => {
<h1 className="mb-2 text-lg font-medium sm:text-xl" id="getting-started">
Send invitation
</h1>
- <p className="sm:text-small text-default-500 mb-3 text-xs sm:mb-5">
+ <p className="text-text-neutral-tertiary mb-3 text-xs sm:mb-5 sm:text-sm">
Follow the steps to send an invitation to the users.
</p>
- <Progress
- classNames={{
- base: "px-0.5 mb-3 sm:mb-5",
- label: "text-xs sm:text-small",
- value: "text-xs sm:text-small text-default-400",
- indicator: "bg-button-primary",
- }}
- label="Steps"
- maxValue={steps.length}
- minValue={0}
- showValueLabel={true}
- size="sm"
- value={currentStep + 1}
- valueLabel={`${currentStep + 1} of ${steps.length}`}
- />
+ <div className="mb-3 flex flex-col gap-2 px-0.5 sm:mb-5">
+ <div className="flex items-center justify-between">
+ <span className="text-xs sm:text-sm">Steps</span>
+ <span className="text-text-neutral-tertiary text-xs sm:text-sm">
+ {`${currentStep + 1} of ${steps.length}`}
+ </span>
+ </div>
+ <Progress
+ aria-label="Steps"
+ value={((currentStep + 1) / steps.length) * 100}
+ className="h-1"
+ indicatorClassName="bg-button-primary"
+ />
+ </div>
{/* Desktop: Full vertical steps */}
<div className="hidden sm:block">
@@ -71,13 +70,13 @@ export const WorkflowSendInvite = () => {
<div className="font-medium">
Current: {steps[currentStep]?.title}
</div>
- <div className="text-default-300 mt-1 text-xs">
+ <div className="text-text-neutral-tertiary mt-1 text-xs">
{steps[currentStep]?.description}
</div>
</div>
</div>
- <Spacer y={2} />
+ <div className="h-2" />
</section>
);
};
diff --git a/ui/components/layout/app-sidebar/app-sidebar-content.test.tsx b/ui/components/layout/app-sidebar/app-sidebar-content.test.tsx
new file mode 100644
index 0000000000..54dedad07c
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-content.test.tsx
@@ -0,0 +1,126 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { AppSidebarContent } from "./app-sidebar-content";
+import { useAppSidebarMode } from "./app-sidebar-mode-store";
+import { APP_SIDEBAR_MODE } from "./types";
+
+const {
+ openCloudUpgradeMock,
+ openLaunchScanModalMock,
+ pathnameValue,
+ pushMock,
+} = vi.hoisted(() => ({
+ openCloudUpgradeMock: vi.fn(),
+ openLaunchScanModalMock: vi.fn(),
+ pathnameValue: { current: "/findings" },
+ pushMock: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => pathnameValue.current,
+ useRouter: () => ({ push: pushMock }),
+}));
+
+vi.mock("@/hooks", () => ({
+ useAuth: () => ({ permissions: {} }),
+}));
+
+vi.mock("@/hooks/use-runtime-config", () => ({
+ useRuntimeConfig: () => ({ apiDocsUrl: "https://local.example/docs" }),
+}));
+
+vi.mock("@/store", () => ({
+ useScansStore: (
+ selector: (state: {
+ openLaunchScanModal: typeof openLaunchScanModalMock;
+ }) => unknown,
+ ) => selector({ openLaunchScanModal: openLaunchScanModalMock }),
+ useCloudUpgradeStore: (
+ selector: (state: {
+ openCloudUpgrade: typeof openCloudUpgradeMock;
+ }) => unknown,
+ ) => selector({ openCloudUpgrade: openCloudUpgradeMock }),
+}));
+
+vi.mock("@/app/(prowler)/lighthouse/_components/navigation", () => ({
+ LighthouseV2SidebarChat: () => <div data-testid="lighthouse-chat-sidebar" />,
+}));
+
+describe("AppSidebarContent", () => {
+ beforeEach(() => {
+ pathnameValue.current = "/findings";
+ pushMock.mockClear();
+ openCloudUpgradeMock.mockClear();
+ openLaunchScanModalMock.mockClear();
+ useAppSidebarMode.setState({ mode: APP_SIDEBAR_MODE.BROWSE });
+ });
+
+ afterEach(() => {
+ vi.unstubAllEnvs();
+ });
+
+ it("shares the brand, Launch Scan action and Local Server Cloud affordances", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("NEXT_PUBLIC_PROWLER_RELEASE_VERSION", "5.8.0");
+ const user = userEvent.setup();
+
+ // When
+ render(<AppSidebarContent />);
+
+ // Then
+ const homeLink = screen.getByRole("link", { name: "Prowler home" });
+ expect(homeLink).toBeVisible();
+ expect(screen.getByRole("link", { name: "Launch Scan" })).toHaveAttribute(
+ "href",
+ "/scans?launchScan=true",
+ );
+ expect(screen.getByText("5.8.0")).toBeVisible();
+
+ await user.click(screen.getByRole("button", { name: "Chat" }));
+ expect(openCloudUpgradeMock).toHaveBeenCalledWith(
+ CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI,
+ undefined,
+ );
+ expect(screen.getAllByText("Cloud").length).toBeGreaterThan(0);
+ });
+
+ it("keeps the existing Lighthouse chat sidebar in Cloud Chat mode", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ useAppSidebarMode.setState({ mode: APP_SIDEBAR_MODE.CHAT });
+
+ // When
+ render(<AppSidebarContent />);
+
+ // Then
+ expect(screen.getByTestId("lighthouse-chat-sidebar")).toBeVisible();
+ expect(
+ screen.getByRole("link", { name: "Service status" }),
+ ).toHaveAttribute("href", "https://status.prowler.com");
+ expect(
+ screen.queryByText("All systems operational"),
+ ).not.toBeInTheDocument();
+ });
+
+ it("opens the current scan modal instead of navigating from the scans route", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ pathnameValue.current = "/scans";
+ const user = userEvent.setup();
+
+ // When
+ render(<AppSidebarContent />);
+ await user.click(screen.getByRole("button", { name: "Launch Scan" }));
+
+ // Then
+ expect(openLaunchScanModalMock).toHaveBeenCalledOnce();
+ expect(
+ screen.queryByRole("link", { name: "Launch Scan" }),
+ ).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/components/layout/app-sidebar/app-sidebar-content.tsx b/ui/components/layout/app-sidebar/app-sidebar-content.tsx
new file mode 100644
index 0000000000..ca2b28949d
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-content.tsx
@@ -0,0 +1,73 @@
+"use client";
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+
+import { LighthouseV2SidebarChat } from "@/app/(prowler)/lighthouse/_components/navigation";
+import { ProwlerBrand } from "@/components/icons";
+import { useAuth } from "@/hooks";
+import { useRuntimeConfig } from "@/hooks/use-runtime-config";
+import { isCloud } from "@/lib/shared/env";
+
+import { useAppSidebarMode } from "./app-sidebar-mode-store";
+import { AppSidebarModeToggle } from "./app-sidebar-mode-toggle";
+import { LaunchScanAction } from "./launch-scan-action";
+import { getNavigationConfig } from "./navigation-config";
+import { SidebarFooter } from "./sidebar-footer";
+import { SidebarNavigation } from "./sidebar-navigation";
+import { APP_SIDEBAR_MODE, type AppSidebarSelectionHandler } from "./types";
+
+interface AppSidebarContentProps {
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+export function AppSidebarContent({ onSelect }: AppSidebarContentProps) {
+ const pathname = usePathname();
+ const { permissions } = useAuth();
+ const { apiDocsUrl, cloudBillingEnabled } = useRuntimeConfig();
+ const mode = useAppSidebarMode((state) => state.mode);
+ const isCloudEnvironment = isCloud();
+ const sections = getNavigationConfig({
+ pathname,
+ apiDocsUrl,
+ cloudBillingEnabled,
+ permissions,
+ });
+ const showChat = isCloudEnvironment && mode === APP_SIDEBAR_MODE.CHAT;
+
+ return (
+ <div className="relative flex h-full min-h-0 w-full flex-col overflow-hidden">
+ <div className="shrink-0 px-5 pt-6 pb-7">
+ <Link
+ href="/"
+ aria-label="Prowler home"
+ className="focus-visible:ring-button-primary/50 flex h-8 items-center rounded-md focus-visible:ring-2 focus-visible:outline-none"
+ onClick={onSelect}
+ >
+ <ProwlerBrand />
+ </Link>
+ </div>
+
+ <div className="shrink-0 space-y-3 px-3 pb-1">
+ <LaunchScanAction onSelect={onSelect} />
+ <AppSidebarModeToggle
+ chatEnabled={isCloudEnvironment}
+ onSelect={onSelect}
+ />
+ </div>
+
+ <div className="min-h-0 flex-1 overflow-hidden">
+ {showChat ? (
+ <LighthouseV2SidebarChat isOpen />
+ ) : (
+ <SidebarNavigation sections={sections} onSelect={onSelect} />
+ )}
+ </div>
+
+ <SidebarFooter
+ isCloudEnvironment={isCloudEnvironment}
+ onSelect={onSelect}
+ />
+ </div>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/app-sidebar-mode-store.test.ts b/ui/components/layout/app-sidebar/app-sidebar-mode-store.test.ts
new file mode 100644
index 0000000000..ba85902736
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-mode-store.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import {
+ migrateAppSidebarState,
+ useAppSidebarMode,
+} from "./app-sidebar-mode-store";
+import { APP_SIDEBAR_MODE } from "./types";
+
+describe("app sidebar mode store", () => {
+ beforeEach(() => {
+ localStorage.clear();
+ useAppSidebarMode.setState({ mode: APP_SIDEBAR_MODE.BROWSE });
+ });
+
+ it("keeps the persisted chat mode while discarding legacy sidebar state", () => {
+ // Given
+ const legacyState = {
+ isOpen: false,
+ isHover: true,
+ navigationMode: APP_SIDEBAR_MODE.CHAT,
+ settings: { disabled: false, isHoverOpen: false },
+ };
+
+ // When
+ const migrated = migrateAppSidebarState(legacyState);
+
+ // Then
+ expect(migrated).toEqual({ mode: APP_SIDEBAR_MODE.CHAT });
+ expect(migrated).not.toHaveProperty("isOpen");
+ expect(migrated).not.toHaveProperty("settings");
+ });
+
+ it("falls back to browse for an invalid persisted mode", () => {
+ // Given / When
+ const migrated = migrateAppSidebarState({ navigationMode: "invalid" });
+
+ // Then
+ expect(migrated).toEqual({ mode: APP_SIDEBAR_MODE.BROWSE });
+ });
+
+ it("rehydrates the legacy payload under the existing sidebar key", async () => {
+ // Given
+ localStorage.setItem(
+ "sidebar",
+ JSON.stringify({
+ state: {
+ navigationMode: APP_SIDEBAR_MODE.CHAT,
+ isOpen: false,
+ isHover: true,
+ settings: { disabled: true },
+ },
+ version: 0,
+ }),
+ );
+
+ // When
+ await useAppSidebarMode.persist.rehydrate();
+
+ // Then
+ expect(useAppSidebarMode.getState().mode).toBe(APP_SIDEBAR_MODE.CHAT);
+ expect(useAppSidebarMode.getState()).not.toEqual(
+ expect.objectContaining({ isOpen: expect.anything() }),
+ );
+ });
+
+ it("updates the current navigation mode", () => {
+ // Given / When
+ useAppSidebarMode.getState().setMode(APP_SIDEBAR_MODE.CHAT);
+
+ // Then
+ expect(useAppSidebarMode.getState().mode).toBe(APP_SIDEBAR_MODE.CHAT);
+ });
+});
diff --git a/ui/components/layout/app-sidebar/app-sidebar-mode-store.ts b/ui/components/layout/app-sidebar/app-sidebar-mode-store.ts
new file mode 100644
index 0000000000..fc076c0296
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-mode-store.ts
@@ -0,0 +1,54 @@
+import { create } from "zustand";
+import { createJSONStorage, persist } from "zustand/middleware";
+
+import { APP_SIDEBAR_MODE, type AppSidebarMode } from "./types";
+
+interface PersistedAppSidebarState {
+ mode: AppSidebarMode;
+}
+
+interface AppSidebarModeStore extends PersistedAppSidebarState {
+ setMode: (mode: AppSidebarMode) => void;
+}
+
+function isAppSidebarMode(value: unknown): value is AppSidebarMode {
+ return Object.values(APP_SIDEBAR_MODE).some((mode) => mode === value);
+}
+
+export function migrateAppSidebarState(
+ persistedState: unknown,
+): PersistedAppSidebarState {
+ if (typeof persistedState !== "object" || persistedState === null) {
+ return { mode: APP_SIDEBAR_MODE.BROWSE };
+ }
+
+ if ("mode" in persistedState && isAppSidebarMode(persistedState.mode)) {
+ return { mode: persistedState.mode };
+ }
+
+ if (
+ "navigationMode" in persistedState &&
+ isAppSidebarMode(persistedState.navigationMode)
+ ) {
+ return { mode: persistedState.navigationMode };
+ }
+
+ return { mode: APP_SIDEBAR_MODE.BROWSE };
+}
+
+export const useAppSidebarMode = create<AppSidebarModeStore>()(
+ persist(
+ (set) => ({
+ mode: APP_SIDEBAR_MODE.BROWSE,
+ setMode: (mode) => set({ mode }),
+ }),
+ {
+ name: "sidebar",
+ storage: createJSONStorage(() => localStorage),
+ merge: (persistedState, currentState) => ({
+ ...currentState,
+ ...migrateAppSidebarState(persistedState),
+ }),
+ },
+ ),
+);
diff --git a/ui/components/layout/app-sidebar/app-sidebar-mode-sync.test.tsx b/ui/components/layout/app-sidebar/app-sidebar-mode-sync.test.tsx
new file mode 100644
index 0000000000..7eb39455b4
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-mode-sync.test.tsx
@@ -0,0 +1,45 @@
+import { render } from "@testing-library/react";
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { useSidePanelStore } from "@/store/side-panel";
+
+import { useAppSidebarMode } from "./app-sidebar-mode-store";
+import { AppSidebarModeSync } from "./app-sidebar-mode-sync";
+import { APP_SIDEBAR_MODE } from "./types";
+
+describe("AppSidebarModeSync", () => {
+ beforeEach(() => {
+ useAppSidebarMode.setState({ mode: APP_SIDEBAR_MODE.CHAT });
+ useSidePanelStore.setState({ isOpen: false });
+ });
+
+ it("restores the requested sidebar mode when a route mounts", () => {
+ // Given / When
+ render(<AppSidebarModeSync mode={APP_SIDEBAR_MODE.BROWSE} />);
+
+ // Then
+ expect(useAppSidebarMode.getState().mode).toBe(APP_SIDEBAR_MODE.BROWSE);
+ });
+
+ it("keeps the side panel open by default", () => {
+ // Given
+ useSidePanelStore.setState({ isOpen: true });
+
+ // When
+ render(<AppSidebarModeSync mode={APP_SIDEBAR_MODE.BROWSE} />);
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+ });
+
+ it("closes the side panel when the full-page chat mounts", () => {
+ // Given
+ useSidePanelStore.setState({ isOpen: true });
+
+ // When
+ render(<AppSidebarModeSync mode={APP_SIDEBAR_MODE.CHAT} closeSidePanel />);
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+});
diff --git a/ui/components/layout/app-sidebar/app-sidebar-mode-sync.tsx b/ui/components/layout/app-sidebar/app-sidebar-mode-sync.tsx
new file mode 100644
index 0000000000..b4d7887dfb
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-mode-sync.tsx
@@ -0,0 +1,30 @@
+"use client";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { useSidePanelStore } from "@/store/side-panel";
+
+import { useAppSidebarMode } from "./app-sidebar-mode-store";
+import type { AppSidebarMode } from "./types";
+
+interface AppSidebarModeSyncProps {
+ mode: AppSidebarMode;
+ // The full-page chat dismisses the side panel: the chat lives in one place
+ // or the other, never both.
+ closeSidePanel?: boolean;
+}
+
+export function AppSidebarModeSync({
+ mode,
+ closeSidePanel = false,
+}: AppSidebarModeSyncProps) {
+ const setMode = useAppSidebarMode((state) => state.setMode);
+
+ useMountEffect(() => {
+ setMode(mode);
+ if (closeSidePanel) {
+ useSidePanelStore.getState().closePanel();
+ }
+ });
+
+ return null;
+}
diff --git a/ui/components/layout/app-sidebar/app-sidebar-mode-toggle.tsx b/ui/components/layout/app-sidebar/app-sidebar-mode-toggle.tsx
new file mode 100644
index 0000000000..0631d09dbf
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar-mode-toggle.tsx
@@ -0,0 +1,115 @@
+"use client";
+
+import { Home } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { LighthouseIcon } from "@/components/icons/Icons";
+import { Badge } from "@/components/shadcn/badge/badge";
+import { NavigationButton } from "@/components/shadcn/navigation-button";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { useAppSidebarMode } from "./app-sidebar-mode-store";
+import {
+ APP_SIDEBAR_MODE,
+ type AppSidebarMode,
+ type AppSidebarSelectionHandler,
+} from "./types";
+
+interface AppSidebarModeToggleProps {
+ chatEnabled: boolean;
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+const MODES = [
+ {
+ value: APP_SIDEBAR_MODE.BROWSE,
+ label: "Home",
+ icon: Home,
+ },
+ {
+ value: APP_SIDEBAR_MODE.CHAT,
+ label: "Chat",
+ icon: LighthouseIcon,
+ },
+] as const;
+
+export function AppSidebarModeToggle({
+ chatEnabled,
+ onSelect,
+}: AppSidebarModeToggleProps) {
+ const router = useRouter();
+ const mode = useAppSidebarMode((state) => state.mode);
+ const setMode = useAppSidebarMode((state) => state.setMode);
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+
+ const selectMode = (nextMode: AppSidebarMode) => {
+ const isChatUpsell = nextMode === APP_SIDEBAR_MODE.CHAT && !chatEnabled;
+
+ if (isChatUpsell) {
+ openCloudUpgrade(
+ CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI,
+ onSelect?.() ?? undefined,
+ );
+ return;
+ }
+
+ setMode(nextMode);
+ onSelect?.();
+
+ if (nextMode === APP_SIDEBAR_MODE.CHAT) {
+ router.push("/lighthouse");
+ }
+ };
+
+ return (
+ <div
+ role="group"
+ aria-label="Sidebar view"
+ className="border-border-sidebar-toggle bg-bg-sidebar-toggle grid grid-cols-2 gap-1 rounded-xl border p-1"
+ >
+ {MODES.map((item) => {
+ const Icon = item.icon;
+ const isActive = item.value === mode;
+ const isCloudUpsell =
+ item.value === APP_SIDEBAR_MODE.CHAT && !chatEnabled;
+ const button = (
+ <NavigationButton
+ key={item.value}
+ variant="toggle"
+ active={isActive}
+ aria-label={item.label}
+ aria-pressed={isActive}
+ onClick={() => selectMode(item.value)}
+ >
+ <Icon aria-hidden="true" className="size-4 shrink-0" />
+ <span>{item.label}</span>
+ {isCloudUpsell && (
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>
+ )}
+ </NavigationButton>
+ );
+
+ if (!isCloudUpsell) return button;
+
+ return (
+ <Tooltip key={item.value} delayDuration={100}>
+ <TooltipTrigger asChild>{button}</TooltipTrigger>
+ <TooltipContent side="right">
+ Available in Prowler Cloud
+ </TooltipContent>
+ </Tooltip>
+ );
+ })}
+ </div>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/app-sidebar.tsx b/ui/components/layout/app-sidebar/app-sidebar.tsx
new file mode 100644
index 0000000000..6864cd64a9
--- /dev/null
+++ b/ui/components/layout/app-sidebar/app-sidebar.tsx
@@ -0,0 +1,10 @@
+import { AppSidebarContent } from "./app-sidebar-content";
+
+export function AppSidebar() {
+ return (
+ <aside className="border-border-neutral-secondary bg-bg-neutral-primary fixed inset-y-0 left-0 z-20 hidden w-[264px] overflow-hidden border-r lg:block">
+ <div aria-hidden="true" className="app-sidebar-halo" />
+ <AppSidebarContent />
+ </aside>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/index.ts b/ui/components/layout/app-sidebar/index.ts
new file mode 100644
index 0000000000..5ee953a19d
--- /dev/null
+++ b/ui/components/layout/app-sidebar/index.ts
@@ -0,0 +1,5 @@
+export { AppSidebar } from "./app-sidebar";
+export { AppSidebarModeSync } from "./app-sidebar-mode-sync";
+export { MobileAppSidebar } from "./mobile-app-sidebar";
+export type { AppSidebarMode } from "./types";
+export { APP_SIDEBAR_MODE } from "./types";
diff --git a/ui/components/layout/app-sidebar/launch-scan-action.tsx b/ui/components/layout/app-sidebar/launch-scan-action.tsx
new file mode 100644
index 0000000000..1da429811f
--- /dev/null
+++ b/ui/components/layout/app-sidebar/launch-scan-action.tsx
@@ -0,0 +1,57 @@
+"use client";
+
+import { ScanLine } from "lucide-react";
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+
+import { Button } from "@/components/shadcn/button/button";
+import { LAUNCH_SCAN_HREF } from "@/lib/scans-navigation";
+import { useScansStore } from "@/store";
+
+import type { AppSidebarSelectionHandler } from "./types";
+
+interface LaunchScanActionProps {
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+function LaunchScanContent() {
+ return (
+ <>
+ <ScanLine aria-hidden="true" className="size-5" />
+ <span>Launch Scan</span>
+ </>
+ );
+}
+
+export function LaunchScanAction({ onSelect }: LaunchScanActionProps) {
+ const pathname = usePathname();
+ const openLaunchScanModal = useScansStore(
+ (state) => state.openLaunchScanModal,
+ );
+ const isScansPage = pathname.startsWith("/scans");
+
+ if (isScansPage) {
+ return (
+ <Button
+ type="button"
+ size="lg"
+ className="w-full"
+ aria-label="Launch Scan"
+ onClick={() => {
+ openLaunchScanModal();
+ onSelect?.();
+ }}
+ >
+ <LaunchScanContent />
+ </Button>
+ );
+ }
+
+ return (
+ <Button asChild size="lg" className="w-full">
+ <Link href={LAUNCH_SCAN_HREF} aria-label="Launch Scan" onClick={onSelect}>
+ <LaunchScanContent />
+ </Link>
+ </Button>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/mobile-app-sidebar.test.tsx b/ui/components/layout/app-sidebar/mobile-app-sidebar.test.tsx
new file mode 100644
index 0000000000..343a6aef72
--- /dev/null
+++ b/ui/components/layout/app-sidebar/mobile-app-sidebar.test.tsx
@@ -0,0 +1,73 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("./app-sidebar-content", () => ({
+ AppSidebarContent: ({
+ onSelect,
+ }: {
+ onSelect?: () => HTMLElement | null;
+ }) => (
+ <button type="button" onClick={onSelect}>
+ Alerts
+ </button>
+ ),
+}));
+
+import { MobileAppSidebar } from "./mobile-app-sidebar";
+
+describe("MobileAppSidebar", () => {
+ it("replaces the open hamburger with a viewport X while the overlay is visible", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<MobileAppSidebar />);
+
+ // When
+ const openButton = screen.getByRole("button", { name: "Open menu" });
+ await user.click(openButton);
+
+ // Then
+ expect(screen.getByRole("dialog", { name: "App sidebar" })).toBeVisible();
+ const closeButton = screen.getByRole("button", { name: "Close menu" });
+ expect(closeButton).toBeVisible();
+ expect(closeButton.querySelector(".lucide-x")).toBeInTheDocument();
+ expect(
+ screen.queryByRole("button", { name: "Close" }),
+ ).not.toBeInTheDocument();
+
+ // When
+ await user.click(closeButton);
+
+ // Then
+ expect(
+ screen.queryByRole("dialog", { name: "App sidebar" }),
+ ).not.toBeInTheDocument();
+ expect(openButton).toHaveFocus();
+ });
+
+ it("hides the trigger based on the viewport, not the narrowed content", () => {
+ // Given / When
+ render(<MobileAppSidebar />);
+
+ // Then: lg: is a container query inside <main>; the side panel squeezing
+ // the page must not surface the mobile menu on desktop.
+ expect(screen.getByRole("button", { name: "Open menu" })).toHaveClass(
+ "min-[64rem]:hidden",
+ );
+ });
+
+ it("closes after selecting an item from the shared sidebar content", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<MobileAppSidebar />);
+ await user.click(screen.getByRole("button", { name: "Open menu" }));
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Alerts" }));
+
+ // Then
+ expect(
+ screen.queryByRole("dialog", { name: "App sidebar" }),
+ ).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/components/layout/app-sidebar/mobile-app-sidebar.tsx b/ui/components/layout/app-sidebar/mobile-app-sidebar.tsx
new file mode 100644
index 0000000000..0a3f9afdeb
--- /dev/null
+++ b/ui/components/layout/app-sidebar/mobile-app-sidebar.tsx
@@ -0,0 +1,65 @@
+"use client";
+
+import { MenuIcon, X } from "lucide-react";
+import { useRef, useState } from "react";
+
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Sheet,
+ SheetClose,
+ SheetContent,
+ SheetDescription,
+ SheetHeader,
+ SheetTitle,
+ SheetTrigger,
+} from "@/components/shadcn/sheet";
+import { cn } from "@/lib/utils";
+
+import { AppSidebarContent } from "./app-sidebar-content";
+
+export function MobileAppSidebar() {
+ const [open, setOpen] = useState(false);
+ const triggerRef = useRef<HTMLButtonElement>(null);
+
+ const handleSelect = () => {
+ setOpen(false);
+ return triggerRef.current;
+ };
+
+ return (
+ <Sheet open={open} onOpenChange={setOpen}>
+ <SheetTrigger asChild>
+ <Button
+ ref={triggerRef}
+ type="button"
+ variant="bare"
+ size="icon-sm"
+ aria-label="Open menu"
+ // min-[64rem] (not lg:): inside <main>, lg is a container query and
+ // the side panel squeezing the page would surface the mobile menu.
+ className={cn("min-[64rem]:hidden", open && "invisible")}
+ >
+ <MenuIcon aria-hidden="true" className="size-5" />
+ </Button>
+ </SheetTrigger>
+ <SheetContent side="left" variant="navigation" showCloseButton={false}>
+ <SheetHeader className="sr-only">
+ <SheetTitle>App sidebar</SheetTitle>
+ <SheetDescription>Primary application navigation</SheetDescription>
+ </SheetHeader>
+ <SheetClose asChild>
+ <Button
+ type="button"
+ variant="outline"
+ size="icon-sm"
+ aria-label="Close menu"
+ className="fixed top-4 right-4 z-[60]"
+ >
+ <X aria-hidden="true" className="size-5" />
+ </Button>
+ </SheetClose>
+ <AppSidebarContent onSelect={handleSelect} />
+ </SheetContent>
+ </Sheet>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/navigation-config.test.ts b/ui/components/layout/app-sidebar/navigation-config.test.ts
new file mode 100644
index 0000000000..9b3cab3501
--- /dev/null
+++ b/ui/components/layout/app-sidebar/navigation-config.test.ts
@@ -0,0 +1,347 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import type { RolePermissionAttributes } from "@/types/users";
+
+import {
+ filterNavigationByPermissions,
+ getNavigationConfig,
+} from "./navigation-config";
+import { NAVIGATION_ITEM_KIND } from "./types";
+
+const getItem = (label: string) =>
+ getNavigationConfig({ pathname: "/alerts", apiDocsUrl: null })
+ .flatMap((section) => section.items)
+ .find((item) => item.label === label);
+
+const getConfigurationChildren = () => {
+ const configuration = getItem("Configuration");
+
+ if (configuration?.kind !== NAVIGATION_ITEM_KIND.COLLAPSIBLE) {
+ throw new Error("Configuration must be a collapsible navigation item");
+ }
+
+ return configuration.children;
+};
+
+describe("getNavigationConfig", () => {
+ afterEach(() => {
+ vi.unstubAllEnvs();
+ });
+
+ it("groups the Local Server navigation without losing available features", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const sections = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: "https://local.example/api/v1/docs",
+ });
+
+ // Then
+ expect(sections.map((section) => section.label ?? null)).toEqual([
+ null,
+ "SECURITY",
+ "SETTINGS",
+ "HELP",
+ ]);
+ expect(sections[0]?.items.map((item) => item.label)).toEqual([
+ "Overview",
+ "Lighthouse AI",
+ ]);
+ expect(sections[1]?.items.map((item) => item.label)).toEqual([
+ "Compliance",
+ "Findings",
+ "Attack Paths",
+ "Scans",
+ "Resources",
+ ]);
+ expect(sections[2]?.items.map((item) => item.label)).toEqual([
+ "Configuration",
+ "Organization",
+ ]);
+ expect(sections[3]?.items.map((item) => item.label)).toEqual([
+ "Documentation",
+ "API Reference",
+ "Community Support",
+ "Prowler Hub",
+ ]);
+ });
+
+ it("models Local Server Cloud features as contextual upgrade actions", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const children = getConfigurationChildren();
+
+ // Then
+ expect(children.map((item) => item.label)).toEqual([
+ "Providers",
+ "Alerts",
+ "Mutelist",
+ "Scans",
+ "CLI Import",
+ "Integrations",
+ "Lighthouse AI",
+ ]);
+ expect(children.find((item) => item.label === "Alerts")).toEqual(
+ expect.objectContaining({
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ cloudUpgradeFeature: CLOUD_UPGRADE_FEATURE.ALERTS,
+ }),
+ );
+ expect(children.find((item) => item.label === "Scans")).toEqual(
+ expect.objectContaining({
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ cloudUpgradeFeature: CLOUD_UPGRADE_FEATURE.SCAN_CONFIGURATION,
+ }),
+ );
+ expect(children.find((item) => item.label === "CLI Import")).toEqual(
+ expect.objectContaining({
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ cloudUpgradeFeature: CLOUD_UPGRADE_FEATURE.CLI_IMPORT,
+ }),
+ );
+ });
+
+ it("uses Cloud destinations and current New badges", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ const sections = getNavigationConfig({
+ pathname: "/scans/config",
+ apiDocsUrl: "https://ignored.example/docs",
+ });
+ const items = sections.flatMap((section) => section.items);
+ const configuration = items.find((item) => item.label === "Configuration");
+
+ if (configuration?.kind !== NAVIGATION_ITEM_KIND.COLLAPSIBLE) {
+ throw new Error("Configuration must be a collapsible navigation item");
+ }
+
+ // Then
+ expect(sections[0]?.items.map((item) => item.label)).toEqual(["Overview"]);
+ expect(configuration.children).not.toEqual(
+ expect.arrayContaining([
+ expect.objectContaining({ label: "CLI Import" }),
+ ]),
+ );
+ expect(
+ configuration.children.find((item) => item.label === "Alerts"),
+ ).toEqual(expect.objectContaining({ highlight: true }));
+ expect(
+ configuration.children.find((item) => item.label === "Scans"),
+ ).toEqual(expect.objectContaining({ active: true, highlight: true }));
+ expect(items.find((item) => item.label === "Attack Paths")).not.toEqual(
+ expect.objectContaining({ highlight: true }),
+ );
+ expect(sections[3]?.items.map((item) => item.label)).toEqual([
+ "Documentation",
+ "API Reference",
+ "Support Desk",
+ "Prowler Hub",
+ ]);
+ });
+
+ it("keeps the Cloud Billing destination for users with billing permission", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const permissions = {
+ manage_billing: true,
+ } as RolePermissionAttributes;
+
+ // When
+ const billing = getNavigationConfig({
+ pathname: "/billing",
+ apiDocsUrl: null,
+ cloudBillingEnabled: true,
+ permissions,
+ })
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "Billing");
+
+ // Then
+ expect(billing).toEqual(
+ expect.objectContaining({
+ href: "/billing",
+ active: true,
+ requiredPermission: "manage_billing",
+ }),
+ );
+ });
+
+ it("hides Billing without permission and in Local Server", () => {
+ // Given
+ const permissions = {
+ manage_billing: false,
+ } as RolePermissionAttributes;
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ const cloudItems = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: null,
+ cloudBillingEnabled: true,
+ permissions,
+ }).flatMap((section) => section.items);
+ const enterpriseItems = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: null,
+ cloudBillingEnabled: false,
+ permissions: { ...permissions, manage_billing: true },
+ }).flatMap((section) => section.items);
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ const localItems = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: null,
+ cloudBillingEnabled: true,
+ permissions: { ...permissions, manage_billing: true },
+ }).flatMap((section) => section.items);
+
+ // Then
+ expect(cloudItems.find((item) => item.label === "Billing")).toBeUndefined();
+ expect(
+ enterpriseItems.find((item) => item.label === "Billing"),
+ ).toBeUndefined();
+ expect(localItems.find((item) => item.label === "Billing")).toBeUndefined();
+ });
+
+ it("keeps environment-specific API documentation destinations", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const localApiReference = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: "https://local.example/api/v1/docs",
+ })
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "API Reference");
+
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const cloudApiReference = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: "https://ignored.example/docs",
+ })
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "API Reference");
+
+ // Then
+ expect(localApiReference).toEqual(
+ expect.objectContaining({ href: "https://local.example/api/v1/docs" }),
+ );
+ expect(cloudApiReference).toEqual(
+ expect.objectContaining({ href: "https://api.prowler.com/api/v1/docs" }),
+ );
+ });
+
+ it("omits the Local Server API reference when no URL is configured", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const items = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: null,
+ }).flatMap((section) => section.items);
+
+ // Then
+ expect(
+ items.find((item) => item.label === "API Reference"),
+ ).toBeUndefined();
+ });
+
+ it("filters navigation by required permission after visible copy changes", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const sections = getNavigationConfig({
+ pathname: "/integrations",
+ apiDocsUrl: null,
+ }).map((section) => ({
+ ...section,
+ items: section.items.map((item) =>
+ item.kind === NAVIGATION_ITEM_KIND.COLLAPSIBLE
+ ? {
+ ...item,
+ children: item.children.map((child) =>
+ child.label === "Integrations"
+ ? { ...child, label: "Connected apps" }
+ : child,
+ ),
+ }
+ : item,
+ ),
+ }));
+ const permissions = {
+ manage_integrations: false,
+ } as RolePermissionAttributes;
+
+ // When
+ const filtered = filterNavigationByPermissions(sections, permissions);
+
+ // Then
+ expect(
+ filtered
+ .flatMap((section) => section.items)
+ .filter((item) => item.kind === NAVIGATION_ITEM_KIND.COLLAPSIBLE)
+ .flatMap((item) => item.children)
+ .find((item) => item.label === "Connected apps"),
+ ).toBeUndefined();
+ });
+
+ it("keeps navigation when the required permission is granted", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const permissions = {
+ manage_integrations: true,
+ } as RolePermissionAttributes;
+
+ // When
+ const configuration = getNavigationConfig({
+ pathname: "/integrations",
+ apiDocsUrl: null,
+ permissions,
+ })
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "Configuration");
+
+ // Then
+ expect(configuration).toEqual(
+ expect.objectContaining({
+ children: expect.arrayContaining([
+ expect.objectContaining({ label: "Integrations" }),
+ ]),
+ }),
+ );
+ });
+
+ it("matches complete route segments without stealing nested settings routes", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const scanDetails = getNavigationConfig({
+ pathname: "/scans/scan-123",
+ apiDocsUrl: null,
+ });
+ const scanSettings = getNavigationConfig({
+ pathname: "/scans/config/edit",
+ apiDocsUrl: null,
+ });
+
+ // Then
+ expect(
+ scanDetails
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "Scans"),
+ ).toEqual(expect.objectContaining({ active: true }));
+ expect(
+ scanSettings
+ .flatMap((section) => section.items)
+ .find((item) => item.label === "Scans"),
+ ).toEqual(expect.objectContaining({ active: false }));
+ });
+});
diff --git a/ui/components/layout/app-sidebar/navigation-config.ts b/ui/components/layout/app-sidebar/navigation-config.ts
new file mode 100644
index 0000000000..05ff31abae
--- /dev/null
+++ b/ui/components/layout/app-sidebar/navigation-config.ts
@@ -0,0 +1,327 @@
+import {
+ Code,
+ CreditCard,
+ FileText,
+ GitBranch,
+ LayoutGrid,
+ MessageCircleQuestion,
+ Settings,
+ ShieldCheck,
+ SquareChartGantt,
+ Tag,
+ Timer,
+ Users,
+ Warehouse,
+} from "lucide-react";
+
+import { LighthouseIcon } from "@/components/icons/Icons";
+import { isCloud } from "@/lib/shared/env";
+import type { CloudUpgradeFeature } from "@/types/cloud-upgrade";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+import type { RolePermissionAttributes } from "@/types/users";
+
+import {
+ NAVIGATION_ITEM_KIND,
+ NAVIGATION_PERMISSION,
+ type NavigationChild,
+ type NavigationItem,
+ type NavigationSection,
+} from "./types";
+
+interface NavigationConfigOptions {
+ pathname: string;
+ apiDocsUrl?: string | null;
+ cloudBillingEnabled?: boolean;
+ permissions?: RolePermissionAttributes;
+}
+
+interface CloudFeatureOptions {
+ isCloudEnvironment: boolean;
+ href: string;
+ label: string;
+ active: boolean;
+ feature: CloudUpgradeFeature;
+}
+
+function getCloudFeature({
+ isCloudEnvironment,
+ href,
+ label,
+ active,
+ feature,
+}: CloudFeatureOptions): NavigationChild {
+ if (!isCloudEnvironment) {
+ return {
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ label,
+ cloudUpgradeFeature: feature,
+ };
+ }
+
+ return {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href,
+ label,
+ active,
+ highlight: true,
+ };
+}
+
+function isRouteActive(pathname: string, href: string) {
+ return pathname === href || pathname.startsWith(`${href}/`);
+}
+
+function hasRequiredPermission(
+ item: NavigationItem | NavigationChild,
+ permissions?: RolePermissionAttributes,
+) {
+ return (
+ item.requiredPermission === undefined ||
+ permissions?.[item.requiredPermission] !== false
+ );
+}
+
+export function filterNavigationByPermissions(
+ sections: NavigationSection[],
+ permissions?: RolePermissionAttributes,
+) {
+ return sections
+ .map((section) => ({
+ ...section,
+ items: section.items
+ .filter((item) => hasRequiredPermission(item, permissions))
+ .map((item) =>
+ item.kind === NAVIGATION_ITEM_KIND.COLLAPSIBLE
+ ? {
+ ...item,
+ children: item.children.filter((child) =>
+ hasRequiredPermission(child, permissions),
+ ),
+ }
+ : item,
+ ),
+ }))
+ .filter((section) => section.items.length > 0);
+}
+
+export function getNavigationConfig({
+ pathname,
+ apiDocsUrl = null,
+ cloudBillingEnabled = false,
+ permissions,
+}: NavigationConfigOptions): NavigationSection[] {
+ const isCloudEnvironment = isCloud();
+ const apiReferenceUrl = isCloudEnvironment
+ ? "https://api.prowler.com/api/v1/docs"
+ : apiDocsUrl;
+
+ const sections: NavigationSection[] = [
+ {
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/",
+ label: "Overview",
+ icon: SquareChartGantt,
+ active: pathname === "/",
+ },
+ ...(!isCloudEnvironment
+ ? [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/lighthouse",
+ label: "Lighthouse AI",
+ icon: LighthouseIcon,
+ active:
+ isRouteActive(pathname, "/lighthouse") &&
+ !isRouteActive(pathname, "/lighthouse/settings"),
+ } as const,
+ ]
+ : []),
+ ],
+ },
+ {
+ label: "SECURITY",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/compliance",
+ label: "Compliance",
+ icon: ShieldCheck,
+ active: isRouteActive(pathname, "/compliance"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/findings?filter[muted]=false&filter[status__in]=FAIL",
+ label: "Findings",
+ icon: Tag,
+ active: isRouteActive(pathname, "/findings"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/attack-paths",
+ label: "Attack Paths",
+ icon: GitBranch,
+ active: isRouteActive(pathname, "/attack-paths"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/scans",
+ label: "Scans",
+ icon: Timer,
+ active:
+ isRouteActive(pathname, "/scans") &&
+ !isRouteActive(pathname, "/scans/config"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/resources",
+ label: "Resources",
+ icon: Warehouse,
+ active: isRouteActive(pathname, "/resources"),
+ },
+ ],
+ },
+ {
+ label: "SETTINGS",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.COLLAPSIBLE,
+ label: "Configuration",
+ icon: Settings,
+ defaultOpen: true,
+ children: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/providers",
+ label: "Providers",
+ active: isRouteActive(pathname, "/providers"),
+ },
+ getCloudFeature({
+ isCloudEnvironment,
+ href: "/alerts",
+ label: "Alerts",
+ active: isRouteActive(pathname, "/alerts"),
+ feature: CLOUD_UPGRADE_FEATURE.ALERTS,
+ }),
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/mutelist",
+ label: "Mutelist",
+ active: pathname === "/mutelist",
+ },
+ getCloudFeature({
+ isCloudEnvironment,
+ href: "/scans/config",
+ label: "Scans",
+ active: isRouteActive(pathname, "/scans/config"),
+ feature: CLOUD_UPGRADE_FEATURE.SCAN_CONFIGURATION,
+ }),
+ ...(!isCloudEnvironment
+ ? [
+ {
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ label: "CLI Import",
+ cloudUpgradeFeature: CLOUD_UPGRADE_FEATURE.CLI_IMPORT,
+ } as const,
+ ]
+ : []),
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/integrations",
+ label: "Integrations",
+ requiredPermission: NAVIGATION_PERMISSION.MANAGE_INTEGRATIONS,
+ active: isRouteActive(pathname, "/integrations"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/lighthouse/settings",
+ label: "Lighthouse AI",
+ active: isRouteActive(pathname, "/lighthouse/settings"),
+ },
+ ],
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.COLLAPSIBLE,
+ label: "Organization",
+ icon: Users,
+ defaultOpen: false,
+ children: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/users",
+ label: "Users",
+ active: isRouteActive(pathname, "/users"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/invitations",
+ label: "Invitations",
+ active: isRouteActive(pathname, "/invitations"),
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/roles",
+ label: "Roles",
+ active: isRouteActive(pathname, "/roles"),
+ },
+ ],
+ },
+ ...(isCloudEnvironment && cloudBillingEnabled
+ ? [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/billing",
+ label: "Billing",
+ icon: CreditCard,
+ requiredPermission: NAVIGATION_PERMISSION.MANAGE_BILLING,
+ active: isRouteActive(pathname, "/billing"),
+ } as const,
+ ]
+ : []),
+ ],
+ },
+ {
+ label: "HELP",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "https://docs.prowler.com/",
+ label: "Documentation",
+ icon: FileText,
+ target: "_blank",
+ },
+ ...(apiReferenceUrl
+ ? [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: apiReferenceUrl,
+ label: "API Reference",
+ icon: Code,
+ target: "_blank",
+ } as const,
+ ]
+ : []),
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: isCloudEnvironment
+ ? "https://customer.support.prowler.com/servicedesk/customer/portal/9/create/102"
+ : "https://github.com/prowler-cloud/prowler/issues",
+ label: isCloudEnvironment ? "Support Desk" : "Community Support",
+ icon: MessageCircleQuestion,
+ target: "_blank",
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "https://hub.prowler.com/",
+ label: "Prowler Hub",
+ icon: LayoutGrid,
+ target: "_blank",
+ tooltip: "Looking for all available checks? learn more.",
+ },
+ ],
+ },
+ ];
+
+ return filterNavigationByPermissions(sections, permissions);
+}
diff --git a/ui/components/layout/app-sidebar/sidebar-footer.tsx b/ui/components/layout/app-sidebar/sidebar-footer.tsx
new file mode 100644
index 0000000000..66c45a5bcb
--- /dev/null
+++ b/ui/components/layout/app-sidebar/sidebar-footer.tsx
@@ -0,0 +1,63 @@
+"use client";
+
+import { Cloud } from "lucide-react";
+import Link from "next/link";
+
+import { Button } from "@/components/shadcn/button/button";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import type { AppSidebarSelectionHandler } from "./types";
+
+interface SidebarFooterProps {
+ isCloudEnvironment: boolean;
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+export function SidebarFooter({
+ isCloudEnvironment,
+ onSelect,
+}: SidebarFooterProps) {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+ const version = process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION;
+
+ return (
+ <div className="shrink-0 px-3 pb-4">
+ {!isCloudEnvironment && (
+ <div className="pt-4 pb-3">
+ <Button
+ type="button"
+ variant="default"
+ className="w-full"
+ onClick={() => {
+ openCloudUpgrade(
+ CLOUD_UPGRADE_FEATURE.GENERAL,
+ onSelect?.() ?? undefined,
+ );
+ }}
+ >
+ <Cloud aria-hidden="true" className="size-4" />
+ Explore Prowler Cloud
+ </Button>
+ </div>
+ )}
+
+ <div className="border-border-neutral-secondary text-text-neutral-tertiary flex min-h-9 items-center border-t pt-3 text-[11px]">
+ {isCloudEnvironment && (
+ <Link
+ href="https://status.prowler.com"
+ target="_blank"
+ rel="noopener noreferrer"
+ className="hover:text-text-neutral-primary min-w-0 flex-1 transition-colors"
+ onClick={onSelect}
+ >
+ <span className="truncate">Service status</span>
+ </Link>
+ )}
+ <span className="ml-auto font-mono">{version}</span>
+ </div>
+ </div>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/sidebar-navigation.test.tsx b/ui/components/layout/app-sidebar/sidebar-navigation.test.tsx
new file mode 100644
index 0000000000..196a20a2cf
--- /dev/null
+++ b/ui/components/layout/app-sidebar/sidebar-navigation.test.tsx
@@ -0,0 +1,196 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { FileText, Settings, ShieldCheck } from "lucide-react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { SidebarNavigation } from "./sidebar-navigation";
+import { NAVIGATION_ITEM_KIND, type NavigationSection } from "./types";
+
+const { openCloudUpgradeMock } = vi.hoisted(() => ({
+ openCloudUpgradeMock: vi.fn(),
+}));
+
+vi.mock("@/store", () => ({
+ useCloudUpgradeStore: (
+ selector: (state: {
+ openCloudUpgrade: typeof openCloudUpgradeMock;
+ }) => unknown,
+ ) => selector({ openCloudUpgrade: openCloudUpgradeMock }),
+}));
+
+const sections: NavigationSection[] = [
+ {
+ label: "SECURITY",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/compliance",
+ label: "Compliance",
+ icon: ShieldCheck,
+ active: true,
+ },
+ ],
+ },
+ {
+ label: "SETTINGS",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.COLLAPSIBLE,
+ label: "Configuration",
+ icon: Settings,
+ defaultOpen: false,
+ children: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "/providers",
+ label: "Providers",
+ active: true,
+ },
+ {
+ kind: NAVIGATION_ITEM_KIND.CLOUD_UPGRADE,
+ label: "Alerts",
+ cloudUpgradeFeature: CLOUD_UPGRADE_FEATURE.ALERTS,
+ },
+ ],
+ },
+ ],
+ },
+ {
+ label: "HELP",
+ items: [
+ {
+ kind: NAVIGATION_ITEM_KIND.LINK,
+ href: "https://docs.prowler.com/",
+ label: "Documentation",
+ icon: FileText,
+ target: "_blank",
+ },
+ ],
+ },
+];
+
+function setProviderActive(active: boolean): NavigationSection[] {
+ return sections.map((section) => ({
+ ...section,
+ items: section.items.map((item) =>
+ item.kind === NAVIGATION_ITEM_KIND.COLLAPSIBLE
+ ? {
+ ...item,
+ children: item.children.map((child) =>
+ child.kind === NAVIGATION_ITEM_KIND.LINK &&
+ child.label === "Providers"
+ ? { ...child, active }
+ : child,
+ ),
+ }
+ : item,
+ ),
+ }));
+}
+
+describe("SidebarNavigation", () => {
+ beforeEach(() => {
+ openCloudUpgradeMock.mockClear();
+ });
+
+ it("renders grouped semantic navigation with accessible active destinations", () => {
+ // Given / When
+ render(<SidebarNavigation sections={sections} />);
+
+ // Then
+ expect(
+ screen.getByRole("navigation", { name: "Main navigation" }),
+ ).toBeVisible();
+ expect(screen.getByText("SECURITY")).toBeVisible();
+ expect(screen.getByRole("link", { name: "Compliance" })).toHaveAttribute(
+ "aria-current",
+ "page",
+ );
+ expect(screen.getByRole("link", { name: "Providers" })).toHaveAttribute(
+ "aria-current",
+ "page",
+ );
+ const activeParent = screen.getByRole("button", {
+ name: "Configuration",
+ });
+ expect(activeParent).toHaveAttribute("aria-expanded", "true");
+ });
+
+ it("allows manually collapsing a section with an active destination", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<SidebarNavigation sections={sections} />);
+ const activeParent = screen.getByRole("button", {
+ name: "Configuration",
+ });
+
+ // When
+ await user.click(activeParent);
+
+ // Then
+ expect(activeParent).toHaveAttribute("aria-expanded", "false");
+ });
+
+ it("expands a collapsed section when one of its destinations becomes active", async () => {
+ // Given
+ const user = userEvent.setup();
+ const { rerender } = render(
+ <SidebarNavigation sections={setProviderActive(false)} />,
+ );
+ const configuration = screen.getByRole("button", {
+ name: "Configuration",
+ });
+ expect(configuration).toHaveAttribute("aria-expanded", "false");
+
+ // When
+ rerender(<SidebarNavigation sections={setProviderActive(true)} />);
+
+ // Then
+ const activeConfiguration = screen.getByRole("button", {
+ name: "Configuration",
+ });
+ expect(activeConfiguration).toHaveAttribute("aria-expanded", "true");
+
+ // When
+ await user.click(activeConfiguration);
+
+ // Then
+ expect(activeConfiguration).toHaveAttribute("aria-expanded", "false");
+
+ // When
+ rerender(<SidebarNavigation sections={setProviderActive(true)} />);
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Configuration" }),
+ ).toHaveAttribute("aria-expanded", "false");
+ });
+
+ it("marks external links and opens contextual Cloud upgrades", async () => {
+ // Given
+ const user = userEvent.setup();
+ const returnFocusElement = document.createElement("button");
+ const onSelect = vi.fn(() => returnFocusElement);
+ render(<SidebarNavigation sections={sections} onSelect={onSelect} />);
+
+ // When
+ await user.click(screen.getByRole("button", { name: /alerts/i }));
+
+ // Then
+ expect(openCloudUpgradeMock).toHaveBeenCalledWith(
+ CLOUD_UPGRADE_FEATURE.ALERTS,
+ returnFocusElement,
+ );
+ expect(screen.getByText("Cloud")).toBeVisible();
+ expect(screen.getByRole("link", { name: "Documentation" })).toHaveAttribute(
+ "target",
+ "_blank",
+ );
+ expect(screen.getByRole("link", { name: "Documentation" })).toHaveAttribute(
+ "rel",
+ "noopener noreferrer",
+ );
+ });
+});
diff --git a/ui/components/layout/app-sidebar/sidebar-navigation.tsx b/ui/components/layout/app-sidebar/sidebar-navigation.tsx
new file mode 100644
index 0000000000..341aacfebf
--- /dev/null
+++ b/ui/components/layout/app-sidebar/sidebar-navigation.tsx
@@ -0,0 +1,288 @@
+"use client";
+
+import { ArrowUpRight, ChevronDown } from "lucide-react";
+import Link from "next/link";
+import { useState } from "react";
+
+import { Badge } from "@/components/shadcn/badge/badge";
+import {
+ Collapsible,
+ CollapsibleContent,
+ CollapsibleTrigger,
+} from "@/components/shadcn/collapsible";
+import { NavigationButton } from "@/components/shadcn/navigation-button";
+import { ScrollArea } from "@/components/shadcn/scroll-area/scroll-area";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { cn } from "@/lib/utils";
+import { useCloudUpgradeStore } from "@/store";
+
+import {
+ type AppSidebarSelectionHandler,
+ NAVIGATION_ITEM_KIND,
+ type NavigationChild,
+ type NavigationChildLink,
+ type NavigationCloudUpgrade,
+ type NavigationCollapsible,
+ type NavigationLink,
+ type NavigationSection,
+} from "./types";
+
+interface SidebarNavigationProps {
+ sections: NavigationSection[];
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+interface NavigationLinkProps {
+ item: NavigationLink;
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+interface NavigationCollapsibleProps {
+ item: NavigationCollapsible;
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+interface NavigationChildProps {
+ item: NavigationChild;
+ onSelect?: AppSidebarSelectionHandler;
+}
+
+function getCollapsibleActivationKey(item: NavigationCollapsible) {
+ const activeChild = item.children.find(
+ (child) =>
+ child.kind === NAVIGATION_ITEM_KIND.LINK && child.active === true,
+ );
+
+ return `${item.label}-${activeChild?.label ?? "inactive"}`;
+}
+
+function TopLevelLink({ item, onSelect }: NavigationLinkProps) {
+ const Icon = item.icon;
+ const isExternal = item.target === "_blank";
+ const link = (
+ <NavigationButton asChild active={item.active}>
+ <Link
+ href={item.href}
+ target={item.target}
+ rel={isExternal ? "noopener noreferrer" : undefined}
+ aria-current={item.active ? "page" : undefined}
+ onClick={onSelect}
+ >
+ {item.active && (
+ <span
+ aria-hidden="true"
+ className="bg-sidebar-active-bar absolute top-2 bottom-2 -left-px w-0.5 rounded-full"
+ />
+ )}
+ <Icon
+ aria-hidden="true"
+ className={cn(
+ "size-[18px] shrink-0",
+ item.active && "text-sidebar-active-icon",
+ )}
+ />
+ <span className="min-w-0 flex-1 truncate">{item.label}</span>
+ {item.highlight && (
+ <Badge variant="new" size="sm">
+ New
+ </Badge>
+ )}
+ {isExternal && <ArrowUpRight aria-hidden="true" className="size-4" />}
+ </Link>
+ </NavigationButton>
+ );
+
+ if (!item.tooltip) return link;
+
+ return (
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>{link}</TooltipTrigger>
+ <TooltipContent side="right">{item.tooltip}</TooltipContent>
+ </Tooltip>
+ );
+}
+
+function CloudUpgradeChild({
+ item,
+ onSelect,
+}: {
+ item: NavigationCloudUpgrade;
+ onSelect?: AppSidebarSelectionHandler;
+}) {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+
+ return (
+ <NavigationButton
+ variant="subitem"
+ onClick={() => {
+ openCloudUpgrade(item.cloudUpgradeFeature, onSelect?.() ?? undefined);
+ }}
+ >
+ <span className="min-w-0 flex-1 truncate">{item.label}</span>
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>
+ </NavigationButton>
+ );
+}
+
+function LinkChild({
+ item,
+ onSelect,
+}: {
+ item: NavigationChildLink;
+ onSelect?: AppSidebarSelectionHandler;
+}) {
+ const isExternal = item.target === "_blank";
+
+ if (item.disabled) {
+ return (
+ <NavigationButton asChild variant="subitem" disabledState>
+ <span aria-disabled="true">{item.label}</span>
+ </NavigationButton>
+ );
+ }
+
+ return (
+ <NavigationButton asChild variant="subitem" active={item.active}>
+ <Link
+ href={item.href}
+ target={item.target}
+ rel={isExternal ? "noopener noreferrer" : undefined}
+ aria-current={item.active ? "page" : undefined}
+ onClick={onSelect}
+ >
+ <span className="min-w-0 flex-1 truncate">{item.label}</span>
+ {item.highlight && (
+ <Badge variant="new" size="sm">
+ New
+ </Badge>
+ )}
+ {isExternal && <ArrowUpRight aria-hidden="true" className="size-3.5" />}
+ </Link>
+ </NavigationButton>
+ );
+}
+
+function NavigationChildItem({ item, onSelect }: NavigationChildProps) {
+ if (item.kind === NAVIGATION_ITEM_KIND.CLOUD_UPGRADE) {
+ return <CloudUpgradeChild item={item} onSelect={onSelect} />;
+ }
+
+ return <LinkChild item={item} onSelect={onSelect} />;
+}
+
+function CollapsibleNavigationItem({
+ item,
+ onSelect,
+}: NavigationCollapsibleProps) {
+ const hasActiveChild = item.children.some(
+ (child) =>
+ child.kind === NAVIGATION_ITEM_KIND.LINK && child.active === true,
+ );
+ const [expanded, setExpanded] = useState(item.defaultOpen || hasActiveChild);
+ const isOpen = expanded;
+ const Icon = item.icon;
+
+ return (
+ <Collapsible open={isOpen} onOpenChange={setExpanded}>
+ <CollapsibleTrigger asChild>
+ <NavigationButton active={hasActiveChild}>
+ {hasActiveChild && (
+ <span
+ aria-hidden="true"
+ className="bg-sidebar-active-bar absolute top-2 bottom-2 -left-px w-0.5 rounded-full"
+ />
+ )}
+ <Icon
+ aria-hidden="true"
+ className={cn(
+ "size-[18px] shrink-0",
+ hasActiveChild && "text-sidebar-active-icon",
+ )}
+ />
+ <span className="min-w-0 flex-1 truncate">{item.label}</span>
+ <ChevronDown
+ aria-hidden="true"
+ className={cn(
+ "size-4 transition-transform duration-200",
+ isOpen && "rotate-180",
+ )}
+ />
+ </NavigationButton>
+ </CollapsibleTrigger>
+ <CollapsibleContent className="data-[state=closed]:animate-collapsible-up data-[state=open]:animate-collapsible-down overflow-hidden">
+ <ul className="border-sidebar-guide mt-1 ml-[21px] space-y-0.5 border-l pl-3">
+ {item.children.map((child) => (
+ <li key={child.label}>
+ <NavigationChildItem item={child} onSelect={onSelect} />
+ </li>
+ ))}
+ </ul>
+ </CollapsibleContent>
+ </Collapsible>
+ );
+}
+
+function NavigationSectionList({
+ section,
+ onSelect,
+}: {
+ section: NavigationSection;
+ onSelect?: AppSidebarSelectionHandler;
+}) {
+ return (
+ <section
+ aria-labelledby={section.label ? `sidebar-${section.label}` : undefined}
+ >
+ {section.label && (
+ <h2
+ id={`sidebar-${section.label}`}
+ className="text-text-neutral-tertiary mb-1.5 px-3 text-[10px] font-semibold tracking-[0.14em]"
+ >
+ {section.label}
+ </h2>
+ )}
+ <ul className="space-y-1">
+ {section.items.map((item) => (
+ <li key={item.label}>
+ {item.kind === NAVIGATION_ITEM_KIND.COLLAPSIBLE ? (
+ <CollapsibleNavigationItem
+ key={getCollapsibleActivationKey(item)}
+ item={item}
+ onSelect={onSelect}
+ />
+ ) : (
+ <TopLevelLink item={item} onSelect={onSelect} />
+ )}
+ </li>
+ ))}
+ </ul>
+ </section>
+ );
+}
+
+export function SidebarNavigation({
+ sections,
+ onSelect,
+}: SidebarNavigationProps) {
+ return (
+ <ScrollArea className="h-full [&>div>div[style]]:block!">
+ <nav aria-label="Main navigation" className="space-y-5 px-3 py-4">
+ {sections.map((section, index) => (
+ <NavigationSectionList
+ key={section.label ?? `primary-${index}`}
+ section={section}
+ onSelect={onSelect}
+ />
+ ))}
+ </nav>
+ </ScrollArea>
+ );
+}
diff --git a/ui/components/layout/app-sidebar/types.ts b/ui/components/layout/app-sidebar/types.ts
new file mode 100644
index 0000000000..a05d593779
--- /dev/null
+++ b/ui/components/layout/app-sidebar/types.ts
@@ -0,0 +1,71 @@
+import type { IconComponent } from "@/types";
+import type { CloudUpgradeFeature } from "@/types/cloud-upgrade";
+
+export const APP_SIDEBAR_MODE = {
+ BROWSE: "browse",
+ CHAT: "chat",
+} as const;
+
+export type AppSidebarMode =
+ (typeof APP_SIDEBAR_MODE)[keyof typeof APP_SIDEBAR_MODE];
+
+export const NAVIGATION_ITEM_KIND = {
+ LINK: "link",
+ COLLAPSIBLE: "collapsible",
+ CLOUD_UPGRADE: "cloud_upgrade",
+} as const;
+
+export const NAVIGATION_PERMISSION = {
+ MANAGE_BILLING: "manage_billing",
+ MANAGE_INTEGRATIONS: "manage_integrations",
+} as const;
+
+export type NavigationPermission =
+ (typeof NAVIGATION_PERMISSION)[keyof typeof NAVIGATION_PERMISSION];
+
+interface NavigationLabel {
+ label: string;
+ requiredPermission?: NavigationPermission;
+}
+
+export interface NavigationLink extends NavigationLabel {
+ kind: typeof NAVIGATION_ITEM_KIND.LINK;
+ href: string;
+ icon: IconComponent;
+ active?: boolean;
+ highlight?: boolean;
+ target?: string;
+ tooltip?: string;
+}
+
+export interface NavigationChildLink extends NavigationLabel {
+ kind: typeof NAVIGATION_ITEM_KIND.LINK;
+ href: string;
+ active?: boolean;
+ disabled?: boolean;
+ highlight?: boolean;
+ target?: string;
+}
+
+export interface NavigationCloudUpgrade extends NavigationLabel {
+ kind: typeof NAVIGATION_ITEM_KIND.CLOUD_UPGRADE;
+ cloudUpgradeFeature: CloudUpgradeFeature;
+}
+
+export type NavigationChild = NavigationChildLink | NavigationCloudUpgrade;
+
+export interface NavigationCollapsible extends NavigationLabel {
+ kind: typeof NAVIGATION_ITEM_KIND.COLLAPSIBLE;
+ icon: IconComponent;
+ children: NavigationChild[];
+ defaultOpen: boolean;
+}
+
+export type NavigationItem = NavigationLink | NavigationCollapsible;
+
+export interface NavigationSection {
+ label?: string;
+ items: NavigationItem[];
+}
+
+export type AppSidebarSelectionHandler = () => HTMLElement | null;
diff --git a/ui/components/layout/index.ts b/ui/components/layout/index.ts
new file mode 100644
index 0000000000..bdc128d36c
--- /dev/null
+++ b/ui/components/layout/index.ts
@@ -0,0 +1,4 @@
+export * from "./app-sidebar";
+export * from "./main-layout";
+export * from "./nav-bar";
+export * from "./user-nav";
diff --git a/ui/components/layout/main-layout/index.ts b/ui/components/layout/main-layout/index.ts
new file mode 100644
index 0000000000..b816f0d4ee
--- /dev/null
+++ b/ui/components/layout/main-layout/index.ts
@@ -0,0 +1 @@
+export * from "./main-layout";
diff --git a/ui/components/layout/main-layout/main-layout.test.tsx b/ui/components/layout/main-layout/main-layout.test.tsx
new file mode 100644
index 0000000000..26ebcc55e6
--- /dev/null
+++ b/ui/components/layout/main-layout/main-layout.test.tsx
@@ -0,0 +1,58 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import MainLayout from "./main-layout";
+
+vi.mock("@/components/layout/app-sidebar", () => ({
+ AppSidebar: () => <aside data-testid="sidebar" />,
+}));
+
+vi.mock("@/components/shared/cloud-upgrade-modal", () => ({
+ CloudUpgradeModal: () => <div data-testid="cloud-upgrade-modal" />,
+}));
+
+describe("MainLayout", () => {
+ it("mounts the shared Cloud upgrade modal with page content", () => {
+ render(
+ <MainLayout>
+ <div>Page content</div>
+ </MainLayout>,
+ );
+
+ expect(screen.getByTestId("cloud-upgrade-modal")).toBeInTheDocument();
+ expect(screen.getByTestId("sidebar")).toBeInTheDocument();
+ expect(screen.getByText("Page content")).toBeVisible();
+ expect(screen.getByRole("main")).toBeVisible();
+ });
+
+ it("keeps the desktop sidebar offset based on the viewport", () => {
+ // Given / When
+ render(
+ <MainLayout>
+ <div>Page content</div>
+ </MainLayout>,
+ );
+
+ // Then: a right panel may narrow main, but the desktop sidebar stays open.
+ // Margin reaches the sidebar edge; the 16px gutter is padding so the
+ // navbar's bled border-b paints instead of being clipped by the scroller.
+ expect(screen.getByText("Page content").parentElement).toHaveClass(
+ "min-[64rem]:ml-[264px]",
+ "pl-4",
+ );
+ });
+
+ it("marks main as the responsive container for pushed page content", () => {
+ // Given / When
+ render(
+ <MainLayout>
+ <div>Page content</div>
+ </MainLayout>,
+ );
+
+ // Then
+ expect(screen.getByText("Page content").parentElement).toHaveAttribute(
+ "data-responsive-container",
+ );
+ });
+});
diff --git a/ui/components/layout/main-layout/main-layout.tsx b/ui/components/layout/main-layout/main-layout.tsx
new file mode 100644
index 0000000000..09141c8daa
--- /dev/null
+++ b/ui/components/layout/main-layout/main-layout.tsx
@@ -0,0 +1,62 @@
+"use client";
+
+import { usePathname } from "next/navigation";
+import { type ReactNode, Suspense } from "react";
+
+import { AppSidebar } from "@/components/layout/app-sidebar";
+import { CloudUpgradeModal } from "@/components/shared/cloud-upgrade-modal";
+import { useMediaQuery } from "@/hooks/use-media-query";
+import { useStore } from "@/hooks/use-store";
+import { isLighthouseChatRoute } from "@/lib/lighthouse-routes";
+import {
+ clampSidePanelWidth,
+ SIDE_PANEL_PUSH_MEDIA_QUERY,
+} from "@/lib/ui-layout";
+import { cn } from "@/lib/utils";
+import { useSidePanelStore } from "@/store/side-panel";
+
+export default function MainLayout({ children }: { children: ReactNode }) {
+ const pathname = usePathname();
+ // Push (not overlay): the open side panel shrinks the page by exactly its
+ // (user-resizable) width so everything stays reachable. Below `sm` the
+ // panel overlays full-width instead, where pushing would leave no page. The
+ // full-page chat route has no panel at all.
+ const sidePanelOpen = useStore(useSidePanelStore, (x) => x.isOpen);
+ const sidePanelWidth = useStore(useSidePanelStore, (x) => x.width);
+ const sidePanelResizing = useStore(useSidePanelStore, (x) => x.isResizing);
+ const isPushViewport = useMediaQuery(SIDE_PANEL_PUSH_MEDIA_QUERY);
+ // Re-clamp at consumption: a persisted width from a larger monitor
+ // rehydrates raw and would otherwise collapse <main> on this viewport.
+ const pushWidth =
+ sidePanelOpen &&
+ sidePanelWidth !== undefined &&
+ isPushViewport &&
+ !isLighthouseChatRoute(pathname)
+ ? clampSidePanelWidth(sidePanelWidth)
+ : undefined;
+ return (
+ <div className="relative flex h-dvh items-center justify-center overflow-hidden">
+ <AppSidebar />
+ <CloudUpgradeModal />
+ <main
+ // @container: <main> is the reference for the app's (container-query)
+ // breakpoints, so pushing it with the side panel re-evaluates them.
+ // min-[64rem] (not lg:) keeps the sidebar margin on viewport terms.
+ // The 16px gutter is padding (not margin): main scrolls, and a scroll
+ // container clips at its padding box — the navbar's border-b bleeds
+ // across this gutter to meet the sidebar's border-r.
+ data-responsive-container
+ className={cn(
+ "no-scrollbar @container relative z-10 mb-auto h-full flex-1 flex-col overflow-y-auto pl-4 min-[64rem]:ml-[264px]",
+ // Margin animates on open/close, but tracks the pointer 1:1 during
+ // a drag resize.
+ !sidePanelResizing &&
+ "transition-[margin-left,margin-right] duration-300 ease-in-out",
+ )}
+ style={{ marginRight: pushWidth }}
+ >
+ <Suspense fallback={null}>{children}</Suspense>
+ </main>
+ </div>
+ );
+}
diff --git a/ui/components/layout/nav-bar/index.ts b/ui/components/layout/nav-bar/index.ts
new file mode 100644
index 0000000000..0f6da2a562
--- /dev/null
+++ b/ui/components/layout/nav-bar/index.ts
@@ -0,0 +1,2 @@
+export * from "./navbar";
+export * from "./navbar-client";
diff --git a/ui/components/ui/nav-bar/navbar-client.test.tsx b/ui/components/layout/nav-bar/navbar-client.test.tsx
similarity index 71%
rename from ui/components/ui/nav-bar/navbar-client.test.tsx
rename to ui/components/layout/nav-bar/navbar-client.test.tsx
index 43356c3cde..c93ed3f6e5 100644
--- a/ui/components/ui/nav-bar/navbar-client.test.tsx
+++ b/ui/components/layout/nav-bar/navbar-client.test.tsx
@@ -6,8 +6,9 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
import { getFlowById } from "@/lib/onboarding";
import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
import { usePageReadyStore } from "@/store/page-ready";
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
-import { NavbarClient } from "./navbar-client";
+import { FeedsLoadingFallback, NavbarClient } from "./navbar-client";
const navigationMocks = vi.hoisted(() => ({
pathname: "/findings",
@@ -30,15 +31,12 @@ vi.mock("@/store/onboarding-replay", () => {
return { useOnboardingReplayStore: hook };
});
-vi.mock("@/hooks/use-sidebar", () => ({
- useSidebar: () => ({ isOpen: true, toggleOpen: vi.fn() }),
-}));
-
vi.mock("@/components/ThemeSwitch", () => ({
ThemeSwitch: () => <button type="button">Theme switch</button>,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
BreadcrumbNavigation: ({
title,
titleAction,
@@ -53,12 +51,8 @@ vi.mock("@/components/ui", () => ({
),
}));
-vi.mock("../sidebar/sheet-menu", () => ({
- SheetMenu: () => <button type="button">Open menu</button>,
-}));
-
-vi.mock("../sidebar/sidebar-toggle", () => ({
- SidebarToggle: () => <button type="button">Toggle sidebar</button>,
+vi.mock("@/components/layout/app-sidebar", () => ({
+ MobileAppSidebar: () => <button type="button">Open menu</button>,
}));
vi.mock("../user-nav/user-nav", () => ({
@@ -76,6 +70,10 @@ describe("NavbarClient", () => {
vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
// Default: the current route's content has loaded, so the icon is enabled.
usePageReadyStore.setState({ readyPath: "/findings" });
+ useSidePanelStore.setState({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ });
});
it("renders an accessible contextual onboarding button in the breadcrumb", async () => {
@@ -238,6 +236,61 @@ describe("NavbarClient", () => {
).not.toBeInTheDocument();
});
+ it("shows the Lighthouse AI side-panel trigger in cloud", () => {
+ // Given / When
+ render(<NavbarClient title="Findings" />);
+
+ // Then
+ expect(screen.getByTestId("side-panel-ai-trigger")).toBeInTheDocument();
+ expect(
+ screen.getByRole("button", { name: "Ask Lighthouse AI" }),
+ ).toBeInTheDocument();
+ });
+
+ it("hides the Lighthouse AI trigger while the AI chat panel is already open", () => {
+ // Given
+ useSidePanelStore.setState({
+ isOpen: true,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ });
+
+ // When
+ render(<NavbarClient title="Findings" />);
+
+ // Then
+ expect(
+ screen.queryByTestId("side-panel-ai-trigger"),
+ ).not.toBeInTheDocument();
+ });
+
+ it("keeps the Lighthouse AI trigger while the panel shows a detail tab", () => {
+ // Given: the panel is open but on the context (detail) tab, so the trigger
+ // is still the way to switch to the AI chat.
+ useSidePanelStore.setState({
+ isOpen: true,
+ selectedTab: SIDE_PANEL_TAB.CONTEXT,
+ });
+
+ // When
+ render(<NavbarClient title="Findings" />);
+
+ // Then
+ expect(screen.getByTestId("side-panel-ai-trigger")).toBeInTheDocument();
+ });
+
+ it("hides the Lighthouse AI side-panel trigger in self-hosted (OSS) deployments", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ render(<NavbarClient title="Findings" />);
+
+ // Then
+ expect(
+ screen.queryByTestId("side-panel-ai-trigger"),
+ ).not.toBeInTheDocument();
+ });
+
it("does not render a contextual onboarding button for unknown flows", () => {
// Given / When
render(
@@ -252,4 +305,29 @@ describe("NavbarClient", () => {
screen.queryByRole("button", { name: /start product tour/i }),
).not.toBeInTheDocument();
});
+
+ it("draws a bottom separator that reaches the sidebar's edge", () => {
+ // Given / When
+ render(<NavbarClient title="Findings" />);
+
+ // Then: same token as the sidebar's border-r, bled 16px left to meet it
+ const header = screen.getByRole("banner");
+ expect(header).toHaveClass(
+ "border-b",
+ "border-border-neutral-secondary",
+ "-ml-4",
+ "pl-4",
+ );
+ expect(header).not.toHaveClass("w-full");
+ });
+
+ it("keeps the feeds fallback on the shared ghost icon treatment", () => {
+ // Given / When
+ render(<FeedsLoadingFallback />);
+
+ // Then: same 32px square as the rest of the navbar action cluster
+ const button = screen.getByRole("button", { name: "Loading updates" });
+ expect(button).toHaveClass("size-8");
+ expect(button).not.toHaveClass("rounded-full");
+ });
});
diff --git a/ui/components/ui/nav-bar/navbar-client.tsx b/ui/components/layout/nav-bar/navbar-client.tsx
similarity index 86%
rename from ui/components/ui/nav-bar/navbar-client.tsx
rename to ui/components/layout/nav-bar/navbar-client.tsx
index bdeb879034..088e31ac33 100644
--- a/ui/components/ui/nav-bar/navbar-client.tsx
+++ b/ui/components/layout/nav-bar/navbar-client.tsx
@@ -4,15 +4,16 @@ import { BellRing, Info } from "lucide-react";
import { usePathname, useRouter } from "next/navigation";
import { ReactNode, Suspense } from "react";
+import { MobileAppSidebar } from "@/components/layout/app-sidebar";
import {
+ BreadcrumbNavigation,
Button,
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn";
+import { SidePanelTrigger } from "@/components/side-panel";
import { ThemeSwitch } from "@/components/ThemeSwitch";
-import { BreadcrumbNavigation } from "@/components/ui";
-import { useSidebar } from "@/hooks/use-sidebar";
import { getFlowById } from "@/lib/onboarding";
import { isCloud } from "@/lib/shared/env";
import { useTourCompletion } from "@/lib/tours/use-tour-completion";
@@ -20,8 +21,6 @@ import { cn } from "@/lib/utils";
import { useOnboardingReplayStore } from "@/store/onboarding-replay";
import { usePageReadyStore } from "@/store/page-ready";
-import { SheetMenu } from "../sidebar/sheet-menu";
-import { SidebarToggle } from "../sidebar/sidebar-toggle";
import { UserNav } from "../user-nav/user-nav";
export interface OnboardingActionConfig {
@@ -43,7 +42,6 @@ export function NavbarClient({
onboardingAction,
feedsSlot,
}: NavbarClientProps) {
- const { isOpen, toggleOpen } = useSidebar();
const pathname = usePathname();
const router = useRouter();
const requestReplay = useOnboardingReplayStore(
@@ -82,13 +80,13 @@ export function NavbarClient({
};
return (
- <header className="sticky top-0 z-10 w-full pt-4 backdrop-blur-sm">
+ // -ml-4/pl-4: bleed the bar across <main>'s 16px left gutter so its
+ // border-b meets the sidebar's border-r. The gutter is main's padding —
+ // main scrolls and would clip anything bled past its padding box.
+ <header className="border-border-neutral-secondary sticky top-0 z-10 -ml-4 border-b pt-4 pl-4 backdrop-blur-sm">
<div className="flex h-14 items-center pr-6">
<div className="flex items-center gap-2">
- <SheetMenu />
- <div className="hidden lg:block">
- <SidebarToggle isOpen={isOpen} setIsOpen={toggleOpen} />
- </div>
+ <MobileAppSidebar />
{/* Suspense contains the useSearchParams() CSR bailout in BreadcrumbNavigation
so statically prerendered pages don't fail the build. */}
<Suspense fallback={null}>
@@ -127,6 +125,7 @@ export function NavbarClient({
</Suspense>
</div>
<div className="flex flex-1 items-center justify-end gap-3">
+ <SidePanelTrigger />
<ThemeSwitch />
{feedsSlot}
<UserNav />
@@ -139,11 +138,12 @@ export function NavbarClient({
export function FeedsLoadingFallback() {
return (
<Button
- variant="outline"
- className="border-border-input-primary-fill relative h-8 w-8 rounded-full bg-transparent p-2"
+ variant="ghost"
+ size="icon-sm"
+ aria-label="Loading updates"
disabled
>
- <BellRing size={18} className="animate-pulse text-slate-400" />
+ <BellRing className="size-5 animate-pulse" />
</Button>
);
}
diff --git a/ui/components/ui/nav-bar/navbar.tsx b/ui/components/layout/nav-bar/navbar.tsx
similarity index 100%
rename from ui/components/ui/nav-bar/navbar.tsx
rename to ui/components/layout/nav-bar/navbar.tsx
diff --git a/ui/components/layout/user-nav/index.ts b/ui/components/layout/user-nav/index.ts
new file mode 100644
index 0000000000..2e600a84a1
--- /dev/null
+++ b/ui/components/layout/user-nav/index.ts
@@ -0,0 +1 @@
+export * from "./user-nav";
diff --git a/ui/components/ui/user-nav/user-nav.tsx b/ui/components/layout/user-nav/user-nav.tsx
similarity index 94%
rename from ui/components/ui/user-nav/user-nav.tsx
rename to ui/components/layout/user-nav/user-nav.tsx
index dd2c2d8247..20c5baf2a3 100644
--- a/ui/components/ui/user-nav/user-nav.tsx
+++ b/ui/components/layout/user-nav/user-nav.tsx
@@ -4,18 +4,18 @@ import { LogOut } from "lucide-react";
import { useSession } from "next-auth/react";
import { logOut } from "@/actions/auth";
+import {
+ Avatar,
+ AvatarFallback,
+ AvatarImage,
+} from "@/components/shadcn/avatar/avatar";
import { Button } from "@/components/shadcn/button/button";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import {
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn/tooltip";
-import {
- Avatar,
- AvatarFallback,
- AvatarImage,
-} from "@/components/ui/avatar/avatar";
-import { CustomLink } from "@/components/ui/custom/custom-link";
export const UserNav = () => {
const { data: session } = useSession();
diff --git a/ui/components/lighthouse/ai-elements/actions.tsx b/ui/components/lighthouse-v1/ai-elements/actions.tsx
similarity index 93%
rename from ui/components/lighthouse/ai-elements/actions.tsx
rename to ui/components/lighthouse-v1/ai-elements/actions.tsx
index 900f7409c6..537957a74b 100644
--- a/ui/components/lighthouse/ai-elements/actions.tsx
+++ b/ui/components/lighthouse-v1/ai-elements/actions.tsx
@@ -37,7 +37,7 @@ export const Action = ({
const button = (
<Button
className={cn(
- "text-muted-foreground hover:text-foreground relative size-9 p-1.5",
+ "text-muted-foreground hover:text-text-neutral-primary relative size-9 p-1.5",
className,
)}
size={size}
diff --git a/ui/components/ai-elements/chain-of-thought.tsx b/ui/components/lighthouse-v1/ai-elements/chain-of-thought.tsx
similarity index 100%
rename from ui/components/ai-elements/chain-of-thought.tsx
rename to ui/components/lighthouse-v1/ai-elements/chain-of-thought.tsx
diff --git a/ui/components/lighthouse-v1/ai-elements/conversation.tsx b/ui/components/lighthouse-v1/ai-elements/conversation.tsx
new file mode 100644
index 0000000000..f1adfa3689
--- /dev/null
+++ b/ui/components/lighthouse-v1/ai-elements/conversation.tsx
@@ -0,0 +1,124 @@
+"use client";
+
+import { ArrowDownIcon } from "lucide-react";
+import type { ComponentProps, ReactNode } from "react";
+import { StickToBottom, useStickToBottomContext } from "use-stick-to-bottom";
+
+import { Button } from "@/components/shadcn/button/button";
+import { cn } from "@/lib/utils";
+
+export type ConversationProps = ComponentProps<typeof StickToBottom>;
+
+export const Conversation = ({ className, ...props }: ConversationProps) => (
+ <StickToBottom
+ className={cn("relative flex-1 overflow-y-hidden", className)}
+ initial="smooth"
+ resize="smooth"
+ role="log"
+ {...props}
+ />
+);
+
+type ConversationContentChildren =
+ | ReactNode
+ | ((context: ReturnType<typeof useStickToBottomContext>) => ReactNode);
+
+export type ConversationContentProps = Omit<
+ ComponentProps<"div">,
+ "children" | "ref"
+> & {
+ children?: ConversationContentChildren;
+ scrollClassName?: string;
+};
+
+export const ConversationContent = ({
+ children,
+ className,
+ scrollClassName,
+ ...props
+}: ConversationContentProps) => {
+ const context = useStickToBottomContext();
+ const { contentRef, scrollRef } = context;
+
+ return (
+ <div
+ ref={scrollRef}
+ className={cn("h-full min-h-0 w-full overflow-y-auto", scrollClassName)}
+ >
+ <div
+ ref={contentRef}
+ className={cn("flex flex-col gap-8 p-4", className)}
+ {...props}
+ >
+ {typeof children === "function" ? children(context) : children}
+ </div>
+ </div>
+ );
+};
+
+export type ConversationEmptyStateProps = ComponentProps<"div"> & {
+ title?: string;
+ description?: string;
+ icon?: ReactNode;
+};
+
+export const ConversationEmptyState = ({
+ className,
+ title = "No messages yet",
+ description = "Start a conversation to see messages here",
+ icon,
+ children,
+ ...props
+}: ConversationEmptyStateProps) => (
+ <div
+ className={cn(
+ "flex size-full flex-col items-center justify-center gap-3 p-8 text-center",
+ className,
+ )}
+ {...props}
+ >
+ {children ?? (
+ <>
+ {icon && <div className="text-muted-foreground">{icon}</div>}
+ <div className="space-y-1">
+ <h3 className="text-sm font-medium">{title}</h3>
+ {description && (
+ <p className="text-muted-foreground text-sm">{description}</p>
+ )}
+ </div>
+ </>
+ )}
+ </div>
+);
+
+export type ConversationScrollButtonProps = ComponentProps<typeof Button>;
+
+export const ConversationScrollButton = ({
+ className,
+ ...props
+}: ConversationScrollButtonProps) => {
+ const { isAtBottom, scrollToBottom } = useStickToBottomContext();
+
+ const handleScrollToBottom = () => {
+ scrollToBottom();
+ };
+
+ return (
+ !isAtBottom && (
+ <Button
+ aria-label="Scroll to bottom"
+ className={cn(
+ "absolute bottom-4 left-[50%] translate-x-[-50%] rounded-full",
+ className,
+ )}
+ onClick={handleScrollToBottom}
+ size="icon"
+ type="button"
+ variant="outline"
+ {...props}
+ >
+ <ArrowDownIcon className="size-4" />
+ </Button>
+ )
+ );
+};
diff --git a/ui/components/lighthouse/ai-elements/dropdown-menu.tsx b/ui/components/lighthouse-v1/ai-elements/dropdown-menu.tsx
similarity index 100%
rename from ui/components/lighthouse/ai-elements/dropdown-menu.tsx
rename to ui/components/lighthouse-v1/ai-elements/dropdown-menu.tsx
diff --git a/ui/components/lighthouse/ai-elements/input-group.tsx b/ui/components/lighthouse-v1/ai-elements/input-group.tsx
similarity index 100%
rename from ui/components/lighthouse/ai-elements/input-group.tsx
rename to ui/components/lighthouse-v1/ai-elements/input-group.tsx
diff --git a/ui/components/lighthouse/ai-elements/input.tsx b/ui/components/lighthouse-v1/ai-elements/input.tsx
similarity index 51%
rename from ui/components/lighthouse/ai-elements/input.tsx
rename to ui/components/lighthouse-v1/ai-elements/input.tsx
index ebfe595935..5a96027223 100644
--- a/ui/components/lighthouse/ai-elements/input.tsx
+++ b/ui/components/lighthouse-v1/ai-elements/input.tsx
@@ -6,7 +6,7 @@ function Input({ className, type, ...props }: React.ComponentProps<"input">) {
type={type}
data-slot="input"
className={cn(
- "file:text-foreground placeholder:text-muted-foreground selection:bg-primary selection:text-primary-foreground dark:bg-input/30 border-input h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+ "file:text-text-neutral-primary placeholder:text-muted-foreground selection:bg-button-primary dark:bg-input/30 border-input h-9 w-full min-w-0 rounded-md border bg-transparent px-3 py-1 text-base shadow-xs transition-[color,box-shadow] outline-none selection:text-black file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
"focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px]",
"aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive",
className,
diff --git a/ui/components/lighthouse/ai-elements/prompt-input.tsx b/ui/components/lighthouse-v1/ai-elements/prompt-input.tsx
similarity index 99%
rename from ui/components/lighthouse/ai-elements/prompt-input.tsx
rename to ui/components/lighthouse-v1/ai-elements/prompt-input.tsx
index 9816c4722a..82326b4d53 100644
--- a/ui/components/lighthouse/ai-elements/prompt-input.tsx
+++ b/ui/components/lighthouse-v1/ai-elements/prompt-input.tsx
@@ -1140,7 +1140,7 @@ export const PromptInputModelSelectTrigger = ({
<SelectTrigger
className={cn(
"text-muted-foreground border-none bg-transparent font-medium shadow-none transition-colors",
- 'hover:bg-accent hover:text-foreground [&[aria-expanded="true"]]:bg-accent [&[aria-expanded="true"]]:text-foreground',
+ 'hover:bg-accent hover:text-text-neutral-primary [&[aria-expanded="true"]]:bg-accent [&[aria-expanded="true"]]:text-text-neutral-primary',
className,
)}
{...props}
diff --git a/ui/components/lighthouse/ai-elements/select.tsx b/ui/components/lighthouse-v1/ai-elements/select.tsx
similarity index 100%
rename from ui/components/lighthouse/ai-elements/select.tsx
rename to ui/components/lighthouse-v1/ai-elements/select.tsx
diff --git a/ui/components/lighthouse/ai-elements/textarea.tsx b/ui/components/lighthouse-v1/ai-elements/textarea.tsx
similarity index 100%
rename from ui/components/lighthouse/ai-elements/textarea.tsx
rename to ui/components/lighthouse-v1/ai-elements/textarea.tsx
diff --git a/ui/components/lighthouse/ai-elements/tooltip.tsx b/ui/components/lighthouse-v1/ai-elements/tooltip.tsx
similarity index 68%
rename from ui/components/lighthouse/ai-elements/tooltip.tsx
rename to ui/components/lighthouse-v1/ai-elements/tooltip.tsx
index 8cf5ce8230..91ebb0d970 100644
--- a/ui/components/lighthouse/ai-elements/tooltip.tsx
+++ b/ui/components/lighthouse-v1/ai-elements/tooltip.tsx
@@ -46,13 +46,13 @@ function TooltipContent({
data-slot="tooltip-content"
sideOffset={sideOffset}
className={cn(
- "bg-foreground text-background animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
+ "bg-text-neutral-primary text-bg-neutral-primary animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance",
className,
)}
{...props}
>
{children}
- <TooltipPrimitive.Arrow className="bg-foreground fill-foreground z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px]" />
+ <TooltipPrimitive.Arrow className="bg-text-neutral-primary fill-text-neutral-primary z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px]" />
</TooltipPrimitive.Content>
</TooltipPrimitive.Portal>
);
diff --git a/ui/components/lighthouse/chain-of-thought-display.tsx b/ui/components/lighthouse-v1/chain-of-thought-display.tsx
similarity index 93%
rename from ui/components/lighthouse/chain-of-thought-display.tsx
rename to ui/components/lighthouse-v1/chain-of-thought-display.tsx
index 6bd226d80e..ff1864bedb 100644
--- a/ui/components/lighthouse/chain-of-thought-display.tsx
+++ b/ui/components/lighthouse-v1/chain-of-thought-display.tsx
@@ -10,14 +10,14 @@ import {
ChainOfThoughtContent,
ChainOfThoughtHeader,
ChainOfThoughtStep,
-} from "@/components/ai-elements/chain-of-thought";
+} from "@/components/lighthouse-v1/ai-elements/chain-of-thought";
import {
CHAIN_OF_THOUGHT_ACTIONS,
type ChainOfThoughtEvent,
getChainOfThoughtHeaderText,
getChainOfThoughtStepLabel,
isMetaTool,
-} from "@/components/lighthouse/chat-utils";
+} from "@/components/lighthouse-v1/chat-utils";
interface ChainOfThoughtDisplayProps {
events: ChainOfThoughtEvent[];
diff --git a/ui/components/lighthouse/chat-utils.ts b/ui/components/lighthouse-v1/chat-utils.ts
similarity index 98%
rename from ui/components/lighthouse/chat-utils.ts
rename to ui/components/lighthouse-v1/chat-utils.ts
index 70ac9e0b05..026197851f 100644
--- a/ui/components/lighthouse/chat-utils.ts
+++ b/ui/components/lighthouse-v1/chat-utils.ts
@@ -10,8 +10,8 @@ import {
MESSAGE_STATUS,
META_TOOLS,
SKILL_PREFIX,
-} from "@/lib/lighthouse/constants";
-import type { ChainOfThoughtData, Message } from "@/lib/lighthouse/types";
+} from "@/lib/lighthouse-v1/constants";
+import type { ChainOfThoughtData, Message } from "@/lib/lighthouse-v1/types";
// Re-export constants for convenience
export {
diff --git a/ui/components/lighthouse/chat.tsx b/ui/components/lighthouse-v1/chat.tsx
similarity index 94%
rename from ui/components/lighthouse/chat.tsx
rename to ui/components/lighthouse-v1/chat.tsx
index 6a8622df1b..851762b8f5 100644
--- a/ui/components/lighthouse/chat.tsx
+++ b/ui/components/lighthouse-v1/chat.tsx
@@ -5,12 +5,12 @@ import { DefaultChatTransport } from "ai";
import { Plus } from "lucide-react";
import { useRef, useState } from "react";
-import { getLighthouseModelIds } from "@/actions/lighthouse/lighthouse";
+import { getLighthouseModelIds } from "@/actions/lighthouse-v1/lighthouse";
import {
Conversation,
ConversationContent,
ConversationScrollButton,
-} from "@/components/ai-elements/conversation";
+} from "@/components/lighthouse-v1/ai-elements/conversation";
import {
PromptInput,
PromptInputBody,
@@ -18,14 +18,14 @@ import {
PromptInputTextarea,
PromptInputToolbar,
PromptInputTools,
-} from "@/components/lighthouse/ai-elements/prompt-input";
+} from "@/components/lighthouse-v1/ai-elements/prompt-input";
import {
ERROR_PREFIX,
MESSAGE_ROLES,
MESSAGE_STATUS,
-} from "@/components/lighthouse/chat-utils";
-import { Loader } from "@/components/lighthouse/loader";
-import { MessageItem } from "@/components/lighthouse/message-item";
+} from "@/components/lighthouse-v1/chat-utils";
+import { Loader } from "@/components/lighthouse-v1/loader";
+import { MessageItem } from "@/components/lighthouse-v1/message-item";
import {
Button,
Card,
@@ -35,10 +35,10 @@ import {
CardTitle,
Combobox,
} from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { CustomLink } from "@/components/ui/custom/custom-link";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
import { useMountEffect } from "@/hooks/use-mount-effect";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
interface Model {
id: string;
@@ -336,7 +336,7 @@ export const Chat = ({
<div className="relative flex h-full min-w-0 flex-col overflow-hidden">
{/* Header with New Chat button */}
{messages.length > 0 && (
- <div className="border-default-200 dark:border-default-100 border-b px-2 py-3 sm:px-4">
+ <div className="border-border-neutral-secondary border-b px-2 py-3 sm:px-4">
<div className="flex items-center justify-end">
<Button
aria-label="Start new chat"
@@ -353,7 +353,7 @@ export const Chat = ({
)}
{!hasConfig && (
- <div className="bg-background/80 absolute inset-0 z-50 flex items-center justify-center backdrop-blur-sm">
+ <div className="bg-bg-neutral-primary/80 absolute inset-0 z-50 flex items-center justify-center backdrop-blur-sm">
<Card
variant="base"
padding="lg"
@@ -367,8 +367,8 @@ export const Chat = ({
</CardHeader>
<CardContent>
<CustomLink
- href="/lighthouse/config"
- className="bg-primary text-primary-foreground hover:bg-primary/90 inline-flex items-center justify-center rounded-md px-4 py-2"
+ href="/lighthouse/settings"
+ className="bg-button-primary hover:bg-button-primary/90 inline-flex items-center justify-center rounded-md px-4 py-2 text-black"
target="_self"
size="sm"
>
diff --git a/ui/components/lighthouse/connect-llm-provider.tsx b/ui/components/lighthouse-v1/connect-llm-provider.tsx
similarity index 97%
rename from ui/components/lighthouse/connect-llm-provider.tsx
rename to ui/components/lighthouse-v1/connect-llm-provider.tsx
index f70051fa38..d35a21d052 100644
--- a/ui/components/lighthouse/connect-llm-provider.tsx
+++ b/ui/components/lighthouse-v1/connect-llm-provider.tsx
@@ -7,9 +7,9 @@ import {
createLighthouseProvider,
getLighthouseProviderByType,
updateLighthouseProviderByType,
-} from "@/actions/lighthouse/lighthouse";
-import { FormButtons } from "@/components/ui/form";
-import type { LighthouseProvider } from "@/types/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
+import { FormButtons } from "@/components/shadcn/form";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
import { getMainFields, getProviderConfig } from "./llm-provider-registry";
import {
@@ -223,7 +223,7 @@ export const ConnectLLMProvider = ({
// Navigate to model selection on success
router.push(
- `/lighthouse/config/select-model?provider=${provider}${isEditMode ? "&mode=edit" : ""}`,
+ `/lighthouse/settings/select-model?provider=${provider}${isEditMode ? "&mode=edit" : ""}`,
);
} catch (err) {
setError(err instanceof Error ? err.message : String(err));
@@ -431,7 +431,7 @@ export const ConnectLLMProvider = ({
)}
<FormButtons
- onCancel={() => router.push("/lighthouse/config")}
+ onCancel={() => router.push("/lighthouse/settings")}
submitText={isLoading ? getLoadingText() : getSubmitText()}
loadingText={getLoadingText()}
isDisabled={!isFormValid || isLoading}
diff --git a/ui/components/lighthouse/forms/delete-llm-provider-form.tsx b/ui/components/lighthouse-v1/forms/delete-llm-provider-form.tsx
similarity index 88%
rename from ui/components/lighthouse/forms/delete-llm-provider-form.tsx
rename to ui/components/lighthouse-v1/forms/delete-llm-provider-form.tsx
index 61d60369fa..f156908ff1 100644
--- a/ui/components/lighthouse/forms/delete-llm-provider-form.tsx
+++ b/ui/components/lighthouse-v1/forms/delete-llm-provider-form.tsx
@@ -6,11 +6,11 @@ import React, { Dispatch, SetStateAction } from "react";
import { useForm } from "react-hook-form";
import * as z from "zod";
-import { deleteLighthouseProviderByType } from "@/actions/lighthouse/lighthouse";
+import { deleteLighthouseProviderByType } from "@/actions/lighthouse-v1/lighthouse";
import { DeleteIcon } from "@/components/icons";
-import { useToast } from "@/components/ui";
-import { Form, FormButtons } from "@/components/ui/form";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import { useToast } from "@/components/shadcn";
+import { Form, FormButtons } from "@/components/shadcn/form";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
const formSchema = z.object({
providerType: z.string(),
@@ -49,7 +49,7 @@ export const DeleteLLMProviderForm = ({
});
setIsOpen(false);
- router.push("/lighthouse/config");
+ router.push("/lighthouse/settings");
}
}
diff --git a/ui/components/lighthouse/index.ts b/ui/components/lighthouse-v1/index.ts
similarity index 84%
rename from ui/components/lighthouse/index.ts
rename to ui/components/lighthouse-v1/index.ts
index 47d349be13..9bdcd76a06 100644
--- a/ui/components/lighthouse/index.ts
+++ b/ui/components/lighthouse-v1/index.ts
@@ -1,8 +1,8 @@
-export * from "./banner";
export * from "./chat";
export * from "./connect-llm-provider";
export * from "./lighthouse-settings";
export * from "./llm-provider-registry";
export * from "./llm-provider-utils";
export * from "./llm-providers-table";
+export * from "./managed-lighthouse-callout";
export * from "./select-model";
diff --git a/ui/components/lighthouse/lighthouse-settings.tsx b/ui/components/lighthouse-v1/lighthouse-settings.tsx
similarity index 92%
rename from ui/components/lighthouse/lighthouse-settings.tsx
rename to ui/components/lighthouse-v1/lighthouse-settings.tsx
index 4fcd1afc86..825786d4d6 100644
--- a/ui/components/lighthouse/lighthouse-settings.tsx
+++ b/ui/components/lighthouse-v1/lighthouse-settings.tsx
@@ -9,7 +9,7 @@ import * as z from "zod";
import {
getTenantConfig,
updateTenantConfig,
-} from "@/actions/lighthouse/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
import { SaveIcon } from "@/components/icons";
import {
Button,
@@ -18,9 +18,9 @@ import {
CardHeader,
CardTitle,
} from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { CustomTextarea } from "@/components/ui/custom";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { CustomTextarea } from "@/components/shadcn/custom";
+import { Form } from "@/components/shadcn/form";
const lighthouseSettingsSchema = z.object({
businessContext: z
@@ -88,13 +88,13 @@ export const LighthouseSettings = () => {
} else {
toast({
title: "Success",
- description: "Lighthouse settings saved successfully",
+ description: "Lighthouse AI settings saved successfully",
});
}
} catch (error) {
toast({
title: "Error",
- description: "Failed to save Lighthouse settings: " + String(error),
+ description: "Failed to save Lighthouse AI settings: " + String(error),
variant: "destructive",
});
} finally {
diff --git a/ui/components/lighthouse/llm-provider-registry.ts b/ui/components/lighthouse-v1/llm-provider-registry.ts
similarity index 97%
rename from ui/components/lighthouse/llm-provider-registry.ts
rename to ui/components/lighthouse-v1/llm-provider-registry.ts
index 48bb8b9654..4f91a222b4 100644
--- a/ui/components/lighthouse/llm-provider-registry.ts
+++ b/ui/components/lighthouse-v1/llm-provider-registry.ts
@@ -1,6 +1,6 @@
"use client";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
export type LLMProviderFieldType = "text" | "password";
diff --git a/ui/components/lighthouse/llm-provider-utils.ts b/ui/components/lighthouse-v1/llm-provider-utils.ts
similarity index 97%
rename from ui/components/lighthouse/llm-provider-utils.ts
rename to ui/components/lighthouse-v1/llm-provider-utils.ts
index 78362666f5..c2d1240d86 100644
--- a/ui/components/lighthouse/llm-provider-utils.ts
+++ b/ui/components/lighthouse-v1/llm-provider-utils.ts
@@ -4,10 +4,10 @@ import {
getLighthouseProviderByType,
refreshProviderModels,
testProviderConnection,
-} from "@/actions/lighthouse/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
import { getTask } from "@/actions/task/tasks";
import { checkTaskStatus } from "@/lib/helper";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
import { getProviderConfig } from "./llm-provider-registry";
diff --git a/ui/components/lighthouse/llm-providers-table.tsx b/ui/components/lighthouse-v1/llm-providers-table.tsx
similarity index 97%
rename from ui/components/lighthouse/llm-providers-table.tsx
rename to ui/components/lighthouse-v1/llm-providers-table.tsx
index 4ca3f9e084..aa6f27885e 100644
--- a/ui/components/lighthouse/llm-providers-table.tsx
+++ b/ui/components/lighthouse-v1/llm-providers-table.tsx
@@ -7,7 +7,7 @@ import { useEffect, useState } from "react";
import {
getLighthouseProviders,
getTenantConfig,
-} from "@/actions/lighthouse/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
import { Button, Card, CardContent, CardHeader } from "@/components/shadcn";
import { getAllProviders } from "./llm-provider-registry";
@@ -217,7 +217,7 @@ export const LLMProvidersTable = () => {
asChild
>
<Link
- href={`/lighthouse/config/connect?provider=${provider.id}`}
+ href={`/lighthouse/settings/connect?provider=${provider.id}`}
>
Connect
</Link>
@@ -232,7 +232,7 @@ export const LLMProvidersTable = () => {
asChild
>
<Link
- href={`/lighthouse/config/connect?provider=${provider.id}&mode=edit`}
+ href={`/lighthouse/settings/connect?provider=${provider.id}&mode=edit`}
>
Configure
</Link>
diff --git a/ui/components/lighthouse/loader.tsx b/ui/components/lighthouse-v1/loader.tsx
similarity index 100%
rename from ui/components/lighthouse/loader.tsx
rename to ui/components/lighthouse-v1/loader.tsx
diff --git a/ui/components/lighthouse-v1/managed-lighthouse-callout.test.tsx b/ui/components/lighthouse-v1/managed-lighthouse-callout.test.tsx
new file mode 100644
index 0000000000..43ce9ac993
--- /dev/null
+++ b/ui/components/lighthouse-v1/managed-lighthouse-callout.test.tsx
@@ -0,0 +1,33 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { ManagedLighthouseCallout } from "./managed-lighthouse-callout";
+
+describe("ManagedLighthouseCallout", () => {
+ afterEach(() => {
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+ });
+
+ it("opens the managed Lighthouse Cloud upgrade", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<ManagedLighthouseCallout />);
+
+ const upgradeButton = screen.getByRole("button", {
+ name: "Explore The Agentic Cloud Defender",
+ });
+
+ // When
+ await user.click(upgradeButton);
+
+ // Then
+ expect(upgradeButton).toHaveClass("bg-button-primary");
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI,
+ );
+ });
+});
diff --git a/ui/components/lighthouse-v1/managed-lighthouse-callout.tsx b/ui/components/lighthouse-v1/managed-lighthouse-callout.tsx
new file mode 100644
index 0000000000..80e38f5ccc
--- /dev/null
+++ b/ui/components/lighthouse-v1/managed-lighthouse-callout.tsx
@@ -0,0 +1,51 @@
+"use client";
+
+import { Sparkles } from "lucide-react";
+
+import { Badge } from "@/components/shadcn/badge/badge";
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Card,
+ CardContent,
+ CardHeader,
+ CardTitle,
+} from "@/components/shadcn/card/card";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+export const ManagedLighthouseCallout = () => {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
+
+ return (
+ <Card variant="inner" padding="lg">
+ <CardHeader className="gap-3">
+ <div className="flex items-center gap-2">
+ <Sparkles
+ aria-hidden="true"
+ className="text-text-neutral-primary size-5"
+ />
+ <CardTitle>Skip the setup with Prowler Cloud</CardTitle>
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>
+ </div>
+ </CardHeader>
+ <CardContent className="flex flex-col items-start gap-4">
+ <p className="text-text-neutral-secondary text-sm">
+ Prowler Cloud includes managed OpenAI access with no API keys to
+ provision, plus a hosted remote MCP server to automate security
+ workflows.
+ </p>
+ <Button
+ type="button"
+ variant="default"
+ onClick={() => openCloudUpgrade(CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI)}
+ >
+ Explore The Agentic Cloud Defender
+ </Button>
+ </CardContent>
+ </Card>
+ );
+};
diff --git a/ui/components/lighthouse/message-item.tsx b/ui/components/lighthouse-v1/message-item.tsx
similarity index 70%
rename from ui/components/lighthouse/message-item.tsx
rename to ui/components/lighthouse-v1/message-item.tsx
index 033ab7a66d..9a1e571b50 100644
--- a/ui/components/lighthouse/message-item.tsx
+++ b/ui/components/lighthouse-v1/message-item.tsx
@@ -6,86 +6,20 @@
import { Copy, RotateCcw } from "lucide-react";
import { defaultRehypePlugins, Streamdown } from "streamdown";
-import { Action, Actions } from "@/components/lighthouse/ai-elements/actions";
-import { ChainOfThoughtDisplay } from "@/components/lighthouse/chain-of-thought-display";
+import {
+ Action,
+ Actions,
+} from "@/components/lighthouse-v1/ai-elements/actions";
+import { ChainOfThoughtDisplay } from "@/components/lighthouse-v1/chain-of-thought-display";
import {
extractChainOfThoughtEvents,
extractMessageText,
type Message,
MESSAGE_ROLES,
MESSAGE_STATUS,
-} from "@/components/lighthouse/chat-utils";
-import { Loader } from "@/components/lighthouse/loader";
-
-/**
- * Escapes angle-bracket placeholders like <bucket_name> to HTML entities
- * so they display correctly instead of being interpreted as HTML tags.
- *
- * This processes the text while preserving:
- * - Content inside inline code (backticks)
- * - Content inside code blocks (triple backticks)
- */
-function escapeAngleBracketPlaceholders(text: string): string {
- // HTML tags to preserve (not escape)
- const htmlTags = new Set([
- "div",
- "span",
- "p",
- "a",
- "img",
- "br",
- "hr",
- "ul",
- "ol",
- "li",
- "table",
- "tr",
- "td",
- "th",
- "thead",
- "tbody",
- "h1",
- "h2",
- "h3",
- "h4",
- "h5",
- "h6",
- "pre",
- "blockquote",
- "strong",
- "em",
- "b",
- "i",
- "u",
- "s",
- "sub",
- "sup",
- "details",
- "summary",
- ]);
-
- // Split by code blocks and inline code to preserve them
- // This regex captures: ```...``` blocks, `...` inline code, and everything else
- const parts = text.split(/(```[\s\S]*?```|`[^`]+`)/g);
-
- return parts
- .map((part) => {
- // If it's a code block or inline code, leave it untouched
- // Shiki/syntax highlighter handles escaping inside code blocks
- if (part.startsWith("```") || part.startsWith("`")) {
- return part;
- }
-
- // For regular text outside code, wrap placeholders in backticks
- return part.replace(/<([a-zA-Z][a-zA-Z0-9_-]*)>/g, (match, tagName) => {
- if (htmlTags.has(tagName.toLowerCase())) {
- return match;
- }
- return `\`<${tagName}>\``;
- });
- })
- .join("");
-}
+} from "@/components/lighthouse-v1/chat-utils";
+import { Loader } from "@/components/lighthouse-v1/loader";
+import { escapeAngleBracketPlaceholders } from "@/lib/markdown";
interface MessageItemProps {
message: Message;
diff --git a/ui/components/lighthouse/select-bedrock-auth-method.tsx b/ui/components/lighthouse-v1/select-bedrock-auth-method.tsx
similarity index 91%
rename from ui/components/lighthouse/select-bedrock-auth-method.tsx
rename to ui/components/lighthouse-v1/select-bedrock-auth-method.tsx
index 1ba19da820..f095514494 100644
--- a/ui/components/lighthouse/select-bedrock-auth-method.tsx
+++ b/ui/components/lighthouse-v1/select-bedrock-auth-method.tsx
@@ -1,9 +1,9 @@
"use client";
-import { RadioGroup } from "@heroui/radio";
import { useRouter, useSearchParams } from "next/navigation";
-import { CustomRadio } from "@/components/ui/custom";
+import { CustomRadio } from "@/components/shadcn/custom";
+import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
const BEDROCK_AUTH_METHODS = {
API_KEY: "api_key",
@@ -37,7 +37,7 @@ export const SelectBedrockAuthMethod = () => {
<div className="flex flex-col gap-3">
<RadioGroup
- className="flex flex-col gap-3"
+ className="gap-3"
value={currentAuth || ""}
onValueChange={handleSelectionChange}
>
diff --git a/ui/components/lighthouse/select-model.tsx b/ui/components/lighthouse-v1/select-model.tsx
similarity index 98%
rename from ui/components/lighthouse/select-model.tsx
rename to ui/components/lighthouse-v1/select-model.tsx
index 5f26036a44..40d8fd308e 100644
--- a/ui/components/lighthouse/select-model.tsx
+++ b/ui/components/lighthouse-v1/select-model.tsx
@@ -7,9 +7,9 @@ import {
getLighthouseModelIds,
getTenantConfig,
updateTenantConfig,
-} from "@/actions/lighthouse/lighthouse";
+} from "@/actions/lighthouse-v1/lighthouse";
import { Button } from "@/components/shadcn";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
import {
getProviderIdByType,
diff --git a/ui/components/lighthouse/workflow/index.ts b/ui/components/lighthouse-v1/workflow/index.ts
similarity index 100%
rename from ui/components/lighthouse/workflow/index.ts
rename to ui/components/lighthouse-v1/workflow/index.ts
diff --git a/ui/components/lighthouse/workflow/workflow-connect-llm.tsx b/ui/components/lighthouse-v1/workflow/workflow-connect-llm.tsx
similarity index 70%
rename from ui/components/lighthouse/workflow/workflow-connect-llm.tsx
rename to ui/components/lighthouse-v1/workflow/workflow-connect-llm.tsx
index 455e244fca..2ce33c4b48 100644
--- a/ui/components/lighthouse/workflow/workflow-connect-llm.tsx
+++ b/ui/components/lighthouse-v1/workflow/workflow-connect-llm.tsx
@@ -1,12 +1,11 @@
"use client";
-import { Progress } from "@heroui/progress";
-import { Spacer } from "@heroui/spacer";
import { usePathname, useSearchParams } from "next/navigation";
import React from "react";
+import { Progress } from "@/components/shadcn/progress";
import { cn } from "@/lib/utils";
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
import { getProviderConfig } from "../llm-provider-registry";
@@ -15,13 +14,13 @@ const steps = [
title: "Enter Credentials",
description:
"Enter your API key and configure connection settings for the LLM provider.",
- href: "/lighthouse/config/connect",
+ href: "/lighthouse/settings/connect",
},
{
title: "Select Default Model",
description:
"Choose the default model to use for AI-powered features in Prowler.",
- href: "/lighthouse/config/select-model",
+ href: "/lighthouse/settings/select-model",
},
];
@@ -31,8 +30,8 @@ const ROUTE_CONFIG: Record<
stepIndex: number;
}
> = {
- "/lighthouse/config/connect": { stepIndex: 0 },
- "/lighthouse/config/select-model": { stepIndex: 1 },
+ "/lighthouse/settings/connect": { stepIndex: 0 },
+ "/lighthouse/settings/select-model": { stepIndex: 1 },
};
export const WorkflowConnectLLM = () => {
@@ -55,26 +54,24 @@ export const WorkflowConnectLLM = () => {
<h1 className="mb-2 text-xl font-medium" id="getting-started">
{isEditMode ? `Configure ${providerName}` : `Connect ${providerName}`}
</h1>
- <p className="text-small text-default-500 mb-5">
+ <p className="text-text-neutral-tertiary mb-5 text-sm">
{isEditMode
? "Update your LLM provider configuration and settings."
: "Follow these steps to configure your LLM provider and enable AI-powered features."}
</p>
- <Progress
- classNames={{
- base: "px-0.5 mb-5",
- label: "text-small",
- value: "text-small text-button-primary",
- indicator: "bg-button-primary",
- }}
- label="Steps"
- maxValue={steps.length}
- minValue={0}
- showValueLabel={true}
- size="md"
- value={currentStep + 1}
- valueLabel={`${currentStep + 1} of ${steps.length}`}
- />
+ <div className="mb-5 flex flex-col gap-2 px-0.5">
+ <div className="flex items-center justify-between">
+ <span className="text-sm">Steps</span>
+ <span className="text-button-primary text-sm">
+ {`${currentStep + 1} of ${steps.length}`}
+ </span>
+ </div>
+ <Progress
+ aria-label="Steps"
+ value={((currentStep + 1) / steps.length) * 100}
+ indicatorClassName="bg-button-primary"
+ />
+ </div>
<nav aria-label="Progress">
<ol className="flex flex-col gap-y-3">
{steps.map((step, index) => {
@@ -84,7 +81,7 @@ export const WorkflowConnectLLM = () => {
return (
<li
key={step.title}
- className="border-border-neutral-primary rounded-large border px-3 py-2.5"
+ className="border-border-neutral-primary rounded-[14px] border px-3 py-2.5"
>
<div className="flex items-center gap-4">
<div
@@ -96,7 +93,7 @@ export const WorkflowConnectLLM = () => {
"border-button-primary text-button-primary bg-transparent",
!isActive &&
!isComplete &&
- "text-default-500 border-border-neutral-primary bg-transparent",
+ "text-text-neutral-tertiary border-border-neutral-primary bg-transparent",
)}
>
{index + 1}
@@ -104,20 +101,20 @@ export const WorkflowConnectLLM = () => {
<div className="flex-1 text-left">
<div
className={cn(
- "text-medium font-medium",
+ "text-base font-medium",
isActive || isComplete
- ? "text-default-foreground"
- : "text-default-500",
+ ? "text-text-neutral-primary"
+ : "text-text-neutral-tertiary",
)}
>
{step.title}
</div>
<div
className={cn(
- "text-small",
+ "text-sm",
isActive || isComplete
- ? "text-default-600"
- : "text-default-500",
+ ? "text-text-neutral-secondary"
+ : "text-text-neutral-tertiary",
)}
>
{step.description}
@@ -129,7 +126,7 @@ export const WorkflowConnectLLM = () => {
})}
</ol>
</nav>
- <Spacer y={4} />
+ <div className="h-4" />
</section>
);
};
diff --git a/ui/components/lighthouse/banner-client.tsx b/ui/components/lighthouse/banner-client.tsx
deleted file mode 100644
index 9c91f2555a..0000000000
--- a/ui/components/lighthouse/banner-client.tsx
+++ /dev/null
@@ -1,128 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useEffect, useRef, useState } from "react";
-
-import { Card, CardContent } from "@/components/shadcn/card/card";
-import { cn } from "@/lib/utils";
-
-import { LighthouseIcon } from "../icons";
-
-const AnimatedGradientCard = ({
- message,
- href,
-}: {
- message: string;
- href: string;
-}) => {
- const interactiveRef = useRef<HTMLDivElement>(null);
- const curXRef = useRef(0);
- const curYRef = useRef(0);
- const tgXRef = useRef(0);
- const tgYRef = useRef(0);
- const [isSafari, setIsSafari] = useState(false);
-
- useEffect(() => {
- setIsSafari(/^((?!chrome|android).)*safari/i.test(navigator.userAgent));
- }, []);
-
- useEffect(() => {
- let animationFrameId: number;
-
- const move = () => {
- if (!interactiveRef.current) return;
-
- curXRef.current += (tgXRef.current - curXRef.current) / 20;
- curYRef.current += (tgYRef.current - curYRef.current) / 20;
-
- interactiveRef.current.style.transform = `translate(${Math.round(curXRef.current)}px, ${Math.round(curYRef.current)}px)`;
-
- animationFrameId = requestAnimationFrame(move);
- };
-
- animationFrameId = requestAnimationFrame(move);
-
- return () => {
- cancelAnimationFrame(animationFrameId);
- };
- }, []);
-
- const handleMouseMove = (event: React.MouseEvent<HTMLDivElement>) => {
- if (interactiveRef.current) {
- const rect = interactiveRef.current.getBoundingClientRect();
- tgXRef.current = event.clientX - rect.left;
- tgYRef.current = event.clientY - rect.top;
- }
- };
-
- return (
- <Link href={href} className="mb-8 block w-full">
- <Card
- variant="base"
- className="group relative overflow-hidden"
- onMouseMove={handleMouseMove}
- >
- <svg className="hidden">
- <defs>
- <filter id="blurMe">
- <feGaussianBlur
- in="SourceGraphic"
- stdDeviation="10"
- result="blur"
- />
- <feColorMatrix
- in="blur"
- mode="matrix"
- values="1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 18 -8"
- result="goo"
- />
- <feBlend in="SourceGraphic" in2="goo" />
- </filter>
- </defs>
- </svg>
-
- <div
- className={cn(
- "pointer-events-none absolute inset-0 blur-lg",
- isSafari ? "blur-2xl" : "[filter:url(#blurMe)_blur(40px)]",
- )}
- >
- <div className="animate-first absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:center_center] opacity-100 [mix-blend-mode:hard-light] [background:radial-gradient(circle_at_center,_var(--bg-neutral-tertiary)_0,_transparent_50%)_no-repeat]" />
-
- <div className="animate-second absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:calc(50%-200px)] opacity-80 [mix-blend-mode:hard-light] [background:radial-gradient(circle_at_center,_var(--bg-button-primary)_0,_transparent_50%)_no-repeat]" />
-
- <div className="animate-third absolute [top:calc(50%-60%)] [left:calc(50%-60%)] h-[120%] w-[120%] [transform-origin:calc(50%+200px)] opacity-70 [mix-blend-mode:hard-light] [background:radial-gradient(circle_at_center,_var(--bg-button-primary-hover)_0,_transparent_50%)_no-repeat]" />
-
- <div
- ref={interactiveRef}
- className="absolute -top-1/2 -left-1/2 h-full w-full opacity-60 [mix-blend-mode:hard-light] [background:radial-gradient(circle_at_center,_var(--bg-button-primary-press)_0,_transparent_50%)_no-repeat]"
- />
- </div>
-
- <CardContent className="relative z-10">
- <div className="flex items-center gap-4">
- <div className="flex h-10 w-10 items-center justify-center">
- <LighthouseIcon size={24} />
- </div>
- <p className="text-text-neutral-primary text-base font-semibold">
- {message}
- </p>
- </div>
- </CardContent>
- </Card>
- </Link>
- );
-};
-
-export const LighthouseBannerClient = ({
- isConfigured,
-}: {
- isConfigured: boolean;
-}) => {
- const message = isConfigured
- ? "Use Lighthouse to review your findings and gain insights"
- : "Enable Lighthouse to secure your cloud with AI insights";
- const href = isConfigured ? "/lighthouse" : "/lighthouse/config";
-
- return <AnimatedGradientCard message={message} href={href} />;
-};
diff --git a/ui/components/lighthouse/banner.tsx b/ui/components/lighthouse/banner.tsx
deleted file mode 100644
index b36ad760b0..0000000000
--- a/ui/components/lighthouse/banner.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { isLighthouseConfigured } from "@/actions/lighthouse/lighthouse";
-
-import { LighthouseBannerClient } from "./banner-client";
-
-export const LighthouseBanner = async () => {
- try {
- const isConfigured = await isLighthouseConfigured();
-
- return <LighthouseBannerClient isConfigured={isConfigured} />;
- } catch (_error) {
- return null;
- }
-};
diff --git a/ui/components/manage-groups/forms/add-group-form.tsx b/ui/components/manage-groups/forms/add-group-form.tsx
index 394d3ae55d..886d462e14 100644
--- a/ui/components/manage-groups/forms/add-group-form.tsx
+++ b/ui/components/manage-groups/forms/add-group-form.tsx
@@ -1,16 +1,15 @@
"use client";
-import { Divider } from "@heroui/divider";
import { zodResolver } from "@hookform/resolvers/zod";
import { SaveIcon } from "lucide-react";
import { Controller, useForm } from "react-hook-form";
import * as z from "zod";
import { createProviderGroup } from "@/actions/manage-groups";
-import { Button } from "@/components/shadcn";
+import { Button, Separator } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form } from "@/components/shadcn/form";
import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form } from "@/components/ui/form";
import { ApiError } from "@/types";
const addGroupSchema = z.object({
@@ -157,9 +156,9 @@ export const AddGroupForm = ({
{form.formState.errors.providers.message}
</p>
)}
- <Divider orientation="horizontal" className="mb-2" />
+ <Separator orientation="horizontal" className="mb-2" />
- <p className="text-small text-default-500">
+ <p className="text-text-neutral-tertiary text-sm">
Roles can also be associated with the group. This step is optional and
can be completed later if needed or from the Roles page.
</p>
diff --git a/ui/components/manage-groups/forms/delete-group-form.tsx b/ui/components/manage-groups/forms/delete-group-form.tsx
index 0504178cb7..6a2a035875 100644
--- a/ui/components/manage-groups/forms/delete-group-form.tsx
+++ b/ui/components/manage-groups/forms/delete-group-form.tsx
@@ -9,8 +9,8 @@ import * as z from "zod";
import { deleteProviderGroup } from "@/actions/manage-groups/manage-groups";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
const formSchema = z.object({
groupId: z.string(),
diff --git a/ui/components/manage-groups/forms/edit-group-form.tsx b/ui/components/manage-groups/forms/edit-group-form.tsx
index 02503940f1..7db75aef2b 100644
--- a/ui/components/manage-groups/forms/edit-group-form.tsx
+++ b/ui/components/manage-groups/forms/edit-group-form.tsx
@@ -1,6 +1,5 @@
"use client";
-import { Divider } from "@heroui/divider";
import { zodResolver } from "@hookform/resolvers/zod";
import { SaveIcon } from "lucide-react";
import { useRouter } from "next/navigation";
@@ -8,11 +7,11 @@ import { Controller, useForm } from "react-hook-form";
import * as z from "zod";
import { updateProviderGroup } from "@/actions/manage-groups/manage-groups";
-import { Button } from "@/components/shadcn";
+import { Button, Separator } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form } from "@/components/shadcn/form";
import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form } from "@/components/ui/form";
import { ApiError } from "@/types";
const editGroupSchema = z.object({
@@ -209,8 +208,8 @@ export const EditGroupForm = ({
</p>
)}
- <Divider orientation="horizontal" className="mb-2" />
- <p className="text-small text-default-500">
+ <Separator orientation="horizontal" className="mb-2" />
+ <p className="text-text-neutral-tertiary text-sm">
The roles associated with the group can be edited directly here or
from the Roles page.
</p>
diff --git a/ui/components/manage-groups/skeleton-manage-groups.tsx b/ui/components/manage-groups/skeleton-manage-groups.tsx
index b2a6cf6053..a268cfc0a3 100644
--- a/ui/components/manage-groups/skeleton-manage-groups.tsx
+++ b/ui/components/manage-groups/skeleton-manage-groups.tsx
@@ -1,33 +1,17 @@
-import { Card } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
-import React from "react";
+import { Card, Skeleton } from "@/components/shadcn";
export const SkeletonManageGroups = () => {
return (
- <Card className="flex h-full w-full flex-col gap-5 p-4" radius="sm">
+ <Card className="flex h-full w-full flex-col gap-5 rounded-lg p-4">
{/* Table headers */}
<div className="hidden justify-between md:flex">
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
</div>
{/* Table body */}
@@ -37,27 +21,13 @@ export const SkeletonManageGroups = () => {
key={index}
className="flex flex-col items-center justify-between md:flex-row md:gap-4"
>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
</div>
))}
</div>
diff --git a/ui/components/manage-groups/table/column-groups.tsx b/ui/components/manage-groups/table/column-groups.tsx
index a7dadd846c..e603650a2c 100644
--- a/ui/components/manage-groups/table/column-groups.tsx
+++ b/ui/components/manage-groups/table/column-groups.tsx
@@ -2,8 +2,8 @@
import { ColumnDef } from "@tanstack/react-table";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { ProviderGroup } from "@/types";
import { DataTableRowActions } from "./data-table-row-actions";
@@ -22,7 +22,7 @@ export const ColumnGroups: ColumnDef<ProviderGroup>[] = [
const {
attributes: { name },
} = getProviderData(row);
- return <p className="text-small font-medium">{name}</p>;
+ return <p className="text-sm font-medium">{name}</p>;
},
},
diff --git a/ui/components/manage-groups/table/skeleton-table-groups.tsx b/ui/components/manage-groups/table/skeleton-table-groups.tsx
index 03c817b9d1..1da8eba819 100644
--- a/ui/components/manage-groups/table/skeleton-table-groups.tsx
+++ b/ui/components/manage-groups/table/skeleton-table-groups.tsx
@@ -1,39 +1,94 @@
-import React from "react";
-
-import { Card } from "@/components/shadcn/card/card";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-export const SkeletonTableGroups = () => {
+const SkeletonTableRow = () => {
return (
- <Card variant="base" padding="md" className="flex flex-col gap-4">
- {/* Table headers */}
- <div className="hidden gap-4 md:flex">
- <Skeleton className="h-8 w-1/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-1/12" />
- <Skeleton className="h-8 w-1/12" />
- </div>
-
- {/* Table body */}
- <div className="flex flex-col gap-3">
- {[...Array(3)].map((_, index) => (
- <div
- key={index}
- className="flex flex-col gap-4 md:flex-row md:items-center"
- >
- <Skeleton className="h-12 w-full md:w-1/12" />
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-1/12" />
- <Skeleton className="hidden h-12 md:block md:w-1/12" />
- </div>
- ))}
- </div>
- </Card>
+ <tr className="border-border-neutral-secondary border-b last:border-b-0">
+ {/* Name - text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-32 rounded" />
+ </td>
+ {/* Providers - count in circle */}
+ <td className="px-3 py-4">
+ <Skeleton className="size-8 rounded-full" />
+ </td>
+ {/* Roles - count in circle */}
+ <td className="px-3 py-4">
+ <Skeleton className="size-8 rounded-full" />
+ </td>
+ {/* Added - date */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Actions */}
+ <td className="px-2 py-4">
+ <Skeleton className="size-6 rounded" />
+ </td>
+ </tr>
+ );
+};
+
+export const SkeletonTableGroups = () => {
+ const rows = 10;
+
+ return (
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
+ {/* Toolbar: Search + Total entries */}
+ <div className="flex items-center justify-between">
+ {/* Search icon button */}
+ <Skeleton className="size-10 rounded-md" />
+ {/* Total entries */}
+ <Skeleton className="h-4 w-28 rounded" />
+ </div>
+
+ {/* Table */}
+ <table className="w-full">
+ <thead>
+ <tr className="border-border-neutral-secondary border-b">
+ {/* Name */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-12 rounded" />
+ </th>
+ {/* Providers */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-20 rounded" />
+ </th>
+ {/* Roles */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-16 rounded" />
+ </th>
+ {/* Added */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-14 rounded" />
+ </th>
+ {/* Actions - empty header */}
+ <th className="w-10 py-3" />
+ </tr>
+ </thead>
+ <tbody>
+ {Array.from({ length: rows }).map((_, i) => (
+ <SkeletonTableRow key={i} />
+ ))}
+ </tbody>
+ </table>
+
+ {/* Pagination */}
+ <div className="flex items-center justify-between pt-2">
+ {/* Rows per page */}
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-4 w-24 rounded" />
+ <Skeleton className="h-9 w-16 rounded-md" />
+ </div>
+ {/* Page info + navigation */}
+ <div className="flex items-center gap-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ <div className="flex gap-1">
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ </div>
+ </div>
+ </div>
+ </div>
);
};
diff --git a/ui/components/overview/new-findings-table/table/column-latest-findings.tsx b/ui/components/overview/new-findings-table/table/column-latest-findings.tsx
index 6310e2dc40..0b2737bad9 100644
--- a/ui/components/overview/new-findings-table/table/column-latest-findings.tsx
+++ b/ui/components/overview/new-findings-table/table/column-latest-findings.tsx
@@ -2,10 +2,18 @@
import { ColumnDef } from "@tanstack/react-table";
+import {
+ loadLatestFindingTriageNote,
+ updateFindingTriage,
+} from "@/actions/findings";
import { getStandaloneFindingColumns } from "@/components/findings/table/column-standalone-findings";
import { FindingProps } from "@/types";
export const ColumnLatestFindings: ColumnDef<FindingProps>[] =
getStandaloneFindingColumns({
includeUpdatedAt: true,
+ onTriageUpdateAction: async (input) => {
+ await updateFindingTriage(input);
+ },
+ onTriageNoteLoadAction: loadLatestFindingTriageNote,
});
diff --git a/ui/components/overview/new-findings-table/table/skeleton-table-new-findings.tsx b/ui/components/overview/new-findings-table/table/skeleton-table-new-findings.tsx
index 76c7851d30..6dd276e9e4 100644
--- a/ui/components/overview/new-findings-table/table/skeleton-table-new-findings.tsx
+++ b/ui/components/overview/new-findings-table/table/skeleton-table-new-findings.tsx
@@ -53,7 +53,7 @@ export const SkeletonTableNewFindings = () => {
const rows = 10;
return (
- <div className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden border p-4">
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
{/* Header: title + description on the left, link on the right */}
<div className="flex w-full items-center justify-between gap-4">
<div className="flex flex-col gap-1">
diff --git a/ui/components/providers/forms/delete-form.tsx b/ui/components/providers/forms/delete-form.tsx
index 580d192641..1547e9f83d 100644
--- a/ui/components/providers/forms/delete-form.tsx
+++ b/ui/components/providers/forms/delete-form.tsx
@@ -8,8 +8,8 @@ import * as z from "zod";
import { deleteProvider } from "@/actions/providers";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
const formSchema = z.object({
diff --git a/ui/components/providers/forms/delete-organization-form.tsx b/ui/components/providers/forms/delete-organization-form.tsx
index fd9434280f..9d17e4251c 100644
--- a/ui/components/providers/forms/delete-organization-form.tsx
+++ b/ui/components/providers/forms/delete-organization-form.tsx
@@ -8,7 +8,7 @@ import {
} from "@/actions/organizations/organizations";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
+import { useToast } from "@/components/shadcn";
import {
PROVIDERS_GROUP_KIND,
ProvidersGroupKind,
diff --git a/ui/components/providers/forms/edit-name-form.tsx b/ui/components/providers/forms/edit-name-form.tsx
index 5a2f1d2943..b6d937baf6 100644
--- a/ui/components/providers/forms/edit-name-form.tsx
+++ b/ui/components/providers/forms/edit-name-form.tsx
@@ -5,8 +5,8 @@ import { useState } from "react";
import { SaveIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
import { Input } from "@/components/shadcn/input/input";
-import { useToast } from "@/components/ui";
interface EditNameFormProps {
currentValue: string;
diff --git a/ui/components/providers/organizations/aws-method-selector.test.tsx b/ui/components/providers/organizations/aws-method-selector.test.tsx
index 62b74a67f4..9279e8dfb2 100644
--- a/ui/components/providers/organizations/aws-method-selector.test.tsx
+++ b/ui/components/providers/organizations/aws-method-selector.test.tsx
@@ -1,28 +1,43 @@
import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
import { afterEach, describe, expect, it, vi } from "vitest";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
import { AwsMethodSelector } from "./aws-method-selector";
describe("AwsMethodSelector", () => {
afterEach(() => {
vi.unstubAllEnvs();
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
});
- it("links the OSS AWS Organizations badge to pricing", () => {
+ it("opens the AWS Organizations upgrade in Local Server", async () => {
// Given
vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ const user = userEvent.setup();
+ const onSelectOrganizations = vi.fn();
// When
render(
<AwsMethodSelector
onSelectSingle={vi.fn()}
- onSelectOrganizations={vi.fn()}
+ onSelectOrganizations={onSelectOrganizations}
/>,
);
// Then
- expect(
- screen.getByRole("link", { name: /available in prowler cloud/i }),
- ).toHaveAttribute("href", "https://prowler.com/pricing");
+ await user.click(
+ screen.getByRole("radio", {
+ name: /add multiple accounts with aws organizations/i,
+ }),
+ );
+
+ expect(onSelectOrganizations).not.toHaveBeenCalled();
+ expect(screen.getByText("Cloud")).toBeVisible();
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS,
+ );
});
});
diff --git a/ui/components/providers/organizations/aws-method-selector.tsx b/ui/components/providers/organizations/aws-method-selector.tsx
index ca36407508..882adef1b2 100644
--- a/ui/components/providers/organizations/aws-method-selector.tsx
+++ b/ui/components/providers/organizations/aws-method-selector.tsx
@@ -1,9 +1,12 @@
"use client";
-import { Ban, Box, Boxes } from "lucide-react";
+import { Box, Boxes } from "lucide-react";
import { RadioCard } from "@/components/providers/radio-card";
-import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
+import { Badge } from "@/components/shadcn/badge/badge";
+import { isCloud } from "@/lib/shared/env";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
interface AwsMethodSelectorProps {
onSelectSingle: () => void;
@@ -14,7 +17,10 @@ export function AwsMethodSelector({
onSelectSingle,
onSelectOrganizations,
}: AwsMethodSelectorProps) {
- const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const isCloudEnv = isCloud();
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
return (
<div className="flex flex-col gap-3">
@@ -29,12 +35,15 @@ export function AwsMethodSelector({
/>
<RadioCard
- icon={isCloudEnv ? Boxes : Ban}
+ icon={Boxes}
title="Add Multiple Accounts With AWS Organizations"
- onClick={onSelectOrganizations}
- disabled={!isCloudEnv}
+ onClick={() =>
+ isCloudEnv
+ ? onSelectOrganizations()
+ : openCloudUpgrade(CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS)
+ }
>
- {!isCloudEnv && <CloudFeatureBadgeLink />}
+ {!isCloudEnv && <Badge variant="cloud">Cloud</Badge>}
</RadioCard>
</div>
);
diff --git a/ui/components/providers/organizations/hooks/use-org-setup-submission.ts b/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
index b11903b48f..3d77ceff7a 100644
--- a/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
+++ b/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
@@ -11,7 +11,7 @@ import {
triggerDiscovery,
updateOrganizationSecret,
} from "@/actions/organizations/organizations";
-import { getSelectableAccountIds } from "@/actions/organizations/organizations.adapter";
+import { getSelectableAccountIdsForTarget } from "@/actions/organizations/organizations.adapter";
import { useOrgSetupStore } from "@/store/organizations/store";
import { DISCOVERY_STATUS, DiscoveryResult } from "@/types/organizations";
@@ -43,6 +43,9 @@ interface OrgSetupSubmissionData {
organizationName?: string;
awsOrgId: string;
roleArn: string;
+ // OU or root ID the StackSet was deployed to. Used to scope the default
+ // account selection to what was actually rolled out.
+ organizationalUnitId?: string;
}
interface UseOrgSetupSubmissionProps {
@@ -295,8 +298,15 @@ export function useOrgSetupSubmission({
return;
}
- const selectableAccountIds = getSelectableAccountIds(
+ // The deployment (management/delegated admin) account is where the local
+ // role is created; its ID is the one embedded in the Role ARN.
+ const deploymentAccountId = data.roleArn.match(
+ /^arn:aws:iam::(\d{12}):role\//,
+ )?.[1];
+ const selectableAccountIds = getSelectableAccountIdsForTarget(
resolvedDiscoveryResult,
+ data.organizationalUnitId ?? "",
+ deploymentAccountId,
);
setDiscovery(discoveryId, resolvedDiscoveryResult);
setSelectedAccountIds(selectableAccountIds);
diff --git a/ui/components/providers/organizations/org-launch-scan.test.tsx b/ui/components/providers/organizations/org-launch-scan.test.tsx
index f7f7fb11a3..d3c9b01a1e 100644
--- a/ui/components/providers/organizations/org-launch-scan.test.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.test.tsx
@@ -43,7 +43,8 @@ vi.mock("next/navigation", () => ({
}),
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
ToastAction: ({ children, ...props }: ComponentProps<"button">) => (
<button {...props}>{children}</button>
),
@@ -429,7 +430,7 @@ describe("OrgLaunchScan", () => {
});
// Then
- expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+ expect(screen.getByText(/exceeded the usage limit/i)).toBeInTheDocument();
expect(updateSchedulesBulkMock).not.toHaveBeenCalled();
expect(launchOrganizationScansMock).not.toHaveBeenCalled();
});
diff --git a/ui/components/providers/organizations/org-launch-scan.tsx b/ui/components/providers/organizations/org-launch-scan.tsx
index b8fde57c65..9339fb1a16 100644
--- a/ui/components/providers/organizations/org-launch-scan.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.tsx
@@ -14,6 +14,7 @@ import {
WizardFooterConfig,
} from "@/components/providers/wizard/steps/footer-controls";
import { ScanScheduleFields } from "@/components/scans/schedule/scan-schedule-fields";
+import { ToastAction, useToast } from "@/components/shadcn";
import {
Select,
SelectContent,
@@ -23,7 +24,7 @@ import {
} from "@/components/shadcn/select/select";
import { Spinner } from "@/components/shadcn/spinner/spinner";
import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
-import { ToastAction, useToast } from "@/components/ui";
+import { UsageLimitMessage } from "@/components/shared/usage-limit-message";
import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
import {
buildScheduleUpdatePayload,
@@ -362,10 +363,7 @@ export function OrgLaunchScan({
)}
{isBlocked ? (
- <p className="text-text-error-primary text-sm">
- You have reached your scan limit, so additional scans are not
- available right now.
- </p>
+ <UsageLimitMessage />
) : isAdvanced ? (
<ScanScheduleFields
form={form}
diff --git a/ui/components/providers/organizations/org-setup-form.test.tsx b/ui/components/providers/organizations/org-setup-form.test.tsx
new file mode 100644
index 0000000000..151abfec33
--- /dev/null
+++ b/ui/components/providers/organizations/org-setup-form.test.tsx
@@ -0,0 +1,121 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useOrgSetupStore } from "@/store/organizations/store";
+import { ORG_SETUP_PHASE } from "@/types/organizations";
+
+import { OrgSetupForm } from "./org-setup-form";
+
+const {
+ setApiErrorMock,
+ submitOrganizationSetupMock,
+ updateOrganizationNameMock,
+} = vi.hoisted(() => ({
+ setApiErrorMock: vi.fn(),
+ submitOrganizationSetupMock: vi.fn(),
+ updateOrganizationNameMock: vi.fn(),
+}));
+
+vi.mock("@/actions/organizations/organizations", () => ({
+ updateOrganizationName: updateOrganizationNameMock,
+}));
+
+vi.mock("@/lib", () => ({
+ getAWSOrgDeploymentQuickLink: ({
+ deployFromDelegatedAdmin,
+ }: {
+ deployFromDelegatedAdmin?: boolean;
+ }) => {
+ const params = new URLSearchParams();
+ if (deployFromDelegatedAdmin) {
+ params.set("param_DeployFromDelegatedAdmin", "true");
+ }
+ return `https://console.aws.amazon.com/#/quick-create?${params.toString()}`;
+ },
+}));
+
+vi.mock("next-auth/react", () => ({
+ useSession: () => ({
+ data: {
+ tenantId: "tenant&id",
+ },
+ }),
+}));
+
+vi.mock("./hooks/use-org-setup-submission", () => ({
+ useOrgSetupSubmission: () => ({
+ apiError: null,
+ setApiError: setApiErrorMock,
+ submitOrganizationSetup: submitOrganizationSetupMock,
+ }),
+}));
+
+function renderOrgSetupForm() {
+ return render(
+ <OrgSetupForm
+ onBack={vi.fn()}
+ onNext={vi.fn()}
+ onFooterChange={vi.fn()}
+ onPhaseChange={vi.fn()}
+ initialPhase={ORG_SETUP_PHASE.ACCESS}
+ />,
+ );
+}
+
+describe("OrgSetupForm", () => {
+ beforeEach(() => {
+ setApiErrorMock.mockReset();
+ submitOrganizationSetupMock.mockReset();
+ updateOrganizationNameMock.mockReset();
+ useOrgSetupStore.getState().reset();
+ });
+
+ it("should render a real disabled button until the deployment link is valid", () => {
+ // Given
+ renderOrgSetupForm();
+
+ // When
+ const deploymentLink = screen.queryByRole("link", {
+ name: /create stack in management account/i,
+ });
+ const deploymentButton = screen.getByRole("button", {
+ name: /create stack in management account/i,
+ });
+
+ // Then
+ expect(deploymentLink).not.toBeInTheDocument();
+ expect(deploymentButton).toBeDisabled();
+ });
+
+ it("should target the delegated administrator account when selected", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderOrgSetupForm();
+
+ // When
+ await user.type(
+ screen.getByLabelText("Organizational Unit or Root ID"),
+ "r-abcd",
+ );
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: /deploying from a delegated administrator account/i,
+ }),
+ );
+
+ // Then
+ const deploymentLink = await screen.findByRole("link", {
+ name: /create stack in delegated administrator account/i,
+ });
+ const hashQuery = new URL(
+ deploymentLink.getAttribute("href") ?? "",
+ ).hash.split("?")[1];
+ const params = new URLSearchParams(hashQuery);
+
+ expect(params.get("param_DeployFromDelegatedAdmin")).toBe("true");
+ expect(
+ screen.getByLabelText("Delegated Administrator Account IAM Role ARN"),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/components/providers/organizations/org-setup-form.tsx b/ui/components/providers/organizations/org-setup-form.tsx
index fe6d086d9f..8b2870e998 100644
--- a/ui/components/providers/organizations/org-setup-form.tsx
+++ b/ui/components/providers/organizations/org-setup-form.tsx
@@ -1,37 +1,30 @@
"use client";
-import { useClipboard } from "@heroui/use-clipboard";
import { zodResolver } from "@hookform/resolvers/zod";
import { Check, Copy, ExternalLink } from "lucide-react";
import { useSession } from "next-auth/react";
-import { FormEvent, useEffect, useState } from "react";
+import type { FormEvent } from "react";
+import { useEffect, useRef, useState } from "react";
import { Controller, useForm } from "react-hook-form";
import { z } from "zod";
import { updateOrganizationName } from "@/actions/organizations/organizations";
import { AWSProviderBadge } from "@/components/icons/providers-badge";
-import {
- WIZARD_FOOTER_ACTION_TYPE,
- WizardFooterConfig,
-} from "@/components/providers/wizard/steps/footer-controls";
-import {
- ORG_WIZARD_INTENT,
- OrgWizardIntent,
-} from "@/components/providers/wizard/types";
+import type { WizardFooterConfig } from "@/components/providers/wizard/steps/footer-controls";
+import { WIZARD_FOOTER_ACTION_TYPE } from "@/components/providers/wizard/steps/footer-controls";
+import type { OrgWizardIntent } from "@/components/providers/wizard/types";
+import { ORG_WIZARD_INTENT } from "@/components/providers/wizard/types";
import { WizardInputField } from "@/components/providers/workflow/forms/fields";
+import { useToast } from "@/components/shadcn";
import { Alert, AlertDescription } from "@/components/shadcn/alert";
import { Button } from "@/components/shadcn/button/button";
import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
+import { Form } from "@/components/shadcn/form";
import { Spinner } from "@/components/shadcn/spinner/spinner";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
-import {
- getAWSCredentialsTemplateLinks,
- PROWLER_CF_TEMPLATE_URL,
- STACKSET_CONSOLE_URL,
-} from "@/lib";
+import { getAWSOrgDeploymentQuickLink } from "@/lib";
import { useOrgSetupStore } from "@/store/organizations/store";
-import { ORG_SETUP_PHASE, OrgSetupPhase } from "@/types/organizations";
+import type { OrgSetupPhase } from "@/types/organizations";
+import { ORG_SETUP_PHASE } from "@/types/organizations";
import { useOrgSetupSubmission } from "./hooks/use-org-setup-submission";
@@ -48,13 +41,19 @@ const orgSetupSchema = z.object({
roleArn: z
.string()
.trim()
- .min(1, "Role ARN is required")
+ .min(1, "IAM Role ARN is required")
.regex(
/^arn:aws:iam::\d{12}:role\//,
"Must be a valid IAM Role ARN (e.g., arn:aws:iam::123456789012:role/ProwlerScan)",
),
+ // OU or root id the StackSet deploys to. UI-only: used to build the
+ // CloudFormation quick-create link, not sent to the backend. Its format is
+ // validated inline (isOrgUnitIdValid) to gate the deployment button, so a
+ // malformed value never blocks the Authenticate submit.
+ organizationalUnitId: z.string().trim().optional(),
+ deployFromDelegatedAdmin: z.boolean().optional(),
stackSetDeployed: z.boolean().refine((value) => value, {
- message: "You must confirm the StackSet deployment before continuing.",
+ error: "You must confirm the deployment before continuing.",
}),
});
@@ -90,12 +89,25 @@ export function OrgSetupForm({
const stackSetExternalId = session?.tenantId ?? "";
const { organizationId } = useOrgSetupStore();
const { toast } = useToast();
- const { copied: isExternalIdCopied, copy: copyExternalId } = useClipboard({
- timeout: 1500,
- });
- const { copied: isTemplateUrlCopied, copy: copyTemplateUrl } = useClipboard({
- timeout: 1500,
- });
+ const COPY_RESET_TIMEOUT = 1500;
+ const [isExternalIdCopied, setIsExternalIdCopied] = useState(false);
+ const externalIdCopyTimer = useRef<ReturnType<typeof setTimeout>>(undefined);
+
+ // Copies text and flips the copied flag back after the timeout, without effects
+ const copyWithFeedback = (
+ text: string,
+ setCopied: (copied: boolean) => void,
+ timerRef: { current: ReturnType<typeof setTimeout> | undefined },
+ ) => {
+ navigator.clipboard.writeText(text).then(() => {
+ setCopied(true);
+ clearTimeout(timerRef.current);
+ timerRef.current = setTimeout(() => setCopied(false), COPY_RESET_TIMEOUT);
+ });
+ };
+
+ const copyExternalId = (text: string) =>
+ copyWithFeedback(text, setIsExternalIdCopied, externalIdCopyTimer);
const [setupPhase, setSetupPhase] = useState<OrgSetupPhase>(initialPhase);
const [isSaving, setIsSaving] = useState(false);
const formId = "org-wizard-setup-form";
@@ -110,6 +122,8 @@ export function OrgSetupForm({
organizationName: initialValues?.organizationName ?? "",
awsOrgId: initialValues?.awsOrgId ?? "",
roleArn: "",
+ organizationalUnitId: "",
+ deployFromDelegatedAdmin: false,
stackSetDeployed: false,
},
});
@@ -123,10 +137,27 @@ export function OrgSetupForm({
const awsOrgId = watch("awsOrgId") || "";
const isOrgIdValid = /^o-[a-z0-9]{10,32}$/.test(awsOrgId.trim());
- const templateLinks = stackSetExternalId
- ? getAWSCredentialsTemplateLinks(stackSetExternalId)
- : null;
- const orgQuickLink = templateLinks?.cloudformationOrgQuickLink;
+
+ const organizationalUnitId = watch("organizationalUnitId") || "";
+ const deployFromDelegatedAdmin = watch("deployFromDelegatedAdmin") || false;
+ const deploymentAccountName = deployFromDelegatedAdmin
+ ? "delegated administrator account"
+ : "management account";
+ const deploymentAccountLabel = deployFromDelegatedAdmin
+ ? "Delegated Administrator Account"
+ : "Management Account";
+ const isOrgUnitIdValid =
+ /^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})$/.test(
+ organizationalUnitId.trim(),
+ );
+ const orgQuickLink =
+ stackSetExternalId && isOrgUnitIdValid
+ ? getAWSOrgDeploymentQuickLink({
+ externalId: stackSetExternalId,
+ organizationalUnitId: organizationalUnitId.trim(),
+ deployFromDelegatedAdmin,
+ })
+ : null;
const { apiError, setApiError, submitOrganizationSetup } =
useOrgSetupSubmission({
@@ -365,91 +396,115 @@ export function OrgSetupForm({
</div>
</div>
- {/* Step 1: Management account - CloudFormation Stack */}
+ {/* Step 1: Choose the deployment target */}
<div className="flex flex-col gap-4">
<p className="text-text-neutral-primary text-sm leading-7 font-normal">
- 1) Deploy the ProwlerScan role in your{" "}
- <strong>management account</strong> using a CloudFormation
- Stack.
+ 1) Choose the AWS <strong>Organizational Unit</strong> (or root)
+ to deploy to. Prowler creates the IAM Role in your deployment
+ account and rolls it out to every member account under this
+ target.
</p>
- <Button
- variant="outline"
- size="lg"
- className="border-border-input-primary bg-bg-input-primary text-button-tertiary hover:bg-bg-input-primary active:bg-bg-input-primary h-12 w-full justify-start"
- disabled={!orgQuickLink}
- asChild
- >
- <a
- href={orgQuickLink || "#"}
- target="_blank"
- rel="noopener noreferrer"
- >
- <ExternalLink className="size-5" />
- <span>Create Stack in Management Account</span>
- </a>
- </Button>
+ <WizardInputField
+ control={control}
+ name="organizationalUnitId"
+ label="Organizational Unit or Root ID"
+ labelPlacement="outside"
+ placeholder="e.g. r-abcd or ou-abcd-1a2b3c4d"
+ isRequired={false}
+ normalizeValue={(value) => value.toLowerCase()}
+ autoCapitalize="none"
+ autoCorrect="off"
+ spellCheck={false}
+ />
+ <p className="text-text-neutral-tertiary text-xs leading-5">
+ Find this in the AWS Organizations console. Use your{" "}
+ <strong>root ID</strong> (starts with <code>r-</code>) to deploy
+ to the whole organization, or an <strong>OU ID</strong> (starts
+ with <code>ou-</code>) to target a specific unit.
+ </p>
+ <div className="flex items-center gap-3">
+ <Controller
+ name="deployFromDelegatedAdmin"
+ control={control}
+ render={({ field }) => (
+ <>
+ <Checkbox
+ id="deployFromDelegatedAdmin"
+ size="sm"
+ checked={field.value}
+ onCheckedChange={(checked) =>
+ field.onChange(Boolean(checked))
+ }
+ />
+ <label
+ htmlFor="deployFromDelegatedAdmin"
+ className="text-text-neutral-secondary text-sm leading-5 font-medium"
+ >
+ I'm deploying from a Delegated Administrator
+ Account (not the Management Account)
+ </label>
+ </>
+ )}
+ />
+ </div>
</div>
- {/* Step 2: Member accounts - CloudFormation StackSet */}
+ {/* Step 2: Single CloudFormation Stack (role + StackSet) */}
<div className="flex flex-col gap-4">
<p className="text-text-neutral-primary text-sm leading-7 font-normal">
- 2) Deploy the ProwlerScan role to{" "}
- <strong>member accounts</strong> using a CloudFormation
- StackSet.
+ 2) Create the CloudFormation Stack in your{" "}
+ <strong>{deploymentAccountName}</strong>. It deploys the
+ ProwlerScan IAM Role and a service-managed StackSet that rolls
+ the IAM Role out to your member accounts in one step.
</p>
- <p className="text-text-neutral-tertiary text-xs leading-5">
- Open the StackSets console, select{" "}
- <strong>Service-managed permissions</strong>, and paste the
- template URL below. Set the <strong>ExternalId</strong>{" "}
- parameter to the value shown above.
- </p>
- <div className="bg-bg-neutral-tertiary border-border-input-primary flex items-center gap-3 rounded-lg border px-4 py-2.5">
- <span className="text-text-neutral-primary min-w-0 flex-1 truncate font-mono text-xs">
- {PROWLER_CF_TEMPLATE_URL}
- </span>
- <button
- type="button"
- onClick={() => copyTemplateUrl(PROWLER_CF_TEMPLATE_URL)}
- className="text-text-neutral-secondary hover:text-text-neutral-primary shrink-0 transition-colors"
- aria-label="Copy template URL"
+ {orgQuickLink ? (
+ <Button
+ variant="default"
+ size="xl"
+ className="w-full justify-start"
+ asChild
>
- {isTemplateUrlCopied ? (
- <Check className="size-4" />
- ) : (
- <Copy className="size-4" />
- )}
- </button>
- </div>
- <Button
- variant="outline"
- size="lg"
- className="border-border-input-primary bg-bg-input-primary text-button-tertiary hover:bg-bg-input-primary active:bg-bg-input-primary h-12 w-full justify-start"
- disabled={!isExternalIdCopied}
- asChild
- >
- <a
- href={STACKSET_CONSOLE_URL}
- target="_blank"
- rel="noopener noreferrer"
+ <a
+ href={orgQuickLink}
+ target="_blank"
+ rel="noopener noreferrer"
+ >
+ <ExternalLink className="size-5" />
+ <span>{`Create Stack in ${deploymentAccountLabel}`}</span>
+ </a>
+ </Button>
+ ) : (
+ <Button
+ type="button"
+ variant="default"
+ size="xl"
+ className="w-full justify-start"
+ disabled
>
<ExternalLink className="size-5" />
- <span>Open StackSets Console</span>
- </a>
- </Button>
+ <span>{`Create Stack in ${deploymentAccountLabel}`}</span>
+ </Button>
+ )}
+ {!isOrgUnitIdValid && (
+ <p className="text-text-neutral-tertiary text-xs leading-5">
+ Enter a valid Organizational Unit or Root ID above to enable
+ deployment.
+ </p>
+ )}
</div>
{/* Step 3: Role ARN + confirm */}
<div className="flex flex-col gap-4">
<p className="text-text-neutral-primary text-sm leading-7 font-normal">
- 3) Paste the management account Role ARN and confirm both
- deployments are complete.
+ 3) Paste the {deploymentAccountName} IAM Role ARN and confirm
+ the deployment is complete.
</p>
</div>
<WizardInputField
control={control}
name="roleArn"
- label="Management Account Role ARN"
+ label={`${deploymentAccountLabel} IAM Role ARN`}
labelPlacement="outside"
placeholder="e.g. arn:aws:iam::123456789012:role/ProwlerScan"
isRequired={false}
@@ -461,7 +516,7 @@ export function OrgSetupForm({
ARN
</p>
- <div className="flex items-start gap-4">
+ <div className="flex items-center gap-3">
<Controller
name="stackSetDeployed"
control={control}
@@ -469,7 +524,7 @@ export function OrgSetupForm({
<>
<Checkbox
id="stackSetDeployed"
- className="mt-0.5"
+ size="sm"
checked={field.value}
onCheckedChange={(checked) =>
field.onChange(Boolean(checked))
@@ -479,8 +534,7 @@ export function OrgSetupForm({
htmlFor="stackSetDeployed"
className="text-text-neutral-tertiary text-xs leading-5 font-normal"
>
- The Stack and StackSet have been successfully deployed in
- AWS
+ The Stack has been successfully deployed in AWS
<span className="text-text-error-primary">*</span>
</label>
</>
diff --git a/ui/components/providers/providers-accounts-table.test.tsx b/ui/components/providers/providers-accounts-table.test.tsx
index 4fe66a6bd7..06f242a5e3 100644
--- a/ui/components/providers/providers-accounts-table.test.tsx
+++ b/ui/components/providers/providers-accounts-table.test.tsx
@@ -8,6 +8,10 @@ import {
PROVIDERS_ROW_TYPE,
type ProvidersTableRow,
} from "@/types/providers-table";
+import {
+ SCAN_CONFIGURATION_LIST_STATUS,
+ type ScanConfigurationData,
+} from "@/types/scan-configurations";
import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
const { dataTableMockState, getColumnProvidersMock } = vi.hoisted(() => ({
@@ -17,7 +21,7 @@ const { dataTableMockState, getColumnProvidersMock } = vi.hoisted(() => ({
getColumnProvidersMock: vi.fn((..._args: unknown[]) => []),
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTable: ({
onRowSelectionChange,
}: {
@@ -40,6 +44,7 @@ vi.mock("./table", () => ({
import {
computeSelectedScheduleProviders,
+ createScanConfigIdByProviderId,
ProvidersAccountsTable,
} from "./providers-accounts-table";
@@ -59,6 +64,7 @@ const createProviderRow = (
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid,
alias,
status: "completed",
@@ -90,6 +96,17 @@ const createProviderRow = (
const providerOne = createProviderRow("provider-1", "111111111111", "Prod");
const providerTwo = createProviderRow("provider-2", "222222222222", "Stage");
const providerThree = createProviderRow("provider-3", "333333333333", "Dev");
+const scanConfig: ScanConfigurationData = {
+ type: "scan-configurations",
+ id: "config-1",
+ attributes: {
+ inserted_at: "2026-01-01T00:00:00Z",
+ updated_at: "2026-01-01T00:00:00Z",
+ name: "Strict AWS",
+ configuration: {},
+ providers: ["provider-1"],
+ },
+};
const organizationRow: ProvidersTableRow = {
id: "org-1",
@@ -147,9 +164,44 @@ describe("ProvidersAccountsTable", () => {
expect.any(Function),
expect.any(Function),
SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+ [],
+ SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ expect.any(Map),
);
});
+ it("passes populated scan configs to provider row action columns", () => {
+ // Given/When
+ render(
+ <ProvidersAccountsTable
+ isCloud
+ metadata={metadata}
+ rows={[]}
+ scanConfigs={[scanConfig]}
+ scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+ onOpenProviderWizard={vi.fn()}
+ onOpenOrganizationWizard={vi.fn()}
+ />,
+ );
+
+ // Then
+ const call = getColumnProvidersMock.mock.calls.at(-1);
+ expect(call?.[8]).toEqual([scanConfig]);
+ expect(call?.[9]).toBe(SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE);
+ expect(call?.[10]).toBeInstanceOf(Map);
+ expect((call?.[10] as Map<string, string>).get("provider-1")).toBe(
+ "config-1",
+ );
+ });
+
+ it("precomputes scan config ids by provider id once for row actions", () => {
+ // Given/When
+ const lookup = createScanConfigIdByProviderId([scanConfig]);
+
+ // Then
+ expect(lookup.get("provider-1")).toBe("config-1");
+ });
+
describe("schedule provider selection", () => {
it("uses the selected provider id for provider rows", () => {
// Given
@@ -268,6 +320,9 @@ describe("ProvidersAccountsTable", () => {
expect.any(Function),
expect.any(Function),
SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+ [],
+ SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ expect.any(Map),
);
});
@@ -301,6 +356,9 @@ describe("ProvidersAccountsTable", () => {
expect.any(Function),
expect.any(Function),
SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+ [],
+ SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ expect.any(Map),
);
});
});
diff --git a/ui/components/providers/providers-accounts-table.tsx b/ui/components/providers/providers-accounts-table.tsx
index 0f51e4dc66..256b6f5c50 100644
--- a/ui/components/providers/providers-accounts-table.tsx
+++ b/ui/components/providers/providers-accounts-table.tsx
@@ -7,13 +7,18 @@ import type {
OrgWizardInitialData,
ProviderWizardInitialData,
} from "@/components/providers/wizard/types";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import { MetaDataProps } from "@/types";
import {
isProvidersOrganizationRow,
isProvidersProviderRow,
ProvidersTableRow,
} from "@/types/providers-table";
+import {
+ SCAN_CONFIGURATION_LIST_STATUS,
+ ScanConfigurationData,
+ type ScanConfigurationListStatus,
+} from "@/types/scan-configurations";
import type {
ScanScheduleCapability,
ScanScheduleProvider,
@@ -26,6 +31,10 @@ interface ProvidersAccountsTableProps {
metadata?: MetaDataProps;
rows: ProvidersTableRow[];
scanScheduleCapability?: ScanScheduleCapability;
+ /** All scan configurations in the tenant, for the provider row's associate/
+ * disassociate action (Cloud-only). */
+ scanConfigs?: ScanConfigurationData[];
+ scanConfigStatus?: ScanConfigurationListStatus;
onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
}
@@ -154,11 +163,27 @@ export function computeSelectedScheduleProviders(
return { providerIds, providers };
}
+export function createScanConfigIdByProviderId(
+ scanConfigs: ScanConfigurationData[],
+): Map<string, string> {
+ const lookup = new Map<string, string>();
+
+ for (const config of scanConfigs) {
+ for (const providerId of config.attributes.providers) {
+ lookup.set(providerId, config.id);
+ }
+ }
+
+ return lookup;
+}
+
function ProvidersAccountsTableContent({
isCloud,
metadata,
rows,
scanScheduleCapability,
+ scanConfigs,
+ scanConfigStatus = SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
onOpenProviderWizard,
onOpenOrganizationWizard,
}: ProvidersAccountsTableProps) {
@@ -170,6 +195,9 @@ function ProvidersAccountsTableContent({
rowSelection,
);
const selectedScheduleProviderIds = selectedScheduleProviders.providerIds;
+ const scanConfigIdByProviderId = createScanConfigIdByProviderId(
+ scanConfigs ?? [],
+ );
const clearSelection = () => setRowSelection({});
@@ -182,6 +210,9 @@ function ProvidersAccountsTableContent({
onOpenProviderWizard,
onOpenOrganizationWizard,
scanScheduleCapability,
+ scanConfigs ?? [],
+ scanConfigStatus,
+ scanConfigIdByProviderId,
);
return (
diff --git a/ui/components/providers/providers-accounts-view.test.tsx b/ui/components/providers/providers-accounts-view.test.tsx
index f888f7f4d8..da2d3c10ef 100644
--- a/ui/components/providers/providers-accounts-view.test.tsx
+++ b/ui/components/providers/providers-accounts-view.test.tsx
@@ -96,6 +96,7 @@ const disconnectedProviders: ProviderProps[] = [
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: "123456789012",
alias: "Production",
status: "completed",
diff --git a/ui/components/providers/providers-accounts-view.tsx b/ui/components/providers/providers-accounts-view.tsx
index 8a5d8f93fc..6d060b190f 100644
--- a/ui/components/providers/providers-accounts-view.tsx
+++ b/ui/components/providers/providers-accounts-view.tsx
@@ -28,7 +28,12 @@ import {
getTourTargetSelector,
} from "@/lib/tours/use-driver-tour";
import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
+import type { ProviderGroup } from "@/types/components";
import type { ProvidersTableRow } from "@/types/providers-table";
+import type {
+ ScanConfigurationData,
+ ScanConfigurationListStatus,
+} from "@/types/scan-configurations";
import type { ScanScheduleCapability } from "@/types/schedules";
const addProviderFlow = getFlowById("add-provider")!;
@@ -51,9 +56,14 @@ interface ProvidersAccountsViewProps {
filters: FilterOption[];
metadata?: MetaDataProps;
providers: ProviderProps[];
+ providerGroups?: ProviderGroup[];
rows: ProvidersTableRow[];
/** Cloud overlay seam for provider-creation scan launch. */
scanScheduleCapability?: ScanScheduleCapability;
+ /** All scan configurations in the tenant, for the provider row's associate/
+ * disassociate action (Cloud-only). */
+ scanConfigs?: ScanConfigurationData[];
+ scanConfigStatus?: ScanConfigurationListStatus;
isScanLimitReached?: boolean;
}
@@ -62,8 +72,11 @@ export function ProvidersAccountsView({
filters,
metadata,
providers,
+ providerGroups = [],
rows,
scanScheduleCapability,
+ scanConfigs,
+ scanConfigStatus,
isScanLimitReached,
}: ProvidersAccountsViewProps) {
const pathname = usePathname();
@@ -141,6 +154,7 @@ export function ProvidersAccountsView({
<ProvidersFilters
filters={filters}
providers={providers}
+ providerGroups={providerGroups}
actions={
<>
<MutedFindingsConfigButton />
@@ -153,6 +167,8 @@ export function ProvidersAccountsView({
metadata={metadata}
rows={rows}
scanScheduleCapability={scanScheduleCapability}
+ scanConfigs={scanConfigs}
+ scanConfigStatus={scanConfigStatus}
onOpenProviderWizard={openProviderWizard}
onOpenOrganizationWizard={openOrganizationWizard}
/>
diff --git a/ui/components/providers/providers-filters.test.tsx b/ui/components/providers/providers-filters.test.tsx
index b6e6655247..667039aa10 100644
--- a/ui/components/providers/providers-filters.test.tsx
+++ b/ui/components/providers/providers-filters.test.tsx
@@ -16,11 +16,15 @@ vi.mock("@/app/(prowler)/_overview/_components/provider-type-selector", () => ({
ProviderTypeSelector: () => <div>Provider type selector</div>,
}));
+vi.mock("@/components/filters/provider-group-selector", () => ({
+ ProviderGroupSelector: () => <div>Provider group selector</div>,
+}));
+
vi.mock("@/components/filters/clear-filters-button", () => ({
ClearFiltersButton: () => <button type="button">Clear</button>,
}));
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: () => null,
}));
diff --git a/ui/components/providers/providers-filters.tsx b/ui/components/providers/providers-filters.tsx
index 285bae4c1e..29f3607665 100644
--- a/ui/components/providers/providers-filters.tsx
+++ b/ui/components/providers/providers-filters.tsx
@@ -5,6 +5,8 @@ import type { ReactNode } from "react";
import { ProviderTypeSelector } from "@/app/(prowler)/_overview/_components/provider-type-selector";
import { ClearFiltersButton } from "@/components/filters/clear-filters-button";
+import { ProviderGroupSelector } from "@/components/filters/provider-group-selector";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import {
MultiSelect,
MultiSelectContent,
@@ -14,10 +16,10 @@ import {
MultiSelectTrigger,
MultiSelectValue,
} from "@/components/shadcn/select/multiselect";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
import { useUrlFilters } from "@/hooks/use-url-filters";
import { isConnectionStatus, isGroupFilterEntity } from "@/lib/helper-filters";
import { FilterEntity, FilterOption, ProviderEntity } from "@/types";
+import { ProviderGroup } from "@/types/components";
import {
GroupFilterEntity,
ProviderConnectionStatus,
@@ -31,12 +33,14 @@ function isNonEmptyString(value: string | null | undefined): value is string {
interface ProvidersFiltersProps {
filters: FilterOption[];
providers: ProviderProps[];
+ providerGroups?: ProviderGroup[];
actions?: ReactNode;
}
export const ProvidersFilters = ({
filters,
providers,
+ providerGroups = [],
actions,
}: ProvidersFiltersProps) => {
const { updateFilter } = useUrlFilters();
@@ -153,6 +157,9 @@ export const ProvidersFilters = ({
<div className="min-w-[200px] flex-1 md:max-w-[280px]">
<ProviderTypeSelector providers={providers} />
</div>
+ <div className="max-w-[240px] min-w-[180px] flex-1">
+ <ProviderGroupSelector groups={providerGroups} />
+ </div>
{sortedFilters.map((filter) => {
const selectedValues = getSelectedValues(filter);
return (
diff --git a/ui/components/providers/radio-card.tsx b/ui/components/providers/radio-card.tsx
index f4b5e13aca..2a15fa6b19 100644
--- a/ui/components/providers/radio-card.tsx
+++ b/ui/components/providers/radio-card.tsx
@@ -30,15 +30,15 @@ export function RadioCard({
disabled
? "border-border-neutral-primary bg-bg-neutral-tertiary cursor-not-allowed"
: selected
- ? "border-primary bg-bg-neutral-tertiary cursor-pointer"
- : "hover:border-primary border-border-neutral-primary bg-bg-neutral-tertiary cursor-pointer",
+ ? "border-button-primary bg-bg-neutral-tertiary cursor-pointer"
+ : "hover:border-button-primary border-border-neutral-primary bg-bg-neutral-tertiary cursor-pointer",
)}
>
<div
className={cn(
"size-[18px] shrink-0 rounded-full border shadow-xs",
selected
- ? "border-primary bg-primary"
+ ? "border-button-primary bg-button-primary"
: "border-border-neutral-primary bg-bg-input-primary",
)}
/>
@@ -53,7 +53,9 @@ export function RadioCard({
<span
className={cn(
"truncate text-sm leading-6",
- disabled ? "text-text-neutral-tertiary" : "text-foreground",
+ disabled
+ ? "text-text-neutral-tertiary"
+ : "text-text-neutral-primary",
)}
>
{title}
diff --git a/ui/components/providers/radio-group-provider.tsx b/ui/components/providers/radio-group-provider.tsx
index 6c9930fd83..de8d941f3a 100644
--- a/ui/components/providers/radio-group-provider.tsx
+++ b/ui/components/providers/radio-group-provider.tsx
@@ -5,6 +5,7 @@ import { Control, Controller } from "react-hook-form";
import { z } from "zod";
import { SearchInput } from "@/components/shadcn";
+import { FormMessage } from "@/components/shadcn/form";
import { cn } from "@/lib/utils";
import { addProviderFormSchema } from "@/types";
@@ -26,7 +27,6 @@ import {
OracleCloudProviderBadge,
VercelProviderBadge,
} from "../icons/providers-badge";
-import { FormMessage } from "../ui/form";
const PROVIDERS = [
{
@@ -169,22 +169,22 @@ export const RadioGroupProvider: FC<RadioGroupProviderProps> = ({
onClick={() => field.onChange(provider.value)}
className={cn(
"flex min-h-[72px] w-full items-center gap-4 rounded-lg border px-3 py-2.5 text-left transition-colors",
- "focus-visible:border-primary focus-visible:outline-none",
+ "focus-visible:border-button-primary focus-visible:outline-none",
isSelected
- ? "border-primary bg-bg-neutral-tertiary"
- : "border-border-neutral-primary bg-bg-neutral-tertiary hover:border-primary",
+ ? "border-button-primary bg-bg-neutral-tertiary"
+ : "border-border-neutral-primary bg-bg-neutral-tertiary hover:border-button-primary",
isInvalid && "border-bg-fail",
)}
>
<div className="border-border-neutral-primary bg-bg-input-primary flex size-[18px] shrink-0 items-center justify-center rounded-full border shadow-xs">
{isSelected && (
- <div className="bg-primary size-2.5 rounded-full" />
+ <div className="bg-button-primary size-2.5 rounded-full" />
)}
</div>
<div className="flex min-w-0 flex-1 items-center gap-1.5">
<BadgeComponent size={26} />
- <span className="text-foreground text-sm leading-6">
+ <span className="text-text-neutral-primary text-sm leading-6">
{provider.label}
</span>
</div>
diff --git a/ui/components/providers/scan-config/manage-scan-config-modal.test.tsx b/ui/components/providers/scan-config/manage-scan-config-modal.test.tsx
new file mode 100644
index 0000000000..1c93a65e49
--- /dev/null
+++ b/ui/components/providers/scan-config/manage-scan-config-modal.test.tsx
@@ -0,0 +1,258 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { ScanConfigurationData } from "@/types/scan-configurations";
+
+import { ManageScanConfigModal } from "./manage-scan-config-modal";
+
+const { setScanConfigurationProvidersMock, toastMock } = vi.hoisted(() => ({
+ setScanConfigurationProvidersMock: vi.fn(),
+ toastMock: vi.fn(),
+}));
+
+vi.mock("@/actions/scan-configurations", () => ({
+ setScanConfigurationProviders: setScanConfigurationProvidersMock,
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: toastMock }),
+}));
+
+vi.mock("@/components/shadcn/custom/custom-link", () => ({
+ CustomLink: ({ children }: { children: React.ReactNode }) => (
+ <span>{children}</span>
+ ),
+}));
+
+// Radix Select relies on pointer-capture and scrollIntoView, which jsdom does
+// not implement. Polyfill them so the dropdown can open in tests.
+beforeAll(() => {
+ Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+ configurable: true,
+ value: vi.fn(() => false),
+ });
+ Object.defineProperty(HTMLElement.prototype, "setPointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+ configurable: true,
+ value: vi.fn(),
+ });
+ Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+ configurable: true,
+ value: vi.fn(),
+ });
+});
+
+const makeConfig = (
+ id: string,
+ name: string,
+ providers: string[],
+): ScanConfigurationData => ({
+ type: "scan-configurations",
+ id,
+ attributes: {
+ inserted_at: "2025-01-01T00:00:00Z",
+ updated_at: "2025-01-01T00:00:00Z",
+ name,
+ configuration: {},
+ providers,
+ },
+});
+
+const renderModal = (
+ overrides: Partial<React.ComponentProps<typeof ManageScanConfigModal>> = {},
+) => {
+ const onOpenChange = vi.fn();
+ const onSaved = vi.fn();
+ const props: React.ComponentProps<typeof ManageScanConfigModal> = {
+ open: true,
+ onOpenChange,
+ providerId: "provider-1",
+ providerLabel: "AWS App Account",
+ scanConfigs: [
+ makeConfig("config-a", "Config A", []),
+ makeConfig("config-b", "Config B", []),
+ ],
+ currentConfigId: null,
+ onSaved,
+ ...overrides,
+ };
+
+ render(<ManageScanConfigModal {...props} />);
+ return { onOpenChange, onSaved, props };
+};
+
+const openSelectAndChoose = async (
+ user: ReturnType<typeof userEvent.setup>,
+ optionName: RegExp,
+) => {
+ await user.click(
+ screen.getByRole("combobox", { name: /scan configuration/i }),
+ );
+ await user.click(await screen.findByRole("option", { name: optionName }));
+};
+
+const clickSave = (user: ReturnType<typeof userEvent.setup>) =>
+ user.click(screen.getByRole("button", { name: /^save$/i }));
+
+describe("ManageScanConfigModal", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ setScanConfigurationProvidersMock.mockResolvedValue({
+ success: "Scan Configuration updated successfully!",
+ });
+ });
+
+ it("has an accessible label on the configuration select", () => {
+ renderModal();
+
+ expect(
+ screen.getByRole("combobox", { name: /scan configuration/i }),
+ ).toBeInTheDocument();
+ });
+
+ it("attaches the provider to the chosen configuration", async () => {
+ // Given an unattached provider.
+ const user = userEvent.setup();
+ const { onOpenChange, onSaved } = renderModal({ currentConfigId: null });
+
+ // When the user picks "Config A" and saves.
+ await openSelectAndChoose(user, /^config a$/i);
+ await clickSave(user);
+
+ // Then the provider is added to that config's provider list.
+ await waitFor(() =>
+ expect(setScanConfigurationProvidersMock).toHaveBeenCalledWith(
+ "config-a",
+ ["provider-1"],
+ ),
+ );
+ expect(onSaved).toHaveBeenCalledTimes(1);
+ expect(onOpenChange).toHaveBeenCalledWith(false);
+ });
+
+ it("detaches the provider when Default is selected", async () => {
+ // Given a provider currently attached to Config A (alongside another).
+ const user = userEvent.setup();
+ const { onOpenChange, onSaved } = renderModal({
+ currentConfigId: "config-a",
+ scanConfigs: [
+ makeConfig("config-a", "Config A", ["provider-1", "provider-2"]),
+ makeConfig("config-b", "Config B", []),
+ ],
+ });
+
+ // When the user switches back to Default and saves.
+ await openSelectAndChoose(user, /^default$/i);
+ await clickSave(user);
+
+ // Then only this provider is dropped — the rest stay attached.
+ await waitFor(() =>
+ expect(setScanConfigurationProvidersMock).toHaveBeenCalledWith(
+ "config-a",
+ ["provider-2"],
+ ),
+ );
+ expect(onSaved).toHaveBeenCalledTimes(1);
+ expect(onOpenChange).toHaveBeenCalledWith(false);
+ });
+
+ it("moves the provider to another configuration", async () => {
+ // Given a provider attached to Config A.
+ const user = userEvent.setup();
+ renderModal({
+ currentConfigId: "config-a",
+ scanConfigs: [
+ makeConfig("config-a", "Config A", ["provider-1"]),
+ makeConfig("config-b", "Config B", []),
+ ],
+ });
+
+ // When the user picks Config B and saves.
+ await openSelectAndChoose(user, /^config b$/i);
+ await clickSave(user);
+
+ // Then the provider is attached to Config B (the backend detaches it from A).
+ await waitFor(() =>
+ expect(setScanConfigurationProvidersMock).toHaveBeenCalledWith(
+ "config-b",
+ ["provider-1"],
+ ),
+ );
+ });
+
+ it("does not call the action when the selection is unchanged", async () => {
+ // Given a provider already attached to Config A.
+ const user = userEvent.setup();
+ const { onOpenChange } = renderModal({
+ currentConfigId: "config-a",
+ scanConfigs: [makeConfig("config-a", "Config A", ["provider-1"])],
+ });
+
+ // When the user saves without changing the selection.
+ await clickSave(user);
+
+ // Then no request is sent, and the modal just closes.
+ expect(setScanConfigurationProvidersMock).not.toHaveBeenCalled();
+ expect(onOpenChange).toHaveBeenCalledWith(false);
+ });
+
+ it("surfaces a destructive toast and keeps the modal open on failure", async () => {
+ // Given the action returns a field error.
+ const user = userEvent.setup();
+ setScanConfigurationProvidersMock.mockResolvedValue({
+ errors: { general: "Boom" },
+ });
+ const { onOpenChange, onSaved } = renderModal({ currentConfigId: null });
+
+ // When the user attaches and saves.
+ await openSelectAndChoose(user, /^config a$/i);
+ await clickSave(user);
+
+ // Then the error is toasted and the modal stays open for a retry.
+ await waitFor(() =>
+ expect(toastMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ variant: "destructive",
+ description: "Boom",
+ }),
+ ),
+ );
+ expect(onSaved).not.toHaveBeenCalled();
+ expect(onOpenChange).not.toHaveBeenCalled();
+ });
+
+ it("resets a cancelled selection when the modal is reopened", async () => {
+ // Given a provider with no attached config.
+ const user = userEvent.setup();
+ const baseProps: React.ComponentProps<typeof ManageScanConfigModal> = {
+ open: true,
+ onOpenChange: vi.fn(),
+ providerId: "provider-1",
+ providerLabel: "AWS App Account",
+ scanConfigs: [
+ makeConfig("config-a", "Config A", []),
+ makeConfig("config-b", "Config B", []),
+ ],
+ currentConfigId: null,
+ onSaved: vi.fn(),
+ };
+ const { rerender } = render(<ManageScanConfigModal {...baseProps} />);
+
+ // When the user picks Config A but closes the modal without saving.
+ await openSelectAndChoose(user, /^config a$/i);
+ rerender(<ManageScanConfigModal {...baseProps} open={false} />);
+
+ // And reopens it for the same (still unattached) provider.
+ rerender(<ManageScanConfigModal {...baseProps} open />);
+
+ // Then the selection falls back to Default — the stale choice is gone, so
+ // saving without touching the dropdown sends nothing.
+ await clickSave(user);
+ expect(setScanConfigurationProvidersMock).not.toHaveBeenCalled();
+ });
+});
diff --git a/ui/components/providers/scan-config/manage-scan-config-modal.tsx b/ui/components/providers/scan-config/manage-scan-config-modal.tsx
new file mode 100644
index 0000000000..d1d4d6471c
--- /dev/null
+++ b/ui/components/providers/scan-config/manage-scan-config-modal.tsx
@@ -0,0 +1,220 @@
+"use client";
+
+import { useState } from "react";
+
+import { setScanConfigurationProviders } from "@/actions/scan-configurations";
+import { Button } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { Modal } from "@/components/shadcn/modal";
+import {
+ Select,
+ SelectContent,
+ SelectItem,
+ SelectTrigger,
+ SelectValue,
+} from "@/components/shadcn/select/select";
+import { DOCS_URLS } from "@/lib/external-urls";
+import { ScanConfigurationData } from "@/types/scan-configurations";
+
+// Sentinel for the "Default" option: detaches the provider so its scans fall
+// back to Prowler's built-in SDK defaults. Select values must be non-empty
+// strings, so we can't use "".
+const DEFAULT_VALUE = "__default__";
+
+interface ManageScanConfigModalProps {
+ open: boolean;
+ onOpenChange: (open: boolean) => void;
+ providerId: string;
+ providerLabel: string;
+ scanConfigs: ScanConfigurationData[];
+ /** The config this provider is currently attached to, if any. */
+ currentConfigId: string | null;
+ /** Called after a successful associate/disassociate so the parent can refresh. */
+ onSaved: () => void;
+}
+
+type ManageScanConfigFormProps = Omit<ManageScanConfigModalProps, "open">;
+
+export function ManageScanConfigModal({
+ open,
+ onOpenChange,
+ ...formProps
+}: ManageScanConfigModalProps) {
+ return (
+ <Modal
+ open={open}
+ onOpenChange={onOpenChange}
+ title="Scan Configuration"
+ size="md"
+ >
+ {/* Only mount the form while the modal is open so a fresh instance is
+ created on every reopen — its selection always initializes from the
+ provider's current config, never from a stale, cancelled selection.
+ The key resets it again if the attached config changes mid-open. */}
+ {open && (
+ <ManageScanConfigForm
+ key={`${formProps.providerId}:${formProps.currentConfigId ?? DEFAULT_VALUE}`}
+ onOpenChange={onOpenChange}
+ {...formProps}
+ />
+ )}
+ </Modal>
+ );
+}
+
+function ManageScanConfigForm({
+ onOpenChange,
+ providerId,
+ providerLabel,
+ scanConfigs,
+ currentConfigId,
+ onSaved,
+}: ManageScanConfigFormProps) {
+ const { toast } = useToast();
+ const [selected, setSelected] = useState<string>(
+ currentConfigId ?? DEFAULT_VALUE,
+ );
+ const [isSaving, setIsSaving] = useState(false);
+
+ const handleSave = async () => {
+ // No change — nothing to do.
+ if (selected === (currentConfigId ?? DEFAULT_VALUE)) {
+ onOpenChange(false);
+ return;
+ }
+
+ const reportError = (description: string) => {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description,
+ });
+ };
+
+ setIsSaving(true);
+ try {
+ let result;
+ if (selected === DEFAULT_VALUE) {
+ // Detach: drop this provider from its current config.
+ if (!currentConfigId) {
+ onOpenChange(false);
+ return;
+ }
+ const current = scanConfigs.find((c) => c.id === currentConfigId);
+ // Bail if we don't have the current config loaded: sending a full
+ // provider_ids replacement off a synthetic empty list would clear every
+ // other provider attached to this configuration.
+ if (!current) {
+ reportError(
+ "This scan configuration is no longer available. Refresh and try again.",
+ );
+ return;
+ }
+ const next = current.attributes.providers.filter(
+ (id) => id !== providerId,
+ );
+ result = await setScanConfigurationProviders(currentConfigId, next);
+ } else {
+ // Attach: add this provider to the chosen config. The backend moves it
+ // off any other config automatically (one config per provider).
+ const target = scanConfigs.find((c) => c.id === selected);
+ // Same guard as the detach path: never replace provider_ids based on a
+ // config we don't actually have.
+ if (!target) {
+ reportError(
+ "This scan configuration is no longer available. Refresh and try again.",
+ );
+ return;
+ }
+ const next = Array.from(
+ new Set([...target.attributes.providers, providerId]),
+ );
+ result = await setScanConfigurationProviders(selected, next);
+ }
+
+ if (result?.success) {
+ toast({
+ title: "Scan Configuration updated",
+ description: result.success,
+ });
+ onSaved();
+ onOpenChange(false);
+ } else {
+ reportError(
+ result?.errors?.general ||
+ result?.errors?.provider_ids ||
+ "Failed to update the Scan Configuration. Please try again.",
+ );
+ }
+ } catch {
+ // An invocation-level failure (transport/framework) rejects instead of
+ // returning an error object — surface it instead of failing silently.
+ reportError("Failed to update the Scan Configuration. Please try again.");
+ } finally {
+ setIsSaving(false);
+ }
+ };
+
+ return (
+ <div className="flex flex-col gap-4">
+ <p className="text-text-neutral-tertiary text-xs">
+ Choose the scan configuration to apply to{" "}
+ <strong>{providerLabel}</strong> on its next scan, or leave default. To
+ create or edit configurations, go to{" "}
+ <CustomLink size="xs" href="/scans/config" target="_self">
+ Scan Config
+ </CustomLink>
+ .
+ </p>
+
+ {/* Always show the dropdown with Default — even with no custom configs,
+ the provider can fall back to Prowler's SDK defaults. */}
+ <div className="flex flex-col gap-1">
+ <Select value={selected} onValueChange={setSelected}>
+ <SelectTrigger aria-label="Scan configuration">
+ <SelectValue placeholder="Default" />
+ </SelectTrigger>
+ <SelectContent>
+ <SelectItem value={DEFAULT_VALUE}>Default</SelectItem>
+ {scanConfigs.map((c) => (
+ <SelectItem key={c.id} value={c.id}>
+ {c.attributes.name}
+ </SelectItem>
+ ))}
+ </SelectContent>
+ </Select>
+ <p className="text-text-neutral-tertiary text-xs">
+ <strong>Default</strong>
+ {
+ " uses Prowler's scan configuration baseline. Read more about it in the "
+ }
+ <CustomLink size="xs" href={DOCS_URLS.SCAN_CONFIGURATION}>
+ documentation
+ </CustomLink>
+ .
+ </p>
+ </div>
+
+ <div className="flex w-full justify-end gap-3">
+ <Button
+ type="button"
+ variant="ghost"
+ size="lg"
+ onClick={() => onOpenChange(false)}
+ disabled={isSaving}
+ >
+ Cancel
+ </Button>
+ <Button
+ type="button"
+ size="lg"
+ onClick={handleSave}
+ disabled={isSaving}
+ >
+ {isSaving ? "Saving..." : "Save"}
+ </Button>
+ </div>
+ </div>
+ );
+}
diff --git a/ui/components/providers/table/column-providers.test.tsx b/ui/components/providers/table/column-providers.test.tsx
index c2e9abc18c..89e7aea791 100644
--- a/ui/components/providers/table/column-providers.test.tsx
+++ b/ui/components/providers/table/column-providers.test.tsx
@@ -18,11 +18,11 @@ vi.mock("@/components/shadcn/checkbox/checkbox", () => ({
Checkbox: () => null,
}));
-vi.mock("@/components/ui/code-snippet/code-snippet", () => ({
+vi.mock("@/components/shadcn/code-snippet/code-snippet", () => ({
CodeSnippet: ({ value }: { value: string }) => <code>{value}</code>,
}));
-vi.mock("@/components/ui/entities", () => ({
+vi.mock("@/components/shadcn/entities", () => ({
DateWithTime: ({ dateTime }: { dateTime: string | null }) => (
<time>{dateTime}</time>
),
@@ -35,15 +35,15 @@ vi.mock("@/components/ui/entities", () => ({
}) => <span>{entityAlias ?? entityId}</span>,
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
}));
-vi.mock("@/components/ui/table/data-table-expand-all-toggle", () => ({
+vi.mock("@/components/shadcn/table/data-table-expand-all-toggle", () => ({
DataTableExpandAllToggle: () => null,
}));
-vi.mock("@/components/ui/table/data-table-expandable-cell", () => ({
+vi.mock("@/components/shadcn/table/data-table-expandable-cell", () => ({
DataTableExpandableCell: ({ children }: { children: ReactNode }) => (
<div>{children}</div>
),
@@ -63,6 +63,7 @@ const providerRow: ProvidersProviderRow = {
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: "123456789012",
alias: "Production",
status: "completed",
diff --git a/ui/components/providers/table/column-providers.tsx b/ui/components/providers/table/column-providers.tsx
index 3f93cd2b45..2590b5669e 100644
--- a/ui/components/providers/table/column-providers.tsx
+++ b/ui/components/providers/table/column-providers.tsx
@@ -9,17 +9,22 @@ import type {
} from "@/components/providers/wizard/types";
import { Badge } from "@/components/shadcn";
import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { DateWithTime, EntityInfo } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
-import { DataTableExpandAllToggle } from "@/components/ui/table/data-table-expand-all-toggle";
-import { DataTableExpandableCell } from "@/components/ui/table/data-table-expandable-cell";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { DateWithTime, EntityInfo } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
+import { DataTableExpandAllToggle } from "@/components/shadcn/table/data-table-expand-all-toggle";
+import { DataTableExpandableCell } from "@/components/shadcn/table/data-table-expandable-cell";
import {
isProvidersOrganizationRow,
PROVIDERS_GROUP_KIND,
ProvidersProviderRow,
ProvidersTableRow,
} from "@/types/providers-table";
+import {
+ SCAN_CONFIGURATION_LIST_STATUS,
+ ScanConfigurationData,
+ type ScanConfigurationListStatus,
+} from "@/types/scan-configurations";
import type {
ScanScheduleCapability,
ScanScheduleProvider,
@@ -113,6 +118,9 @@ export function getColumnProviders(
onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void,
onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void,
scanScheduleCapability?: ScanScheduleCapability,
+ scanConfigs: ScanConfigurationData[] = [],
+ scanConfigStatus: ScanConfigurationListStatus = SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ scanConfigIdByProviderId: ReadonlyMap<string, string> = new Map(),
): ColumnDef<ProvidersTableRow>[] {
return [
{
@@ -190,6 +198,11 @@ export function getColumnProviders(
cloudProvider={provider.attributes.provider}
entityAlias={provider.attributes.alias}
entityId={provider.attributes.uid}
+ nameAction={
+ provider.attributes.is_dynamic ? (
+ <Badge variant="info">Custom</Badge>
+ ) : undefined
+ }
/>
</DataTableExpandableCell>
);
@@ -315,6 +328,9 @@ export function getColumnProviders(
),
cell: ({ row }) => {
const hasSelection = Object.values(rowSelection).some(Boolean);
+ const currentScanConfigId = isProvidersOrganizationRow(row.original)
+ ? null
+ : (scanConfigIdByProviderId.get(row.original.id) ?? null);
return (
<DataTableRowActions
@@ -327,6 +343,9 @@ export function getColumnProviders(
onClearSelection={onClearSelection}
onOpenProviderWizard={onOpenProviderWizard}
onOpenOrganizationWizard={onOpenOrganizationWizard}
+ scanConfigs={scanConfigs}
+ scanConfigStatus={scanConfigStatus}
+ currentScanConfigId={currentScanConfigId}
capability={scanScheduleCapability}
/>
);
diff --git a/ui/components/providers/table/data-table-row-actions.test.tsx b/ui/components/providers/table/data-table-row-actions.test.tsx
index b5f340f3b8..0a0a774b50 100644
--- a/ui/components/providers/table/data-table-row-actions.test.tsx
+++ b/ui/components/providers/table/data-table-row-actions.test.tsx
@@ -9,6 +9,7 @@ import {
PROVIDERS_ROW_TYPE,
ProvidersTableRow,
} from "@/types/providers-table";
+import type { ScanConfigurationData } from "@/types/scan-configurations";
import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
const { checkConnectionProviderMock, getScheduleMock, pushMock } = vi.hoisted(
@@ -47,6 +48,22 @@ vi.mock("../forms/edit-name-form", () => ({
EditNameForm: () => null,
}));
+vi.mock("../scan-config/manage-scan-config-modal", () => ({
+ ManageScanConfigModal: ({
+ open,
+ currentConfigId,
+ }: {
+ open: boolean;
+ currentConfigId: string | null;
+ }) =>
+ open ? (
+ <div
+ data-testid="manage-scan-config-modal"
+ data-current-config-id={currentConfigId ?? ""}
+ />
+ ) : null,
+}));
+
vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
EDIT_SCAN_SCHEDULE_STATE: {
LOADING: "loading",
@@ -70,7 +87,8 @@ vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
) : null,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: vi.fn() }),
}));
@@ -123,6 +141,51 @@ const createRow = (hasSecret = false) =>
},
}) as unknown as Row<ProvidersTableRow>;
+// A dynamic provider outside the hardcoded configurable set (read-only in the UI).
+const createDynamicRow = (hasSecret = true) =>
+ ({
+ original: {
+ id: "provider-dyn-1",
+ rowType: PROVIDERS_ROW_TYPE.PROVIDER,
+ type: "providers",
+ attributes: {
+ provider: "template",
+ is_dynamic: true,
+ uid: "template-account-0001",
+ alias: "Template Plug-in",
+ status: "completed",
+ resources: 0,
+ connection: {
+ connected: true,
+ last_checked_at: "2025-02-13T11:17:00Z",
+ },
+ scanner_args: {
+ only_logs: false,
+ excluded_checks: [],
+ aws_retries_max_attempts: 3,
+ },
+ inserted_at: "2025-02-13T11:17:00Z",
+ updated_at: "2025-02-13T11:17:00Z",
+ created_by: {
+ object: "user",
+ id: "user-1",
+ },
+ },
+ relationships: {
+ secret: {
+ data: hasSecret ? { id: "secret-1", type: "secrets" } : null,
+ },
+ provider_groups: {
+ meta: {
+ count: 0,
+ },
+ data: [],
+ },
+ },
+ groupNames: [],
+ },
+ }) as unknown as Row<ProvidersTableRow>;
+
const createOrgRow = () =>
({
original: {
@@ -182,6 +245,18 @@ const createOuRow = () =>
},
}) as unknown as Row<ProvidersTableRow>;
+const scanConfig: ScanConfigurationData = {
+ type: "scan-configurations",
+ id: "config-1",
+ attributes: {
+ inserted_at: "2026-01-01T00:00:00Z",
+ updated_at: "2026-01-01T00:00:00Z",
+ name: "Strict AWS",
+ configuration: {},
+ providers: ["provider-1"],
+ },
+};
+
describe("DataTableRowActions", () => {
afterEach(() => {
vi.unstubAllEnvs();
@@ -228,6 +303,38 @@ describe("DataTableRowActions", () => {
expect(screen.queryByText("Update Credentials")).not.toBeInTheDocument();
});
+ it("allows rename/delete and operational actions for a dynamic provider but hides credential management", async () => {
+ // Given a dynamic provider outside the configurable set, with the advanced
+ // schedule capability enabled (so Edit Scan Schedule can show).
+ const user = userEvent.setup();
+ render(
+ <DataTableRowActions
+ row={createDynamicRow(true)}
+ hasSelection={false}
+ isRowSelected={false}
+ testableProviderIds={[]}
+ onClearSelection={vi.fn()}
+ onOpenProviderWizard={vi.fn()}
+ onOpenOrganizationWizard={vi.fn()}
+ capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button"));
+
+ // Then — rename and delete are backend-generic, so they stay available
+ expect(screen.getByText("Edit Provider Alias")).toBeInTheDocument();
+ expect(screen.getByText("Delete Provider")).toBeInTheDocument();
+ // ...operational actions stay available too
+ expect(screen.getByText("Test Connection")).toBeInTheDocument();
+ expect(screen.getByText("View Scan Jobs")).toBeInTheDocument();
+ expect(screen.getByText("Edit Scan Schedule")).toBeInTheDocument();
+ // ...but credential management is hidden (no bespoke wizard for dynamic types)
+ expect(screen.queryByText("Add Credentials")).not.toBeInTheDocument();
+ expect(screen.queryByText("Update Credentials")).not.toBeInTheDocument();
+ });
+
it("navigates to the provider-filtered scan jobs from View Scan Jobs", async () => {
// Given
const user = userEvent.setup();
@@ -361,6 +468,95 @@ describe("DataTableRowActions", () => {
expect(screen.queryByText("Edit Scan Schedule")).not.toBeInTheDocument();
});
+ it("opens scan config management with the precomputed current config id", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const user = userEvent.setup();
+
+ render(
+ <DataTableRowActions
+ row={createRow(true)}
+ hasSelection={false}
+ isRowSelected={false}
+ testableProviderIds={[]}
+ onClearSelection={vi.fn()}
+ onOpenProviderWizard={vi.fn()}
+ onOpenOrganizationWizard={vi.fn()}
+ scanConfigs={[scanConfig]}
+ currentScanConfigId="config-1"
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button"));
+ await user.click(screen.getByText("Edit Scan Configuration"));
+
+ // Then
+ expect(screen.getByTestId("manage-scan-config-modal")).toHaveAttribute(
+ "data-current-config-id",
+ "config-1",
+ );
+ });
+
+ it("shows scan config management as unavailable when scan configs failed to load", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const user = userEvent.setup();
+
+ render(
+ <DataTableRowActions
+ row={createRow(true)}
+ hasSelection={false}
+ isRowSelected={false}
+ testableProviderIds={[]}
+ onClearSelection={vi.fn()}
+ onOpenProviderWizard={vi.fn()}
+ onOpenOrganizationWizard={vi.fn()}
+ scanConfigStatus="unavailable"
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button"));
+
+ // Then
+ const item = screen
+ .getByText("Scan Configuration unavailable")
+ .closest("[role='menuitem']");
+ expect(item).toHaveAttribute("aria-disabled", "true");
+ });
+
+ it("hides Edit Scan Configuration for dynamic providers in Prowler Cloud", async () => {
+ // Given a dynamic provider in a Cloud tenant with scan configs available.
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ const user = userEvent.setup();
+
+ render(
+ <DataTableRowActions
+ row={createDynamicRow(true)}
+ hasSelection={false}
+ isRowSelected={false}
+ testableProviderIds={[]}
+ onClearSelection={vi.fn()}
+ onOpenProviderWizard={vi.fn()}
+ onOpenOrganizationWizard={vi.fn()}
+ scanConfigs={[]}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button"));
+
+ // Then — dynamic providers can't use a Scan Configuration, so the action is
+ // absent entirely, not merely shown as "unavailable".
+ expect(
+ screen.queryByText("Edit Scan Configuration"),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText("Scan Configuration unavailable"),
+ ).not.toBeInTheDocument();
+ });
+
it("renders Update Credentials for provider rows with credentials", async () => {
// Given
const user = userEvent.setup();
diff --git a/ui/components/providers/table/data-table-row-actions.tsx b/ui/components/providers/table/data-table-row-actions.tsx
index 6e28b68042..c43631f754 100644
--- a/ui/components/providers/table/data-table-row-actions.tsx
+++ b/ui/components/providers/table/data-table-row-actions.tsx
@@ -6,6 +6,7 @@ import {
KeyRound,
Pencil,
Rocket,
+ SlidersHorizontal,
Timer,
Trash2,
} from "lucide-react";
@@ -25,19 +26,20 @@ import {
EditScanScheduleModal,
type EditScanScheduleState,
} from "@/components/scans/schedule/edit-scan-schedule-modal";
+import { useToast } from "@/components/shadcn";
import {
ActionDropdown,
ActionDropdownDangerZone,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
import { runWithConcurrencyLimit } from "@/lib/concurrency";
import { testProviderConnection } from "@/lib/provider-helpers";
import { getScanScheduleCapability } from "@/lib/schedules";
import { isCloud } from "@/lib/shared/env";
import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
import { PROVIDER_WIZARD_MODE } from "@/types/provider-wizard";
+import { isConfigurableProvider } from "@/types/providers";
import {
isProvidersOrganizationRow,
PROVIDERS_GROUP_KIND,
@@ -45,6 +47,11 @@ import {
ProvidersOrganizationRow,
ProvidersTableRow,
} from "@/types/providers-table";
+import {
+ SCAN_CONFIGURATION_LIST_STATUS,
+ ScanConfigurationData,
+ type ScanConfigurationListStatus,
+} from "@/types/scan-configurations";
import {
SCAN_SCHEDULE_CAPABILITY,
type ScanScheduleCapability,
@@ -55,6 +62,7 @@ import {
import { DeleteForm } from "../forms/delete-form";
import { DeleteOrganizationForm } from "../forms/delete-organization-form";
import { EditNameForm } from "../forms/edit-name-form";
+import { ManageScanConfigModal } from "../scan-config/manage-scan-config-modal";
interface DataTableRowActionsProps {
row: Row<ProvidersTableRow>;
@@ -72,6 +80,13 @@ interface DataTableRowActionsProps {
onClearSelection: () => void;
onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
+ /**
+ * All scan configurations in the tenant, used to associate/disassociate this
+ * provider's config from the row menu (Cloud-only feature). Empty in OSS.
+ */
+ scanConfigs?: ScanConfigurationData[];
+ scanConfigStatus?: ScanConfigurationListStatus;
+ currentScanConfigId?: string | null;
/**
* Schedule capability override. Absent in OSS (defaults to a Cloud-vs-non-Cloud
* decision). The prowler-cloud overlay injects a billing-aware capability so
@@ -271,6 +286,9 @@ export function DataTableRowActions({
onClearSelection,
onOpenProviderWizard,
onOpenOrganizationWizard,
+ scanConfigs = [],
+ scanConfigStatus = SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE,
+ currentScanConfigId = null,
capability,
}: DataTableRowActionsProps) {
const canEditSchedule =
@@ -282,6 +300,7 @@ export function DataTableRowActions({
kind: EDIT_SCAN_SCHEDULE_STATE.LOADING,
});
const [isDeleteOpen, setIsDeleteOpen] = useState(false);
+ const [isScanConfigOpen, setIsScanConfigOpen] = useState(false);
const [loading, setLoading] = useState(false);
const { toast } = useToast();
const router = useRouter();
@@ -290,11 +309,21 @@ export function DataTableRowActions({
const isOrganizationRow = isProvidersOrganizationRow(rowData);
const provider = isOrganizationRow ? null : rowData;
const providerId = provider?.id ?? "";
- const providerType = provider?.attributes.provider ?? "aws";
+ const providerType = provider?.attributes.provider ?? "";
+ // Only predefined providers can manage credentials from the UI
+ const canManageCredentials = isConfigurableProvider(providerType);
const providerUid = provider?.attributes.uid ?? "";
const providerAlias = provider?.attributes.alias ?? null;
const providerSecretId = provider?.relationships.secret.data?.id ?? null;
const hasSecret = Boolean(provider?.relationships.secret.data);
+ const isCloudProvider = isCloud() && Boolean(provider);
+ // Dynamic providers have no config.yaml baseline, so a Scan Configuration
+ // can't apply to them — hide the action entirely.
+ const isDynamicProvider = Boolean(provider?.attributes.is_dynamic);
+ const canManageScanConfig =
+ isCloudProvider &&
+ !isDynamicProvider &&
+ scanConfigStatus === SCAN_CONFIGURATION_LIST_STATUS.AVAILABLE;
const scheduleProvider: ScanScheduleProvider | undefined = provider
? {
providerId,
@@ -548,6 +577,17 @@ export function DataTableRowActions({
provider={scheduleProvider}
state={scheduleState}
/>
+ {canManageScanConfig && provider && (
+ <ManageScanConfigModal
+ open={isScanConfigOpen}
+ onOpenChange={setIsScanConfigOpen}
+ providerId={providerId}
+ providerLabel={providerAlias || providerUid}
+ scanConfigs={scanConfigs}
+ currentConfigId={currentScanConfigId}
+ onSaved={() => router.refresh()}
+ />
+ )}
<div className="relative flex items-center justify-end gap-2">
<ActionDropdown>
<ActionDropdownItem
@@ -575,22 +615,41 @@ export function DataTableRowActions({
onSelect={() => void openScheduleEditor()}
/>
)}
- <ActionDropdownItem
- icon={<KeyRound />}
- label={hasSecret ? "Update Credentials" : "Add Credentials"}
- onSelect={() =>
- onOpenProviderWizard({
- providerId,
- providerType,
- providerUid,
- providerAlias,
- secretId: providerSecretId,
- mode: providerSecretId
- ? PROVIDER_WIZARD_MODE.UPDATE
- : PROVIDER_WIZARD_MODE.ADD,
- })
- }
- />
+ {canManageScanConfig && (
+ <ActionDropdownItem
+ icon={<SlidersHorizontal />}
+ label="Edit Scan Configuration"
+ onSelect={() => setIsScanConfigOpen(true)}
+ />
+ )}
+ {isCloudProvider &&
+ !isDynamicProvider &&
+ scanConfigStatus === SCAN_CONFIGURATION_LIST_STATUS.UNAVAILABLE && (
+ <ActionDropdownItem
+ icon={<SlidersHorizontal />}
+ label="Scan Configuration unavailable"
+ description="Try again later."
+ disabled
+ />
+ )}
+ {canManageCredentials && (
+ <ActionDropdownItem
+ icon={<KeyRound />}
+ label={hasSecret ? "Update Credentials" : "Add Credentials"}
+ onSelect={() =>
+ onOpenProviderWizard({
+ providerId,
+ providerType,
+ providerUid,
+ providerAlias,
+ secretId: providerSecretId,
+ mode: providerSecretId
+ ? PROVIDER_WIZARD_MODE.UPDATE
+ : PROVIDER_WIZARD_MODE.ADD,
+ })
+ }
+ />
+ )}
<ActionDropdownItem
icon={<Rocket />}
label={loading ? "Testing..." : "Test Connection"}
diff --git a/ui/components/providers/table/skeleton-table-provider.tsx b/ui/components/providers/table/skeleton-table-provider.tsx
index 1fe557b808..ac99be94bd 100644
--- a/ui/components/providers/table/skeleton-table-provider.tsx
+++ b/ui/components/providers/table/skeleton-table-provider.tsx
@@ -57,7 +57,7 @@ export const SkeletonTableProviders = () => {
const rows = 10;
return (
- <div className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden border p-4">
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
{/* Toolbar: Search + Total entries */}
<div className="flex items-center justify-between">
<Skeleton className="size-10 rounded-md" />
diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx
index e382bfbf71..dbc31771d9 100644
--- a/ui/components/providers/wizard/steps/launch-step.test.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.test.tsx
@@ -34,7 +34,8 @@ vi.mock("@/actions/schedules", () => ({
updateSchedule: updateScheduleMock,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
ToastAction: ({ children, ...props }: ComponentProps<"button">) => (
<button {...props}>{children}</button>
),
@@ -93,7 +94,7 @@ describe("LaunchStep", () => {
);
// Then
- expect(screen.getByText("Account Connected!")).toBeInTheDocument();
+ expect(screen.getByText("Provider Connected!")).toBeInTheDocument();
expect(
screen.getByRole("radio", { name: "On a schedule" }),
).toBeChecked();
@@ -373,6 +374,31 @@ describe("LaunchStep", () => {
scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
});
+ it("uses a warning badge for the subscription requirement", () => {
+ // Given
+ seedConnectedProvider();
+
+ // When
+ render(
+ <LaunchStep
+ onBack={vi.fn()}
+ onClose={vi.fn()}
+ onFooterChange={vi.fn()}
+ capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+ />,
+ );
+
+ // Then
+ expect(screen.getByText("Requires subscription")).toHaveClass(
+ "bg-bg-warning-secondary/20",
+ "text-text-warning-primary",
+ );
+ expect(screen.getByText("Requires subscription")).toHaveAttribute(
+ "data-slot",
+ "badge",
+ );
+ });
+
it("defaults to run now, locks schedule mode, and only launches a manual scan", async () => {
// Given
const onClose = vi.fn();
@@ -473,7 +499,7 @@ describe("LaunchStep", () => {
);
// Then
- expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+ expect(screen.getByText(/exceeded the usage limit/i)).toBeInTheDocument();
await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
});
diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx
index 59f6bcd578..1c24f2b893 100644
--- a/ui/components/providers/wizard/steps/launch-step.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.tsx
@@ -12,18 +12,16 @@ import {
} from "@/components/scans/schedule/save-schedule";
import { ScanScheduleFields } from "@/components/scans/schedule/scan-schedule-fields";
import { Field, FieldLabel } from "@/components/shadcn";
+import { ToastAction, useToast } from "@/components/shadcn";
+import { Badge } from "@/components/shadcn/badge/badge";
+import { EntityInfo } from "@/components/shadcn/entities";
import {
RadioGroup,
RadioGroupItem,
} from "@/components/shadcn/radio-group/radio-group";
import { Spinner } from "@/components/shadcn/spinner/spinner";
import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
-import {
- CloudFeatureBadge,
- CloudFeatureBadgeLink,
-} from "@/components/shared/cloud-feature-badge";
-import { ToastAction, useToast } from "@/components/ui";
-import { EntityInfo } from "@/components/ui/entities";
+import { UsageLimitMessage } from "@/components/shared/usage-limit-message";
import {
type ActionErrorResult,
getActionErrorMessage,
@@ -296,11 +294,11 @@ export function LaunchStep({
<div className="flex items-center gap-3">
<TreeStatusIcon status={TREE_ITEM_STATUS.SUCCESS} className="size-6" />
- <h3 className="text-sm font-semibold">Account Connected!</h3>
+ <h3 className="text-sm font-semibold">Provider Connected!</h3>
</div>
<p className="text-text-neutral-secondary text-sm">
- Your account is connected to Prowler and ready to Scan!
+ Your provider is connected to Prowler and ready to Scan!
</p>
{!providerId && (
@@ -332,13 +330,11 @@ export function LaunchStep({
disabled={!canUseScheduleMode}
/>
On a schedule
- {!canUseScheduleMode &&
- !isBlocked &&
- (isManualOnly ? (
- <CloudFeatureBadge label="Requires subscription" size="sm" />
- ) : (
- <CloudFeatureBadgeLink size="sm" />
- ))}
+ {isManualOnly && !isBlocked && (
+ <Badge variant="warning" size="sm">
+ Requires subscription
+ </Badge>
+ )}
</label>
</RadioGroup>
</Field>
@@ -350,12 +346,7 @@ export function LaunchStep({
</p>
)}
- {(isLimitBlocked || isBlocked) && (
- <p className="text-text-error-primary text-sm">
- You have reached your scan limit, so additional scans are not
- available right now.
- </p>
- )}
+ {(isLimitBlocked || isBlocked) && <UsageLimitMessage />}
{isScheduleMode && (
<ScanScheduleFields
diff --git a/ui/components/providers/workflow/credentials-role-helper.tsx b/ui/components/providers/workflow/credentials-role-helper.tsx
index 0ded59beee..12e0bd3502 100644
--- a/ui/components/providers/workflow/credentials-role-helper.tsx
+++ b/ui/components/providers/workflow/credentials-role-helper.tsx
@@ -2,7 +2,7 @@
import { IdIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
import { IntegrationType } from "@/types/integrations";
interface CredentialsRoleHelperProps {
@@ -92,7 +92,7 @@ export const CredentialsRoleHelper = ({
</div>
<div className="flex items-center gap-2">
- <span className="text-default-500 block text-xs font-medium">
+ <span className="text-text-neutral-tertiary block text-xs font-medium">
External ID:
</span>
<CodeSnippet value={externalId} icon={<IdIcon size={16} />} />
diff --git a/ui/components/providers/workflow/forms/base-credentials-form.tsx b/ui/components/providers/workflow/forms/base-credentials-form.tsx
index 227a2eada6..8bedaa2514 100644
--- a/ui/components/providers/workflow/forms/base-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/base-credentials-form.tsx
@@ -5,8 +5,8 @@ import { useEffect } from "react";
import { Control, UseFormSetValue } from "react-hook-form";
import { Button } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
import { Separator } from "@/components/shadcn/separator/separator";
-import { Form } from "@/components/ui/form";
import { useCredentialsForm } from "@/hooks/use-credentials-form";
import { getAWSCredentialsTemplateLinks } from "@/lib";
import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
diff --git a/ui/components/providers/workflow/forms/connect-account-form.tsx b/ui/components/providers/workflow/forms/connect-account-form.tsx
index ddc5038160..303a5c918a 100644
--- a/ui/components/providers/workflow/forms/connect-account-form.tsx
+++ b/ui/components/providers/workflow/forms/connect-account-form.tsx
@@ -12,9 +12,14 @@ import { AwsMethodSelector } from "@/components/providers/organizations/aws-meth
import { WizardInputField } from "@/components/providers/workflow/forms/fields";
import { ProviderTitleDocs } from "@/components/providers/workflow/provider-title-docs";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
-import { addProviderFormSchema, ApiError, ProviderType } from "@/types";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
+import {
+ addProviderFormSchema,
+ ApiError,
+ KnownProviderType,
+ ProviderType,
+} from "@/types";
import { RadioGroupProvider } from "../../radio-group-provider";
@@ -156,7 +161,7 @@ function applyBackStep({
setPrevStep((prev) => prev - 1);
if (prevStep === 2) {
- form.setValue("providerType", undefined as unknown as ProviderType, {
+ form.setValue("providerType", undefined as unknown as KnownProviderType, {
shouldValidate: false,
});
setAwsMethod(null);
diff --git a/ui/components/providers/workflow/forms/fields/wizard-input-field.tsx b/ui/components/providers/workflow/forms/fields/wizard-input-field.tsx
index b769bd1461..bcfd945807 100644
--- a/ui/components/providers/workflow/forms/fields/wizard-input-field.tsx
+++ b/ui/components/providers/workflow/forms/fields/wizard-input-field.tsx
@@ -4,8 +4,8 @@ import { Icon } from "@iconify/react";
import { InputHTMLAttributes, useState } from "react";
import { Control, FieldPath, FieldValues } from "react-hook-form";
+import { FormControl, FormField, FormMessage } from "@/components/shadcn/form";
import { Input } from "@/components/shadcn/input/input";
-import { FormControl, FormField, FormMessage } from "@/components/ui/form";
import { cn } from "@/lib/utils";
interface WizardInputFieldProps<T extends FieldValues> {
@@ -142,7 +142,7 @@ export const WizardInputField = <T extends FieldValues>({
<button
type="button"
onClick={toggleVisibility}
- className="text-default-400 hover:text-default-500 absolute top-1/2 right-3 -translate-y-1/2"
+ className="text-text-neutral-tertiary hover:text-text-neutral-secondary absolute top-1/2 right-3 -translate-y-1/2"
aria-label={
inputType === "password"
? "Show password"
diff --git a/ui/components/providers/workflow/forms/fields/wizard-radio-card.tsx b/ui/components/providers/workflow/forms/fields/wizard-radio-card.tsx
index 00b8440030..1e67dfaaa5 100644
--- a/ui/components/providers/workflow/forms/fields/wizard-radio-card.tsx
+++ b/ui/components/providers/workflow/forms/fields/wizard-radio-card.tsx
@@ -18,7 +18,7 @@ export const WizardRadioCard = ({
<div
className={cn(
"group inline-flex w-full cursor-pointer items-center justify-between gap-4 rounded-lg border-2 p-4",
- "border-default hover:border-button-primary",
+ "border-border-input-primary hover:border-button-primary",
"has-[[data-state=checked]]:border-button-primary",
isInvalid && "border-bg-fail",
)}
diff --git a/ui/components/providers/workflow/forms/fields/wizard-textarea-field.tsx b/ui/components/providers/workflow/forms/fields/wizard-textarea-field.tsx
index 473de8d48d..9c171be2f3 100644
--- a/ui/components/providers/workflow/forms/fields/wizard-textarea-field.tsx
+++ b/ui/components/providers/workflow/forms/fields/wizard-textarea-field.tsx
@@ -2,8 +2,8 @@
import { Control, FieldPath, FieldValues } from "react-hook-form";
+import { FormControl, FormField, FormMessage } from "@/components/shadcn/form";
import { Textarea } from "@/components/shadcn/textarea/textarea";
-import { FormControl, FormField, FormMessage } from "@/components/ui/form";
import { cn } from "@/lib/utils";
interface WizardTextareaFieldProps<T extends FieldValues> {
diff --git a/ui/components/providers/workflow/forms/provider-connection-info.tsx b/ui/components/providers/workflow/forms/provider-connection-info.tsx
index 61c9becde6..85e8987326 100644
--- a/ui/components/providers/workflow/forms/provider-connection-info.tsx
+++ b/ui/components/providers/workflow/forms/provider-connection-info.tsx
@@ -1,3 +1,4 @@
+import { getProviderLogo } from "@/components/shadcn/entities/get-provider-logo";
import { ProviderType } from "@/types";
import {
@@ -5,7 +6,6 @@ import {
ConnectionPending,
ConnectionTrue,
} from "../../../icons";
-import { getProviderLogo } from "../../../ui/entities/get-provider-logo";
interface ProviderConnectionInfoProps {
connected: boolean | null;
@@ -24,19 +24,19 @@ export const ProviderConnectionInfo = ({
switch (connected) {
case true:
return (
- <div className="rounded-medium border-system-success bg-system-success-lighter flex items-center justify-center border-2 p-1">
- <ConnectionTrue className="text-system-success" size={24} />
+ <div className="border-bg-pass bg-bg-pass-secondary flex items-center justify-center rounded-xl border-2 p-1">
+ <ConnectionTrue className="text-text-success-primary" size={24} />
</div>
);
case false:
return (
- <div className="rounded-medium border-border-error flex items-center justify-center border-2 p-1">
+ <div className="border-border-error flex items-center justify-center rounded-xl border-2 p-1">
<ConnectionFalse className="text-text-error-primary" size={24} />
</div>
);
case null:
return (
- <div className="bg-info-lighter border-info-lighter rounded-medium flex items-center justify-center border p-1">
+ <div className="bg-info-lighter border-info-lighter flex items-center justify-center rounded-xl border p-1">
<ConnectionPending className="text-info" size={24} />
</div>
);
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-role-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-role-credentials-form.tsx
index c333834d0b..3c3dcc6973 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-role-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-role-credentials-form.tsx
@@ -13,16 +13,16 @@ export const AlibabaCloudRoleCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect assuming RAM Role
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide the RAM Role ARN to assume, along with the Access Keys of a
RAM user that has permission to assume the role.
</div>
</div>
- <span className="text-default-500 text-xs font-bold">
+ <span className="text-text-neutral-tertiary text-xs font-bold">
RAM Role to Assume
</span>
@@ -39,7 +39,7 @@ export const AlibabaCloudRoleCredentialsForm = ({
<Separator />
- <span className="text-default-500 text-xs font-bold">
+ <span className="text-text-neutral-tertiary text-xs font-bold">
Credentials for Role Assumption
</span>
@@ -64,7 +64,9 @@ export const AlibabaCloudRoleCredentialsForm = ({
isRequired
/>
- <span className="text-default-500 text-xs">Optional fields</span>
+ <span className="text-text-neutral-tertiary text-xs">
+ Optional fields
+ </span>
<WizardInputField
control={control}
@@ -77,7 +79,7 @@ export const AlibabaCloudRoleCredentialsForm = ({
isRequired={false}
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Keys never leave your browser unencrypted and are stored as secrets in
the backend. The role will be assumed using STS to obtain temporary
credentials.
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-static-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-static-credentials-form.tsx
index abbeda341e..2931ab8797 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-static-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/credentials-type/alibabacloud-static-credentials-form.tsx
@@ -12,10 +12,10 @@ export const AlibabaCloudStaticCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Access Keys
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide a RAM user Access Key ID and Access Key Secret with read
access to the resources you want Prowler to assess.
</div>
@@ -40,7 +40,7 @@ export const AlibabaCloudStaticCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Keys never leave your browser unencrypted and are stored as secrets in
the backend. Rotate the key from Alibaba Cloud RAM console anytime if
needed.
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/radio-group-alibabacloud-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/radio-group-alibabacloud-via-credentials-type-form.tsx
index 1315a6b559..73245cd02e 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/radio-group-alibabacloud-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/radio-group-alibabacloud-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller, FieldValues, Path } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupAlibabaCloudViaCredentialsFormProps<T extends FieldValues> = {
control: Control<T>;
@@ -38,11 +38,13 @@ export const RadioGroupAlibabaCloudViaCredentialsTypeForm = <
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">Using RAM Role</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ Using RAM Role
+ </span>
<WizardRadioCard value="role" isInvalid={isInvalid}>
Connect assuming RAM Role
</WizardRadioCard>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Using Credentials
</span>
<WizardRadioCard value="credentials" isInvalid={isInvalid}>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/select-via-alibabacloud.tsx b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/select-via-alibabacloud.tsx
index 2a83629b70..ea82f98d58 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/select-via-alibabacloud.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/alibabacloud/select-via-alibabacloud.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupAlibabaCloudViaCredentialsTypeForm } from "./radio-group-alibabacloud-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form.tsx
index 218bd7f89a..44bfde7de4 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form.tsx
@@ -73,13 +73,13 @@ export const AWSRoleCredentialsForm = ({
<>
<div className="flex flex-col">
{type === "providers" && (
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect assuming IAM Role
</div>
)}
</div>
- <span className="text-default-500 text-xs font-bold">
+ <span className="text-text-neutral-tertiary text-xs font-bold">
Specify which AWS credentials to use
</span>
@@ -157,10 +157,12 @@ export const AWSRoleCredentialsForm = ({
<Separator />
{type === "providers" ? (
- <span className="text-default-500 text-xs font-bold">Assume Role</span>
+ <span className="text-text-neutral-tertiary text-xs font-bold">
+ Assume Role
+ </span>
) : (
<div className="flex items-center justify-between">
- <span className="text-default-500 text-xs font-bold">
+ <span className="text-text-neutral-tertiary text-xs font-bold">
{isCloudEnv && credentialsType === "aws-sdk-default"
? "Adding a role is required"
: "Optionally add a role"}
@@ -207,7 +209,9 @@ export const AWSRoleCredentialsForm = ({
isRequired
/>
- <span className="text-default-500 text-xs">Optional fields</span>
+ <span className="text-text-neutral-tertiary text-xs">
+ Optional fields
+ </span>
<div className="mt-4 grid grid-cols-1 gap-4 md:grid-cols-2">
<WizardInputField
control={control}
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-static-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-static-credentials-form.tsx
index 6abc4cf808..c0751c7c7d 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-static-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-static-credentials-form.tsx
@@ -12,10 +12,10 @@ export const AWSStaticCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide the information for your AWS credentials.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/aws/radio-group-aws-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/aws/radio-group-aws-via-credentials-type-form.tsx
index 294d68515b..a556ff7329 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/aws/radio-group-aws-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/aws/radio-group-aws-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupAWSViaCredentialsFormProps = {
control: Control<any>;
@@ -33,11 +33,15 @@ export const RadioGroupAWSViaCredentialsTypeForm = ({
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">Using IAM Role</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ Using IAM Role
+ </span>
<WizardRadioCard value="role" isInvalid={isInvalid}>
Connect assuming IAM Role
</WizardRadioCard>
- <span className="text-default-500 text-sm">Using Credentials</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ Using Credentials
+ </span>
<WizardRadioCard value="credentials" isInvalid={isInvalid}>
Connect via Credentials
</WizardRadioCard>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/aws/select-via-aws.tsx b/ui/components/providers/workflow/forms/select-credentials-type/aws/select-via-aws.tsx
index a7554c4cf2..cc74333abd 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/aws/select-via-aws.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/aws/select-via-aws.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupAWSViaCredentialsTypeForm } from "./radio-group-aws-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-key-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-key-credentials-form.tsx
index ae36e87372..2a3d71334f 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-key-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-key-credentials-form.tsx
@@ -14,10 +14,10 @@ export const CloudflareApiKeyCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via API Key + Email
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide your Cloudflare Global API Key and the email address
associated with your Cloudflare account.
</div>
@@ -42,7 +42,7 @@ export const CloudflareApiKeyCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Credentials never leave your browser unencrypted and are stored as
secrets in the backend. You can regenerate your API Key from the
Cloudflare dashboard anytime if needed.
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-token-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-token-credentials-form.tsx
index b3c089683b..08f316b627 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-token-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-token-credentials-form.tsx
@@ -14,10 +14,10 @@ export const CloudflareApiTokenCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via API Token
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide a Cloudflare API Token with read permissions to the resources
you want Prowler to assess. This is the recommended authentication
method.
@@ -33,7 +33,7 @@ export const CloudflareApiTokenCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Tokens never leave your browser unencrypted and are stored as secrets in
the backend. You can revoke the token from the Cloudflare dashboard
anytime if needed.
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/radio-group-cloudflare-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/radio-group-cloudflare-via-credentials-type-form.tsx
index 67ea17267e..cd49d8acfe 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/radio-group-cloudflare-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/radio-group-cloudflare-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupCloudflareViaCredentialsFormProps = {
control: Control<any>;
@@ -33,7 +33,7 @@ export const RadioGroupCloudflareViaCredentialsTypeForm = ({
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Select Authentication Method
</span>
<WizardRadioCard value="api_token" isInvalid={isInvalid}>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/select-via-cloudflare.tsx b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/select-via-cloudflare.tsx
index 24011ff56d..3615eb2803 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/select-via-cloudflare.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/cloudflare/select-via-cloudflare.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupCloudflareViaCredentialsTypeForm } from "./radio-group-cloudflare-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-default-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-default-credentials-form.tsx
index 4a2d63d4f9..0e4e6f451f 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-default-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-default-credentials-form.tsx
@@ -11,10 +11,10 @@ export const GCPDefaultCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide the information for your GCP credentials.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-service-account-key-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-service-account-key-form.tsx
index 381ccf892d..f3edce82ac 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-service-account-key-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/gcp/credentials-type/gcp-service-account-key-form.tsx
@@ -11,10 +11,10 @@ export const GCPServiceAccountKeyForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Service Account Key
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide the service account key for your GCP credentials.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/gcp/radio-group-gcp-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/gcp/radio-group-gcp-via-credentials-type-form.tsx
index 1f32d154a7..36f27133f0 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/gcp/radio-group-gcp-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/gcp/radio-group-gcp-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupGCPViaCredentialsFormProps = {
control: Control<any>;
@@ -33,13 +33,13 @@ export const RadioGroupGCPViaCredentialsTypeForm = ({
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Using Service Account
</span>
<WizardRadioCard value="service-account" isInvalid={isInvalid}>
Connect via Service Account Key
</WizardRadioCard>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Using Application Default Credentials
</span>
<WizardRadioCard value="credentials" isInvalid={isInvalid}>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/gcp/select-via-gcp.tsx b/ui/components/providers/workflow/forms/select-credentials-type/gcp/select-via-gcp.tsx
index 5d52c3e4a8..20c3632208 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/gcp/select-via-gcp.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/gcp/select-via-gcp.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupGCPViaCredentialsTypeForm } from "./radio-group-gcp-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-app-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-app-form.tsx
index 3d4d23c25b..0fc134094c 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-app-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-app-form.tsx
@@ -12,10 +12,10 @@ export const GitHubAppForm = ({ control }: { control: Control<any> }) => {
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via GitHub App
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your GitHub App ID and private key.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-oauth-app-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-oauth-app-form.tsx
index e3da204060..85b34ac1b9 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-oauth-app-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-oauth-app-form.tsx
@@ -9,10 +9,10 @@ export const GitHubOAuthAppForm = ({ control }: { control: Control<any> }) => {
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via OAuth App
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your GitHub OAuth App token.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-personal-access-token-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-personal-access-token-form.tsx
index 1e173faff5..1b749e238f 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-personal-access-token-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/github/credentials-type/github-personal-access-token-form.tsx
@@ -13,10 +13,10 @@ export const GitHubPersonalAccessTokenForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Personal Access Token
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your GitHub personal access token.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/github/radio-group-github-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/github/radio-group-github-via-credentials-type-form.tsx
index fa2d5ab98f..0878a1d64a 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/github/radio-group-github-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/github/radio-group-github-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupGitHubViaCredentialsFormProps = {
control: Control<any>;
@@ -33,7 +33,7 @@ export const RadioGroupGitHubViaCredentialsTypeForm = ({
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Personal Access Token
</span>
<WizardRadioCard
@@ -43,12 +43,16 @@ export const RadioGroupGitHubViaCredentialsTypeForm = ({
Personal Access Token
</WizardRadioCard>
- <span className="text-default-500 text-sm">OAuth App</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ OAuth App
+ </span>
<WizardRadioCard value="oauth_app" isInvalid={isInvalid}>
OAuth App Token
</WizardRadioCard>
- <span className="text-default-500 text-sm">GitHub App</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ GitHub App
+ </span>
<WizardRadioCard value="github_app" isInvalid={isInvalid}>
GitHub App
</WizardRadioCard>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/github/select-via-github.tsx b/ui/components/providers/workflow/forms/select-credentials-type/github/select-via-github.tsx
index 7822c4de22..6f1e77996c 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/github/select-via-github.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/github/select-via-github.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupGitHubViaCredentialsTypeForm } from "./radio-group-github-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-certificate-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-certificate-credentials-form.tsx
index bdce76f584..8e256679eb 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-certificate-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-certificate-credentials-form.tsx
@@ -17,10 +17,10 @@ export const M365CertificateCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
App Certificate Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your Microsoft 365 application credentials with
certificate authentication.
</div>
@@ -55,7 +55,7 @@ export const M365CertificateCredentialsForm = ({
isRequired
minRows={4}
/>
- <p className="text-default-500 text-sm">
+ <p className="text-text-neutral-tertiary text-sm">
The certificate content must be base64 encoded from an unsigned
certificate. For detailed instructions on how to generate and encode
your certificate, please refer to the{" "}
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-client-secret-credentials-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-client-secret-credentials-form.tsx
index ab3bef8a93..f48af823bc 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-client-secret-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/m365/credentials-type/m365-client-secret-credentials-form.tsx
@@ -13,10 +13,10 @@ export const M365ClientSecretCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
App Client Secret Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your Microsoft 365 application credentials.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/m365/radio-group-m365-via-credentials-type-form.tsx b/ui/components/providers/workflow/forms/select-credentials-type/m365/radio-group-m365-via-credentials-type-form.tsx
index ed871352a7..97587c521c 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/m365/radio-group-m365-via-credentials-type-form.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/m365/radio-group-m365-via-credentials-type-form.tsx
@@ -3,8 +3,8 @@
import { Control, Controller } from "react-hook-form";
import { WizardRadioCard } from "@/components/providers/workflow/forms/fields";
+import { FormMessage } from "@/components/shadcn/form";
import { RadioGroup } from "@/components/shadcn/radio-group/radio-group";
-import { FormMessage } from "@/components/ui/form";
type RadioGroupM365ViaCredentialsFormProps = {
control: Control<any>;
@@ -33,7 +33,7 @@ export const RadioGroupM365ViaCredentialsTypeForm = ({
onChange?.(value);
}}
>
- <span className="text-default-500 text-sm">
+ <span className="text-text-neutral-tertiary text-sm">
Select Authentication Method
</span>
<WizardRadioCard value="app_client_secret" isInvalid={isInvalid}>
diff --git a/ui/components/providers/workflow/forms/select-credentials-type/m365/select-via-m365.tsx b/ui/components/providers/workflow/forms/select-credentials-type/m365/select-via-m365.tsx
index 71bd260fff..9e3b9d62f0 100644
--- a/ui/components/providers/workflow/forms/select-credentials-type/m365/select-via-m365.tsx
+++ b/ui/components/providers/workflow/forms/select-credentials-type/m365/select-via-m365.tsx
@@ -3,7 +3,7 @@
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { RadioGroupM365ViaCredentialsTypeForm } from "./radio-group-m365-via-credentials-type-form";
diff --git a/ui/components/providers/workflow/forms/test-connection-form.tsx b/ui/components/providers/workflow/forms/test-connection-form.tsx
index 3d6c710b19..503c74e1b0 100644
--- a/ui/components/providers/workflow/forms/test-connection-form.tsx
+++ b/ui/components/providers/workflow/forms/test-connection-form.tsx
@@ -12,7 +12,7 @@ import { z } from "zod";
import { deleteCredentials } from "@/actions/providers";
import { CheckIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { Form } from "@/components/ui/form";
+import { Form } from "@/components/shadcn/form";
import { testProviderConnection } from "@/lib/provider-helpers";
import { ProviderType } from "@/types";
import { testConnectionFormSchema } from "@/types";
@@ -155,7 +155,7 @@ export const TestConnectionForm = ({
>
<div className="text-left">
<div className="mb-2 text-xl font-medium">Check connection</div>
- <p className="text-small text-default-500 py-2">
+ <p className="text-text-neutral-tertiary py-2 text-sm">
{!isUpdated
? "After a successful connection, continue to the launch step to configure and start your scan."
: "A successful connection will redirect you to the providers page."}
@@ -178,12 +178,12 @@ export const TestConnectionForm = ({
/>
</div>
<div className="min-w-0 flex-1">
- <p className="text-small text-text-error-primary break-words">
+ <p className="text-text-error-primary text-sm break-words">
{connectionStatus.error || "Unknown error"}
</p>
</div>
</div>
- <p className="text-small text-text-error-primary">
+ <p className="text-text-error-primary text-sm">
It seems there was an issue with your credentials. Please review
your credentials and try again.
</p>
@@ -198,7 +198,7 @@ export const TestConnectionForm = ({
/>
{isUpdated && !connectionStatus?.error && (
- <p className="text-small text-default-500 py-2">
+ <p className="text-text-neutral-tertiary py-2 text-sm">
Check the new credentials and test the connection.
</p>
)}
diff --git a/ui/components/providers/workflow/forms/via-credentials/azure-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/azure-credentials-form.tsx
index 7551abf919..7fc4ff36d2 100644
--- a/ui/components/providers/workflow/forms/via-credentials/azure-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/azure-credentials-form.tsx
@@ -11,10 +11,10 @@ export const AzureCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide the information for your Azure credentials.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/googleworkspace-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/googleworkspace-credentials-form.tsx
index de692aa1fe..94726893d6 100644
--- a/ui/components/providers/workflow/forms/via-credentials/googleworkspace-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/googleworkspace-credentials-form.tsx
@@ -15,10 +15,10 @@ export const GoogleWorkspaceCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Service Account
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide your Service Account JSON and the admin email to impersonate.
</div>
</div>
@@ -48,7 +48,7 @@ export const GoogleWorkspaceCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Credentials never leave your browser unencrypted and are stored as
secrets in the backend. You can revoke the Service Account from the
Google Cloud Console anytime if needed.
diff --git a/ui/components/providers/workflow/forms/via-credentials/iac-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/iac-credentials-form.tsx
index cd118b7022..4be6b97be6 100644
--- a/ui/components/providers/workflow/forms/via-credentials/iac-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/iac-credentials-form.tsx
@@ -11,10 +11,10 @@ export const IacCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Repository
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide an access token if the repository is private (optional).
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/image-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/image-credentials-form.tsx
index b071b1c013..44b560e464 100644
--- a/ui/components/providers/workflow/forms/via-credentials/image-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/image-credentials-form.tsx
@@ -12,10 +12,10 @@ export const ImageCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Registry Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide registry credentials to authenticate with your container
registry (all fields are optional).
</div>
@@ -52,10 +52,10 @@ export const ImageCredentialsForm = ({
/>
<div className="flex flex-col pt-2">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Scan Scope
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Limit which repositories and tags are scanned using regex patterns.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/k8s-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/k8s-credentials-form.tsx
index 701bffcba5..a0f687e037 100644
--- a/ui/components/providers/workflow/forms/via-credentials/k8s-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/k8s-credentials-form.tsx
@@ -1,20 +1,35 @@
+"use client";
+
import { Control } from "react-hook-form";
+import { useWatch } from "react-hook-form";
import { WizardTextareaField } from "@/components/providers/workflow/forms/fields";
import { KubernetesCredentials } from "@/types";
+import {
+ KUBECONFIG_EXEC_AUTHENTICATION_ERROR,
+ kubeconfigContainsExecAuthentication,
+} from "@/types/formSchemas";
export const KubernetesCredentialsForm = ({
control,
}: {
control: Control<KubernetesCredentials>;
}) => {
+ const kubeconfigContent = useWatch({
+ control,
+ name: "kubeconfig_content",
+ });
+ const hasExecAuthentication = kubeconfigContainsExecAuthentication(
+ kubeconfigContent ?? "",
+ );
+
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Credentials
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide the kubeconfig content for your Kubernetes credentials.
</div>
</div>
@@ -28,6 +43,11 @@ export const KubernetesCredentialsForm = ({
minRows={10}
isRequired
/>
+ {hasExecAuthentication && (
+ <p className="text-text-error-primary text-xs">
+ {KUBECONFIG_EXEC_AUTHENTICATION_ERROR}
+ </p>
+ )}
</>
);
};
diff --git a/ui/components/providers/workflow/forms/via-credentials/mongodbatlas-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/mongodbatlas-credentials-form.tsx
index 582860adae..6baa79441d 100644
--- a/ui/components/providers/workflow/forms/via-credentials/mongodbatlas-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/mongodbatlas-credentials-form.tsx
@@ -12,10 +12,10 @@ export const MongoDBAtlasCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via API Keys
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide an organization-level MongoDB Atlas API public and private key
with read access to the resources you want Prowler to assess.
</div>
@@ -40,7 +40,7 @@ export const MongoDBAtlasCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Keys never leave your browser unencrypted and are stored as secrets in
the backend. Rotate the key from MongoDB Atlas anytime if needed.
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/okta-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/okta-credentials-form.tsx
index 42aa16124b..270afa8e96 100644
--- a/ui/components/providers/workflow/forms/via-credentials/okta-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/okta-credentials-form.tsx
@@ -15,10 +15,10 @@ export const OktaCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via OAuth 2.0 Private Key JWT
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide the Client ID and PEM-encoded private key of an Okta API
Services app whose matching public key (JWK) is registered on the
service app.
@@ -43,7 +43,7 @@ export const OktaCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
The private key is sent over TLS and stored as a secret in the backend.
You can rotate or revoke the public key from the Okta admin console at
any time.
diff --git a/ui/components/providers/workflow/forms/via-credentials/openstack-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/openstack-credentials-form.tsx
index cbc7935f2b..2085fe5f49 100644
--- a/ui/components/providers/workflow/forms/via-credentials/openstack-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/openstack-credentials-form.tsx
@@ -14,10 +14,10 @@ export const OpenStackCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via Clouds YAML
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your OpenStack clouds.yaml content and the cloud name.
</div>
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/oraclecloud-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/oraclecloud-credentials-form.tsx
index 56e5ca4afe..ec989868ea 100644
--- a/ui/components/providers/workflow/forms/via-credentials/oraclecloud-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/oraclecloud-credentials-form.tsx
@@ -15,10 +15,10 @@ export const OracleCloudCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via API Key
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Please provide your Oracle Cloud Infrastructure API key credentials.
</div>
</div>
@@ -48,16 +48,6 @@ export const OracleCloudCredentialsForm = ({
variant="bordered"
isRequired
/>
- <WizardInputField
- control={control}
- name={ProviderCredentialFields.OCI_REGION}
- type="text"
- label="Region"
- labelPlacement="inside"
- placeholder="e.g. us-ashburn-1"
- variant="bordered"
- isRequired
- />
<WizardTextareaField
control={control}
name={ProviderCredentialFields.OCI_KEY_CONTENT}
@@ -78,7 +68,7 @@ export const OracleCloudCredentialsForm = ({
variant="bordered"
isRequired={false}
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Paste the raw content of your OCI private key file (PEM format). The key
will be automatically encoded for secure transmission.
</div>
diff --git a/ui/components/providers/workflow/forms/via-credentials/vercel-credentials-form.tsx b/ui/components/providers/workflow/forms/via-credentials/vercel-credentials-form.tsx
index 559efe6340..170a0e409f 100644
--- a/ui/components/providers/workflow/forms/via-credentials/vercel-credentials-form.tsx
+++ b/ui/components/providers/workflow/forms/via-credentials/vercel-credentials-form.tsx
@@ -12,10 +12,10 @@ export const VercelCredentialsForm = ({
return (
<>
<div className="flex flex-col">
- <div className="text-md text-default-foreground leading-9 font-bold">
+ <div className="text-md text-text-neutral-primary leading-9 font-bold">
Connect via API Token
</div>
- <div className="text-default-500 text-sm">
+ <div className="text-text-neutral-tertiary text-sm">
Provide a Vercel API Token with read permissions to the resources you
want Prowler to assess.
</div>
@@ -30,7 +30,7 @@ export const VercelCredentialsForm = ({
variant="bordered"
isRequired
/>
- <div className="text-default-400 text-xs">
+ <div className="text-text-neutral-tertiary text-xs">
Tokens never leave your browser unencrypted and are stored as secrets in
the backend. You can revoke the token from the Vercel dashboard anytime
at vercel.com/account/tokens.
diff --git a/ui/components/providers/workflow/provider-title-docs.tsx b/ui/components/providers/workflow/provider-title-docs.tsx
index 9afc788e79..3f06dd5f88 100644
--- a/ui/components/providers/workflow/provider-title-docs.tsx
+++ b/ui/components/providers/workflow/provider-title-docs.tsx
@@ -1,7 +1,7 @@
"use client";
-import { getProviderName } from "@/components/ui/entities/get-provider-logo";
-import { getProviderLogo } from "@/components/ui/entities/get-provider-logo";
+import { getProviderName } from "@/components/shadcn/entities/get-provider-logo";
+import { getProviderLogo } from "@/components/shadcn/entities/get-provider-logo";
import { ProviderType } from "@/types";
export const ProviderTitleDocs = ({
diff --git a/ui/components/resources/resource-details-sheet.tsx b/ui/components/resources/resource-details-sheet.tsx
index 1ae3ec0e74..c0603d9124 100644
--- a/ui/components/resources/resource-details-sheet.tsx
+++ b/ui/components/resources/resource-details-sheet.tsx
@@ -1,15 +1,6 @@
"use client";
-import { X } from "lucide-react";
-
-import {
- Drawer,
- DrawerClose,
- DrawerContent,
- DrawerDescription,
- DrawerHeader,
- DrawerTitle,
-} from "@/components/shadcn";
+import { DetailSidePanel } from "@/components/side-panel/detail-side-panel";
import { ResourceProps } from "@/types";
import { ResourceDetailContent } from "./table/resource-detail-content";
@@ -26,20 +17,13 @@ export const ResourceDetailsSheet = ({
onOpenChange,
}: ResourceDetailsSheetProps) => {
return (
- <Drawer direction="right" open={open} onOpenChange={onOpenChange}>
- <DrawerContent className="3xl:w-1/3 h-full w-full overflow-hidden p-6 outline-none md:w-1/2 md:max-w-none md:min-w-[720px]">
- <DrawerHeader className="sr-only">
- <DrawerTitle>Resource Details</DrawerTitle>
- <DrawerDescription>View the resource details</DrawerDescription>
- </DrawerHeader>
- <DrawerClose className="ring-offset-background focus:ring-ring absolute top-4 right-4 rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-none">
- <X className="size-4" />
- <span className="sr-only">Close</span>
- </DrawerClose>
- {open && (
- <ResourceDetailContent key={resource.id} resourceDetails={resource} />
- )}
- </DrawerContent>
- </Drawer>
+ <DetailSidePanel
+ open={open}
+ onOpenChange={onOpenChange}
+ title="Resource Details"
+ description="View the resource details"
+ >
+ <ResourceDetailContent key={resource.id} resourceDetails={resource} />
+ </DetailSidePanel>
);
};
diff --git a/ui/components/resources/resources-filters.tsx b/ui/components/resources/resources-filters.tsx
index d6b90a6c87..562e1844b6 100644
--- a/ui/components/resources/resources-filters.tsx
+++ b/ui/components/resources/resources-filters.tsx
@@ -11,11 +11,13 @@ import {
FilterSummaryStrip,
} from "@/components/filters/filter-summary-strip";
import { ProviderAccountSelectors } from "@/components/filters/provider-account-selectors";
+import { ProviderGroupSelector } from "@/components/filters/provider-group-selector";
import { Button } from "@/components/shadcn";
-import { ExpandableSection } from "@/components/ui/expandable-section";
-import { DataTableFilterCustom } from "@/components/ui/table";
+import { ExpandableSection } from "@/components/shadcn/expandable-section";
+import { DataTableFilterCustom } from "@/components/shadcn/table";
import { useFilterBatch } from "@/hooks/use-filter-batch";
import { getGroupLabel } from "@/lib/categories";
+import { ProviderGroup } from "@/types/components";
import { DATA_TABLE_FILTER_MODE } from "@/types/filters";
import { ProviderProps } from "@/types/providers";
@@ -26,6 +28,7 @@ import {
interface ResourcesFiltersProps {
providers: ProviderProps[];
+ providerGroups?: ProviderGroup[];
uniqueRegions: string[];
uniqueServices: string[];
uniqueResourceTypes: string[];
@@ -40,6 +43,7 @@ const FILTER_CONTROL_COLUMN_CLASS =
export const ResourcesFilters = ({
providers,
+ providerGroups = [],
uniqueRegions,
uniqueServices,
uniqueResourceTypes,
@@ -93,10 +97,12 @@ export const ResourcesFilters = ({
const appliedFilterChips: FilterChip[] = buildResourcesFilterChips(
appliedFilters,
providers,
+ providerGroups,
);
const pendingFilterChips: FilterChip[] = buildResourcesFilterChips(
changedFilters,
providers,
+ providerGroups,
);
const appliedCount = countVisibleFilterKeys(appliedFilters);
const showAppliedRow = appliedFilterChips.length > 0;
@@ -178,6 +184,13 @@ export const ResourcesFilters = ({
providerSelectorClassName={FILTER_CONTROL_COLUMN_CLASS}
accountSelectorClassName={FILTER_CONTROL_COLUMN_CLASS}
/>
+ <div className={FILTER_CONTROL_COLUMN_CLASS}>
+ <ProviderGroupSelector
+ groups={providerGroups}
+ selectedValues={getFilterValue("filter[provider_groups__in]")}
+ onBatchChange={setPending}
+ />
+ </div>
{hasCustomFilters && (
<Button
variant="outline"
diff --git a/ui/components/resources/resources-filters.utils.test.ts b/ui/components/resources/resources-filters.utils.test.ts
new file mode 100644
index 0000000000..f7abda5410
--- /dev/null
+++ b/ui/components/resources/resources-filters.utils.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+
+import type { ProviderGroup } from "@/types/components";
+import type { ProviderProps } from "@/types/providers";
+
+import {
+ buildResourcesFilterChips,
+ getResourcesFilterDisplayValue,
+} from "./resources-filters.utils";
+
+const providerGroups: ProviderGroup[] = [
+ {
+ type: "provider-groups",
+ id: "group-1",
+ attributes: { name: "Production", inserted_at: "", updated_at: "" },
+ relationships: {
+ providers: { meta: { count: 0 }, data: [] },
+ roles: { meta: { count: 0 }, data: [] },
+ },
+ links: { self: "" },
+ },
+];
+
+const providers: ProviderProps[] = [];
+
+describe("getResourcesFilterDisplayValue", () => {
+ it("shows the provider group name for provider_groups filters", () => {
+ expect(
+ getResourcesFilterDisplayValue(
+ "filter[provider_groups__in]",
+ "group-1",
+ providers,
+ providerGroups,
+ ),
+ ).toBe("Production");
+ });
+
+ it("keeps the raw value when the provider group cannot be resolved", () => {
+ expect(
+ getResourcesFilterDisplayValue(
+ "filter[provider_groups__in]",
+ "missing-group",
+ providers,
+ providerGroups,
+ ),
+ ).toBe("missing-group");
+ });
+});
+
+describe("buildResourcesFilterChips", () => {
+ it("labels provider group chips and resolves their names", () => {
+ const chips = buildResourcesFilterChips(
+ { "filter[provider_groups__in]": ["group-1"] },
+ providers,
+ providerGroups,
+ );
+
+ expect(chips).toEqual([
+ {
+ key: "filter[provider_groups__in]",
+ label: "Provider Group",
+ value: "group-1",
+ displayValue: "Production",
+ },
+ ]);
+ });
+});
diff --git a/ui/components/resources/resources-filters.utils.ts b/ui/components/resources/resources-filters.utils.ts
index cbfdf4441a..805cf2ace1 100644
--- a/ui/components/resources/resources-filters.utils.ts
+++ b/ui/components/resources/resources-filters.utils.ts
@@ -1,11 +1,15 @@
+import type { ResourcesFilterParam } from "@/actions/resources/resources-filters";
import type { FilterChip } from "@/components/filters/filter-summary-strip";
import { formatLabel, getGroupLabel } from "@/lib/categories";
+import { getProviderGroupDisplayValue } from "@/lib/helper-filters";
+import type { ProviderGroup } from "@/types/components";
import type { ProviderProps } from "@/types/providers";
import { getProviderDisplayName } from "@/types/providers";
-const RESOURCE_FILTER_KEY_LABELS: Record<string, string> = {
+const RESOURCE_FILTER_KEY_LABELS: Record<ResourcesFilterParam, string> = {
"filter[provider_type__in]": "Provider",
"filter[provider_id__in]": "Account",
+ "filter[provider_groups__in]": "Provider Group",
"filter[region__in]": "Region",
"filter[service__in]": "Service",
"filter[type__in]": "Type",
@@ -28,6 +32,7 @@ export function getResourcesFilterDisplayValue(
filterKey: string,
value: string,
providers: ProviderProps[],
+ providerGroups: ProviderGroup[] = [],
): string {
if (!value) return value;
@@ -39,6 +44,10 @@ export function getResourcesFilterDisplayValue(
return getProviderAccountDisplayValue(value, providers);
}
+ if (filterKey === "filter[provider_groups__in]") {
+ return getProviderGroupDisplayValue(value, providerGroups);
+ }
+
if (filterKey === "filter[groups__in]") {
return getGroupLabel(value);
}
@@ -53,15 +62,17 @@ export function getResourcesFilterDisplayValue(
export function buildResourcesFilterChips(
pendingFilters: Record<string, string[]>,
providers: ProviderProps[],
+ providerGroups: ProviderGroup[] = [],
): FilterChip[] {
const chips: FilterChip[] = [];
Object.entries(pendingFilters).forEach(([key, values]) => {
if (!values || values.length === 0) return;
- const label = RESOURCE_FILTER_KEY_LABELS[key] ?? key;
+ const label =
+ RESOURCE_FILTER_KEY_LABELS[key as ResourcesFilterParam] ?? key;
const displayValues = values.map((value) =>
- getResourcesFilterDisplayValue(key, value, providers),
+ getResourcesFilterDisplayValue(key, value, providers, providerGroups),
);
const chip: FilterChip = {
diff --git a/ui/components/resources/skeleton/skeleton-table-resources.tsx b/ui/components/resources/skeleton/skeleton-table-resources.tsx
index 8a9fde1492..58300dedd3 100644
--- a/ui/components/resources/skeleton/skeleton-table-resources.tsx
+++ b/ui/components/resources/skeleton/skeleton-table-resources.tsx
@@ -55,7 +55,7 @@ export const SkeletonTableResources = () => {
const rows = 10;
return (
- <div className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden border p-4">
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
{/* Toolbar: Search + Total entries */}
<div className="flex items-center justify-between">
{/* Search icon button */}
diff --git a/ui/components/resources/table/column-resources.tsx b/ui/components/resources/table/column-resources.tsx
index 4fb32da3de..69fd4a03dc 100644
--- a/ui/components/resources/table/column-resources.tsx
+++ b/ui/components/resources/table/column-resources.tsx
@@ -7,8 +7,8 @@ import {
ActionDropdown,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
-import { EntityInfo } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { EntityInfo } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { getGroupLabel } from "@/lib/categories";
import { getRegionFlag } from "@/lib/region-flags";
import { ProviderType, ResourceProps } from "@/types";
diff --git a/ui/components/resources/table/resource-detail-content.tsx b/ui/components/resources/table/resource-detail-content.tsx
index 1d1e5c4c23..fba3949bc8 100644
--- a/ui/components/resources/table/resource-detail-content.tsx
+++ b/ui/components/resources/table/resource-detail-content.tsx
@@ -4,6 +4,10 @@ import { Row, RowSelectionState } from "@tanstack/react-table";
import { Container, CornerDownRight, Link } from "lucide-react";
import { useState } from "react";
+import {
+ loadLatestFindingTriageNote,
+ updateFindingTriage,
+} from "@/actions/findings";
import { FloatingMuteButton } from "@/components/findings/floating-mute-button";
import { FindingDetailDrawer } from "@/components/findings/table";
import {
@@ -15,21 +19,26 @@ import {
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn";
+import {
+ BreadcrumbNavigation,
+ CustomBreadcrumbItem,
+} from "@/components/shadcn";
+import { DateWithTime } from "@/components/shadcn/entities/date-with-time";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import {
InfoField,
InfoTooltip,
} from "@/components/shadcn/info-field/info-field";
import { LoadingState } from "@/components/shadcn/spinner/loading-state";
+import { DataTable } from "@/components/shadcn/table";
import { EventsTimeline } from "@/components/shared/events-timeline/events-timeline";
import { ExternalResourceLink } from "@/components/shared/external-resource-link";
import { ResourceMetadataPanel } from "@/components/shared/resource-metadata-panel";
-import { BreadcrumbNavigation, CustomBreadcrumbItem } from "@/components/ui";
-import { DateWithTime } from "@/components/ui/entities/date-with-time";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
-import { DataTable } from "@/components/ui/table";
import { getGroupLabel } from "@/lib/categories";
+import { shouldRefreshAfterTriageUpdate } from "@/lib/finding-triage";
import { getRegionFlag } from "@/lib/region-flags";
import { ProviderType, ResourceProps } from "@/types";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
import {
getResourceFindingsColumns,
@@ -100,6 +109,7 @@ export const ResourceDetailContent = ({
hasInitiallyLoaded,
providerOrg,
resourceTags,
+ patchTriageUpdate,
} = useResourceDrawerBootstrap({
resourceId,
resourceUid: attributes.uid,
@@ -140,6 +150,17 @@ export const ResourceDetailContent = ({
if (ids.length > 0) setFindingsReloadNonce((v) => v + 1);
};
+ const handleTriageUpdate = async (input: UpdateFindingTriageInput) => {
+ await updateFindingTriage(input);
+
+ if (shouldRefreshAfterTriageUpdate(input)) {
+ setFindingsReloadNonce((value) => value + 1);
+ return;
+ }
+
+ patchTriageUpdate(input);
+ };
+
const failedFindings = findingsData;
const selectableRowCount = failedFindings.filter(
@@ -161,6 +182,8 @@ export const ResourceDetailContent = ({
selectableRowCount,
navigateToFinding,
handleMuteComplete,
+ handleTriageUpdate,
+ loadLatestFindingTriageNote,
);
const findingTitle =
diff --git a/ui/components/resources/table/resource-findings-columns.test.tsx b/ui/components/resources/table/resource-findings-columns.test.tsx
new file mode 100644
index 0000000000..118d5503da
--- /dev/null
+++ b/ui/components/resources/table/resource-findings-columns.test.tsx
@@ -0,0 +1,161 @@
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@/components/findings/table", () => ({
+ DataTableRowActions: ({
+ row,
+ onTriageUpdateAction,
+ }: {
+ row: { original: ResourceFinding };
+ onTriageUpdateAction?: unknown;
+ }) => (
+ <button disabled={!row.original.triage || !onTriageUpdateAction}>
+ {row.original.triage ? "Add Triage Note" : "-"}
+ </button>
+ ),
+ FindingTriageStatusCell: ({ triage }: { triage?: { label: string } }) =>
+ triage ? (
+ <button aria-label="Triage status">{triage.label}</button>
+ ) : (
+ <span>-</span>
+ ),
+}));
+
+vi.mock("@/components/findings/table/notification-indicator", () => ({
+ NotificationIndicator: () => null,
+}));
+
+vi.mock("@/components/shadcn", () => ({
+ Checkbox: ({ "aria-label": ariaLabel }: { "aria-label"?: string }) => (
+ <input type="checkbox" aria-label={ariaLabel} />
+ ),
+}));
+
+vi.mock("@/components/shadcn/entities", () => ({
+ DateWithTime: ({ dateTime }: { dateTime: string }) => <time>{dateTime}</time>,
+}));
+
+vi.mock("@/components/shadcn/table", () => ({
+ DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
+ SeverityBadge: ({ severity }: { severity: string }) => (
+ <span>{severity}</span>
+ ),
+ StatusFindingBadge: ({ status }: { status: string }) => <span>{status}</span>,
+}));
+
+import {
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+import {
+ getResourceFindingsColumns,
+ type ResourceFinding,
+} from "./resource-findings-columns";
+
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "prowler-finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
+function makeFinding(overrides?: Partial<ResourceFinding>): ResourceFinding {
+ return {
+ type: "findings",
+ id: "finding-1",
+ triage: makeTriageSummary(),
+ attributes: {
+ status: "FAIL",
+ severity: "critical",
+ muted: false,
+ updated_at: "2026-03-30T10:05:00Z",
+ check_metadata: {
+ checktitle: "S3 public access",
+ },
+ },
+ ...overrides,
+ };
+}
+
+function getColumnIds(columns: ReturnType<typeof getResourceFindingsColumns>) {
+ return columns.map(
+ (column) =>
+ (column as { id?: string; accessorKey?: string }).id ??
+ (column as { id?: string; accessorKey?: string }).accessorKey,
+ );
+}
+
+describe("resource-findings-columns", () => {
+ it("should render Triage before actions without adding a Notes column", () => {
+ // Given
+ const columns = getResourceFindingsColumns({}, 1, vi.fn());
+
+ // When
+ const columnIds = getColumnIds(columns);
+
+ // Then
+ expect(columnIds.slice(-2)).toEqual(["triage", "actions"]);
+ expect(columnIds).not.toContain("notes");
+ });
+
+ it("should render triage status and Add Triage Note action from the finding DTO", () => {
+ // Given
+ const columns = getResourceFindingsColumns(
+ {},
+ 1,
+ vi.fn(),
+ vi.fn(),
+ vi.fn(),
+ );
+ const triageColumn = columns.find(
+ (col) => (col as { id?: string }).id === "triage",
+ );
+ const actionsColumn = columns.find(
+ (col) => (col as { id?: string }).id === "actions",
+ );
+ if (!triageColumn?.cell || !actionsColumn?.cell) {
+ throw new Error("triage/actions columns not found");
+ }
+ const finding = makeFinding({
+ triage: makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ }),
+ });
+ const TriageCell = triageColumn.cell as (props: {
+ row: { original: ResourceFinding };
+ }) => ReactNode;
+ const ActionsCell = actionsColumn.cell as (props: {
+ row: { original: ResourceFinding };
+ }) => ReactNode;
+
+ // When
+ render(
+ <div>
+ {TriageCell({ row: { original: finding } })}
+ {ActionsCell({ row: { original: finding } })}
+ </div>,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("button", { name: "Triage status" }),
+ ).toHaveTextContent("Remediating");
+ expect(
+ screen.getByRole("button", { name: "Add Triage Note" }),
+ ).toBeEnabled();
+ });
+});
diff --git a/ui/components/resources/table/resource-findings-columns.tsx b/ui/components/resources/table/resource-findings-columns.tsx
index 94426e0fbe..11d6dac7c7 100644
--- a/ui/components/resources/table/resource-findings-columns.tsx
+++ b/ui/components/resources/table/resource-findings-columns.tsx
@@ -2,23 +2,32 @@
import { ColumnDef, RowSelectionState } from "@tanstack/react-table";
-import { DataTableRowActions } from "@/components/findings/table";
+import {
+ DataTableRowActions,
+ FindingTriageStatusCell,
+} from "@/components/findings/table";
+import type { FindingTriageUpdateHandler } from "@/components/findings/table/finding-triage-status-control";
import {
DeltaType,
NotificationIndicator,
} from "@/components/findings/table/notification-indicator";
import { Checkbox } from "@/components/shadcn";
-import { DateWithTime } from "@/components/ui/entities";
+import { DateWithTime } from "@/components/shadcn/entities";
import {
DataTableColumnHeader,
Severity,
SeverityBadge,
StatusFindingBadge,
-} from "@/components/ui/table";
+} from "@/components/shadcn/table";
+import type {
+ FindingTriageLoadedNote,
+ FindingTriageSummary,
+} from "@/types/findings-triage";
export interface ResourceFinding {
type: "findings";
id: string;
+ triage?: FindingTriageSummary;
attributes: {
status: "PASS" | "FAIL" | "MANUAL";
severity: Severity;
@@ -37,6 +46,10 @@ export const getResourceFindingsColumns = (
selectableRowCount: number,
onNavigate: (id: string) => void,
onMuteComplete?: (findingIds: string[]) => void,
+ onTriageUpdateAction?: FindingTriageUpdateHandler,
+ onTriageNoteLoadAction?: (
+ triage: FindingTriageSummary,
+ ) => Promise<FindingTriageLoadedNote>,
): ColumnDef<ResourceFinding>[] => {
const selectedCount = Object.values(rowSelection).filter(Boolean).length;
const isAllSelected =
@@ -136,11 +149,29 @@ export const getResourceFindingsColumns = (
),
enableSorting: false,
},
+ {
+ id: "triage",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Triage" />
+ ),
+ cell: ({ row }) => (
+ <FindingTriageStatusCell
+ triage={row.original.triage}
+ onTriageUpdateAction={onTriageUpdateAction}
+ />
+ ),
+ enableSorting: false,
+ },
{
id: "actions",
header: () => <div className="w-10" />,
cell: ({ row }) => (
- <DataTableRowActions row={row} onMuteComplete={onMuteComplete} />
+ <DataTableRowActions
+ row={row}
+ onMuteComplete={onMuteComplete}
+ onTriageUpdateAction={onTriageUpdateAction}
+ onTriageNoteLoadAction={onTriageNoteLoadAction}
+ />
),
enableSorting: false,
},
diff --git a/ui/components/resources/table/resources-table-with-selection.tsx b/ui/components/resources/table/resources-table-with-selection.tsx
index 97a23e78b3..56fc1a9ff7 100644
--- a/ui/components/resources/table/resources-table-with-selection.tsx
+++ b/ui/components/resources/table/resources-table-with-selection.tsx
@@ -3,7 +3,7 @@
import { useState } from "react";
import { ResourceDetailsSheet } from "@/components/resources/resource-details-sheet";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import { MetaDataProps, ResourceProps } from "@/types";
import { getColumnResources } from "./column-resources";
diff --git a/ui/components/resources/table/use-resource-drawer-bootstrap.test.ts b/ui/components/resources/table/use-resource-drawer-bootstrap.test.ts
new file mode 100644
index 0000000000..d853f2b8ec
--- /dev/null
+++ b/ui/components/resources/table/use-resource-drawer-bootstrap.test.ts
@@ -0,0 +1,115 @@
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { getResourceDrawerDataMock } = vi.hoisted(() => ({
+ getResourceDrawerDataMock: vi.fn(),
+}));
+
+vi.mock("@/actions/resources", () => ({
+ getResourceDrawerData: getResourceDrawerDataMock,
+}));
+
+import {
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+import type { ResourceFinding } from "./resource-findings-columns";
+import { useResourceDrawerBootstrap } from "./use-resource-drawer-bootstrap";
+
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
+function makeFinding(overrides?: Partial<ResourceFinding>): ResourceFinding {
+ return {
+ type: "findings",
+ id: "finding-1",
+ triage: makeTriageSummary(),
+ attributes: {
+ status: "FAIL",
+ severity: "critical",
+ muted: false,
+ muted_reason: undefined,
+ updated_at: "2026-03-30T10:05:00Z",
+ check_metadata: {
+ checktitle: "S3 public access",
+ },
+ },
+ ...overrides,
+ };
+}
+
+function renderBootstrap(findingsReloadNonce = 0) {
+ return renderHook(() =>
+ useResourceDrawerBootstrap({
+ resourceId: "resource-1",
+ resourceUid: "resource-uid-1",
+ providerId: "provider-1",
+ providerType: "aws",
+ currentPage: 1,
+ pageSize: 10,
+ searchQuery: "",
+ findingsReloadNonce,
+ }),
+ );
+}
+
+describe("useResourceDrawerBootstrap", () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ getResourceDrawerDataMock.mockResolvedValue({
+ findings: [makeFinding()],
+ findingsMeta: null,
+ providerOrg: null,
+ resourceTags: {},
+ });
+ });
+
+ it("should patch finding triage locally without reloading drawer data", async () => {
+ // Given
+ const { result } = renderBootstrap();
+
+ await waitFor(() => expect(result.current.findingsLoading).toBe(false));
+ const loadCount = getResourceDrawerDataMock.mock.calls.length;
+
+ // When
+ act(() => {
+ result.current.patchTriageUpdate({
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ isMuted: false,
+ note: "Investigating",
+ });
+ });
+
+ // Then
+ expect(result.current.findingsData[0]?.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ hasVisibleNote: true,
+ notesCount: 1,
+ }),
+ );
+ expect(getResourceDrawerDataMock).toHaveBeenCalledTimes(loadCount);
+ });
+});
diff --git a/ui/components/resources/table/use-resource-drawer-bootstrap.ts b/ui/components/resources/table/use-resource-drawer-bootstrap.ts
index 7508a70626..675bf337b0 100644
--- a/ui/components/resources/table/use-resource-drawer-bootstrap.ts
+++ b/ui/components/resources/table/use-resource-drawer-bootstrap.ts
@@ -3,7 +3,9 @@
import { useEffect, useState } from "react";
import { getResourceDrawerData } from "@/actions/resources";
+import { applyOptimisticFindingTriageRowsUpdate } from "@/lib/finding-triage";
import { MetaDataProps } from "@/types";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
import { OrganizationResource } from "@/types/organizations";
import { ResourceFinding } from "./resource-findings-columns";
@@ -26,6 +28,7 @@ interface UseResourceDrawerBootstrapReturn {
hasInitiallyLoaded: boolean;
providerOrg: OrganizationResource | null;
resourceTags: Record<string, string>;
+ patchTriageUpdate: (input: UpdateFindingTriageInput) => void;
}
export function useResourceDrawerBootstrap({
@@ -48,6 +51,12 @@ export function useResourceDrawerBootstrap({
null,
);
+ const patchTriageUpdate = (input: UpdateFindingTriageInput) => {
+ setFindingsData((findings) =>
+ applyOptimisticFindingTriageRowsUpdate(findings, input),
+ );
+ };
+
useEffect(() => {
let cancelled = false;
@@ -111,5 +120,6 @@ export function useResourceDrawerBootstrap({
hasInitiallyLoaded,
providerOrg,
resourceTags,
+ patchTriageUpdate,
};
}
diff --git a/ui/components/roles/table/column-roles.tsx b/ui/components/roles/table/column-roles.tsx
index d65be6f253..00350373b5 100644
--- a/ui/components/roles/table/column-roles.tsx
+++ b/ui/components/roles/table/column-roles.tsx
@@ -2,8 +2,8 @@
import { ColumnDef } from "@tanstack/react-table";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { RolesProps } from "@/types";
import { DataTableRowActions } from "./data-table-row-actions";
diff --git a/ui/components/roles/table/skeleton-table-roles.tsx b/ui/components/roles/table/skeleton-table-roles.tsx
index 15372fdc91..9505f6f23e 100644
--- a/ui/components/roles/table/skeleton-table-roles.tsx
+++ b/ui/components/roles/table/skeleton-table-roles.tsx
@@ -1,37 +1,102 @@
-import React from "react";
-
-import { Card } from "@/components/shadcn/card/card";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-export const SkeletonTableRoles = () => {
+const SkeletonTableRow = () => {
return (
- <Card variant="base" padding="md" className="flex flex-col gap-4">
- {/* Table headers */}
- <div className="hidden gap-4 md:flex">
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-1/12" />
- </div>
-
- {/* Table body */}
- <div className="flex flex-col gap-3">
- {[...Array(10)].map((_, index) => (
- <div
- key={index}
- className="flex flex-col gap-4 md:flex-row md:items-center"
- >
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-1/12" />
- </div>
- ))}
- </div>
- </Card>
+ <tr className="border-border-neutral-secondary border-b last:border-b-0">
+ {/* Role - bold name text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-32 rounded" />
+ </td>
+ {/* Users - count text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-16 rounded" />
+ </td>
+ {/* Invitations - count text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-20 rounded" />
+ </td>
+ {/* Permissions - state text */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-20 rounded" />
+ </td>
+ {/* Added - date */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Actions */}
+ <td className="px-2 py-4">
+ <Skeleton className="size-6 rounded" />
+ </td>
+ </tr>
+ );
+};
+
+export const SkeletonTableRoles = () => {
+ const rows = 10;
+
+ return (
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
+ {/* Toolbar: Search + Total entries */}
+ <div className="flex items-center justify-between">
+ {/* Search icon button */}
+ <Skeleton className="size-10 rounded-md" />
+ {/* Total entries */}
+ <Skeleton className="h-4 w-28 rounded" />
+ </div>
+
+ {/* Table */}
+ <table className="w-full">
+ <thead>
+ <tr className="border-border-neutral-secondary border-b">
+ {/* Role */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-12 rounded" />
+ </th>
+ {/* Users */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-14 rounded" />
+ </th>
+ {/* Invitations */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-20 rounded" />
+ </th>
+ {/* Permissions */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-24 rounded" />
+ </th>
+ {/* Added */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-14 rounded" />
+ </th>
+ {/* Actions - empty header */}
+ <th className="w-10 py-3" />
+ </tr>
+ </thead>
+ <tbody>
+ {Array.from({ length: rows }).map((_, i) => (
+ <SkeletonTableRow key={i} />
+ ))}
+ </tbody>
+ </table>
+
+ {/* Pagination */}
+ <div className="flex items-center justify-between pt-2">
+ {/* Rows per page */}
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-4 w-24 rounded" />
+ <Skeleton className="h-9 w-16 rounded-md" />
+ </div>
+ {/* Page info + navigation */}
+ <div className="flex items-center gap-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ <div className="flex gap-1">
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ </div>
+ </div>
+ </div>
+ </div>
);
};
diff --git a/ui/components/roles/workflow/forms/add-role-form.test.tsx b/ui/components/roles/workflow/forms/add-role-form.test.tsx
index 80a9c523b3..e5e791fe07 100644
--- a/ui/components/roles/workflow/forms/add-role-form.test.tsx
+++ b/ui/components/roles/workflow/forms/add-role-form.test.tsx
@@ -1,6 +1,6 @@
import { render, screen } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
import { AddRoleForm } from "./add-role-form";
@@ -72,10 +72,22 @@ vi.mock("@/components/shadcn/select/enhanced-multi-select", () => ({
EnhancedMultiSelect: () => <div data-testid="group-select" />,
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: vi.fn() }),
}));
+beforeAll(() => {
+ class ResizeObserverMock {
+ observe() {}
+ unobserve() {}
+ disconnect() {}
+ }
+
+ globalThis.ResizeObserver = ResizeObserverMock;
+ window.ResizeObserver = ResizeObserverMock;
+});
+
describe("AddRoleForm", () => {
afterEach(() => {
routerMocks.push.mockClear();
@@ -117,4 +129,213 @@ describe("AddRoleForm", () => {
// Then
expect(routerMocks.push).toHaveBeenCalledWith("/roles");
});
+
+ it("shows a subtle inline Unlimited Visibility description", () => {
+ // Given / When
+ render(<AddRoleForm groups={[]} />);
+
+ // Then
+ expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+ expect(
+ screen.getByText(
+ "Checking the box below grants visibility into every provider: resources, findings, scans, and compliance results, regardless of the provider groups selected.",
+ ),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByText(/required to use the Jira integration/i),
+ ).toHaveProperty("tagName", "STRONG");
+ expect(
+ screen.getByRole("link", { name: /learn more about provider groups/i }),
+ ).toHaveAttribute(
+ "href",
+ "https://docs.prowler.com/user-guide/tutorials/prowler-app-rbac#provider-groups",
+ );
+ expect(
+ screen.queryByRole("heading", { name: "Unlimited Visibility" }),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(
+ /does not grant admin actions such as managing users, providers, scans, integrations, billing, or alerts/i,
+ ),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(
+ /enable it only for roles that need organization-wide security visibility/i,
+ ),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(
+ /manage providers enables unlimited visibility in this form because provider administration needs organization-wide provider-group context/i,
+ ),
+ ).not.toBeInTheDocument();
+
+ const visibilityHeading = screen.getByText("Visibility");
+ const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ });
+
+ expect(
+ visibilityHeading.compareDocumentPosition(unlimitedVisibilityCheckbox) &
+ Node.DOCUMENT_POSITION_FOLLOWING,
+ ).toBeTruthy();
+ });
+
+ it("keeps the Visibility section and hides only groups when Unlimited Visibility is enabled", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[{ id: "group-1", name: "Production" }]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+
+ // Then
+ expect(screen.getByText("Visibility")).toBeInTheDocument();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).toBeChecked();
+ expect(
+ screen.getByText(/checking the box below grants visibility/i),
+ ).toBeInTheDocument();
+ expect(screen.queryByTestId("group-select")).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(/select the groups this role will have access to/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("does not force Unlimited Visibility when Manage Providers is selected", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ expect(
+ screen.queryByText(
+ /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+ ),
+ ).not.toBeInTheDocument();
+ });
+
+ it("does not force Unlimited Visibility when granting all admin permissions", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ });
+
+ it("keeps Unlimited Visibility user-controlled when Manage Providers is selected", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ expect(screen.getByTestId("group-select")).toBeInTheDocument();
+ });
+
+ it("keeps explicitly enabled Unlimited Visibility when all admin permissions are toggled off", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).not.toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).toBeChecked();
+ });
+
+ it("does not show extra Manage Providers guidance for explicitly enabled Unlimited Visibility", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<AddRoleForm groups={[]} />);
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ );
+
+ // Then
+ expect(
+ screen.queryByText(
+ /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+ ),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(/remove this automatic visibility grant/i),
+ ).not.toBeInTheDocument();
+ });
});
diff --git a/ui/components/roles/workflow/forms/add-role-form.tsx b/ui/components/roles/workflow/forms/add-role-form.tsx
index 2ae5db944d..7795500e15 100644
--- a/ui/components/roles/workflow/forms/add-role-form.tsx
+++ b/ui/components/roles/workflow/forms/add-role-form.tsx
@@ -1,85 +1,38 @@
"use client";
-import { Checkbox } from "@heroui/checkbox";
-import { Divider } from "@heroui/divider";
-import { Tooltip } from "@heroui/tooltip";
-import { zodResolver } from "@hookform/resolvers/zod";
-import clsx from "clsx";
-import { InfoIcon } from "lucide-react";
import { useRouter } from "next/navigation";
-import { useEffect } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { z } from "zod";
+import { DefaultValues } from "react-hook-form";
import { addRole } from "@/actions/roles/roles";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
-import { getErrorMessage, permissionFormFields } from "@/lib";
-import { addRoleFormSchema, ApiError } from "@/types";
+import { useToast } from "@/components/shadcn";
+import { getErrorMessage } from "@/lib";
+import { RoleFormValues } from "@/types";
-type FormValues = z.input<typeof addRoleFormSchema>;
+import { RoleForm, RoleFormSubmitContext, RoleGroupOption } from "./role-form";
-export const AddRoleForm = ({
- groups,
-}: {
- groups: { id: string; name: string }[];
-}) => {
+export const AddRoleForm = ({ groups }: { groups: RoleGroupOption[] }) => {
const { toast } = useToast();
const router = useRouter();
const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
- const visiblePermissionFormFields = permissionFormFields.filter(
- (permission) =>
- !["manage_billing", "manage_alerts"].includes(permission.field) ||
- isCloudEnvironment,
- );
- const form = useForm<FormValues>({
- resolver: zodResolver(addRoleFormSchema),
- defaultValues: {
- name: "",
- manage_users: false,
- manage_providers: false,
- manage_integrations: false,
- manage_scans: false,
- unlimited_visibility: false,
- groups: [],
- ...(isCloudEnvironment && {
- manage_billing: false,
- manage_alerts: false,
- }),
- },
- });
-
- const { watch, setValue } = form;
-
- const manageProviders = watch("manage_providers");
- const unlimitedVisibility = watch("unlimited_visibility");
-
- useEffect(() => {
- if (manageProviders && !unlimitedVisibility) {
- setValue("unlimited_visibility", true, {
- shouldValidate: true,
- shouldDirty: true,
- shouldTouch: true,
- });
- }
- }, [manageProviders, unlimitedVisibility, setValue]);
-
- const isLoading = form.formState.isSubmitting;
-
- const onSelectAllChange = (checked: boolean) => {
- visiblePermissionFormFields.forEach(({ field }) => {
- form.setValue(field as keyof FormValues, checked, {
- shouldValidate: true,
- shouldDirty: true,
- shouldTouch: true,
- });
- });
+ const defaultValues: DefaultValues<RoleFormValues> = {
+ name: "",
+ manage_users: false,
+ manage_providers: false,
+ manage_integrations: false,
+ manage_scans: false,
+ unlimited_visibility: false,
+ groups: [],
+ ...(isCloudEnvironment && {
+ manage_billing: false,
+ manage_alerts: false,
+ }),
};
- const onSubmitClient = async (values: FormValues) => {
+ const onSubmit = async (
+ values: RoleFormValues,
+ { handleServerResponse }: RoleFormSubmitContext,
+ ) => {
const formData = new FormData();
formData.append("name", values.name);
@@ -107,33 +60,13 @@ export const AddRoleForm = ({
try {
const data = await addRole(formData);
+ if (!handleServerResponse(data)) return;
- if (data?.errors && data.errors.length > 0) {
- data.errors.forEach((error: ApiError) => {
- const errorMessage = error.detail;
- const pointer = error.source?.pointer;
- switch (pointer) {
- case "/data/attributes/name":
- form.setError("name", {
- type: "server",
- message: errorMessage,
- });
- break;
- default:
- toast({
- variant: "destructive",
- title: "Error",
- description: errorMessage,
- });
- }
- });
- } else {
- toast({
- title: "Role Added",
- description: "The role was added successfully.",
- });
- router.push("/roles");
- }
+ toast({
+ title: "Role Added",
+ description: "The role was added successfully.",
+ });
+ router.push("/roles");
} catch (error) {
toast({
variant: "destructive",
@@ -144,120 +77,11 @@ export const AddRoleForm = ({
};
return (
- <Form {...form}>
- <form
- onSubmit={form.handleSubmit(onSubmitClient)}
- className="flex flex-col gap-6"
- >
- <CustomInput
- control={form.control}
- name="name"
- type="text"
- label="Role Name"
- labelPlacement="inside"
- placeholder="Enter role name"
- variant="bordered"
- isRequired
- />
-
- <div className="flex flex-col gap-4">
- <span className="text-lg font-semibold">Admin Permissions</span>
-
- {/* Select All Checkbox */}
- <Checkbox
- isSelected={visiblePermissionFormFields.every((perm) =>
- form.watch(perm.field as keyof FormValues),
- )}
- onChange={(e) => onSelectAllChange(e.target.checked)}
- classNames={{
- label: "text-small",
- wrapper: "checkbox-update",
- }}
- color="default"
- >
- Grant all admin permissions
- </Checkbox>
-
- {/* Permissions Grid */}
- <div className="grid grid-cols-2 gap-4">
- {visiblePermissionFormFields.map(
- ({ field, label, description }) => (
- <div key={field} className="flex items-center gap-2">
- <Checkbox
- {...form.register(field as keyof FormValues)}
- isSelected={!!form.watch(field as keyof FormValues)}
- classNames={{
- label: "text-small",
- wrapper: "checkbox-update",
- }}
- color="default"
- >
- {label}
- </Checkbox>
- <Tooltip content={description} placement="right">
- <div className="flex w-fit items-center justify-center">
- <InfoIcon
- className={clsx(
- "text-default-400 group-data-[selected=true]:text-foreground cursor-pointer",
- )}
- aria-hidden={"true"}
- width={16}
- />
- </div>
- </Tooltip>
- </div>
- ),
- )}
- </div>
- </div>
- <Divider className="my-4" />
-
- {!unlimitedVisibility && (
- <div className="flex flex-col gap-4">
- <span className="text-lg font-semibold">
- Groups and Account Visibility
- </span>
-
- <p className="text-small text-default-700 font-medium">
- Select the groups this role will have access to. If no groups are
- selected and unlimited visibility is not enabled, the role will
- not have access to any accounts.
- </p>
-
- <Controller
- name="groups"
- control={form.control}
- render={({ field }) => (
- <div className="flex flex-col gap-2">
- <EnhancedMultiSelect
- options={groups.map((group) => ({
- label: group.name,
- value: group.id,
- }))}
- onValueChange={field.onChange}
- defaultValue={field.value || []}
- placeholder="Select groups"
- searchable={true}
- hideSelectAll={true}
- emptyIndicator="No results found"
- resetOnDefaultValueChange={true}
- />
- </div>
- )}
- />
- {form.formState.errors.groups && (
- <p className="mt-2 text-sm text-red-600">
- {form.formState.errors.groups.message}
- </p>
- )}
- </div>
- )}
- <FormButtons
- submitText="Add Role"
- isDisabled={isLoading}
- onCancel={() => router.push("/roles")}
- />
- </form>
- </Form>
+ <RoleForm
+ groups={groups}
+ defaultValues={defaultValues}
+ submitText="Add Role"
+ onSubmit={onSubmit}
+ />
);
};
diff --git a/ui/components/roles/workflow/forms/delete-role-form.tsx b/ui/components/roles/workflow/forms/delete-role-form.tsx
index 94c1f7b9c3..0c4aa127f1 100644
--- a/ui/components/roles/workflow/forms/delete-role-form.tsx
+++ b/ui/components/roles/workflow/forms/delete-role-form.tsx
@@ -8,8 +8,8 @@ import * as z from "zod";
import { deleteRole } from "@/actions/roles";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
const formSchema = z.object({
roleId: z.string(),
diff --git a/ui/components/roles/workflow/forms/edit-role-form.test.tsx b/ui/components/roles/workflow/forms/edit-role-form.test.tsx
new file mode 100644
index 0000000000..0bc69c8ffd
--- /dev/null
+++ b/ui/components/roles/workflow/forms/edit-role-form.test.tsx
@@ -0,0 +1,332 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { EditRoleForm } from "./edit-role-form";
+
+const routerMocks = vi.hoisted(() => ({
+ push: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+ useRouter: () => routerMocks,
+}));
+
+vi.mock("@/actions/roles/roles", () => ({
+ updateRole: vi.fn(),
+}));
+
+vi.mock("@/lib", () => ({
+ cn: (...classes: Array<string | false | null | undefined>) =>
+ classes.filter(Boolean).join(" "),
+ getErrorMessage: (error: unknown) => String(error),
+ permissionFormFields: [
+ {
+ field: "manage_users",
+ label: "Invite and Manage Users",
+ description:
+ "Allows inviting new users and managing existing user details",
+ },
+ {
+ field: "manage_account",
+ label: "Manage Account",
+ description: "Provides access to account settings and RBAC configuration",
+ },
+ {
+ field: "unlimited_visibility",
+ label: "Unlimited Visibility",
+ description:
+ "Provides complete visibility across all the providers and its related resources",
+ },
+ {
+ field: "manage_providers",
+ label: "Manage Providers",
+ description:
+ "Allows configuration and management of provider connections",
+ },
+ {
+ field: "manage_integrations",
+ label: "Manage Integrations",
+ description:
+ "Allows configuration and management of third-party integrations",
+ },
+ {
+ field: "manage_scans",
+ label: "Manage Scans",
+ description: "Allows launching and configuring scans security scans",
+ },
+ {
+ field: "manage_alerts",
+ label: "Manage Alerts",
+ description: "Allows creating and managing custom alerts",
+ },
+ {
+ field: "manage_billing",
+ label: "Manage Billing",
+ description: "Provides access to billing settings and invoices",
+ },
+ ],
+}));
+
+vi.mock("@/components/shadcn/select/enhanced-multi-select", () => ({
+ EnhancedMultiSelect: () => <div data-testid="group-select" />,
+}));
+
+vi.mock("@/components/ui", () => ({
+ useToast: () => ({ toast: vi.fn() }),
+}));
+
+beforeAll(() => {
+ class ResizeObserverMock {
+ observe() {}
+ unobserve() {}
+ disconnect() {}
+ }
+
+ globalThis.ResizeObserver = ResizeObserverMock;
+ window.ResizeObserver = ResizeObserverMock;
+});
+
+const roleData = ({
+ manageProviders = false,
+ unlimitedVisibility = false,
+}: {
+ manageProviders?: boolean;
+ unlimitedVisibility?: boolean;
+} = {}) => ({
+ data: {
+ attributes: {
+ name: "Existing role",
+ manage_users: false,
+ manage_account: false,
+ manage_providers: manageProviders,
+ manage_integrations: false,
+ manage_scans: false,
+ unlimited_visibility: unlimitedVisibility,
+ groups: [],
+ },
+ relationships: {
+ provider_groups: {
+ data: [],
+ },
+ },
+ },
+});
+
+const renderEditRoleForm = (options?: Parameters<typeof roleData>[0]) =>
+ render(
+ <EditRoleForm roleId="role-1" roleData={roleData(options)} groups={[]} />,
+ );
+
+describe("EditRoleForm", () => {
+ afterEach(() => {
+ routerMocks.push.mockClear();
+ vi.unstubAllEnvs();
+ });
+
+ it("shows the subtle Unlimited Visibility description inside Visibility", () => {
+ // Given / When
+ renderEditRoleForm();
+
+ // Then
+ expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+ expect(
+ screen.getByText(
+ "Checking the box below grants visibility into every provider: resources, findings, scans, and compliance results, regardless of the provider groups selected.",
+ ),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByText(/required to use the Jira integration/i),
+ ).toHaveProperty("tagName", "STRONG");
+ expect(
+ screen.getByRole("link", { name: /learn more about provider groups/i }),
+ ).toHaveAttribute(
+ "href",
+ "https://docs.prowler.com/user-guide/tutorials/prowler-app-rbac#provider-groups",
+ );
+ expect(
+ screen.queryByText(
+ /manage providers enables unlimited visibility in this form because provider administration needs organization-wide provider-group context/i,
+ ),
+ ).not.toBeInTheDocument();
+
+ const visibilityHeading = screen.getByText("Visibility");
+ const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ });
+
+ expect(
+ visibilityHeading.compareDocumentPosition(unlimitedVisibilityCheckbox) &
+ Node.DOCUMENT_POSITION_FOLLOWING,
+ ).toBeTruthy();
+ });
+
+ it("keeps the Visibility section and hides only groups when Unlimited Visibility is enabled", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <EditRoleForm
+ roleId="role-1"
+ roleData={roleData()}
+ groups={[{ id: "group-1", name: "Production" }]}
+ />,
+ );
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+
+ // Then
+ expect(screen.getByText("Visibility")).toBeInTheDocument();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).toBeChecked();
+ expect(
+ screen.getByText(/checking the box below grants visibility/i),
+ ).toBeInTheDocument();
+ expect(screen.queryByTestId("group-select")).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(/select the groups this role will have access to/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("does not force Unlimited Visibility when Manage Providers is selected", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderEditRoleForm();
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ expect(
+ screen.queryByText(
+ /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+ ),
+ ).not.toBeInTheDocument();
+ });
+
+ it("does not force Unlimited Visibility when granting all admin permissions", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderEditRoleForm();
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ });
+
+ it("keeps Unlimited Visibility user-controlled when Manage Providers is selected", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderEditRoleForm();
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).not.toBeChecked();
+ expect(screen.getByTestId("group-select")).toBeInTheDocument();
+ });
+
+ it("keeps explicitly enabled Unlimited Visibility when all admin permissions are toggled off", async () => {
+ // Given
+ const user = userEvent.setup();
+ renderEditRoleForm();
+
+ // When
+ await user.click(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+ await user.click(
+ screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).not.toBeChecked();
+ expect(
+ screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ }),
+ ).toBeChecked();
+ });
+
+ it("does not show extra Manage Providers guidance", () => {
+ // Given / When
+ renderEditRoleForm({ manageProviders: true, unlimitedVisibility: true });
+
+ // Then
+ expect(
+ screen.queryByText(
+ /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+ ),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByText(/remove this automatic visibility grant/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("keeps existing inconsistent Manage Providers and Unlimited Visibility values on initial render", () => {
+ // Given / When
+ renderEditRoleForm({ manageProviders: true, unlimitedVisibility: false });
+
+ // Then
+ expect(
+ screen.getByRole("checkbox", { name: "Manage Providers" }),
+ ).toBeChecked();
+ const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+ name: "Enable Unlimited Visibility for this role",
+ });
+ expect(unlimitedVisibilityCheckbox).not.toBeChecked();
+ expect(unlimitedVisibilityCheckbox).toBeEnabled();
+ });
+});
diff --git a/ui/components/roles/workflow/forms/edit-role-form.tsx b/ui/components/roles/workflow/forms/edit-role-form.tsx
index e3e1a3bde8..fb42e628a0 100644
--- a/ui/components/roles/workflow/forms/edit-role-form.tsx
+++ b/ui/components/roles/workflow/forms/edit-role-form.tsx
@@ -1,25 +1,14 @@
"use client";
-import { Checkbox } from "@heroui/checkbox";
-import { Divider } from "@heroui/divider";
-import { Tooltip } from "@heroui/tooltip";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { clsx } from "clsx";
-import { InfoIcon } from "lucide-react";
import { useRouter } from "next/navigation";
-import { useEffect } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { z } from "zod";
+import { DefaultValues } from "react-hook-form";
import { updateRole } from "@/actions/roles/roles";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
-import { getErrorMessage, permissionFormFields } from "@/lib";
-import { ApiError, editRoleFormSchema } from "@/types";
+import { useToast } from "@/components/shadcn";
+import { getErrorMessage } from "@/lib";
+import { RoleFormValues } from "@/types";
-type FormValues = z.input<typeof editRoleFormSchema>;
+import { RoleForm, RoleFormSubmitContext, RoleGroupOption } from "./role-form";
export const EditRoleForm = ({
roleId,
@@ -29,7 +18,7 @@ export const EditRoleForm = ({
roleId: string;
roleData: {
data: {
- attributes: FormValues;
+ attributes: RoleFormValues;
relationships?: {
provider_groups?: {
data: Array<{ id: string; type: string }>;
@@ -37,57 +26,24 @@ export const EditRoleForm = ({
};
};
};
- groups: { id: string; name: string }[];
+ groups: RoleGroupOption[];
}) => {
const { toast } = useToast();
const router = useRouter();
const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
- const visiblePermissionFormFields = permissionFormFields.filter(
- (permission) =>
- !["manage_billing", "manage_alerts"].includes(permission.field) ||
- isCloudEnvironment,
- );
- const form = useForm<FormValues>({
- resolver: zodResolver(editRoleFormSchema),
- defaultValues: {
- ...roleData.data.attributes,
- groups:
- roleData.data.relationships?.provider_groups?.data.map((g) => g.id) ||
- [],
- },
- });
-
- const { watch, setValue } = form;
-
- const manageProviders = watch("manage_providers");
- const unlimitedVisibility = watch("unlimited_visibility");
-
- useEffect(() => {
- if (manageProviders && !unlimitedVisibility) {
- setValue("unlimited_visibility", true, {
- shouldValidate: true,
- shouldDirty: true,
- shouldTouch: true,
- });
- }
- }, [manageProviders, unlimitedVisibility, setValue]);
-
- const isLoading = form.formState.isSubmitting;
-
- const onSelectAllChange = (checked: boolean) => {
- visiblePermissionFormFields.forEach(({ field }) => {
- form.setValue(field as keyof FormValues, checked, {
- shouldValidate: true,
- shouldDirty: true,
- shouldTouch: true,
- });
- });
+ const defaultValues: DefaultValues<RoleFormValues> = {
+ ...roleData.data.attributes,
+ groups:
+ roleData.data.relationships?.provider_groups?.data.map((g) => g.id) || [],
};
- const onSubmitClient = async (values: FormValues) => {
+ const onSubmit = async (
+ values: RoleFormValues,
+ { handleServerResponse }: RoleFormSubmitContext,
+ ) => {
try {
- const updatedFields: Partial<FormValues> = {};
+ const updatedFields: Partial<RoleFormValues> = {};
if (values.name !== roleData.data.attributes.name) {
updatedFields.name = values.name;
@@ -127,33 +83,13 @@ export const EditRoleForm = ({
});
const data = await updateRole(formData, roleId);
+ if (!handleServerResponse(data)) return;
- if (data?.errors && data.errors.length > 0) {
- data.errors.forEach((error: ApiError) => {
- const errorMessage = error.detail;
- const pointer = error.source?.pointer;
- switch (pointer) {
- case "/data/attributes/name":
- form.setError("name", {
- type: "server",
- message: errorMessage,
- });
- break;
- default:
- toast({
- variant: "destructive",
- title: "Error",
- description: errorMessage,
- });
- }
- });
- } else {
- toast({
- title: "Role Updated",
- description: "The role was updated successfully.",
- });
- router.push("/roles");
- }
+ toast({
+ title: "Role Updated",
+ description: "The role was updated successfully.",
+ });
+ router.push("/roles");
} catch (error) {
toast({
variant: "destructive",
@@ -164,119 +100,11 @@ export const EditRoleForm = ({
};
return (
- <Form {...form}>
- <form
- onSubmit={form.handleSubmit(onSubmitClient)}
- className="flex flex-col gap-6"
- >
- <CustomInput
- control={form.control}
- name="name"
- type="text"
- label="Role Name"
- labelPlacement="inside"
- placeholder="Enter role name"
- variant="bordered"
- isRequired
- />
-
- <div className="flex flex-col gap-4">
- <span className="text-lg font-semibold">Admin Permissions</span>
-
- {/* Select All Checkbox */}
- <Checkbox
- isSelected={visiblePermissionFormFields.every((perm) =>
- form.watch(perm.field as keyof FormValues),
- )}
- onChange={(e) => onSelectAllChange(e.target.checked)}
- classNames={{
- label: "text-small",
- wrapper: "checkbox-update",
- }}
- color="default"
- >
- Grant all admin permissions
- </Checkbox>
-
- {/* Permissions Grid */}
- <div className="grid grid-cols-2 gap-4">
- {visiblePermissionFormFields.map(
- ({ field, label, description }) => (
- <div key={field} className="flex items-center gap-2">
- <Checkbox
- {...form.register(field as keyof FormValues)}
- isSelected={!!form.watch(field as keyof FormValues)}
- classNames={{
- label: "text-small",
- wrapper: "checkbox-update",
- }}
- color="default"
- >
- {label}
- </Checkbox>
- <Tooltip content={description} placement="right">
- <div className="flex w-fit items-center justify-center">
- <InfoIcon
- className={clsx(
- "text-default-400 group-data-[selected=true]:text-foreground cursor-pointer",
- )}
- aria-hidden={"true"}
- width={16}
- />
- </div>
- </Tooltip>
- </div>
- ),
- )}
- </div>
- </div>
- <Divider className="my-4" />
-
- {!unlimitedVisibility && (
- <div className="flex flex-col gap-4">
- <span className="text-lg font-semibold">Groups visibility</span>
-
- <p className="text-small text-default-700 font-medium">
- Select the groups this role will have access to. If no groups are
- selected and unlimited visibility is not enabled, the role will
- not have access to any accounts.
- </p>
-
- <Controller
- name="groups"
- control={form.control}
- render={({ field }) => (
- <div className="flex flex-col gap-2">
- <EnhancedMultiSelect
- options={groups.map((group) => ({
- label: group.name,
- value: group.id,
- }))}
- onValueChange={field.onChange}
- defaultValue={field.value || []}
- placeholder="Select groups"
- searchable={true}
- hideSelectAll={true}
- emptyIndicator="No results found"
- resetOnDefaultValueChange={true}
- />
- </div>
- )}
- />
-
- {form.formState.errors.groups && (
- <p className="mt-2 text-sm text-red-600">
- {form.formState.errors.groups.message}
- </p>
- )}
- </div>
- )}
- <FormButtons
- submitText="Update Role"
- isDisabled={isLoading}
- onCancel={() => router.push("/roles")}
- />
- </form>
- </Form>
+ <RoleForm
+ groups={groups}
+ defaultValues={defaultValues}
+ submitText="Update Role"
+ onSubmit={onSubmit}
+ />
);
};
diff --git a/ui/components/roles/workflow/forms/role-form.tsx b/ui/components/roles/workflow/forms/role-form.tsx
new file mode 100644
index 0000000000..d0978f7721
--- /dev/null
+++ b/ui/components/roles/workflow/forms/role-form.tsx
@@ -0,0 +1,240 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { InfoIcon } from "lucide-react";
+import { useRouter } from "next/navigation";
+import {
+ Controller,
+ DefaultValues,
+ useForm,
+ UseFormReturn,
+ useWatch,
+} from "react-hook-form";
+
+import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
+import {
+ Form,
+ FormButtons,
+ FormControl,
+ FormField,
+ FormItem,
+ FormLabel,
+ FormMessage,
+} from "@/components/shadcn/form";
+import { Input } from "@/components/shadcn/input/input";
+import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
+import { Separator } from "@/components/shadcn/separator/separator";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { useFormServerErrors } from "@/hooks/use-form-server-errors";
+import { useManageProvidersUnlimitedVisibility } from "@/hooks/use-manage-providers-unlimited-visibility";
+import {
+ getUnlimitedVisibilityField,
+ getVisiblePermissionFormFields,
+} from "@/lib/role-permissions";
+import { roleFormSchema, RoleFormValues } from "@/types";
+
+import { UnlimitedVisibilityField } from "./unlimited-visibility-section";
+
+export interface RoleGroupOption {
+ id: string;
+ name: string;
+}
+
+export interface RoleFormSubmitContext {
+ form: UseFormReturn<RoleFormValues>;
+ handleServerResponse: (data: unknown) => boolean;
+}
+
+interface RoleFormProps {
+ groups: RoleGroupOption[];
+ defaultValues: DefaultValues<RoleFormValues>;
+ submitText: string;
+ onSubmit: (
+ values: RoleFormValues,
+ ctx: RoleFormSubmitContext,
+ ) => void | Promise<void>;
+ onCancel?: () => void;
+}
+
+export const RoleForm = ({
+ groups,
+ defaultValues,
+ submitText,
+ onSubmit,
+ onCancel,
+}: RoleFormProps) => {
+ const router = useRouter();
+
+ const form = useForm<RoleFormValues>({
+ resolver: zodResolver(roleFormSchema),
+ defaultValues,
+ });
+
+ const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const visiblePermissionFormFields =
+ getVisiblePermissionFormFields(isCloudEnvironment);
+ const showUnlimitedVisibilityField = !!getUnlimitedVisibilityField();
+
+ const { setPermissionValue, setUnlimitedVisibility } =
+ useManageProvidersUnlimitedVisibility(form);
+ const { handleServerResponse } = useFormServerErrors(form, {
+ "/data/attributes/name": "name",
+ });
+
+ // useWatch instead of form.watch: React Compiler can keep memoized JSX stale
+ // when getter reads happen during render.
+ const formValues = useWatch({ control: form.control });
+ const unlimitedVisibility = !!formValues.unlimited_visibility;
+ const isLoading = form.formState.isSubmitting;
+
+ const onSelectAllChange = (checked: boolean) => {
+ visiblePermissionFormFields.forEach(({ field }) => {
+ setPermissionValue(field, checked);
+ });
+ };
+
+ const handleCancel = onCancel ?? (() => router.push("/roles"));
+
+ return (
+ <Form {...form}>
+ <form
+ onSubmit={form.handleSubmit((values) =>
+ onSubmit(values, { form, handleServerResponse }),
+ )}
+ className="flex flex-col gap-6"
+ >
+ <FormField
+ control={form.control}
+ name="name"
+ render={({ field }) => (
+ <FormItem>
+ <FormLabel>
+ Role Name <span className="text-text-error-primary">*</span>
+ </FormLabel>
+ <FormControl>
+ <Input
+ placeholder="Enter role name"
+ {...field}
+ value={field.value ?? ""}
+ />
+ </FormControl>
+ <FormMessage />
+ </FormItem>
+ )}
+ />
+
+ <div className="flex flex-col gap-4">
+ <span className="text-lg font-semibold">Admin Permissions</span>
+
+ {/* Select All Checkbox */}
+ <div className="flex items-center gap-2">
+ <Checkbox
+ id="select-all"
+ size="sm"
+ checked={visiblePermissionFormFields.every((perm) =>
+ Boolean(formValues[perm.field as keyof RoleFormValues]),
+ )}
+ onCheckedChange={(checked) => onSelectAllChange(Boolean(checked))}
+ />
+ <label htmlFor="select-all" className="text-small">
+ Grant all admin permissions
+ </label>
+ </div>
+
+ {/* Permissions Grid */}
+ <div className="grid grid-cols-2 gap-4">
+ {visiblePermissionFormFields.map(
+ ({ field, label, description }) => (
+ <div key={field} className="flex items-center gap-2">
+ <Checkbox
+ id={field}
+ size="sm"
+ checked={!!formValues[field as keyof RoleFormValues]}
+ onCheckedChange={(checked) =>
+ setPermissionValue(field, Boolean(checked))
+ }
+ />
+ <label htmlFor={field} className="text-small">
+ {label}
+ </label>
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <div className="flex w-fit items-center justify-center">
+ <InfoIcon
+ className="text-muted-foreground cursor-pointer"
+ aria-hidden="true"
+ width={16}
+ />
+ </div>
+ </TooltipTrigger>
+ <TooltipContent side="right">{description}</TooltipContent>
+ </Tooltip>
+ </div>
+ ),
+ )}
+ </div>
+ </div>
+
+ <Separator className="my-4" />
+
+ <div className="flex flex-col gap-4">
+ <span className="text-lg font-semibold">Visibility</span>
+
+ {showUnlimitedVisibilityField && (
+ <UnlimitedVisibilityField
+ isSelected={unlimitedVisibility}
+ onValueChange={setUnlimitedVisibility}
+ />
+ )}
+
+ {!unlimitedVisibility && (
+ <>
+ <p className="text-small text-default-700 font-medium">
+ Select the groups this role will have access to. If no groups
+ are selected and unlimited visibility is not enabled, the role
+ will not have access to any accounts.
+ </p>
+
+ <Controller
+ name="groups"
+ control={form.control}
+ render={({ field }) => (
+ <div className="flex flex-col gap-2">
+ <EnhancedMultiSelect
+ options={groups.map((group) => ({
+ label: group.name,
+ value: group.id,
+ }))}
+ onValueChange={field.onChange}
+ defaultValue={field.value || []}
+ placeholder="Select groups"
+ searchable={true}
+ hideSelectAll={true}
+ emptyIndicator="No results found"
+ resetOnDefaultValueChange={true}
+ />
+ </div>
+ )}
+ />
+
+ {form.formState.errors.groups && (
+ <p className="mt-2 text-sm text-red-600">
+ {form.formState.errors.groups.message}
+ </p>
+ )}
+ </>
+ )}
+ </div>
+ <FormButtons
+ submitText={submitText}
+ isDisabled={isLoading}
+ onCancel={handleCancel}
+ />
+ </form>
+ </Form>
+ );
+};
diff --git a/ui/components/roles/workflow/forms/unlimited-visibility-section.tsx b/ui/components/roles/workflow/forms/unlimited-visibility-section.tsx
new file mode 100644
index 0000000000..a8d59d5793
--- /dev/null
+++ b/ui/components/roles/workflow/forms/unlimited-visibility-section.tsx
@@ -0,0 +1,68 @@
+import { InfoIcon } from "lucide-react";
+import { ReactNode } from "react";
+
+import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+
+const PROVIDER_GROUPS_DOCS_URL =
+ "https://docs.prowler.com/user-guide/tutorials/prowler-app-rbac#provider-groups";
+
+export const UnlimitedVisibilitySection = ({
+ children,
+}: {
+ children: ReactNode;
+}) => {
+ return (
+ <section className="space-y-2">
+ <div className="text-muted-foreground flex items-start gap-2 text-sm">
+ <InfoIcon
+ aria-hidden="true"
+ className="text-bg-data-info mt-0.5 h-4 w-4 shrink-0"
+ />
+ <div className="flex flex-col gap-1">
+ <p>
+ Checking the box below grants visibility into every provider:
+ resources, findings, scans, and compliance results, regardless of
+ the provider groups selected.
+ </p>
+ <p>
+ Unlimited Visibility is also{" "}
+ <strong>required to use the Jira integration</strong>.{" "}
+ <CustomLink href={PROVIDER_GROUPS_DOCS_URL} size="sm">
+ Learn more about Provider Groups
+ </CustomLink>
+ </p>
+ </div>
+ </div>
+ <div>{children}</div>
+ </section>
+ );
+};
+
+export const UnlimitedVisibilityField = ({
+ isSelected,
+ onValueChange,
+}: {
+ isSelected: boolean;
+ onValueChange: (checked: boolean) => void;
+}) => {
+ return (
+ <UnlimitedVisibilitySection>
+ <div className="flex items-center gap-2">
+ <Checkbox
+ id="unlimited_visibility"
+ name="unlimited_visibility"
+ checked={isSelected}
+ onCheckedChange={(checked) => onValueChange(Boolean(checked))}
+ size="sm"
+ />
+ <label
+ htmlFor="unlimited_visibility"
+ className="text-small font-medium peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+ >
+ Enable Unlimited Visibility for this role
+ </label>
+ </div>
+ </UnlimitedVisibilitySection>
+ );
+};
diff --git a/ui/components/roles/workflow/skeleton-role-form.tsx b/ui/components/roles/workflow/skeleton-role-form.tsx
index bbb95ed102..60d525a629 100644
--- a/ui/components/roles/workflow/skeleton-role-form.tsx
+++ b/ui/components/roles/workflow/skeleton-role-form.tsx
@@ -1,33 +1,17 @@
-import { Card } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
-import React from "react";
+import { Card, Skeleton } from "@/components/shadcn";
export const SkeletonRoleForm = () => {
return (
- <Card className="flex h-full w-full flex-col gap-5 p-4" radius="sm">
+ <Card className="flex h-full w-full flex-col gap-5 rounded-lg p-4">
{/* Table headers */}
<div className="hidden justify-between md:flex">
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-2/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
- <Skeleton className="w-1/12 rounded-lg">
- <div className="bg-default-200 h-8"></div>
- </Skeleton>
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-2/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
+ <Skeleton className="h-8 w-1/12 rounded-lg" />
</div>
{/* Table body */}
@@ -37,27 +21,13 @@ export const SkeletonRoleForm = () => {
key={index}
className="flex flex-col items-center justify-between md:flex-row md:gap-4"
>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 w-full rounded-lg md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-2/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
- <Skeleton className="mb-2 hidden rounded-lg sm:flex md:mb-0 md:w-1/12">
- <div className="bg-default-300 h-12"></div>
- </Skeleton>
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 h-12 w-full rounded-lg md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-2/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
+ <Skeleton className="mb-2 hidden h-12 rounded-lg sm:flex md:mb-0 md:w-1/12" />
</div>
))}
</div>
diff --git a/ui/components/roles/workflow/vertical-steps.tsx b/ui/components/roles/workflow/vertical-steps.tsx
index 13202083d1..17abec63d2 100644
--- a/ui/components/roles/workflow/vertical-steps.tsx
+++ b/ui/components/roles/workflow/vertical-steps.tsx
@@ -1,11 +1,12 @@
"use client";
-import { cn } from "@heroui/theme";
import { useControlledState } from "@react-stately/utils";
import { domAnimation, LazyMotion, m } from "framer-motion";
import type { ComponentProps } from "react";
import React from "react";
+import { cn } from "@/lib/utils";
+
export type VerticalStepProps = {
className?: string;
description?: React.ReactNode;
@@ -122,38 +123,37 @@ export const VerticalSteps = React.forwardRef<
"[--active-color:var(--step-color)]",
"[--complete-background-color:var(--step-color)]",
"[--complete-border-color:var(--step-color)]",
- "[--inactive-border-color:hsl(var(--heroui-default-300))]",
- "[--inactive-color:hsl(var(--heroui-default-300))]",
+ "[--inactive-border-color:var(--border-neutral-tertiary)]",
+ "[--inactive-color:var(--border-neutral-tertiary)]",
];
switch (color) {
- case "primary":
- userColor = "[--step-color:hsl(var(--heroui-primary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
- break;
case "secondary":
- userColor = "[--step-color:hsl(var(--heroui-secondary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-secondary-foreground))]";
+ userColor =
+ "[--step-color:var(--color-violet-600)] dark:[--step-color:var(--color-violet-400)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "success":
- userColor = "[--step-color:hsl(var(--heroui-success))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-success-foreground))]";
+ userColor = "[--step-color:var(--bg-pass-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "warning":
- userColor = "[--step-color:hsl(var(--heroui-warning))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-warning-foreground))]";
+ userColor = "[--step-color:var(--bg-warning-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
case "danger":
- userColor = "[--step-color:hsl(var(--heroui-error))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-error-foreground))]";
+ userColor = "[--step-color:var(--bg-fail-primary)]";
+ fgColor = "[--step-fg-color:var(--color-white)]";
break;
case "default":
- userColor = "[--step-color:hsl(var(--heroui-default))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-default-foreground))]";
+ userColor =
+ "[--step-color:var(--color-zinc-300)] dark:[--step-color:var(--color-zinc-600)]";
+ fgColor = "[--step-fg-color:var(--text-neutral-primary)]";
break;
+ case "primary":
default:
- userColor = "[--step-color:hsl(var(--heroui-primary))]";
- fgColor = "[--step-fg-color:hsl(var(--heroui-primary-foreground))]";
+ userColor = "[--step-color:var(--bg-button-primary)]";
+ fgColor = "[--step-fg-color:var(--color-black)]";
break;
}
@@ -161,7 +161,7 @@ export const VerticalSteps = React.forwardRef<
if (!className?.includes("--step-color")) colorsVars.unshift(userColor);
if (!className?.includes("--inactive-bar-color"))
colorsVars.push(
- "[--inactive-bar-color:hsl(var(--heroui-default-300))]",
+ "[--inactive-bar-color:var(--border-neutral-tertiary)]",
);
return colorsVars;
@@ -186,7 +186,7 @@ export const VerticalSteps = React.forwardRef<
ref={ref}
aria-current={status === "active" ? "step" : undefined}
className={cn(
- "group rounded-large flex w-full cursor-pointer items-center justify-center gap-4 px-3 py-2.5",
+ "group flex w-full cursor-pointer items-center justify-center gap-4 rounded-[14px] px-3 py-2.5",
stepClassName,
)}
onClick={() => setCurrentStep(stepIdx)}
@@ -197,12 +197,9 @@ export const VerticalSteps = React.forwardRef<
<div className="relative">
<m.div
animate={status}
- className={cn(
- "border-medium text-large text-default-foreground relative flex h-[34px] w-[34px] items-center justify-center rounded-full font-semibold",
- {
- "shadow-lg": status === "complete",
- },
- )}
+ className={`text-text-neutral-primary relative flex h-[34px] w-[34px] items-center justify-center rounded-full border-2 text-lg font-semibold ${
+ status === "complete" ? "shadow-lg" : ""
+ }`}
data-status={status}
initial={false}
transition={{ duration: 0.25 }}
@@ -238,22 +235,20 @@ export const VerticalSteps = React.forwardRef<
<div className="flex-1 text-left">
<div>
<div
- className={cn(
- "text-medium text-default-foreground font-medium transition-[color,opacity] duration-300 group-active:opacity-70",
- {
- "text-default-500": status === "inactive",
- },
- )}
+ className={`text-base font-medium transition-[color,opacity] duration-300 group-active:opacity-70 ${
+ status === "inactive"
+ ? "text-text-neutral-tertiary"
+ : "text-text-neutral-primary"
+ }`}
>
{step.title}
</div>
<div
- className={cn(
- "text-tiny text-default-600 lg:text-small transition-[color,opacity] duration-300 group-active:opacity-70",
- {
- "text-default-500": status === "inactive",
- },
- )}
+ className={`text-xs transition-[color,opacity] duration-300 group-active:opacity-70 lg:text-sm ${
+ status === "inactive"
+ ? "text-text-neutral-tertiary"
+ : "text-text-neutral-secondary"
+ }`}
>
{step.description}
</div>
diff --git a/ui/components/roles/workflow/workflow-add-edit-role.tsx b/ui/components/roles/workflow/workflow-add-edit-role.tsx
index 201203c343..fa86b83799 100644
--- a/ui/components/roles/workflow/workflow-add-edit-role.tsx
+++ b/ui/components/roles/workflow/workflow-add-edit-role.tsx
@@ -1,10 +1,10 @@
"use client";
-import { Progress } from "@heroui/progress";
-import { Spacer } from "@heroui/spacer";
import { usePathname } from "next/navigation";
import React from "react";
+import { Progress } from "@/components/shadcn/progress";
+
import { VerticalSteps } from "./vertical-steps";
const steps = [
@@ -35,31 +35,29 @@ export const WorkflowAddEditRole = () => {
<h1 className="mb-2 text-xl font-medium" id="getting-started">
Manage Role Permissions
</h1>
- <p className="text-small text-default-500 mb-5">
+ <p className="text-text-neutral-tertiary mb-5 text-sm">
Define a new role with customized permissions or modify an existing one
to meet your needs.
</p>
- <Progress
- classNames={{
- base: "px-0.5 mb-5",
- label: "text-small",
- value: "text-small text-default-400",
- }}
- label="Steps"
- maxValue={steps.length - 1}
- minValue={0}
- showValueLabel={true}
- size="md"
- value={currentStep}
- valueLabel={`${currentStep + 1} of ${steps.length}`}
- />
+ <div className="mb-5 flex flex-col gap-2 px-0.5">
+ <div className="flex items-center justify-between">
+ <span className="text-sm">Steps</span>
+ <span className="text-text-neutral-tertiary text-sm">
+ {`${currentStep + 1} of ${steps.length}`}
+ </span>
+ </div>
+ <Progress
+ aria-label="Steps"
+ value={(currentStep / (steps.length - 1)) * 100}
+ />
+ </div>
<VerticalSteps
hideProgressBars
currentStep={currentStep}
stepClassName="border border-border-neutral-primary aria-[current]:border-button-primary aria-[current]:text-text-neutral-primary cursor-default"
steps={steps}
/>
- <Spacer y={4} />
+ <div className="h-4" />
</section>
);
};
diff --git a/ui/components/scans/edit-alias-modal.test.tsx b/ui/components/scans/edit-alias-modal.test.tsx
index 2d0f787a7b..7318d2c022 100644
--- a/ui/components/scans/edit-alias-modal.test.tsx
+++ b/ui/components/scans/edit-alias-modal.test.tsx
@@ -16,7 +16,7 @@ vi.mock("@/actions/scans", () => ({
updateScan: updateScanMock,
}));
-vi.mock("@/components/ui/toast", () => ({
+vi.mock("@/components/shadcn/toast", () => ({
toast: toastMock,
}));
diff --git a/ui/components/scans/edit-alias-modal.tsx b/ui/components/scans/edit-alias-modal.tsx
index 36d618e2ba..da889614a6 100644
--- a/ui/components/scans/edit-alias-modal.tsx
+++ b/ui/components/scans/edit-alias-modal.tsx
@@ -8,9 +8,9 @@ import { z } from "zod";
import { updateScan } from "@/actions/scans";
import { Field, FieldError, FieldLabel, Input } from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
-import { FormButtons } from "@/components/ui/form";
-import { toast } from "@/components/ui/toast";
+import { toast } from "@/components/shadcn/toast";
import { scanAliasSchema } from "./scan-alias-validation";
diff --git a/ui/components/scans/launch-scan-modal.test.tsx b/ui/components/scans/launch-scan-modal.test.tsx
index f413603caf..706b704425 100644
--- a/ui/components/scans/launch-scan-modal.test.tsx
+++ b/ui/components/scans/launch-scan-modal.test.tsx
@@ -50,7 +50,7 @@ vi.mock("@/actions/schedules", () => ({
updateSchedule: updateScheduleMock,
}));
-vi.mock("@/components/ui/toast", () => ({
+vi.mock("@/components/shadcn/toast", () => ({
ToastAction: ({ children, ...props }: ComponentProps<"button">) => (
<button {...props}>{children}</button>
),
@@ -74,7 +74,7 @@ vi.mock("@/components/shadcn/modal", () => ({
) : null,
}));
-vi.mock("@/components/ui/entities", () => ({
+vi.mock("@/components/shadcn/entities", () => ({
EntityInfo: ({
entityAlias,
entityId,
@@ -130,15 +130,17 @@ import {
ACTION_ERROR_MESSAGES,
ACTION_ERROR_STATUS,
} from "@/lib/action-errors";
+import { ProviderProps } from "@/types";
import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
import { LaunchScanModal } from "./launch-scan-modal";
-const provider = {
+const provider: ProviderProps = {
id: "provider-1",
type: "providers" as const,
attributes: {
provider: "aws" as const,
+ is_dynamic: false,
uid: "123456789012",
alias: "Production",
status: "completed" as const,
@@ -546,15 +548,26 @@ describe("LaunchScanModal", () => {
expect(getScheduleMock).not.toHaveBeenCalled();
});
- it("locks schedule mode outside ADVANCED (OSS default)", () => {
+ it("preserves legacy daily scheduling outside Cloud", async () => {
+ const user = userEvent.setup();
+ scheduleDailyMock.mockResolvedValue({ data: { id: provider.id } });
render(
<LaunchScanModal open onOpenChange={vi.fn()} providers={[provider]} />,
);
expect(
screen.getByRole("radio", { name: "On a schedule" }),
- ).toBeDisabled();
+ ).toBeEnabled();
+
+ await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+ await user.click(screen.getByRole("radio", { name: "On a schedule" }));
+ expect(screen.getByRole("combobox", { name: "Repeats" })).toBeDisabled();
+
+ await user.click(screen.getByRole("button", { name: /save schedule/i }));
+
+ await waitFor(() => expect(scheduleDailyMock).toHaveBeenCalledTimes(1));
expect(getScheduleMock).not.toHaveBeenCalled();
+ expect(updateScheduleMock).not.toHaveBeenCalled();
});
it("hides schedule mode but allows manual scans in MANUAL_ONLY", async () => {
@@ -591,7 +604,7 @@ describe("LaunchScanModal", () => {
);
expect(screen.queryByRole("radio")).not.toBeInTheDocument();
- expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+ expect(screen.getByText(/exceeded the usage limit/i)).toBeInTheDocument();
expect(
screen.getByRole("button", { name: /launch scan/i }),
).toBeDisabled();
@@ -610,7 +623,7 @@ describe("LaunchScanModal", () => {
);
expect(screen.queryByRole("radio")).not.toBeInTheDocument();
- expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+ expect(screen.getByText(/exceeded the usage limit/i)).toBeInTheDocument();
await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
await user.click(screen.getByRole("button", { name: /launch scan/i }));
diff --git a/ui/components/scans/launch-scan-modal.tsx b/ui/components/scans/launch-scan-modal.tsx
index 3cc9083908..465321dc1a 100644
--- a/ui/components/scans/launch-scan-modal.tsx
+++ b/ui/components/scans/launch-scan-modal.tsx
@@ -11,15 +11,21 @@ import { z } from "zod";
import { scanOnDemand } from "@/actions/scans";
import { getSchedule } from "@/actions/schedules";
import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
-import { Field, FieldError, FieldLabel, Input } from "@/components/shadcn";
+import {
+ Badge,
+ Field,
+ FieldError,
+ FieldLabel,
+ Input,
+} from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
import {
RadioGroup,
RadioGroupItem,
} from "@/components/shadcn/radio-group/radio-group";
-import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
-import { FormButtons } from "@/components/ui/form";
-import { toast, ToastAction } from "@/components/ui/toast";
+import { toast, ToastAction } from "@/components/shadcn/toast";
+import { UsageLimitMessage } from "@/components/shared/usage-limit-message";
import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
import {
buildScheduleAttributesFromProvider,
@@ -110,11 +116,13 @@ function LaunchScanForm({
const requestedProviderRef = useRef<string>("");
const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
+ const isDailyLegacy = capability === SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY;
+ const canUseScheduleMode = isAdvanced || isDailyLegacy;
const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
const isBlocked =
capability === SCAN_SCHEDULE_CAPABILITY.BLOCKED ||
(isManualOnly && isScanLimitReached);
- const isScheduleMode = isAdvanced && mode === LAUNCH_MODE.SCHEDULE;
+ const isScheduleMode = canUseScheduleMode && mode === LAUNCH_MODE.SCHEDULE;
// useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
const providerId = useWatch({ control: form.control, name: "providerId" });
@@ -168,13 +176,15 @@ function LaunchScanForm({
const handleProviderChange = (id: string) => {
form.setValue("providerId", id, { shouldValidate: true });
- if (isScheduleMode) void loadSchedule(id);
+ if (isScheduleMode && isAdvanced) void loadSchedule(id);
};
const handleModeChange = (nextMode: string) => {
- if (nextMode === LAUNCH_MODE.SCHEDULE && !isAdvanced) return;
+ if (nextMode === LAUNCH_MODE.SCHEDULE && !canUseScheduleMode) return;
setMode(nextMode as LaunchMode);
- if (nextMode === LAUNCH_MODE.SCHEDULE) void loadSchedule(providerId);
+ if (nextMode === LAUNCH_MODE.SCHEDULE && isAdvanced) {
+ void loadSchedule(providerId);
+ }
};
const launchNow = form.handleSubmit(async ({ providerId, scanAlias }) => {
@@ -215,7 +225,7 @@ function LaunchScanForm({
});
const saveSchedule = async () => {
- if (isBlocked || !isAdvanced) return;
+ if (isBlocked || !canUseScheduleMode) return;
const providerValid = await form.trigger("providerId");
if (!providerValid) return;
@@ -224,6 +234,7 @@ function LaunchScanForm({
const result = await saveScheduleWithInitialScan({
providerId: form.getValues("providerId"),
values,
+ useLegacyDaily: isDailyLegacy,
});
if (result.status === SAVE_SCHEDULE_STATUS.ERROR) {
@@ -319,22 +330,19 @@ function LaunchScanForm({
<RadioGroupItem
value={LAUNCH_MODE.SCHEDULE}
aria-label="On a schedule"
- disabled={!isAdvanced}
+ disabled={!canUseScheduleMode}
/>
On a schedule
- {!isAdvanced && <CloudFeatureBadgeLink size="sm" />}
+ {isDailyLegacy && (
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>
+ )}
</label>
</RadioGroup>
</Field>
)}
- {isBlocked && (
- <p className="text-text-error-primary text-sm">
- You have reached your scan limit, so additional scans are not
- available right now.
- </p>
- )}
-
{!isScheduleMode && (
<Field>
<FieldLabel htmlFor="launch-scan-alias">Alias (optional)</FieldLabel>
@@ -347,6 +355,8 @@ function LaunchScanForm({
</Field>
)}
+ {isBlocked && <UsageLimitMessage />}
+
{isScheduleMode && isScheduleLoading && (
<div className="flex items-center gap-3 py-2">
<Loader2 className="size-5 animate-spin" />
@@ -366,6 +376,8 @@ function LaunchScanForm({
disabled={isSubmitting || !providerId}
showLaunchInitialScan
showNextScheduledCopy
+ canUseAdvancedSchedule={isAdvanced}
+ showCloudUpgradeBadge={isDailyLegacy}
/>
)}
diff --git a/ui/components/scans/scan-error-details-modal.test.tsx b/ui/components/scans/scan-error-details-modal.test.tsx
index 1474e7eea1..f7993fc632 100644
--- a/ui/components/scans/scan-error-details-modal.test.tsx
+++ b/ui/components/scans/scan-error-details-modal.test.tsx
@@ -6,7 +6,7 @@ import {
type ScanErrorDetailsState,
} from "./scan-error-details-modal";
-vi.mock("@/components/ui/code-snippet/code-snippet", () => ({
+vi.mock("@/components/shadcn/code-snippet/code-snippet", () => ({
CodeSnippet: ({
value,
formatter,
diff --git a/ui/components/scans/scan-error-details-view.test.tsx b/ui/components/scans/scan-error-details-view.test.tsx
index 145f84d529..30fe5ed83e 100644
--- a/ui/components/scans/scan-error-details-view.test.tsx
+++ b/ui/components/scans/scan-error-details-view.test.tsx
@@ -5,7 +5,7 @@ import type { ScanErrorDetails } from "@/actions/task/task.adapter";
import { ScanErrorDetailsView } from "./scan-error-details-view";
-vi.mock("@/components/ui/code-snippet/code-snippet", () => ({
+vi.mock("@/components/shadcn/code-snippet/code-snippet", () => ({
CodeSnippet: ({
value,
formatter,
diff --git a/ui/components/scans/scan-error-details-view.tsx b/ui/components/scans/scan-error-details-view.tsx
index 8670e20ba4..b6e9b641e9 100644
--- a/ui/components/scans/scan-error-details-view.tsx
+++ b/ui/components/scans/scan-error-details-view.tsx
@@ -2,7 +2,7 @@
import type { ScanErrorDetails } from "@/actions/task/task.adapter";
import { Field, FieldLabel, LabeledField } from "@/components/shadcn";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
interface ScanErrorDetailsViewProps {
details: ScanErrorDetails;
diff --git a/ui/components/scans/scans-filter-bar.test.tsx b/ui/components/scans/scans-filter-bar.test.tsx
index f629e0291b..366b91c9b0 100644
--- a/ui/components/scans/scans-filter-bar.test.tsx
+++ b/ui/components/scans/scans-filter-bar.test.tsx
@@ -9,7 +9,12 @@ vi.mock("@/components/filters/provider-account-selectors", () => ({
ProviderAccountSelectors: () => <div>Provider account selectors</div>,
}));
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/filters/provider-group-selector", () => ({
+ ProviderGroupSelector: () => <div>Provider group selector</div>,
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Select: ({ children }: { children: React.ReactNode }) => (
<div>{children}</div>
),
diff --git a/ui/components/scans/scans-filter-bar.tsx b/ui/components/scans/scans-filter-bar.tsx
index 9e11fddf0e..de4539651f 100644
--- a/ui/components/scans/scans-filter-bar.tsx
+++ b/ui/components/scans/scans-filter-bar.tsx
@@ -1,6 +1,7 @@
"use client";
import { ProviderAccountSelectors } from "@/components/filters/provider-account-selectors";
+import { ProviderGroupSelector } from "@/components/filters/provider-group-selector";
import {
Select,
SelectContent,
@@ -8,8 +9,10 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn";
+import { isCloud } from "@/lib/shared/env";
import { SCAN_JOBS_TAB, type ScanJobsTab } from "@/types";
-import { FilterType } from "@/types/filters";
+import type { ProviderGroup } from "@/types/components";
+import { FILTER_FIELD } from "@/types/filters";
import type { ProviderProps } from "@/types/providers";
import {
@@ -19,6 +22,7 @@ import {
interface ScansFilterBarProps {
providers: ProviderProps[];
+ providerGroups?: ProviderGroup[];
activeTab: ScanJobsTab;
scheduleType: string;
scanStatus: string;
@@ -31,6 +35,7 @@ const filterItemClass = "w-full md:w-[calc(50%-0.375rem)] xl:w-60";
export function ScansFilterBar({
providers,
+ providerGroups = [],
activeTab,
scheduleType,
scanStatus,
@@ -38,7 +43,7 @@ export function ScansFilterBar({
onScheduleTypeChange,
onScanStatusChange,
}: ScansFilterBarProps) {
- const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const isCloudEnvironment = isCloud();
const triggerFilterOptions = getScanTriggerFilterOptions(isCloudEnvironment);
const statusFilterOptions = getScanStatusFilterOptions(activeTab);
const showScheduleTypeFilter = activeTab !== SCAN_JOBS_TAB.SCHEDULED;
@@ -47,13 +52,20 @@ export function ScansFilterBar({
<>
<ProviderAccountSelectors
providers={providers}
- accountFilterKey={FilterType.PROVIDER}
+ accountFilterKey={FILTER_FIELD.PROVIDER}
accountValue="id"
paramsToDeleteOnChange={["page", "scanId"]}
providerSelectorClassName={filterItemClass}
accountSelectorClassName={filterItemClass}
/>
+ <div className={filterItemClass}>
+ <ProviderGroupSelector
+ groups={providerGroups}
+ paramsToDeleteOnChange={["page", "scanId"]}
+ />
+ </div>
+
{showScheduleTypeFilter && (
<Select value={scheduleType} onValueChange={onScheduleTypeChange}>
<SelectTrigger aria-label="All Types" className={filterItemClass}>
diff --git a/ui/components/scans/scans-page-shell.test.tsx b/ui/components/scans/scans-page-shell.test.tsx
index d8a40407e7..c142c2e3ac 100644
--- a/ui/components/scans/scans-page-shell.test.tsx
+++ b/ui/components/scans/scans-page-shell.test.tsx
@@ -3,6 +3,7 @@ import userEvent from "@testing-library/user-event";
import { afterEach, describe, expect, it, vi } from "vitest";
import { useScansStore } from "@/store";
+import { ProviderProps } from "@/types";
import { ScansPageShell } from "./scans-page-shell";
@@ -102,12 +103,13 @@ vi.mock("@/components/providers/muted-findings-config-button", () => ({
MutedFindingsConfigButton: () => <a href="/mutelist">Configure Mutelist</a>,
}));
-const providers = [
+const providers: ProviderProps[] = [
{
id: "provider-1",
type: "providers" as const,
attributes: {
provider: "aws" as const,
+ is_dynamic: false,
uid: "123456789012",
alias: "Production",
status: "completed" as const,
diff --git a/ui/components/scans/scans-page-shell.tsx b/ui/components/scans/scans-page-shell.tsx
index 4682ff6dfb..b553d224b5 100644
--- a/ui/components/scans/scans-page-shell.tsx
+++ b/ui/components/scans/scans-page-shell.tsx
@@ -17,9 +17,11 @@ import {
LAUNCH_SCAN_SEARCH_PARAM,
LAUNCH_SCAN_SEARCH_VALUE,
} from "@/lib/scans-navigation";
+import { isCloud } from "@/lib/shared/env";
import { buildViewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
import { useScansStore } from "@/store";
import { SCAN_JOBS_TAB, SCAN_TAB_LABELS, type ScanJobsTab } from "@/types";
+import type { ProviderGroup } from "@/types/components";
import type { ProviderProps } from "@/types/providers";
import type { ScanScheduleCapability } from "@/types/schedules";
@@ -32,6 +34,7 @@ import { useScansFilters } from "./use-scans-filters";
interface ScansPageShellProps {
providers: ProviderProps[];
+ providerGroups?: ProviderGroup[];
hasManageScansPermission: boolean;
activeScanCount?: number;
children: ReactNode;
@@ -42,6 +45,7 @@ interface ScansPageShellProps {
export function ScansPageShell({
providers,
+ providerGroups = [],
hasManageScansPermission,
activeScanCount = 0,
children,
@@ -64,7 +68,7 @@ export function ScansPageShell({
const hasConnectedProviders = providers.some(
(provider) => provider.attributes.connection.connected === true,
);
- const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const isCloudEnvironment = isCloud();
const launchDisabled = !hasManageScansPermission || !hasConnectedProviders;
const launchOpen = isLaunchScanModalOpen || urlLaunchOpen;
// When a scan is already running, the tour highlights its row (anchored in
@@ -116,6 +120,7 @@ export function ScansPageShell({
>
<ScansFilterBar
providers={providers}
+ providerGroups={providerGroups}
activeTab={filters.activeTab}
scheduleType={filters.scheduleType}
scanStatus={filters.scanStatus}
diff --git a/ui/components/scans/scans.utils.test.ts b/ui/components/scans/scans.utils.test.ts
index b24ea8cbd4..558533f01c 100644
--- a/ui/components/scans/scans.utils.test.ts
+++ b/ui/components/scans/scans.utils.test.ts
@@ -177,6 +177,7 @@ describe("buildPendingScheduleRows", () => {
type: "providers",
attributes: {
provider: "aws",
+ is_dynamic: false,
uid: `uid-${id}`,
alias: `alias-${id}`,
status: "completed",
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
index 27f5c302de..e8e64ce77a 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
@@ -26,7 +26,7 @@ vi.mock("@/actions/schedules", () => ({
updateSchedulesBulk: updateSchedulesBulkMock,
}));
-vi.mock("@/components/ui/toast", () => ({
+vi.mock("@/components/shadcn/toast", () => ({
toast: toastMock,
}));
@@ -40,7 +40,7 @@ vi.mock("@/components/icons/providers-badge/provider-type-icon", () => ({
),
}));
-vi.mock("@/components/ui/entities", () => ({
+vi.mock("@/components/shadcn/entities", () => ({
EntityInfo: ({
badge,
cloudProvider,
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
index 73fd781411..f8caa12c1f 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
@@ -16,10 +16,10 @@ import {
type ProviderTypeIconStackItem,
} from "@/components/icons/providers-badge/provider-type-icon";
import { Button, FieldError } from "@/components/shadcn";
+import { EntityInfo } from "@/components/shadcn/entities";
+import { FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
-import { EntityInfo } from "@/components/ui/entities";
-import { FormButtons } from "@/components/ui/form";
-import { toast } from "@/components/ui/toast";
+import { toast } from "@/components/shadcn/toast";
import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
import { runWithConcurrencyLimit } from "@/lib/concurrency";
import {
diff --git a/ui/components/scans/schedule/scan-schedule-fields.test.tsx b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
index dd311d880e..2beadf68ad 100644
--- a/ui/components/scans/schedule/scan-schedule-fields.test.tsx
+++ b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
@@ -1,9 +1,11 @@
import { render, screen } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
import { useForm } from "react-hook-form";
-import { beforeAll, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
import { getScheduleFormDefaults } from "@/lib/schedules";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
import type { ScheduleFormValues } from "@/types/schedules";
import { ScanScheduleFields } from "./scan-schedule-fields";
@@ -58,6 +60,9 @@ function getHelperCopy(text: RegExp) {
}
describe("ScanScheduleFields", () => {
+ afterEach(() => {
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+ });
it("updates the helper copy when the cadence changes to interval", async () => {
// Given
const user = userEvent.setup();
@@ -97,8 +102,9 @@ describe("ScanScheduleFields", () => {
);
});
- it("shows a single cloud badge beside the Scan Schedule title when advanced controls are locked", () => {
+ it("opens advanced scheduling from the Cloud badge when controls are locked", async () => {
// Given
+ const user = userEvent.setup();
render(
<ScheduleFieldsHarness
canUseAdvancedSchedule={false}
@@ -107,15 +113,27 @@ describe("ScanScheduleFields", () => {
);
// Then
- expect(screen.getAllByText("Available in Prowler Cloud")).toHaveLength(1);
+ expect(screen.getAllByText("Cloud")).toHaveLength(1);
expect(screen.getByText("Scan Schedule").parentElement).toHaveTextContent(
- "Available in Prowler Cloud",
+ "Cloud",
);
expect(screen.getByText("Scan Time").parentElement).not.toHaveTextContent(
- "Available in Prowler Cloud",
+ "Cloud",
);
expect(screen.getByText("Repeats").parentElement).not.toHaveTextContent(
- "Available in Prowler Cloud",
+ "Cloud",
+ );
+
+ // When
+ await user.click(
+ screen.getByRole("button", {
+ name: "Explore advanced scheduling in Prowler Cloud",
+ }),
+ );
+
+ // Then
+ expect(useCloudUpgradeStore.getState().activeFeature).toBe(
+ CLOUD_UPGRADE_FEATURE.ADVANCED_SCHEDULING,
);
});
});
diff --git a/ui/components/scans/schedule/scan-schedule-fields.tsx b/ui/components/scans/schedule/scan-schedule-fields.tsx
index 9351ca5336..a83d8d3c0b 100644
--- a/ui/components/scans/schedule/scan-schedule-fields.tsx
+++ b/ui/components/scans/schedule/scan-schedule-fields.tsx
@@ -6,6 +6,8 @@ import type { ReactNode } from "react";
import { Controller, type UseFormReturn, useWatch } from "react-hook-form";
import {
+ Badge,
+ Button,
Checkbox,
Field,
FieldLabel,
@@ -15,13 +17,14 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn";
-import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
import {
formatDayOfMonth,
formatScheduleHour,
getBrowserTimezone,
getNextScheduledRun,
} from "@/lib/schedules";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
import {
SCHEDULE_FREQUENCY,
SCHEDULE_WEEKDAY_LABELS,
@@ -130,6 +133,9 @@ export function ScanScheduleFields({
canUseAdvancedSchedule = true,
showCloudUpgradeBadge = false,
}: ScanScheduleFieldsProps) {
+ const openCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.openCloudUpgrade,
+ );
// useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
const control = form.control;
const [frequency, hour, dayOfWeek, dayOfMonth, intervalHours] = useWatch({
@@ -149,7 +155,19 @@ export function ScanScheduleFields({
// ignores them, so they are display-only with a Cloud upsell.
const advancedDisabled = disabled || !canUseAdvancedSchedule;
const cloudUpgradeBadge = showCloudUpgradeBadge ? (
- <CloudFeatureBadgeLink size="sm" />
+ <Button
+ type="button"
+ variant="bare"
+ size="link-xs"
+ aria-label="Explore advanced scheduling in Prowler Cloud"
+ onClick={() =>
+ openCloudUpgrade(CLOUD_UPGRADE_FEATURE.ADVANCED_SCHEDULING)
+ }
+ >
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>
+ </Button>
) : null;
return (
diff --git a/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
index 8251bdddc4..53aefda632 100644
--- a/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
+++ b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
@@ -7,7 +7,7 @@ import { ScanJobsTable } from "../scan-jobs-table";
// Mock DataTable to a minimal table that applies getRowAttributes per row, so we can
// assert the view-first-scan "in-progress" anchor lands on the right row/tab.
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTable: ({
data,
getRowAttributes,
diff --git a/ui/components/scans/table/cells/account-cell.tsx b/ui/components/scans/table/cells/account-cell.tsx
index ecc7bcc987..104e94610e 100644
--- a/ui/components/scans/table/cells/account-cell.tsx
+++ b/ui/components/scans/table/cells/account-cell.tsx
@@ -1,6 +1,6 @@
"use client";
-import { EntityInfo } from "@/components/ui/entities";
+import { EntityInfo } from "@/components/shadcn/entities";
import type { ProviderType, ScanProps } from "@/types";
export function AccountCell({ scan }: { scan: ScanProps }) {
diff --git a/ui/components/scans/table/cells/scan-info-cell.tsx b/ui/components/scans/table/cells/scan-info-cell.tsx
index 7731a2fae1..226732d8fa 100644
--- a/ui/components/scans/table/cells/scan-info-cell.tsx
+++ b/ui/components/scans/table/cells/scan-info-cell.tsx
@@ -7,7 +7,7 @@ import {
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn";
-import { EntityInfo } from "@/components/ui/entities";
+import { EntityInfo } from "@/components/shadcn/entities";
import type { ScanProps } from "@/types";
export function ScanInfoCell({ scan }: { scan: ScanProps }) {
diff --git a/ui/components/scans/table/scan-jobs-columns.test.tsx b/ui/components/scans/table/scan-jobs-columns.test.tsx
index 4f8891666c..3a30d74800 100644
--- a/ui/components/scans/table/scan-jobs-columns.test.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.test.tsx
@@ -5,7 +5,8 @@ import { describe, expect, it, vi } from "vitest";
import type { ScanProps } from "@/types";
-vi.mock("@/components/shadcn", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
Badge: ({ children }: { children: ReactNode }) => <span>{children}</span>,
Progress: () => <div />,
StackedCell: ({
@@ -22,7 +23,7 @@ vi.mock("@/components/shadcn", () => ({
),
}));
-vi.mock("@/components/ui/entities", () => ({
+vi.mock("@/components/shadcn/entities", () => ({
DateWithTime: () => <time />,
EntityInfo: ({
entityAlias,
@@ -42,7 +43,7 @@ vi.mock("@/components/ui/entities", () => ({
),
}));
-vi.mock("@/components/ui/custom", () => ({
+vi.mock("@/components/shadcn/custom", () => ({
TableLink: ({
href,
isDisabled,
@@ -54,7 +55,7 @@ vi.mock("@/components/ui/custom", () => ({
}) => (isDisabled ? <span>{label}</span> : <a href={href}>{label}</a>),
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTableColumnHeader: ({ title }: { title: string }) => <span>{title}</span>,
}));
diff --git a/ui/components/scans/table/scan-jobs-columns.tsx b/ui/components/scans/table/scan-jobs-columns.tsx
index 1367c718de..553310ec0d 100644
--- a/ui/components/scans/table/scan-jobs-columns.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.tsx
@@ -3,8 +3,8 @@
import type { ColumnDef } from "@tanstack/react-table";
import { StackedCell } from "@/components/shadcn";
-import { DataTableColumnHeader } from "@/components/ui/table";
-import { StatusBadge } from "@/components/ui/table/status-badge";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
+import { StatusBadge } from "@/components/shadcn/table/status-badge";
import { formatLocalDate, formatLocalTimeWithZone } from "@/lib/date-utils";
import { SCAN_JOBS_TAB, type ScanJobsTab, type ScanProps } from "@/types";
import type { ScanScheduleCapability } from "@/types/schedules";
diff --git a/ui/components/scans/table/scan-jobs-row-actions.test.tsx b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
index dff5a81677..e547374098 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.test.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
@@ -27,7 +27,8 @@ vi.mock("next/navigation", () => ({
}),
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: toastMock }),
}));
@@ -332,7 +333,7 @@ describe("ScanJobsRowActions", () => {
// Then
expect(pushMock).toHaveBeenCalledWith(
- "/findings?filter[scan]=scan-1&filter[inserted_at]=2026-01-01&filter[status__in]=FAIL",
+ "/findings?filter[scan__in]=scan-1&filter[inserted_at]=2026-01-01&filter[status__in]=FAIL",
);
});
diff --git a/ui/components/scans/table/scan-jobs-row-actions.tsx b/ui/components/scans/table/scan-jobs-row-actions.tsx
index 69935ed85c..15d9bf0085 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.tsx
@@ -24,11 +24,11 @@ import {
EditScanScheduleModal,
type EditScanScheduleState,
} from "@/components/scans/schedule/edit-scan-schedule-modal";
+import { useToast } from "@/components/shadcn";
import {
ActionDropdown,
ActionDropdownItem,
} from "@/components/shadcn/dropdown";
-import { useToast } from "@/components/ui";
import { toLocalDateString } from "@/lib/date-utils";
import { downloadScanZip } from "@/lib/helper";
import { getScanScheduleCapability } from "@/lib/schedules";
@@ -93,7 +93,7 @@ export function ScanJobsRowActions({
const openFindings = () => {
if (!isCompleted || !scanDate) return;
router.push(
- `/findings?filter[scan]=${scan.id}&filter[inserted_at]=${scanDate}&filter[status__in]=FAIL`,
+ `/findings?filter[scan__in]=${scan.id}&filter[inserted_at]=${scanDate}&filter[status__in]=FAIL`,
);
};
diff --git a/ui/components/scans/table/scan-jobs-table.test.tsx b/ui/components/scans/table/scan-jobs-table.test.tsx
index f11f227373..2338f89bc5 100644
--- a/ui/components/scans/table/scan-jobs-table.test.tsx
+++ b/ui/components/scans/table/scan-jobs-table.test.tsx
@@ -10,7 +10,7 @@ const { getScanJobsColumnsMock } = vi.hoisted(() => ({
getScanJobsColumnsMock: vi.fn((_options: unknown) => []),
}));
-vi.mock("@/components/ui/table", () => ({
+vi.mock("@/components/shadcn/table", () => ({
DataTable: ({ data }: { data: ScanProps[] }) => (
<div data-testid="scan-jobs-data-table">{data.length}</div>
),
diff --git a/ui/components/scans/table/scan-jobs-table.tsx b/ui/components/scans/table/scan-jobs-table.tsx
index de8d57c4a9..35c53b8e3e 100644
--- a/ui/components/scans/table/scan-jobs-table.tsx
+++ b/ui/components/scans/table/scan-jobs-table.tsx
@@ -1,6 +1,6 @@
"use client";
-import { DataTable } from "@/components/ui/table";
+import { DataTable } from "@/components/shadcn/table";
import type { MetaDataProps, ScanJobsTab, ScanProps } from "@/types";
import { SCAN_JOBS_TAB } from "@/types";
import type { ScanScheduleCapability } from "@/types/schedules";
diff --git a/ui/components/scans/table/skeleton-table-scans.tsx b/ui/components/scans/table/skeleton-table-scans.tsx
index b435225af9..160e756106 100644
--- a/ui/components/scans/table/skeleton-table-scans.tsx
+++ b/ui/components/scans/table/skeleton-table-scans.tsx
@@ -184,7 +184,7 @@ export const SkeletonTableScans = ({
const columns = COLUMNS_BY_TAB[tab];
return (
- <div className="rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col justify-between gap-4 overflow-hidden border p-4">
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col justify-between gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
{/* Toolbar — mirrors DataTable's flex-col → md:flex-row layout (no search, only total entries) */}
<div className="flex flex-col items-start gap-3 md:flex-row md:items-center md:justify-between">
<div className="w-full md:w-auto" />
diff --git a/ui/components/services/ServiceCard.tsx b/ui/components/services/ServiceCard.tsx
index 8447607eee..e7602abe4d 100644
--- a/ui/components/services/ServiceCard.tsx
+++ b/ui/components/services/ServiceCard.tsx
@@ -1,5 +1,4 @@
-import { Card, CardBody } from "@heroui/card";
-import { Chip } from "@heroui/chip";
+import { Badge, Card, CardContent } from "@/components/shadcn";
import { getAWSIcon, NotificationIcon, SuccessIcon } from "../icons";
@@ -12,13 +11,17 @@ export const ServiceCard: React.FC<CardServiceProps> = ({
serviceAlias,
}) => {
return (
- <Card fullWidth isPressable isHoverable shadow="sm">
- <CardBody className="flex flex-row items-center justify-between gap-4">
+ <Card
+ role="button"
+ tabIndex={0}
+ className="bg-bg-neutral-secondary hover:bg-bg-neutral-tertiary w-full cursor-pointer gap-0 shadow-sm transition-colors"
+ >
+ <CardContent className="flex flex-row items-center justify-between gap-4 p-3">
<div className="flex items-center gap-4">
{getAWSIcon(serviceAlias)}
<div className="flex flex-col">
<h4 className="text-md leading-5 font-bold">{serviceAlias}</h4>
- <small className="text-default-500">
+ <small className="text-text-neutral-tertiary">
{fidingsFailed > 0
? `${fidingsFailed} Failed Findings`
: "No failed findings"}
@@ -26,23 +29,18 @@ export const ServiceCard: React.FC<CardServiceProps> = ({
</div>
</div>
- <Chip
- className="h-10"
- variant="flat"
- startContent={
- fidingsFailed > 0 ? (
- <NotificationIcon size={18} />
- ) : (
- <SuccessIcon size={18} />
- )
- }
- color={fidingsFailed > 0 ? "danger" : "success"}
- radius="full"
- size="md"
+ <Badge
+ className="h-10 [&>svg]:size-[18px]"
+ variant={fidingsFailed > 0 ? "error" : "success"}
>
+ {fidingsFailed > 0 ? (
+ <NotificationIcon size={18} />
+ ) : (
+ <SuccessIcon size={18} />
+ )}
{fidingsFailed > 0 ? fidingsFailed : ""}
- </Chip>
- </CardBody>
+ </Badge>
+ </CardContent>
</Card>
);
};
diff --git a/ui/components/services/ServiceSkeletonGrid.tsx b/ui/components/services/ServiceSkeletonGrid.tsx
index 4270f9a716..8c7abaad3f 100644
--- a/ui/components/services/ServiceSkeletonGrid.tsx
+++ b/ui/components/services/ServiceSkeletonGrid.tsx
@@ -1,6 +1,4 @@
-import { Card } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
-import React from "react";
+import { Card, Skeleton } from "@/components/shadcn";
export const ServiceSkeletonGrid = () => {
return (
@@ -8,9 +6,7 @@ export const ServiceSkeletonGrid = () => {
<div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 xl:grid-cols-4">
{[...Array(25)].map((_, index) => (
<div key={index} className="flex flex-col gap-4">
- <Skeleton className="h-16 rounded-lg">
- <div className="bg-default-300 h-full"></div>
- </Skeleton>
+ <Skeleton className="h-16 rounded-lg" />
</div>
))}
</div>
diff --git a/ui/components/shadcn/accordion/Accordion.test.tsx b/ui/components/shadcn/accordion/Accordion.test.tsx
new file mode 100644
index 0000000000..f4cde74d1f
--- /dev/null
+++ b/ui/components/shadcn/accordion/Accordion.test.tsx
@@ -0,0 +1,193 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useState } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+import { Accordion, AccordionItemProps } from "./Accordion";
+
+const buildItems = (): AccordionItemProps[] => [
+ { key: "first", title: "First item", content: "First content" },
+ { key: "second", title: "Second item", content: "Second content" },
+];
+
+describe("Accordion", () => {
+ describe("when uncontrolled", () => {
+ it("should expand an item when its trigger is clicked", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<Accordion items={buildItems()} />);
+ expect(screen.queryByText("First content")).not.toBeInTheDocument();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "First item" }));
+
+ // Then
+ expect(screen.getByText("First content")).toBeVisible();
+ });
+
+ it("should collapse an expanded item when its trigger is clicked again", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <Accordion items={buildItems()} defaultExpandedKeys={["first"]} />,
+ );
+ expect(screen.getByText("First content")).toBeVisible();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "First item" }));
+
+ // Then
+ expect(screen.queryByText("First content")).not.toBeInTheDocument();
+ });
+
+ it("should collapse siblings in single selection mode", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <Accordion
+ items={buildItems()}
+ selectionMode="single"
+ defaultExpandedKeys={["first"]}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Second item" }));
+
+ // Then
+ expect(screen.getByText("Second content")).toBeVisible();
+ expect(screen.queryByText("First content")).not.toBeInTheDocument();
+ });
+
+ it("should keep siblings expanded in multiple selection mode", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <Accordion
+ items={buildItems()}
+ selectionMode="multiple"
+ defaultExpandedKeys={["first"]}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Second item" }));
+
+ // Then
+ expect(screen.getByText("First content")).toBeVisible();
+ expect(screen.getByText("Second content")).toBeVisible();
+ });
+
+ it("should not expand a disabled item", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <Accordion
+ items={[
+ {
+ key: "locked",
+ title: "Locked item",
+ content: "Locked content",
+ isDisabled: true,
+ },
+ ]}
+ />,
+ );
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Locked item" }));
+
+ // Then
+ expect(screen.queryByText("Locked content")).not.toBeInTheDocument();
+ });
+ });
+
+ describe("when controlled", () => {
+ it("should reflect the selectedKeys prop and report changes through onSelectionChange", async () => {
+ // Given
+ const user = userEvent.setup();
+ const onSelectionChange = vi.fn();
+ const ControlledAccordion = () => {
+ const [keys, setKeys] = useState<string[]>([]);
+ return (
+ <Accordion
+ items={buildItems()}
+ selectionMode="multiple"
+ selectedKeys={keys}
+ onSelectionChange={(next) => {
+ onSelectionChange(next);
+ setKeys(next);
+ }}
+ />
+ );
+ };
+ render(<ControlledAccordion />);
+
+ // When
+ await user.click(screen.getByRole("button", { name: "First item" }));
+
+ // Then
+ expect(onSelectionChange).toHaveBeenCalledWith(["first"]);
+ expect(screen.getByText("First content")).toBeVisible();
+
+ // When the item is toggled off
+ await user.click(screen.getByRole("button", { name: "First item" }));
+
+ // Then
+ expect(onSelectionChange).toHaveBeenLastCalledWith([]);
+ expect(screen.queryByText("First content")).not.toBeInTheDocument();
+ });
+
+ it("should not expand items on click when the parent ignores selection changes", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<Accordion items={buildItems()} selectedKeys={[]} />);
+
+ // When
+ await user.click(screen.getByRole("button", { name: "First item" }));
+
+ // Then
+ expect(screen.queryByText("First content")).not.toBeInTheDocument();
+ });
+ });
+
+ describe("when items are nested", () => {
+ it("should render nested accordions sharing the controlled selection", async () => {
+ // Given
+ const user = userEvent.setup();
+ const ControlledAccordion = () => {
+ const [keys, setKeys] = useState<string[]>(["parent"]);
+ return (
+ <Accordion
+ items={[
+ {
+ key: "parent",
+ title: "Parent item",
+ content: "Parent content",
+ items: [
+ {
+ key: "child",
+ title: "Child item",
+ content: "Child content",
+ },
+ ],
+ },
+ ]}
+ selectionMode="multiple"
+ selectedKeys={keys}
+ onSelectionChange={setKeys}
+ />
+ );
+ };
+ render(<ControlledAccordion />);
+ expect(screen.getByText("Parent content")).toBeVisible();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Child item" }));
+
+ // Then both levels stay expanded
+ expect(screen.getByText("Parent content")).toBeVisible();
+ expect(screen.getByText("Child content")).toBeVisible();
+ });
+ });
+});
diff --git a/ui/components/shadcn/accordion/Accordion.tsx b/ui/components/shadcn/accordion/Accordion.tsx
new file mode 100644
index 0000000000..5ac80ccc3d
--- /dev/null
+++ b/ui/components/shadcn/accordion/Accordion.tsx
@@ -0,0 +1,178 @@
+"use client";
+
+import { ChevronDown } from "lucide-react";
+import { Children, ReactNode, useState } from "react";
+
+import {
+ Collapsible,
+ CollapsibleContent,
+ CollapsibleTrigger,
+} from "@/components/shadcn/collapsible";
+import { cn } from "@/lib/utils";
+
+export interface AccordionItemProps {
+ key: string;
+ title: ReactNode;
+ subtitle?: ReactNode;
+ content: ReactNode;
+ items?: AccordionItemProps[];
+ isDisabled?: boolean;
+}
+
+export interface AccordionProps {
+ items: AccordionItemProps[];
+ variant?: "light" | "shadow" | "bordered" | "splitted";
+ className?: string;
+ defaultExpandedKeys?: string[];
+ selectedKeys?: string[];
+ selectionMode?: "single" | "multiple";
+ isCompact?: boolean;
+ showDivider?: boolean;
+ onItemExpand?: (key: string) => void;
+ onSelectionChange?: (keys: string[]) => void;
+}
+
+const AccordionContent = ({
+ content,
+ items,
+ selectedKeys,
+ onSelectionChange,
+}: {
+ content: ReactNode;
+ items?: AccordionItemProps[];
+ selectedKeys?: string[];
+ onSelectionChange?: (keys: string[]) => void;
+}) => {
+ // Normalize possible array content to automatically assign stable keys
+ const normalizedContent = Array.isArray(content)
+ ? Children.toArray(content)
+ : content;
+
+ return (
+ <div className="text-text-neutral-secondary text-sm">
+ {normalizedContent}
+ {items && items.length > 0 && (
+ <div className="border-border-neutral-secondary mt-4 ml-2 border-l-2 pl-4">
+ <Accordion
+ items={items}
+ variant="light"
+ isCompact
+ selectionMode="multiple"
+ selectedKeys={selectedKeys}
+ onSelectionChange={onSelectionChange}
+ />
+ </div>
+ )}
+ </div>
+ );
+};
+
+export const Accordion = ({
+ items,
+ variant = "light",
+ className,
+ defaultExpandedKeys = [],
+ selectedKeys,
+ selectionMode = "single",
+ isCompact = false,
+ showDivider = true,
+ onItemExpand,
+ onSelectionChange,
+}: AccordionProps) => {
+ // Determine if component is in controlled or uncontrolled mode
+ const isControlled = selectedKeys !== undefined;
+
+ const [internalExpandedKeys, setInternalExpandedKeys] =
+ useState<string[]>(defaultExpandedKeys);
+
+ // Use selectedKeys if controlled, otherwise use internal state
+ const expandedKeys = isControlled ? selectedKeys : internalExpandedKeys;
+
+ const handleToggle = (key: string, open: boolean) => {
+ let nextKeys: string[];
+
+ if (open) {
+ // Single mode collapses siblings; multiple mode keeps the whole set so
+ // nested accordions sharing the same controlled state don't wipe parents
+ nextKeys = selectionMode === "multiple" ? [...expandedKeys, key] : [key];
+ onItemExpand?.(key);
+ } else {
+ nextKeys = expandedKeys.filter((expandedKey) => expandedKey !== key);
+ }
+
+ if (isControlled) {
+ onSelectionChange?.(nextKeys);
+ } else {
+ setInternalExpandedKeys(nextKeys);
+ }
+ };
+
+ return (
+ <div
+ data-variant={variant}
+ className={cn(
+ "bg-bg-input-primary dark:bg-input/30 border-border-neutral-secondary w-full rounded-lg border px-2 py-1",
+ className,
+ )}
+ >
+ {items.map((item, index) => {
+ const isExpanded = expandedKeys.includes(item.key);
+
+ return (
+ <div key={item.key}>
+ <Collapsible
+ data-accordion-key={item.key}
+ open={isExpanded}
+ onOpenChange={(open) => handleToggle(item.key, open)}
+ disabled={item.isDisabled}
+ className="my-2"
+ >
+ <CollapsibleTrigger
+ aria-label={
+ typeof item.title === "string"
+ ? item.title
+ : `Item ${item.key}`
+ }
+ className={cn(
+ "hover:bg-bg-neutral-tertiary data-[state=open]:bg-bg-neutral-tertiary flex w-full items-center rounded-lg px-3 transition-colors disabled:cursor-not-allowed disabled:opacity-50",
+ isCompact ? "py-2" : "py-3",
+ )}
+ >
+ <div className="flex-1 text-left">
+ <div className="text-sm">{item.title}</div>
+ {item.subtitle && (
+ <div className="text-text-neutral-tertiary text-xs">
+ {item.subtitle}
+ </div>
+ )}
+ </div>
+ <ChevronDown
+ aria-hidden="true"
+ className={cn(
+ "text-text-neutral-tertiary shrink-0 transition-transform duration-200",
+ isExpanded && "rotate-180",
+ )}
+ />
+ </CollapsibleTrigger>
+ <CollapsibleContent className="data-[state=closed]:animate-collapsible-up data-[state=open]:animate-collapsible-down overflow-hidden">
+ <div className="px-3 py-3">
+ <AccordionContent
+ content={item.content}
+ items={item.items}
+ selectedKeys={selectedKeys}
+ onSelectionChange={onSelectionChange}
+ />
+ </div>
+ </CollapsibleContent>
+ </Collapsible>
+ {showDivider && index < items.length - 1 && (
+ <div className="bg-border-neutral-secondary h-px w-full" />
+ )}
+ </div>
+ );
+ })}
+ </div>
+ );
+};
+
+Accordion.displayName = "Accordion";
diff --git a/ui/components/shadcn/accordion/index.ts b/ui/components/shadcn/accordion/index.ts
new file mode 100644
index 0000000000..16e0243c2a
--- /dev/null
+++ b/ui/components/shadcn/accordion/index.ts
@@ -0,0 +1 @@
+export * from "./Accordion";
diff --git a/ui/components/shadcn/action-card/ActionCard.tsx b/ui/components/shadcn/action-card/ActionCard.tsx
new file mode 100644
index 0000000000..5359cc176c
--- /dev/null
+++ b/ui/components/shadcn/action-card/ActionCard.tsx
@@ -0,0 +1,90 @@
+"use client";
+
+import { Icon } from "@iconify/react";
+
+import {
+ Card,
+ CardContent,
+ type CardProps,
+} from "@/components/shadcn/card/card";
+import { cn } from "@/lib/utils";
+
+const COLOR_STYLES = {
+ success: {
+ card: "border-bg-pass",
+ iconWrapper: "bg-bg-pass-secondary border-bg-pass",
+ icon: "text-text-success-primary",
+ },
+ secondary: {
+ card: "border-violet-200 dark:border-violet-950",
+ iconWrapper:
+ "bg-violet-50 dark:bg-violet-950 border-violet-200 dark:border-violet-900",
+ icon: "text-violet-600 dark:text-violet-400",
+ },
+ warning: {
+ card: "border-amber-500 dark:border-amber-400",
+ iconWrapper:
+ "bg-bg-warning-secondary border-amber-100 dark:border-amber-900",
+ icon: "text-text-warning-primary",
+ },
+ fail: {
+ card: "border-rose-400 dark:border-rose-700",
+ iconWrapper: "bg-bg-fail-secondary border-rose-200 dark:border-rose-900",
+ icon: "text-text-error",
+ },
+ default: {
+ card: "border-border-neutral-secondary",
+ iconWrapper: "bg-bg-neutral-tertiary border-border-neutral-secondary",
+ icon: "text-text-neutral-tertiary",
+ },
+} as const;
+
+export type ActionCardProps = CardProps & {
+ icon: string;
+ title: string;
+ color?: "success" | "secondary" | "warning" | "fail";
+ description: string;
+};
+
+export const ActionCard = ({
+ color,
+ title,
+ icon,
+ description,
+ children,
+ className,
+ ...props
+}: ActionCardProps) => {
+ const colors = COLOR_STYLES[color ?? "default"];
+
+ return (
+ <Card
+ role="button"
+ tabIndex={0}
+ className={cn(
+ "bg-bg-neutral-secondary hover:bg-bg-neutral-tertiary cursor-pointer gap-0 shadow-sm transition-colors",
+ "border",
+ colors.card,
+ className,
+ )}
+ {...props}
+ >
+ <CardContent className="flex h-full flex-row items-center gap-2 p-2">
+ <div
+ className={cn(
+ "item-center flex rounded-xl border p-1",
+ colors.iconWrapper,
+ )}
+ >
+ <Icon className={colors.icon} icon={icon} width={24} />
+ </div>
+ <div className="flex flex-col">
+ <p className="text-md">{title}</p>
+ <p className="text-text-neutral-tertiary text-sm">
+ {description || children}
+ </p>
+ </div>
+ </CardContent>
+ </Card>
+ );
+};
diff --git a/ui/components/shadcn/action-card/index.ts b/ui/components/shadcn/action-card/index.ts
new file mode 100644
index 0000000000..c485969635
--- /dev/null
+++ b/ui/components/shadcn/action-card/index.ts
@@ -0,0 +1 @@
+export * from "./ActionCard";
diff --git a/ui/components/ui/alert-dialog/AlertDialog.tsx b/ui/components/shadcn/alert-dialog/AlertDialog.tsx
similarity index 99%
rename from ui/components/ui/alert-dialog/AlertDialog.tsx
rename to ui/components/shadcn/alert-dialog/AlertDialog.tsx
index a10434174e..ac81e1460b 100644
--- a/ui/components/ui/alert-dialog/AlertDialog.tsx
+++ b/ui/components/shadcn/alert-dialog/AlertDialog.tsx
@@ -1,9 +1,10 @@
"use client";
-import { cn } from "@heroui/theme";
import * as AlertDialogPrimitive from "@radix-ui/react-alert-dialog";
import * as React from "react";
+import { cn } from "@/lib/utils";
+
const AlertDialog = AlertDialogPrimitive.Root;
const AlertDialogTrigger = AlertDialogPrimitive.Trigger;
diff --git a/ui/components/shadcn/alert-dialog/index.ts b/ui/components/shadcn/alert-dialog/index.ts
new file mode 100644
index 0000000000..ba87679af2
--- /dev/null
+++ b/ui/components/shadcn/alert-dialog/index.ts
@@ -0,0 +1 @@
+export * from "./AlertDialog";
diff --git a/ui/components/ui/avatar/avatar.tsx b/ui/components/shadcn/avatar/avatar.tsx
similarity index 100%
rename from ui/components/ui/avatar/avatar.tsx
rename to ui/components/shadcn/avatar/avatar.tsx
diff --git a/ui/components/shadcn/avatar/index.ts b/ui/components/shadcn/avatar/index.ts
new file mode 100644
index 0000000000..90fdb226bc
--- /dev/null
+++ b/ui/components/shadcn/avatar/index.ts
@@ -0,0 +1 @@
+export * from "./avatar";
diff --git a/ui/components/shadcn/badge/badge.test.tsx b/ui/components/shadcn/badge/badge.test.tsx
index adae2f54b8..51f68d4610 100644
--- a/ui/components/shadcn/badge/badge.test.tsx
+++ b/ui/components/shadcn/badge/badge.test.tsx
@@ -18,6 +18,39 @@ describe("Badge", () => {
expect(badge?.className).toContain("text-bg-data-info");
});
+ it("applies the Cloud variant and compact size", () => {
+ // Given / When
+ render(
+ <Badge variant="cloud" size="sm">
+ Cloud
+ </Badge>,
+ );
+
+ // Then
+ expect(screen.getByText("Cloud")).toHaveClass(
+ "bg-feature-cloud",
+ "h-5",
+ "rounded-md",
+ "text-[10px]",
+ );
+ });
+
+ it("applies the New feature variant tokens", () => {
+ // Given / When
+ render(
+ <Badge variant="new" size="sm">
+ New
+ </Badge>,
+ );
+
+ // Then
+ expect(screen.getByText("New")).toHaveClass(
+ "bg-bg-feature-new",
+ "text-text-feature-new",
+ "h-5",
+ );
+ });
+
it("merges a custom className", () => {
const { container } = render(
<Badge variant="tag" className="extra-class">
diff --git a/ui/components/shadcn/badge/badge.tsx b/ui/components/shadcn/badge/badge.tsx
index fd1a6efd11..7e727e1a33 100644
--- a/ui/components/shadcn/badge/badge.tsx
+++ b/ui/components/shadcn/badge/badge.tsx
@@ -10,13 +10,13 @@ const badgeVariants = cva(
variants: {
variant: {
default:
- "border-transparent bg-primary text-primary-foreground [a&]:hover:bg-primary/90",
+ "border-transparent bg-button-primary text-black [a&]:hover:bg-button-primary/90",
secondary:
- "border-transparent bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90",
+ "border-transparent bg-violet-600 text-white dark:bg-violet-500 [a&]:hover:bg-violet-600/90 dark:[a&]:hover:bg-violet-500/90",
destructive:
"border-transparent bg-destructive text-white [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60",
outline:
- "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground",
+ "text-text-neutral-primary [a&]:hover:bg-accent [a&]:hover:text-accent-foreground",
tag: "bg-bg-tag border-border-tag text-text-neutral-primary",
success:
"border-transparent bg-bg-pass-secondary text-text-success-primary",
@@ -25,10 +25,18 @@ const badgeVariants = cva(
error:
"border-transparent bg-bg-fail-secondary text-text-error-primary",
info: "border-transparent bg-bg-data-info/15 text-bg-data-info",
+ cloud:
+ "bg-feature-cloud h-6 rounded-lg border-0 px-2 py-0 text-xs leading-5 font-bold text-black",
+ new: "bg-bg-feature-new text-text-feature-new border-0 font-bold",
+ },
+ size: {
+ default: "",
+ sm: "h-5 rounded-md px-1.5 py-0 text-[10px] leading-4",
},
},
defaultVariants: {
variant: "default",
+ size: "default",
},
},
);
@@ -36,6 +44,7 @@ const badgeVariants = cva(
function Badge({
className,
variant,
+ size,
asChild = false,
...props
}: ComponentProps<"span"> &
@@ -45,7 +54,7 @@ function Badge({
return (
<Comp
data-slot="badge"
- className={cn(badgeVariants({ variant }), className)}
+ className={cn(badgeVariants({ variant, size }), className)}
{...props}
/>
);
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx b/ui/components/shadcn/breadcrumbs/breadcrumb-navigation.test.tsx
similarity index 52%
rename from ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
rename to ui/components/shadcn/breadcrumbs/breadcrumb-navigation.test.tsx
index 6277782433..5d85f092ec 100644
--- a/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
+++ b/ui/components/shadcn/breadcrumbs/breadcrumb-navigation.test.tsx
@@ -1,10 +1,14 @@
import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
import { BreadcrumbNavigation } from "./breadcrumb-navigation";
+const navigationMock = vi.hoisted(() => ({
+ pathname: "/findings",
+}));
+
vi.mock("next/navigation", () => ({
- usePathname: () => "/findings",
+ usePathname: () => navigationMock.pathname,
useSearchParams: () => new URLSearchParams(),
}));
@@ -12,16 +16,11 @@ vi.mock("@iconify/react", () => ({
Icon: ({ icon }: { icon: string }) => <span aria-label={icon} />,
}));
-vi.mock("@heroui/breadcrumbs", () => ({
- Breadcrumbs: ({ children }: { children: React.ReactNode }) => (
- <nav aria-label="Breadcrumb">{children}</nav>
- ),
- BreadcrumbItem: ({ children }: { children: React.ReactNode }) => (
- <span>{children}</span>
- ),
-}));
-
describe("BreadcrumbNavigation", () => {
+ afterEach(() => {
+ navigationMock.pathname = "/findings";
+ });
+
it("renders the title action next to the current breadcrumb title", () => {
// Given / When
render(
@@ -40,4 +39,25 @@ describe("BreadcrumbNavigation", () => {
screen.getByRole("button", { name: "Start product tour" }),
).toBeInTheDocument();
});
+
+ it("does not render icons for secondary breadcrumb items", () => {
+ // Given
+ navigationMock.pathname = "/scans/config";
+
+ // When
+ render(
+ <BreadcrumbNavigation
+ mode="auto"
+ title="Configuration"
+ icon="lucide:sliders"
+ />,
+ );
+
+ // Then
+ expect(screen.getByLabelText("lucide:timer")).toBeInTheDocument();
+ expect(screen.queryByLabelText("lucide:sliders")).not.toBeInTheDocument();
+ expect(
+ screen.getByRole("heading", { name: "Configuration" }),
+ ).toBeInTheDocument();
+ });
});
diff --git a/ui/components/shadcn/breadcrumbs/breadcrumb-navigation.tsx b/ui/components/shadcn/breadcrumbs/breadcrumb-navigation.tsx
new file mode 100644
index 0000000000..abe796009f
--- /dev/null
+++ b/ui/components/shadcn/breadcrumbs/breadcrumb-navigation.tsx
@@ -0,0 +1,249 @@
+"use client";
+
+import { Icon } from "@iconify/react";
+import Link from "next/link";
+import { usePathname, useSearchParams } from "next/navigation";
+import { ReactNode } from "react";
+
+import { LighthouseIcon } from "@/components/icons/Icons";
+import { cn } from "@/lib/utils";
+
+export interface CustomBreadcrumbItem {
+ name: string;
+ path?: string;
+ icon?: string | ReactNode;
+ isLast?: boolean;
+ isClickable?: boolean;
+ onClick?: () => void;
+}
+
+interface BreadcrumbNavigationProps {
+ mode?: "auto" | "custom" | "hybrid";
+ title?: string;
+ icon?: string | ReactNode;
+ titleAction?: ReactNode;
+ customItems?: CustomBreadcrumbItem[];
+ className?: string;
+ paramToPreserve?: string;
+ showTitle?: boolean;
+}
+
+export function BreadcrumbNavigation({
+ mode = "auto",
+ title,
+ icon,
+ titleAction,
+ customItems = [],
+ className = "",
+ paramToPreserve = "scanId",
+ showTitle = true,
+}: BreadcrumbNavigationProps) {
+ const pathname = usePathname();
+ const searchParams = useSearchParams();
+
+ const generateAutoBreadcrumbs = (): CustomBreadcrumbItem[] => {
+ const pathIconMapping: Record<string, string | ReactNode> = {
+ "/integrations": "lucide:puzzle",
+ "/alerts": "lucide:bell-ring",
+ "/providers": "lucide:cloud",
+ "/users": "lucide:users",
+ "/compliance": "lucide:shield-check",
+ "/findings": "lucide:search",
+ "/scans": "lucide:timer",
+ "/roles": "lucide:key",
+ "/resources": "lucide:database",
+ "/lighthouse": <LighthouseIcon />,
+ "/manage-groups": "lucide:users-2",
+ "/services": "lucide:server",
+ "/workloads": "lucide:layers",
+ "/attack-paths": "lucide:git-branch",
+ };
+
+ const pathSegments = pathname
+ .split("/")
+ .filter((segment) => segment !== "");
+
+ if (pathSegments.length === 0) {
+ return [{ name: "Home", path: "/", isLast: true }];
+ }
+
+ const breadcrumbs: CustomBreadcrumbItem[] = [];
+ let currentPath = "";
+
+ pathSegments.forEach((segment, index) => {
+ currentPath += `/${segment}`;
+ const isLast = index === pathSegments.length - 1;
+ let displayName = segment.charAt(0).toUpperCase() + segment.slice(1);
+
+ if (segment.includes("-")) {
+ displayName = segment
+ .split("-")
+ .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+ .join(" ");
+ }
+ if (segment === "lighthouse") {
+ displayName = "Lighthouse AI";
+ }
+
+ const segmentIcon = !isLast ? pathIconMapping[currentPath] : undefined;
+
+ breadcrumbs.push({
+ name: displayName,
+ path: currentPath,
+ icon: segmentIcon,
+ isLast,
+ isClickable: !isLast,
+ });
+ });
+
+ return breadcrumbs;
+ };
+
+ const buildNavigationUrl = (path: string) => {
+ const paramValue = searchParams.get(paramToPreserve);
+ if (path === "/compliance" && paramValue) {
+ return `/compliance?${paramToPreserve}=${paramValue}`;
+ }
+ return path;
+ };
+
+ const renderTitleWithIcon = (
+ titleText: string,
+ isLink: boolean = false,
+ showIcon: boolean = true,
+ ) => (
+ <div className="flex items-center gap-2">
+ {showIcon && typeof icon === "string" ? (
+ <Icon
+ className="text-text-neutral-primary"
+ height={24}
+ icon={icon}
+ width={24}
+ />
+ ) : showIcon && icon ? (
+ <div className="flex h-8 w-8 items-center justify-center *:h-full *:w-full">
+ {icon}
+ </div>
+ ) : null}
+ <h1
+ className={`text-text-neutral-primary max-w-[200px] truncate text-sm font-bold sm:max-w-none ${isLink ? "hover:text-button-primary transition-colors" : ""}`}
+ >
+ {titleText}
+ </h1>
+ {titleAction}
+ </div>
+ );
+
+ let breadcrumbItems: CustomBreadcrumbItem[] = [];
+
+ switch (mode) {
+ case "auto":
+ breadcrumbItems = generateAutoBreadcrumbs();
+ break;
+ case "custom":
+ breadcrumbItems = customItems;
+ break;
+ case "hybrid":
+ breadcrumbItems = [...generateAutoBreadcrumbs(), ...customItems];
+ break;
+ }
+
+ return (
+ <div className={cn(className, "w-fit md:w-full")}>
+ <nav aria-label="Breadcrumb">
+ <ol className="flex flex-wrap items-center">
+ {breadcrumbItems.map((breadcrumb, index) => (
+ <li
+ key={breadcrumb.path || index}
+ className="flex items-center"
+ aria-current={
+ index === breadcrumbItems.length - 1 ? "page" : undefined
+ }
+ >
+ {breadcrumb.isLast && showTitle && title ? (
+ renderTitleWithIcon(title, false, index === 0)
+ ) : breadcrumb.isClickable && breadcrumb.path ? (
+ <Link
+ href={buildNavigationUrl(breadcrumb.path)}
+ className="flex cursor-pointer items-center gap-2"
+ >
+ {index === 0 &&
+ breadcrumb.icon &&
+ typeof breadcrumb.icon === "string" ? (
+ <Icon
+ aria-hidden="true"
+ className="text-text-neutral-primary"
+ height={24}
+ icon={breadcrumb.icon}
+ width={24}
+ />
+ ) : index === 0 && breadcrumb.icon ? (
+ <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
+ {breadcrumb.icon}
+ </div>
+ ) : null}
+ <span className="text-text-neutral-primary hover:text-button-primary max-w-[150px] truncate text-sm font-bold transition-colors sm:max-w-none">
+ {breadcrumb.name}
+ </span>
+ </Link>
+ ) : breadcrumb.isClickable && breadcrumb.onClick ? (
+ <button
+ onClick={breadcrumb.onClick}
+ className="text-text-neutral-primary hover:text-text-neutral-primary-hover flex cursor-pointer items-center gap-2 text-sm font-medium transition-colors"
+ >
+ {index === 0 &&
+ breadcrumb.icon &&
+ typeof breadcrumb.icon === "string" ? (
+ <Icon
+ aria-hidden="true"
+ className="text-text-neutral-primary"
+ height={24}
+ icon={breadcrumb.icon}
+ width={24}
+ />
+ ) : index === 0 && breadcrumb.icon ? (
+ <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
+ {breadcrumb.icon}
+ </div>
+ ) : null}
+ <span className="max-w-[150px] truncate sm:max-w-none">
+ {breadcrumb.name}
+ </span>
+ </button>
+ ) : (
+ <div className="flex items-center gap-2">
+ {index === 0 &&
+ breadcrumb.icon &&
+ typeof breadcrumb.icon === "string" ? (
+ <Icon
+ aria-hidden="true"
+ className="text-text-neutral-tertiary"
+ height={24}
+ icon={breadcrumb.icon}
+ width={24}
+ />
+ ) : index === 0 && breadcrumb.icon ? (
+ <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
+ {breadcrumb.icon}
+ </div>
+ ) : null}
+ <span className="max-w-[150px] truncate text-sm font-medium text-gray-900 sm:max-w-none dark:text-gray-100">
+ {breadcrumb.name}
+ </span>
+ </div>
+ )}
+ {index < breadcrumbItems.length - 1 && (
+ <span
+ aria-hidden="true"
+ className="text-text-neutral-tertiary px-1 text-sm"
+ >
+ /
+ </span>
+ )}
+ </li>
+ ))}
+ </ol>
+ </nav>
+ </div>
+ );
+}
diff --git a/ui/components/shadcn/breadcrumbs/index.ts b/ui/components/shadcn/breadcrumbs/index.ts
new file mode 100644
index 0000000000..908d780e87
--- /dev/null
+++ b/ui/components/shadcn/breadcrumbs/index.ts
@@ -0,0 +1 @@
+export * from "./breadcrumb-navigation";
diff --git a/ui/components/shadcn/button/button.tsx b/ui/components/shadcn/button/button.tsx
index 44c7788cb4..b74997a43b 100644
--- a/ui/components/shadcn/button/button.tsx
+++ b/ui/components/shadcn/button/button.tsx
@@ -25,12 +25,6 @@ const buttonVariants = cva(
// Chrome-free: no border/background, only the icon shows. Hover/active shift
// the icon color instead of painting a box. Pair with an `icon*` size.
bare: "border-0 bg-transparent p-0 text-text-neutral-secondary hover:text-text-neutral-primary active:text-text-neutral-primary focus-visible:ring-border-neutral-secondary/50 disabled:bg-transparent",
- // Menu variant like secondary but more padding and the back is almost transparent
- menu: "backdrop-blur-xl bg-white/60 dark:bg-white/5 border border-white/80 dark:border-white/10 text-text-neutral-primary dark:text-white shadow-lg hover:bg-white/70 dark:hover:bg-white/10 hover:border-white/90 dark:hover:border-white/30 active:bg-white/80 dark:active:bg-white/15 active:scale-[0.98] focus-visible:ring-button-primary/50 transition-all duration-200",
- "menu-active":
- "backdrop-blur-xl bg-white/50 dark:bg-white/5 border border-black/[0.08] dark:border-white/10 text-text-neutral-primary dark:text-white shadow-sm hover:bg-white/60 dark:hover:bg-white/10 hover:border-black/[0.12] dark:hover:border-white/30 active:bg-white/70 dark:active:bg-white/15 active:scale-[0.98] focus-visible:ring-button-primary/50 transition-all duration-200",
- "menu-inactive":
- "text-text-neutral-primary border border-transparent hover:backdrop-blur-xl hover:bg-white/40 dark:hover:bg-white/5 hover:border-black/[0.08] dark:hover:border-white/10 hover:shadow-sm active:bg-white/50 dark:active:bg-white/15 active:scale-[0.98] focus-visible:ring-border-neutral-secondary/50 transition-all duration-200",
},
size: {
default: "h-9 px-4 py-2 has-[>svg]:px-3",
diff --git a/ui/components/shadcn/card/card.test.tsx b/ui/components/shadcn/card/card.test.tsx
new file mode 100644
index 0000000000..8d2e1ec7fa
--- /dev/null
+++ b/ui/components/shadcn/card/card.test.tsx
@@ -0,0 +1,17 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { CardHeader } from "./card";
+
+describe("CardHeader", () => {
+ it("does not add vertical margin by default", () => {
+ // Given - A default card header
+ render(<CardHeader>Header</CardHeader>);
+
+ // When - Reading the rendered header
+ const header = screen.getByText("Header");
+
+ // Then - Card spacing is controlled by the card gap or caller styles
+ expect(header).not.toHaveClass("mb-6");
+ });
+});
diff --git a/ui/components/shadcn/card/card.tsx b/ui/components/shadcn/card/card.tsx
index 629d0de9f6..ee1174d061 100644
--- a/ui/components/shadcn/card/card.tsx
+++ b/ui/components/shadcn/card/card.tsx
@@ -28,6 +28,7 @@ const cardVariants = cva("flex flex-col gap-6 rounded-xl border", {
sm: "px-3 py-2",
md: "px-4 py-3",
lg: "px-5 py-4",
+ xl: "p-8",
none: "p-0",
},
},
@@ -78,7 +79,7 @@ function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
<div
data-slot="card-header"
className={cn(
- "@container/card-header mb-6 grid auto-rows-min grid-rows-[auto_auto] items-start has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6",
+ "@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-start has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6",
className,
)}
{...props}
diff --git a/ui/components/ui/chart/Chart.tsx b/ui/components/shadcn/chart/Chart.tsx
similarity index 100%
rename from ui/components/ui/chart/Chart.tsx
rename to ui/components/shadcn/chart/Chart.tsx
diff --git a/ui/components/shadcn/chart/index.ts b/ui/components/shadcn/chart/index.ts
new file mode 100644
index 0000000000..bbdc26f312
--- /dev/null
+++ b/ui/components/shadcn/chart/index.ts
@@ -0,0 +1 @@
+export * from "./Chart";
diff --git a/ui/components/shadcn/code-snippet/code-snippet.test.tsx b/ui/components/shadcn/code-snippet/code-snippet.test.tsx
new file mode 100644
index 0000000000..3ef54e5676
--- /dev/null
+++ b/ui/components/shadcn/code-snippet/code-snippet.test.tsx
@@ -0,0 +1,82 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it } from "vitest";
+
+import { CodeSnippet } from "./code-snippet";
+
+describe("CodeSnippet", () => {
+ it("should display the value and copy it to the clipboard", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<CodeSnippet value="prowler --version" />);
+ expect(screen.getByText("prowler --version")).toBeInTheDocument();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Copy to clipboard" }));
+
+ // Then
+ await expect(navigator.clipboard.readText()).resolves.toBe(
+ "prowler --version",
+ );
+ });
+
+ it("should copy the raw value even when a formatter changes the displayed text", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <CodeSnippet
+ value="arn:aws:iam::123456789012:role/prowler"
+ formatter={(value) => value.slice(0, 10)}
+ />,
+ );
+ expect(screen.getByText("arn:aws:ia")).toBeInTheDocument();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Copy to clipboard" }));
+
+ // Then
+ await expect(navigator.clipboard.readText()).resolves.toBe(
+ "arn:aws:iam::123456789012:role/prowler",
+ );
+ });
+
+ it("should render only the copy button when hideCode is set", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<CodeSnippet value="secret-token" hideCode />);
+
+ // Then the value is not displayed but copying still works
+ expect(screen.queryByText("secret-token")).not.toBeInTheDocument();
+
+ await user.click(screen.getByRole("button", { name: "Copy to clipboard" }));
+ await expect(navigator.clipboard.readText()).resolves.toBe("secret-token");
+ });
+
+ describe("copy feedback", () => {
+ it("should show the check icon after copying and revert after two seconds", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<CodeSnippet value="copied-value" />);
+ const copyButton = screen.getByRole("button", {
+ name: "Copy to clipboard",
+ });
+ expect(copyButton.querySelector(".lucide-copy")).not.toBeNull();
+
+ // When
+ await user.click(copyButton);
+
+ // Then the confirmation icon replaces the copy icon
+ await waitFor(() =>
+ expect(copyButton.querySelector(".lucide-check")).not.toBeNull(),
+ );
+ expect(copyButton.querySelector(".lucide-copy")).toBeNull();
+
+ // Then the copy icon is restored once the 2s reset timeout elapses
+ await waitFor(
+ () => expect(copyButton.querySelector(".lucide-copy")).not.toBeNull(),
+ { timeout: 3000 },
+ );
+ expect(copyButton.querySelector(".lucide-check")).toBeNull();
+ });
+ });
+});
diff --git a/ui/components/ui/code-snippet/code-snippet.tsx b/ui/components/shadcn/code-snippet/code-snippet.tsx
similarity index 87%
rename from ui/components/ui/code-snippet/code-snippet.tsx
rename to ui/components/shadcn/code-snippet/code-snippet.tsx
index 313787d48c..23091cfdf5 100644
--- a/ui/components/ui/code-snippet/code-snippet.tsx
+++ b/ui/components/shadcn/code-snippet/code-snippet.tsx
@@ -50,21 +50,6 @@ export const CodeSnippet = ({
const displayValue = formatter ? formatter(value) : value;
- const CopyButton = () => (
- <button
- type="button"
- onClick={handleCopy}
- className="text-text-neutral-secondary hover:text-text-neutral-primary shrink-0 cursor-pointer transition-colors"
- aria-label={ariaLabel}
- >
- {copied ? (
- <Check className="h-3.5 w-3.5" />
- ) : (
- <Copy className="h-3.5 w-3.5" />
- )}
- </button>
- );
-
// When hideCode is true, render only the copy button without container styling
if (hideCode) {
return (
@@ -116,7 +101,20 @@ export const CodeSnippet = ({
<TooltipContent side="top">{value}</TooltipContent>
</Tooltip>
)}
- {!hideCopyButton && <CopyButton />}
+ {!hideCopyButton && (
+ <button
+ type="button"
+ onClick={handleCopy}
+ className="text-text-neutral-secondary hover:text-text-neutral-primary shrink-0 cursor-pointer transition-colors"
+ aria-label={ariaLabel}
+ >
+ {copied ? (
+ <Check className="h-3.5 w-3.5" />
+ ) : (
+ <Copy className="h-3.5 w-3.5" />
+ )}
+ </button>
+ )}
</div>
);
};
diff --git a/ui/components/shadcn/code-snippet/index.ts b/ui/components/shadcn/code-snippet/index.ts
new file mode 100644
index 0000000000..de9dedd757
--- /dev/null
+++ b/ui/components/shadcn/code-snippet/index.ts
@@ -0,0 +1 @@
+export * from "./code-snippet";
diff --git a/ui/components/shadcn/combobox/combobox.test.tsx b/ui/components/shadcn/combobox/combobox.test.tsx
new file mode 100644
index 0000000000..797b770c19
--- /dev/null
+++ b/ui/components/shadcn/combobox/combobox.test.tsx
@@ -0,0 +1,20 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { Combobox } from "./combobox";
+
+describe("Combobox", () => {
+ it("uses the compact trigger size through its semantic API", () => {
+ // Given / When
+ render(
+ <Combobox
+ aria-label="Model"
+ size="sm"
+ options={[{ value: "gpt-5", label: "GPT-5" }]}
+ />,
+ );
+
+ // Then
+ expect(screen.getByRole("combobox", { name: "Model" })).toHaveClass("h-8");
+ });
+});
diff --git a/ui/components/shadcn/combobox/combobox.tsx b/ui/components/shadcn/combobox/combobox.tsx
index b10bcf8973..4420a469e6 100644
--- a/ui/components/shadcn/combobox/combobox.tsx
+++ b/ui/components/shadcn/combobox/combobox.tsx
@@ -24,13 +24,18 @@ const comboboxTriggerVariants = cva("", {
variants: {
variant: {
default:
- "w-full justify-between rounded-xl border border-border-neutral-secondary bg-bg-neutral-secondary hover:bg-bg-neutral-tertiary",
+ "w-full justify-between rounded-lg border border-border-neutral-secondary bg-bg-neutral-secondary hover:bg-bg-neutral-tertiary",
ghost:
- "border-none bg-transparent shadow-none hover:bg-accent hover:text-foreground",
+ "border-none bg-transparent shadow-none hover:bg-accent hover:text-text-neutral-primary",
+ },
+ size: {
+ default: "",
+ sm: "",
},
},
defaultVariants: {
variant: "default",
+ size: "default",
},
});
@@ -38,7 +43,7 @@ const comboboxContentVariants = cva("p-0", {
variants: {
variant: {
default:
- "w-[calc(100vw-2rem)] max-w-md rounded-xl border border-border-neutral-secondary bg-bg-neutral-secondary shadow-md sm:w-full",
+ "w-[calc(100vw-2rem)] max-w-md rounded-lg border border-border-neutral-secondary bg-bg-neutral-secondary shadow-md sm:w-full",
ghost:
"w-[calc(100vw-2rem)] max-w-md rounded-lg border border-slate-400 bg-white sm:w-full dark:border-[#262626] dark:bg-[#171717]",
},
@@ -74,6 +79,7 @@ export interface ComboboxProps
showSelectedFirst?: boolean;
loading?: boolean;
loadingMessage?: string;
+ "aria-label"?: string;
}
export function Combobox({
@@ -88,10 +94,12 @@ export function Combobox({
triggerClassName,
contentClassName,
variant = "default",
+ size = "default",
disabled = false,
showSelectedFirst = true,
loading = false,
loadingMessage = "Loading...",
+ "aria-label": ariaLabel,
}: ComboboxProps) {
const [open, setOpen] = useState(false);
@@ -111,11 +119,13 @@ export function Combobox({
<PopoverTrigger asChild>
<Button
variant="outline"
+ size={size}
role="combobox"
+ aria-label={ariaLabel}
aria-expanded={open}
disabled={disabled}
className={cn(
- comboboxTriggerVariants({ variant }),
+ comboboxTriggerVariants({ variant, size }),
triggerClassName,
className,
)}
diff --git a/ui/components/shadcn/command.tsx b/ui/components/shadcn/command.tsx
index b7d9067f96..4f1c676040 100644
--- a/ui/components/shadcn/command.tsx
+++ b/ui/components/shadcn/command.tsx
@@ -123,7 +123,7 @@ function CommandGroup({
<CommandPrimitive.Group
data-slot="command-group"
className={cn(
- "text-foreground [&_[cmdk-group-heading]]:text-muted-foreground overflow-hidden p-1 [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:py-1.5 [&_[cmdk-group-heading]]:text-xs [&_[cmdk-group-heading]]:font-medium",
+ "text-text-neutral-primary [&_[cmdk-group-heading]]:text-muted-foreground overflow-hidden p-1 [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:py-1.5 [&_[cmdk-group-heading]]:text-xs [&_[cmdk-group-heading]]:font-medium",
className,
)}
{...props}
diff --git a/ui/components/ui/content-layout/content-layout.tsx b/ui/components/shadcn/content-layout/content-layout.tsx
similarity index 82%
rename from ui/components/ui/content-layout/content-layout.tsx
rename to ui/components/shadcn/content-layout/content-layout.tsx
index 37f04b6899..86d02db15e 100644
--- a/ui/components/ui/content-layout/content-layout.tsx
+++ b/ui/components/shadcn/content-layout/content-layout.tsx
@@ -1,6 +1,9 @@
import { ReactNode } from "react";
-import { Navbar, type OnboardingActionConfig } from "../nav-bar/navbar";
+import {
+ Navbar,
+ type OnboardingActionConfig,
+} from "@/components/layout/nav-bar/navbar";
interface ContentLayoutProps {
title: string;
diff --git a/ui/components/shadcn/content-layout/index.ts b/ui/components/shadcn/content-layout/index.ts
new file mode 100644
index 0000000000..db9d1db07f
--- /dev/null
+++ b/ui/components/shadcn/content-layout/index.ts
@@ -0,0 +1,2 @@
+export * from "./content-layout";
+export * from "./skeleton-content-layout";
diff --git a/ui/components/shadcn/content-layout/skeleton-content-layout.tsx b/ui/components/shadcn/content-layout/skeleton-content-layout.tsx
new file mode 100644
index 0000000000..2c39aaef9e
--- /dev/null
+++ b/ui/components/shadcn/content-layout/skeleton-content-layout.tsx
@@ -0,0 +1,13 @@
+import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
+
+export const SkeletonContentLayout = () => {
+ return (
+ <div className="flex items-center gap-4">
+ {/* Theme Switch Skeleton */}
+ <Skeleton className="h-8 w-8 rounded-full" />
+
+ {/* User Avatar Skeleton */}
+ <Skeleton className="h-10 w-10 rounded-full" />
+ </div>
+ );
+};
diff --git a/ui/components/ui/custom/custom-banner.tsx b/ui/components/shadcn/custom/custom-banner.tsx
similarity index 91%
rename from ui/components/ui/custom/custom-banner.tsx
rename to ui/components/shadcn/custom/custom-banner.tsx
index 0969721368..4f9580316d 100644
--- a/ui/components/ui/custom/custom-banner.tsx
+++ b/ui/components/shadcn/custom/custom-banner.tsx
@@ -3,7 +3,8 @@
import { InfoIcon } from "lucide-react";
import Link from "next/link";
-import { Button, Card, CardContent } from "@/components/shadcn";
+import { Button } from "@/components/shadcn/button/button";
+import { Card, CardContent } from "@/components/shadcn/card/card";
interface CustomBannerProps {
title: string;
diff --git a/ui/components/shadcn/custom/custom-input.test.tsx b/ui/components/shadcn/custom/custom-input.test.tsx
new file mode 100644
index 0000000000..fa745a21c0
--- /dev/null
+++ b/ui/components/shadcn/custom/custom-input.test.tsx
@@ -0,0 +1,101 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useForm } from "react-hook-form";
+import { describe, expect, it } from "vitest";
+
+import { Form } from "@/components/shadcn/form";
+
+import { CustomInput } from "./custom-input";
+
+interface TestFormValues {
+ password: string;
+ email: string;
+}
+
+const TestForm = ({
+ password = false,
+ isRequired,
+}: {
+ password?: boolean;
+ isRequired?: boolean;
+}) => {
+ const form = useForm<TestFormValues>({
+ defaultValues: { password: "", email: "" },
+ });
+
+ return (
+ <Form {...form}>
+ <CustomInput
+ control={form.control}
+ name={password ? "password" : "email"}
+ label="Email"
+ password={password}
+ {...(isRequired !== undefined && { isRequired })}
+ />
+ </Form>
+ );
+};
+
+describe("CustomInput", () => {
+ describe("when used as a password field", () => {
+ it("should mask the value by default", () => {
+ // Given
+ render(<TestForm password />);
+
+ // Then
+ expect(screen.getByLabelText(/^password/i)).toHaveAttribute(
+ "type",
+ "password",
+ );
+ });
+
+ it("should reveal and re-mask the value with the visibility toggle", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<TestForm password />);
+ const input = screen.getByLabelText(/^password/i);
+ await user.type(input, "hunter2");
+
+ // When the user shows the password
+ await user.click(screen.getByRole("button", { name: "Show password" }));
+
+ // Then the value becomes readable and the toggle flips
+ expect(input).toHaveAttribute("type", "text");
+ expect(input).toHaveValue("hunter2");
+
+ // When the user hides it again
+ await user.click(screen.getByRole("button", { name: "Hide password" }));
+
+ // Then
+ expect(input).toHaveAttribute("type", "password");
+ });
+ });
+
+ describe("when used as a regular field", () => {
+ it("should keep the provided type and accept user input", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<TestForm />);
+ const input = screen.getByLabelText(/email/i);
+
+ // When
+ await user.type(input, "dev@prowler.com");
+
+ // Then
+ expect(input).toHaveAttribute("type", "text");
+ expect(input).toHaveValue("dev@prowler.com");
+ expect(
+ screen.queryByRole("button", { name: /password/i }),
+ ).not.toBeInTheDocument();
+ });
+
+ it("should hide the required indicator when isRequired is false", () => {
+ // Given
+ render(<TestForm isRequired={false} />);
+
+ // Then
+ expect(screen.queryByText("*")).not.toBeInTheDocument();
+ expect(screen.getByLabelText(/email/i)).not.toBeRequired();
+ });
+ });
+});
diff --git a/ui/components/shadcn/custom/custom-input.tsx b/ui/components/shadcn/custom/custom-input.tsx
new file mode 100644
index 0000000000..6edca37fa8
--- /dev/null
+++ b/ui/components/shadcn/custom/custom-input.tsx
@@ -0,0 +1,149 @@
+"use client";
+
+import { Icon } from "@iconify/react";
+import { useState } from "react";
+import { Control, FieldPath, FieldValues } from "react-hook-form";
+
+import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
+import { FormControl, FormField } from "@/components/shadcn/form";
+import { Input } from "@/components/shadcn/input/input";
+import { cn } from "@/lib/utils";
+
+const SIZE_MAP = { sm: "sm", md: "default", lg: "lg" } as const;
+
+interface CustomInputProps<T extends FieldValues> {
+ control: Control<T>;
+ name: FieldPath<T>;
+ label?: string;
+ labelPlacement?: "inside" | "outside";
+ variant?: "flat" | "bordered" | "underlined" | "faded";
+ size?: "sm" | "md" | "lg";
+ type?: string;
+ placeholder?: string;
+ password?: boolean;
+ confirmPassword?: boolean;
+ defaultValue?: string;
+ isReadOnly?: boolean;
+ isRequired?: boolean;
+ isDisabled?: boolean;
+}
+
+export const CustomInput = <T extends FieldValues>({
+ control,
+ name,
+ type = "text",
+ label = name,
+ labelPlacement = "inside",
+ placeholder,
+ variant = "bordered",
+ size = "md",
+ confirmPassword = false,
+ password = false,
+ defaultValue,
+ isReadOnly = false,
+ isRequired = true,
+ isDisabled = false,
+}: CustomInputProps<T>) => {
+ const [isPasswordVisible, setIsPasswordVisible] = useState(false);
+ const [isConfirmPasswordVisible, setIsConfirmPasswordVisible] =
+ useState(false);
+ void variant;
+ void defaultValue;
+
+ const inputLabel = confirmPassword
+ ? "Confirm Password"
+ : password
+ ? "Password"
+ : label;
+
+ const inputPlaceholder = confirmPassword
+ ? "Confirm Password"
+ : password
+ ? "Password"
+ : placeholder;
+
+ const isMaskedInput = password || confirmPassword;
+ const inputType = isMaskedInput
+ ? isPasswordVisible || isConfirmPasswordVisible
+ ? "text"
+ : "password"
+ : type;
+ const inputIsRequired = isMaskedInput ? true : isRequired;
+
+ const toggleVisibility = () => {
+ if (password) {
+ setIsPasswordVisible(!isPasswordVisible);
+ } else if (confirmPassword) {
+ setIsConfirmPasswordVisible(!isConfirmPasswordVisible);
+ }
+ };
+
+ return (
+ <FormField
+ control={control}
+ name={name}
+ render={({ field, fieldState }) => (
+ <Field>
+ {inputLabel && (
+ <FieldLabel
+ htmlFor={name}
+ className={cn(
+ labelPlacement === "inside" && "font-light tracking-tight",
+ )}
+ >
+ {inputLabel}
+ {inputIsRequired && (
+ <span className="text-text-error-primary">*</span>
+ )}
+ </FieldLabel>
+ )}
+ <div className="relative">
+ <FormControl>
+ <Input
+ id={name}
+ type={inputType}
+ inputSize={SIZE_MAP[size]}
+ placeholder={inputPlaceholder}
+ required={inputIsRequired}
+ disabled={isDisabled}
+ readOnly={isReadOnly}
+ aria-invalid={!!fieldState.error}
+ className={cn(
+ "text-text-neutral-secondary",
+ isMaskedInput && "pr-10",
+ fieldState.error &&
+ "border-border-error focus:border-border-error focus:ring-border-error",
+ )}
+ {...field}
+ value={field.value ?? ""}
+ />
+ </FormControl>
+ {isMaskedInput && (
+ <button
+ type="button"
+ onClick={toggleVisibility}
+ className="absolute top-1/2 right-3 -translate-y-1/2"
+ aria-label={
+ inputType === "password" ? "Show password" : "Hide password"
+ }
+ >
+ <Icon
+ className="text-text-neutral-tertiary pointer-events-none text-2xl"
+ icon={
+ (password && isPasswordVisible) ||
+ (confirmPassword && isConfirmPasswordVisible)
+ ? "solar:eye-closed-linear"
+ : "solar:eye-bold"
+ }
+ />
+ </button>
+ )}
+ </div>
+ {fieldState.error?.message && (
+ <FieldError>{fieldState.error.message}</FieldError>
+ )}
+ </Field>
+ )}
+ />
+ );
+};
diff --git a/ui/components/ui/custom/custom-link.test.ts b/ui/components/shadcn/custom/custom-link.test.ts
similarity index 100%
rename from ui/components/ui/custom/custom-link.test.ts
rename to ui/components/shadcn/custom/custom-link.test.ts
diff --git a/ui/components/ui/custom/custom-link.tsx b/ui/components/shadcn/custom/custom-link.tsx
similarity index 98%
rename from ui/components/ui/custom/custom-link.tsx
rename to ui/components/shadcn/custom/custom-link.tsx
index 608825c8b2..acf2fa5a8d 100644
--- a/ui/components/ui/custom/custom-link.tsx
+++ b/ui/components/shadcn/custom/custom-link.tsx
@@ -1,7 +1,7 @@
import Link from "next/link";
import { type AnchorHTMLAttributes, forwardRef, type ReactNode } from "react";
-import { cn } from "@/lib";
+import { cn } from "@/lib/utils";
interface CustomLinkProps extends AnchorHTMLAttributes<HTMLAnchorElement> {
href: string;
diff --git a/ui/components/ui/custom/custom-modal-buttons.tsx b/ui/components/shadcn/custom/custom-modal-buttons.tsx
similarity index 94%
rename from ui/components/ui/custom/custom-modal-buttons.tsx
rename to ui/components/shadcn/custom/custom-modal-buttons.tsx
index 922452771b..591fa8e182 100644
--- a/ui/components/ui/custom/custom-modal-buttons.tsx
+++ b/ui/components/shadcn/custom/custom-modal-buttons.tsx
@@ -1,7 +1,7 @@
import { Loader2 } from "lucide-react";
import { ReactNode } from "react";
-import { Button } from "@/components/shadcn";
+import { Button } from "@/components/shadcn/button/button";
interface ModalButtonsProps {
onCancel: () => void;
diff --git a/ui/components/shadcn/custom/custom-radio.tsx b/ui/components/shadcn/custom/custom-radio.tsx
new file mode 100644
index 0000000000..53fd0e6bd6
--- /dev/null
+++ b/ui/components/shadcn/custom/custom-radio.tsx
@@ -0,0 +1,25 @@
+"use client";
+
+import { RadioGroupItem } from "@/components/shadcn/radio-group/radio-group";
+import { cn } from "@/lib/utils";
+
+interface CustomRadioProps {
+ description?: string;
+ value?: string;
+ children?: React.ReactNode;
+}
+
+export const CustomRadio = ({ value, children }: CustomRadioProps) => {
+ return (
+ <label
+ className={cn(
+ "inline-flex w-full max-w-full cursor-pointer flex-row-reverse items-center justify-between gap-4 rounded-lg border-2 p-4 hover:opacity-70 active:opacity-50",
+ "border-border-input-primary hover:border-button-primary",
+ "has-[[data-state=checked]]:border-button-primary",
+ )}
+ >
+ <RadioGroupItem value={value || ""} />
+ <span>{children}</span>
+ </label>
+ );
+};
diff --git a/ui/components/shadcn/custom/custom-server-input.tsx b/ui/components/shadcn/custom/custom-server-input.tsx
new file mode 100644
index 0000000000..acdf4e7ccd
--- /dev/null
+++ b/ui/components/shadcn/custom/custom-server-input.tsx
@@ -0,0 +1,72 @@
+"use client";
+
+import type { ChangeEvent } from "react";
+
+import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
+import { Input } from "@/components/shadcn/input/input";
+import { cn } from "@/lib/utils";
+
+interface CustomServerInputProps {
+ name: string;
+ label?: string;
+ labelPlacement?: "inside" | "outside";
+ variant?: "flat" | "bordered" | "underlined" | "faded";
+ type?: string;
+ placeholder?: string;
+ isRequired?: boolean;
+ isInvalid?: boolean;
+ errorMessage?: string;
+ value?: string;
+ onChange?: (e: ChangeEvent<HTMLInputElement>) => void;
+}
+
+/**
+ * Custom input component that is used to display a server input without useForm hook.
+ */
+export const CustomServerInput = ({
+ name,
+ type = "text",
+ label,
+ labelPlacement = "outside",
+ placeholder,
+ variant = "bordered",
+ isRequired = false,
+ isInvalid = false,
+ errorMessage,
+ value,
+ onChange,
+}: CustomServerInputProps) => {
+ void variant;
+
+ return (
+ <Field>
+ {label && (
+ <FieldLabel
+ htmlFor={name}
+ className={cn(
+ labelPlacement === "inside" && "font-light tracking-tight",
+ )}
+ >
+ {label}
+ {isRequired && <span className="text-text-error-primary">*</span>}
+ </FieldLabel>
+ )}
+ <Input
+ id={name}
+ name={name}
+ type={type}
+ placeholder={placeholder}
+ required={isRequired}
+ aria-invalid={isInvalid || undefined}
+ className={cn(
+ "text-text-neutral-secondary",
+ isInvalid &&
+ "border-border-error focus:border-border-error focus:ring-border-error",
+ )}
+ value={value}
+ onChange={onChange}
+ />
+ {isInvalid && errorMessage && <FieldError>{errorMessage}</FieldError>}
+ </Field>
+ );
+};
diff --git a/ui/components/ui/custom/custom-table-link.tsx b/ui/components/shadcn/custom/custom-table-link.tsx
similarity index 91%
rename from ui/components/ui/custom/custom-table-link.tsx
rename to ui/components/shadcn/custom/custom-table-link.tsx
index 9fba1e2c55..24b40aa520 100644
--- a/ui/components/ui/custom/custom-table-link.tsx
+++ b/ui/components/shadcn/custom/custom-table-link.tsx
@@ -2,7 +2,7 @@
import Link from "next/link";
-import { Button } from "@/components/shadcn";
+import { Button } from "@/components/shadcn/button/button";
interface TableLinkProps {
href: string;
diff --git a/ui/components/shadcn/custom/custom-textarea.tsx b/ui/components/shadcn/custom/custom-textarea.tsx
new file mode 100644
index 0000000000..ae36c0e453
--- /dev/null
+++ b/ui/components/shadcn/custom/custom-textarea.tsx
@@ -0,0 +1,95 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { Control, FieldPath, FieldValues } from "react-hook-form";
+
+import { Field, FieldError, FieldLabel } from "@/components/shadcn/field/field";
+import { FormControl, FormField } from "@/components/shadcn/form";
+import { Textarea } from "@/components/shadcn/textarea/textarea";
+import { cn } from "@/lib/utils";
+
+const SIZE_MAP = { sm: "sm", md: "default", lg: "lg" } as const;
+
+interface CustomTextareaProps<T extends FieldValues> {
+ control: Control<T>;
+ name: FieldPath<T>;
+ label?: string;
+ labelPlacement?: "inside" | "outside" | "outside-left";
+ variant?: "flat" | "bordered" | "underlined" | "faded";
+ size?: "sm" | "md" | "lg";
+ placeholder?: string;
+ defaultValue?: string;
+ isRequired?: boolean;
+ minRows?: number;
+ maxRows?: number;
+ fullWidth?: boolean;
+ disableAutosize?: boolean;
+ description?: ReactNode;
+}
+
+export const CustomTextarea = <T extends FieldValues>({
+ control,
+ name,
+ label = name,
+ labelPlacement = "inside",
+ placeholder,
+ variant = "flat",
+ size = "md",
+ defaultValue,
+ isRequired = false,
+ minRows = 3,
+ maxRows = 8,
+ fullWidth = true,
+ disableAutosize = false,
+ description,
+}: CustomTextareaProps<T>) => {
+ void variant;
+ void defaultValue;
+ void maxRows;
+ void fullWidth;
+ void disableAutosize;
+
+ return (
+ <FormField
+ control={control}
+ name={name}
+ render={({ field, fieldState }) => (
+ <Field>
+ {label && (
+ <FieldLabel
+ htmlFor={name}
+ className={cn(
+ labelPlacement === "inside" && "font-light tracking-tight",
+ )}
+ >
+ {label}
+ {isRequired && <span className="text-text-error-primary">*</span>}
+ </FieldLabel>
+ )}
+ <FormControl>
+ <Textarea
+ id={name}
+ textareaSize={SIZE_MAP[size]}
+ placeholder={placeholder}
+ required={isRequired}
+ rows={minRows}
+ aria-invalid={!!fieldState.error}
+ className={cn(
+ fieldState.error &&
+ "border-border-error focus:border-border-error focus:ring-border-error",
+ )}
+ {...field}
+ value={field.value ?? ""}
+ />
+ </FormControl>
+ {description && (
+ <p className="text-text-neutral-tertiary text-xs">{description}</p>
+ )}
+ {fieldState.error?.message && (
+ <FieldError>{fieldState.error.message}</FieldError>
+ )}
+ </Field>
+ )}
+ />
+ );
+};
diff --git a/ui/components/shadcn/custom/index.ts b/ui/components/shadcn/custom/index.ts
new file mode 100644
index 0000000000..8a1bcd488f
--- /dev/null
+++ b/ui/components/shadcn/custom/index.ts
@@ -0,0 +1,8 @@
+export * from "./custom-banner";
+export * from "./custom-input";
+export * from "./custom-link";
+export * from "./custom-modal-buttons";
+export * from "./custom-radio";
+export * from "./custom-server-input";
+export * from "./custom-table-link";
+export * from "./custom-textarea";
diff --git a/ui/components/shadcn/dialog.tsx b/ui/components/shadcn/dialog.tsx
index 63721874a1..2b4669190c 100644
--- a/ui/components/shadcn/dialog.tsx
+++ b/ui/components/shadcn/dialog.tsx
@@ -59,7 +59,7 @@ function DialogContent({
<DialogPrimitive.Content
data-slot="dialog-content"
className={cn(
- "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
+ "bg-bg-neutral-primary data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
className,
)}
onClick={(e) => e.stopPropagation()}
@@ -70,7 +70,7 @@ function DialogContent({
{showCloseButton && (
<DialogPrimitive.Close
data-slot="dialog-close"
- className="ring-offset-background focus:ring-ring data-[state=open]:bg-accent data-[state=open]:text-muted-foreground absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4"
+ className="data-[state=open]:bg-accent data-[state=open]:text-muted-foreground focus-visible:bg-bg-neutral-tertiary focus-visible:text-text-neutral-primary absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus-visible:opacity-100 focus-visible:outline-none disabled:pointer-events-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4"
>
<XIcon />
<span className="sr-only">Close</span>
@@ -85,7 +85,7 @@ function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
return (
<div
data-slot="dialog-header"
- className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
+ className={cn("flex flex-col gap-2 text-left", className)}
{...props}
/>
);
diff --git a/ui/components/shadcn/discovery-callout/discovery-callout.test.tsx b/ui/components/shadcn/discovery-callout/discovery-callout.test.tsx
new file mode 100644
index 0000000000..e8870c4f0b
--- /dev/null
+++ b/ui/components/shadcn/discovery-callout/discovery-callout.test.tsx
@@ -0,0 +1,67 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { Button } from "@/components/shadcn/button/button";
+
+import {
+ DiscoveryCallout,
+ DiscoveryCalloutAnchor,
+ DiscoveryCalloutContent,
+} from "./discovery-callout";
+
+function renderCallout(open: boolean, onDismiss: () => void) {
+ return render(
+ <DiscoveryCallout open={open} onDismiss={onDismiss}>
+ <DiscoveryCalloutAnchor asChild>
+ <Button type="button">Anchor</Button>
+ </DiscoveryCalloutAnchor>
+ <DiscoveryCalloutContent
+ title="Meet the feature"
+ description="It lives right here."
+ data-testid="callout"
+ />
+ </DiscoveryCallout>,
+ );
+}
+
+describe("DiscoveryCallout", () => {
+ it("renders the title and description while open", () => {
+ // Given / When
+ renderCallout(true, vi.fn());
+
+ // Then
+ expect(screen.getByTestId("callout")).toBeInTheDocument();
+ expect(screen.getByText("Meet the feature")).toBeInTheDocument();
+ expect(screen.getByText("It lives right here.")).toBeInTheDocument();
+ });
+
+ it("renders nothing while closed", () => {
+ // Given / When
+ renderCallout(false, vi.fn());
+
+ // Then
+ expect(screen.queryByTestId("callout")).not.toBeInTheDocument();
+ });
+
+ it("dismisses through the action button", () => {
+ // Given
+ const onDismiss = vi.fn();
+ renderCallout(true, onDismiss);
+
+ // When
+ fireEvent.click(screen.getByRole("button", { name: "Got it" }));
+
+ // Then
+ expect(onDismiss).toHaveBeenCalledTimes(1);
+ });
+
+ it("keeps focus free when it opens", () => {
+ // Given / When: the callout opens on its own (not user-invoked)
+ renderCallout(true, vi.fn());
+
+ // Then: focus stays wherever the user had it
+ expect(screen.getByTestId("callout")).not.toContainElement(
+ document.activeElement as HTMLElement,
+ );
+ });
+});
diff --git a/ui/components/shadcn/discovery-callout/discovery-callout.tsx b/ui/components/shadcn/discovery-callout/discovery-callout.tsx
new file mode 100644
index 0000000000..f2c2aad8b4
--- /dev/null
+++ b/ui/components/shadcn/discovery-callout/discovery-callout.tsx
@@ -0,0 +1,82 @@
+"use client";
+
+import type { ComponentProps, ReactNode } from "react";
+
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Popover,
+ PopoverAnchor,
+ PopoverClose,
+ PopoverContent,
+} from "@/components/shadcn/popover";
+
+interface DiscoveryCalloutProps {
+ // Controlled: the caller decides when the hint shows and persists "seen".
+ open: boolean;
+ // Fired on every dismissal path: the action button, outside click, Escape.
+ onDismiss: () => void;
+ children: ReactNode;
+}
+
+// One-time feature-discovery callout anchored to the control it introduces.
+// Compound usage: wrap the anchor element in DiscoveryCalloutAnchor and
+// render one DiscoveryCalloutContent beside it, all inside DiscoveryCallout.
+export function DiscoveryCallout({
+ open,
+ onDismiss,
+ children,
+}: DiscoveryCalloutProps) {
+ return (
+ <Popover
+ open={open}
+ onOpenChange={(nextOpen) => {
+ if (!nextOpen) onDismiss();
+ }}
+ >
+ {children}
+ </Popover>
+ );
+}
+
+export const DiscoveryCalloutAnchor = PopoverAnchor;
+
+interface DiscoveryCalloutContentProps {
+ title: string;
+ description: ReactNode;
+ dismissLabel?: string;
+ side?: ComponentProps<typeof PopoverContent>["side"];
+ align?: ComponentProps<typeof PopoverContent>["align"];
+ "data-testid"?: string;
+}
+
+export function DiscoveryCalloutContent({
+ title,
+ description,
+ dismissLabel = "Got it",
+ side = "bottom",
+ align = "end",
+ "data-testid": testId,
+}: DiscoveryCalloutContentProps) {
+ return (
+ <PopoverContent
+ side={side}
+ align={align}
+ sideOffset={8}
+ // A discovery hint must never steal focus from what the user is doing.
+ onOpenAutoFocus={(event) => event.preventDefault()}
+ data-testid={testId}
+ >
+ <div className="flex flex-col gap-2">
+ <p className="text-text-neutral-primary text-sm font-medium">{title}</p>
+ <p className="text-text-neutral-secondary text-sm">{description}</p>
+ <div className="flex justify-end">
+ <PopoverClose asChild>
+ <Button type="button" variant="outline" size="sm">
+ {dismissLabel}
+ </Button>
+ </PopoverClose>
+ </div>
+ </div>
+ </PopoverContent>
+ );
+}
diff --git a/ui/components/shadcn/download-icon-button/download-icon-button.tsx b/ui/components/shadcn/download-icon-button/download-icon-button.tsx
new file mode 100644
index 0000000000..d34d6f854d
--- /dev/null
+++ b/ui/components/shadcn/download-icon-button/download-icon-button.tsx
@@ -0,0 +1,51 @@
+"use client";
+
+import { DownloadIcon } from "lucide-react";
+
+import { Button } from "@/components/shadcn/button/button";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+
+interface DownloadIconButtonProps {
+ paramId: string;
+ onDownload: (paramId: string) => void;
+ ariaLabel?: string;
+ isDisabled?: boolean;
+ textTooltip?: string;
+ isDownloading?: boolean;
+}
+
+export const DownloadIconButton = ({
+ paramId,
+ onDownload,
+ ariaLabel = "Download report",
+ isDisabled,
+ textTooltip = "Download report",
+ isDownloading = false,
+}: DownloadIconButtonProps) => {
+ return (
+ <div className="flex items-center justify-end">
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <Button
+ variant="ghost"
+ size="icon-sm"
+ disabled={isDisabled || isDownloading}
+ onClick={() => onDownload(paramId)}
+ aria-label={ariaLabel}
+ className="p-0 disabled:opacity-30"
+ >
+ <DownloadIcon
+ className={isDownloading ? "animate-download-icon" : ""}
+ size={16}
+ />
+ </Button>
+ </TooltipTrigger>
+ <TooltipContent className="text-xs">{textTooltip}</TooltipContent>
+ </Tooltip>
+ </div>
+ );
+};
diff --git a/ui/components/shadcn/download-icon-button/index.ts b/ui/components/shadcn/download-icon-button/index.ts
new file mode 100644
index 0000000000..c6bc9835dc
--- /dev/null
+++ b/ui/components/shadcn/download-icon-button/index.ts
@@ -0,0 +1 @@
+export * from "./download-icon-button";
diff --git a/ui/components/shadcn/drawer.tsx b/ui/components/shadcn/drawer.tsx
deleted file mode 100644
index 5468f0114d..0000000000
--- a/ui/components/shadcn/drawer.tsx
+++ /dev/null
@@ -1,133 +0,0 @@
-"use client";
-
-import type { ComponentProps } from "react";
-import { Drawer as DrawerPrimitive } from "vaul";
-
-import { cn } from "@/lib/utils";
-
-function Drawer({ ...props }: ComponentProps<typeof DrawerPrimitive.Root>) {
- return <DrawerPrimitive.Root data-slot="drawer" handleOnly {...props} />;
-}
-
-function DrawerTrigger({
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Trigger>) {
- return <DrawerPrimitive.Trigger data-slot="drawer-trigger" {...props} />;
-}
-
-function DrawerPortal({
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Portal>) {
- return <DrawerPrimitive.Portal data-slot="drawer-portal" {...props} />;
-}
-
-function DrawerClose({
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Close>) {
- return <DrawerPrimitive.Close data-slot="drawer-close" {...props} />;
-}
-
-function DrawerOverlay({
- className,
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Overlay>) {
- return (
- <DrawerPrimitive.Overlay
- data-slot="drawer-overlay"
- className={cn(
- "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
- className,
- )}
- {...props}
- />
- );
-}
-
-function DrawerContent({
- className,
- children,
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Content>) {
- return (
- <DrawerPortal data-slot="drawer-portal">
- <DrawerOverlay />
- <DrawerPrimitive.Content
- data-slot="drawer-content"
- className={cn(
- "group/drawer-content bg-background fixed z-50 flex h-auto flex-col",
- "data-[vaul-drawer-direction=top]:inset-x-0 data-[vaul-drawer-direction=top]:top-0 data-[vaul-drawer-direction=top]:mb-24 data-[vaul-drawer-direction=top]:max-h-[80vh] data-[vaul-drawer-direction=top]:rounded-b-lg data-[vaul-drawer-direction=top]:border-b",
- "data-[vaul-drawer-direction=bottom]:inset-x-0 data-[vaul-drawer-direction=bottom]:bottom-0 data-[vaul-drawer-direction=bottom]:mt-24 data-[vaul-drawer-direction=bottom]:max-h-[80vh] data-[vaul-drawer-direction=bottom]:rounded-t-lg data-[vaul-drawer-direction=bottom]:border-t",
- "data-[vaul-drawer-direction=right]:border-l-border-neutral-secondary data-[vaul-drawer-direction=right]:inset-y-0 data-[vaul-drawer-direction=right]:right-0 data-[vaul-drawer-direction=right]:border-l",
- "data-[vaul-drawer-direction=left]:inset-y-0 data-[vaul-drawer-direction=left]:left-0 data-[vaul-drawer-direction=left]:border-r",
- className,
- )}
- {...props}
- >
- <div className="bg-muted mx-auto mt-4 hidden h-2 w-[100px] shrink-0 rounded-full group-data-[vaul-drawer-direction=bottom]/drawer-content:block" />
- {children}
- </DrawerPrimitive.Content>
- </DrawerPortal>
- );
-}
-
-function DrawerHeader({ className, ...props }: ComponentProps<"div">) {
- return (
- <div
- data-slot="drawer-header"
- className={cn(
- "flex flex-col gap-0.5 p-4 group-data-[vaul-drawer-direction=bottom]/drawer-content:text-center group-data-[vaul-drawer-direction=top]/drawer-content:text-center md:gap-1.5 md:text-left",
- className,
- )}
- {...props}
- />
- );
-}
-
-function DrawerFooter({ className, ...props }: ComponentProps<"div">) {
- return (
- <div
- data-slot="drawer-footer"
- className={cn("mt-auto flex flex-col gap-2 p-4", className)}
- {...props}
- />
- );
-}
-
-function DrawerTitle({
- className,
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Title>) {
- return (
- <DrawerPrimitive.Title
- data-slot="drawer-title"
- className={cn("text-foreground font-semibold", className)}
- {...props}
- />
- );
-}
-
-function DrawerDescription({
- className,
- ...props
-}: ComponentProps<typeof DrawerPrimitive.Description>) {
- return (
- <DrawerPrimitive.Description
- data-slot="drawer-description"
- className={cn("text-muted-foreground text-sm", className)}
- {...props}
- />
- );
-}
-
-export {
- Drawer,
- DrawerClose,
- DrawerContent,
- DrawerDescription,
- DrawerFooter,
- DrawerHeader,
- DrawerOverlay,
- DrawerPortal,
- DrawerTitle,
- DrawerTrigger,
-};
diff --git a/ui/components/ui/dropdown-menu/dropdown-menu.tsx b/ui/components/shadcn/dropdown-menu/dropdown-menu.tsx
similarity index 88%
rename from ui/components/ui/dropdown-menu/dropdown-menu.tsx
rename to ui/components/shadcn/dropdown-menu/dropdown-menu.tsx
index 7d27f09a7c..be92b7b6b3 100644
--- a/ui/components/ui/dropdown-menu/dropdown-menu.tsx
+++ b/ui/components/shadcn/dropdown-menu/dropdown-menu.tsx
@@ -31,7 +31,7 @@ const DropdownMenuSubTrigger = React.forwardRef<
<DropdownMenuPrimitive.SubTrigger
ref={ref}
className={cn(
- "hover:text-accent-foreground focus:bg-accent data-[state=open]:bg-accent text-default-600 hover:bg-default-100 flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm outline-none select-none hover:font-bold",
+ "hover:text-accent-foreground focus:bg-accent data-[state=open]:bg-accent text-text-neutral-secondary hover:bg-bg-neutral-tertiary flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm outline-none select-none hover:font-bold",
inset && "pl-8",
className,
)}
@@ -88,7 +88,7 @@ const DropdownMenuItem = React.forwardRef<
<DropdownMenuPrimitive.Item
ref={ref}
className={cn(
- "focus:bg-accent focus:text-accent-foreground text-default-600 hover:bg-default-100 relative flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm subpixel-antialiased transition-colors outline-none select-none hover:[font-variation-settings:'wght'_600] data-disabled:pointer-events-none data-disabled:opacity-50",
+ "focus:bg-accent focus:text-accent-foreground text-text-neutral-secondary hover:bg-bg-neutral-tertiary relative flex cursor-default items-center rounded-sm px-2 py-1.5 text-sm subpixel-antialiased transition-colors outline-none select-none hover:[font-variation-settings:'wght'_600] data-disabled:pointer-events-none data-disabled:opacity-50",
inset && "pl-8",
className,
)}
@@ -104,7 +104,7 @@ const DropdownMenuCheckboxItem = React.forwardRef<
<DropdownMenuPrimitive.CheckboxItem
ref={ref}
className={cn(
- "focus:bg-accent focus:text-accent-foreground text-default-600 hover:bg-default-100 relative flex cursor-default items-center rounded-sm py-1.5 pr-2 pl-8 text-sm transition-colors outline-none select-none hover:font-bold data-disabled:pointer-events-none data-disabled:opacity-50",
+ "focus:bg-accent focus:text-accent-foreground text-text-neutral-secondary hover:bg-bg-neutral-tertiary relative flex cursor-default items-center rounded-sm py-1.5 pr-2 pl-8 text-sm transition-colors outline-none select-none hover:font-bold data-disabled:pointer-events-none data-disabled:opacity-50",
className,
)}
checked={checked}
@@ -167,10 +167,7 @@ const DropdownMenuSeparator = React.forwardRef<
>(({ className, ...props }, ref) => (
<DropdownMenuPrimitive.Separator
ref={ref}
- className={cn(
- "bg-default-200 dark:bg-default-700 -mx-1 my-1 h-px",
- className,
- )}
+ className={cn("bg-border-neutral-secondary -mx-1 my-1 h-px", className)}
{...props}
/>
));
diff --git a/ui/components/shadcn/dropdown-menu/index.ts b/ui/components/shadcn/dropdown-menu/index.ts
new file mode 100644
index 0000000000..10ff970210
--- /dev/null
+++ b/ui/components/shadcn/dropdown-menu/index.ts
@@ -0,0 +1 @@
+export * from "./dropdown-menu";
diff --git a/ui/components/shadcn/dropdown/action-dropdown.tsx b/ui/components/shadcn/dropdown/action-dropdown.tsx
index 9acb84515a..47c72b3afd 100644
--- a/ui/components/shadcn/dropdown/action-dropdown.tsx
+++ b/ui/components/shadcn/dropdown/action-dropdown.tsx
@@ -44,10 +44,21 @@ export function ActionDropdown({
}: ActionDropdownProps) {
const [open, setOpen] = useState(false);
- // Close dropdown when any ancestor scrolls (capture phase catches all scroll events)
+ // Close dropdown when any ancestor scrolls (capture phase catches all scroll events),
+ // but ignore scrolls originating inside a nested dialog (e.g. pasting into a modal
+ // textarea) so they don't unmount a modal rendered within this menu.
useEffect(() => {
if (!open) return;
- const handleScroll = () => setOpen(false);
+ const handleScroll = (event: Event) => {
+ const target = event.target;
+ if (
+ target instanceof Element &&
+ target.closest('[data-slot="dialog-content"]')
+ ) {
+ return;
+ }
+ setOpen(false);
+ };
window.addEventListener("scroll", handleScroll, true);
return () => window.removeEventListener("scroll", handleScroll, true);
}, [open]);
diff --git a/ui/components/ui/entities/date-with-time.test.tsx b/ui/components/shadcn/entities/date-with-time.test.tsx
similarity index 100%
rename from ui/components/ui/entities/date-with-time.test.tsx
rename to ui/components/shadcn/entities/date-with-time.test.tsx
diff --git a/ui/components/ui/entities/date-with-time.tsx b/ui/components/shadcn/entities/date-with-time.tsx
similarity index 100%
rename from ui/components/ui/entities/date-with-time.tsx
rename to ui/components/shadcn/entities/date-with-time.tsx
diff --git a/ui/components/ui/entities/entity-info.tsx b/ui/components/shadcn/entities/entity-info.tsx
similarity index 97%
rename from ui/components/ui/entities/entity-info.tsx
rename to ui/components/shadcn/entities/entity-info.tsx
index ff8dd39e98..a8aeff92a4 100644
--- a/ui/components/ui/entities/entity-info.tsx
+++ b/ui/components/shadcn/entities/entity-info.tsx
@@ -2,12 +2,12 @@
import { ReactNode } from "react";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
import {
Tooltip,
TooltipContent,
TooltipTrigger,
} from "@/components/shadcn/tooltip";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
import type { ProviderType } from "@/types";
import { getProviderLogo } from "./get-provider-logo";
diff --git a/ui/components/ui/entities/get-provider-logo.tsx b/ui/components/shadcn/entities/get-provider-logo.tsx
similarity index 91%
rename from ui/components/ui/entities/get-provider-logo.tsx
rename to ui/components/shadcn/entities/get-provider-logo.tsx
index 7481d0a8ed..729e17395a 100644
--- a/ui/components/ui/entities/get-provider-logo.tsx
+++ b/ui/components/shadcn/entities/get-provider-logo.tsx
@@ -16,7 +16,9 @@ import {
OracleCloudProviderBadge,
VercelProviderBadge,
} from "@/components/icons/providers-badge";
+import { GenericProviderBadge } from "@/components/icons/providers-badge/generic-provider-badge";
import { ProviderType } from "@/types";
+import { getProviderDisplayName } from "@/types/providers";
export const getProviderLogo = (provider: ProviderType) => {
switch (provider) {
@@ -53,7 +55,7 @@ export const getProviderLogo = (provider: ProviderType) => {
case "okta":
return <OktaProviderBadge width={35} height={35} />;
default:
- return null;
+ return <GenericProviderBadge width={35} height={35} />;
}
};
@@ -92,6 +94,6 @@ export const getProviderName = (provider: ProviderType): string => {
case "okta":
return "Okta";
default:
- return "Unknown Provider";
+ return getProviderDisplayName(provider);
}
};
diff --git a/ui/components/shadcn/entities/index.ts b/ui/components/shadcn/entities/index.ts
new file mode 100644
index 0000000000..126cc34cd8
--- /dev/null
+++ b/ui/components/shadcn/entities/index.ts
@@ -0,0 +1,4 @@
+export * from "./date-with-time";
+export * from "./entity-info";
+export * from "./get-provider-logo";
+export * from "./scan-status";
diff --git a/ui/components/ui/entities/scan-status.tsx b/ui/components/shadcn/entities/scan-status.tsx
similarity index 100%
rename from ui/components/ui/entities/scan-status.tsx
rename to ui/components/shadcn/entities/scan-status.tsx
diff --git a/ui/components/shadcn/expandable-section.tsx b/ui/components/shadcn/expandable-section.tsx
new file mode 100644
index 0000000000..8109231111
--- /dev/null
+++ b/ui/components/shadcn/expandable-section.tsx
@@ -0,0 +1,39 @@
+"use client";
+
+import { cn } from "@/lib/utils";
+
+interface ExpandableSectionProps {
+ isExpanded: boolean;
+ children: React.ReactNode;
+ className?: string;
+ contentClassName?: string;
+}
+
+/**
+ * Animated expandable section using CSS grid for smooth height transitions.
+ * Animates from height 0 to auto content height.
+ */
+export function ExpandableSection({
+ isExpanded,
+ children,
+ className,
+ contentClassName,
+}: ExpandableSectionProps) {
+ return (
+ <div
+ className={cn(
+ "grid transition-[grid-template-rows] duration-300 ease-in-out",
+ isExpanded ? "grid-rows-[1fr]" : "grid-rows-[0fr]",
+ className,
+ )}
+ >
+ <div className="overflow-hidden">
+ <div
+ className={cn("pt-4", contentClassName, !isExpanded && "invisible")}
+ >
+ {children}
+ </div>
+ </div>
+ </div>
+ );
+}
diff --git a/ui/components/ui/feedback-banner/feedback-banner.tsx b/ui/components/shadcn/feedback-banner/feedback-banner.tsx
similarity index 91%
rename from ui/components/ui/feedback-banner/feedback-banner.tsx
rename to ui/components/shadcn/feedback-banner/feedback-banner.tsx
index a774cfffac..549f1d6518 100644
--- a/ui/components/ui/feedback-banner/feedback-banner.tsx
+++ b/ui/components/shadcn/feedback-banner/feedback-banner.tsx
@@ -15,12 +15,12 @@ const typeStyles: Record<
{ border: string; bg: string; text: string }
> = {
error: {
- border: "border-danger",
- bg: "bg-system-error-light/30 dark:bg-system-error-light/80",
+ border: "border-border-error",
+ bg: "bg-bg-fail-secondary",
text: "text-text-error",
},
warning: {
- border: "border-warning",
+ border: "border-amber-500",
bg: "bg-yellow-100 dark:bg-yellow-200",
text: "text-yellow-800",
},
diff --git a/ui/components/shadcn/feedback-banner/index.ts b/ui/components/shadcn/feedback-banner/index.ts
new file mode 100644
index 0000000000..ba3fe70979
--- /dev/null
+++ b/ui/components/shadcn/feedback-banner/index.ts
@@ -0,0 +1 @@
+export * from "./feedback-banner";
diff --git a/ui/components/shadcn/field/field.tsx b/ui/components/shadcn/field/field.tsx
index 4987713ff1..75bbe073ae 100644
--- a/ui/components/shadcn/field/field.tsx
+++ b/ui/components/shadcn/field/field.tsx
@@ -25,11 +25,22 @@ function FieldLabel({ className, ...props }: React.ComponentProps<"label">) {
);
}
-function FieldError({ className, ...props }: React.ComponentProps<"p">) {
+function FieldError({
+ className,
+ multiline = false,
+ ...props
+}: React.ComponentProps<"p"> & {
+ /** Preserve newlines for multi-line messages (e.g. server validation lists). */
+ multiline?: boolean;
+}) {
return (
<p
data-slot="field-error"
- className={cn("text-text-error-primary max-w-full text-xs", className)}
+ className={cn(
+ "text-text-error-primary max-w-full text-xs",
+ multiline && "whitespace-pre-wrap",
+ className,
+ )}
{...props}
/>
);
diff --git a/ui/components/ui/form/Form.test.tsx b/ui/components/shadcn/form/Form.test.tsx
similarity index 100%
rename from ui/components/ui/form/Form.test.tsx
rename to ui/components/shadcn/form/Form.test.tsx
diff --git a/ui/components/ui/form/Form.tsx b/ui/components/shadcn/form/Form.tsx
similarity index 100%
rename from ui/components/ui/form/Form.tsx
rename to ui/components/shadcn/form/Form.tsx
diff --git a/ui/components/ui/form/Label.tsx b/ui/components/shadcn/form/Label.tsx
similarity index 100%
rename from ui/components/ui/form/Label.tsx
rename to ui/components/shadcn/form/Label.tsx
diff --git a/ui/components/ui/form/form-buttons.tsx b/ui/components/shadcn/form/form-buttons.tsx
similarity index 97%
rename from ui/components/ui/form/form-buttons.tsx
rename to ui/components/shadcn/form/form-buttons.tsx
index 82501dd2db..8b48ef66f7 100644
--- a/ui/components/ui/form/form-buttons.tsx
+++ b/ui/components/shadcn/form/form-buttons.tsx
@@ -5,7 +5,7 @@ import { Dispatch, SetStateAction } from "react";
import { useFormStatus } from "react-dom";
import { SaveIcon } from "@/components/icons";
-import { Button } from "@/components/shadcn";
+import { Button } from "@/components/shadcn/button/button";
interface FormCancelButtonProps {
setIsOpen?: Dispatch<SetStateAction<boolean>>;
diff --git a/ui/components/shadcn/form/index.ts b/ui/components/shadcn/form/index.ts
new file mode 100644
index 0000000000..696b86aca3
--- /dev/null
+++ b/ui/components/shadcn/form/index.ts
@@ -0,0 +1,3 @@
+export * from "./Form";
+export * from "./form-buttons";
+export * from "./Label";
diff --git a/ui/components/shadcn/headers/index.ts b/ui/components/shadcn/headers/index.ts
new file mode 100644
index 0000000000..3416f7cd47
--- /dev/null
+++ b/ui/components/shadcn/headers/index.ts
@@ -0,0 +1 @@
+export * from "./navigation-header";
diff --git a/ui/components/shadcn/headers/navigation-header.tsx b/ui/components/shadcn/headers/navigation-header.tsx
new file mode 100644
index 0000000000..99acb2b368
--- /dev/null
+++ b/ui/components/shadcn/headers/navigation-header.tsx
@@ -0,0 +1,39 @@
+import { Icon } from "@iconify/react";
+import Link from "next/link";
+
+import { Button } from "@/components/shadcn/button/button";
+import { Separator } from "@/components/shadcn/separator/separator";
+
+interface NavigationHeaderProps {
+ title: string;
+ icon: string;
+ href?: string;
+}
+
+export const NavigationHeader = ({
+ title,
+ icon,
+ href,
+}: NavigationHeaderProps) => {
+ return (
+ <>
+ <header className="border-border-neutral-secondary flex items-center gap-3 border-b px-6 py-4">
+ <Button
+ className="border-border-neutral-secondary bg-transparent p-0"
+ aria-label="Navigation button"
+ variant="outline"
+ size="icon"
+ asChild
+ >
+ <Link href={href || ""}>
+ <Icon icon={icon} className="text-text-neutral-secondary" />
+ </Link>
+ </Button>
+ <Separator orientation="vertical" className="h-6" />
+ <h1 className="text-text-neutral-secondary text-xl font-light">
+ {title}
+ </h1>
+ </header>
+ </>
+ );
+};
diff --git a/ui/components/shadcn/index.ts b/ui/components/shadcn/index.ts
index 18ac317ef5..6b720d6f79 100644
--- a/ui/components/shadcn/index.ts
+++ b/ui/components/shadcn/index.ts
@@ -1,5 +1,9 @@
+export * from "./accordion/Accordion";
+export * from "./action-card/ActionCard";
export * from "./alert";
+export * from "./alert-dialog";
export * from "./badge/badge";
+export * from "./breadcrumbs";
export * from "./button/button";
export * from "./card/card";
export * from "./card/resource-stats-card/resource-stats-card";
@@ -7,12 +11,17 @@ export * from "./card/resource-stats-card/resource-stats-card-content";
export * from "./card/resource-stats-card/resource-stats-card-header";
export * from "./checkbox/checkbox";
export * from "./combobox";
-export * from "./drawer";
+export * from "./download-icon-button";
export * from "./dropdown/dropdown";
+export * from "./feedback-banner";
export * from "./field/field";
export * from "./file-upload";
+export * from "./headers";
export * from "./info-field";
export * from "./input/input";
+export * from "./label";
+export * from "./navigation-button";
+export * from "./navigation-progress";
export * from "./progress";
export * from "./search-input/search-input";
export * from "./section/section";
@@ -21,7 +30,9 @@ export * from "./select/select";
export * from "./separator/separator";
export * from "./skeleton/skeleton";
export * from "./stacked-cell/stacked-cell";
+export * from "./switch/switch";
export * from "./tabs/generic-tabs";
export * from "./tabs/tabs";
export * from "./textarea/textarea";
+export * from "./toast";
export * from "./tooltip";
diff --git a/ui/components/ui/label/Label.tsx b/ui/components/shadcn/label/Label.tsx
similarity index 100%
rename from ui/components/ui/label/Label.tsx
rename to ui/components/shadcn/label/Label.tsx
diff --git a/ui/components/shadcn/label/index.ts b/ui/components/shadcn/label/index.ts
new file mode 100644
index 0000000000..e0a468a2d2
--- /dev/null
+++ b/ui/components/shadcn/label/index.ts
@@ -0,0 +1 @@
+export * from "./Label";
diff --git a/ui/components/shadcn/modal/modal.tsx b/ui/components/shadcn/modal/modal.tsx
index 0d6eb3842f..39dd968d43 100644
--- a/ui/components/shadcn/modal/modal.tsx
+++ b/ui/components/shadcn/modal/modal.tsx
@@ -33,6 +33,14 @@ interface ModalProps {
size?: ModalSize;
className?: string;
onOpenAutoFocus?: (event: Event) => void;
+ onCloseAutoFocus?: (event: Event) => void;
+ /**
+ * Cap the dialog at 90dvh and scroll overflowing content, instead of
+ * letting it grow past the viewport. Opt-in per modal (e.g. for content
+ * whose height depends on user input) rather than a DS-wide default, so
+ * existing modals keep their current sizing.
+ */
+ scrollable?: boolean;
}
export const Modal = ({
@@ -44,13 +52,19 @@ export const Modal = ({
size = "xl",
className,
onOpenAutoFocus = preventInitialAutoFocus,
+ onCloseAutoFocus,
+ scrollable = false,
}: ModalProps) => {
return (
<Dialog open={open} onOpenChange={onOpenChange}>
<DialogContent
onOpenAutoFocus={onOpenAutoFocus}
+ onCloseAutoFocus={onCloseAutoFocus}
+ // Radix requires an accessible description; opt out explicitly when none is provided.
+ {...(description ? {} : { "aria-describedby": undefined })}
className={cn(
"border-text-neutral-tertiary bg-bg-neutral-secondary rounded-[24px] border shadow-[0_0_200px_0_rgba(15,44,46,0.50)]",
+ scrollable && "max-h-[90dvh] overflow-y-auto",
SIZE_CLASSES[size],
className,
)}
@@ -59,7 +73,7 @@ export const Modal = ({
<DialogHeader>
<DialogTitle>{title}</DialogTitle>
{description && (
- <DialogDescription className="text-small text-gray-600 dark:text-gray-300">
+ <DialogDescription className="text-sm text-gray-600 dark:text-gray-300">
{description}
</DialogDescription>
)}
diff --git a/ui/components/shadcn/navigation-button/index.ts b/ui/components/shadcn/navigation-button/index.ts
new file mode 100644
index 0000000000..5b57be94a2
--- /dev/null
+++ b/ui/components/shadcn/navigation-button/index.ts
@@ -0,0 +1 @@
+export * from "./navigation-button";
diff --git a/ui/components/shadcn/navigation-button/navigation-button.test.tsx b/ui/components/shadcn/navigation-button/navigation-button.test.tsx
new file mode 100644
index 0000000000..7951fcbcc8
--- /dev/null
+++ b/ui/components/shadcn/navigation-button/navigation-button.test.tsx
@@ -0,0 +1,31 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { NavigationButton } from "./navigation-button";
+
+describe("NavigationButton", () => {
+ it("composes an active navigation link without rendering a nested button", () => {
+ // Given / When
+ render(
+ <NavigationButton asChild active>
+ <a href="/findings">Findings</a>
+ </NavigationButton>,
+ );
+
+ // Then
+ const link = screen.getByRole("link", { name: "Findings" });
+ expect(link).toHaveAttribute("data-slot", "navigation-button");
+ expect(link).toHaveAttribute("data-active", "true");
+ expect(screen.queryByRole("button")).not.toBeInTheDocument();
+ });
+
+ it("defaults native navigation controls to non-submitting buttons", () => {
+ // Given / When
+ render(<NavigationButton variant="toggle">Chat</NavigationButton>);
+
+ // Then
+ const button = screen.getByRole("button", { name: "Chat" });
+ expect(button).toHaveAttribute("type", "button");
+ expect(button).toHaveAttribute("data-active", "false");
+ });
+});
diff --git a/ui/components/shadcn/navigation-button/navigation-button.tsx b/ui/components/shadcn/navigation-button/navigation-button.tsx
new file mode 100644
index 0000000000..5c72605438
--- /dev/null
+++ b/ui/components/shadcn/navigation-button/navigation-button.tsx
@@ -0,0 +1,115 @@
+import { Slot } from "@radix-ui/react-slot";
+import { cva, type VariantProps } from "class-variance-authority";
+import type { ComponentProps } from "react";
+
+import { cn } from "@/lib/utils";
+
+const navigationButtonVariants = cva(
+ "focus-visible:ring-button-primary/50 flex min-w-0 items-center focus-visible:ring-2 focus-visible:outline-none",
+ {
+ variants: {
+ variant: {
+ item: "relative min-h-10 w-full justify-start gap-3 rounded-lg border px-3 py-2 text-left text-sm font-medium transition-all duration-200",
+ subitem:
+ "min-h-8 w-full justify-start gap-2 rounded-md px-3 py-1.5 text-left text-sm transition-colors",
+ toggle:
+ "h-8 flex-1 justify-center gap-1.5 rounded-lg border px-2 text-sm transition-all",
+ },
+ active: {
+ true: "",
+ false: "",
+ },
+ disabledState: {
+ true: "pointer-events-none text-text-neutral-tertiary",
+ false: "",
+ },
+ },
+ compoundVariants: [
+ {
+ variant: "item",
+ active: true,
+ disabledState: false,
+ class:
+ "border-border-sidebar-active bg-bg-sidebar-active text-text-neutral-primary shadow-sidebar-active",
+ },
+ {
+ variant: "item",
+ active: false,
+ disabledState: false,
+ class:
+ "text-text-neutral-secondary hover:border-border-sidebar-hover hover:bg-bg-sidebar-hover hover:text-text-neutral-primary border-transparent",
+ },
+ {
+ variant: "subitem",
+ active: true,
+ disabledState: false,
+ class:
+ "bg-bg-sidebar-subitem-active text-text-neutral-primary font-medium",
+ },
+ {
+ variant: "subitem",
+ active: false,
+ disabledState: false,
+ class:
+ "text-text-neutral-secondary hover:bg-bg-sidebar-hover hover:text-text-neutral-primary",
+ },
+ {
+ variant: "toggle",
+ active: true,
+ disabledState: false,
+ class:
+ "border-border-sidebar-active bg-bg-sidebar-active text-text-neutral-primary shadow-sidebar-active",
+ },
+ {
+ variant: "toggle",
+ active: false,
+ disabledState: false,
+ class:
+ "text-text-neutral-secondary hover:bg-bg-sidebar-hover hover:text-text-neutral-primary border-transparent",
+ },
+ ],
+ defaultVariants: {
+ variant: "item",
+ active: false,
+ disabledState: false,
+ },
+ },
+);
+
+interface NavigationButtonProps
+ extends ComponentProps<"button">,
+ VariantProps<typeof navigationButtonVariants> {
+ asChild?: boolean;
+}
+
+function NavigationButton({
+ active = false,
+ asChild = false,
+ className,
+ disabledState = false,
+ type,
+ variant,
+ ...props
+}: NavigationButtonProps) {
+ const Comp = asChild ? Slot : "button";
+
+ return (
+ <Comp
+ data-slot="navigation-button"
+ data-active={active}
+ data-disabled={disabledState}
+ type={asChild ? undefined : (type ?? "button")}
+ className={cn(
+ navigationButtonVariants({
+ active,
+ className,
+ disabledState,
+ variant,
+ }),
+ )}
+ {...props}
+ />
+ );
+}
+
+export { NavigationButton };
diff --git a/ui/components/shadcn/navigation-progress/index.ts b/ui/components/shadcn/navigation-progress/index.ts
new file mode 100644
index 0000000000..2a80281acb
--- /dev/null
+++ b/ui/components/shadcn/navigation-progress/index.ts
@@ -0,0 +1,7 @@
+export { NavigationProgress } from "./navigation-progress";
+export {
+ cancelProgress,
+ completeProgress,
+ startProgress,
+ useNavigationProgress,
+} from "./use-navigation-progress";
diff --git a/ui/components/ui/navigation-progress/navigation-progress.tsx b/ui/components/shadcn/navigation-progress/navigation-progress.tsx
similarity index 96%
rename from ui/components/ui/navigation-progress/navigation-progress.tsx
rename to ui/components/shadcn/navigation-progress/navigation-progress.tsx
index 3fcb241569..8aaae510fc 100644
--- a/ui/components/ui/navigation-progress/navigation-progress.tsx
+++ b/ui/components/shadcn/navigation-progress/navigation-progress.tsx
@@ -2,7 +2,7 @@
import { useEffect, useState } from "react";
-import { cn } from "@/lib";
+import { cn } from "@/lib/utils";
import { useNavigationProgress } from "./use-navigation-progress";
diff --git a/ui/components/ui/navigation-progress/use-navigation-progress.ts b/ui/components/shadcn/navigation-progress/use-navigation-progress.ts
similarity index 100%
rename from ui/components/ui/navigation-progress/use-navigation-progress.ts
rename to ui/components/shadcn/navigation-progress/use-navigation-progress.ts
diff --git a/ui/components/shadcn/popover.tsx b/ui/components/shadcn/popover.tsx
index e64bae46ad..c974718f39 100644
--- a/ui/components/shadcn/popover.tsx
+++ b/ui/components/shadcn/popover.tsx
@@ -32,7 +32,9 @@ function PopoverContent({
align={align}
sideOffset={sideOffset}
className={cn(
- "bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 pointer-events-auto z-50 w-72 origin-(--radix-popover-content-transform-origin) rounded-md border p-4 shadow-md outline-hidden",
+ // House floating surface (same as tooltip); `bg-popover` was a stock
+ // shadcn token that does not exist in this design system.
+ "border-border-neutral-tertiary bg-bg-neutral-tertiary text-text-neutral-primary data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 pointer-events-auto z-50 w-72 origin-(--radix-popover-content-transform-origin) rounded-lg border p-4 shadow-lg outline-hidden",
className,
)}
{...props}
@@ -47,4 +49,10 @@ function PopoverAnchor({
return <PopoverPrimitive.Anchor data-slot="popover-anchor" {...props} />;
}
-export { Popover, PopoverAnchor, PopoverContent, PopoverTrigger };
+function PopoverClose({
+ ...props
+}: React.ComponentProps<typeof PopoverPrimitive.Close>) {
+ return <PopoverPrimitive.Close data-slot="popover-close" {...props} />;
+}
+
+export { Popover, PopoverAnchor, PopoverClose, PopoverContent, PopoverTrigger };
diff --git a/ui/components/shadcn/scroll-area/index.ts b/ui/components/shadcn/scroll-area/index.ts
new file mode 100644
index 0000000000..e368a81202
--- /dev/null
+++ b/ui/components/shadcn/scroll-area/index.ts
@@ -0,0 +1 @@
+export * from "./scroll-area";
diff --git a/ui/components/ui/scroll-area/scroll-area.tsx b/ui/components/shadcn/scroll-area/scroll-area.tsx
similarity index 100%
rename from ui/components/ui/scroll-area/scroll-area.tsx
rename to ui/components/shadcn/scroll-area/scroll-area.tsx
diff --git a/ui/components/shadcn/section/section.tsx b/ui/components/shadcn/section/section.tsx
index 9098013fe6..ca127657b1 100644
--- a/ui/components/shadcn/section/section.tsx
+++ b/ui/components/shadcn/section/section.tsx
@@ -25,7 +25,7 @@ function SectionTitle({ className, ...props }: React.ComponentProps<"h3">) {
<h3
data-slot="section-title"
className={cn(
- "text-md text-default-foreground leading-9 font-bold",
+ "text-md text-text-neutral-primary leading-9 font-bold",
className,
)}
{...props}
@@ -40,7 +40,7 @@ function SectionDescription({
return (
<p
data-slot="section-description"
- className={cn("text-default-500 text-sm", className)}
+ className={cn("text-text-neutral-tertiary text-sm", className)}
{...props}
/>
);
diff --git a/ui/components/shadcn/select/multiselect.test.tsx b/ui/components/shadcn/select/multiselect.test.tsx
index 3959d16053..9323539aa1 100644
--- a/ui/components/shadcn/select/multiselect.test.tsx
+++ b/ui/components/shadcn/select/multiselect.test.tsx
@@ -83,6 +83,43 @@ describe("MultiSelect", () => {
).not.toBeInTheDocument();
});
+ it("uses a selected background instead of a check icon for active items", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <MultiSelect values={["aws-prod"]} onValuesChange={() => {}}>
+ <MultiSelectTrigger>
+ <MultiSelectValue placeholder="Select accounts" />
+ </MultiSelectTrigger>
+ <MultiSelectContent search={false}>
+ <MultiSelectItem value="aws-prod">Production AWS</MultiSelectItem>
+ <MultiSelectItem value="azure-dev">Development Azure</MultiSelectItem>
+ </MultiSelectContent>
+ </MultiSelect>,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox"));
+
+ // Then
+ const selectedItem = screen.getByRole("option", {
+ name: "Production AWS",
+ });
+ expect(selectedItem).toHaveAttribute("data-state", "checked");
+ expect(selectedItem).toHaveClass(
+ "data-[state=checked]:bg-button-tertiary/10",
+ );
+ expect(selectedItem).not.toHaveClass(
+ "data-[state=checked]:bg-bg-neutral-tertiary",
+ );
+ expect(selectedItem).toHaveClass(
+ "data-[state=checked]:hover:bg-button-tertiary/15",
+ );
+ expect(selectedItem).toHaveClass("hover:bg-slate-200");
+ expect(selectedItem).toHaveClass("dark:hover:bg-slate-700/50");
+ expect(selectedItem.querySelector("svg")).toBeNull();
+ });
+
it("filters items without crashing when search is enabled", async () => {
const user = userEvent.setup();
@@ -181,39 +218,6 @@ describe("MultiSelect", () => {
expect(screen.getByPlaceholderText("Search accounts...")).toHaveValue("");
});
- it("closes the dropdown when clicking outside", async () => {
- // Given
- const user = userEvent.setup();
- render(
- <div>
- <MultiSelect values={[]} onValuesChange={() => {}}>
- <MultiSelectTrigger>
- <MultiSelectValue placeholder="Select accounts" />
- </MultiSelectTrigger>
- <MultiSelectContent
- search={{
- placeholder: "Search accounts...",
- emptyMessage: "No accounts found.",
- }}
- >
- <MultiSelectItem value="aws-prod">Production AWS</MultiSelectItem>
- </MultiSelectContent>
- </MultiSelect>
- <button type="button">Outside target</button>
- </div>,
- );
-
- // When
- await user.click(screen.getByRole("combobox"));
- expect(screen.getByPlaceholderText("Search accounts...")).toBeVisible();
- await user.click(screen.getByRole("button", { name: /outside target/i }));
-
- // Then
- expect(
- screen.queryByPlaceholderText("Search accounts..."),
- ).not.toBeInTheDocument();
- });
-
it("sizes the dropdown to its content with a capped width", async () => {
const user = userEvent.setup();
@@ -237,46 +241,6 @@ describe("MultiSelect", () => {
expect(screen.getByRole("dialog")).toHaveClass("sm:max-w-[22rem]");
});
- it("keeps long option lists scrollable inside the dropdown", async () => {
- // Given
- const user = userEvent.setup();
-
- render(
- <MultiSelect values={[]} onValuesChange={() => {}}>
- <MultiSelectTrigger>
- <MultiSelectValue placeholder="Select accounts" />
- </MultiSelectTrigger>
- <MultiSelectContent search={false}>
- {Array.from({ length: 20 }, (_, index) => (
- <MultiSelectItem key={index} value={`account-${index}`}>
- Account {index}
- </MultiSelectItem>
- ))}
- </MultiSelectContent>
- </MultiSelect>,
- );
-
- // When
- await user.click(screen.getByRole("combobox"));
-
- // Then
- const list = screen
- .getByRole("dialog")
- .querySelector('[data-slot="command-list"]');
-
- expect(screen.getByRole("dialog")).toHaveStyle({
- maxHeight:
- "min(360px, var(--radix-popover-content-available-height, 360px))",
- });
- expect(list).toHaveClass("minimal-scrollbar");
- expect(list).toHaveStyle({
- maxHeight:
- "min(300px, var(--radix-popover-content-available-height, 300px))",
- });
- expect(list).toHaveClass("overflow-y-auto");
- expect(list).toHaveClass("overscroll-contain");
- });
-
it("keeps the legacy clear-all behavior by default", async () => {
const user = userEvent.setup();
const onValuesChange = vi.fn();
diff --git a/ui/components/shadcn/select/multiselect.tsx b/ui/components/shadcn/select/multiselect.tsx
index 209edbe599..5360836574 100644
--- a/ui/components/shadcn/select/multiselect.tsx
+++ b/ui/components/shadcn/select/multiselect.tsx
@@ -1,6 +1,6 @@
"use client";
-import { CheckIcon, ChevronDown, XIcon } from "lucide-react";
+import { ChevronDown, XIcon } from "lucide-react";
import {
type ComponentPropsWithoutRef,
createContext,
@@ -411,12 +411,12 @@ export function MultiSelectItem({
disabled={disabled}
aria-disabled={disabled}
data-disabled={disabled ? "true" : undefined}
+ data-state={isSelected ? "checked" : "unchecked"}
value={value}
keywords={keywords}
data-slot="multiselect-item"
className={cn(
- "focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-bg-button-secondary text-bg-button-secondary my-1 flex w-full cursor-pointer items-center justify-between gap-3 overflow-hidden rounded-lg px-4 py-3 text-sm outline-hidden select-none first:mt-0 last:mb-0 hover:bg-slate-200 data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 dark:hover:bg-slate-700/50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-5",
- isSelected && "bg-slate-100 dark:bg-slate-800/50",
+ "focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-bg-button-secondary text-bg-button-secondary data-[state=checked]:bg-button-tertiary/10 data-[state=checked]:text-text-neutral-primary data-[state=checked]:hover:bg-button-tertiary/15 data-[state=checked]:focus:bg-button-tertiary/15 data-[selected=true]:data-[state=checked]:bg-button-tertiary/15 my-1 flex w-full cursor-pointer items-center gap-3 overflow-hidden rounded-lg px-4 py-3 text-sm outline-hidden select-none first:mt-0 last:mb-0 hover:bg-slate-200 data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 dark:hover:bg-slate-700/50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-5",
disabled && "cursor-not-allowed opacity-50 hover:bg-transparent",
className,
)}
@@ -429,12 +429,6 @@ export function MultiSelectItem({
<span className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden whitespace-nowrap">
{children}
</span>
- <CheckIcon
- className={cn(
- "text-bg-button-secondary size-5 shrink-0",
- isSelected ? "opacity-100" : "opacity-0",
- )}
- />
</CommandItem>
);
}
diff --git a/ui/components/shadcn/select/select.test.tsx b/ui/components/shadcn/select/select.test.tsx
new file mode 100644
index 0000000000..9ea72b39c1
--- /dev/null
+++ b/ui/components/shadcn/select/select.test.tsx
@@ -0,0 +1,84 @@
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeAll, describe, expect, it } from "vitest";
+
+import { Select, SelectContent, SelectItem, SelectTrigger } from "./select";
+
+beforeAll(() => {
+ Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+ configurable: true,
+ value: () => false,
+ });
+ Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+ configurable: true,
+ value: () => {},
+ });
+ Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+ configurable: true,
+ value: () => {},
+ });
+});
+
+describe("Select", () => {
+ it("supports an extra-small trigger size", () => {
+ // Given / When
+ render(
+ <Select value="open">
+ <SelectTrigger aria-label="Compact status" size="xs">
+ Open
+ </SelectTrigger>
+ <SelectContent>
+ <SelectItem value="open">Open</SelectItem>
+ </SelectContent>
+ </Select>,
+ );
+
+ // Then
+ const trigger = screen.getByRole("combobox", { name: "Compact status" });
+ expect(trigger).toHaveAttribute("data-size", "xs");
+ expect(trigger).toHaveClass(
+ "data-[size=xs]:h-8",
+ "data-[size=xs]:px-3",
+ "data-[size=xs]:py-0",
+ "data-[size=xs]:text-xs",
+ );
+ });
+
+ it("uses a selected background instead of a check icon for the active item", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(
+ <Select value="under_review">
+ <SelectTrigger aria-label="Triage status">Under Review</SelectTrigger>
+ <SelectContent>
+ <SelectItem value="open">Open</SelectItem>
+ <SelectItem value="under_review">Under Review</SelectItem>
+ </SelectContent>
+ </Select>,
+ );
+
+ // When
+ await user.click(screen.getByRole("combobox", { name: "Triage status" }));
+
+ // Then
+ const selectedItem = screen.getByRole("option", {
+ name: "Under Review",
+ });
+ expect(selectedItem).toHaveAttribute("data-state", "checked");
+ expect(selectedItem).toHaveClass(
+ "data-[state=checked]:bg-button-tertiary/10",
+ );
+ expect(selectedItem).not.toHaveClass(
+ "data-[state=checked]:bg-bg-neutral-tertiary",
+ );
+ expect(selectedItem).toHaveClass(
+ "data-[state=checked]:hover:bg-button-tertiary/15",
+ );
+ expect(selectedItem).toHaveClass("hover:bg-slate-200");
+ expect(selectedItem).toHaveClass("dark:hover:bg-slate-700/50");
+ expect(
+ within(selectedItem).queryByRole("img", { hidden: true }),
+ ).toBeNull();
+ expect(selectedItem.querySelector("svg")).toBeNull();
+ });
+});
diff --git a/ui/components/shadcn/select/select.tsx b/ui/components/shadcn/select/select.tsx
index 76099df534..36ed268da7 100644
--- a/ui/components/shadcn/select/select.tsx
+++ b/ui/components/shadcn/select/select.tsx
@@ -1,7 +1,7 @@
"use client";
import * as SelectPrimitive from "@radix-ui/react-select";
-import { CheckIcon, ChevronDownIcon, ChevronUpIcon } from "lucide-react";
+import { ChevronDownIcon, ChevronUpIcon } from "lucide-react";
import { ComponentProps, type WheelEvent } from "react";
import { cn } from "@/lib/utils";
@@ -10,6 +10,22 @@ const stopWheelPropagation = (event: WheelEvent<HTMLElement>) => {
event.stopPropagation();
};
+const SELECT_TRIGGER_SIZES = {
+ XS: "xs",
+ SM: "sm",
+ DEFAULT: "default",
+} as const;
+
+const SELECT_TRIGGER_ICON_SIZES = {
+ SM: "sm",
+ DEFAULT: "default",
+} as const;
+
+type SelectTriggerSize =
+ (typeof SELECT_TRIGGER_SIZES)[keyof typeof SELECT_TRIGGER_SIZES];
+type SelectTriggerIconSize =
+ (typeof SELECT_TRIGGER_ICON_SIZES)[keyof typeof SELECT_TRIGGER_ICON_SIZES];
+
function Select({
allowDeselect = false,
...props
@@ -49,20 +65,20 @@ function SelectValue({
function SelectTrigger({
className,
- size = "default",
- iconSize = "default",
+ size = SELECT_TRIGGER_SIZES.DEFAULT,
+ iconSize = SELECT_TRIGGER_ICON_SIZES.DEFAULT,
children,
...props
}: ComponentProps<typeof SelectPrimitive.Trigger> & {
- size?: "sm" | "default";
- iconSize?: "sm" | "default";
+ size?: SelectTriggerSize;
+ iconSize?: SelectTriggerIconSize;
}) {
return (
<SelectPrimitive.Trigger
data-slot="select-trigger"
data-size={size}
className={cn(
- "group border-border-input-primary bg-bg-input-primary text-bg-button-secondary data-[placeholder]:text-bg-button-secondary [&_svg:not([class*='text-'])]:text-bg-button-secondary aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive hover:bg-bg-neutral-tertiary active:bg-border-neutral-tertiary dark:bg-input/30 dark:hover:bg-input/50 focus-visible:border-border-input-primary-press focus-visible:ring-border-input-primary-press flex w-full items-center justify-between gap-2 overflow-hidden rounded-lg border px-4 py-3 text-sm whitespace-nowrap shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-1 focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 has-[>svg]:px-3 data-[size=default]:h-[52px] data-[size=sm]:h-10 *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-2 dark:focus-visible:ring-slate-400 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-6",
+ "group border-border-input-primary bg-bg-input-primary text-bg-button-secondary data-[placeholder]:text-bg-button-secondary [&_svg:not([class*='text-'])]:text-bg-button-secondary aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive hover:bg-bg-neutral-tertiary active:bg-border-neutral-tertiary dark:bg-input/30 dark:hover:bg-input/50 focus-visible:border-border-input-primary-press focus-visible:ring-border-input-primary-press flex w-full items-center justify-between gap-2 overflow-hidden rounded-lg border px-4 py-3 text-sm whitespace-nowrap shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-1 focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 has-[>svg]:px-3 data-[size=default]:h-[52px] data-[size=sm]:h-10 data-[size=xs]:h-8 data-[size=xs]:gap-1.5 data-[size=xs]:px-3 data-[size=xs]:py-0 data-[size=xs]:text-xs *:data-[slot=select-value]:line-clamp-1 *:data-[slot=select-value]:flex *:data-[slot=select-value]:items-center *:data-[slot=select-value]:gap-2 dark:focus-visible:ring-slate-400 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-6",
className,
)}
{...props}
@@ -72,7 +88,7 @@ function SelectTrigger({
<ChevronDownIcon
className={cn(
"text-bg-button-secondary shrink-0 opacity-70 transition-transform duration-200 group-data-[state=open]:rotate-180",
- iconSize === "sm" ? "size-4" : "size-6",
+ iconSize === SELECT_TRIGGER_ICON_SIZES.SM ? "size-4" : "size-6",
)}
aria-hidden="true"
/>
@@ -162,7 +178,7 @@ function SelectItem({
<SelectPrimitive.Item
data-slot="select-item"
className={cn(
- "focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-bg-button-secondary text-bg-button-secondary relative flex w-full cursor-pointer items-center gap-2 rounded-lg py-3 pr-12 pl-4 text-sm outline-hidden select-none hover:bg-slate-200 data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 dark:hover:bg-slate-700/50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-5",
+ "focus:bg-accent focus:text-accent-foreground [&_svg:not([class*='text-'])]:text-bg-button-secondary text-bg-button-secondary data-[state=checked]:bg-button-tertiary/10 data-[state=checked]:text-text-neutral-primary data-[state=checked]:hover:bg-button-tertiary/15 data-[state=checked]:focus:bg-button-tertiary/15 relative flex w-full cursor-pointer items-center gap-2 rounded-lg py-3 pr-4 pl-4 text-sm outline-hidden select-none hover:bg-slate-200 data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 dark:hover:bg-slate-700/50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-5",
className,
)}
{...props}
@@ -172,9 +188,6 @@ function SelectItem({
{children}
</span>
</SelectPrimitive.ItemText>
- <SelectPrimitive.ItemIndicator asChild>
- <CheckIcon className="text-bg-button-secondary absolute right-4 size-5" />
- </SelectPrimitive.ItemIndicator>
</SelectPrimitive.Item>
);
}
diff --git a/ui/components/shadcn/sheet/index.ts b/ui/components/shadcn/sheet/index.ts
new file mode 100644
index 0000000000..2865f1c5a7
--- /dev/null
+++ b/ui/components/shadcn/sheet/index.ts
@@ -0,0 +1,2 @@
+export * from "./sheet";
+export * from "./trigger-sheet";
diff --git a/ui/components/shadcn/sheet/sheet.test.tsx b/ui/components/shadcn/sheet/sheet.test.tsx
new file mode 100644
index 0000000000..a472d08fd1
--- /dev/null
+++ b/ui/components/shadcn/sheet/sheet.test.tsx
@@ -0,0 +1,31 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import {
+ Sheet,
+ SheetContent,
+ SheetDescription,
+ SheetHeader,
+ SheetTitle,
+} from "./sheet";
+
+describe("SheetContent", () => {
+ it("exposes the navigation drawer variant as a design-system contract", () => {
+ // Given / When
+ render(
+ <Sheet open>
+ <SheetContent variant="navigation" showCloseButton={false}>
+ <SheetHeader>
+ <SheetTitle>App navigation</SheetTitle>
+ <SheetDescription>Primary destinations</SheetDescription>
+ </SheetHeader>
+ </SheetContent>
+ </Sheet>,
+ );
+
+ // Then
+ expect(
+ screen.getByRole("dialog", { name: "App navigation" }),
+ ).toHaveAttribute("data-variant", "navigation");
+ });
+});
diff --git a/ui/components/shadcn/sheet/sheet.tsx b/ui/components/shadcn/sheet/sheet.tsx
new file mode 100644
index 0000000000..2d5b79de8c
--- /dev/null
+++ b/ui/components/shadcn/sheet/sheet.tsx
@@ -0,0 +1,170 @@
+"use client";
+
+import * as SheetPrimitive from "@radix-ui/react-dialog";
+import { Cross2Icon } from "@radix-ui/react-icons";
+import { cva, type VariantProps } from "class-variance-authority";
+import type { ComponentPropsWithRef, HTMLAttributes } from "react";
+
+import { cn } from "@/lib/utils";
+
+const Sheet = SheetPrimitive.Root;
+
+const SheetTrigger = SheetPrimitive.Trigger;
+
+const SheetClose = SheetPrimitive.Close;
+
+const SheetPortal = SheetPrimitive.Portal;
+
+function SheetOverlay({
+ className,
+ ref,
+ ...props
+}: ComponentPropsWithRef<typeof SheetPrimitive.Overlay>) {
+ return (
+ <SheetPrimitive.Overlay
+ ref={ref}
+ className={cn(
+ "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/80",
+ className,
+ )}
+ {...props}
+ />
+ );
+}
+SheetOverlay.displayName = SheetPrimitive.Overlay.displayName;
+
+const sheetVariants = cva(
+ "fixed z-50 gap-4 border border-border-neutral-secondary bg-bg-neutral-secondary p-6 shadow-lg transition ease-in-out data-[state=closed]:duration-300 data-[state=open]:duration-500 data-[state=open]:animate-in data-[state=closed]:animate-out",
+ {
+ variants: {
+ side: {
+ top: "inset-x-0 top-0 rounded-b-xl data-[state=closed]:slide-out-to-top data-[state=open]:slide-in-from-top",
+ bottom:
+ "inset-x-0 bottom-0 rounded-t-xl data-[state=closed]:slide-out-to-bottom data-[state=open]:slide-in-from-bottom",
+ left: "inset-y-0 left-0 h-full w-3/4 rounded-r-xl data-[state=closed]:slide-out-to-left data-[state=open]:slide-in-from-left",
+ right:
+ "inset-y-0 right-0 h-full w-3/4 rounded-l-xl data-[state=closed]:slide-out-to-right data-[state=open]:slide-in-from-right",
+ },
+ variant: {
+ default: "",
+ navigation:
+ "bg-bg-neutral-primary w-[264px] max-w-[264px] gap-0 rounded-none p-0",
+ },
+ },
+ defaultVariants: {
+ side: "right",
+ variant: "default",
+ },
+ },
+);
+
+interface SheetContentProps
+ extends ComponentPropsWithRef<typeof SheetPrimitive.Content>,
+ VariantProps<typeof sheetVariants> {
+ showCloseButton?: boolean;
+}
+
+function SheetContent({
+ children,
+ className,
+ ref,
+ showCloseButton = true,
+ side = "right",
+ variant = "default",
+ ...props
+}: SheetContentProps) {
+ return (
+ <SheetPortal>
+ <SheetOverlay />
+ <SheetPrimitive.Content
+ ref={ref}
+ data-variant={variant}
+ className={cn(sheetVariants({ side, variant }), className)}
+ {...props}
+ >
+ {showCloseButton && (
+ <SheetPrimitive.Close className="absolute top-4 right-4 rounded-sm opacity-70 ring-offset-white transition-opacity hover:opacity-100 focus:ring-2 focus:ring-neutral-950 focus:ring-offset-2 focus:outline-none disabled:pointer-events-none data-[state=open]:bg-neutral-100 dark:ring-offset-neutral-950 dark:focus:ring-neutral-300 dark:data-[state=open]:bg-neutral-800">
+ <Cross2Icon className="h-4 w-4" />
+ <span className="sr-only">Close</span>
+ </SheetPrimitive.Close>
+ )}
+ {children}
+ </SheetPrimitive.Content>
+ </SheetPortal>
+ );
+}
+SheetContent.displayName = SheetPrimitive.Content.displayName;
+
+const SheetHeader = ({
+ className,
+ ...props
+}: HTMLAttributes<HTMLDivElement>) => (
+ <div
+ className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
+ {...props}
+ />
+);
+SheetHeader.displayName = "SheetHeader";
+
+const SheetFooter = ({
+ className,
+ ...props
+}: HTMLAttributes<HTMLDivElement>) => (
+ <div
+ className={cn(
+ "flex flex-col-reverse sm:flex-row sm:justify-end sm:gap-2",
+ className,
+ )}
+ {...props}
+ />
+);
+SheetFooter.displayName = "SheetFooter";
+
+function SheetTitle({
+ className,
+ ref,
+ ...props
+}: ComponentPropsWithRef<typeof SheetPrimitive.Title>) {
+ return (
+ <SheetPrimitive.Title
+ ref={ref}
+ className={cn(
+ "text-lg font-semibold text-neutral-950 dark:text-neutral-50",
+ className,
+ )}
+ {...props}
+ />
+ );
+}
+SheetTitle.displayName = SheetPrimitive.Title.displayName;
+
+function SheetDescription({
+ className,
+ ref,
+ ...props
+}: ComponentPropsWithRef<typeof SheetPrimitive.Description>) {
+ return (
+ <SheetPrimitive.Description
+ ref={ref}
+ className={cn(
+ "text-sm text-neutral-500 dark:text-neutral-400",
+ className,
+ )}
+ {...props}
+ />
+ );
+}
+SheetDescription.displayName = SheetPrimitive.Description.displayName;
+
+export {
+ Sheet,
+ SheetClose,
+ SheetContent,
+ SheetDescription,
+ SheetFooter,
+ SheetHeader,
+ SheetOverlay,
+ SheetPortal,
+ SheetTitle,
+ SheetTrigger,
+};
diff --git a/ui/components/ui/sheet/trigger-sheet.tsx b/ui/components/shadcn/sheet/trigger-sheet.tsx
similarity index 100%
rename from ui/components/ui/sheet/trigger-sheet.tsx
rename to ui/components/shadcn/sheet/trigger-sheet.tsx
diff --git a/ui/components/shadcn/side-panel/side-panel.tsx b/ui/components/shadcn/side-panel/side-panel.tsx
new file mode 100644
index 0000000000..db4755592c
--- /dev/null
+++ b/ui/components/shadcn/side-panel/side-panel.tsx
@@ -0,0 +1,142 @@
+"use client";
+
+import {
+ type ComponentProps,
+ type KeyboardEvent,
+ type PointerEvent,
+} from "react";
+
+import { cn } from "@/lib/utils";
+
+// Base right-hand side panel primitive: a fixed shell that slides in from the
+// right without a backdrop (non-modal). Presentation only — open state, tabs
+// and content wiring live in the caller (see components/side-panel/).
+
+interface SidePanelProps extends ComponentProps<"aside"> {
+ open: boolean;
+}
+
+export function SidePanel({
+ open,
+ className,
+ children,
+ ...props
+}: SidePanelProps) {
+ return (
+ <aside
+ role="complementary"
+ inert={!open}
+ className={cn(
+ "border-border-neutral-secondary bg-bg-neutral-secondary fixed inset-y-0 right-0 z-40 flex flex-col border-l shadow-xl transition-[transform,width] duration-200",
+ open ? "translate-x-0" : "translate-x-full",
+ className,
+ )}
+ {...props}
+ >
+ {children}
+ </aside>
+ );
+}
+
+export function SidePanelHeader({
+ className,
+ ...props
+}: ComponentProps<"div">) {
+ return (
+ <div
+ className={cn(
+ "border-border-neutral-secondary flex items-center gap-1 border-b px-3 py-2",
+ className,
+ )}
+ {...props}
+ />
+ );
+}
+
+export function SidePanelBody({ className, ...props }: ComponentProps<"div">) {
+ return (
+ <div
+ // @container: content hosted in the panel (detail tables, the chat)
+ // resolves its breakpoints against the panel's width, not the viewport.
+ data-responsive-container
+ className={cn("@container relative min-h-0 flex-1", className)}
+ {...props}
+ />
+ );
+}
+
+// Width added/removed per arrow-key press when resizing via keyboard.
+const KEYBOARD_RESIZE_STEP = 24;
+
+interface SidePanelResizeHandleProps {
+ // Receives the pointer's clientX on every drag move; the caller derives the
+ // new width from it (for a right-anchored panel: viewport width - clientX)
+ // and clamps it.
+ onResize: (clientX: number) => void;
+ onResizeStart?: () => void;
+ onResizeEnd?: () => void;
+ // Current width and bounds for the ARIA window-splitter contract and to
+ // derive keyboard steps.
+ value: number;
+ min: number;
+ max: number;
+}
+
+export function SidePanelResizeHandle({
+ onResize,
+ onResizeStart,
+ onResizeEnd,
+ value,
+ min,
+ max,
+}: SidePanelResizeHandleProps) {
+ const handlePointerDown = (event: PointerEvent<HTMLDivElement>) => {
+ event.preventDefault();
+ event.currentTarget.setPointerCapture(event.pointerId);
+ onResizeStart?.();
+ };
+
+ const handlePointerMove = (event: PointerEvent<HTMLDivElement>) => {
+ if (!event.currentTarget.hasPointerCapture(event.pointerId)) return;
+ onResize(event.clientX);
+ };
+
+ // Idempotent: also reached via onLostPointerCapture (capture already gone),
+ // e.g. when Escape closes the panel mid-drag and pointerup never arrives.
+ const endResize = (event: PointerEvent<HTMLDivElement>) => {
+ if (event.currentTarget.hasPointerCapture(event.pointerId)) {
+ event.currentTarget.releasePointerCapture(event.pointerId);
+ }
+ onResizeEnd?.();
+ };
+
+ // WAI-ARIA window splitter: arrows move the handle as a drag would, so on
+ // this right-docked panel ArrowLeft widens and ArrowRight narrows.
+ const handleKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+ if (event.key !== "ArrowLeft" && event.key !== "ArrowRight") return;
+ event.preventDefault();
+ const step =
+ event.key === "ArrowLeft" ? KEYBOARD_RESIZE_STEP : -KEYBOARD_RESIZE_STEP;
+ // Same contract as a drag: report the clientX the handle would land on.
+ onResize(window.innerWidth - (value + step));
+ };
+
+ return (
+ <div
+ role="separator"
+ tabIndex={0}
+ aria-orientation="vertical"
+ aria-label="Resize panel"
+ aria-valuemin={min}
+ aria-valuemax={max}
+ aria-valuenow={Math.round(value)}
+ className="hover:bg-border-neutral-secondary active:bg-border-neutral-secondary focus-visible:ring-button-primary/50 absolute inset-y-0 left-0 z-10 w-1.5 cursor-col-resize touch-none transition-colors outline-none focus-visible:ring-2"
+ onPointerDown={handlePointerDown}
+ onPointerMove={handlePointerMove}
+ onPointerUp={endResize}
+ onPointerCancel={endResize}
+ onLostPointerCapture={endResize}
+ onKeyDown={handleKeyDown}
+ />
+ );
+}
diff --git a/ui/components/shadcn/switch/switch.tsx b/ui/components/shadcn/switch/switch.tsx
new file mode 100644
index 0000000000..6659651011
--- /dev/null
+++ b/ui/components/shadcn/switch/switch.tsx
@@ -0,0 +1,41 @@
+"use client";
+
+import * as SwitchPrimitive from "@radix-ui/react-switch";
+import { ComponentProps } from "react";
+
+import { cn } from "@/lib/utils";
+
+function Switch({
+ className,
+ ...props
+}: ComponentProps<typeof SwitchPrimitive.Root>) {
+ return (
+ <SwitchPrimitive.Root
+ data-slot="switch"
+ className={cn(
+ // Base styles
+ "peer inline-flex h-6 w-11 shrink-0 cursor-pointer items-center rounded-full border transition-all outline-none",
+ // Default state
+ "bg-bg-input-primary border-border-input-primary shadow-[0_1px_2px_0_rgba(0,0,0,0.1)]",
+ // Checked state
+ "data-[state=checked]:bg-button-primary data-[state=checked]:border-button-primary",
+ // Focus state
+ "focus-visible:border-border-input-primary-press focus-visible:ring-border-input-primary-press/50 focus-visible:ring-2",
+ // Disabled state
+ "disabled:cursor-not-allowed disabled:opacity-40 disabled:shadow-none",
+ className,
+ )}
+ {...props}
+ >
+ <SwitchPrimitive.Thumb
+ data-slot="switch-thumb"
+ className={cn(
+ "bg-border-input-primary-fill pointer-events-none block size-5 rounded-full shadow-[0_1px_2px_0_rgba(0,0,0,0.2)] transition-transform",
+ "data-[state=checked]:translate-x-[21px] data-[state=checked]:bg-white data-[state=unchecked]:translate-x-px",
+ )}
+ />
+ </SwitchPrimitive.Root>
+ );
+}
+
+export { Switch };
diff --git a/ui/components/ui/table/data-table-animated-row.tsx b/ui/components/shadcn/table/data-table-animated-row.tsx
similarity index 100%
rename from ui/components/ui/table/data-table-animated-row.tsx
rename to ui/components/shadcn/table/data-table-animated-row.tsx
diff --git a/ui/components/ui/table/data-table-column-header.tsx b/ui/components/shadcn/table/data-table-column-header.tsx
similarity index 100%
rename from ui/components/ui/table/data-table-column-header.tsx
rename to ui/components/shadcn/table/data-table-column-header.tsx
diff --git a/ui/components/ui/table/data-table-expand-all-toggle.tsx b/ui/components/shadcn/table/data-table-expand-all-toggle.tsx
similarity index 98%
rename from ui/components/ui/table/data-table-expand-all-toggle.tsx
rename to ui/components/shadcn/table/data-table-expand-all-toggle.tsx
index 69a93aad2e..60b19bb74e 100644
--- a/ui/components/ui/table/data-table-expand-all-toggle.tsx
+++ b/ui/components/shadcn/table/data-table-expand-all-toggle.tsx
@@ -53,7 +53,7 @@ export function DataTableExpandAllToggle<TData>({
onClick={() => table.toggleAllRowsExpanded(!isAllExpanded)}
className={cn(
"rounded transition-colors",
- "hover:bg-prowler-white/10",
+ "hover:bg-white/10",
"focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
)}
aria-label={isAllExpanded ? "Collapse all rows" : "Expand all rows"}
diff --git a/ui/components/ui/table/data-table-expand-toggle.tsx b/ui/components/shadcn/table/data-table-expand-toggle.tsx
similarity index 98%
rename from ui/components/ui/table/data-table-expand-toggle.tsx
rename to ui/components/shadcn/table/data-table-expand-toggle.tsx
index 7e18b4e510..20c320ed6e 100644
--- a/ui/components/ui/table/data-table-expand-toggle.tsx
+++ b/ui/components/shadcn/table/data-table-expand-toggle.tsx
@@ -52,7 +52,7 @@ export function DataTableExpandToggle<TData>({
onClick={row.getToggleExpandedHandler()}
className={cn(
"shrink-0 rounded transition-colors",
- "hover:bg-prowler-white/10",
+ "hover:bg-white/10",
"focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
)}
aria-label={isExpanded ? "Collapse row" : "Expand row"}
diff --git a/ui/components/ui/table/data-table-expandable-cell.tsx b/ui/components/shadcn/table/data-table-expandable-cell.tsx
similarity index 100%
rename from ui/components/ui/table/data-table-expandable-cell.tsx
rename to ui/components/shadcn/table/data-table-expandable-cell.tsx
diff --git a/ui/components/ui/table/data-table-filter-custom-batch.test.tsx b/ui/components/shadcn/table/data-table-filter-custom-batch.test.tsx
similarity index 99%
rename from ui/components/ui/table/data-table-filter-custom-batch.test.tsx
rename to ui/components/shadcn/table/data-table-filter-custom-batch.test.tsx
index 34f47ab455..7180f18a27 100644
--- a/ui/components/ui/table/data-table-filter-custom-batch.test.tsx
+++ b/ui/components/shadcn/table/data-table-filter-custom-batch.test.tsx
@@ -106,7 +106,7 @@ vi.mock(
ComplianceScanInfo: () => null,
}),
);
-vi.mock("@/components/ui/entities/entity-info", () => ({
+vi.mock("@/components/shadcn/entities/entity-info", () => ({
EntityInfo: () => null,
}));
vi.mock("@/lib/helper-filters", () => ({
diff --git a/ui/components/ui/table/data-table-filter-custom.tsx b/ui/components/shadcn/table/data-table-filter-custom.tsx
similarity index 99%
rename from ui/components/ui/table/data-table-filter-custom.tsx
rename to ui/components/shadcn/table/data-table-filter-custom.tsx
index 6e5c612e44..c5e02f1c5e 100644
--- a/ui/components/ui/table/data-table-filter-custom.tsx
+++ b/ui/components/shadcn/table/data-table-filter-custom.tsx
@@ -5,6 +5,7 @@ import { useState } from "react";
import { ComplianceScanInfo } from "@/components/compliance/compliance-header/compliance-scan-info";
import { ClearFiltersButton } from "@/components/filters/clear-filters-button";
+import { EntityInfo } from "@/components/shadcn/entities/entity-info";
import {
MultiSelect,
MultiSelectContent,
@@ -14,7 +15,6 @@ import {
MultiSelectTrigger,
MultiSelectValue,
} from "@/components/shadcn/select/multiselect";
-import { EntityInfo } from "@/components/ui/entities/entity-info";
import { useUrlFilters } from "@/hooks/use-url-filters";
import {
getScanEntityLabel,
diff --git a/ui/components/ui/table/data-table-pagination.test.tsx b/ui/components/shadcn/table/data-table-pagination.test.tsx
similarity index 65%
rename from ui/components/ui/table/data-table-pagination.test.tsx
rename to ui/components/shadcn/table/data-table-pagination.test.tsx
index ae8fa43bf4..33140f0712 100644
--- a/ui/components/ui/table/data-table-pagination.test.tsx
+++ b/ui/components/shadcn/table/data-table-pagination.test.tsx
@@ -10,11 +10,11 @@ vi.mock("next/navigation", () => ({
}));
vi.mock("@/lib", () => ({
- getPaginationInfo: () => ({
- currentPage: 2,
- totalPages: 4,
- totalEntries: 40,
- itemsPerPageOptions: [10, 20, 50],
+ getPaginationInfo: (metadata: MetaDataProps) => ({
+ currentPage: metadata.pagination.page,
+ totalPages: metadata.pagination.pages,
+ totalEntries: metadata.pagination.count,
+ itemsPerPageOptions: metadata.pagination.itemsPerPage ?? [10, 20, 50],
}),
}));
@@ -64,4 +64,25 @@ describe("DataTablePagination", () => {
"hover:text-text-neutral-primary",
);
});
+
+ it("does not render an empty pagination container when there is only one page", () => {
+ // Given - Metadata for a table that does not need pagination
+ const singlePageMetadata: MetaDataProps = {
+ pagination: {
+ page: 1,
+ pages: 1,
+ count: 1,
+ itemsPerPage: [10, 20, 50],
+ },
+ version: "latest",
+ };
+
+ // When - Rendering pagination
+ const { container } = render(
+ <DataTablePagination metadata={singlePageMetadata} />,
+ );
+
+ // Then - No wrapper remains to add extra DataTable gap
+ expect(container).toBeEmptyDOMElement();
+ });
});
diff --git a/ui/components/ui/table/data-table-pagination.tsx b/ui/components/shadcn/table/data-table-pagination.tsx
similarity index 99%
rename from ui/components/ui/table/data-table-pagination.tsx
rename to ui/components/shadcn/table/data-table-pagination.tsx
index 019d98c31d..be0b1e2676 100644
--- a/ui/components/ui/table/data-table-pagination.tsx
+++ b/ui/components/shadcn/table/data-table-pagination.tsx
@@ -80,6 +80,8 @@ export function DataTablePagination({
itemsPerPageOptions,
} = getPaginationInfo(metadata);
+ if (totalPages <= 1) return null;
+
// For controlled mode, use controlled values; for prefixed, read from URL; otherwise use metadata
const currentPage = isControlled
? controlledPage
diff --git a/ui/components/ui/table/data-table-search.tsx b/ui/components/shadcn/table/data-table-search.tsx
similarity index 99%
rename from ui/components/ui/table/data-table-search.tsx
rename to ui/components/shadcn/table/data-table-search.tsx
index fa85bdb2e1..9b30937986 100644
--- a/ui/components/ui/table/data-table-search.tsx
+++ b/ui/components/shadcn/table/data-table-search.tsx
@@ -44,7 +44,7 @@ export const DataTableSearch = ({
controlledValue,
onSearchChange,
onSearchCommit,
- placeholder = "Search...",
+ placeholder = "Search... (press Enter)",
badge,
}: DataTableSearchProps) => {
const searchParams = useSearchParams();
diff --git a/ui/components/ui/table/data-table.test.tsx b/ui/components/shadcn/table/data-table.test.tsx
similarity index 94%
rename from ui/components/ui/table/data-table.test.tsx
rename to ui/components/shadcn/table/data-table.test.tsx
index b63a5a9bfb..3332e4aa91 100644
--- a/ui/components/ui/table/data-table.test.tsx
+++ b/ui/components/shadcn/table/data-table.test.tsx
@@ -89,7 +89,7 @@ describe("DataTable", () => {
);
});
- it("should stack the right content below search on narrow screens", () => {
+ it("should stack the right content below search when the container is narrow", () => {
// Given
render(
<DataTable
@@ -105,11 +105,13 @@ describe("DataTable", () => {
const toolbar = screen.getByTestId("data-table-toolbar");
const rightContent = screen.getByTestId("data-table-toolbar-right");
- // Then
+ // Then: md is a container query app-wide, so this also reacts when the
+ // side panel shrinks the page; the right group stays on one row.
expect(toolbar).toHaveClass("flex-col");
expect(toolbar).toHaveClass("md:flex-row");
expect(rightContent).toHaveClass("w-full");
expect(rightContent).toHaveClass("md:w-auto");
+ expect(rightContent).toHaveClass("flex-wrap", "items-center");
});
});
diff --git a/ui/components/ui/table/data-table.tsx b/ui/components/shadcn/table/data-table.tsx
similarity index 95%
rename from ui/components/ui/table/data-table.tsx
rename to ui/components/shadcn/table/data-table.tsx
index adb79f3b5f..26bc6bd2aa 100644
--- a/ui/components/ui/table/data-table.tsx
+++ b/ui/components/shadcn/table/data-table.tsx
@@ -26,12 +26,12 @@ import {
TableHead,
TableHeader,
TableRow,
-} from "@/components/ui/table";
-import { DataTableAnimatedRow } from "@/components/ui/table/data-table-animated-row";
-import { DataTablePagination } from "@/components/ui/table/data-table-pagination";
-import { DataTableSearch } from "@/components/ui/table/data-table-search";
+} from "@/components/shadcn/table";
+import { DataTableAnimatedRow } from "@/components/shadcn/table/data-table-animated-row";
+import { DataTablePagination } from "@/components/shadcn/table/data-table-pagination";
+import { DataTableSearch } from "@/components/shadcn/table/data-table-search";
import { useFilterTransitionOptional } from "@/contexts";
-import { cn } from "@/lib";
+import { cn } from "@/lib/utils";
import { FilterOption, MetaDataProps } from "@/types";
type DataTableRowAttributes = {
@@ -260,7 +260,7 @@ export function DataTable<TData, TValue>({
return (
<div
className={cn(
- "minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col justify-between gap-4 overflow-auto border p-4 transition-opacity duration-200",
+ "minimal-scrollbar border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col justify-between gap-4 overflow-auto rounded-[14px] border p-4 shadow-sm transition-opacity duration-200",
isPending && "pointer-events-none opacity-60",
)}
>
@@ -285,7 +285,7 @@ export function DataTable<TData, TValue>({
</div>
<div
data-testid="data-table-toolbar-right"
- className="flex w-full flex-col items-start gap-2 md:ml-auto md:w-auto md:flex-row md:items-center md:gap-4"
+ className="flex w-full flex-wrap items-center gap-x-4 gap-y-2 md:ml-auto md:w-auto"
>
{toolbarRightContent}
{metadata && (
diff --git a/ui/components/shadcn/table/index.ts b/ui/components/shadcn/table/index.ts
new file mode 100644
index 0000000000..908c1bb9d3
--- /dev/null
+++ b/ui/components/shadcn/table/index.ts
@@ -0,0 +1,9 @@
+export * from "./data-table";
+export * from "./data-table-column-header";
+export * from "./data-table-filter-custom";
+export * from "./data-table-pagination";
+export * from "./data-table-search";
+export * from "./severity-badge";
+export * from "./status-badge";
+export * from "./status-finding-badge";
+export * from "./table";
diff --git a/ui/components/ui/table/severity-badge.tsx b/ui/components/shadcn/table/severity-badge.tsx
similarity index 100%
rename from ui/components/ui/table/severity-badge.tsx
rename to ui/components/shadcn/table/severity-badge.tsx
diff --git a/ui/components/ui/table/status-badge.test.tsx b/ui/components/shadcn/table/status-badge.test.tsx
similarity index 100%
rename from ui/components/ui/table/status-badge.test.tsx
rename to ui/components/shadcn/table/status-badge.test.tsx
diff --git a/ui/components/ui/table/status-badge.tsx b/ui/components/shadcn/table/status-badge.tsx
similarity index 96%
rename from ui/components/ui/table/status-badge.tsx
rename to ui/components/shadcn/table/status-badge.tsx
index dbde046f21..209f252ee6 100644
--- a/ui/components/ui/table/status-badge.tsx
+++ b/ui/components/shadcn/table/status-badge.tsx
@@ -1,5 +1,5 @@
import { SpinnerIcon } from "@/components/icons";
-import { Badge } from "@/components/shadcn";
+import { Badge } from "@/components/shadcn/badge/badge";
import { cn } from "@/lib/utils";
export type Status =
diff --git a/ui/components/shadcn/table/status-finding-badge.tsx b/ui/components/shadcn/table/status-finding-badge.tsx
new file mode 100644
index 0000000000..f77f038b74
--- /dev/null
+++ b/ui/components/shadcn/table/status-finding-badge.tsx
@@ -0,0 +1,57 @@
+import { Badge } from "@/components/shadcn/badge/badge";
+import { cn } from "@/lib/utils";
+
+export const FindingStatusValues = {
+ FAIL: "FAIL",
+ PASS: "PASS",
+ MANUAL: "MANUAL",
+ MUTED: "MUTED",
+} as const;
+
+export type FindingStatus =
+ (typeof FindingStatusValues)[keyof typeof FindingStatusValues];
+
+type FindingStatusVariant = "error" | "success" | "warning" | "tag";
+
+const STATUS_VARIANT: Record<FindingStatus, FindingStatusVariant> = {
+ FAIL: "error",
+ PASS: "success",
+ MANUAL: "warning",
+ MUTED: "tag",
+} as const;
+
+type StatusFindingBadgeSize = "sm" | "md" | "lg";
+
+const SIZE_CLASS: Record<StatusFindingBadgeSize, string> = {
+ sm: "",
+ md: "px-2.5 py-1",
+ lg: "px-3 py-1.5 text-sm",
+} as const;
+
+interface StatusFindingBadgeProps {
+ status: FindingStatus;
+ size?: StatusFindingBadgeSize;
+ value?: string | number;
+ className?: string;
+}
+
+export const StatusFindingBadge = ({
+ status,
+ size = "sm",
+ value,
+ className,
+}: StatusFindingBadgeProps) => {
+ const variant = STATUS_VARIANT[status] ?? "tag";
+ const displayText =
+ status.charAt(0).toUpperCase() + status.slice(1).toLowerCase();
+
+ return (
+ <Badge
+ variant={variant}
+ className={cn("font-bold", SIZE_CLASS[size], className)}
+ >
+ {displayText}
+ {value !== undefined && `: ${value}`}
+ </Badge>
+ );
+};
diff --git a/ui/components/ui/table/table.tsx b/ui/components/shadcn/table/table.tsx
similarity index 94%
rename from ui/components/ui/table/table.tsx
rename to ui/components/shadcn/table/table.tsx
index 99e7f37588..266ec155d3 100644
--- a/ui/components/ui/table/table.tsx
+++ b/ui/components/shadcn/table/table.tsx
@@ -91,8 +91,6 @@ const TableHead = forwardRef<
"h-11 px-1.5 text-left align-middle text-xs font-medium whitespace-nowrap outline-none",
"first:rounded-l-full first:border-l first:pl-3",
"last:rounded-r-full last:border-r last:pr-3",
- "data-[hover=true]:text-foreground-400 data-[focus-visible=true]:outline-focus",
- "data-[focus-visible=true]:z-10 data-[focus-visible=true]:outline-2 data-[focus-visible=true]:outline-offset-2",
"rtl:text-right rtl:first:rounded-l-[unset] rtl:first:rounded-r-full rtl:last:rounded-l-full rtl:last:rounded-r-[unset]",
"[&:has([role=checkbox])]:pr-0",
className,
diff --git a/ui/components/shadcn/tabs/tabs.tsx b/ui/components/shadcn/tabs/tabs.tsx
index d66d4bfa2c..5dbb0ed0e8 100644
--- a/ui/components/shadcn/tabs/tabs.tsx
+++ b/ui/components/shadcn/tabs/tabs.tsx
@@ -11,7 +11,7 @@ import {
import { cn } from "@/lib/utils";
const TRIGGER_STYLES = {
- base: "relative inline-flex min-w-0 items-center justify-center gap-2 py-3 text-sm font-medium transition-colors disabled:pointer-events-none disabled:opacity-50 [&:not(:first-child)]:pl-4 [&:not(:last-child)]:pr-4",
+ base: "relative inline-flex min-w-0 items-center justify-center gap-2 py-3 text-sm font-medium transition-colors disabled:pointer-events-none [&:not(:first-child)]:pl-4 [&:not(:last-child)]:pr-4",
border: "border-r border-[#E9E9F0] last:border-r-0 dark:border-[#171D30]",
text: "text-slate-600 hover:text-slate-900 dark:text-slate-400 dark:hover:text-white",
active:
@@ -73,22 +73,30 @@ interface TabsTriggerProps
extends ComponentProps<typeof TabsPrimitive.Trigger> {
/** Tooltip shown below the trigger — useful when the label is truncated. */
tooltip?: ReactNode;
+ /** Content displayed next to the label without inheriting disabled opacity. */
+ adornment?: ReactNode;
}
function TabsTrigger({
className,
tooltip,
+ adornment,
children,
+ disabled,
...props
}: TabsTriggerProps) {
const trigger = (
<TabsPrimitive.Trigger
data-slot="tabs-trigger"
className={cn(buildTriggerClassName(), className)}
+ disabled={disabled}
{...props}
>
{/* block + min-w-0 needed for truncate to render ellipsis */}
- <span className="block min-w-0 truncate">{children}</span>
+ <span className={cn("block min-w-0 truncate", disabled && "opacity-50")}>
+ {children}
+ </span>
+ {adornment}
</TabsPrimitive.Trigger>
);
if (!tooltip) return trigger;
diff --git a/ui/components/shadcn/textarea/textarea.test.ts b/ui/components/shadcn/textarea/textarea.test.ts
new file mode 100644
index 0000000000..66b3b53b3b
--- /dev/null
+++ b/ui/components/shadcn/textarea/textarea.test.ts
@@ -0,0 +1,17 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+describe("Textarea", () => {
+ it("does not import Next font loaders from the shared primitive", () => {
+ // Given
+ const currentDir = path.dirname(fileURLToPath(import.meta.url));
+ const source = readFileSync(path.join(currentDir, "textarea.tsx"), "utf8");
+
+ // Then
+ expect(source).not.toContain("@/config/fonts");
+ expect(source).not.toContain("next/font");
+ });
+});
diff --git a/ui/components/shadcn/textarea/textarea.tsx b/ui/components/shadcn/textarea/textarea.tsx
index 32dba86796..60bd1dd52a 100644
--- a/ui/components/shadcn/textarea/textarea.tsx
+++ b/ui/components/shadcn/textarea/textarea.tsx
@@ -1,7 +1,7 @@
"use client";
import { cva, type VariantProps } from "class-variance-authority";
-import { ComponentProps, forwardRef } from "react";
+import type { ComponentProps, Ref } from "react";
import { cn } from "@/lib/utils";
@@ -14,37 +14,53 @@ const textareaVariants = cva(
"border-border-input-primary bg-bg-input-primary dark:bg-input/30 hover:bg-bg-neutral-tertiary dark:hover:bg-input/50 focus:border-border-input-primary-press focus:ring-1 focus:ring-inset focus:ring-border-input-primary-press placeholder:text-text-neutral-tertiary",
ghost:
"border-transparent bg-transparent hover:bg-bg-neutral-tertiary focus:bg-bg-neutral-tertiary placeholder:text-text-neutral-tertiary",
+ soft: "border-transparent bg-bg-neutral-tertiary placeholder:text-text-neutral-tertiary",
},
textareaSize: {
default: "min-h-16 px-4 py-3",
sm: "min-h-12 px-3 py-2 text-xs",
lg: "min-h-24 px-5 py-4",
},
+ font: {
+ sans: "",
+ mono: "font-mono",
+ },
},
defaultVariants: {
variant: "default",
textareaSize: "default",
+ font: "sans",
},
},
);
export interface TextareaProps
extends Omit<ComponentProps<"textarea">, "size">,
- VariantProps<typeof textareaVariants> {}
+ VariantProps<typeof textareaVariants> {
+ ref?: Ref<HTMLTextAreaElement>;
+}
-const Textarea = forwardRef<HTMLTextAreaElement, TextareaProps>(
- ({ className, variant, textareaSize, ...props }, ref) => {
- return (
- <textarea
- ref={ref}
- data-slot="textarea"
- className={cn(textareaVariants({ variant, textareaSize, className }))}
- {...props}
- />
- );
- },
-);
+export const Textarea = ({
+ className,
+ variant,
+ textareaSize,
+ font,
+ ref,
+ ...props
+}: TextareaProps) => {
+ return (
+ <textarea
+ ref={ref}
+ data-slot="textarea"
+ className={cn(
+ textareaVariants({ variant, textareaSize, font }),
+ className,
+ )}
+ {...props}
+ />
+ );
+};
Textarea.displayName = "Textarea";
-export { Textarea, textareaVariants };
+export { textareaVariants };
diff --git a/ui/components/ui/toast/Toast.tsx b/ui/components/shadcn/toast/Toast.tsx
similarity index 65%
rename from ui/components/ui/toast/Toast.tsx
rename to ui/components/shadcn/toast/Toast.tsx
index 4cc6cb2efd..c1a6a642d4 100644
--- a/ui/components/ui/toast/Toast.tsx
+++ b/ui/components/shadcn/toast/Toast.tsx
@@ -25,7 +25,7 @@ const ToastViewport = React.forwardRef<
ToastViewport.displayName = ToastPrimitives.Viewport.displayName;
const toastVariants = cva(
- "group pointer-events-auto relative flex w-full items-center justify-between gap-2 overflow-hidden rounded-md border border-slate-200 p-4 pr-6 shadow-lg transition-all data-[swipe=cancel]:translate-x-0 data-[swipe=end]:translate-x-(--radix-toast-swipe-end-x) data-[swipe=move]:translate-x-(--radix-toast-swipe-move-x) data-[swipe=move]:transition-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[swipe=end]:animate-out data-[state=closed]:fade-out-80 data-[state=closed]:slide-out-to-right-full data-[state=open]:slide-in-from-top-full data-[state=open]:sm:slide-in-from-bottom-full dark:border-slate-800",
+ "group pointer-events-auto relative flex w-full items-center justify-between gap-2 overflow-hidden rounded-md border p-4 pr-6 shadow-lg transition-all data-[swipe=cancel]:translate-x-0 data-[swipe=end]:translate-x-(--radix-toast-swipe-end-x) data-[swipe=move]:translate-x-(--radix-toast-swipe-move-x) data-[swipe=move]:transition-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[swipe=end]:animate-out data-[state=closed]:fade-out-80 data-[state=closed]:slide-out-to-right-full data-[state=open]:slide-in-from-top-full data-[state=open]:sm:slide-in-from-bottom-full",
{
variants: {
variant: {
@@ -63,7 +63,7 @@ const ToastAction = React.forwardRef<
<ToastPrimitives.Action
ref={ref}
className={cn(
- "inline-flex h-8 shrink-0 items-center justify-center self-end rounded-md border border-slate-200 bg-transparent px-3 text-sm font-medium transition-colors group-[.destructive]:border-slate-100/40 hover:bg-slate-100 group-[.destructive]:hover:border-red-500/30 group-[.destructive]:hover:bg-red-500 group-[.destructive]:hover:text-slate-50 focus:ring-1 focus:ring-slate-950 focus:outline-none group-[.destructive]:focus:ring-red-500 disabled:pointer-events-none disabled:opacity-50 dark:border-slate-800 dark:group-[.destructive]:border-slate-800/40 dark:hover:bg-slate-800 dark:group-[.destructive]:hover:border-red-900/30 dark:group-[.destructive]:hover:bg-red-900 dark:group-[.destructive]:hover:text-slate-50 dark:focus:ring-slate-300 dark:group-[.destructive]:focus:ring-red-900",
+ "border-border-neutral-secondary hover:bg-bg-neutral-tertiary focus:ring-border-input-primary-press/50 inline-flex h-8 shrink-0 items-center justify-center self-end rounded-md border bg-transparent px-3 text-sm font-medium transition-colors group-[.destructive]:border-slate-100/40 group-[.destructive]:hover:border-red-500/30 group-[.destructive]:hover:bg-red-500 group-[.destructive]:hover:text-slate-50 focus:ring-1 focus:outline-none group-[.destructive]:focus:ring-red-500 disabled:pointer-events-none disabled:opacity-50 dark:group-[.destructive]:border-slate-800/40 dark:group-[.destructive]:hover:border-red-900/30 dark:group-[.destructive]:hover:bg-red-900 dark:group-[.destructive]:hover:text-slate-50 dark:group-[.destructive]:focus:ring-red-900",
className,
)}
{...props}
@@ -78,7 +78,7 @@ const ToastClose = React.forwardRef<
<ToastPrimitives.Close
ref={ref}
className={cn(
- "absolute top-1 right-1 rounded-md p-1 text-slate-950/50 opacity-0 transition-opacity group-hover:opacity-100 group-[.destructive]:text-red-300 hover:text-slate-950 group-[.destructive]:hover:text-red-50 focus:opacity-100 focus:ring-1 focus:outline-none group-[.destructive]:focus:ring-red-400 group-[.destructive]:focus:ring-offset-red-600 dark:text-slate-50/50 dark:hover:text-slate-50",
+ "text-text-neutral-primary/50 hover:text-text-neutral-primary absolute top-1 right-1 rounded-md p-1 opacity-0 transition-opacity group-hover:opacity-100 group-[.destructive]:text-red-300 group-[.destructive]:hover:text-red-50 focus:opacity-100 focus:ring-1 focus:outline-none group-[.destructive]:focus:ring-red-400 group-[.destructive]:focus:ring-offset-red-600",
className,
)}
toast-close=""
@@ -107,7 +107,7 @@ const ToastDescription = React.forwardRef<
>(({ className, ...props }, ref) => (
<ToastPrimitives.Description
ref={ref}
- className={cn("text-small opacity-90", className)}
+ className={cn("text-sm opacity-90", className)}
{...props}
/>
));
diff --git a/ui/components/ui/toast/Toaster.tsx b/ui/components/shadcn/toast/Toaster.tsx
similarity index 94%
rename from ui/components/ui/toast/Toaster.tsx
rename to ui/components/shadcn/toast/Toaster.tsx
index 4287ed5c8b..16f63f6298 100644
--- a/ui/components/ui/toast/Toaster.tsx
+++ b/ui/components/shadcn/toast/Toaster.tsx
@@ -7,7 +7,7 @@ import {
ToastProvider,
ToastTitle,
ToastViewport,
-} from "@/components/ui";
+} from "@/components/shadcn/toast/Toast";
import { useToast } from "./use-toast";
diff --git a/ui/components/shadcn/toast/index.ts b/ui/components/shadcn/toast/index.ts
new file mode 100644
index 0000000000..d21acc2dc6
--- /dev/null
+++ b/ui/components/shadcn/toast/index.ts
@@ -0,0 +1,3 @@
+export * from "./Toast";
+export * from "./Toaster";
+export * from "./use-toast";
diff --git a/ui/components/ui/toast/use-toast.ts b/ui/components/shadcn/toast/use-toast.ts
similarity index 97%
rename from ui/components/ui/toast/use-toast.ts
rename to ui/components/shadcn/toast/use-toast.ts
index b7263fcaf6..c95bd3bfe8 100644
--- a/ui/components/ui/toast/use-toast.ts
+++ b/ui/components/shadcn/toast/use-toast.ts
@@ -3,7 +3,10 @@
// Inspired by react-hot-toast library
import * as React from "react";
-import type { ToastActionElement, ToastProps } from "@/components/ui";
+import type {
+ ToastActionElement,
+ ToastProps,
+} from "@/components/shadcn/toast/Toast";
const TOAST_LIMIT = 6;
const TOAST_REMOVE_DELAY = 1000000;
diff --git a/ui/components/shadcn/tooltip.test.tsx b/ui/components/shadcn/tooltip.test.tsx
new file mode 100644
index 0000000000..c543a41362
--- /dev/null
+++ b/ui/components/shadcn/tooltip.test.tsx
@@ -0,0 +1,22 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { Tooltip, TooltipContent, TooltipTrigger } from "./tooltip";
+
+describe("TooltipContent", () => {
+ it("uses a constrained content width through its semantic API", async () => {
+ // Given / When
+ render(
+ <Tooltip defaultOpen>
+ <TooltipTrigger>Finding</TooltipTrigger>
+ <TooltipContent maxWidth="md">Long finding description</TooltipContent>
+ </Tooltip>,
+ );
+
+ // Then
+ const content = (
+ await screen.findAllByText("Long finding description")
+ ).find((element) => element.dataset.slot === "tooltip-content");
+ expect(content).toHaveClass("max-w-96");
+ });
+});
diff --git a/ui/components/shadcn/tooltip.tsx b/ui/components/shadcn/tooltip.tsx
index c024b79c88..698880391c 100644
--- a/ui/components/shadcn/tooltip.tsx
+++ b/ui/components/shadcn/tooltip.tsx
@@ -1,13 +1,30 @@
"use client";
import * as TooltipPrimitive from "@radix-ui/react-tooltip";
+import { cva, type VariantProps } from "class-variance-authority";
+import type { ComponentProps } from "react";
import { cn } from "@/lib/utils";
+const tooltipContentVariants = cva(
+ "border-border-neutral-tertiary bg-bg-neutral-tertiary text-text-neutral-primary animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-lg border px-2 py-1.5 text-left text-xs break-all whitespace-normal shadow-lg",
+ {
+ variants: {
+ maxWidth: {
+ default: "max-w-[min(700px,calc(100vw-2rem))]",
+ md: "max-w-96",
+ },
+ },
+ defaultVariants: {
+ maxWidth: "default",
+ },
+ },
+);
+
function TooltipProvider({
delayDuration = 0,
...props
-}: React.ComponentProps<typeof TooltipPrimitive.Provider>) {
+}: ComponentProps<typeof TooltipPrimitive.Provider>) {
return (
<TooltipPrimitive.Provider
data-slot="tooltip-provider"
@@ -17,9 +34,7 @@ function TooltipProvider({
);
}
-function Tooltip({
- ...props
-}: React.ComponentProps<typeof TooltipPrimitive.Root>) {
+function Tooltip({ ...props }: ComponentProps<typeof TooltipPrimitive.Root>) {
return (
<TooltipProvider>
<TooltipPrimitive.Root data-slot="tooltip" {...props} />
@@ -29,25 +44,27 @@ function Tooltip({
function TooltipTrigger({
...props
-}: React.ComponentProps<typeof TooltipPrimitive.Trigger>) {
+}: ComponentProps<typeof TooltipPrimitive.Trigger>) {
return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />;
}
+interface TooltipContentProps
+ extends ComponentProps<typeof TooltipPrimitive.Content>,
+ VariantProps<typeof tooltipContentVariants> {}
+
function TooltipContent({
className,
+ maxWidth,
sideOffset = 4,
children,
...props
-}: React.ComponentProps<typeof TooltipPrimitive.Content>) {
+}: TooltipContentProps) {
return (
<TooltipPrimitive.Portal>
<TooltipPrimitive.Content
data-slot="tooltip-content"
sideOffset={sideOffset}
- className={cn(
- "border-border-neutral-tertiary bg-bg-neutral-tertiary text-text-neutral-primary animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit max-w-[min(700px,calc(100vw-2rem))] origin-(--radix-tooltip-content-transform-origin) rounded-lg border px-2 py-1.5 text-left text-xs break-all whitespace-normal shadow-lg",
- className,
- )}
+ className={cn(tooltipContentVariants({ maxWidth }), className)}
{...props}
>
{children}
diff --git a/ui/components/shadcn/tree-view/tree-leaf.tsx b/ui/components/shadcn/tree-view/tree-leaf.tsx
index 1348bd9324..b603815980 100644
--- a/ui/components/shadcn/tree-view/tree-leaf.tsx
+++ b/ui/components/shadcn/tree-view/tree-leaf.tsx
@@ -57,7 +57,7 @@ export function TreeLeaf({
<div
className={cn(
"flex items-center gap-2 rounded-md px-2 py-1.5",
- "hover:bg-prowler-white/5 cursor-pointer",
+ "cursor-pointer hover:bg-white/5",
"focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
item.disabled && "cursor-not-allowed opacity-50",
item.className,
diff --git a/ui/components/shadcn/tree-view/tree-node.tsx b/ui/components/shadcn/tree-view/tree-node.tsx
index fbd0703df8..eab8860399 100644
--- a/ui/components/shadcn/tree-view/tree-node.tsx
+++ b/ui/components/shadcn/tree-view/tree-node.tsx
@@ -95,7 +95,7 @@ export function TreeNode({
<div
className={cn(
"flex items-center gap-2 rounded-md px-2 py-1.5",
- "hover:bg-prowler-white/5 cursor-pointer",
+ "cursor-pointer hover:bg-white/5",
"focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
item.disabled && "cursor-not-allowed opacity-50",
item.className,
@@ -110,7 +110,7 @@ export function TreeNode({
onKeyDown={handleKeyDown}
>
<button
- className="hover:bg-prowler-white/10 shrink-0 rounded p-0.5"
+ className="shrink-0 rounded p-0.5 hover:bg-white/10"
aria-label={isExpanded ? "Collapse" : "Expand"}
onClick={(e) => {
e.stopPropagation();
diff --git a/ui/components/shared/cloud-feature-badge.tsx b/ui/components/shared/cloud-feature-badge.tsx
deleted file mode 100644
index 9dc69ec22b..0000000000
--- a/ui/components/shared/cloud-feature-badge.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import type { CSSProperties } from "react";
-
-import { cn } from "@/lib/utils";
-
-interface MenuFeatureBadgeProps {
- label?: string;
- variant?: "cloud" | "new";
- size?: "default" | "sm";
- className?: string;
-}
-
-const FEATURE_BADGE_STYLE: Record<
- NonNullable<MenuFeatureBadgeProps["variant"]>,
- CSSProperties | undefined
-> = {
- cloud: {
- backgroundImage:
- "linear-gradient(112deg, rgb(46, 229, 155) 3.5%, rgb(98, 223, 240) 98.8%)",
- },
- new: undefined,
-};
-
-const FEATURE_BADGE_VARIANT_CLASS: Record<
- NonNullable<MenuFeatureBadgeProps["variant"]>,
- string
-> = {
- cloud: "text-primary-foreground",
- new: "bg-emerald-500 text-white",
-};
-
-const FEATURE_BADGE_SIZE_CLASS: Record<
- NonNullable<MenuFeatureBadgeProps["size"]>,
- string
-> = {
- default: "h-6 rounded-lg px-2 text-xs leading-5",
- sm: "h-5 rounded-md px-1.5 text-[10px] leading-4",
-};
-
-export const MenuFeatureBadge = ({
- label,
- variant = "cloud",
- size = "default",
- className,
-}: MenuFeatureBadgeProps) => (
- <span
- className={cn(
- "inline-flex shrink-0 items-center justify-center font-bold whitespace-nowrap",
- FEATURE_BADGE_VARIANT_CLASS[variant],
- FEATURE_BADGE_SIZE_CLASS[size],
- className,
- )}
- style={FEATURE_BADGE_STYLE[variant]}
- >
- {label}
- </span>
-);
-
-export const CloudFeatureBadge = ({
- label = "Available in Prowler Cloud",
- size,
- className,
-}: Omit<MenuFeatureBadgeProps, "variant">) => (
- <MenuFeatureBadge
- label={label}
- variant="cloud"
- size={size}
- className={className}
- />
-);
-
-interface CloudFeatureBadgeLinkProps
- extends Omit<MenuFeatureBadgeProps, "variant"> {
- href?: string;
-}
-
-export const CloudFeatureBadgeLink = ({
- href = "https://prowler.com/pricing",
- label,
- size,
- className,
-}: CloudFeatureBadgeLinkProps) => (
- <a
- href={href}
- target="_blank"
- rel="noopener noreferrer"
- className="shrink-0 whitespace-nowrap transition-opacity hover:opacity-90"
- >
- <CloudFeatureBadge label={label} size={size} className={className} />
- </a>
-);
diff --git a/ui/components/shared/cloud-upgrade-modal.test.tsx b/ui/components/shared/cloud-upgrade-modal.test.tsx
new file mode 100644
index 0000000000..318c03740c
--- /dev/null
+++ b/ui/components/shared/cloud-upgrade-modal.test.tsx
@@ -0,0 +1,136 @@
+import { cleanup, render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { useCloudUpgradeStore } from "@/store/cloud-upgrade/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import { CloudUpgradeModal } from "./cloud-upgrade-modal";
+
+describe("CloudUpgradeModal", () => {
+ afterEach(() => {
+ cleanup();
+ vi.unstubAllEnvs();
+ useCloudUpgradeStore.getState().closeCloudUpgrade();
+ });
+
+ it("renders the active contextual upgrade in Local Server", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ useCloudUpgradeStore
+ .getState()
+ .openCloudUpgrade(CLOUD_UPGRADE_FEATURE.ALERTS);
+
+ // When
+ render(<CloudUpgradeModal />);
+
+ // Then
+ expect(
+ await screen.findByRole("dialog", { name: "Turn Findings into Alerts" }),
+ ).toBeVisible();
+ expect(screen.getByText("Available in Prowler Cloud")).toBeVisible();
+ expect(
+ screen.getByRole("link", { name: "Create Alerts in Prowler Cloud" }),
+ ).toHaveAttribute(
+ "href",
+ "https://cloud.prowler.com/sign-up?utm_source=prowler-local-server&utm_content=alerts",
+ );
+ expect(
+ screen.getByRole("link", { name: "View Plans & Pricing" }),
+ ).toHaveAttribute(
+ "href",
+ "https://prowler.com/pricing?utm_source=prowler-local-server&utm_content=alerts",
+ );
+ });
+
+ it("uses the standard equal-width CTA layout", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ useCloudUpgradeStore
+ .getState()
+ .openCloudUpgrade(CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS);
+
+ // When
+ render(<CloudUpgradeModal />);
+
+ // Then
+ const dialog = await screen.findByRole("dialog", {
+ name: "Add Your Entire AWS Organization",
+ });
+ const primaryCta = screen.getByRole("link", {
+ name: "Set Up AWS Organizations in Prowler Cloud",
+ });
+ const secondaryCta = screen.getByRole("link", {
+ name: "View Plans & Pricing",
+ });
+
+ expect(dialog).toHaveClass("sm:max-w-2xl");
+ expect(primaryCta.parentElement).toHaveClass("gap-3", "md:flex-row");
+ expect(primaryCta).toHaveClass(
+ "h-auto",
+ "min-h-9",
+ "whitespace-normal",
+ "md:flex-1",
+ );
+ expect(secondaryCta).toHaveClass(
+ "h-auto",
+ "min-h-9",
+ "whitespace-normal",
+ "md:flex-1",
+ );
+ expect(primaryCta.querySelector(".truncate")).not.toBeInTheDocument();
+ expect(primaryCta).toHaveAttribute(
+ "href",
+ "https://cloud.prowler.com/sign-up?utm_source=prowler-local-server&utm_content=organization",
+ );
+ });
+
+ it("closes the active upgrade and returns focus to its trigger", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ const user = userEvent.setup();
+
+ render(
+ <>
+ <button
+ type="button"
+ onClick={() =>
+ useCloudUpgradeStore
+ .getState()
+ .openCloudUpgrade(CLOUD_UPGRADE_FEATURE.GENERAL)
+ }
+ >
+ Explore Prowler Cloud
+ </button>
+ <CloudUpgradeModal />
+ </>,
+ );
+
+ const trigger = screen.getByRole("button", {
+ name: "Explore Prowler Cloud",
+ });
+ await user.click(trigger);
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Close" }));
+
+ // Then
+ expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+ expect(trigger).toHaveFocus();
+ expect(useCloudUpgradeStore.getState().activeFeature).toBeNull();
+ });
+
+ it("does not render upgrade UI in Prowler Cloud", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ useCloudUpgradeStore
+ .getState()
+ .openCloudUpgrade(CLOUD_UPGRADE_FEATURE.ALERTS);
+
+ // When
+ render(<CloudUpgradeModal />);
+
+ // Then
+ expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/components/shared/cloud-upgrade-modal.tsx b/ui/components/shared/cloud-upgrade-modal.tsx
new file mode 100644
index 0000000000..9d7617d941
--- /dev/null
+++ b/ui/components/shared/cloud-upgrade-modal.tsx
@@ -0,0 +1,107 @@
+"use client";
+
+import { Check, Cloud } from "lucide-react";
+
+import { Badge } from "@/components/shadcn/badge/badge";
+import { Button } from "@/components/shadcn/button/button";
+import { Modal } from "@/components/shadcn/modal";
+import {
+ CLOUD_UPGRADE_CONTENT,
+ CLOUD_UPGRADE_FOOTER_NOTE,
+ CLOUD_UPGRADE_SECONDARY_CTA,
+ getCloudUpgradeCompareUrl,
+ getCloudUpgradePrimaryUrl,
+} from "@/lib/cloud-upgrade";
+import { isCloud } from "@/lib/shared/env";
+import { useCloudUpgradeStore } from "@/store";
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+const allowInitialAutoFocus = () => {};
+
+export const CloudUpgradeModal = () => {
+ const activeFeature = useCloudUpgradeStore((state) => state.activeFeature);
+ const closeCloudUpgrade = useCloudUpgradeStore(
+ (state) => state.closeCloudUpgrade,
+ );
+ const returnFocusElement = useCloudUpgradeStore(
+ (state) => state.returnFocusElement,
+ );
+
+ if (isCloud()) return null;
+
+ const feature = activeFeature ?? CLOUD_UPGRADE_FEATURE.GENERAL;
+ const content = CLOUD_UPGRADE_CONTENT[feature];
+
+ return (
+ <Modal
+ open={activeFeature !== null}
+ onOpenChange={(open) => !open && closeCloudUpgrade()}
+ onOpenAutoFocus={allowInitialAutoFocus}
+ onCloseAutoFocus={(event) => {
+ event.preventDefault();
+ returnFocusElement?.focus();
+ }}
+ title={content.title}
+ description={content.description}
+ size="2xl"
+ >
+ <div className="min-w-0 space-y-6">
+ <div className="flex items-center gap-3">
+ <div className="bg-bg-neutral-tertiary text-text-neutral-primary flex size-10 items-center justify-center rounded-xl">
+ <Cloud aria-hidden="true" className="size-5" />
+ </div>
+ <Badge variant="cloud">Available in Prowler Cloud</Badge>
+ </div>
+
+ <ul className="space-y-3">
+ {content.benefits.map((benefit) => (
+ <li
+ key={benefit}
+ className="text-text-neutral-secondary flex items-start gap-3 text-sm"
+ >
+ <Check
+ aria-hidden="true"
+ className="text-text-success mt-0.5 size-4"
+ />
+ <span>{benefit}</span>
+ </li>
+ ))}
+ </ul>
+
+ <div className="flex flex-col gap-3 md:flex-row">
+ <Button
+ asChild
+ className="h-auto min-h-9 w-full min-w-0 shrink whitespace-normal md:flex-1"
+ >
+ <a
+ href={getCloudUpgradePrimaryUrl(feature)}
+ target="_blank"
+ rel="noopener noreferrer"
+ title={content.primaryCta}
+ >
+ {content.primaryCta}
+ </a>
+ </Button>
+ <Button
+ asChild
+ variant="outline"
+ className="h-auto min-h-9 w-full min-w-0 shrink whitespace-normal md:flex-1"
+ >
+ <a
+ href={getCloudUpgradeCompareUrl(feature)}
+ target="_blank"
+ rel="noopener noreferrer"
+ title={CLOUD_UPGRADE_SECONDARY_CTA}
+ >
+ {CLOUD_UPGRADE_SECONDARY_CTA}
+ </a>
+ </Button>
+ </div>
+
+ <p className="text-text-neutral-tertiary text-center text-xs">
+ {CLOUD_UPGRADE_FOOTER_NOTE}
+ </p>
+ </div>
+ </Modal>
+ );
+};
diff --git a/ui/components/shared/events-timeline/events-timeline.tsx b/ui/components/shared/events-timeline/events-timeline.tsx
index e386e5528d..03673e8088 100644
--- a/ui/components/shared/events-timeline/events-timeline.tsx
+++ b/ui/components/shared/events-timeline/events-timeline.tsx
@@ -19,8 +19,8 @@ import {
Checkbox,
InfoField,
} from "@/components/shadcn";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
import { Spinner } from "@/components/shadcn/spinner/spinner";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
import { cn } from "@/lib/utils";
import { ResourceEventProps } from "@/types";
diff --git a/ui/components/shared/task-polling-watcher.tsx b/ui/components/shared/task-polling-watcher.tsx
new file mode 100644
index 0000000000..18f9749854
--- /dev/null
+++ b/ui/components/shared/task-polling-watcher.tsx
@@ -0,0 +1,31 @@
+"use client";
+
+import {
+ CROSS_PROVIDER_PDF_TASK_KIND,
+ crossProviderPdfHandler,
+} from "@/app/(prowler)/compliance/_lib/cross-provider-pdf";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import {
+ registerTaskKindHandler,
+ resumePendingTasks,
+} from "@/store/task-watcher/store";
+
+// Kind registrations happen at module scope, before any task can settle in
+// this tab. Adding a new watched task kind (integration tests, scan exports,
+// …) is one line here plus a handler next to the feature that owns it.
+registerTaskKindHandler(CROSS_PROVIDER_PDF_TASK_KIND, crossProviderPdfHandler);
+
+/**
+ * Mounted once in the app layout (next to `Toaster`): resumes polling any
+ * backend task persisted as pending by `@/store/task-watcher`, so completion
+ * toasts survive a hard reload. In-session tracking needs no component at
+ * all — `trackAndPollTask` runs its loop at module scope from the
+ * dispatching click handler.
+ */
+export const TaskPollingWatcher = () => {
+ useMountEffect(() => {
+ resumePendingTasks();
+ });
+
+ return null;
+};
diff --git a/ui/components/shared/usage-limit-message.test.tsx b/ui/components/shared/usage-limit-message.test.tsx
new file mode 100644
index 0000000000..b7fdf04954
--- /dev/null
+++ b/ui/components/shared/usage-limit-message.test.tsx
@@ -0,0 +1,37 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { USAGE_LIMIT_MESSAGE } from "@/lib/action-errors";
+import { BILLING_URL } from "@/lib/external-urls";
+
+import { UsageLimitMessage } from "./usage-limit-message";
+
+describe("UsageLimitMessage", () => {
+ it("renders the shared usage-limit copy", () => {
+ render(<UsageLimitMessage />);
+
+ expect(screen.getByText(/exceeded the usage limit/i)).toBeInTheDocument();
+ });
+
+ it("links to Prowler Cloud billing", () => {
+ render(<UsageLimitMessage />);
+
+ const link = screen.getByRole("link", { name: /manage billing/i });
+ expect(link).toHaveAttribute("href", BILLING_URL);
+ expect(link).toHaveAttribute("target", "_blank");
+ expect(link).toHaveAttribute("rel", "noopener noreferrer");
+ });
+
+ it("keeps the copy in sync with the 402 action-error message", () => {
+ render(<UsageLimitMessage />);
+
+ expect(screen.getByText(USAGE_LIMIT_MESSAGE)).toBeInTheDocument();
+ });
+
+ it("merges a custom className with the base styles", () => {
+ const { container } = render(<UsageLimitMessage className="mt-4" />);
+
+ expect(container.firstChild).toHaveClass("mt-4");
+ expect(container.firstChild).toHaveClass("text-text-error-primary");
+ });
+});
diff --git a/ui/components/shared/usage-limit-message.tsx b/ui/components/shared/usage-limit-message.tsx
new file mode 100644
index 0000000000..8a413e4f61
--- /dev/null
+++ b/ui/components/shared/usage-limit-message.tsx
@@ -0,0 +1,25 @@
+import Link from "next/link";
+
+import { USAGE_LIMIT_MESSAGE } from "@/lib/action-errors";
+import { BILLING_URL } from "@/lib/external-urls";
+import { cn } from "@/lib/utils";
+
+interface UsageLimitMessageProps {
+ className?: string;
+}
+
+// Over-limit (trial-expired) notice shown in scan launch flows. Pairs the shared
+// usage-limit copy with a link to Prowler Cloud billing.
+export const UsageLimitMessage = ({ className }: UsageLimitMessageProps) => (
+ <p className={cn("text-text-error-primary text-sm", className)}>
+ {USAGE_LIMIT_MESSAGE}{" "}
+ <Link
+ href={BILLING_URL}
+ target="_blank"
+ rel="noopener noreferrer"
+ className="underline"
+ >
+ Manage Billing
+ </Link>
+ </p>
+);
diff --git a/ui/components/side-panel/detail-side-panel.test.tsx b/ui/components/side-panel/detail-side-panel.test.tsx
new file mode 100644
index 0000000000..482e5bb738
--- /dev/null
+++ b/ui/components/side-panel/detail-side-panel.test.tsx
@@ -0,0 +1,177 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useState } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+import { DetailSidePanel } from "./detail-side-panel";
+import { GlobalSidePanel } from "./global-side-panel";
+
+const { isCloudMock } = vi.hoisted(() => ({ isCloudMock: vi.fn(() => true) }));
+
+vi.mock("@/lib/shared/env", () => ({ isCloud: isCloudMock }));
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => "/findings",
+}));
+
+vi.mock(
+ "@/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat",
+ () => ({
+ LighthousePanelChat: () => (
+ <div data-testid="panel-chat-content">chat content</div>
+ ),
+ }),
+);
+
+// Mimics a table host: local open state, detail content as children.
+function Host({ initialOpen = true }: { initialOpen?: boolean }) {
+ const [open, setOpen] = useState(initialOpen);
+ return (
+ <>
+ <button type="button" onClick={() => setOpen(true)}>
+ Open detail
+ </button>
+ <GlobalSidePanel />
+ <DetailSidePanel
+ open={open}
+ onOpenChange={setOpen}
+ title="Resource Details"
+ description="View the resource details"
+ >
+ <div data-testid="detail-content">detail body</div>
+ </DetailSidePanel>
+ <output data-testid="host-open-state">{String(open)}</output>
+ </>
+ );
+}
+
+// Mimics two findings-table rows, each mounting its own DetailSidePanel with
+// per-row open state — the real layout on the findings page.
+function DualHost() {
+ const [openA, setOpenA] = useState(false);
+ const [openB, setOpenB] = useState(false);
+ return (
+ <>
+ <button type="button" onClick={() => setOpenA(true)}>
+ Open A
+ </button>
+ <button type="button" onClick={() => setOpenB(true)}>
+ Open B
+ </button>
+ <GlobalSidePanel />
+ <DetailSidePanel open={openA} onOpenChange={setOpenA} title="Finding A">
+ <div data-testid="detail-a">A body</div>
+ </DetailSidePanel>
+ <DetailSidePanel open={openB} onOpenChange={setOpenB} title="Finding B">
+ <div data-testid="detail-b">B body</div>
+ </DetailSidePanel>
+ <output data-testid="open-a">{String(openA)}</output>
+ <output data-testid="open-b">{String(openB)}</output>
+ </>
+ );
+}
+
+describe("DetailSidePanel", () => {
+ beforeEach(() => {
+ isCloudMock.mockReturnValue(true);
+ localStorage.clear();
+ useSidePanelStore.setState({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ hasBeenOpened: false,
+ contextTab: null,
+ contextOwnerToken: 0,
+ contextOutlet: null,
+ });
+ });
+
+ it("portals the detail content into the global panel when open", async () => {
+ // Given / When
+ render(<Host />);
+
+ // Then: the content renders inside the panel's context outlet
+ const detail = await screen.findByTestId("detail-content");
+ expect(
+ screen.getByTestId("side-panel-context-outlet").contains(detail),
+ ).toBe(true);
+ expect(screen.getByRole("tab", { name: "Details" })).toHaveAttribute(
+ "aria-selected",
+ "true",
+ );
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+ });
+
+ it("clears the host selection when the panel is dismissed", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<Host />);
+ await screen.findByTestId("detail-content");
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Close side panel" }));
+
+ // Then: the host's open state flips, the content unmounts, the tab is gone
+ expect(screen.getByTestId("host-open-state")).toHaveTextContent("false");
+ expect(screen.queryByTestId("detail-content")).not.toBeInTheDocument();
+ expect(useSidePanelStore.getState().contextTab).toBeNull();
+ });
+
+ it("keeps the detail mounted while chatting on the AI tab", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<Host />);
+ await screen.findByTestId("detail-content");
+
+ // When
+ await user.click(screen.getByRole("tab", { name: "Lighthouse AI" }));
+
+ // Then: chat is up, detail DOM survives hidden (carousel/scroll intact)
+ expect(await screen.findByTestId("panel-chat-content")).toBeInTheDocument();
+ expect(screen.getByTestId("detail-content")).toBeInTheDocument();
+ expect(screen.getByTestId("detail-content")).not.toBeVisible();
+ });
+
+ it("hands the panel to the newest detail view and closes the previous one", async () => {
+ // Given: finding A's detail view owns the panel
+ const user = userEvent.setup();
+ render(<DualHost />);
+ await user.click(screen.getByRole("button", { name: "Open A" }));
+ await screen.findByTestId("detail-a");
+
+ // When: the user opens finding B while A is still mounted
+ await user.click(screen.getByRole("button", { name: "Open B" }));
+
+ // Then: only B portals into the outlet; A closed itself
+ const detailB = await screen.findByTestId("detail-b");
+ expect(
+ screen.getByTestId("side-panel-context-outlet").contains(detailB),
+ ).toBe(true);
+ expect(screen.queryByTestId("detail-a")).not.toBeInTheDocument();
+ expect(screen.getByTestId("open-a")).toHaveTextContent("false");
+ expect(screen.getByTestId("open-b")).toHaveTextContent("true");
+
+ // When: the panel is dismissed
+ await user.click(screen.getByRole("button", { name: "Close side panel" }));
+
+ // Then: B (the current owner) is the one that clears its selection
+ expect(screen.getByTestId("open-b")).toHaveTextContent("false");
+ expect(screen.queryByTestId("detail-b")).not.toBeInTheDocument();
+ expect(useSidePanelStore.getState().contextTab).toBeNull();
+ });
+
+ it("registers nothing while closed and registers on open", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<Host initialOpen={false} />);
+ expect(useSidePanelStore.getState().contextTab).toBeNull();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Open detail" }));
+
+ // Then
+ expect(await screen.findByTestId("detail-content")).toBeInTheDocument();
+ expect(useSidePanelStore.getState().contextTab?.label).toBe("Details");
+ });
+});
diff --git a/ui/components/side-panel/detail-side-panel.tsx b/ui/components/side-panel/detail-side-panel.tsx
new file mode 100644
index 0000000000..c7d30aaa4c
--- /dev/null
+++ b/ui/components/side-panel/detail-side-panel.tsx
@@ -0,0 +1,66 @@
+"use client";
+
+import { type ReactNode, useState } from "react";
+import { createPortal } from "react-dom";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { useSidePanelStore } from "@/store/side-panel";
+
+interface DetailSidePanelProps {
+ open: boolean;
+ onOpenChange: (open: boolean) => void;
+ // Screen-reader heading; the visible tab label is always "Details".
+ title: string;
+ description?: string;
+ children: ReactNode;
+}
+
+// Hosts a detail view (finding/resource) inside the global side panel as its
+// "Details" context tab. The owning table keeps ALL detail state (selection,
+// carousel, fetch caches) — only the rendered output moves into the panel via
+// a portal, so the AI tab and the detail view share one panel, PostHog-style.
+// Drop-in replacement for the old vaul detail drawers: same open/onOpenChange
+// contract, no modal overlay.
+export function DetailSidePanel({
+ open,
+ ...activeProps
+}: DetailSidePanelProps) {
+ // Mount/unmount IS the registration lifecycle: no dependency effects needed.
+ if (!open) return null;
+ return <DetailSidePanelActive {...activeProps} />;
+}
+
+function DetailSidePanelActive({
+ onOpenChange,
+ title,
+ description,
+ children,
+}: Omit<DetailSidePanelProps, "open">) {
+ // Owner token from registration: several detail views can be mounted at
+ // once (one per table row); only the current owner may portal or unregister.
+ const [token, setToken] = useState<number | null>(null);
+
+ useMountEffect(() => {
+ const registered = useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ // Mount-scoped capture is safe: the component remounts per open cycle
+ // and every consumer's close path ends in stable setters.
+ onRequestClose: () => onOpenChange(false),
+ });
+ setToken(registered);
+ return () => useSidePanelStore.getState().unregisterContextTab(registered);
+ });
+
+ const ownerToken = useSidePanelStore((state) => state.contextOwnerToken);
+ const outlet = useSidePanelStore((state) => state.contextOutlet);
+ if (!outlet || token === null || token !== ownerToken) return null;
+
+ return createPortal(
+ <div className="flex h-full min-h-0 flex-col">
+ <h2 className="sr-only">{title}</h2>
+ {description ? <p className="sr-only">{description}</p> : null}
+ {children}
+ </div>,
+ outlet,
+ );
+}
diff --git a/ui/components/side-panel/global-side-panel.test.tsx b/ui/components/side-panel/global-side-panel.test.tsx
new file mode 100644
index 0000000000..0626997e0a
--- /dev/null
+++ b/ui/components/side-panel/global-side-panel.test.tsx
@@ -0,0 +1,427 @@
+import { act, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SIDE_PANEL_DEFAULT_WIDTH } from "@/lib/ui-layout";
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+import { GlobalSidePanel } from "./global-side-panel";
+
+const { isCloudMock } = vi.hoisted(() => ({ isCloudMock: vi.fn(() => true) }));
+
+const navigationMocks = vi.hoisted(() => ({ pathname: "/findings" }));
+
+// jsdom has no matchMedia: emulate the push (>= sm) viewport per test.
+const mediaMocks = vi.hoisted(() => ({ isPushViewport: false }));
+
+// Toggles a render failure to exercise the panel's local error boundary.
+const chatMocks = vi.hoisted(() => ({ shouldThrow: false }));
+
+// Adds a second registry tab on demand: the real registry only holds one
+// today, but tab-switch isolation must already hold for when cloud adds more.
+const registryMocks = vi.hoisted(() => ({ extraTab: false }));
+
+vi.mock("@/lib/shared/env", () => ({ isCloud: isCloudMock }));
+
+vi.mock("./side-panel-tabs", async (importOriginal) => {
+ const original = await importOriginal<typeof import("./side-panel-tabs")>();
+ return {
+ ...original,
+ getVisibleSidePanelTabs: () => {
+ const tabs = original.getVisibleSidePanelTabs();
+ if (!registryMocks.extraTab) return tabs;
+ return [
+ ...tabs,
+ {
+ id: "second-tab",
+ label: "Second tab",
+ Icon: () => null,
+ loadContent: () =>
+ Promise.resolve({
+ default: () => (
+ <div data-testid="second-tab-content">second content</div>
+ ),
+ }),
+ Fallback: () => null,
+ isAvailable: () => true,
+ },
+ ];
+ },
+ };
+});
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => navigationMocks.pathname,
+}));
+
+vi.mock("@/hooks/use-media-query", () => ({
+ useMediaQuery: () => mediaMocks.isPushViewport,
+}));
+
+// The AI tab's real content pulls in the whole chat (server actions,
+// streamdown); the shell test only cares that the registry's content mounts.
+vi.mock(
+ "@/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat",
+ () => ({
+ LighthousePanelChat: () => {
+ if (chatMocks.shouldThrow) throw new Error("chunk load failed");
+ return <div data-testid="panel-chat-content">chat content</div>;
+ },
+ }),
+);
+
+describe("GlobalSidePanel", () => {
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ beforeEach(() => {
+ isCloudMock.mockReturnValue(true);
+ navigationMocks.pathname = "/findings";
+ mediaMocks.isPushViewport = false;
+ chatMocks.shouldThrow = false;
+ registryMocks.extraTab = false;
+ localStorage.clear();
+ useSidePanelStore.setState({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ hasBeenOpened: false,
+ width: SIDE_PANEL_DEFAULT_WIDTH,
+ isResizing: false,
+ contextTab: null,
+ contextOwnerToken: 0,
+ contextOutlet: null,
+ });
+ });
+
+ it("renders closed and empty by default (lazy-mount)", () => {
+ // Given / When
+ render(<GlobalSidePanel />);
+
+ // Then: panel exists but is off-screen, inert, and mounts no content
+ const panel = screen.getByTestId("global-side-panel");
+ expect(panel).toHaveClass("translate-x-full");
+ expect(screen.queryByTestId("panel-chat-content")).not.toBeInTheDocument();
+ });
+
+ it("slides in and mounts the AI tab content when opened via the store", async () => {
+ // Given
+ render(<GlobalSidePanel />);
+
+ // When
+ act(() => useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT));
+
+ // Then
+ expect(screen.getByTestId("global-side-panel")).toHaveClass(
+ "translate-x-0",
+ );
+ expect(await screen.findByTestId("panel-chat-content")).toBeInTheDocument();
+ });
+
+ it("keeps the content mounted (hidden) after closing", async () => {
+ // Given
+ render(<GlobalSidePanel />);
+ act(() => useSidePanelStore.getState().openPanel());
+ await screen.findByTestId("panel-chat-content");
+
+ // When
+ act(() => useSidePanelStore.getState().closePanel());
+
+ // Then: off-screen but the chat DOM survives (scroll/draft preservation)
+ expect(screen.getByTestId("global-side-panel")).toHaveClass(
+ "translate-x-full",
+ );
+ expect(screen.getByTestId("panel-chat-content")).toBeInTheDocument();
+ });
+
+ it("closes on Escape", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<GlobalSidePanel />);
+ act(() => useSidePanelStore.getState().openPanel());
+
+ // When
+ await user.keyboard("{Escape}");
+
+ // Then
+ await waitFor(() =>
+ expect(useSidePanelStore.getState().isOpen).toBe(false),
+ );
+ });
+
+ it("toggles with Cmd/Ctrl+.", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<GlobalSidePanel />);
+
+ // When / Then
+ await user.keyboard("{Meta>}.{/Meta}");
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+
+ await user.keyboard("{Meta>}.{/Meta}");
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("closes via the close button", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<GlobalSidePanel />);
+ act(() => useSidePanelStore.getState().openPanel());
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Close side panel" }));
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("groups the chat actions beside close in the existing header", async () => {
+ // Given
+ render(<GlobalSidePanel />);
+
+ // When
+ act(() => useSidePanelStore.getState().openPanel());
+
+ // Then: no extra toolbar; both actions are adjacent in the panel header
+ const newChat = await screen.findByRole("button", { name: "New chat" });
+ const fullPage = screen.getByRole("link", {
+ name: "Open Lighthouse AI full page",
+ });
+ const close = screen.getByRole("button", { name: "Close side panel" });
+ const actionGroup = close.parentElement;
+ expect(actionGroup).toContainElement(newChat);
+ expect(actionGroup).toContainElement(fullPage);
+ expect(actionGroup).toHaveClass("ml-auto");
+ expect(newChat).not.toHaveClass("ml-auto");
+ expect(close).not.toHaveClass("ml-auto");
+ });
+
+ it("renders nothing in OSS while no detail view is registered", () => {
+ // Given
+ isCloudMock.mockReturnValue(false);
+
+ // When
+ const { container } = render(<GlobalSidePanel />);
+
+ // Then
+ expect(container).toBeEmptyDOMElement();
+ });
+
+ it("hosts a registered detail view in OSS, without the AI tab", () => {
+ // Given
+ isCloudMock.mockReturnValue(false);
+ render(<GlobalSidePanel />);
+
+ // When: a detail view registers its context tab
+ act(() =>
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ }),
+ );
+
+ // Then: the panel appears with only the Details surface (no tab strip)
+ expect(screen.getByTestId("global-side-panel")).toHaveClass(
+ "translate-x-0",
+ );
+ expect(screen.getByText("Details")).toBeInTheDocument();
+ expect(screen.queryByRole("tablist")).not.toBeInTheDocument();
+ expect(screen.getByTestId("side-panel-context-outlet")).toBeInTheDocument();
+ });
+
+ it("shows Details and Lighthouse AI as switchable tabs in cloud", async () => {
+ // Given
+ const user = userEvent.setup();
+ render(<GlobalSidePanel />);
+ act(() =>
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ }),
+ );
+
+ // Then: the context tab opens selected, beside the AI tab
+ const detailsTab = screen.getByRole("tab", { name: "Details" });
+ expect(detailsTab).toHaveAttribute("aria-selected", "true");
+ expect(detailsTab).toHaveClass("aria-selected:after:scale-x-100");
+ expect(detailsTab).not.toHaveClass("rounded-[8px]");
+ expect(screen.getByTestId("side-panel-context-outlet")).toBeVisible();
+
+ const lighthouseTab = screen.getByRole("tab", { name: "Lighthouse AI" });
+ expect(lighthouseTab.querySelector("svg")?.parentElement).toHaveClass(
+ "flex",
+ );
+
+ // When: switching to the AI tab
+ await user.click(lighthouseTab);
+
+ // Then: the chat mounts and the detail outlet stays mounted, hidden
+ expect(await screen.findByTestId("panel-chat-content")).toBeInTheDocument();
+ expect(screen.getByTestId("side-panel-context-outlet")).not.toBeVisible();
+
+ // When: switching back
+ await user.click(screen.getByRole("tab", { name: "Details" }));
+
+ // Then
+ expect(screen.getByTestId("side-panel-context-outlet")).toBeVisible();
+ });
+
+ it("contains a lazy tab failure inside the panel and recovers via Retry", async () => {
+ // Given: the AI tab's content throws on render (e.g. chunk-load failure)
+ const user = userEvent.setup();
+ const consoleError = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ chatMocks.shouldThrow = true;
+ render(<GlobalSidePanel />);
+
+ // When
+ act(() => useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT));
+
+ // Then: the failure stays inside the panel body; the shell survives
+ expect(
+ await screen.findByText("This panel failed to load."),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("button", { name: "Close side panel" }),
+ ).toBeInTheDocument();
+
+ // When: the failure clears and the user retries
+ chatMocks.shouldThrow = false;
+ await user.click(screen.getByRole("button", { name: "Retry" }));
+
+ // Then: the content mounts normally
+ expect(await screen.findByTestId("panel-chat-content")).toBeInTheDocument();
+ consoleError.mockRestore();
+ });
+
+ it("renders the next tab fresh after another tab failed", async () => {
+ // Given: two registry tabs, with the first one failing to render
+ registryMocks.extraTab = true;
+ chatMocks.shouldThrow = true;
+ const user = userEvent.setup();
+ const consoleError = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ render(<GlobalSidePanel />);
+ act(() => useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT));
+ await screen.findByText("This panel failed to load.");
+
+ // When: the user switches to the healthy second tab
+ await user.click(screen.getByRole("tab", { name: "Second tab" }));
+
+ // Then: its content mounts instead of the previous tab's error state
+ expect(await screen.findByTestId("second-tab-content")).toBeInTheDocument();
+ expect(
+ screen.queryByText("This panel failed to load."),
+ ).not.toBeInTheDocument();
+ consoleError.mockRestore();
+ });
+
+ it("keeps the context outlet attached across store-driven re-renders", () => {
+ // Given: a registered detail view with its portal outlet attached
+ render(<GlobalSidePanel />);
+ act(() =>
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ }),
+ );
+ const outlet = useSidePanelStore.getState().contextOutlet;
+ expect(outlet).not.toBeNull();
+
+ // When: an unrelated update re-renders the panel (a resize tick)
+ const seen: (HTMLElement | null)[] = [];
+ const unsubscribe = useSidePanelStore.subscribe((state) =>
+ seen.push(state.contextOutlet),
+ );
+ act(() => useSidePanelStore.getState().setWidth(500));
+ unsubscribe();
+
+ // Then: the outlet never detached (a null flicker remounts the portal)
+ expect(seen).not.toContain(null);
+ expect(useSidePanelStore.getState().contextOutlet).toBe(outlet);
+ });
+
+ it("re-clamps a persisted oversized width to the current viewport", () => {
+ // Given: a huge width rehydrated raw from a larger monitor
+ mediaMocks.isPushViewport = true;
+ useSidePanelStore.setState({ width: 5000 });
+ render(<GlobalSidePanel />);
+
+ // When
+ act(() => useSidePanelStore.getState().openPanel());
+
+ // Then: applied width is capped at 85% of this viewport
+ expect(screen.getByTestId("global-side-panel")).toHaveStyle({
+ width: `${Math.floor(window.innerWidth * 0.85)}px`,
+ });
+ });
+
+ it("resizes with arrow keys on the handle (left widens, right narrows)", async () => {
+ // Given
+ mediaMocks.isPushViewport = true;
+ const user = userEvent.setup();
+ render(<GlobalSidePanel />);
+ act(() => useSidePanelStore.getState().openPanel());
+ const handle = screen.getByRole("separator", { name: "Resize panel" });
+ expect(handle).toHaveAttribute(
+ "aria-valuenow",
+ String(SIDE_PANEL_DEFAULT_WIDTH),
+ );
+
+ // When / Then
+ act(() => handle.focus());
+ await user.keyboard("{ArrowLeft}");
+ expect(useSidePanelStore.getState().width).toBe(
+ SIDE_PANEL_DEFAULT_WIDTH + 24,
+ );
+
+ await user.keyboard("{ArrowRight}");
+ expect(useSidePanelStore.getState().width).toBe(SIDE_PANEL_DEFAULT_WIDTH);
+ });
+
+ it("exposes half the viewport as the resize maximum on ultra-wide screens", () => {
+ // Given
+ vi.stubGlobal("innerWidth", 2560);
+ mediaMocks.isPushViewport = true;
+ useSidePanelStore.setState({ width: 5000 });
+
+ // When
+ render(<GlobalSidePanel />);
+
+ // Then
+ expect(screen.getByTestId("global-side-panel")).toHaveStyle({
+ width: "1280px",
+ });
+ expect(
+ screen.getByRole("separator", { name: "Resize panel" }),
+ ).toHaveAttribute("aria-valuemax", "1280");
+ });
+
+ it("does not exist on the full-page chat route (one place or the other)", () => {
+ // Given: the user is on the agentic chat page with the panel open
+ navigationMocks.pathname = "/lighthouse";
+ useSidePanelStore.setState({ isOpen: true, hasBeenOpened: true });
+
+ // When
+ const { container } = render(<GlobalSidePanel />);
+
+ // Then: no panel DOM at all — the chat lives in the page there
+ expect(container).toBeEmptyDOMElement();
+ });
+
+ it("remains available on Lighthouse settings", () => {
+ // Given: settings must coexist with the panel, unlike the chat page
+ navigationMocks.pathname = "/lighthouse/settings";
+ useSidePanelStore.setState({ isOpen: true, hasBeenOpened: true });
+
+ // When
+ render(<GlobalSidePanel />);
+
+ // Then
+ expect(screen.getByTestId("global-side-panel")).toHaveClass(
+ "translate-x-0",
+ );
+ });
+});
diff --git a/ui/components/side-panel/global-side-panel.tsx b/ui/components/side-panel/global-side-panel.tsx
new file mode 100644
index 0000000000..539cca7880
--- /dev/null
+++ b/ui/components/side-panel/global-side-panel.tsx
@@ -0,0 +1,260 @@
+"use client";
+
+import { X } from "lucide-react";
+import { usePathname } from "next/navigation";
+
+import { Button } from "@/components/shadcn/button/button";
+import {
+ SidePanel,
+ SidePanelBody,
+ SidePanelHeader,
+ SidePanelResizeHandle,
+} from "@/components/shadcn/side-panel/side-panel";
+import {
+ Tabs,
+ TabsContent,
+ TabsList,
+ TabsTrigger,
+} from "@/components/shadcn/tabs/tabs";
+import { useMediaQuery } from "@/hooks/use-media-query";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { isLighthouseChatRoute } from "@/lib/lighthouse-routes";
+import {
+ clampSidePanelWidth,
+ getSidePanelMaxWidth,
+ SIDE_PANEL_MIN_WIDTH,
+ SIDE_PANEL_PUSH_MEDIA_QUERY,
+} from "@/lib/ui-layout";
+import { cn } from "@/lib/utils";
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+import { RetryableLazyContent } from "./retryable-lazy-content";
+import { getVisibleSidePanelTabs } from "./side-panel-tabs";
+
+// Non-modal push panel (PostHog-style): no backdrop, MainLayout shifts the
+// page by the panel width so everything stays reachable. It hosts the fixed
+// registry tabs (Lighthouse AI, cloud-only) plus one dynamic "context" tab
+// that detail views (finding/resource) register and portal their content into
+// — one single panel for every right-hand surface. On the full-page chat
+// route the panel does not exist at all: the chat lives in one place or the
+// other, never both.
+export function GlobalSidePanel() {
+ const pathname = usePathname();
+ const isOpen = useSidePanelStore((state) => state.isOpen);
+ const selectedTab = useSidePanelStore((state) => state.selectedTab);
+ const hasBeenOpened = useSidePanelStore((state) => state.hasBeenOpened);
+ const contextTab = useSidePanelStore((state) => state.contextTab);
+ const width = useSidePanelStore((state) => state.width);
+ const isResizing = useSidePanelStore((state) => state.isResizing);
+ const openPanel = useSidePanelStore((state) => state.openPanel);
+ const closePanel = useSidePanelStore((state) => state.closePanel);
+ // Stable action for the outlet ref: an inline closure would detach/reattach
+ // (null → element) on every render, e.g. on each resize tick.
+ const setContextOutlet = useSidePanelStore((state) => state.setContextOutlet);
+ // Below `sm` the panel overlays full-width; the resizable px width and the
+ // push margin only make sense from `sm` up.
+ const isPushViewport = useMediaQuery(SIDE_PANEL_PUSH_MEDIA_QUERY);
+
+ useMountEffect(() => {
+ const handleKeyDown = (event: KeyboardEvent) => {
+ // Radix overlays (modals, popovers) preventDefault their own Escape.
+ if (event.defaultPrevented) return;
+ // The full-page chat owns its route: no panel there (read the live URL,
+ // the mount closure would keep a stale pathname).
+ if (isLighthouseChatRoute(window.location.pathname)) return;
+ const store = useSidePanelStore.getState();
+ if ((event.metaKey || event.ctrlKey) && event.key === ".") {
+ // Nothing to show in OSS without a detail view registered.
+ if (getVisibleSidePanelTabs().length === 0 && !store.contextTab) {
+ return;
+ }
+ event.preventDefault();
+ store.togglePanel();
+ return;
+ }
+ if (event.key === "Escape" && store.isOpen) {
+ store.closePanel();
+ }
+ };
+
+ window.addEventListener("keydown", handleKeyDown);
+ return () => window.removeEventListener("keydown", handleKeyDown);
+ });
+
+ const registryTabs = getVisibleSidePanelTabs();
+ if (isLighthouseChatRoute(pathname)) return null;
+ if (registryTabs.length === 0 && !contextTab) return null;
+
+ // The persisted tab can point at a tab that is not available here; fall
+ // back to the context tab first (it was registered on purpose), then to the
+ // first registry tab.
+ const activeRegistryTab =
+ registryTabs.find((tab) => tab.id === selectedTab) ?? registryTabs[0];
+ const isContextSelected =
+ Boolean(contextTab) &&
+ (selectedTab === SIDE_PANEL_TAB.CONTEXT || !activeRegistryTab);
+ const tabCount = registryTabs.length + (contextTab ? 1 : 0);
+ const activeTabId = isContextSelected
+ ? SIDE_PANEL_TAB.CONTEXT
+ : activeRegistryTab?.id;
+
+ const handleTabChange = (tabId: string) => {
+ if (tabId === SIDE_PANEL_TAB.CONTEXT) {
+ openPanel(SIDE_PANEL_TAB.CONTEXT);
+ return;
+ }
+ const registryTab = registryTabs.find((tab) => tab.id === tabId);
+ if (registryTab) openPanel(registryTab.id);
+ };
+
+ const handleResize = (clientX: number) => {
+ // Right-anchored panel: dragging the left edge sets width to the distance
+ // between the pointer and the right viewport edge.
+ useSidePanelStore.getState().setWidth(window.innerWidth - clientX);
+ };
+
+ return (
+ <SidePanel
+ open={isOpen}
+ aria-label="Side panel"
+ data-testid="global-side-panel"
+ className={cn("w-full", isResizing && "transition-none")}
+ // Re-clamp at consumption: a persisted width from a larger monitor
+ // rehydrates raw and would otherwise collapse <main> on this viewport.
+ style={{ width: isPushViewport ? clampSidePanelWidth(width) : undefined }}
+ >
+ {isPushViewport ? (
+ <SidePanelResizeHandle
+ value={width}
+ min={SIDE_PANEL_MIN_WIDTH}
+ max={getSidePanelMaxWidth()}
+ onResize={handleResize}
+ onResizeStart={() => useSidePanelStore.getState().setIsResizing(true)}
+ onResizeEnd={() => useSidePanelStore.getState().setIsResizing(false)}
+ />
+ ) : null}
+ <Tabs
+ value={activeTabId}
+ onValueChange={handleTabChange}
+ className="flex min-h-0 flex-1 flex-col"
+ >
+ <SidePanelHeader>
+ {tabCount > 1 ? (
+ <TabsList>
+ {contextTab ? (
+ <TabsTrigger value={SIDE_PANEL_TAB.CONTEXT}>
+ {contextTab.label}
+ </TabsTrigger>
+ ) : null}
+ {registryTabs.map((tab) => {
+ const TabIcon = tab.Icon;
+ return (
+ <TabsTrigger key={tab.id} value={tab.id}>
+ <span className="flex items-center gap-2">
+ <TabIcon />
+ {tab.label}
+ </span>
+ </TabsTrigger>
+ );
+ })}
+ </TabsList>
+ ) : (
+ <SinglePanelLabel
+ contextLabel={contextTab?.label}
+ registryTab={activeRegistryTab}
+ />
+ )}
+ <div className="ml-auto flex items-center gap-1">
+ {!isContextSelected && activeRegistryTab?.HeaderActions ? (
+ <activeRegistryTab.HeaderActions />
+ ) : null}
+ <Button
+ type="button"
+ variant="ghost"
+ size="icon-sm"
+ aria-label="Close side panel"
+ onClick={() => closePanel()}
+ >
+ <X />
+ </Button>
+ </div>
+ </SidePanelHeader>
+ {/* Portal target for the registered detail view. Always rendered while
+ the panel exists so the owner can portal in as soon as it registers;
+ Radix keeps the inactive panel mounted but hidden. */}
+ <TabsContent
+ value={SIDE_PANEL_TAB.CONTEXT}
+ className="relative mt-0 min-h-0 flex-1 data-[state=inactive]:hidden"
+ forceMount
+ asChild
+ >
+ <SidePanelBody
+ hidden={!isContextSelected}
+ className="overflow-hidden p-6 pt-4"
+ >
+ {/* Plain inner node: the outlet ref must not go through Radix's
+ Slot (asChild), whose per-render composeRefs would detach and
+ reattach it — flickering the store outlet — on every render. */}
+ <div
+ ref={setContextOutlet}
+ data-testid="side-panel-context-outlet"
+ className="h-full"
+ />
+ </SidePanelBody>
+ </TabsContent>
+ {/* Registry (AI) content stays mounted after the first open so scroll
+ position and composer drafts survive closes. [contain:layout] traps
+ streamdown's fixed fullscreen overlay inside the panel. */}
+ {activeRegistryTab ? (
+ <TabsContent
+ value={activeRegistryTab.id}
+ className="relative mt-0 min-h-0 flex-1 data-[state=inactive]:hidden"
+ forceMount
+ asChild
+ >
+ <SidePanelBody
+ hidden={isContextSelected}
+ className="[contain:layout]"
+ >
+ {hasBeenOpened ? (
+ // key: a tab switch must reset the lazy instance and any
+ // error-boundary state from the previous tab.
+ <RetryableLazyContent
+ key={activeRegistryTab.id}
+ load={activeRegistryTab.loadContent}
+ fallback={<activeRegistryTab.Fallback />}
+ />
+ ) : null}
+ </SidePanelBody>
+ </TabsContent>
+ ) : null}
+ </Tabs>
+ </SidePanel>
+ );
+}
+
+interface SinglePanelLabelProps {
+ contextLabel?: string;
+ registryTab?: ReturnType<typeof getVisibleSidePanelTabs>[number];
+}
+
+function SinglePanelLabel({
+ contextLabel,
+ registryTab,
+}: SinglePanelLabelProps) {
+ if (contextLabel) {
+ return (
+ <div className="text-text-neutral-primary flex items-center gap-2 text-sm font-medium">
+ {contextLabel}
+ </div>
+ );
+ }
+ if (!registryTab) return null;
+ const Icon = registryTab.Icon;
+ return (
+ <div className="text-text-neutral-primary flex items-center gap-2 text-sm font-medium">
+ <Icon className="size-4" />
+ {registryTab.label}
+ </div>
+ );
+}
diff --git a/ui/components/side-panel/index.ts b/ui/components/side-panel/index.ts
new file mode 100644
index 0000000000..a1a19c0689
--- /dev/null
+++ b/ui/components/side-panel/index.ts
@@ -0,0 +1,4 @@
+export { DetailSidePanel } from "./detail-side-panel";
+export { GlobalSidePanel } from "./global-side-panel";
+export { getVisibleSidePanelTabs, SIDE_PANEL_TABS } from "./side-panel-tabs";
+export { SidePanelTrigger } from "./side-panel-trigger";
diff --git a/ui/components/side-panel/retryable-lazy-content.test.tsx b/ui/components/side-panel/retryable-lazy-content.test.tsx
new file mode 100644
index 0000000000..5b886e4d8c
--- /dev/null
+++ b/ui/components/side-panel/retryable-lazy-content.test.tsx
@@ -0,0 +1,37 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { RetryableLazyContent } from "./retryable-lazy-content";
+
+describe("RetryableLazyContent", () => {
+ it("loads the lazy chunk again after the first import rejects", async () => {
+ // Given
+ const user = userEvent.setup();
+ const consoleError = vi
+ .spyOn(console, "error")
+ .mockImplementation(() => {});
+ const load = vi
+ .fn()
+ .mockRejectedValueOnce(new Error("chunk load failed"))
+ .mockResolvedValueOnce({
+ default: () => <div>Lazy panel loaded</div>,
+ });
+
+ render(
+ <RetryableLazyContent load={load} fallback={<div>Loading panel</div>} />,
+ );
+
+ expect(
+ await screen.findByText("This panel failed to load."),
+ ).toBeInTheDocument();
+
+ // When
+ await user.click(screen.getByRole("button", { name: "Retry" }));
+
+ // Then
+ expect(await screen.findByText("Lazy panel loaded")).toBeInTheDocument();
+ expect(load).toHaveBeenCalledTimes(2);
+ consoleError.mockRestore();
+ });
+});
diff --git a/ui/components/side-panel/retryable-lazy-content.tsx b/ui/components/side-panel/retryable-lazy-content.tsx
new file mode 100644
index 0000000000..9925cf5fff
--- /dev/null
+++ b/ui/components/side-panel/retryable-lazy-content.tsx
@@ -0,0 +1,35 @@
+"use client";
+
+import {
+ type ComponentType,
+ lazy,
+ type ReactNode,
+ Suspense,
+ useState,
+} from "react";
+
+import { SidePanelErrorBoundary } from "./side-panel-error-boundary";
+
+interface RetryableLazyContentProps {
+ load: () => Promise<{ default: ComponentType }>;
+ fallback: ReactNode;
+}
+
+export function RetryableLazyContent({
+ load,
+ fallback,
+}: RetryableLazyContentProps) {
+ const [Content, setContent] = useState(() => lazy(load));
+
+ const handleRetry = () => {
+ setContent(lazy(load));
+ };
+
+ return (
+ <SidePanelErrorBoundary onRetry={handleRetry}>
+ <Suspense fallback={fallback}>
+ <Content />
+ </Suspense>
+ </SidePanelErrorBoundary>
+ );
+}
diff --git a/ui/components/side-panel/side-panel-error-boundary.tsx b/ui/components/side-panel/side-panel-error-boundary.tsx
new file mode 100644
index 0000000000..1e9f5ad554
--- /dev/null
+++ b/ui/components/side-panel/side-panel-error-boundary.tsx
@@ -0,0 +1,55 @@
+"use client";
+
+import { Component, type ReactNode } from "react";
+
+import { Button } from "@/components/shadcn/button/button";
+
+interface SidePanelErrorBoundaryProps {
+ children: ReactNode;
+ onRetry: () => void;
+}
+
+interface SidePanelErrorBoundaryState {
+ hasError: boolean;
+}
+
+// GlobalSidePanel mounts at the app-layout level, above every segment
+// error.tsx, so an uncaught render/chunk-load error in a lazy tab would
+// bubble to global-error and replace the whole app. Class component because
+// React has no hook equivalent for error boundaries.
+export class SidePanelErrorBoundary extends Component<
+ SidePanelErrorBoundaryProps,
+ SidePanelErrorBoundaryState
+> {
+ state: SidePanelErrorBoundaryState = { hasError: false };
+
+ static getDerivedStateFromError(): SidePanelErrorBoundaryState {
+ return { hasError: true };
+ }
+
+ private handleRetry = () => {
+ this.props.onRetry();
+ this.setState({ hasError: false });
+ };
+
+ render() {
+ if (this.state.hasError) {
+ return (
+ <div className="flex h-full flex-col items-center justify-center gap-3 p-6 text-center">
+ <p className="text-text-neutral-primary text-sm font-medium">
+ This panel failed to load.
+ </p>
+ <Button
+ type="button"
+ variant="outline"
+ size="sm"
+ onClick={this.handleRetry}
+ >
+ Retry
+ </Button>
+ </div>
+ );
+ }
+ return this.props.children;
+ }
+}
diff --git a/ui/components/side-panel/side-panel-tabs.tsx b/ui/components/side-panel/side-panel-tabs.tsx
new file mode 100644
index 0000000000..683a56aed6
--- /dev/null
+++ b/ui/components/side-panel/side-panel-tabs.tsx
@@ -0,0 +1,51 @@
+"use client";
+
+import type { ComponentType } from "react";
+
+import { LighthousePanelChatSkeleton } from "@/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat-skeleton";
+import { LighthousePanelHeaderActions } from "@/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-header-actions";
+import { LighthouseIcon } from "@/components/icons";
+import { isCloud } from "@/lib/shared/env";
+import { SIDE_PANEL_TAB, type SidePanelTabId } from "@/store/side-panel";
+
+// The CONTEXT tab is dynamic (registered at runtime by detail views), so the
+// static registry only holds the fixed tabs.
+type RegistrySidePanelTabId = Exclude<
+ SidePanelTabId,
+ typeof SIDE_PANEL_TAB.CONTEXT
+>;
+
+interface SidePanelTabDefinition {
+ id: RegistrySidePanelTabId;
+ label: string;
+ Icon: ComponentType<{ className?: string }>;
+ // Kept as a loader so Retry can create a fresh React.lazy instance after a
+ // rejected chunk request instead of reusing React's cached rejection.
+ loadContent: () => Promise<{ default: ComponentType }>;
+ // Eager (lightweight) 1:1 skeleton shown while Content's bundle downloads.
+ Fallback: ComponentType;
+ HeaderActions?: ComponentType;
+ isAvailable: () => boolean;
+}
+
+export const SIDE_PANEL_TABS: Record<
+ RegistrySidePanelTabId,
+ SidePanelTabDefinition
+> = {
+ [SIDE_PANEL_TAB.AI_CHAT]: {
+ id: SIDE_PANEL_TAB.AI_CHAT,
+ label: "Lighthouse AI",
+ Icon: LighthouseIcon,
+ loadContent: () =>
+ import(
+ "@/app/(prowler)/lighthouse/_components/panel/lighthouse-panel-chat"
+ ).then((module) => ({ default: module.LighthousePanelChat })),
+ Fallback: LighthousePanelChatSkeleton,
+ HeaderActions: LighthousePanelHeaderActions,
+ isAvailable: () => isCloud(),
+ },
+};
+
+export function getVisibleSidePanelTabs(): SidePanelTabDefinition[] {
+ return Object.values(SIDE_PANEL_TABS).filter((tab) => tab.isAvailable());
+}
diff --git a/ui/components/side-panel/side-panel-trigger.test.tsx b/ui/components/side-panel/side-panel-trigger.test.tsx
new file mode 100644
index 0000000000..e5435a46e3
--- /dev/null
+++ b/ui/components/side-panel/side-panel-trigger.test.tsx
@@ -0,0 +1,138 @@
+import { act, fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+import { SidePanelTrigger } from "./side-panel-trigger";
+
+const { isCloudMock } = vi.hoisted(() => ({ isCloudMock: vi.fn(() => true) }));
+
+vi.mock("@/lib/shared/env", () => ({ isCloud: isCloudMock }));
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => "/findings",
+}));
+
+const HINT_DELAY_MS = 1500;
+
+describe("SidePanelTrigger discovery callout", () => {
+ beforeEach(() => {
+ vi.useFakeTimers();
+ isCloudMock.mockReturnValue(true);
+ localStorage.clear();
+ useSidePanelStore.setState({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ hasBeenOpened: false,
+ hasSeenAiTriggerHint: false,
+ });
+ });
+
+ afterEach(() => {
+ vi.useRealTimers();
+ });
+
+ it("surfaces the callout once, after the settle delay", () => {
+ // Given / When
+ render(<SidePanelTrigger />);
+
+ // Then: nothing competes with the page while it loads
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+
+ // When: the delay elapses
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+
+ // Then
+ expect(screen.getByTestId("side-panel-ai-hint")).toBeInTheDocument();
+ expect(
+ screen.getByText("Ask Lighthouse AI from any page"),
+ ).toBeInTheDocument();
+ });
+
+ it("never surfaces the callout again once seen", () => {
+ // Given: a returning user
+ useSidePanelStore.setState({ hasSeenAiTriggerHint: true });
+
+ // When
+ render(<SidePanelTrigger />);
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS * 2));
+
+ // Then
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+ });
+
+ it("dismisses and persists via Got it", () => {
+ // Given
+ render(<SidePanelTrigger />);
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+
+ // When
+ fireEvent.click(screen.getByRole("button", { name: "Got it" }));
+
+ // Then
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(true);
+ const persisted = JSON.parse(
+ localStorage.getItem("side-panel-store") ?? "{}",
+ );
+ expect(persisted.state.hasSeenAiTriggerHint).toBe(true);
+ });
+
+ it("retires the callout when the user opens the chat from the trigger", () => {
+ // Given
+ render(<SidePanelTrigger />);
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+
+ // When
+ fireEvent.click(screen.getByTestId("side-panel-ai-trigger"));
+
+ // Then: the panel opened on the AI tab and the hint is retired for good
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(true);
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+ });
+
+ it("retires the callout when the chat opens from anywhere else", () => {
+ // Given: the callout is showing
+ render(<SidePanelTrigger />);
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+ expect(screen.getByTestId("side-panel-ai-hint")).toBeInTheDocument();
+
+ // When: another entry point (⌘., Overview banner) opens the AI chat
+ act(() => useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT));
+
+ // Then
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+ });
+
+ it("glows while undiscovered and calms once dismissed", () => {
+ // Given: first visit; the icon starts calm during page load
+ const { container } = render(<SidePanelTrigger />);
+ expect(container.querySelector("animate")).not.toBeInTheDocument();
+
+ // When: the callout appears
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+
+ // Then: the animated aura glows alongside it
+ expect(container.querySelector("animate")).toBeInTheDocument();
+
+ // When: the user dismisses the hint
+ fireEvent.click(screen.getByRole("button", { name: "Got it" }));
+
+ // Then: the icon settles back to its calm rendering
+ expect(container.querySelector("animate")).not.toBeInTheDocument();
+ });
+
+ it("stays quiet in OSS where the trigger does not render", () => {
+ // Given
+ isCloudMock.mockReturnValue(false);
+
+ // When
+ const { container } = render(<SidePanelTrigger />);
+ act(() => vi.advanceTimersByTime(HINT_DELAY_MS));
+
+ // Then
+ expect(container).toBeEmptyDOMElement();
+ expect(screen.queryByTestId("side-panel-ai-hint")).not.toBeInTheDocument();
+ });
+});
diff --git a/ui/components/side-panel/side-panel-trigger.tsx b/ui/components/side-panel/side-panel-trigger.tsx
new file mode 100644
index 0000000000..22a90faab5
--- /dev/null
+++ b/ui/components/side-panel/side-panel-trigger.tsx
@@ -0,0 +1,93 @@
+"use client";
+
+import { usePathname } from "next/navigation";
+import { useState } from "react";
+
+import { LighthouseIcon } from "@/components/icons";
+import { Button } from "@/components/shadcn/button/button";
+import {
+ DiscoveryCallout,
+ DiscoveryCalloutAnchor,
+ DiscoveryCalloutContent,
+} from "@/components/shadcn/discovery-callout/discovery-callout";
+import {
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { isLighthouseChatRoute } from "@/lib/lighthouse-routes";
+import { isCloud } from "@/lib/shared/env";
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+// Late enough that the page has settled and the callout reads as a pointer,
+// not as part of the page loading in.
+const AI_HINT_DELAY_MS = 1500;
+
+export function SidePanelTrigger() {
+ const pathname = usePathname();
+ const openPanel = useSidePanelStore((state) => state.openPanel);
+ // Hidden while the AI chat is already showing; kept while the panel shows a
+ // detail (context) tab, where the trigger is the way back to the chat.
+ const isAiChatPanelOpen = useSidePanelStore(
+ (state) => state.isOpen && state.selectedTab === SIDE_PANEL_TAB.AI_CHAT,
+ );
+ // One-time discovery callout: opens once after a short delay and never
+ // again — dismissing it or reaching the AI chat any other way (⌘., the
+ // Overview banner) marks it seen in the persisted store.
+ const hintSeen = useSidePanelStore((state) => state.hasSeenAiTriggerHint);
+ const markHintSeen = useSidePanelStore(
+ (state) => state.markAiTriggerHintSeen,
+ );
+ const [hintReady, setHintReady] = useState(false);
+
+ useMountEffect(() => {
+ if (useSidePanelStore.getState().hasSeenAiTriggerHint) return;
+ const timer = setTimeout(() => setHintReady(true), AI_HINT_DELAY_MS);
+ return () => clearTimeout(timer);
+ });
+
+ // Lighthouse AI (and the panel itself) is cloud-only. On the full-page chat
+ // route the panel is not available: the chat lives in one place at a time.
+ if (!isCloud()) return null;
+ if (isLighthouseChatRoute(pathname)) return null;
+ if (isAiChatPanelOpen) return null;
+
+ // Gated on hintReady (client-only) so SSR and hydration render the calm
+ // icon; the glow starts with the callout and stops once discovered.
+ const undiscovered = hintReady && !hintSeen;
+
+ return (
+ <DiscoveryCallout open={undiscovered} onDismiss={markHintSeen}>
+ <Tooltip delayDuration={100}>
+ <TooltipTrigger asChild>
+ <DiscoveryCalloutAnchor asChild>
+ <Button
+ type="button"
+ variant="ghost"
+ size="icon-sm"
+ aria-label="Ask Lighthouse AI"
+ data-testid="side-panel-ai-trigger"
+ onClick={() => openPanel(SIDE_PANEL_TAB.AI_CHAT)}
+ >
+ <LighthouseIcon animatedAura={undiscovered} className="size-5" />
+ </Button>
+ </DiscoveryCalloutAnchor>
+ </TooltipTrigger>
+ <TooltipContent>
+ Ask Lighthouse AI <kbd className="ml-1 text-xs">⌘.</kbd>
+ </TooltipContent>
+ </Tooltip>
+ <DiscoveryCalloutContent
+ title="Ask Lighthouse AI from any page"
+ description={
+ <>
+ Open the assistant right here whenever you need it, or press{" "}
+ <kbd className="text-xs">⌘.</kbd> to toggle it.
+ </>
+ }
+ data-testid="side-panel-ai-hint"
+ />
+ </DiscoveryCallout>
+ );
+}
diff --git a/ui/components/ui/accordion/Accordion.tsx b/ui/components/ui/accordion/Accordion.tsx
deleted file mode 100644
index 89403aa08d..0000000000
--- a/ui/components/ui/accordion/Accordion.tsx
+++ /dev/null
@@ -1,167 +0,0 @@
-"use client";
-
-import { Accordion as NextUIAccordion, AccordionItem } from "@heroui/accordion";
-import type { Selection } from "@react-types/shared";
-import { ChevronDown } from "lucide-react";
-import React, { ReactNode, useCallback, useMemo, useState } from "react";
-
-import { cn } from "@/lib/utils";
-
-export interface AccordionItemProps {
- key: string;
- title: ReactNode;
- subtitle?: ReactNode;
- content: ReactNode;
- items?: AccordionItemProps[];
- isDisabled?: boolean;
-}
-
-export interface AccordionProps {
- items: AccordionItemProps[];
- variant?: "light" | "shadow" | "bordered" | "splitted";
- className?: string;
- defaultExpandedKeys?: string[];
- selectedKeys?: string[];
- selectionMode?: "single" | "multiple";
- isCompact?: boolean;
- showDivider?: boolean;
- onItemExpand?: (key: string) => void;
- onSelectionChange?: (keys: string[]) => void;
-}
-
-const AccordionContent = ({
- content,
- items,
- selectedKeys,
- onSelectionChange,
-}: {
- content: ReactNode;
- items?: AccordionItemProps[];
- selectedKeys?: string[];
- onSelectionChange?: (keys: string[]) => void;
-}) => {
- // Normalize possible array content to automatically assign stable keys
- const normalizedContent = Array.isArray(content)
- ? React.Children.toArray(content)
- : content;
-
- return (
- <div className="text-sm text-gray-700 dark:text-gray-300">
- {normalizedContent}
- {items && items.length > 0 && (
- <div className="mt-4 ml-2 border-l-2 border-gray-200 pl-4 dark:border-gray-700">
- <Accordion
- items={items}
- variant="light"
- isCompact
- selectionMode="multiple"
- selectedKeys={selectedKeys}
- onSelectionChange={onSelectionChange}
- />
- </div>
- )}
- </div>
- );
-};
-
-export const Accordion = ({
- items,
- variant = "light",
- className,
- defaultExpandedKeys = [],
- selectedKeys,
- selectionMode = "single",
- isCompact = false,
- showDivider = true,
- onItemExpand,
- onSelectionChange,
-}: AccordionProps) => {
- // Determine if component is in controlled or uncontrolled mode
- const isControlled = selectedKeys !== undefined;
-
- const [internalExpandedKeys, setInternalExpandedKeys] = useState<Selection>(
- new Set(defaultExpandedKeys),
- );
-
- // Use selectedKeys if controlled, otherwise use internal state
- const expandedKeys = useMemo(
- () => (isControlled ? new Set(selectedKeys) : internalExpandedKeys),
- [isControlled, selectedKeys, internalExpandedKeys],
- );
-
- const handleSelectionChange = useCallback(
- (keys: Selection) => {
- const keysArray = Array.from(keys as Set<string>);
-
- // If controlled mode, call parent callback
- if (isControlled && onSelectionChange) {
- onSelectionChange(keysArray);
- } else {
- // If uncontrolled, update internal state
- setInternalExpandedKeys(keys);
- }
-
- // Handle onItemExpand for backward compatibility
- if (onItemExpand && keys !== expandedKeys) {
- const currentKeys = Array.from(expandedKeys as Set<string>);
- const newKeys = keysArray;
-
- const newlyExpandedKeys = newKeys.filter(
- (key) => !currentKeys.includes(key),
- );
-
- newlyExpandedKeys.forEach((key) => {
- onItemExpand(key);
- });
- }
- },
- [expandedKeys, onItemExpand, isControlled, onSelectionChange],
- );
-
- return (
- <NextUIAccordion
- className={cn(
- "bg-bg-neutral-primary border-border-neutral-secondary w-full rounded-lg border",
- className,
- )}
- variant={variant}
- selectionMode={selectionMode}
- selectedKeys={expandedKeys}
- onSelectionChange={handleSelectionChange}
- isCompact={isCompact}
- showDivider={showDivider}
- >
- {items.map((item, index) => (
- <AccordionItem
- key={item.key}
- data-accordion-key={item.key}
- aria-label={
- typeof item.title === "string" ? item.title : `Item ${item.key}`
- }
- title={item.title}
- subtitle={item.subtitle}
- isDisabled={item.isDisabled}
- indicator={<ChevronDown className="text-gray-500" />}
- classNames={{
- base: index === 0 || index === 1 ? "my-2" : "my-2",
- title: "text-sm",
- subtitle: "text-xs text-gray-500",
- trigger:
- "py-2 px-2 rounded-lg data-[hover=true]:bg-bg-neutral-tertiary data-[open=true]:bg-bg-neutral-tertiary w-full flex items-center transition-colors",
- content: "px-0 py-1",
- }}
- >
- <AccordionContent
- key={`${item.key}-content`}
- content={item.content}
- items={item.items}
- selectedKeys={selectedKeys}
- onSelectionChange={onSelectionChange}
- />
- </AccordionItem>
- ))}
- </NextUIAccordion>
- );
-};
-
-Accordion.displayName = "Accordion";
diff --git a/ui/components/ui/accordion/index.ts b/ui/components/ui/accordion/index.ts
new file mode 100644
index 0000000000..1256da7513
--- /dev/null
+++ b/ui/components/ui/accordion/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/accordion";
diff --git a/ui/components/ui/action-card/ActionCard.tsx b/ui/components/ui/action-card/ActionCard.tsx
deleted file mode 100644
index c925cc363c..0000000000
--- a/ui/components/ui/action-card/ActionCard.tsx
+++ /dev/null
@@ -1,84 +0,0 @@
-"use client";
-
-import type { CardProps } from "@heroui/card";
-import { Card, CardBody } from "@heroui/card";
-import { Icon } from "@iconify/react";
-import React from "react";
-
-import { cn } from "@/lib";
-
-export type ActionCardProps = CardProps & {
- icon: string;
- title: string;
- color?: "success" | "secondary" | "warning" | "fail";
- description: string;
-};
-
-export const ActionCard = React.forwardRef<HTMLDivElement, ActionCardProps>(
- ({ color, title, icon, description, children, className, ...props }, ref) => {
- const colors = React.useMemo(() => {
- switch (color) {
- case "success":
- return {
- card: "border-system-success-medium",
- iconWrapper: "bg-system-success-lighter border-system-success",
- icon: "text-system-success",
- };
- case "secondary":
- return {
- card: "border-secondary-100",
- iconWrapper: "bg-secondary-50 border-secondary-100",
- icon: "text-secondary",
- };
- case "warning":
- return {
- card: "border-warning-500",
- iconWrapper: "bg-warning-50 border-warning-100",
- icon: "text-warning-600",
- };
- case "fail":
- return {
- card: "border-danger-300",
- iconWrapper: "bg-danger-50 border-danger-100",
- icon: "text-text-error",
- };
-
- default:
- return {
- card: "border-default-200",
- iconWrapper: "bg-default-50 border-default-100",
- icon: "text-default-500",
- };
- }
- }, [color]);
-
- return (
- <Card
- ref={ref}
- isPressable
- className={cn("border-small", colors?.card, className)}
- shadow="sm"
- {...props}
- >
- <CardBody className="flex h-full flex-row items-center gap-2 p-2">
- <div
- className={cn(
- "item-center rounded-medium flex border p-1",
- colors?.iconWrapper,
- )}
- >
- <Icon className={colors?.icon} icon={icon} width={24} />
- </div>
- <div className="flex flex-col">
- <p className="text-md">{title}</p>
- <p className="text-default-400 text-sm">
- {description || children}
- </p>
- </div>
- </CardBody>
- </Card>
- );
- },
-);
-
-ActionCard.displayName = "ActionCard";
diff --git a/ui/components/ui/action-card/index.ts b/ui/components/ui/action-card/index.ts
new file mode 100644
index 0000000000..88507a5a13
--- /dev/null
+++ b/ui/components/ui/action-card/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/action-card";
diff --git a/ui/components/ui/alert-dialog/index.ts b/ui/components/ui/alert-dialog/index.ts
new file mode 100644
index 0000000000..7c54d25222
--- /dev/null
+++ b/ui/components/ui/alert-dialog/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/alert-dialog";
diff --git a/ui/components/ui/alert/Alert.tsx b/ui/components/ui/alert/Alert.tsx
index 51e850fe9e..48c4e66e7d 100644
--- a/ui/components/ui/alert/Alert.tsx
+++ b/ui/components/ui/alert/Alert.tsx
@@ -10,7 +10,7 @@ const alertVariants = cva(
variant: {
default: "bg-white text-slate-950 dark:bg-slate-950 dark:text-slate-50",
destructive:
- "bg-danger-50 border-red-500/50 text-red-700 dark:border-red-500 dark:border-red-900/50 dark:text-red-700 dark:dark:border-red-900",
+ "bg-bg-fail-secondary border-red-500/50 text-red-700 dark:border-red-500 dark:border-red-900/50 dark:text-red-700 dark:dark:border-red-900",
},
},
defaultVariants: {
diff --git a/ui/components/ui/avatar/index.ts b/ui/components/ui/avatar/index.ts
new file mode 100644
index 0000000000..2668f02cf3
--- /dev/null
+++ b/ui/components/ui/avatar/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/avatar";
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx b/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
deleted file mode 100644
index 6becf7d4db..0000000000
--- a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
+++ /dev/null
@@ -1,224 +0,0 @@
-"use client";
-
-import { BreadcrumbItem, Breadcrumbs } from "@heroui/breadcrumbs";
-import { Icon } from "@iconify/react";
-import Link from "next/link";
-import { usePathname, useSearchParams } from "next/navigation";
-import { ReactNode } from "react";
-
-import { LighthouseIcon } from "@/components/icons/Icons";
-import { cn } from "@/lib/utils";
-
-export interface CustomBreadcrumbItem {
- name: string;
- path?: string;
- icon?: string | ReactNode;
- isLast?: boolean;
- isClickable?: boolean;
- onClick?: () => void;
-}
-
-interface BreadcrumbNavigationProps {
- mode?: "auto" | "custom" | "hybrid";
- title?: string;
- icon?: string | ReactNode;
- titleAction?: ReactNode;
- customItems?: CustomBreadcrumbItem[];
- className?: string;
- paramToPreserve?: string;
- showTitle?: boolean;
-}
-
-export function BreadcrumbNavigation({
- mode = "auto",
- title,
- icon,
- titleAction,
- customItems = [],
- className = "",
- paramToPreserve = "scanId",
- showTitle = true,
-}: BreadcrumbNavigationProps) {
- const pathname = usePathname();
- const searchParams = useSearchParams();
-
- const generateAutoBreadcrumbs = (): CustomBreadcrumbItem[] => {
- const pathIconMapping: Record<string, string | ReactNode> = {
- "/integrations": "lucide:puzzle",
- "/alerts": "lucide:bell-ring",
- "/providers": "lucide:cloud",
- "/users": "lucide:users",
- "/compliance": "lucide:shield-check",
- "/findings": "lucide:search",
- "/scans": "lucide:activity",
- "/roles": "lucide:key",
- "/resources": "lucide:database",
- "/lighthouse": <LighthouseIcon />,
- "/manage-groups": "lucide:users-2",
- "/services": "lucide:server",
- "/workloads": "lucide:layers",
- "/attack-paths": "lucide:git-branch",
- };
-
- const pathSegments = pathname
- .split("/")
- .filter((segment) => segment !== "");
-
- if (pathSegments.length === 0) {
- return [{ name: "Home", path: "/", isLast: true }];
- }
-
- const breadcrumbs: CustomBreadcrumbItem[] = [];
- let currentPath = "";
-
- pathSegments.forEach((segment, index) => {
- currentPath += `/${segment}`;
- const isLast = index === pathSegments.length - 1;
- let displayName = segment.charAt(0).toUpperCase() + segment.slice(1);
-
- if (segment.includes("-")) {
- displayName = segment
- .split("-")
- .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
- .join(" ");
- }
- if (segment === "lighthouse") {
- displayName = "Lighthouse AI";
- }
-
- const segmentIcon = !isLast ? pathIconMapping[currentPath] : undefined;
-
- breadcrumbs.push({
- name: displayName,
- path: currentPath,
- icon: segmentIcon,
- isLast,
- isClickable: !isLast,
- });
- });
-
- return breadcrumbs;
- };
-
- const buildNavigationUrl = (path: string) => {
- const paramValue = searchParams.get(paramToPreserve);
- if (path === "/compliance" && paramValue) {
- return `/compliance?${paramToPreserve}=${paramValue}`;
- }
- return path;
- };
-
- const renderTitleWithIcon = (titleText: string, isLink: boolean = false) => (
- <div className="flex items-center gap-2">
- {typeof icon === "string" ? (
- <Icon
- className="text-text-neutral-primary"
- height={24}
- icon={icon}
- width={24}
- />
- ) : icon ? (
- <div className="flex h-8 w-8 items-center justify-center *:h-full *:w-full">
- {icon}
- </div>
- ) : null}
- <h1
- className={`text-text-neutral-primary max-w-[200px] truncate text-sm font-bold sm:max-w-none ${isLink ? "hover:text-primary transition-colors" : ""}`}
- >
- {titleText}
- </h1>
- {titleAction}
- </div>
- );
-
- let breadcrumbItems: CustomBreadcrumbItem[] = [];
-
- switch (mode) {
- case "auto":
- breadcrumbItems = generateAutoBreadcrumbs();
- break;
- case "custom":
- breadcrumbItems = customItems;
- break;
- case "hybrid":
- breadcrumbItems = [...generateAutoBreadcrumbs(), ...customItems];
- break;
- }
-
- return (
- <div className={cn(className, "w-fit md:w-full")}>
- <Breadcrumbs separator="/">
- {breadcrumbItems.map((breadcrumb, index) => (
- <BreadcrumbItem key={breadcrumb.path || index}>
- {breadcrumb.isLast && showTitle && title ? (
- renderTitleWithIcon(title)
- ) : breadcrumb.isClickable && breadcrumb.path ? (
- <Link
- href={buildNavigationUrl(breadcrumb.path)}
- className="flex cursor-pointer items-center gap-2"
- >
- {breadcrumb.icon && typeof breadcrumb.icon === "string" ? (
- <Icon
- aria-hidden="true"
- className="text-text-neutral-primary"
- height={24}
- icon={breadcrumb.icon}
- width={24}
- />
- ) : breadcrumb.icon ? (
- <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
- {breadcrumb.icon}
- </div>
- ) : null}
- <span className="text-text-neutral-primary hover:text-primary max-w-[150px] truncate text-sm font-bold transition-colors sm:max-w-none">
- {breadcrumb.name}
- </span>
- </Link>
- ) : breadcrumb.isClickable && breadcrumb.onClick ? (
- <button
- onClick={breadcrumb.onClick}
- className="text-text-neutral-primary hover:text-text-neutral-primary-hover flex cursor-pointer items-center gap-2 text-sm font-medium transition-colors"
- >
- {breadcrumb.icon && typeof breadcrumb.icon === "string" ? (
- <Icon
- aria-hidden="true"
- className="text-text-neutral-primary"
- height={24}
- icon={breadcrumb.icon}
- width={24}
- />
- ) : breadcrumb.icon ? (
- <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
- {breadcrumb.icon}
- </div>
- ) : null}
- <span className="max-w-[150px] truncate sm:max-w-none">
- {breadcrumb.name}
- </span>
- </button>
- ) : (
- <div className="flex items-center gap-2">
- {breadcrumb.icon && typeof breadcrumb.icon === "string" ? (
- <Icon
- aria-hidden="true"
- className="text-default-500"
- height={24}
- icon={breadcrumb.icon}
- width={24}
- />
- ) : breadcrumb.icon ? (
- <div className="flex h-6 w-6 items-center justify-center *:h-full *:w-full">
- {breadcrumb.icon}
- </div>
- ) : null}
- <span className="max-w-[150px] truncate text-sm font-medium text-gray-900 sm:max-w-none dark:text-gray-100">
- {breadcrumb.name}
- </span>
- </div>
- )}
- </BreadcrumbItem>
- ))}
- </Breadcrumbs>
- </div>
- );
-}
diff --git a/ui/components/ui/breadcrumbs/index.ts b/ui/components/ui/breadcrumbs/index.ts
index 908d780e87..ea03e9d571 100644
--- a/ui/components/ui/breadcrumbs/index.ts
+++ b/ui/components/ui/breadcrumbs/index.ts
@@ -1 +1,3 @@
-export * from "./breadcrumb-navigation";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/breadcrumbs";
diff --git a/ui/components/ui/button/button.tsx b/ui/components/ui/button/button.tsx
index 63dc97b26f..515def5e19 100644
--- a/ui/components/ui/button/button.tsx
+++ b/ui/components/ui/button/button.tsx
@@ -10,16 +10,16 @@ const buttonVariants = cva(
variants: {
variant: {
default:
- "bg-primary text-primary-foreground font-semibold shadow hover:bg-primary/90",
+ "bg-button-primary text-black font-semibold shadow hover:bg-button-primary/90",
destructive:
"bg-destructive text-destructive-foreground shadow-sm hover:bg-destructive/90",
outline:
- "border border-input bg-background shadow-sm hover:bg-accent hover:text-accent-foreground",
+ "border border-input bg-bg-neutral-primary shadow-sm hover:bg-accent hover:text-accent-foreground",
secondary:
"border-2 border-slate-950 text-neutral-primary dark:border-white dark:text-neutral-primary font-bold px-[14px]",
ghost:
"border-2 border-transparent text-neutral-secondary dark:text-neutral-secondary hover:border-slate-950 dark:hover:border-white hover:font-bold px-[14px]",
- link: "text-primary underline-offset-4 hover:underline",
+ link: "text-button-primary underline-offset-4 hover:underline",
},
size: {
default: "h-9 px-4 py-2",
diff --git a/ui/components/ui/chart/index.ts b/ui/components/ui/chart/index.ts
new file mode 100644
index 0000000000..ded491dff3
--- /dev/null
+++ b/ui/components/ui/chart/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/chart";
diff --git a/ui/components/ui/code-snippet/index.ts b/ui/components/ui/code-snippet/index.ts
new file mode 100644
index 0000000000..874033aa92
--- /dev/null
+++ b/ui/components/ui/code-snippet/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/code-snippet";
diff --git a/ui/components/ui/content-layout/index.ts b/ui/components/ui/content-layout/index.ts
new file mode 100644
index 0000000000..d2c0bf534b
--- /dev/null
+++ b/ui/components/ui/content-layout/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/content-layout";
diff --git a/ui/components/ui/content-layout/skeleton-content-layout.tsx b/ui/components/ui/content-layout/skeleton-content-layout.tsx
deleted file mode 100644
index 3f1c0f14ca..0000000000
--- a/ui/components/ui/content-layout/skeleton-content-layout.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { Skeleton } from "@heroui/skeleton";
-
-export const SkeletonContentLayout = () => {
- return (
- <div className="flex items-center gap-4">
- {/* Theme Switch Skeleton */}
- <Skeleton className="dark:bg-prowler-blue-800 h-8 w-8 rounded-full">
- <div className="bg-default-200 h-8 w-8"></div>
- </Skeleton>
-
- {/* User Avatar Skeleton */}
- <Skeleton className="dark:bg-prowler-blue-800 h-10 w-10 rounded-full">
- <div className="bg-default-200 h-10 w-10"></div>
- </Skeleton>
- </div>
- );
-};
diff --git a/ui/components/ui/custom/custom-input.tsx b/ui/components/ui/custom/custom-input.tsx
deleted file mode 100644
index 86b3852380..0000000000
--- a/ui/components/ui/custom/custom-input.tsx
+++ /dev/null
@@ -1,124 +0,0 @@
-"use client";
-
-import { Input } from "@heroui/input";
-import { Icon } from "@iconify/react";
-import { useState } from "react";
-import { Control, FieldPath, FieldValues } from "react-hook-form";
-
-import { FormControl, FormField } from "@/components/ui/form";
-
-interface CustomInputProps<T extends FieldValues> {
- control: Control<T>;
- name: FieldPath<T>;
- label?: string;
- labelPlacement?: "inside" | "outside";
- variant?: "flat" | "bordered" | "underlined" | "faded";
- size?: "sm" | "md" | "lg";
- type?: string;
- placeholder?: string;
- password?: boolean;
- confirmPassword?: boolean;
- defaultValue?: string;
- isReadOnly?: boolean;
- isRequired?: boolean;
- isDisabled?: boolean;
-}
-
-export const CustomInput = <T extends FieldValues>({
- control,
- name,
- type = "text",
- label = name,
- labelPlacement = "inside",
- placeholder,
- variant = "bordered",
- size = "md",
- confirmPassword = false,
- password = false,
- defaultValue,
- isReadOnly = false,
- isRequired = true,
- isDisabled = false,
-}: CustomInputProps<T>) => {
- const [isPasswordVisible, setIsPasswordVisible] = useState(false);
- const [isConfirmPasswordVisible, setIsConfirmPasswordVisible] =
- useState(false);
-
- const inputLabel = confirmPassword
- ? "Confirm Password"
- : password
- ? "Password"
- : label;
-
- const inputPlaceholder = confirmPassword
- ? "Confirm Password"
- : password
- ? "Password"
- : placeholder;
-
- const inputType =
- password || confirmPassword
- ? isPasswordVisible || isConfirmPasswordVisible
- ? "text"
- : "password"
- : type;
- const inputIsRequired = password || confirmPassword ? true : isRequired;
-
- const toggleVisibility = () => {
- if (password) {
- setIsPasswordVisible(!isPasswordVisible);
- } else if (confirmPassword) {
- setIsConfirmPasswordVisible(!isConfirmPasswordVisible);
- }
- };
-
- const endContent = (password || confirmPassword) && (
- <button type="button" onClick={toggleVisibility}>
- <Icon
- className="text-default-400 pointer-events-none text-2xl"
- icon={
- (password && isPasswordVisible) ||
- (confirmPassword && isConfirmPasswordVisible)
- ? "solar:eye-closed-linear"
- : "solar:eye-bold"
- }
- />
- </button>
- );
-
- return (
- <FormField
- control={control}
- name={name}
- render={({ field, fieldState }) => (
- <>
- <FormControl>
- <Input
- id={name}
- classNames={{
- label:
- "tracking-tight font-light !text-text-neutral-secondary text-xs z-0!",
- input: "text-text-neutral-secondary text-small",
- }}
- isRequired={inputIsRequired}
- label={inputLabel}
- labelPlacement={labelPlacement}
- placeholder={inputPlaceholder}
- type={inputType}
- variant={variant}
- size={size}
- defaultValue={defaultValue}
- endContent={endContent}
- isDisabled={isDisabled}
- isReadOnly={isReadOnly}
- isInvalid={!!fieldState.error}
- errorMessage={fieldState.error?.message}
- {...field}
- value={field.value ?? ""}
- />
- </FormControl>
- </>
- )}
- />
- );
-};
diff --git a/ui/components/ui/custom/custom-radio.tsx b/ui/components/ui/custom/custom-radio.tsx
deleted file mode 100644
index 5594721ec7..0000000000
--- a/ui/components/ui/custom/custom-radio.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import { useRadio } from "@heroui/radio";
-import { cn } from "@heroui/theme";
-import { VisuallyHidden } from "@react-aria/visually-hidden";
-import React from "react";
-
-interface CustomRadioProps {
- description?: string;
- value?: string;
- children?: React.ReactNode;
-}
-
-export const CustomRadio: React.FC<CustomRadioProps> = (props) => {
- const {
- Component,
- children,
- // description,
- getBaseProps,
- getWrapperProps,
- getInputProps,
- getLabelProps,
- getLabelWrapperProps,
- getControlProps,
- } = useRadio({ ...props, value: props.value || "" });
-
- return (
- <Component
- {...getBaseProps()}
- className={cn(
- "group tap-highlight-transparent inline-flex flex-row-reverse items-center justify-between hover:opacity-70 active:opacity-50",
- "border-default max-w-full cursor-pointer gap-4 rounded-lg border-2 p-4",
- "hover:border-button-primary data-[selected=true]:border-button-primary w-full",
- )}
- >
- <VisuallyHidden>
- <input {...getInputProps()} />
- </VisuallyHidden>
- <span {...getWrapperProps()}>
- <span {...getControlProps()} />
- </span>
- <div {...getLabelWrapperProps()}>
- {children && <span {...getLabelProps()}>{children}</span>}
- {/* {description && (
- <span className="text-small text-foreground opacity-70">
- {description}
- </span>
- )} */}
- </div>
- </Component>
- );
-};
diff --git a/ui/components/ui/custom/custom-server-input.tsx b/ui/components/ui/custom/custom-server-input.tsx
deleted file mode 100644
index c73e4aff43..0000000000
--- a/ui/components/ui/custom/custom-server-input.tsx
+++ /dev/null
@@ -1,58 +0,0 @@
-"use client";
-
-import { Input } from "@heroui/input";
-import React from "react";
-
-interface CustomServerInputProps {
- name: string;
- label?: string;
- labelPlacement?: "inside" | "outside";
- variant?: "flat" | "bordered" | "underlined" | "faded";
- type?: string;
- placeholder?: string;
- isRequired?: boolean;
- isInvalid?: boolean;
- errorMessage?: string;
- value?: string;
- onChange?: (e: React.ChangeEvent<HTMLInputElement>) => void;
-}
-
-/**
- * Custom input component that is used to display a server input without useForm hook.
- */
-export const CustomServerInput = ({
- name,
- type = "text",
- label,
- labelPlacement = "outside",
- placeholder,
- variant = "bordered",
- isRequired = false,
- isInvalid = false,
- errorMessage,
- value,
- onChange,
-}: CustomServerInputProps) => {
- return (
- <div className="flex flex-col">
- <Input
- id={name}
- name={name}
- type={type}
- label={label}
- labelPlacement={labelPlacement}
- placeholder={placeholder}
- variant={variant}
- isRequired={isRequired}
- isInvalid={isInvalid}
- errorMessage={errorMessage}
- value={value}
- onChange={onChange}
- classNames={{
- label: "tracking-tight font-light !text-default-500 text-xs z-0!",
- input: "text-default-500 text-small",
- }}
- />
- </div>
- );
-};
diff --git a/ui/components/ui/custom/custom-textarea.tsx b/ui/components/ui/custom/custom-textarea.tsx
deleted file mode 100644
index e006b65a26..0000000000
--- a/ui/components/ui/custom/custom-textarea.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-"use client";
-
-import { Textarea } from "@heroui/input";
-import React from "react";
-import { Control, FieldPath, FieldValues } from "react-hook-form";
-
-import { FormControl, FormField, FormMessage } from "@/components/ui/form";
-
-interface CustomTextareaProps<T extends FieldValues> {
- control: Control<T>;
- name: FieldPath<T>;
- label?: string;
- labelPlacement?: "inside" | "outside" | "outside-left";
- variant?: "flat" | "bordered" | "underlined" | "faded";
- size?: "sm" | "md" | "lg";
- placeholder?: string;
- defaultValue?: string;
- isRequired?: boolean;
- minRows?: number;
- maxRows?: number;
- fullWidth?: boolean;
- disableAutosize?: boolean;
- description?: React.ReactNode;
-}
-
-export const CustomTextarea = <T extends FieldValues>({
- control,
- name,
- label = name,
- labelPlacement = "inside",
- placeholder,
- variant = "flat",
- size = "md",
- defaultValue,
- isRequired = false,
- minRows = 3,
- maxRows = 8,
- fullWidth = true,
- disableAutosize = false,
- description,
-}: CustomTextareaProps<T>) => {
- return (
- <FormField
- control={control}
- name={name}
- render={({ field }) => (
- <>
- <FormControl>
- <Textarea
- id={name}
- label={label}
- labelPlacement={labelPlacement}
- placeholder={placeholder}
- variant={variant}
- size={size}
- isRequired={isRequired}
- defaultValue={defaultValue}
- minRows={minRows}
- maxRows={maxRows}
- fullWidth={fullWidth}
- disableAutosize={disableAutosize}
- description={description}
- {...field}
- />
- </FormControl>
- <FormMessage className="text-text-error max-w-full text-xs" />
- </>
- )}
- />
- );
-};
diff --git a/ui/components/ui/custom/index.ts b/ui/components/ui/custom/index.ts
index 8a1bcd488f..066b2e1e72 100644
--- a/ui/components/ui/custom/index.ts
+++ b/ui/components/ui/custom/index.ts
@@ -1,8 +1,3 @@
-export * from "./custom-banner";
-export * from "./custom-input";
-export * from "./custom-link";
-export * from "./custom-modal-buttons";
-export * from "./custom-radio";
-export * from "./custom-server-input";
-export * from "./custom-table-link";
-export * from "./custom-textarea";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/custom";
diff --git a/ui/components/ui/download-icon-button/download-icon-button.tsx b/ui/components/ui/download-icon-button/download-icon-button.tsx
deleted file mode 100644
index a89a183faa..0000000000
--- a/ui/components/ui/download-icon-button/download-icon-button.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-"use client";
-
-import { Tooltip } from "@heroui/tooltip";
-import { DownloadIcon } from "lucide-react";
-
-import { Button } from "@/components/shadcn/button/button";
-
-interface DownloadIconButtonProps {
- paramId: string;
- onDownload: (paramId: string) => void;
- ariaLabel?: string;
- isDisabled?: boolean;
- textTooltip?: string;
- isDownloading?: boolean;
-}
-
-export const DownloadIconButton = ({
- paramId,
- onDownload,
- ariaLabel = "Download report",
- isDisabled,
- textTooltip = "Download report",
- isDownloading = false,
-}: DownloadIconButtonProps) => {
- return (
- <div className="flex items-center justify-end">
- <Tooltip content={textTooltip} className="text-xs">
- <Button
- variant="ghost"
- size="icon-sm"
- disabled={isDisabled || isDownloading}
- onClick={() => onDownload(paramId)}
- aria-label={ariaLabel}
- className="p-0 disabled:opacity-30"
- >
- <DownloadIcon
- className={isDownloading ? "animate-download-icon" : ""}
- size={16}
- />
- </Button>
- </Tooltip>
- </div>
- );
-};
diff --git a/ui/components/ui/download-icon-button/index.ts b/ui/components/ui/download-icon-button/index.ts
new file mode 100644
index 0000000000..3724eccdfc
--- /dev/null
+++ b/ui/components/ui/download-icon-button/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/download-icon-button";
diff --git a/ui/components/ui/dropdown-menu/index.ts b/ui/components/ui/dropdown-menu/index.ts
new file mode 100644
index 0000000000..c7f2ec7654
--- /dev/null
+++ b/ui/components/ui/dropdown-menu/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/dropdown-menu";
diff --git a/ui/components/ui/entities/index.ts b/ui/components/ui/entities/index.ts
index 126cc34cd8..4a052b2617 100644
--- a/ui/components/ui/entities/index.ts
+++ b/ui/components/ui/entities/index.ts
@@ -1,4 +1,3 @@
-export * from "./date-with-time";
-export * from "./entity-info";
-export * from "./get-provider-logo";
-export * from "./scan-status";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/entities";
diff --git a/ui/components/ui/expandable-section.tsx b/ui/components/ui/expandable-section.tsx
index 8109231111..414920bb56 100644
--- a/ui/components/ui/expandable-section.tsx
+++ b/ui/components/ui/expandable-section.tsx
@@ -1,39 +1,3 @@
-"use client";
-
-import { cn } from "@/lib/utils";
-
-interface ExpandableSectionProps {
- isExpanded: boolean;
- children: React.ReactNode;
- className?: string;
- contentClassName?: string;
-}
-
-/**
- * Animated expandable section using CSS grid for smooth height transitions.
- * Animates from height 0 to auto content height.
- */
-export function ExpandableSection({
- isExpanded,
- children,
- className,
- contentClassName,
-}: ExpandableSectionProps) {
- return (
- <div
- className={cn(
- "grid transition-[grid-template-rows] duration-300 ease-in-out",
- isExpanded ? "grid-rows-[1fr]" : "grid-rows-[0fr]",
- className,
- )}
- >
- <div className="overflow-hidden">
- <div
- className={cn("pt-4", contentClassName, !isExpanded && "invisible")}
- >
- {children}
- </div>
- </div>
- </div>
- );
-}
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/expandable-section";
diff --git a/ui/components/ui/feedback-banner/index.ts b/ui/components/ui/feedback-banner/index.ts
new file mode 100644
index 0000000000..c58235aeba
--- /dev/null
+++ b/ui/components/ui/feedback-banner/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/feedback-banner";
diff --git a/ui/components/ui/form/index.ts b/ui/components/ui/form/index.ts
index 696b86aca3..4e283a4bb7 100644
--- a/ui/components/ui/form/index.ts
+++ b/ui/components/ui/form/index.ts
@@ -1,3 +1,3 @@
-export * from "./Form";
-export * from "./form-buttons";
-export * from "./Label";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/form";
diff --git a/ui/components/ui/headers/index.ts b/ui/components/ui/headers/index.ts
new file mode 100644
index 0000000000..357b218401
--- /dev/null
+++ b/ui/components/ui/headers/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/headers";
diff --git a/ui/components/ui/headers/navigation-header.tsx b/ui/components/ui/headers/navigation-header.tsx
deleted file mode 100644
index 40002d6d92..0000000000
--- a/ui/components/ui/headers/navigation-header.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { Divider } from "@heroui/divider";
-import { Icon } from "@iconify/react";
-import Link from "next/link";
-
-import { Button } from "@/components/shadcn";
-
-interface NavigationHeaderProps {
- title: string;
- icon: string;
- href?: string;
-}
-
-export const NavigationHeader = ({
- title,
- icon,
- href,
-}: NavigationHeaderProps) => {
- return (
- <>
- <header className="flex items-center gap-3 border-b border-gray-200 px-6 py-4 dark:border-gray-800">
- <Button
- className="border-gray-200 bg-transparent p-0"
- aria-label="Navigation button"
- variant="outline"
- size="icon"
- asChild
- >
- <Link href={href || ""}>
- <Icon icon={icon} className="text-gray-600 dark:text-gray-400" />
- </Link>
- </Button>
- <Divider orientation="vertical" className="h-6" />
- <h1 className="text-default-700 text-xl font-light">{title}</h1>
- </header>
- </>
- );
-};
diff --git a/ui/components/ui/index.ts b/ui/components/ui/index.ts
index bb414d2805..6d4e9aa30f 100644
--- a/ui/components/ui/index.ts
+++ b/ui/components/ui/index.ts
@@ -1,18 +1,19 @@
-export * from "./accordion/Accordion";
-export * from "./action-card/ActionCard";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
export * from "./alert/Alert";
-export * from "./alert-dialog/AlertDialog";
-export * from "./breadcrumbs";
export * from "./collapsible/collapsible";
-export * from "./content-layout/content-layout";
export * from "./dialog/dialog";
-export * from "./download-icon-button/download-icon-button";
export * from "./dropdown/Dropdown";
-export * from "./feedback-banner/feedback-banner";
-export * from "./headers/navigation-header";
-export * from "./label/Label";
-export * from "./main-layout/main-layout";
-export * from "./navigation-progress";
export * from "./select";
-export * from "./sidebar";
-export * from "./toast";
+export * from "@/components/layout/main-layout";
+export * from "@/components/shadcn/accordion";
+export * from "@/components/shadcn/action-card";
+export * from "@/components/shadcn/alert-dialog";
+export * from "@/components/shadcn/breadcrumbs";
+export * from "@/components/shadcn/content-layout";
+export * from "@/components/shadcn/download-icon-button";
+export * from "@/components/shadcn/feedback-banner";
+export * from "@/components/shadcn/headers";
+export * from "@/components/shadcn/label";
+export * from "@/components/shadcn/navigation-progress";
+export * from "@/components/shadcn/toast";
diff --git a/ui/components/ui/label/index.ts b/ui/components/ui/label/index.ts
new file mode 100644
index 0000000000..a5694a4059
--- /dev/null
+++ b/ui/components/ui/label/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/label";
diff --git a/ui/components/ui/main-layout/index.ts b/ui/components/ui/main-layout/index.ts
new file mode 100644
index 0000000000..1b4f9538cc
--- /dev/null
+++ b/ui/components/ui/main-layout/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/layout/main-layout";
diff --git a/ui/components/ui/main-layout/main-layout.test.tsx b/ui/components/ui/main-layout/main-layout.test.tsx
deleted file mode 100644
index 3e51bbed36..0000000000
--- a/ui/components/ui/main-layout/main-layout.test.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
-
-import MainLayout from "./main-layout";
-
-vi.mock("@/hooks/use-sidebar", () => ({
- useSidebar: vi.fn(),
-}));
-
-vi.mock("@/hooks/use-store", () => ({
- useStore: () => ({
- getOpenState: () => true,
- settings: { disabled: false },
- }),
-}));
-
-vi.mock("../sidebar/sidebar", () => ({
- Sidebar: () => <aside data-testid="sidebar" />,
-}));
-
-describe("MainLayout", () => {
- it("renders subdued background glows for side-nav contrast", () => {
- render(
- <MainLayout>
- <div>Page content</div>
- </MainLayout>,
- );
-
- const topGlow =
- screen.getByTestId("sidebar").previousElementSibling
- ?.previousElementSibling;
- const bottomGlow = screen.getByTestId("sidebar").previousElementSibling;
-
- expect(topGlow).toHaveClass("h-[120%]", "w-[160%]", "opacity-[7%]");
- expect(bottomGlow).toHaveClass("h-[50%]", "w-[50%]", "opacity-[7%]");
- });
-});
diff --git a/ui/components/ui/main-layout/main-layout.tsx b/ui/components/ui/main-layout/main-layout.tsx
deleted file mode 100644
index 831eda7899..0000000000
--- a/ui/components/ui/main-layout/main-layout.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-"use client";
-
-import { useSidebar } from "@/hooks/use-sidebar";
-import { useStore } from "@/hooks/use-store";
-import { cn } from "@/lib/utils";
-
-import { Sidebar } from "../sidebar/sidebar";
-export default function MainLayout({
- children,
-}: {
- children: React.ReactNode;
-}) {
- const sidebar = useStore(useSidebar, (x) => x);
- if (!sidebar) return null;
- const { getOpenState, settings } = sidebar;
- return (
- <div className="relative flex h-dvh items-center justify-center overflow-hidden">
- {/* Top-left gradient halo */}
- <div
- className="pointer-events-none fixed top-0 left-0 z-0 h-[120%] w-[160%] opacity-[7%] blur-3xl"
- style={{
- background: "linear-gradient(90deg, #31E59F 0%, #60E0EC 100%)",
- transform: "translate(-50%, -50%)",
- }}
- />
-
- {/* Bottom-right gradient halo */}
- <div
- className="pointer-events-none fixed right-0 bottom-0 z-0 h-[50%] w-[50%] opacity-[7%] blur-3xl"
- style={{
- background: "linear-gradient(90deg, #31E59F 0%, #60E0EC 100%)",
- transform: "translate(50%, 50%)",
- }}
- />
-
- <Sidebar />
- <main
- className={cn(
- "no-scrollbar relative z-10 mb-auto h-full flex-1 flex-col overflow-y-auto transition-[margin-left] duration-300 ease-in-out",
- !settings.disabled &&
- (!getOpenState() ? "lg:ml-[90px]" : "lg:ml-[248px]"),
- )}
- >
- {children}
- </main>
- </div>
- );
-}
diff --git a/ui/components/ui/nav-bar/index.ts b/ui/components/ui/nav-bar/index.ts
new file mode 100644
index 0000000000..1235a050e2
--- /dev/null
+++ b/ui/components/ui/nav-bar/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/layout/nav-bar";
diff --git a/ui/components/ui/navigation-progress/index.ts b/ui/components/ui/navigation-progress/index.ts
index 2a80281acb..ec26280c9d 100644
--- a/ui/components/ui/navigation-progress/index.ts
+++ b/ui/components/ui/navigation-progress/index.ts
@@ -1,7 +1,3 @@
-export { NavigationProgress } from "./navigation-progress";
-export {
- cancelProgress,
- completeProgress,
- startProgress,
- useNavigationProgress,
-} from "./use-navigation-progress";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/navigation-progress";
diff --git a/ui/components/ui/scroll-area/index.ts b/ui/components/ui/scroll-area/index.ts
new file mode 100644
index 0000000000..78b017a3d9
--- /dev/null
+++ b/ui/components/ui/scroll-area/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/scroll-area";
diff --git a/ui/components/ui/sheet/index.ts b/ui/components/ui/sheet/index.ts
index 2865f1c5a7..6fc42025da 100644
--- a/ui/components/ui/sheet/index.ts
+++ b/ui/components/ui/sheet/index.ts
@@ -1,2 +1,3 @@
-export * from "./sheet";
-export * from "./trigger-sheet";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/sheet";
diff --git a/ui/components/ui/sheet/sheet.tsx b/ui/components/ui/sheet/sheet.tsx
deleted file mode 100644
index 49ba1e7f92..0000000000
--- a/ui/components/ui/sheet/sheet.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-"use client";
-
-import * as SheetPrimitive from "@radix-ui/react-dialog";
-import { Cross2Icon } from "@radix-ui/react-icons";
-import { cva, type VariantProps } from "class-variance-authority";
-import * as React from "react";
-
-import { cn } from "@/lib/utils";
-
-const Sheet = SheetPrimitive.Root;
-
-const SheetTrigger = SheetPrimitive.Trigger;
-
-const SheetClose = SheetPrimitive.Close;
-
-const SheetPortal = SheetPrimitive.Portal;
-
-const SheetOverlay = React.forwardRef<
- React.ElementRef<typeof SheetPrimitive.Overlay>,
- React.ComponentPropsWithoutRef<typeof SheetPrimitive.Overlay>
->(({ className, ...props }, ref) => (
- <SheetPrimitive.Overlay
- className={cn(
- "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/80",
- className,
- )}
- {...props}
- ref={ref}
- />
-));
-SheetOverlay.displayName = SheetPrimitive.Overlay.displayName;
-
-const sheetVariants = cva(
- "fixed z-50 gap-4 border border-border-neutral-secondary bg-bg-neutral-secondary p-6 shadow-lg transition ease-in-out data-[state=closed]:duration-300 data-[state=open]:duration-500 data-[state=open]:animate-in data-[state=closed]:animate-out",
- {
- variants: {
- side: {
- top: "inset-x-0 top-0 rounded-b-xl data-[state=closed]:slide-out-to-top data-[state=open]:slide-in-from-top",
- bottom:
- "inset-x-0 bottom-0 rounded-t-xl data-[state=closed]:slide-out-to-bottom data-[state=open]:slide-in-from-bottom",
- left: "inset-y-0 left-0 h-full w-3/4 rounded-r-xl data-[state=closed]:slide-out-to-left data-[state=open]:slide-in-from-left",
- right:
- "inset-y-0 right-0 h-full w-3/4 rounded-l-xl data-[state=closed]:slide-out-to-right data-[state=open]:slide-in-from-right",
- },
- },
- defaultVariants: {
- side: "right",
- },
- },
-);
-
-interface SheetContentProps
- extends React.ComponentPropsWithoutRef<typeof SheetPrimitive.Content>,
- VariantProps<typeof sheetVariants> {}
-
-const SheetContent = React.forwardRef<
- React.ElementRef<typeof SheetPrimitive.Content>,
- SheetContentProps
->(({ side = "right", className, children, ...props }, ref) => (
- <SheetPortal>
- <SheetOverlay />
- <SheetPrimitive.Content
- ref={ref}
- className={cn(sheetVariants({ side }), className)}
- {...props}
- >
- <SheetPrimitive.Close className="absolute top-4 right-4 rounded-sm opacity-70 ring-offset-white transition-opacity hover:opacity-100 focus:ring-2 focus:ring-neutral-950 focus:ring-offset-2 focus:outline-none disabled:pointer-events-none data-[state=open]:bg-neutral-100 dark:ring-offset-neutral-950 dark:focus:ring-neutral-300 dark:data-[state=open]:bg-neutral-800">
- <Cross2Icon className="h-4 w-4" />
- <span className="sr-only">Close</span>
- </SheetPrimitive.Close>
- {children}
- </SheetPrimitive.Content>
- </SheetPortal>
-));
-SheetContent.displayName = SheetPrimitive.Content.displayName;
-
-const SheetHeader = ({
- className,
- ...props
-}: React.HTMLAttributes<HTMLDivElement>) => (
- <div
- className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
- {...props}
- />
-);
-SheetHeader.displayName = "SheetHeader";
-
-const SheetFooter = ({
- className,
- ...props
-}: React.HTMLAttributes<HTMLDivElement>) => (
- <div
- className={cn(
- "flex flex-col-reverse sm:flex-row sm:justify-end sm:gap-2",
- className,
- )}
- {...props}
- />
-);
-SheetFooter.displayName = "SheetFooter";
-
-const SheetTitle = React.forwardRef<
- React.ElementRef<typeof SheetPrimitive.Title>,
- React.ComponentPropsWithoutRef<typeof SheetPrimitive.Title>
->(({ className, ...props }, ref) => (
- <SheetPrimitive.Title
- ref={ref}
- className={cn(
- "text-lg font-semibold text-neutral-950 dark:text-neutral-50",
- className,
- )}
- {...props}
- />
-));
-SheetTitle.displayName = SheetPrimitive.Title.displayName;
-
-const SheetDescription = React.forwardRef<
- React.ElementRef<typeof SheetPrimitive.Description>,
- React.ComponentPropsWithoutRef<typeof SheetPrimitive.Description>
->(({ className, ...props }, ref) => (
- <SheetPrimitive.Description
- ref={ref}
- className={cn("text-sm text-neutral-500 dark:text-neutral-400", className)}
- {...props}
- />
-));
-SheetDescription.displayName = SheetPrimitive.Description.displayName;
-
-export {
- Sheet,
- SheetClose,
- SheetContent,
- SheetDescription,
- SheetFooter,
- SheetHeader,
- SheetOverlay,
- SheetPortal,
- SheetTitle,
- SheetTrigger,
-};
diff --git a/ui/components/ui/sidebar/collapsible-menu.tsx b/ui/components/ui/sidebar/collapsible-menu.tsx
deleted file mode 100644
index 7937bf940d..0000000000
--- a/ui/components/ui/sidebar/collapsible-menu.tsx
+++ /dev/null
@@ -1,98 +0,0 @@
-"use client";
-
-import { ChevronDown } from "lucide-react";
-import { usePathname } from "next/navigation";
-import { useEffect, useState } from "react";
-
-import { Button } from "@/components/shadcn/button/button";
-import {
- Tooltip,
- TooltipContent,
- TooltipTrigger,
-} from "@/components/shadcn/tooltip";
-import {
- Collapsible,
- CollapsibleContent,
- CollapsibleTrigger,
-} from "@/components/ui/collapsible/collapsible";
-import { SubmenuItem } from "@/components/ui/sidebar/submenu-item";
-import { cn } from "@/lib/utils";
-import { IconComponent, SubmenuProps } from "@/types";
-
-interface CollapsibleMenuProps {
- icon: IconComponent;
- label: string;
- submenus: SubmenuProps[];
- defaultOpen?: boolean;
- isOpen: boolean;
-}
-
-export const CollapsibleMenu = ({
- icon: Icon,
- label,
- submenus,
- defaultOpen = false,
- isOpen: isSidebarOpen,
-}: CollapsibleMenuProps) => {
- const pathname = usePathname();
- const isSubmenuActive = submenus.some((submenu) =>
- submenu.active === undefined ? submenu.href === pathname : submenu.active,
- );
- const [isCollapsed, setIsCollapsed] = useState(
- isSubmenuActive || defaultOpen,
- );
-
- // Collapse the menu when sidebar is closed
- useEffect(() => {
- if (!isSidebarOpen) {
- setIsCollapsed(false);
- }
- }, [isSidebarOpen]);
-
- return (
- <Collapsible
- open={isCollapsed}
- onOpenChange={setIsCollapsed}
- defaultOpen={defaultOpen}
- className="group mb-1 w-full"
- >
- <Tooltip delayDuration={100}>
- <TooltipTrigger asChild>
- <CollapsibleTrigger asChild>
- <Button
- variant={isSubmenuActive ? "menu-active" : "menu-inactive"}
- className={cn(
- isSidebarOpen ? "w-full justify-start" : "w-14 justify-center",
- )}
- >
- {isSidebarOpen ? (
- <div className="flex w-full items-center justify-between">
- <div className="flex items-center">
- <span className="mr-4">
- <Icon size={18} />
- </span>
- <p className="max-w-[150px] truncate">{label}</p>
- </div>
- <ChevronDown
- size={18}
- className="transition-transform duration-200 group-data-[state=open]:rotate-180"
- />
- </div>
- ) : (
- <Icon size={18} />
- )}
- </Button>
- </CollapsibleTrigger>
- </TooltipTrigger>
- {!isSidebarOpen && (
- <TooltipContent side="right">{label}</TooltipContent>
- )}
- </Tooltip>
- <CollapsibleContent className="data-[state=closed]:animate-collapsible-up data-[state=open]:animate-collapsible-down flex flex-col items-end overflow-hidden">
- {submenus.map((submenu, index) => (
- <SubmenuItem key={index} {...submenu} />
- ))}
- </CollapsibleContent>
- </Collapsible>
- );
-};
diff --git a/ui/components/ui/sidebar/index.ts b/ui/components/ui/sidebar/index.ts
deleted file mode 100644
index 6fe9b4c4e2..0000000000
--- a/ui/components/ui/sidebar/index.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-export * from "./collapsible-menu";
-export * from "./menu";
-export * from "./menu-item";
-export * from "./sheet-menu";
-export * from "./sidebar";
-export * from "./sidebar-toggle";
-export * from "./submenu-item";
diff --git a/ui/components/ui/sidebar/menu-item.tsx b/ui/components/ui/sidebar/menu-item.tsx
deleted file mode 100644
index 2f2bd1c7b8..0000000000
--- a/ui/components/ui/sidebar/menu-item.tsx
+++ /dev/null
@@ -1,83 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-
-import { Button } from "@/components/shadcn/button/button";
-import {
- Tooltip,
- TooltipContent,
- TooltipTrigger,
-} from "@/components/shadcn/tooltip";
-import { MenuFeatureBadge } from "@/components/shared/cloud-feature-badge";
-import { cn } from "@/lib/utils";
-import { IconComponent } from "@/types";
-
-interface MenuItemProps {
- href: string;
- label: string;
- icon: IconComponent;
- active?: boolean;
- target?: string;
- tooltip?: string;
- isOpen: boolean;
- highlight?: boolean;
-}
-
-export const MenuItem = ({
- href,
- label,
- icon: Icon,
- active,
- target,
- tooltip,
- isOpen,
- highlight,
-}: MenuItemProps) => {
- const pathname = usePathname();
- // Extract only the pathname from href (without query parameters) for comparison
- const hrefPathname = href.split("?")[0];
- const isActive =
- active !== undefined ? active : pathname.startsWith(hrefPathname);
-
- // Show tooltip always for Prowler Hub, or when sidebar is collapsed
- const showTooltip = label === "Prowler Hub" ? !!tooltip : !isOpen;
-
- return (
- <Tooltip delayDuration={100}>
- <TooltipTrigger asChild>
- <Button
- variant={isActive ? "menu-active" : "menu-inactive"}
- className={cn(
- isOpen ? "w-full justify-start" : "w-14 justify-center",
- )}
- asChild
- >
- <Link href={href} target={target}>
- <div className="flex items-center">
- <span className={cn(isOpen ? "mr-4" : "")}>
- <Icon size={18} />
- </span>
- {isOpen && (
- <p className="flex max-w-[200px] items-center truncate">
- <span>{label}</span>
- {highlight && (
- <MenuFeatureBadge
- label="New"
- variant="new"
- size="sm"
- className="ml-2"
- />
- )}
- </p>
- )}
- </div>
- </Link>
- </Button>
- </TooltipTrigger>
- {showTooltip && (
- <TooltipContent side="right">{tooltip || label}</TooltipContent>
- )}
- </Tooltip>
- );
-};
diff --git a/ui/components/ui/sidebar/menu.test.tsx b/ui/components/ui/sidebar/menu.test.tsx
deleted file mode 100644
index 100925a792..0000000000
--- a/ui/components/ui/sidebar/menu.test.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
-
-import { Menu } from "./menu";
-
-const { openLaunchScanModalMock, pathnameValue } = vi.hoisted(() => ({
- openLaunchScanModalMock: vi.fn(),
- pathnameValue: { current: "/findings" },
-}));
-
-vi.mock("next/navigation", () => ({
- usePathname: () => pathnameValue.current,
-}));
-
-vi.mock("@/hooks", () => ({
- useAuth: () => ({
- permissions: {},
- }),
-}));
-
-vi.mock("@/lib/menu-list", () => ({
- getMenuList: () => [],
-}));
-
-vi.mock("@/store", () => ({
- useScansStore: (
- selector: (state: { openLaunchScanModal: () => void }) => unknown,
- ) => selector({ openLaunchScanModal: openLaunchScanModalMock }),
-}));
-
-describe("Menu", () => {
- it("links scan to the scans page with the modal open", () => {
- pathnameValue.current = "/findings";
-
- render(<Menu isOpen />);
-
- const launchScanLink = screen.getByRole("link", { name: /launch scan/i });
- const launchScanWrapper = launchScanLink.closest("div.flex.shrink-0");
-
- expect(launchScanLink).toHaveAttribute("href", "/scans?launchScan=true");
- expect(launchScanWrapper).toHaveClass("flex", "justify-center");
- expect(launchScanLink).toHaveClass("h-14", "w-[180px]", "p-1");
- expect(launchScanLink).not.toHaveClass("h-8", "h-9", "h-10");
- expect(screen.getByText("Scan")).toHaveClass("text-xl", "leading-8");
- expect(screen.getByText("Scan")).not.toHaveClass("text-2xl", "font-bold");
- expect(
- launchScanLink.querySelector('svg[viewBox="0 0 432.08 396.77"]'),
- ).toBeInTheDocument();
- });
-
- it("opens the launch scan modal without navigation when already on scans", async () => {
- pathnameValue.current = "/scans";
-
- render(<Menu isOpen />);
-
- await screen.getByRole("button", { name: /launch scan/i }).click();
-
- expect(openLaunchScanModalMock).toHaveBeenCalledTimes(1);
- expect(
- screen.queryByRole("link", { name: /launch scan/i }),
- ).not.toBeInTheDocument();
- });
-
- it("shows the Prowler icon when the menu is collapsed", () => {
- pathnameValue.current = "/findings";
-
- render(<Menu isOpen={false} />);
-
- const launchScanLink = screen.getByRole("link", { name: /launch scan/i });
-
- expect(launchScanLink).toHaveClass("h-9", "w-14");
- expect(launchScanLink).not.toHaveClass("h-14");
- expect(
- launchScanLink.querySelector('svg[viewBox="0 0 432.08 396.77"]'),
- ).toBeInTheDocument();
- });
-});
diff --git a/ui/components/ui/sidebar/menu.tsx b/ui/components/ui/sidebar/menu.tsx
deleted file mode 100644
index c2ba5d6c28..0000000000
--- a/ui/components/ui/sidebar/menu.tsx
+++ /dev/null
@@ -1,201 +0,0 @@
-"use client";
-
-import { Divider } from "@heroui/divider";
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-
-import { InfoIcon, ProwlerShort } from "@/components/icons";
-import { Button } from "@/components/shadcn/button/button";
-import {
- Tooltip,
- TooltipContent,
- TooltipTrigger,
-} from "@/components/shadcn/tooltip";
-import { ScrollArea } from "@/components/ui/scroll-area/scroll-area";
-import { CollapsibleMenu } from "@/components/ui/sidebar/collapsible-menu";
-import { MenuItem } from "@/components/ui/sidebar/menu-item";
-import { useAuth } from "@/hooks";
-import { useRuntimeConfig } from "@/hooks/use-runtime-config";
-import { getMenuList } from "@/lib/menu-list";
-import { LAUNCH_SCAN_HREF } from "@/lib/scans-navigation";
-import { cn } from "@/lib/utils";
-import { useScansStore } from "@/store";
-import { GroupProps } from "@/types";
-import { RolePermissionAttributes } from "@/types/users";
-
-interface MenuHideRule {
- label: string;
- condition: (permissions: RolePermissionAttributes) => boolean;
-}
-
-const MENU_HIDE_RULES: MenuHideRule[] = [
- {
- label: "Billing",
- condition: (permissions) => permissions?.manage_billing === false,
- },
- {
- label: "Integrations",
- condition: (permissions) => permissions?.manage_integrations === false,
- },
-];
-
-const filterMenus = (menuGroups: GroupProps[], labelsToHide: string[]) => {
- return menuGroups
- .map((group) => ({
- ...group,
- menus: group.menus
- .filter((menu) => !labelsToHide.includes(menu.label))
- .map((menu) => ({
- ...menu,
- submenus: menu.submenus?.filter(
- (submenu) => !labelsToHide.includes(submenu.label),
- ),
- })),
- }))
- .filter((group) => group.menus.length > 0);
-};
-
-export const Menu = ({ isOpen }: { isOpen: boolean }) => {
- const pathname = usePathname();
- const { permissions } = useAuth();
- const openLaunchScanModal = useScansStore(
- (state) => state.openLaunchScanModal,
- );
- const isScansPage = pathname.startsWith("/scans");
- const { apiDocsUrl } = useRuntimeConfig();
-
- const menuList = getMenuList({
- pathname,
- apiDocsUrl,
- });
-
- const labelsToHide = MENU_HIDE_RULES.filter((rule) =>
- rule.condition(permissions),
- ).map((rule) => rule.label);
-
- const filteredMenuList = filterMenus(menuList, labelsToHide);
-
- return (
- <div className="flex h-full flex-col overflow-hidden">
- {/* Launch Scan Button */}
- <div className="flex shrink-0 justify-center px-2">
- <Tooltip delayDuration={100}>
- <TooltipTrigger asChild>
- {isScansPage ? (
- <Button
- type="button"
- aria-label="Launch Scan"
- className={cn(isOpen ? "h-14 w-[180px] p-1" : "w-14")}
- variant="default"
- size="default"
- onClick={openLaunchScanModal}
- >
- <LaunchScanButtonContent isOpen={isOpen} />
- </Button>
- ) : (
- <Button
- asChild
- className={cn(isOpen ? "h-14 w-[180px] p-1" : "w-14")}
- variant="default"
- size="default"
- >
- <Link href={LAUNCH_SCAN_HREF} aria-label="Launch Scan">
- <LaunchScanButtonContent isOpen={isOpen} />
- </Link>
- </Button>
- )}
- </TooltipTrigger>
- {!isOpen && <TooltipContent side="right">Launch Scan</TooltipContent>}
- </Tooltip>
- </div>
-
- {/* Menu Items */}
- <div className="flex-1 overflow-hidden">
- <ScrollArea className="h-full [&>div>div[style]]:block!">
- <nav className="mt-2 w-full lg:mt-6">
- <ul className="mx-2 flex flex-col items-start gap-1 pb-4">
- {filteredMenuList.map((group, groupIndex) => (
- <li key={groupIndex} className="w-full">
- {group.menus.map((menu, menuIndex) => (
- <div key={menuIndex} className="w-full">
- {menu.submenus && menu.submenus.length > 0 ? (
- <CollapsibleMenu
- icon={menu.icon}
- label={menu.label}
- submenus={menu.submenus}
- defaultOpen={menu.defaultOpen}
- isOpen={isOpen}
- />
- ) : (
- <MenuItem
- href={menu.href}
- label={menu.label}
- icon={menu.icon}
- active={menu.active}
- target={menu.target}
- tooltip={menu.tooltip}
- isOpen={isOpen}
- highlight={menu.highlight}
- />
- )}
- </div>
- ))}
- </li>
- ))}
- </ul>
- </nav>
- </ScrollArea>
- </div>
-
- {/* Footer */}
- <div className="text-muted-foreground border-border-neutral-secondary flex shrink-0 items-center justify-center gap-2 border-t pt-4 pb-2 text-center text-xs">
- {isOpen ? (
- <>
- <span>{process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION}</span>
- {process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true" && (
- <>
- <Divider orientation="vertical" />
- <Link
- href="https://status.prowler.com"
- target="_blank"
- rel="noopener noreferrer"
- className="flex items-center gap-1"
- >
- <InfoIcon size={16} />
- <span className="text-muted-foreground font-normal opacity-80 transition-opacity hover:font-bold hover:opacity-100">
- Service Status
- </span>
- </Link>
- </>
- )}
- </>
- ) : (
- process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true" && (
- <Tooltip>
- <TooltipTrigger asChild>
- <Link
- href="https://status.prowler.com"
- target="_blank"
- rel="noopener noreferrer"
- className="flex items-center"
- >
- <InfoIcon size={16} />
- </Link>
- </TooltipTrigger>
- <TooltipContent side="right">Service Status</TooltipContent>
- </Tooltip>
- )
- )}
- </div>
- </div>
- );
-};
-
-function LaunchScanButtonContent({ isOpen }: { isOpen: boolean }) {
- return (
- <span className={cn("flex items-center", isOpen && "gap-2.5")}>
- <ProwlerShort aria-hidden="true" className="size-5 text-current" />
- {isOpen && <span className="text-xl leading-8">Scan</span>}
- </span>
- );
-}
diff --git a/ui/components/ui/sidebar/sheet-menu.tsx b/ui/components/ui/sidebar/sheet-menu.tsx
deleted file mode 100644
index 05a3ebb09d..0000000000
--- a/ui/components/ui/sidebar/sheet-menu.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import { MenuIcon } from "lucide-react";
-import Link from "next/link";
-
-import { ProwlerExtended } from "@/components/icons";
-import {
- Sheet,
- SheetContent,
- SheetDescription,
- SheetHeader,
- SheetTitle,
- SheetTrigger,
-} from "@/components/ui/sheet";
-import { Menu } from "@/components/ui/sidebar/menu";
-
-import { Button } from "../button/button";
-
-export function SheetMenu() {
- return (
- <Sheet>
- <SheetTrigger className="lg:hidden" asChild>
- <Button className="h-8" variant="outline" size="icon">
- <MenuIcon size={20} />
- </Button>
- </SheetTrigger>
- <SheetContent className="flex h-full flex-col px-3 sm:w-72" side="left">
- <SheetHeader>
- <SheetTitle className="sr-only">Sidebar</SheetTitle>
- <SheetDescription className="sr-only" />
- <Button
- className="flex items-center justify-center pt-1 pb-2"
- variant="link"
- asChild
- >
- <Link href="/" className="flex items-center gap-2">
- <ProwlerExtended />
- </Link>
- </Button>
- </SheetHeader>
- <Menu isOpen />
- </SheetContent>
- </Sheet>
- );
-}
diff --git a/ui/components/ui/sidebar/sidebar-toggle.tsx b/ui/components/ui/sidebar/sidebar-toggle.tsx
deleted file mode 100644
index 27e1fdab27..0000000000
--- a/ui/components/ui/sidebar/sidebar-toggle.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import { ChevronLeft, ChevronRight } from "lucide-react";
-
-import { Button } from "@/components/shadcn/button/button";
-import {
- Tooltip,
- TooltipContent,
- TooltipTrigger,
-} from "@/components/shadcn/tooltip";
-
-interface SidebarToggleProps {
- isOpen: boolean | undefined;
- setIsOpen?: () => void;
-}
-
-export function SidebarToggle({ isOpen, setIsOpen }: SidebarToggleProps) {
- // Closed → chevron right (will open); open/undefined → chevron left (will collapse).
- const isClosed = isOpen === false;
- const Chevron = isClosed ? ChevronRight : ChevronLeft;
-
- return (
- <Tooltip>
- <TooltipTrigger asChild>
- <Button
- type="button"
- variant="bare"
- size="icon-sm"
- onClick={() => setIsOpen?.()}
- aria-label={isClosed ? "Expand sidebar" : "Collapse sidebar"}
- >
- <Chevron className="size-5" />
- </Button>
- </TooltipTrigger>
- <TooltipContent side="bottom">
- {isClosed ? "Expand Sidebar" : "Collapse Sidebar"}
- </TooltipContent>
- </Tooltip>
- );
-}
diff --git a/ui/components/ui/sidebar/sidebar.tsx b/ui/components/ui/sidebar/sidebar.tsx
deleted file mode 100644
index cf1baea4b4..0000000000
--- a/ui/components/ui/sidebar/sidebar.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-"use client";
-
-import clsx from "clsx";
-import Link from "next/link";
-
-import { ProwlerShort } from "@/components/icons";
-import { ProwlerExtended } from "@/components/icons";
-import { useSidebar } from "@/hooks/use-sidebar";
-import { useStore } from "@/hooks/use-store";
-import { cn } from "@/lib/utils";
-
-import { Button } from "../button/button";
-import { Menu } from "./menu";
-
-export function Sidebar() {
- const sidebar = useStore(useSidebar, (x) => x);
- if (!sidebar) return null;
- const { isOpen, getOpenState, setIsHover, settings } = sidebar;
- return (
- <aside
- className={cn(
- "fixed top-0 left-0 z-20 h-screen -translate-x-full transition-[width] duration-300 ease-in-out lg:translate-x-0",
- !getOpenState() ? "w-[90px]" : "w-[248px]",
- settings.disabled && "hidden",
- )}
- >
- <div
- onMouseEnter={() => setIsHover(true)}
- onMouseLeave={() => setIsHover(false)}
- className="no-scrollbar relative flex h-full flex-col overflow-x-hidden overflow-y-auto px-3 py-6"
- >
- <Button
- className={cn(
- "mb-1 transition-transform duration-300 ease-in-out",
- !getOpenState() ? "translate-x-1" : "translate-x-0",
- )}
- variant="link"
- asChild
- >
- <Link
- href="/"
- className={clsx(
- "mb-6 flex w-full flex-col items-center justify-center px-3",
- {
- "gap-0": !isOpen,
- },
- )}
- >
- <div
- className={clsx({
- hidden: isOpen,
- })}
- >
- <ProwlerShort />
- </div>
- <div
- className={clsx({
- hidden: !isOpen,
- "mt-0!": isOpen,
- })}
- >
- <ProwlerExtended />
- </div>
- </Link>
- </Button>
-
- <Menu isOpen={getOpenState()} />
- </div>
- </aside>
- );
-}
diff --git a/ui/components/ui/sidebar/submenu-item.test.tsx b/ui/components/ui/sidebar/submenu-item.test.tsx
deleted file mode 100644
index cde10cd007..0000000000
--- a/ui/components/ui/sidebar/submenu-item.test.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-import { render, screen } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { describe, expect, it, vi } from "vitest";
-
-import { SubmenuItem } from "./submenu-item";
-
-vi.mock("next/navigation", () => ({
- usePathname: () => "/",
-}));
-
-const TestIcon = ({ size = 16 }: { size?: number }) => (
- <svg aria-hidden="true" height={size} width={size} />
-);
-
-describe("SubmenuItem", () => {
- it("should show the cloud-only tooltip for disabled cloud menu items", async () => {
- // Given
- const user = userEvent.setup();
- render(
- <SubmenuItem
- href="/alerts"
- label="Alerts"
- icon={TestIcon}
- disabled
- highlight
- cloudOnly
- />,
- );
-
- // When
- const button = screen.getByRole("button", { name: /alerts/i });
- expect(button).toHaveAttribute("aria-disabled", "true");
- expect(button).toHaveClass(
- "cursor-not-allowed",
- "text-text-neutral-tertiary",
- );
- await user.hover(button.parentElement as HTMLElement);
-
- // Then
- expect(screen.getByText("New")).toHaveClass("h-5", "text-[10px]");
- expect(screen.queryByText("Cloud")).not.toBeInTheDocument();
- expect(
- await screen.findAllByText("Available in Prowler Cloud"),
- ).not.toHaveLength(0);
- });
-});
diff --git a/ui/components/ui/sidebar/submenu-item.tsx b/ui/components/ui/sidebar/submenu-item.tsx
deleted file mode 100644
index 2767381ff0..0000000000
--- a/ui/components/ui/sidebar/submenu-item.tsx
+++ /dev/null
@@ -1,130 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-import { type MouseEvent } from "react";
-
-import { Button } from "@/components/shadcn/button/button";
-import {
- Tooltip,
- TooltipContent,
- TooltipTrigger,
-} from "@/components/shadcn/tooltip";
-import { MenuFeatureBadge } from "@/components/shared/cloud-feature-badge";
-import { IconComponent } from "@/types";
-
-interface SubmenuItemProps {
- href: string;
- label: string;
- icon: IconComponent;
- active?: boolean;
- target?: string;
- disabled?: boolean;
- highlight?: boolean;
- cloudOnly?: boolean;
- onClick?: (event: MouseEvent<HTMLAnchorElement>) => void;
-}
-
-export const SubmenuItem = ({
- href,
- label,
- icon: Icon,
- active,
- target,
- disabled,
- highlight,
- cloudOnly,
- onClick,
-}: SubmenuItemProps) => {
- const pathname = usePathname();
- const isActive = active !== undefined ? active : pathname === href;
-
- // Special case: Mutelist with tooltip when disabled
- if (disabled && label === "Mutelist") {
- return (
- <Tooltip>
- <TooltipTrigger asChild>
- <Button
- className="pointer-events-none mt-1 w-[calc(100%-12px)] cursor-not-allowed justify-start px-2 py-1"
- disabled
- >
- <span className="mr-2">
- <Icon size={16} />
- </span>
- <p className="min-w-0 truncate">{label}</p>
- </Button>
- </TooltipTrigger>
- <TooltipContent side="right">
- The mutelist will be enabled after adding a provider
- </TooltipContent>
- </Tooltip>
- );
- }
-
- if (disabled) {
- const tooltip = cloudOnly
- ? "Available in Prowler Cloud"
- : `${label} is unavailable.`;
-
- return (
- <Tooltip>
- <TooltipTrigger asChild>
- <span
- className="group mt-1 inline-flex w-[calc(100%-12px)]"
- tabIndex={0}
- >
- <Button
- variant="menu-inactive"
- className="text-text-neutral-tertiary w-full cursor-not-allowed justify-start px-2 py-1"
- aria-disabled="true"
- tabIndex={-1}
- type="button"
- >
- <span className="mr-2">
- <Icon size={16} />
- </span>
- <p className="flex min-w-0 items-center gap-2">
- <span className="truncate">{label}</span>
- {highlight && (
- <MenuFeatureBadge label="New" variant="new" size="sm" />
- )}
- </p>
- </Button>
- </span>
- </TooltipTrigger>
- <TooltipContent side="right">{tooltip}</TooltipContent>
- </Tooltip>
- );
- }
-
- return (
- <Button
- variant={isActive ? "menu-active" : "menu-inactive"}
- className="mt-1 w-[calc(100%-12px)] justify-start px-2 py-1"
- asChild={!disabled}
- disabled={disabled}
- >
- <Link
- href={href}
- target={target}
- className="flex items-center"
- onClick={onClick}
- >
- <span className="mr-2">
- <Icon size={16} />
- </span>
- <p className="flex min-w-0 items-center">
- <span className="truncate">{label}</span>
- {highlight && (
- <MenuFeatureBadge
- label="New"
- variant="new"
- size="sm"
- className="ml-2"
- />
- )}
- </p>
- </Link>
- </Button>
- );
-};
diff --git a/ui/components/ui/skeleton/skeleton.tsx b/ui/components/ui/skeleton/skeleton.tsx
index 54058436b7..361bf53ab0 100644
--- a/ui/components/ui/skeleton/skeleton.tsx
+++ b/ui/components/ui/skeleton/skeleton.tsx
@@ -39,7 +39,7 @@ export function Skeleton({
: undefined,
}}
className={cn(
- "dark:bg-prowler-blue-800 animate-pulse bg-gray-200",
+ "bg-border-neutral-tertiary animate-pulse",
variantClasses[variant],
!animate && "animate-none",
className,
diff --git a/ui/components/ui/table/index.ts b/ui/components/ui/table/index.ts
index 908c1bb9d3..2e60275a8d 100644
--- a/ui/components/ui/table/index.ts
+++ b/ui/components/ui/table/index.ts
@@ -1,9 +1,3 @@
-export * from "./data-table";
-export * from "./data-table-column-header";
-export * from "./data-table-filter-custom";
-export * from "./data-table-pagination";
-export * from "./data-table-search";
-export * from "./severity-badge";
-export * from "./status-badge";
-export * from "./status-finding-badge";
-export * from "./table";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/table";
diff --git a/ui/components/ui/table/status-finding-badge.tsx b/ui/components/ui/table/status-finding-badge.tsx
deleted file mode 100644
index 4dd53b8692..0000000000
--- a/ui/components/ui/table/status-finding-badge.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-import { cn } from "@/lib/utils";
-
-export const FindingStatusValues = {
- FAIL: "FAIL",
- PASS: "PASS",
- MANUAL: "MANUAL",
- MUTED: "MUTED",
-} as const;
-
-export type FindingStatus =
- (typeof FindingStatusValues)[keyof typeof FindingStatusValues];
-
-const STATUS_STYLES = {
- FAIL: "border-bg-fail text-bg-fail",
- PASS: "border-bg-pass text-bg-pass",
- MANUAL: "border-bg-warning text-bg-warning",
- MUTED: "border-text-neutral-tertiary text-text-neutral-tertiary",
-} as const;
-
-interface StatusFindingBadgeProps {
- status: FindingStatus;
- size?: "sm" | "md" | "lg";
- value?: string | number;
-}
-
-export const StatusFindingBadge = ({
- status,
- value,
-}: StatusFindingBadgeProps) => {
- const statusStyle = STATUS_STYLES[status] || STATUS_STYLES.MUTED;
- const displayText =
- status.charAt(0).toUpperCase() + status.slice(1).toLowerCase();
-
- return (
- <span
- className={cn(
- "inline-flex items-center justify-center rounded px-0 py-0.5",
- "border-x border-y-0",
- "min-w-[38px] text-center text-xs font-bold",
- statusStyle,
- )}
- >
- {displayText}
- {value !== undefined && `: ${value}`}
- </span>
- );
-};
diff --git a/ui/components/ui/toast/index.ts b/ui/components/ui/toast/index.ts
index d21acc2dc6..5b12c318c7 100644
--- a/ui/components/ui/toast/index.ts
+++ b/ui/components/ui/toast/index.ts
@@ -1,3 +1,3 @@
-export * from "./Toast";
-export * from "./Toaster";
-export * from "./use-toast";
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/shadcn/toast";
diff --git a/ui/components/ui/tooltip/tooltip.tsx b/ui/components/ui/tooltip/tooltip.tsx
index 7cebfc4a44..e1d2c5a24d 100644
--- a/ui/components/ui/tooltip/tooltip.tsx
+++ b/ui/components/ui/tooltip/tooltip.tsx
@@ -19,7 +19,7 @@ const TooltipContent = React.forwardRef<
ref={ref}
sideOffset={sideOffset}
className={cn(
- "bg-bg-neutral-secondary text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 overflow-hidden rounded-md px-3 py-1.5 text-xs",
+ "bg-bg-neutral-secondary text-text-neutral-primary animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 overflow-hidden rounded-md px-3 py-1.5 text-xs",
className,
)}
{...props}
diff --git a/ui/components/ui/user-nav/index.ts b/ui/components/ui/user-nav/index.ts
new file mode 100644
index 0000000000..b42944574e
--- /dev/null
+++ b/ui/components/ui/user-nav/index.ts
@@ -0,0 +1,3 @@
+// Temporary re-export shim for prowler-cloud overlay imports.
+// Remove after the cloud repo migrates to @/components/shadcn paths.
+export * from "@/components/layout/user-nav";
diff --git a/ui/components/users/forms/create-tenant-form.test.tsx b/ui/components/users/forms/create-tenant-form.test.tsx
index 0da2677949..d473c230ca 100644
--- a/ui/components/users/forms/create-tenant-form.test.tsx
+++ b/ui/components/users/forms/create-tenant-form.test.tsx
@@ -19,7 +19,8 @@ vi.mock("@/actions/users/tenants", () => ({
}));
const mockToast = vi.fn();
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: mockToast }),
}));
diff --git a/ui/components/users/forms/create-tenant-form.tsx b/ui/components/users/forms/create-tenant-form.tsx
index ba883022c2..1b685a64ff 100644
--- a/ui/components/users/forms/create-tenant-form.tsx
+++ b/ui/components/users/forms/create-tenant-form.tsx
@@ -8,9 +8,9 @@ import {
switchTenant,
SwitchTenantState,
} from "@/actions/users/tenants";
-import { useToast } from "@/components/ui";
-import { CustomServerInput } from "@/components/ui/custom";
-import { FormButtons } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { CustomServerInput } from "@/components/shadcn/custom";
+import { FormButtons } from "@/components/shadcn/form";
import { reloadPage } from "@/lib/navigation";
export const CreateTenantForm = ({
diff --git a/ui/components/users/forms/delete-form.tsx b/ui/components/users/forms/delete-form.tsx
index 8ea6dd4ab1..9a86efed8e 100644
--- a/ui/components/users/forms/delete-form.tsx
+++ b/ui/components/users/forms/delete-form.tsx
@@ -8,8 +8,8 @@ import * as z from "zod";
import { deleteUser } from "@/actions/users/users";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
-import { Form } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { Form } from "@/components/shadcn/form";
const formSchema = z.object({
userId: z.string(),
diff --git a/ui/components/users/forms/delete-tenant-form.test.tsx b/ui/components/users/forms/delete-tenant-form.test.tsx
index d92134f99e..17ad35e38f 100644
--- a/ui/components/users/forms/delete-tenant-form.test.tsx
+++ b/ui/components/users/forms/delete-tenant-form.test.tsx
@@ -1,7 +1,9 @@
-import { render, screen } from "@testing-library/react";
+import { render, screen, waitFor } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
import { describe, expect, it, vi } from "vitest";
+import { deleteTenantThenSignOut } from "@/actions/users/tenants";
+
import { DeleteTenantForm } from "./delete-tenant-form";
const mockUpdate = vi.fn();
@@ -15,12 +17,14 @@ vi.mock("@/auth.config", () => ({
vi.mock("@/actions/users/tenants", () => ({
deleteTenant: vi.fn(),
+ deleteTenantThenSignOut: vi.fn(),
switchTenant: vi.fn(),
switchThenDeleteTenant: vi.fn(),
}));
const mockToast = vi.fn();
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: mockToast }),
}));
@@ -28,6 +32,7 @@ const baseProps = {
tenantId: "tenant-1",
tenantName: "My Organization",
isActiveTenant: false,
+ isLastTenant: false,
availableTenants: [{ id: "tenant-2", name: "Other Org" }],
setIsOpen: vi.fn(),
};
@@ -87,4 +92,119 @@ describe("DeleteTenantForm", () => {
await user.click(screen.getByRole("button", { name: /cancel/i }));
expect(baseProps.setIsOpen).toHaveBeenCalledWith(false);
});
+
+ it("shows last-tenant warning and no target select when isLastTenant", () => {
+ render(
+ <DeleteTenantForm
+ {...baseProps}
+ isActiveTenant={true}
+ isLastTenant={true}
+ availableTenants={[]}
+ />,
+ );
+ expect(screen.getByText(/close your session/i)).toBeInTheDocument();
+ expect(
+ screen.queryByText(/switch to after deletion/i),
+ ).not.toBeInTheDocument();
+ });
+
+ it("last-tenant submit enables with name only and calls the delete-and-sign-out action", async () => {
+ const user = userEvent.setup();
+ // The action redirects server-side on success, so the promise never
+ // resolves with a value in the real flow; a NEXT_REDIRECT rejection is
+ // the closest observable behavior.
+ vi.mocked(deleteTenantThenSignOut).mockRejectedValue({
+ digest: "NEXT_REDIRECT;replace;/sign-in;303;",
+ });
+
+ render(
+ <DeleteTenantForm
+ {...baseProps}
+ isActiveTenant={true}
+ isLastTenant={true}
+ availableTenants={[]}
+ />,
+ );
+
+ const submitBtn = screen.getByRole("button", { name: /delete/i });
+ expect(submitBtn).toBeDisabled();
+
+ await user.type(
+ screen.getByPlaceholderText("My Organization"),
+ "My Organization",
+ );
+ expect(submitBtn).toBeEnabled();
+
+ await user.click(submitBtn);
+
+ await waitFor(() => {
+ expect(deleteTenantThenSignOut).toHaveBeenCalled();
+ });
+ // A redirect is not a failure: no error toast
+ expect(mockToast).not.toHaveBeenCalledWith(
+ expect.objectContaining({ variant: "destructive" }),
+ );
+ });
+
+ it("last-tenant submit shows error and re-enables when delete fails", async () => {
+ const user = userEvent.setup();
+ vi.mocked(deleteTenantThenSignOut).mockResolvedValue({
+ error: "Delete failed",
+ });
+
+ render(
+ <DeleteTenantForm
+ {...baseProps}
+ isActiveTenant={true}
+ isLastTenant={true}
+ availableTenants={[]}
+ />,
+ );
+
+ await user.type(
+ screen.getByPlaceholderText("My Organization"),
+ "My Organization",
+ );
+ await user.click(screen.getByRole("button", { name: /delete/i }));
+
+ await waitFor(() => {
+ expect(mockToast).toHaveBeenCalledWith(
+ expect.objectContaining({
+ variant: "destructive",
+ description: "Delete failed",
+ }),
+ );
+ });
+ // Submitting state is reset so the user is not stuck on a disabled button
+ expect(screen.getByRole("button", { name: /delete/i })).toBeEnabled();
+ });
+
+ it("last-tenant submit recovers when the action call itself fails", async () => {
+ const user = userEvent.setup();
+ vi.mocked(deleteTenantThenSignOut).mockRejectedValue(
+ new Error("network error"),
+ );
+
+ render(
+ <DeleteTenantForm
+ {...baseProps}
+ isActiveTenant={true}
+ isLastTenant={true}
+ availableTenants={[]}
+ />,
+ );
+
+ await user.type(
+ screen.getByPlaceholderText("My Organization"),
+ "My Organization",
+ );
+ await user.click(screen.getByRole("button", { name: /delete/i }));
+
+ await waitFor(() => {
+ expect(mockToast).toHaveBeenCalledWith(
+ expect.objectContaining({ variant: "destructive" }),
+ );
+ });
+ expect(screen.getByRole("button", { name: /delete/i })).toBeEnabled();
+ });
});
diff --git a/ui/components/users/forms/delete-tenant-form.tsx b/ui/components/users/forms/delete-tenant-form.tsx
index 79bbc7f0bc..d7a3a0af6d 100644
--- a/ui/components/users/forms/delete-tenant-form.tsx
+++ b/ui/components/users/forms/delete-tenant-form.tsx
@@ -10,7 +10,13 @@ import {
useState,
} from "react";
-import { deleteTenant, switchThenDeleteTenant } from "@/actions/users/tenants";
+import {
+ deleteTenant,
+ deleteTenantThenSignOut,
+ switchThenDeleteTenant,
+} from "@/actions/users/tenants";
+import { useToast } from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
import { Input } from "@/components/shadcn/input/input";
import {
Select,
@@ -19,8 +25,6 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn/select/select";
-import { useToast } from "@/components/ui";
-import { FormButtons } from "@/components/ui/form";
import { reloadPage } from "@/lib/navigation";
import { TenantOption } from "@/types/users";
@@ -28,6 +32,7 @@ interface DeleteTenantFormProps {
tenantId: string;
tenantName: string;
isActiveTenant: boolean;
+ isLastTenant: boolean;
availableTenants: TenantOption[];
setIsOpen: Dispatch<SetStateAction<boolean>>;
}
@@ -36,6 +41,7 @@ export const DeleteTenantForm = ({
tenantId,
tenantName,
isActiveTenant,
+ isLastTenant,
availableTenants,
setIsOpen,
}: DeleteTenantFormProps) => {
@@ -48,7 +54,10 @@ export const DeleteTenantForm = ({
const [isSubmitting, setIsSubmitting] = useState(false);
const nameMatches = confirmName === tenantName;
- const canSubmit = isActiveTenant
+ // Deleting the last tenant needs no switch target — there is nothing to
+ // switch to; the session is closed after deletion instead.
+ const needsSwitchTarget = isActiveTenant && !isLastTenant;
+ const canSubmit = needsSwitchTarget
? nameMatches && targetTenantId !== ""
: nameMatches;
@@ -71,6 +80,44 @@ export const DeleteTenantForm = ({
// eslint-disable-next-line react-hooks/exhaustive-deps
}, [deleteState]);
+ // Handle last-tenant delete: a single server action deletes the tenant and
+ // closes the session, since the API also removes users whose only tenant
+ // was the deleted one. On success it redirects to /sign-in server-side.
+ const handleLastTenantDelete = async (e: FormEvent<HTMLFormElement>) => {
+ e.preventDefault();
+ setIsSubmitting(true);
+
+ const formData = new FormData(e.currentTarget);
+
+ try {
+ const result = await deleteTenantThenSignOut(null, formData);
+ if (result && "error" in result) {
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: result.error,
+ });
+ setIsSubmitting(false);
+ }
+ } catch (error) {
+ // The action redirects by throwing NEXT_REDIRECT — never a failure.
+ if (
+ error &&
+ typeof error === "object" &&
+ "digest" in error &&
+ String(error.digest).startsWith("NEXT_REDIRECT")
+ ) {
+ return;
+ }
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: "The organization could not be deleted. Please try again.",
+ });
+ setIsSubmitting(false);
+ }
+ };
+
// Handle active-tenant delete: call server action directly to avoid
// React's RSC reconciliation unmounting this component before we can
// update the session with the new tokens.
@@ -115,12 +162,18 @@ export const DeleteTenantForm = ({
return (
<form
- action={isActiveTenant ? undefined : deleteFormAction}
- onSubmit={isActiveTenant ? handleActiveTenantDelete : undefined}
+ action={isActiveTenant || isLastTenant ? undefined : deleteFormAction}
+ onSubmit={
+ isLastTenant
+ ? handleLastTenantDelete
+ : isActiveTenant
+ ? handleActiveTenantDelete
+ : undefined
+ }
className="flex flex-col gap-4"
>
<input type="hidden" name="tenantId" value={tenantId} />
- {isActiveTenant && targetTenantId && (
+ {needsSwitchTarget && targetTenantId && (
<input type="hidden" name="targetTenantId" value={targetTenantId} />
)}
@@ -137,7 +190,14 @@ export const DeleteTenantForm = ({
autoComplete="off"
/>
- {isActiveTenant && (
+ {isLastTenant && (
+ <div className="text-text-error-primary text-sm">
+ This is your only organization. Deleting it will also remove your user
+ account and close your session.
+ </div>
+ )}
+
+ {needsSwitchTarget && (
<div className="flex flex-col gap-2">
<div className="text-sm">
This is your active organization. Select which organization to
diff --git a/ui/components/users/forms/edit-form.tsx b/ui/components/users/forms/edit-form.tsx
index 26b94f518d..362ec3088e 100644
--- a/ui/components/users/forms/edit-form.tsx
+++ b/ui/components/users/forms/edit-form.tsx
@@ -8,6 +8,9 @@ import * as z from "zod";
import { updateUser, updateUserRole } from "@/actions/users/users";
import { Card } from "@/components/shadcn";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form, FormButtons } from "@/components/shadcn/form";
import {
Select,
SelectContent,
@@ -15,9 +18,6 @@ import {
SelectTrigger,
SelectValue,
} from "@/components/shadcn/select/select";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
import { editUserFormSchema } from "@/types";
export const EditForm = ({
@@ -121,12 +121,12 @@ export const EditForm = ({
variant="inner"
className="flex flex-row items-center justify-center gap-4"
>
- <div className="text-small flex items-center">
+ <div className="flex items-center text-sm">
<UserIcon className="mr-2 h-4 w-4" />
<span className="text-text-neutral-secondary">Name:</span>
<span className="ml-2 font-semibold">{userName}</span>
</div>
- <div className="text-small flex items-center">
+ <div className="flex items-center text-sm">
<ShieldIcon className="mr-2 h-4 w-4" />
<span className="text-text-neutral-secondary">Role:</span>
<span className="ml-2 font-semibold">
diff --git a/ui/components/users/forms/edit-tenant-form.tsx b/ui/components/users/forms/edit-tenant-form.tsx
index 6854363b39..a35fc38362 100644
--- a/ui/components/users/forms/edit-tenant-form.tsx
+++ b/ui/components/users/forms/edit-tenant-form.tsx
@@ -3,9 +3,9 @@
import { Dispatch, SetStateAction, useActionState, useEffect } from "react";
import { updateTenantName } from "@/actions/users/tenants";
-import { useToast } from "@/components/ui";
-import { CustomServerInput } from "@/components/ui/custom";
-import { FormButtons } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { CustomServerInput } from "@/components/shadcn/custom";
+import { FormButtons } from "@/components/shadcn/form";
export const EditTenantForm = ({
tenantId,
diff --git a/ui/components/users/forms/expel-user-form.tsx b/ui/components/users/forms/expel-user-form.tsx
index 0e9b375147..d333b1ab49 100644
--- a/ui/components/users/forms/expel-user-form.tsx
+++ b/ui/components/users/forms/expel-user-form.tsx
@@ -5,7 +5,7 @@ import { Dispatch, SetStateAction, useTransition } from "react";
import { removeUserFromTenant } from "@/actions/users/users";
import { DeleteIcon } from "@/components/icons";
import { Button } from "@/components/shadcn";
-import { useToast } from "@/components/ui";
+import { useToast } from "@/components/shadcn";
interface ExpelUserFormProps {
userId: string;
diff --git a/ui/components/users/forms/switch-tenant-form.test.tsx b/ui/components/users/forms/switch-tenant-form.test.tsx
index 95ef443509..018e55b7ae 100644
--- a/ui/components/users/forms/switch-tenant-form.test.tsx
+++ b/ui/components/users/forms/switch-tenant-form.test.tsx
@@ -14,7 +14,8 @@ vi.mock("@/actions/users/tenants", () => ({
}));
const mockToast = vi.fn();
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
useToast: () => ({ toast: mockToast }),
}));
diff --git a/ui/components/users/forms/switch-tenant-form.tsx b/ui/components/users/forms/switch-tenant-form.tsx
index a48b462876..b518ebd5bf 100644
--- a/ui/components/users/forms/switch-tenant-form.tsx
+++ b/ui/components/users/forms/switch-tenant-form.tsx
@@ -4,8 +4,8 @@ import { useSession } from "next-auth/react";
import { Dispatch, SetStateAction, useActionState, useEffect } from "react";
import { switchTenant } from "@/actions/users/tenants";
-import { useToast } from "@/components/ui";
-import { FormButtons } from "@/components/ui/form";
+import { useToast } from "@/components/shadcn";
+import { FormButtons } from "@/components/shadcn/form";
import { reloadPage } from "@/lib/navigation";
export const SwitchTenantForm = ({
diff --git a/ui/components/users/profile/api-key-success-modal.tsx b/ui/components/users/profile/api-key-success-modal.tsx
index ee170b3738..d6c0aed8de 100644
--- a/ui/components/users/profile/api-key-success-modal.tsx
+++ b/ui/components/users/profile/api-key-success-modal.tsx
@@ -1,9 +1,11 @@
"use client";
+import { AlertTriangle } from "lucide-react";
+
import { Button } from "@/components/shadcn";
+import { Alert, AlertDescription } from "@/components/shadcn/alert";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
import { Modal } from "@/components/shadcn/modal";
-import { Alert, AlertDescription } from "@/components/ui/alert/Alert";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
interface ApiKeySuccessModalProps {
isOpen: boolean;
@@ -23,7 +25,8 @@ export const ApiKeySuccessModal = ({
title="API Key Created Successfully"
>
<div className="flex flex-col gap-6">
- <Alert variant="destructive">
+ <Alert variant="error">
+ <AlertTriangle />
<AlertDescription>
This is the only time you will see this API key. Please copy it now
and store it securely. Once you close this dialog, the key cannot be
diff --git a/ui/components/users/profile/api-keys-card-client.tsx b/ui/components/users/profile/api-keys-card-client.tsx
index fae6a2fbdc..0adc0c405a 100644
--- a/ui/components/users/profile/api-keys-card-client.tsx
+++ b/ui/components/users/profile/api-keys-card-client.tsx
@@ -1,6 +1,5 @@
"use client";
-import { useDisclosure } from "@heroui/use-disclosure";
import { useRouter } from "next/navigation";
import { useState } from "react";
@@ -12,8 +11,8 @@ import {
CardHeader,
CardTitle,
} from "@/components/shadcn";
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { DataTable } from "@/components/ui/table";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { DataTable } from "@/components/shadcn/table";
import { MetaDataProps } from "@/types";
import { ApiKeySuccessModal } from "./api-key-success-modal";
@@ -38,14 +37,14 @@ export const ApiKeysCardClient = ({
);
const [createdApiKey, setCreatedApiKey] = useState<string | null>(null);
- const createModal = useDisclosure();
- const successModal = useDisclosure();
- const revokeModal = useDisclosure();
- const editModal = useDisclosure();
+ const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
+ const [isSuccessModalOpen, setIsSuccessModalOpen] = useState(false);
+ const [isRevokeModalOpen, setIsRevokeModalOpen] = useState(false);
+ const [isEditModalOpen, setIsEditModalOpen] = useState(false);
const handleCreateSuccess = (apiKey: string) => {
setCreatedApiKey(apiKey);
- successModal.onOpen();
+ setIsSuccessModalOpen(true);
router.refresh();
};
@@ -59,19 +58,19 @@ export const ApiKeysCardClient = ({
const handleRevokeClick = (apiKey: EnrichedApiKey) => {
setSelectedApiKey(apiKey);
- revokeModal.onOpen();
+ setIsRevokeModalOpen(true);
};
const handleEditClick = (apiKey: EnrichedApiKey) => {
setSelectedApiKey(apiKey);
- editModal.onOpen();
+ setIsEditModalOpen(true);
};
const columns = createApiKeyColumns(handleEditClick, handleRevokeClick);
return (
<>
- <Card variant="base" padding="none" className="p-4">
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
<CardHeader>
<div className="flex flex-col gap-2">
<CardTitle>API Keys</CardTitle>
@@ -83,7 +82,11 @@ export const ApiKeysCardClient = ({
</p>
</div>
<CardAction>
- <Button variant="default" size="sm" onClick={createModal.onOpen}>
+ <Button
+ variant="default"
+ size="sm"
+ onClick={() => setIsCreateModalOpen(true)}
+ >
Create API Key
</Button>
</CardAction>
@@ -105,29 +108,29 @@ export const ApiKeysCardClient = ({
{/* Modals */}
<CreateApiKeyModal
- isOpen={createModal.isOpen}
- onClose={createModal.onClose}
+ isOpen={isCreateModalOpen}
+ onClose={() => setIsCreateModalOpen(false)}
onSuccess={handleCreateSuccess}
/>
{createdApiKey && (
<ApiKeySuccessModal
- isOpen={successModal.isOpen}
- onClose={successModal.onClose}
+ isOpen={isSuccessModalOpen}
+ onClose={() => setIsSuccessModalOpen(false)}
apiKey={createdApiKey}
/>
)}
<RevokeApiKeyModal
- isOpen={revokeModal.isOpen}
- onClose={revokeModal.onClose}
+ isOpen={isRevokeModalOpen}
+ onClose={() => setIsRevokeModalOpen(false)}
apiKey={selectedApiKey}
onSuccess={handleRevokeSuccess}
/>
<EditApiKeyNameModal
- isOpen={editModal.isOpen}
- onClose={editModal.onClose}
+ isOpen={isEditModalOpen}
+ onClose={() => setIsEditModalOpen(false)}
apiKey={selectedApiKey}
onSuccess={handleEditSuccess}
existingApiKeys={initialApiKeys}
diff --git a/ui/components/users/profile/api-keys/column-api-keys.tsx b/ui/components/users/profile/api-keys/column-api-keys.tsx
index f812890aab..3d24fddaaa 100644
--- a/ui/components/users/profile/api-keys/column-api-keys.tsx
+++ b/ui/components/users/profile/api-keys/column-api-keys.tsx
@@ -2,7 +2,7 @@
import { ColumnDef } from "@tanstack/react-table";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { DataTableRowActions } from "./data-table-row-actions";
import {
diff --git a/ui/components/users/profile/api-keys/table-cells.test.tsx b/ui/components/users/profile/api-keys/table-cells.test.tsx
new file mode 100644
index 0000000000..a7d61d318f
--- /dev/null
+++ b/ui/components/users/profile/api-keys/table-cells.test.tsx
@@ -0,0 +1,60 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it } from "vitest";
+
+import { DateCell, NameCell } from "./table-cells";
+import type { EnrichedApiKey } from "./types";
+
+const apiKey: EnrichedApiKey = {
+ type: "api-keys",
+ id: "api-key-1",
+ attributes: {
+ name: "Production access key with a very long human readable name",
+ prefix: "pk_12345678",
+ expires_at: "2099-01-01T00:00:00Z",
+ revoked: false,
+ inserted_at: "2026-01-01T00:00:00Z",
+ last_used_at: null,
+ },
+ relationships: {
+ entity: {
+ data: {
+ type: "users",
+ id: "user-1",
+ },
+ },
+ },
+ userEmail: "user@example.com",
+};
+
+describe("NameCell", () => {
+ it("keeps long API key names on one line with a tooltip", async () => {
+ // Given - A long API key name
+ const user = userEvent.setup();
+
+ render(<NameCell apiKey={apiKey} />);
+
+ // When - Reading and hovering the displayed name
+ const name = screen.getByText(apiKey.attributes.name!);
+ await user.hover(name);
+
+ // Then - The cell has a fixed width, truncates, and exposes the full name
+ expect(name).toHaveClass("w-64", "truncate", "whitespace-nowrap");
+ expect(await screen.findByRole("tooltip")).toHaveTextContent(
+ apiKey.attributes.name!,
+ );
+ });
+});
+
+describe("DateCell", () => {
+ it("keeps API key dates on one line", () => {
+ // Given - A rendered API key date
+ render(<DateCell date={null} />);
+
+ // When - Reading the date cell
+ const date = screen.getByText("Never");
+
+ // Then - The table date cannot wrap to a second line
+ expect(date).toHaveClass("whitespace-nowrap");
+ });
+});
diff --git a/ui/components/users/profile/api-keys/table-cells.tsx b/ui/components/users/profile/api-keys/table-cells.tsx
index bcba736056..e799cfd387 100644
--- a/ui/components/users/profile/api-keys/table-cells.tsx
+++ b/ui/components/users/profile/api-keys/table-cells.tsx
@@ -1,14 +1,35 @@
-import { Chip } from "@heroui/chip";
+import {
+ Badge,
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
+} from "@/components/shadcn";
import { FALLBACK_VALUES } from "./constants";
import { EnrichedApiKey, getApiKeyStatus } from "./types";
import { formatRelativeTime, getStatusColor, getStatusLabel } from "./utils";
-export const NameCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => (
- <p className="text-sm font-medium">
- {apiKey.attributes.name || FALLBACK_VALUES.UNNAMED}
- </p>
-);
+// Maps HeroUI status colors to shadcn Badge variants
+const STATUS_BADGE_VARIANT = {
+ success: "success",
+ danger: "error",
+ warning: "warning",
+} as const;
+
+export const NameCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => {
+ const name = apiKey.attributes.name || FALLBACK_VALUES.UNNAMED;
+
+ return (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <p className="w-64 truncate text-sm font-medium whitespace-nowrap">
+ {name}
+ </p>
+ </TooltipTrigger>
+ <TooltipContent>{name}</TooltipContent>
+ </Tooltip>
+ );
+};
export const PrefixCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => (
<code className="rounded px-2 py-1 font-mono text-xs">
@@ -17,7 +38,7 @@ export const PrefixCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => (
);
export const DateCell = ({ date }: { date: string | null }) => (
- <p className="text-sm">{formatRelativeTime(date)}</p>
+ <p className="text-sm whitespace-nowrap">{formatRelativeTime(date)}</p>
);
export const LastUsedCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => (
@@ -27,9 +48,9 @@ export const LastUsedCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => (
export const StatusCell = ({ apiKey }: { apiKey: EnrichedApiKey }) => {
const status = getApiKeyStatus(apiKey);
return (
- <Chip color={getStatusColor(status)} size="sm" variant="flat">
+ <Badge variant={STATUS_BADGE_VARIANT[getStatusColor(status)]}>
{getStatusLabel(status)}
- </Chip>
+ </Badge>
);
};
diff --git a/ui/components/users/profile/create-api-key-modal.tsx b/ui/components/users/profile/create-api-key-modal.tsx
index a76fe8d53b..e5dfa94fc3 100644
--- a/ui/components/users/profile/create-api-key-modal.tsx
+++ b/ui/components/users/profile/create-api-key-modal.tsx
@@ -5,11 +5,11 @@ import { useForm } from "react-hook-form";
import * as z from "zod";
import { createApiKey } from "@/actions/api-keys/api-keys";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import { Form, FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { CustomLink } from "@/components/ui/custom/custom-link";
-import { Form, FormButtons } from "@/components/ui/form";
import { DEFAULT_EXPIRY_DAYS } from "./api-keys/constants";
import { calculateExpiryDate } from "./api-keys/utils";
diff --git a/ui/components/users/profile/edit-api-key-name-modal.tsx b/ui/components/users/profile/edit-api-key-name-modal.tsx
index b015f7b732..5c36714822 100644
--- a/ui/components/users/profile/edit-api-key-name-modal.tsx
+++ b/ui/components/users/profile/edit-api-key-name-modal.tsx
@@ -6,10 +6,10 @@ import { useForm } from "react-hook-form";
import * as z from "zod";
import { updateApiKey } from "@/actions/api-keys/api-keys";
+import { useToast } from "@/components/shadcn";
+import { CustomInput } from "@/components/shadcn/custom";
+import { Form, FormButtons } from "@/components/shadcn/form";
import { Modal } from "@/components/shadcn/modal";
-import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
import { EnrichedApiKey } from "./api-keys/types";
import { isApiKeyNameDuplicate } from "./api-keys/utils";
diff --git a/ui/components/users/profile/index.ts b/ui/components/users/profile/index.ts
index 35afe2c8fa..75bf757836 100644
--- a/ui/components/users/profile/index.ts
+++ b/ui/components/users/profile/index.ts
@@ -3,7 +3,6 @@ export * from "./api-keys-card";
export * from "./api-keys-card-client";
export * from "./create-api-key-modal";
export * from "./edit-api-key-name-modal";
-export * from "./membership-item";
export * from "./memberships-card";
export * from "./revoke-api-key-modal";
export * from "./role-item";
diff --git a/ui/components/users/profile/membership-item.test.tsx b/ui/components/users/profile/membership-item.test.tsx
deleted file mode 100644
index 54006a0afc..0000000000
--- a/ui/components/users/profile/membership-item.test.tsx
+++ /dev/null
@@ -1,169 +0,0 @@
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
-
-import { MembershipItem } from "./membership-item";
-
-vi.mock("next-auth/react", () => ({
- useSession: () => ({ update: vi.fn() }),
-}));
-
-vi.mock("@/auth.config", () => ({
- auth: vi.fn(),
-}));
-
-vi.mock("@/actions/users/tenants", () => ({
- switchTenant: vi.fn(),
- updateTenantName: vi.fn(),
- deleteTenant: vi.fn(),
-}));
-
-vi.mock("@/components/ui", () => ({
- useToast: () => ({ toast: vi.fn() }),
-}));
-
-const baseMembership = {
- id: "mem-1",
- type: "memberships" as const,
- attributes: { role: "owner", date_joined: "2025-05-19T11:31:00Z" },
- relationships: {
- tenant: { data: { type: "tenants", id: "tenant-1" } },
- user: { data: { type: "users", id: "user-1" } },
- },
-};
-
-describe("MembershipItem", () => {
- it("shows Switch button when not active tenant", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={false}
- sessionTenantId="different-tenant"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
-
- expect(screen.getByRole("button", { name: /switch/i })).toBeInTheDocument();
- expect(screen.queryByText("Active")).not.toBeInTheDocument();
- });
-
- it("shows Active badge when active tenant", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={false}
- sessionTenantId="tenant-1"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
-
- expect(screen.getByText("Active")).toBeInTheDocument();
- expect(
- screen.queryByRole("button", { name: /switch/i }),
- ).not.toBeInTheDocument();
- });
-
- it("shows Edit button when user is owner", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={true}
- sessionTenantId="tenant-1"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
-
- expect(screen.getByRole("button", { name: /edit/i })).toBeInTheDocument();
- });
-
- it("hides Edit button when user is not owner", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={false}
- sessionTenantId="tenant-1"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
-
- expect(
- screen.queryByRole("button", { name: /edit/i }),
- ).not.toBeInTheDocument();
- });
-
- it("displays membership role as badge", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={false}
- sessionTenantId="tenant-1"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
-
- expect(screen.getByText("owner")).toBeInTheDocument();
- });
-
- it("shows Delete button when isOrgOwner and membershipCount > 1", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={true}
- sessionTenantId="tenant-1"
- availableTenants={[{ id: "tenant-2", name: "Other Org" }]}
- membershipCount={2}
- />,
- );
- expect(screen.getByRole("button", { name: /delete/i })).toBeInTheDocument();
- });
-
- it("hides Delete button when membershipCount === 1", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={true}
- sessionTenantId="tenant-1"
- availableTenants={[]}
- membershipCount={1}
- />,
- );
- expect(
- screen.queryByRole("button", { name: /delete/i }),
- ).not.toBeInTheDocument();
- });
-
- it("hides Delete button when not isOrgOwner", () => {
- render(
- <MembershipItem
- membership={baseMembership}
- tenantName="Test Org"
- tenantId="tenant-1"
- isOrgOwner={false}
- sessionTenantId="tenant-1"
- availableTenants={[{ id: "tenant-2", name: "Other Org" }]}
- membershipCount={2}
- />,
- );
- expect(
- screen.queryByRole("button", { name: /delete/i }),
- ).not.toBeInTheDocument();
- });
-});
diff --git a/ui/components/users/profile/membership-item.tsx b/ui/components/users/profile/membership-item.tsx
deleted file mode 100644
index 1d6f7d02d6..0000000000
--- a/ui/components/users/profile/membership-item.tsx
+++ /dev/null
@@ -1,132 +0,0 @@
-"use client";
-
-import { useState } from "react";
-
-import { Badge, Button, Card } from "@/components/shadcn";
-import { InfoField } from "@/components/shadcn/info-field/info-field";
-import { Modal } from "@/components/shadcn/modal";
-import { DateWithTime } from "@/components/ui/entities";
-import { EditTenantForm } from "@/components/users/forms";
-import { DeleteTenantForm } from "@/components/users/forms/delete-tenant-form";
-import { SwitchTenantForm } from "@/components/users/forms/switch-tenant-form";
-import { MembershipDetailData, TenantOption } from "@/types/users";
-
-export const MembershipItem = ({
- membership,
- tenantName,
- tenantId,
- isOrgOwner,
- sessionTenantId,
- availableTenants,
- membershipCount,
-}: {
- membership: MembershipDetailData;
- tenantName: string;
- tenantId: string;
- isOrgOwner: boolean;
- sessionTenantId: string | undefined;
- availableTenants: TenantOption[];
- membershipCount: number;
-}) => {
- const [isEditOpen, setIsEditOpen] = useState(false);
- const [isSwitchingOpen, setIsSwitchingOpen] = useState(false);
- const [isDeletingOpen, setIsDeletingOpen] = useState(false);
-
- const isActiveTenant = tenantId === sessionTenantId;
- const canDelete = isOrgOwner && membershipCount > 1;
-
- return (
- <>
- <Modal open={isEditOpen} onOpenChange={setIsEditOpen} title="">
- <EditTenantForm
- tenantId={tenantId}
- tenantName={tenantName}
- setIsOpen={setIsEditOpen}
- />
- </Modal>
- <Modal
- open={isSwitchingOpen}
- onOpenChange={setIsSwitchingOpen}
- title="Confirm organization switch"
- description="The session will be updated and the page will reload to apply the change."
- >
- <SwitchTenantForm tenantId={tenantId} setIsOpen={setIsSwitchingOpen} />
- </Modal>
- <Modal
- open={isDeletingOpen}
- onOpenChange={setIsDeletingOpen}
- title="Delete organization"
- description="This will permanently delete the organization and all its data. Users with no other organizations will lose access. This action cannot be undone."
- >
- <DeleteTenantForm
- tenantId={tenantId}
- tenantName={tenantName}
- isActiveTenant={isActiveTenant}
- availableTenants={availableTenants}
- setIsOpen={setIsDeletingOpen}
- />
- </Modal>
- <Card variant="inner" className="p-2">
- <div className="flex w-full flex-col gap-2 sm:flex-row sm:items-center sm:gap-4">
- <Badge variant="secondary">{membership.attributes.role}</Badge>
-
- <div className="flex flex-row flex-wrap gap-1 gap-x-4">
- <InfoField label="Name" inline variant="transparent">
- <span className="font-semibold whitespace-nowrap">
- {tenantName}
- </span>
- </InfoField>
- <InfoField label="Joined on" inline variant="transparent">
- <DateWithTime
- inline
- showTime={false}
- dateTime={membership.attributes.date_joined}
- />
- </InfoField>
- </div>
-
- <div className="ml-auto flex items-center gap-2">
- {isOrgOwner && (
- <Button
- type="button"
- variant="ghost"
- size="sm"
- onClick={() => setIsEditOpen(true)}
- >
- Edit
- </Button>
- )}
- {canDelete && (
- <Button
- type="button"
- variant="ghost"
- size="sm"
- className="text-destructive hover:text-destructive"
- onClick={() => setIsDeletingOpen(true)}
- >
- Delete
- </Button>
- )}
- {isActiveTenant ? (
- <Badge
- variant="outline"
- className="border-emerald-600 text-emerald-600"
- >
- Active
- </Badge>
- ) : (
- <Button
- type="button"
- variant="ghost"
- size="sm"
- onClick={() => setIsSwitchingOpen(true)}
- >
- Switch
- </Button>
- )}
- </div>
- </div>
- </Card>
- </>
- );
-};
diff --git a/ui/components/users/profile/memberships-card-client.test.tsx b/ui/components/users/profile/memberships-card-client.test.tsx
new file mode 100644
index 0000000000..c5ae7f5e4e
--- /dev/null
+++ b/ui/components/users/profile/memberships-card-client.test.tsx
@@ -0,0 +1,208 @@
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import type { MembershipDetailData, TenantDetailData } from "@/types/users";
+
+import { MembershipsCardClient } from "./memberships-card-client";
+
+vi.mock("next/navigation", () => ({
+ usePathname: () => "/profile",
+ useRouter: () => ({
+ push: vi.fn(),
+ }),
+ useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("@/contexts", () => ({
+ useFilterTransitionOptional: () => null,
+}));
+
+vi.mock("@/lib", () => ({
+ getPaginationInfo: () => ({
+ currentPage: 1,
+ totalPages: 1,
+ totalEntries: 1,
+ itemsPerPageOptions: [10, 20, 50],
+ }),
+}));
+
+vi.mock("@/components/users/forms/create-tenant-form", () => ({
+ CreateTenantForm: () => <div>Create organization form</div>,
+}));
+
+vi.mock("@/components/users/forms", () => ({
+ EditTenantForm: () => <div>Edit organization form</div>,
+}));
+
+vi.mock("@/components/users/forms/delete-tenant-form", () => ({
+ DeleteTenantForm: () => <div>Delete organization form</div>,
+}));
+
+vi.mock("@/components/users/forms/switch-tenant-form", () => ({
+ SwitchTenantForm: () => <div>Switch organization form</div>,
+}));
+
+vi.mock("@/components/shadcn", async (importOriginal) => ({
+ ...(await importOriginal<Record<string, unknown>>()),
+ useToast: () => ({ toast: vi.fn() }),
+}));
+
+const memberships = [
+ {
+ id: "membership-1",
+ type: "memberships",
+ attributes: {
+ role: "owner",
+ date_joined: "2026-06-09T10:00:00Z",
+ },
+ relationships: {
+ tenant: {
+ data: {
+ type: "tenants",
+ id: "tenant-1",
+ },
+ },
+ },
+ },
+] satisfies MembershipDetailData[];
+
+const inactiveMembership = {
+ id: "membership-2",
+ type: "memberships",
+ attributes: {
+ role: "owner",
+ date_joined: "2026-06-23T10:00:00Z",
+ },
+ relationships: {
+ tenant: {
+ data: {
+ type: "tenants",
+ id: "tenant-2",
+ },
+ },
+ },
+} satisfies MembershipDetailData;
+
+const tenantsMap = {
+ "tenant-1": {
+ id: "tenant-1",
+ type: "tenants",
+ attributes: {
+ name: "Prowler Labs",
+ },
+ relationships: {
+ memberships: {
+ meta: {
+ count: 1,
+ },
+ data: [],
+ },
+ },
+ },
+ "tenant-2": {
+ id: "tenant-2",
+ type: "tenants",
+ attributes: {
+ name: "Prowler Sandbox",
+ },
+ relationships: {
+ memberships: {
+ meta: {
+ count: 1,
+ },
+ data: [],
+ },
+ },
+ },
+} satisfies Record<string, TenantDetailData>;
+
+describe("MembershipsCardClient", () => {
+ it("renders organizations in a table with the active status before the name", () => {
+ // When
+ render(
+ <MembershipsCardClient
+ memberships={memberships}
+ tenantsMap={tenantsMap}
+ hasManageAccount
+ sessionTenantId="tenant-1"
+ />,
+ );
+
+ // Then
+ expect(screen.getByRole("table")).toBeInTheDocument();
+ expect(
+ screen.getByRole("columnheader", { name: "Role" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("columnheader", { name: "Status" }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("columnheader", { name: "Name" }),
+ ).toBeInTheDocument();
+
+ const row = screen.getByRole("row", {
+ name: /owner active prowler labs/i,
+ });
+ const cells = within(row).getAllByRole("cell");
+
+ expect(cells[0]).toHaveTextContent("owner");
+ expect(cells[1]).toHaveTextContent("Active");
+ expect(cells[2]).toHaveTextContent("Prowler Labs");
+ });
+
+ it("leaves inactive organization status empty", () => {
+ // Given / When
+ render(
+ <MembershipsCardClient
+ memberships={[...memberships, inactiveMembership]}
+ tenantsMap={tenantsMap}
+ hasManageAccount
+ sessionTenantId="tenant-1"
+ />,
+ );
+
+ // Then
+ const inactiveRow = screen.getByRole("row", {
+ name: /owner prowler sandbox/i,
+ });
+ expect(within(inactiveRow).queryByText("Inactive")).not.toBeInTheDocument();
+ expect(screen.getByText("Active")).toBeInTheDocument();
+ });
+
+ it("keeps organization edit and delete actions inside the actions menu", async () => {
+ // Given
+ const user = userEvent.setup();
+
+ render(
+ <MembershipsCardClient
+ memberships={memberships}
+ tenantsMap={tenantsMap}
+ hasManageAccount
+ sessionTenantId="tenant-1"
+ />,
+ );
+
+ // When
+ expect(
+ screen.queryByRole("button", { name: "Edit" }),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByRole("button", { name: "Delete" }),
+ ).not.toBeInTheDocument();
+
+ await user.click(
+ screen.getByRole("button", {
+ name: "Open actions menu",
+ }),
+ );
+
+ // Then
+ expect(
+ screen.getByRole("menuitem", { name: /edit organization/i }),
+ ).toBeInTheDocument();
+ expect(
+ screen.getByRole("menuitem", { name: /delete organization/i }),
+ ).toBeInTheDocument();
+ });
+});
diff --git a/ui/components/users/profile/memberships-card-client.tsx b/ui/components/users/profile/memberships-card-client.tsx
index cab2a3f924..10b7f28e24 100644
--- a/ui/components/users/profile/memberships-card-client.tsx
+++ b/ui/components/users/profile/memberships-card-client.tsx
@@ -1,20 +1,51 @@
"use client";
+import { ColumnDef, Row } from "@tanstack/react-table";
+import { ArrowRightLeft, Pencil, Trash2 } from "lucide-react";
import { useState } from "react";
import {
+ Badge,
Button,
Card,
CardAction,
CardContent,
CardHeader,
CardTitle,
+ Tooltip,
+ TooltipContent,
+ TooltipTrigger,
} from "@/components/shadcn";
+import { CustomLink } from "@/components/shadcn/custom/custom-link";
+import {
+ ActionDropdown,
+ ActionDropdownDangerZone,
+ ActionDropdownItem,
+} from "@/components/shadcn/dropdown";
+import { DateWithTime } from "@/components/shadcn/entities";
import { Modal } from "@/components/shadcn/modal";
+import { DataTable, DataTableColumnHeader } from "@/components/shadcn/table";
+import { EditTenantForm } from "@/components/users/forms";
import { CreateTenantForm } from "@/components/users/forms/create-tenant-form";
-import { MembershipDetailData, TenantDetailData } from "@/types/users";
+import { DeleteTenantForm } from "@/components/users/forms/delete-tenant-form";
+import { SwitchTenantForm } from "@/components/users/forms/switch-tenant-form";
+import {
+ MembershipDetailData,
+ TenantDetailData,
+ TenantOption,
+} from "@/types/users";
-import { MembershipItem } from "./membership-item";
+interface MembershipRow {
+ id: string;
+ tenantId: string;
+ tenantName: string;
+ role: string;
+ dateJoined: string;
+ isActiveTenant: boolean;
+ isOrgOwner: boolean;
+ availableTenants: TenantOption[];
+ membershipCount: number;
+}
interface MembershipsCardClientProps {
memberships: MembershipDetailData[];
@@ -23,6 +54,151 @@ interface MembershipsCardClientProps {
sessionTenantId: string | undefined;
}
+const OrganizationNameCell = ({ name }: { name: string }) => (
+ <Tooltip>
+ <TooltipTrigger asChild>
+ <span className="block w-64 truncate text-sm font-medium whitespace-nowrap">
+ {name}
+ </span>
+ </TooltipTrigger>
+ <TooltipContent>{name}</TooltipContent>
+ </Tooltip>
+);
+
+const MembershipRowActions = ({ row }: { row: Row<MembershipRow> }) => {
+ const membership = row.original;
+ const [isEditOpen, setIsEditOpen] = useState(false);
+ const [isSwitchingOpen, setIsSwitchingOpen] = useState(false);
+ const [isDeletingOpen, setIsDeletingOpen] = useState(false);
+
+ const isLastTenant = membership.membershipCount === 1;
+ const hasActions = membership.isOrgOwner || !membership.isActiveTenant;
+
+ if (!hasActions) {
+ return null;
+ }
+
+ return (
+ <>
+ <Modal open={isEditOpen} onOpenChange={setIsEditOpen} title="">
+ <EditTenantForm
+ tenantId={membership.tenantId}
+ tenantName={membership.tenantName}
+ setIsOpen={setIsEditOpen}
+ />
+ </Modal>
+ <Modal
+ open={isSwitchingOpen}
+ onOpenChange={setIsSwitchingOpen}
+ title="Confirm organization switch"
+ description="The session will be updated and the page will reload to apply the change."
+ >
+ <SwitchTenantForm
+ tenantId={membership.tenantId}
+ setIsOpen={setIsSwitchingOpen}
+ />
+ </Modal>
+ <Modal
+ open={isDeletingOpen}
+ onOpenChange={setIsDeletingOpen}
+ title="Delete organization"
+ description={
+ isLastTenant
+ ? "This will permanently delete the organization and all its data. This action cannot be undone."
+ : "This will permanently delete the organization and all its data. Users with no other organizations will lose access. This action cannot be undone."
+ }
+ >
+ <DeleteTenantForm
+ tenantId={membership.tenantId}
+ tenantName={membership.tenantName}
+ isActiveTenant={membership.isActiveTenant}
+ isLastTenant={isLastTenant}
+ availableTenants={membership.availableTenants}
+ setIsOpen={setIsDeletingOpen}
+ />
+ </Modal>
+ <div className="relative flex items-center justify-end gap-2">
+ <ActionDropdown>
+ {membership.isOrgOwner && (
+ <ActionDropdownItem
+ icon={<Pencil />}
+ label="Edit organization"
+ onSelect={() => setIsEditOpen(true)}
+ />
+ )}
+ {!membership.isActiveTenant && (
+ <ActionDropdownItem
+ icon={<ArrowRightLeft />}
+ label="Switch organization"
+ onSelect={() => setIsSwitchingOpen(true)}
+ />
+ )}
+ {membership.isOrgOwner && (
+ <ActionDropdownDangerZone>
+ <ActionDropdownItem
+ icon={<Trash2 />}
+ label="Delete organization"
+ destructive
+ onSelect={() => setIsDeletingOpen(true)}
+ />
+ </ActionDropdownDangerZone>
+ )}
+ </ActionDropdown>
+ </div>
+ </>
+ );
+};
+
+const membershipColumns: ColumnDef<MembershipRow>[] = [
+ {
+ accessorKey: "role",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Role" />
+ ),
+ cell: ({ row }) => <Badge variant="tag">{row.original.role}</Badge>,
+ enableSorting: false,
+ },
+ {
+ accessorKey: "isActiveTenant",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Status" />
+ ),
+ cell: ({ row }) =>
+ row.original.isActiveTenant ? (
+ <Badge variant="success">Active</Badge>
+ ) : null,
+ enableSorting: false,
+ },
+ {
+ accessorKey: "tenantName",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Name" />
+ ),
+ cell: ({ row }) => <OrganizationNameCell name={row.original.tenantName} />,
+ enableSorting: false,
+ },
+ {
+ accessorKey: "dateJoined",
+ header: ({ column }) => (
+ <DataTableColumnHeader column={column} title="Joined on" />
+ ),
+ cell: ({ row }) => (
+ <DateWithTime
+ inline
+ showTime={false}
+ dateTime={row.original.dateJoined}
+ />
+ ),
+ enableSorting: false,
+ },
+ {
+ id: "actions",
+ header: ({ column }) => <DataTableColumnHeader column={column} title="" />,
+ cell: ({ row }) => <MembershipRowActions row={row} />,
+ enableSorting: false,
+ },
+];
+
export const MembershipsCardClient = ({
memberships,
tenantsMap,
@@ -37,6 +213,23 @@ export const MembershipsCardClient = ({
return { id, name: tenantsMap[id]?.attributes.name || id };
});
+ const rows = memberships.map((membership) => {
+ const tenantId = membership.relationships.tenant.data.id;
+ const tenantName = tenantsMap[tenantId]?.attributes.name || tenantId;
+
+ return {
+ id: membership.id,
+ tenantId,
+ tenantName,
+ role: membership.attributes.role,
+ dateJoined: membership.attributes.date_joined,
+ isActiveTenant: tenantId === sessionTenantId,
+ isOrgOwner: hasManageAccount && membership.attributes.role === "owner",
+ availableTenants: availableTenants.filter((t) => t.id !== tenantId),
+ membershipCount: memberships.length,
+ };
+ });
+
return (
<>
<Modal
@@ -46,12 +239,15 @@ export const MembershipsCardClient = ({
>
<CreateTenantForm setIsOpen={setIsCreateOpen} />
</Modal>
- <Card variant="base" padding="none" className="p-4">
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
<CardHeader>
<div className="flex flex-col gap-1">
<CardTitle>Organizations</CardTitle>
<p className="text-xs text-gray-500">
- Organizations this user is associated with
+ Organizations this user is associated with.{" "}
+ <CustomLink href="https://docs.prowler.com/user-guide/tutorials/prowler-app-multi-tenant">
+ Learn more
+ </CustomLink>
</p>
</div>
<CardAction>
@@ -68,27 +264,7 @@ export const MembershipsCardClient = ({
{memberships.length === 0 ? (
<div className="text-sm text-gray-500">No memberships found.</div>
) : (
- <div className="flex flex-col gap-2">
- {memberships.map((membership) => {
- const tenantId = membership.relationships.tenant.data.id;
- return (
- <MembershipItem
- key={membership.id}
- membership={membership}
- tenantId={tenantId}
- tenantName={tenantsMap[tenantId]?.attributes.name}
- isOrgOwner={
- hasManageAccount && membership.attributes.role === "owner"
- }
- sessionTenantId={sessionTenantId}
- availableTenants={availableTenants.filter(
- (t) => t.id !== tenantId,
- )}
- membershipCount={memberships.length}
- />
- );
- })}
- </div>
+ <DataTable columns={membershipColumns} data={rows} />
)}
</CardContent>
</Card>
diff --git a/ui/components/users/profile/revoke-api-key-modal.tsx b/ui/components/users/profile/revoke-api-key-modal.tsx
index 6097b747c5..bae0a7e010 100644
--- a/ui/components/users/profile/revoke-api-key-modal.tsx
+++ b/ui/components/users/profile/revoke-api-key-modal.tsx
@@ -1,16 +1,12 @@
"use client";
-import { Trash2Icon } from "lucide-react";
+import { AlertTriangle, Trash2Icon } from "lucide-react";
import { revokeApiKey } from "@/actions/api-keys/api-keys";
+import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn/alert";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { ModalButtons } from "@/components/shadcn/custom/custom-modal-buttons";
import { Modal } from "@/components/shadcn/modal";
-import {
- Alert,
- AlertDescription,
- AlertTitle,
-} from "@/components/ui/alert/Alert";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { ModalButtons } from "@/components/ui/custom/custom-modal-buttons";
import { FALLBACK_VALUES } from "./api-keys/constants";
import { EnrichedApiKey } from "./api-keys/types";
@@ -56,8 +52,9 @@ export const RevokeApiKeyModal = ({
size="lg"
>
<div className="flex flex-col gap-4">
- <Alert variant="destructive">
- <AlertTitle>⚠️ Warning</AlertTitle>
+ <Alert variant="error">
+ <AlertTriangle />
+ <AlertTitle>Warning</AlertTitle>
<AlertDescription>
This action cannot be undone. This API key will be revoked and will
no longer work.
@@ -76,7 +73,8 @@ export const RevokeApiKeyModal = ({
</div>
{error && (
- <Alert variant="destructive">
+ <Alert variant="error">
+ <AlertTriangle />
<AlertDescription>{error}</AlertDescription>
</Alert>
)}
diff --git a/ui/components/users/profile/role-item.test.tsx b/ui/components/users/profile/role-item.test.tsx
index afcfced822..947da3515c 100644
--- a/ui/components/users/profile/role-item.test.tsx
+++ b/ui/components/users/profile/role-item.test.tsx
@@ -15,6 +15,7 @@ const roleDetail = {
type: "roles",
attributes: {
name: "Cloud admin",
+ permission_state: "unlimited",
manage_users: false,
manage_account: false,
manage_providers: false,
@@ -52,4 +53,31 @@ describe("RoleItem", () => {
// Then
expect(screen.queryByText("Manage Alerts")).not.toBeInTheDocument();
});
+
+ it("displays the permission state as a badge", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ render(<RoleItem role={role} roleDetail={roleDetail} />);
+
+ // Then
+ expect(screen.getByText("unlimited")).toHaveClass("bg-bg-tag");
+ });
+
+ it("does not render the details toggle", () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ render(<RoleItem role={role} roleDetail={roleDetail} />);
+
+ // Then
+ expect(
+ screen.queryByRole("button", { name: /hide details/i }),
+ ).not.toBeInTheDocument();
+ expect(
+ screen.queryByRole("button", { name: /show details/i }),
+ ).not.toBeInTheDocument();
+ });
});
diff --git a/ui/components/users/profile/role-item.tsx b/ui/components/users/profile/role-item.tsx
index 5e1f6feef4..8cf786f454 100644
--- a/ui/components/users/profile/role-item.tsx
+++ b/ui/components/users/profile/role-item.tsx
@@ -1,10 +1,8 @@
"use client";
-import { Chip } from "@heroui/chip";
import { Ban, Check } from "lucide-react";
-import { useState } from "react";
-import { Button, Card } from "@/components/shadcn";
+import { Badge, Card } from "@/components/shadcn";
import { getRolePermissions } from "@/lib/permissions";
import { RoleData, RoleDetail } from "@/types/users";
@@ -35,13 +33,11 @@ export const RoleItem = ({
role: RoleData;
roleDetail?: RoleDetail;
}) => {
- const [isExpanded, setIsExpanded] = useState(true);
-
if (!roleDetail) {
return (
- <Chip key={role.id} size="sm" variant="flat" color="primary">
+ <Badge key={role.id} variant="info">
{role.id}
- </Chip>
+ </Badge>
);
}
@@ -56,38 +52,27 @@ export const RoleItem = ({
<Card variant="inner">
<div className="flex items-center justify-between">
<div className="flex items-center gap-2">
- <Chip size="sm" variant="flat" color="primary">
- {roleName}
- </Chip>
- <span className="text-xs text-gray-500 capitalize">
- {permissionState}
- </span>
+ <Badge variant="info">{roleName}</Badge>
+ {permissionState && (
+ <Badge variant="tag" className="capitalize">
+ {permissionState}
+ </Badge>
+ )}
</div>
-
- <Button
- variant="ghost"
- size="sm"
- onClick={() => setIsExpanded(!isExpanded)}
- className="px-0"
- >
- {isExpanded ? "Hide details" : "Show details"}
- </Button>
</div>
- {isExpanded && (
- <div
- id={detailsId}
- className="animate-fadeIn border-border-neutral-primary border-t pt-4"
- role="region"
- aria-label={`Details for role ${roleName}`}
- >
- <div className="grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-2">
- {permissions.map(({ key, label, enabled }) => (
- <PermissionItem key={key} label={label} enabled={enabled} />
- ))}
- </div>
+ <div
+ id={detailsId}
+ className="border-border-neutral-primary border-t pt-4"
+ role="region"
+ aria-label={`Details for role ${roleName}`}
+ >
+ <div className="grid grid-cols-1 gap-3 md:grid-cols-2 lg:grid-cols-2">
+ {permissions.map(({ key, label, enabled }) => (
+ <PermissionItem key={key} label={label} enabled={enabled} />
+ ))}
</div>
- )}
+ </div>
</Card>
);
};
diff --git a/ui/components/users/profile/roles-card.tsx b/ui/components/users/profile/roles-card.tsx
index 3c4465f751..e4621074f9 100644
--- a/ui/components/users/profile/roles-card.tsx
+++ b/ui/components/users/profile/roles-card.tsx
@@ -1,4 +1,4 @@
-import { Card, CardContent } from "@/components/shadcn";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn";
import { RoleData, RoleDetail } from "@/types/users";
import { RoleItem } from "./role-item";
@@ -11,14 +11,16 @@ export const RolesCard = ({
roleDetails: Record<string, RoleDetail>;
}) => {
return (
- <Card variant="base" padding="none" className="p-4">
- <CardContent>
- <div className="mb-6 flex flex-col gap-1">
- <h4 className="text-lg font-bold">Active roles</h4>
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
+ <CardHeader>
+ <div className="flex flex-col gap-1">
+ <CardTitle>Active roles</CardTitle>
<p className="text-xs text-gray-500">
Roles assigned to this user account
</p>
</div>
+ </CardHeader>
+ <CardContent>
{roles.length === 0 ? (
<div className="text-sm text-gray-500">No roles assigned.</div>
) : (
diff --git a/ui/components/users/profile/skeleton-user-info.tsx b/ui/components/users/profile/skeleton-user-info.tsx
index 35eaf89921..3296d75ec9 100644
--- a/ui/components/users/profile/skeleton-user-info.tsx
+++ b/ui/components/users/profile/skeleton-user-info.tsx
@@ -1,83 +1,152 @@
-import { Card, CardBody } from "@heroui/card";
-import { Skeleton } from "@heroui/skeleton";
+import {
+ Card,
+ CardAction,
+ CardContent,
+ CardHeader,
+ Separator,
+ Skeleton,
+} from "@/components/shadcn";
+// Mirrors the real profile layout: one large card with sections stacked
+// vertically. Conditional cards (SAML / API keys) depend on permissions not
+// known while loading, so we mirror only the always-present structure.
export const SkeletonUserInfo = () => {
return (
- <div className="flex flex-col gap-6">
- {/* User Information */}
- <Card>
- <CardBody>
- <div className="flex flex-col gap-3">
- {/* Name */}
- <div className="flex items-center justify-between">
- <p className="text-default-600 text-sm font-semibold">Name:</p>
- <Skeleton className="h-5 w-24 rounded-lg">
- <div className="bg-default-200 h-5 w-24"></div>
- </Skeleton>
- </div>
- {/* Email */}
- <div className="flex items-center justify-between">
- <p className="text-default-600 text-sm font-semibold">Email:</p>
- <Skeleton className="h-5 w-32 rounded-lg">
- <div className="bg-default-200 h-5 w-32"></div>
- </Skeleton>
- </div>
- {/* Company */}
- <div className="flex items-center justify-between">
- <p className="text-default-600 text-sm font-semibold">Company:</p>
- <Skeleton className="h-5 w-28 rounded-lg">
- <div className="bg-default-200 h-5 w-28"></div>
- </Skeleton>
- </div>
- {/* Date Joined */}
- <div className="flex items-center justify-between">
- <p className="text-default-600 text-sm font-semibold">
- Date Joined:
- </p>
- <Skeleton className="h-5 w-36 rounded-lg">
- <div className="bg-default-200 h-5 w-36"></div>
- </Skeleton>
- </div>
- {/* Tenant ID */}
- <div className="flex items-center justify-between">
- <p className="text-default-600 text-sm font-semibold">
- Tenant ID:
- </p>
- <Skeleton className="h-5 w-32 rounded-lg">
- <div className="bg-default-200 h-5 w-32"></div>
- </Skeleton>
- </div>
- </div>
- </CardBody>
- </Card>
+ <Card
+ variant="base"
+ padding="none"
+ role="region"
+ aria-label="User profile settings loading"
+ className="w-full gap-4 p-4 md:p-5"
+ >
+ <UserBasicInfoSkeleton />
+ <RolesCardSkeleton />
+ <OrganizationsCardSkeleton />
+ </Card>
+ );
+};
- {/* Roles */}
- <Card>
- <CardBody>
- <h4 className="mb-3 text-sm font-semibold">Roles</h4>
- <div className="flex flex-wrap gap-2">
- {[1, 2, 3].map((i) => (
- <Skeleton key={i} className="h-6 w-20 rounded-full">
- <div className="bg-default-200 h-6 w-20 rounded-full"></div>
- </Skeleton>
- ))}
+const UserBasicInfoSkeleton = () => {
+ return (
+ <Card variant="inner" padding="none" className="p-4 md:p-5">
+ <CardContent>
+ {/* Avatar + name / email */}
+ <div className="flex items-center gap-4">
+ <Skeleton className="size-10 rounded-full" />
+ <div className="flex flex-col gap-1.5">
+ <Skeleton className="h-4 w-32 rounded" />
+ <Skeleton className="h-3 w-48 rounded" />
</div>
- </CardBody>
- </Card>
+ </div>
+ <Separator className="my-4" />
+ {/* Date Joined + Organization ID */}
+ <div className="flex flex-row gap-4 md:gap-8">
+ <FieldSkeleton labelWidth="w-20" valueWidth="w-24" />
+ <div className="flex min-w-0 flex-1 flex-col gap-1.5">
+ <Skeleton className="h-3 w-28 rounded" />
+ <Skeleton className="h-8 w-full max-w-xs rounded-md" />
+ </div>
+ </div>
+ </CardContent>
+ </Card>
+ );
+};
- {/* Memberships */}
- <Card>
- <CardBody>
- <h4 className="mb-3 text-sm font-semibold">Memberships</h4>
- <div className="flex flex-col gap-2">
- {[1, 2].map((i) => (
- <Skeleton key={i} className="h-16 w-full rounded-md">
- <div className="bg-default-200 h-16 w-full rounded-md"></div>
- </Skeleton>
- ))}
+const RolesCardSkeleton = () => {
+ return (
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
+ <CardHeader>
+ <div className="flex flex-col gap-1.5">
+ <Skeleton className="h-6 w-28 rounded" />
+ <Skeleton className="h-3 w-48 rounded" />
+ </div>
+ </CardHeader>
+ <CardContent>
+ <div className="flex flex-col gap-2">
+ <RoleItemSkeleton />
+ <RoleItemSkeleton />
+ </div>
+ </CardContent>
+ </Card>
+ );
+};
+
+// Mirrors <RoleItem>: inner card with role badges and permission rows below.
+const RoleItemSkeleton = () => {
+ return (
+ <Card variant="inner">
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-5 w-20 rounded-full" />
+ <Skeleton className="h-5 w-16 rounded-full" />
+ </div>
+ <div className="border-border-neutral-primary mt-4 grid grid-cols-1 gap-3 border-t pt-4 md:grid-cols-2">
+ {[0, 1, 2, 3].map((i) => (
+ <div key={i} className="flex items-center gap-2">
+ <Skeleton className="size-4 rounded-full" />
+ <Skeleton className="h-3 w-24 rounded" />
</div>
- </CardBody>
- </Card>
+ ))}
+ </div>
+ </Card>
+ );
+};
+
+const OrganizationsCardSkeleton = () => {
+ return (
+ <Card variant="inner" padding="none" className="gap-4 p-4 md:p-5">
+ <CardHeader>
+ <div className="flex flex-col gap-1.5">
+ <Skeleton className="h-5 w-32 rounded" />
+ <Skeleton className="h-3 w-52 rounded" />
+ </div>
+ <CardAction>
+ <Skeleton className="h-8 w-36 rounded-md" />
+ </CardAction>
+ </CardHeader>
+ <CardContent>
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 rounded-[14px] border p-4 shadow-sm">
+ <div className="bg-bg-neutral-tertiary border-border-neutral-primary grid h-11 grid-cols-[88px_96px_minmax(0,1fr)_120px_48px] items-center gap-4 rounded-full border px-4">
+ <Skeleton className="h-3 w-10 rounded" />
+ <Skeleton className="h-3 w-12 rounded" />
+ <Skeleton className="h-3 w-12 rounded" />
+ <Skeleton className="h-3 w-16 rounded" />
+ <span className="sr-only">Actions</span>
+ </div>
+ {[0, 1].map((i) => (
+ <div
+ key={i}
+ className="grid h-12 grid-cols-[88px_96px_minmax(0,1fr)_120px_48px] items-center gap-4 px-4"
+ >
+ <Skeleton className="h-5 w-14 rounded-full" />
+ <Skeleton className="h-5 w-16 rounded-full" />
+ <Skeleton className="h-4 w-40 rounded" />
+ <Skeleton className="h-4 w-24 rounded" />
+ <Skeleton className="ml-auto size-7 rounded-full" />
+ </div>
+ ))}
+ </div>
+ </CardContent>
+ </Card>
+ );
+};
+
+// Label + value pair. `inline` lays them side by side (info fields inside a
+// row); otherwise stacked (a standalone field).
+const FieldSkeleton = ({
+ labelWidth,
+ valueWidth,
+ inline = false,
+}: {
+ labelWidth: string;
+ valueWidth: string;
+ inline?: boolean;
+}) => {
+ return (
+ <div
+ className={inline ? "flex items-center gap-2" : "flex flex-col gap-1.5"}
+ >
+ <Skeleton className={`h-3 ${labelWidth} rounded`} />
+ <Skeleton className={`h-4 ${valueWidth} rounded`} />
</div>
);
};
diff --git a/ui/components/users/profile/user-basic-info-card.tsx b/ui/components/users/profile/user-basic-info-card.tsx
index 1e2c7e3e33..c437b211bb 100644
--- a/ui/components/users/profile/user-basic-info-card.tsx
+++ b/ui/components/users/profile/user-basic-info-card.tsx
@@ -1,12 +1,10 @@
"use client";
-import { Divider } from "@heroui/divider";
-
import { ProwlerShort } from "@/components/icons";
-import { Card, CardContent } from "@/components/shadcn";
+import { Card, CardContent, Separator } from "@/components/shadcn";
+import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet";
+import { DateWithTime } from "@/components/shadcn/entities";
import { InfoField } from "@/components/shadcn/info-field/info-field";
-import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
-import { DateWithTime } from "@/components/ui/entities";
import { UserDataWithRoles } from "@/types/users";
const TenantIdCopy = ({ id }: { id: string }) => {
@@ -27,7 +25,7 @@ export const UserBasicInfoCard = ({
const { name, email, company_name, date_joined } = user.attributes;
return (
- <Card variant="base" padding="none" className="p-4">
+ <Card variant="inner" padding="none" className="p-4 md:p-5">
<CardContent>
<div className="flex items-center gap-4">
<div className="flex h-10 w-10 items-center justify-center rounded-full border-3 border-black p-1 dark:border-white">
@@ -41,7 +39,7 @@ export const UserBasicInfoCard = ({
</span>
</div>
</div>
- <Divider className="my-4" />
+ <Separator className="my-4" />
<div className="flex flex-row gap-4 md:items-start md:justify-start md:gap-8">
<div className="flex gap-2 whitespace-nowrap md:flex-col md:items-start md:justify-start">
<div className="flex items-center gap-2">
diff --git a/ui/components/users/table/column-users.tsx b/ui/components/users/table/column-users.tsx
index fc599eb13e..a99a795397 100644
--- a/ui/components/users/table/column-users.tsx
+++ b/ui/components/users/table/column-users.tsx
@@ -2,8 +2,8 @@
import { ColumnDef } from "@tanstack/react-table";
-import { DateWithTime } from "@/components/ui/entities";
-import { DataTableColumnHeader } from "@/components/ui/table";
+import { DateWithTime } from "@/components/shadcn/entities";
+import { DataTableColumnHeader } from "@/components/shadcn/table";
import { UserProps } from "@/types";
import { DataTableRowActions } from "./data-table-row-actions";
diff --git a/ui/components/users/table/skeleton-table-user.tsx b/ui/components/users/table/skeleton-table-user.tsx
index c16074f976..c6d990a864 100644
--- a/ui/components/users/table/skeleton-table-user.tsx
+++ b/ui/components/users/table/skeleton-table-user.tsx
@@ -1,37 +1,102 @@
-import React from "react";
-
-import { Card } from "@/components/shadcn/card/card";
import { Skeleton } from "@/components/shadcn/skeleton/skeleton";
-export const SkeletonTableUser = () => {
+const SkeletonTableRow = () => {
return (
- <Card variant="base" padding="md" className="flex flex-col gap-4">
- {/* Table headers */}
- <div className="hidden gap-4 md:flex">
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-2/12" />
- <Skeleton className="h-8 w-1/12" />
- </div>
-
- {/* Table body */}
- <div className="flex flex-col gap-3">
- {[...Array(10)].map((_, index) => (
- <div
- key={index}
- className="flex flex-col gap-4 md:flex-row md:items-center"
- >
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="h-12 w-full md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-2/12" />
- <Skeleton className="hidden h-12 md:block md:w-1/12" />
- </div>
- ))}
- </div>
- </Card>
+ <tr className="border-border-neutral-secondary border-b last:border-b-0">
+ {/* Name */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-28 rounded" />
+ </td>
+ {/* Email */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-32 rounded" />
+ </td>
+ {/* Role */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-20 rounded" />
+ </td>
+ {/* Company name */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Joined - date */}
+ <td className="px-3 py-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ </td>
+ {/* Actions */}
+ <td className="px-2 py-4">
+ <Skeleton className="size-6 rounded" />
+ </td>
+ </tr>
+ );
+};
+
+export const SkeletonTableUser = () => {
+ const rows = 10;
+
+ return (
+ <div className="border-border-neutral-secondary bg-bg-neutral-secondary flex w-full flex-col gap-4 overflow-hidden rounded-[14px] border p-4 shadow-sm">
+ {/* Toolbar: Search + Total entries */}
+ <div className="flex items-center justify-between">
+ {/* Search icon button */}
+ <Skeleton className="size-10 rounded-md" />
+ {/* Total entries */}
+ <Skeleton className="h-4 w-28 rounded" />
+ </div>
+
+ {/* Table */}
+ <table className="w-full">
+ <thead>
+ <tr className="border-border-neutral-secondary border-b">
+ {/* Name */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-12 rounded" />
+ </th>
+ {/* Email */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-14 rounded" />
+ </th>
+ {/* Role */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-10 rounded" />
+ </th>
+ {/* Company name */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-28 rounded" />
+ </th>
+ {/* Joined */}
+ <th className="px-3 py-3 text-left">
+ <Skeleton className="h-4 w-16 rounded" />
+ </th>
+ {/* Actions - empty header */}
+ <th className="w-10 py-3" />
+ </tr>
+ </thead>
+ <tbody>
+ {Array.from({ length: rows }).map((_, i) => (
+ <SkeletonTableRow key={i} />
+ ))}
+ </tbody>
+ </table>
+
+ {/* Pagination */}
+ <div className="flex items-center justify-between pt-2">
+ {/* Rows per page */}
+ <div className="flex items-center gap-2">
+ <Skeleton className="h-4 w-24 rounded" />
+ <Skeleton className="h-9 w-16 rounded-md" />
+ </div>
+ {/* Page info + navigation */}
+ <div className="flex items-center gap-4">
+ <Skeleton className="h-4 w-24 rounded" />
+ <div className="flex gap-1">
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ <Skeleton className="size-9 rounded-md" />
+ </div>
+ </div>
+ </div>
+ </div>
);
};
diff --git a/ui/config/site.test.ts b/ui/config/site.test.ts
new file mode 100644
index 0000000000..686b38c988
--- /dev/null
+++ b/ui/config/site.test.ts
@@ -0,0 +1,30 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+describe("siteConfig", () => {
+ afterEach(() => {
+ vi.unstubAllEnvs();
+ vi.resetModules();
+ });
+
+ it("names the open-source application Prowler Local Server", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+ // When
+ const { siteConfig } = await import("./site");
+
+ // Then
+ expect(siteConfig.name).toBe("Prowler Local Server");
+ });
+
+ it("keeps the Prowler Cloud name in Cloud", async () => {
+ // Given
+ vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+ // When
+ const { siteConfig } = await import("./site");
+
+ // Then
+ expect(siteConfig.name).toBe("Prowler Cloud");
+ });
+});
diff --git a/ui/config/site.ts b/ui/config/site.ts
index f8ef5584d4..7bd9fe685c 100644
--- a/ui/config/site.ts
+++ b/ui/config/site.ts
@@ -1,9 +1,9 @@
+import { isCloud } from "@/lib/shared/env";
+
export type SiteConfig = typeof siteConfig;
-const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
-
export const siteConfig = {
- name: isCloudEnv ? "Prowler Cloud" : "Prowler",
+ name: isCloud() ? "Prowler Cloud" : "Prowler Local Server",
description:
'Prowler is the world\'s most widely used Open-Source Cloud Security Platform that automates security and compliance across any cloud environment. With hundreds of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to "Secure ANY Cloud at AI Speed". Prowler delivers AI-driven, customizable, and easy-to-use assessments, dashboards, reports, and integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.',
};
diff --git a/ui/dependency-log.json b/ui/dependency-log.json
index b200139313..acb4622141 100644
--- a/ui/dependency-log.json
+++ b/ui/dependency-log.json
@@ -5,7 +5,7 @@
"from": "3.0.207",
"to": "3.0.205",
"strategy": "installed",
- "generatedAt": "2026-06-17T11:28:12.866Z"
+ "generatedAt": "2026-06-17T16:00:06.271Z"
},
{
"section": "dependencies",
@@ -55,14 +55,6 @@
"strategy": "installed",
"generatedAt": "2026-01-19T15:06:16.239Z"
},
- {
- "section": "dependencies",
- "name": "@heroui/react",
- "from": "2.8.4",
- "to": "2.8.4",
- "strategy": "installed",
- "generatedAt": "2025-10-22T12:36:37.962Z"
- },
{
"section": "dependencies",
"name": "@hookform/resolvers",
@@ -239,6 +231,14 @@
"strategy": "installed",
"generatedAt": "2025-10-22T12:36:37.962Z"
},
+ {
+ "section": "dependencies",
+ "name": "@radix-ui/react-switch",
+ "from": "1.3.0",
+ "to": "1.3.0",
+ "strategy": "installed",
+ "generatedAt": "2026-06-17T16:00:06.271Z"
+ },
{
"section": "dependencies",
"name": "@radix-ui/react-tabs",
@@ -306,10 +306,10 @@
{
"section": "dependencies",
"name": "@sentry/nextjs",
- "from": "10.11.0",
- "to": "10.27.0",
+ "from": "10.27.0",
+ "to": "10.65.0",
"strategy": "installed",
- "generatedAt": "2025-12-15T11:18:25.093Z"
+ "generatedAt": "2026-07-16T15:35:58.334Z"
},
{
"section": "dependencies",
@@ -365,7 +365,15 @@
"from": "6.0.205",
"to": "6.0.203",
"strategy": "installed",
- "generatedAt": "2026-06-17T11:28:12.866Z"
+ "generatedAt": "2026-06-17T16:00:06.271Z"
+ },
+ {
+ "section": "dependencies",
+ "name": "ajv",
+ "from": "8.17.1",
+ "to": "8.18.0",
+ "strategy": "installed",
+ "generatedAt": "2026-06-25T07:13:59.855Z"
},
{
"section": "dependencies",
@@ -402,10 +410,10 @@
{
"section": "dependencies",
"name": "date-fns",
- "from": "4.1.0",
+ "from": null,
"to": "4.1.0",
"strategy": "installed",
- "generatedAt": "2025-10-22T12:36:37.962Z"
+ "generatedAt": "2026-06-17T18:31:57.448Z"
},
{
"section": "dependencies",
@@ -427,17 +435,17 @@
"section": "dependencies",
"name": "import-in-the-middle",
"from": "2.0.0",
- "to": "2.0.0",
+ "to": "3.3.1",
"strategy": "installed",
- "generatedAt": "2025-12-16T08:33:37.278Z"
+ "generatedAt": "2026-07-16T15:35:58.334Z"
},
{
"section": "dependencies",
"name": "js-yaml",
- "from": "4.1.0",
- "to": "4.1.1",
+ "from": "4.1.1",
+ "to": "4.3.0",
"strategy": "installed",
- "generatedAt": "2025-12-15T11:18:25.093Z"
+ "generatedAt": "2026-07-16T15:29:57.887Z"
},
{
"section": "dependencies",
@@ -458,10 +466,10 @@
{
"section": "dependencies",
"name": "lucide-react",
- "from": "0.543.0",
+ "from": null,
"to": "0.543.0",
"strategy": "installed",
- "generatedAt": "2025-10-22T12:36:37.962Z"
+ "generatedAt": "2026-06-17T18:31:46.507Z"
},
{
"section": "dependencies",
@@ -623,14 +631,6 @@
"strategy": "installed",
"generatedAt": "2025-12-15T08:24:46.195Z"
},
- {
- "section": "dependencies",
- "name": "vaul",
- "from": "1.1.2",
- "to": "1.1.2",
- "strategy": "installed",
- "generatedAt": "2026-01-05T16:21:23.125Z"
- },
{
"section": "dependencies",
"name": "world-atlas",
diff --git a/ui/hooks/index.ts b/ui/hooks/index.ts
index 8231eef4d5..c1c150cf27 100644
--- a/ui/hooks/index.ts
+++ b/ui/hooks/index.ts
@@ -5,6 +5,5 @@ export * from "./use-local-storage";
export * from "./use-mount-effect";
export * from "./use-related-filters";
export * from "./use-scroll-hint";
-export * from "./use-sidebar";
export * from "./use-store";
export * from "./use-url-filters";
diff --git a/ui/hooks/use-credentials-form.ts b/ui/hooks/use-credentials-form.ts
index 71cb139e5d..6fee1ac9e5 100644
--- a/ui/hooks/use-credentials-form.ts
+++ b/ui/hooks/use-credentials-form.ts
@@ -180,7 +180,6 @@ export const useCredentialsForm = ({
[ProviderCredentialFields.OCI_FINGERPRINT]: "",
[ProviderCredentialFields.OCI_KEY_CONTENT]: "",
[ProviderCredentialFields.OCI_TENANCY]: providerUid || "",
- [ProviderCredentialFields.OCI_REGION]: "",
[ProviderCredentialFields.OCI_PASS_PHRASE]: "",
};
case "mongodbatlas":
diff --git a/ui/hooks/use-filter-batch.test.ts b/ui/hooks/use-filter-batch.test.ts
index 10f416c4b1..0607c041ef 100644
--- a/ui/hooks/use-filter-batch.test.ts
+++ b/ui/hooks/use-filter-batch.test.ts
@@ -62,22 +62,22 @@ describe("useFilterBatch", () => {
expect(result.current.hasChanges).toBe(false);
});
- it("should expose filter[delta]=new under the FilterType.DELTA key so the dropdown shows it selected", async () => {
+ it("should expose filter[delta]=new under the FILTER_FIELD.DELTA key so the dropdown shows it selected", async () => {
// Given — URL from LinkToFindings uses `filter[delta]` (singular), matching the API.
setSearchParams({
"filter[status__in]": "FAIL",
"filter[delta]": "new",
});
- const { FilterType } = await import("@/types/filters");
+ const { FILTER_FIELD } = await import("@/types/filters");
// When
const { result } = renderHook(() => useFilterBatch());
- // Then — the Delta dropdown reads via getFilterValue(`filter[${FilterType.DELTA}]`).
+ // Then — the Delta dropdown reads via getFilterValue(`filter[${FILTER_FIELD.DELTA}]`).
// For the checkbox of "new" to appear checked, that lookup must return ["new"].
expect(
- result.current.getFilterValue(`filter[${FilterType.DELTA}]`),
+ result.current.getFilterValue(`filter[${FILTER_FIELD.DELTA}]`),
).toEqual(["new"]);
});
diff --git a/ui/hooks/use-finding-group-resource-state.test.ts b/ui/hooks/use-finding-group-resource-state.test.ts
index 7803270def..c86284d8e4 100644
--- a/ui/hooks/use-finding-group-resource-state.test.ts
+++ b/ui/hooks/use-finding-group-resource-state.test.ts
@@ -1,4 +1,4 @@
-import { renderHook } from "@testing-library/react";
+import { act, renderHook } from "@testing-library/react";
import { beforeEach, describe, expect, it, vi } from "vitest";
const { useFindingGroupResourcesMock, useResourceDetailDrawerMock } =
@@ -24,7 +24,12 @@ vi.mock("@/components/findings/table/resource-detail-drawer", () => ({
useResourceDetailDrawer: useResourceDetailDrawerMock,
}));
-import { type FindingGroupRow, FINDINGS_ROW_TYPE } from "@/types";
+import {
+ type FindingGroupRow,
+ type FindingResourceRow,
+ FINDINGS_ROW_TYPE,
+} from "@/types";
+import { FINDING_TRIAGE_STATUS } from "@/types/findings-triage";
import { useFindingGroupResourceState } from "./use-finding-group-resource-state";
@@ -123,4 +128,84 @@ describe("useFindingGroupResourceState", () => {
}),
);
});
+
+ it("preserves an existing mute reason for already-muted optimistic shortcut updates", async () => {
+ // Given
+ const mutedResource: FindingResourceRow = {
+ id: "resource-1",
+ rowType: FINDINGS_ROW_TYPE.RESOURCE,
+ findingId: "finding-1",
+ checkId: "check-1",
+ providerType: "aws",
+ providerAlias: "production",
+ providerUid: "provider-1",
+ resourceName: "resource-1",
+ resourceType: "Bucket",
+ resourceGroup: "default",
+ resourceUid: "resource-uid-1",
+ service: "s3",
+ region: "us-east-1",
+ severity: "high",
+ status: "MUTED",
+ statusExtended: "Muted finding",
+ delta: null,
+ isMuted: true,
+ mutedReason: "Existing mute rule",
+ firstSeenAt: null,
+ lastSeenAt: "2026-04-22T10:00:00Z",
+ triage: {
+ findingId: "finding-1",
+ findingUid: "finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.OPEN,
+ label: "Open",
+ hasVisibleNote: false,
+ isMuted: true,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ },
+ };
+
+ const { result } = renderHook(() =>
+ useFindingGroupResourceState({
+ group,
+ filters: {},
+ hasHistoricalData: false,
+ }),
+ );
+ const onSetResources = useFindingGroupResourcesMock.mock.calls[0][0]
+ .onSetResources as (
+ resources: FindingResourceRow[],
+ hasMore: boolean,
+ ) => void;
+
+ await act(async () => {
+ onSetResources([mutedResource], false);
+ });
+
+ // When
+ await act(async () => {
+ await result.current.updateTriageOptimistically(
+ {
+ findingId: "finding-1",
+ findingUid: "finding-uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.OPEN,
+ isMuted: true,
+ },
+ async () => undefined,
+ );
+ });
+
+ // Then
+ expect(result.current.resources[0]).toEqual(
+ expect.objectContaining({
+ isMuted: true,
+ mutedReason: "Existing mute rule",
+ }),
+ );
+ });
});
diff --git a/ui/hooks/use-finding-group-resource-state.ts b/ui/hooks/use-finding-group-resource-state.ts
index af59bc8fc9..b146e4d9fb 100644
--- a/ui/hooks/use-finding-group-resource-state.ts
+++ b/ui/hooks/use-finding-group-resource-state.ts
@@ -1,13 +1,19 @@
"use client";
import { OnChangeFn, Row, RowSelectionState } from "@tanstack/react-table";
-import { useState } from "react";
+import { useRef, useState } from "react";
import { canMuteFindingResource } from "@/components/findings/table/finding-resource-selection";
import { useResourceDetailDrawer } from "@/components/findings/table/resource-detail-drawer";
import { useFindingGroupResources } from "@/hooks/use-finding-group-resources";
import { applyDefaultMutedFilter } from "@/lib";
+import {
+ applyOptimisticTriageSummaryUpdate,
+ getOptimisticTriageMutedReason,
+ shouldMarkFindingMutedForTriageUpdate,
+} from "@/lib/finding-triage";
import { FindingGroupRow, FindingResourceRow } from "@/types";
+import type { UpdateFindingTriageInput } from "@/types/findings-triage";
interface UseFindingGroupResourceStateOptions {
group: FindingGroupRow;
@@ -35,6 +41,10 @@ interface UseFindingGroupResourceStateReturn {
handleMuteComplete: () => void;
handleRowSelectionChange: OnChangeFn<RowSelectionState>;
resolveSelectedFindingIds: (ids: string[]) => Promise<string[]>;
+ updateTriageOptimistically: (
+ input: UpdateFindingTriageInput,
+ updateAction: (input: UpdateFindingTriageInput) => Promise<void>,
+ ) => Promise<void>;
}
export function useFindingGroupResourceState({
@@ -47,12 +57,79 @@ export function useFindingGroupResourceState({
const [rowSelection, setRowSelection] = useState<RowSelectionState>({});
const [resources, setResources] = useState<FindingResourceRow[]>([]);
const [isLoading, setIsLoading] = useState(true);
+ const baseResourcesRef = useRef<FindingResourceRow[]>([]);
+ const optimisticTriageByFindingIdRef = useRef(
+ new Map<string, { token: string; input: UpdateFindingTriageInput }>(),
+ );
+ const settledOptimisticFindingIdsRef = useRef(new Set<string>());
+
+ const mergeOptimisticTriage = (items: FindingResourceRow[]) =>
+ items.map((resource) => {
+ const optimisticEntry = optimisticTriageByFindingIdRef.current.get(
+ resource.findingId,
+ );
+ const optimistic = optimisticEntry?.input;
+
+ if (!optimistic || !resource.triage) {
+ return resource;
+ }
+
+ const shouldMarkMuted = shouldMarkFindingMutedForTriageUpdate(optimistic);
+ const shouldSetTriageMuteReason =
+ shouldMarkMuted && optimistic.isMuted !== true;
+
+ return {
+ ...resource,
+ isMuted: shouldMarkMuted ? true : resource.isMuted,
+ mutedReason: shouldSetTriageMuteReason
+ ? getOptimisticTriageMutedReason(optimistic.status!)
+ : resource.mutedReason,
+ triage: applyOptimisticTriageSummaryUpdate(resource.triage, optimistic),
+ };
+ });
+
+ const removeOptimisticEntry = (findingId: string) => {
+ optimisticTriageByFindingIdRef.current.delete(findingId);
+ settledOptimisticFindingIdsRef.current.delete(findingId);
+ };
+
+ const resourceSatisfiesOptimisticUpdate = (
+ resource: FindingResourceRow,
+ optimistic: UpdateFindingTriageInput,
+ ) => {
+ const statusMatches =
+ !optimistic.status || resource.triage?.status === optimistic.status;
+ const noteMatches =
+ !optimistic.note ||
+ Boolean(resource.triage?.hasVisibleNote) ||
+ (resource.triage?.notesCount ?? 0) > 0;
+
+ return statusMatches && noteMatches;
+ };
+
+ const clearSettledOptimisticUpdates = (items: FindingResourceRow[]) => {
+ for (const resource of items) {
+ const optimistic = optimisticTriageByFindingIdRef.current.get(
+ resource.findingId,
+ )?.input;
+
+ if (
+ optimistic &&
+ settledOptimisticFindingIdsRef.current.has(resource.findingId) &&
+ resourceSatisfiesOptimisticUpdate(resource, optimistic)
+ ) {
+ removeOptimisticEntry(resource.findingId);
+ }
+ }
+ };
const handleSetResources = (
newResources: FindingResourceRow[],
_hasMore: boolean,
) => {
- setResources(newResources);
+ clearSettledOptimisticUpdates(newResources);
+ baseResourcesRef.current = newResources;
+ setResources(mergeOptimisticTriage(baseResourcesRef.current));
setIsLoading(false);
};
@@ -60,7 +137,9 @@ export function useFindingGroupResourceState({
newResources: FindingResourceRow[],
_hasMore: boolean,
) => {
- setResources((prev) => [...prev, ...newResources]);
+ clearSettledOptimisticUpdates(newResources);
+ baseResourcesRef.current = [...baseResourcesRef.current, ...newResources];
+ setResources(mergeOptimisticTriage(baseResourcesRef.current));
setIsLoading(false);
};
@@ -141,6 +220,54 @@ export function useFindingGroupResourceState({
return ids.filter(Boolean);
};
+ const applyOptimisticTriageUpdate = (input: UpdateFindingTriageInput) => {
+ removeOptimisticEntry(input.findingId);
+ const token = crypto.randomUUID();
+ optimisticTriageByFindingIdRef.current.set(input.findingId, {
+ token,
+ input,
+ });
+ setResources(mergeOptimisticTriage(baseResourcesRef.current));
+ return token;
+ };
+
+ const clearOptimisticTriageUpdate = (findingId: string, token: string) => {
+ if (
+ optimisticTriageByFindingIdRef.current.get(findingId)?.token !== token
+ ) {
+ return;
+ }
+
+ removeOptimisticEntry(findingId);
+ setResources(mergeOptimisticTriage(baseResourcesRef.current));
+ };
+
+ const settleOptimisticTriageUpdate = (findingId: string, token: string) => {
+ if (
+ optimisticTriageByFindingIdRef.current.get(findingId)?.token !== token
+ ) {
+ return;
+ }
+
+ settledOptimisticFindingIdsRef.current.add(findingId);
+ };
+
+ const updateTriageOptimistically = async (
+ input: UpdateFindingTriageInput,
+ updateAction: (input: UpdateFindingTriageInput) => Promise<void>,
+ ) => {
+ const optimisticToken = applyOptimisticTriageUpdate(input);
+ try {
+ await updateAction(input);
+ settleOptimisticTriageUpdate(input.findingId, optimisticToken);
+ refresh();
+ } catch (error) {
+ clearOptimisticTriageUpdate(input.findingId, optimisticToken);
+ refresh();
+ throw error;
+ }
+ };
+
return {
rowSelection,
resources,
@@ -159,5 +286,6 @@ export function useFindingGroupResourceState({
handleMuteComplete,
handleRowSelectionChange,
resolveSelectedFindingIds,
+ updateTriageOptimistically,
};
}
diff --git a/ui/hooks/use-form-server-errors.ts b/ui/hooks/use-form-server-errors.ts
index 84337c42e6..c8e5077d61 100644
--- a/ui/hooks/use-form-server-errors.ts
+++ b/ui/hooks/use-form-server-errors.ts
@@ -1,6 +1,6 @@
import { UseFormReturn } from "react-hook-form";
-import { useToast } from "@/components/ui";
+import { useToast } from "@/components/shadcn";
import { ApiError } from "@/types";
/**
diff --git a/ui/hooks/use-manage-providers-unlimited-visibility.ts b/ui/hooks/use-manage-providers-unlimited-visibility.ts
new file mode 100644
index 0000000000..6c4990e6c5
--- /dev/null
+++ b/ui/hooks/use-manage-providers-unlimited-visibility.ts
@@ -0,0 +1,42 @@
+import type {
+ FieldValues,
+ Path,
+ PathValue,
+ UseFormReturn,
+} from "react-hook-form";
+
+type RolePermissionValues = {
+ manage_providers?: boolean;
+ unlimited_visibility?: boolean;
+};
+
+const setBooleanFormValue = <T extends FieldValues>(
+ form: Pick<UseFormReturn<T>, "setValue">,
+ field: Path<T>,
+ value: boolean,
+) => {
+ form.setValue(field, value as PathValue<T, Path<T>>, {
+ shouldValidate: true,
+ shouldDirty: true,
+ shouldTouch: true,
+ });
+};
+
+export const useManageProvidersUnlimitedVisibility = <
+ T extends FieldValues & RolePermissionValues,
+>(
+ form: Pick<UseFormReturn<T>, "setValue" | "watch">,
+) => {
+ const setUnlimitedVisibility = (checked: boolean) => {
+ setBooleanFormValue(form, "unlimited_visibility" as Path<T>, checked);
+ };
+
+ const setPermissionValue = (field: string, checked: boolean) => {
+ setBooleanFormValue(form, field as Path<T>, checked);
+ };
+
+ return {
+ setPermissionValue,
+ setUnlimitedVisibility,
+ };
+};
diff --git a/ui/hooks/use-media-query.ts b/ui/hooks/use-media-query.ts
new file mode 100644
index 0000000000..3929011ab9
--- /dev/null
+++ b/ui/hooks/use-media-query.ts
@@ -0,0 +1,20 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+const canMatchMedia = () =>
+ typeof window !== "undefined" && typeof window.matchMedia === "function";
+
+// SSR-safe media query subscription (server snapshot is always false).
+export function useMediaQuery(query: string): boolean {
+ return useSyncExternalStore(
+ (onChange) => {
+ if (!canMatchMedia()) return () => {};
+ const mediaQueryList = window.matchMedia(query);
+ mediaQueryList.addEventListener("change", onChange);
+ return () => mediaQueryList.removeEventListener("change", onChange);
+ },
+ () => (canMatchMedia() ? window.matchMedia(query).matches : false),
+ () => false,
+ );
+}
diff --git a/ui/hooks/use-mute-rule-action.test.ts b/ui/hooks/use-mute-rule-action.test.ts
index 8e8f94f0ba..c060c99b8c 100644
--- a/ui/hooks/use-mute-rule-action.test.ts
+++ b/ui/hooks/use-mute-rule-action.test.ts
@@ -5,7 +5,7 @@ const { toastMock } = vi.hoisted(() => ({
toastMock: vi.fn(),
}));
-vi.mock("@/components/ui", () => ({
+vi.mock("@/components/shadcn", () => ({
useToast: () => ({
toast: toastMock,
}),
diff --git a/ui/hooks/use-mute-rule-action.ts b/ui/hooks/use-mute-rule-action.ts
index 5e34921d62..ce6e9f6939 100644
--- a/ui/hooks/use-mute-rule-action.ts
+++ b/ui/hooks/use-mute-rule-action.ts
@@ -2,7 +2,7 @@
import { useTransition } from "react";
-import { useToast } from "@/components/ui";
+import { useToast } from "@/components/shadcn";
type MuteRuleActionResult = {
success?: string;
diff --git a/ui/hooks/use-related-filters.ts b/ui/hooks/use-related-filters.ts
index 56c0be3a5a..eb5e805b2a 100644
--- a/ui/hooks/use-related-filters.ts
+++ b/ui/hooks/use-related-filters.ts
@@ -2,8 +2,9 @@ import { useSearchParams } from "next/navigation";
import { isScanEntity } from "@/lib/helper-filters";
import {
+ FILTER_FIELD,
FilterEntity,
- FilterType,
+ FilterParam,
ProviderEntity,
ProviderType,
ScanEntity,
@@ -16,7 +17,9 @@ interface UseRelatedFiltersProps {
completedScanIds?: string[];
scanDetails?: { [key: string]: ScanEntity }[];
enableScanRelation?: boolean;
- providerFilterType?: FilterType.PROVIDER | FilterType.PROVIDER_UID;
+ providerFilterType?:
+ | typeof FILTER_FIELD.PROVIDER
+ | typeof FILTER_FIELD.PROVIDER_UID;
}
/**
@@ -38,15 +41,17 @@ export const useRelatedFilters = ({
completedScanIds = [],
scanDetails = [],
enableScanRelation = false,
- providerFilterType = FilterType.PROVIDER,
+ providerFilterType = FILTER_FIELD.PROVIDER,
}: UseRelatedFiltersProps) => {
const searchParams = useSearchParams();
const providers = providerIds.length > 0 ? providerIds : providerUIDs;
- const providerParam = searchParams.get(`filter[${providerFilterType}]`);
+ const providerParam = searchParams.get(
+ `filter[${providerFilterType}]` satisfies FilterParam,
+ );
const providerTypeParam = searchParams.get(
- `filter[${FilterType.PROVIDER_TYPE}]`,
+ `filter[${FILTER_FIELD.PROVIDER_TYPE}]` satisfies FilterParam,
);
const currentProviders = providerParam ? providerParam.split(",") : [];
diff --git a/ui/hooks/use-sidebar.ts b/ui/hooks/use-sidebar.ts
deleted file mode 100644
index f2fe831170..0000000000
--- a/ui/hooks/use-sidebar.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { create } from "zustand";
-import { createJSONStorage, persist } from "zustand/middleware";
-
-type SidebarSettings = { disabled: boolean; isHoverOpen: boolean };
-type SidebarStore = {
- isOpen: boolean;
- isHover: boolean;
- settings: SidebarSettings;
- toggleOpen: () => void;
- setIsOpen: (isOpen: boolean) => void;
- setIsHover: (isHover: boolean) => void;
- getOpenState: () => boolean;
-};
-
-export const useSidebar = create(
- persist<SidebarStore>(
- (set, get) => ({
- isOpen: true,
- isHover: false,
- settings: { disabled: false, isHoverOpen: false },
- toggleOpen: () => {
- set({ isOpen: !get().isOpen });
- },
- setIsOpen: (isOpen: boolean) => {
- set({ isOpen });
- },
- setIsHover: (isHover: boolean) => {
- set({ isHover });
- },
- getOpenState: () => {
- const state = get();
- return state.isOpen || (state.settings.isHoverOpen && state.isHover);
- },
- }),
- {
- name: "sidebar",
- storage: createJSONStorage(() => localStorage),
- },
- ),
-);
diff --git a/ui/instrumentation-client.test.ts b/ui/instrumentation-client.test.ts
index 69728d5426..18b3d6559e 100644
--- a/ui/instrumentation-client.test.ts
+++ b/ui/instrumentation-client.test.ts
@@ -24,10 +24,13 @@ vi.mock("@/lib/get-runtime-config.client", () => ({
getRuntimeConfigClient: getConfigMock,
}));
-vi.mock("@/components/ui/navigation-progress/use-navigation-progress", () => ({
- startProgress: vi.fn(),
- cancelProgress: vi.fn(),
-}));
+vi.mock(
+ "@/components/shadcn/navigation-progress/use-navigation-progress",
+ () => ({
+ startProgress: vi.fn(),
+ cancelProgress: vi.fn(),
+ }),
+);
describe("instrumentation-client Sentry init", () => {
beforeEach(() => {
diff --git a/ui/instrumentation-client.ts b/ui/instrumentation-client.ts
index abced8232e..910af90010 100644
--- a/ui/instrumentation-client.ts
+++ b/ui/instrumentation-client.ts
@@ -19,7 +19,7 @@ import * as Sentry from "@sentry/nextjs";
import {
cancelProgress,
startProgress,
-} from "@/components/ui/navigation-progress/use-navigation-progress";
+} from "@/components/shadcn/navigation-progress/use-navigation-progress";
import { getRuntimeConfigClient } from "@/lib/get-runtime-config.client";
export const NAVIGATION_TYPE = {
diff --git a/ui/instrumentation.ts b/ui/instrumentation.ts
index 6716ffeb4e..c9793bddf7 100644
--- a/ui/instrumentation.ts
+++ b/ui/instrumentation.ts
@@ -19,9 +19,13 @@ import "@/lib/env";
import * as Sentry from "@sentry/nextjs";
-import { readEnv } from "@/lib/runtime-env";
+import { readGatedEnv } from "@/lib/integrations";
-const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
+const sentryDsn = readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+);
export async function register() {
// Skip Sentry initialization if DSN is not configured
diff --git a/ui/knip.config.ts b/ui/knip.config.ts
index 9afb7d8240..7423037350 100644
--- a/ui/knip.config.ts
+++ b/ui/knip.config.ts
@@ -33,9 +33,6 @@ const config: KnipConfig = {
// Sentry instrumentation hooks — loaded via require() by the runtime
"import-in-the-middle",
"require-in-the-middle",
- // @heroui/react re-exports all sub-packages; imports like @heroui/skeleton
- // resolve to transitive deps of @heroui/react, not direct dependencies
- "@heroui/*",
],
ignoreExportsUsedInFile: {
interface: true,
diff --git a/ui/lib/action-errors.test.ts b/ui/lib/action-errors.test.ts
index b770f6b7af..5c434dab5b 100644
--- a/ui/lib/action-errors.test.ts
+++ b/ui/lib/action-errors.test.ts
@@ -22,7 +22,7 @@ describe("getActionErrorMessage", () => {
expect(message).toBe(ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.FORBIDDEN]);
});
- it("should use the default subscription error for payment-required responses", () => {
+ it("should use the default usage-limit error for payment-required responses", () => {
// Given
const result = {
error: "Payment required.",
diff --git a/ui/lib/action-errors.ts b/ui/lib/action-errors.ts
index 46fc3ae4b8..bea6dcd8df 100644
--- a/ui/lib/action-errors.ts
+++ b/ui/lib/action-errors.ts
@@ -6,9 +6,14 @@ export const ACTION_ERROR_STATUS = {
export type ActionErrorStatus =
(typeof ACTION_ERROR_STATUS)[keyof typeof ACTION_ERROR_STATUS];
+// Shown whenever the API returns 402 for an over-limit (trial-expired) tenant.
+// Rendered with a billing link by he `UsageLimitMessage` component, and as
+// plain text in toasts/field errors.
+export const USAGE_LIMIT_MESSAGE =
+ "You have exceeded the usage limit of one provider. You can add more providers and run unlimited scans by adding a subscription.";
+
export const ACTION_ERROR_MESSAGES = {
- [ACTION_ERROR_STATUS.PAYMENT_REQUIRED]:
- "Your subscription doesn't allow this action. Upgrade your plan or contact an administrator.",
+ [ACTION_ERROR_STATUS.PAYMENT_REQUIRED]: USAGE_LIMIT_MESSAGE,
[ACTION_ERROR_STATUS.FORBIDDEN]:
"You don't have permission to perform this action. Ask an administrator to update your role.",
} as const satisfies Record<ActionErrorStatus, string>;
diff --git a/ui/lib/auth-callback-url.test.ts b/ui/lib/auth-callback-url.test.ts
new file mode 100644
index 0000000000..71161c7c98
--- /dev/null
+++ b/ui/lib/auth-callback-url.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ appendCallbackState,
+ getInvitationTokenFromCallbackPath,
+ getSafeCallbackPath,
+} from "@/lib/auth-callback-url";
+
+describe("auth callback URL helpers", () => {
+ describe("when appending OAuth state", () => {
+ it("should add a relative callback path as provider state", () => {
+ const authUrl = "https://accounts.example.com/oauth?client_id=client";
+ const callbackPath = "/invitation/accept?invitation_token=test-token";
+
+ const result = appendCallbackState(authUrl, callbackPath);
+
+ expect(new URL(result).searchParams.get("state")).toBe(callbackPath);
+ });
+
+ it("should not add state for the default callback path", () => {
+ const authUrl = "https://accounts.example.com/oauth?client_id=client";
+
+ const result = appendCallbackState(authUrl, "/");
+
+ expect(new URL(result).searchParams.has("state")).toBe(false);
+ });
+ });
+
+ describe("when reading callback paths", () => {
+ it("should return relative callback paths", () => {
+ const params = new URLSearchParams({
+ state: "/invitation/accept?invitation_token=test-token",
+ });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe("/invitation/accept?invitation_token=test-token");
+ });
+
+ it("should reject external callback URLs", () => {
+ const params = new URLSearchParams({
+ state: "https://attacker.example/phishing",
+ });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe("/");
+ });
+
+ it("should reject protocol-relative callback URLs", () => {
+ const params = new URLSearchParams({
+ state: "//attacker.example/phishing",
+ });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe("/");
+ });
+
+ it("should reject backslash-normalized callback URLs", () => {
+ const params = new URLSearchParams({ state: "/\\attacker.example" });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe("/");
+ });
+
+ it("should reject callback URLs with control characters before the host", () => {
+ const params = new URLSearchParams({ state: "/\t/attacker.example" });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe("/");
+ });
+
+ it("should preserve the query string of relative callback paths", () => {
+ const params = new URLSearchParams({
+ state: "/invitation/accept?invitation_token=test-token&foo=bar",
+ });
+
+ const result = getSafeCallbackPath(params);
+
+ expect(result).toBe(
+ "/invitation/accept?invitation_token=test-token&foo=bar",
+ );
+ });
+ });
+
+ describe("when appending OAuth state for unsafe paths", () => {
+ it("should not add a backslash-normalized path as provider state", () => {
+ const authUrl = "https://accounts.example.com/oauth?client_id=client";
+
+ const result = appendCallbackState(authUrl, "/\\attacker.example");
+
+ expect(new URL(result).searchParams.has("state")).toBe(false);
+ });
+ });
+
+ describe("when reading invitation tokens", () => {
+ it("should return invitation tokens from safe callback paths", () => {
+ const callbackPath = "/invitation/accept?invitation_token=test-token";
+
+ const result = getInvitationTokenFromCallbackPath(callbackPath);
+
+ expect(result).toBe("test-token");
+ });
+ });
+});
diff --git a/ui/lib/auth-callback-url.ts b/ui/lib/auth-callback-url.ts
new file mode 100644
index 0000000000..c2bdd6be9c
--- /dev/null
+++ b/ui/lib/auth-callback-url.ts
@@ -0,0 +1,65 @@
+const DEFAULT_CALLBACK_PATH = "/";
+const INVITATION_TOKEN_PARAM = "invitation_token";
+// Origin used only to resolve relative paths; never part of the returned value.
+const INTERNAL_ORIGIN = "http://localhost";
+
+type CallbackSearchParams = {
+ get(name: string): string | null;
+};
+
+export const getSafeCallbackPathFromValue = (
+ value: string | null | undefined,
+) => {
+ if (!value || !value.startsWith("/") || value.startsWith("//")) {
+ return DEFAULT_CALLBACK_PATH;
+ }
+
+ // A prefix check is not enough: the URL parser normalizes backslashes and
+ // control characters, so "/\evil.com" or "/\t/evil.com" pass the check above
+ // yet resolve to an external origin. Resolve against a fixed origin and
+ // confirm it stayed internal before trusting the path.
+ try {
+ const url = new URL(value, INTERNAL_ORIGIN);
+ if (url.origin !== INTERNAL_ORIGIN) {
+ return DEFAULT_CALLBACK_PATH;
+ }
+
+ return `${url.pathname}${url.search}${url.hash}`;
+ } catch (_error) {
+ return DEFAULT_CALLBACK_PATH;
+ }
+};
+
+export const getSafeCallbackPath = (
+ searchParams: CallbackSearchParams,
+ key = "state",
+) => getSafeCallbackPathFromValue(searchParams.get(key));
+
+export const appendCallbackState = (authUrl: string, callbackPath: string) => {
+ const safeCallbackPath = getSafeCallbackPathFromValue(callbackPath);
+ if (safeCallbackPath === DEFAULT_CALLBACK_PATH) {
+ return authUrl;
+ }
+
+ try {
+ const url = new URL(authUrl);
+ url.searchParams.set("state", safeCallbackPath);
+ return url.toString();
+ } catch (_error) {
+ return authUrl;
+ }
+};
+
+export const getInvitationTokenFromCallbackPath = (callbackPath: string) => {
+ const safeCallbackPath = getSafeCallbackPathFromValue(callbackPath);
+ if (safeCallbackPath === DEFAULT_CALLBACK_PATH) {
+ return null;
+ }
+
+ try {
+ const url = new URL(safeCallbackPath, "http://localhost");
+ return url.searchParams.get(INVITATION_TOKEN_PARAM);
+ } catch (_error) {
+ return null;
+ }
+};
diff --git a/ui/lib/cloud-upgrade.test.ts b/ui/lib/cloud-upgrade.test.ts
new file mode 100644
index 0000000000..f16f54413b
--- /dev/null
+++ b/ui/lib/cloud-upgrade.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+
+import { CLOUD_UPGRADE_FEATURE } from "@/types/cloud-upgrade";
+
+import {
+ CLOUD_UPGRADE_CONTENT,
+ CLOUD_UPGRADE_FOOTER_NOTE,
+ getCloudUpgradeCompareUrl,
+ getCloudUpgradePrimaryUrl,
+} from "./cloud-upgrade";
+
+describe("cloud upgrade content", () => {
+ it("should use title case for every Cloud modal title", () => {
+ // Given / When
+ const titles = Object.values(CLOUD_UPGRADE_CONTENT).map(
+ (content) => content.title,
+ );
+
+ // Then
+ expect(titles).toEqual([
+ "Keep Every Provider Checked Automatically",
+ "Turn Findings into Alerts",
+ "Add Your Entire AWS Organization",
+ "Bring CLI Findings into One Cloud View",
+ "See Compliance Across Every Provider",
+ "Coordinate Finding Remediation",
+ "Use The Agent Cloud Defender",
+ "Scale Prowler Without Operating It",
+ "Configure Every Scan Once",
+ ]);
+ });
+
+ it("should explain that Prowler Local Server remains unchanged", () => {
+ // Given / When / Then
+ expect(CLOUD_UPGRADE_FOOTER_NOTE).toBe(
+ "Prowler Cloud opens in a new tab. Your Prowler Local Server remains unchanged.",
+ );
+ });
+});
+
+describe("cloud upgrade URLs", () => {
+ it("should attribute the primary Cloud destination", () => {
+ // Given / When
+ const url = getCloudUpgradePrimaryUrl(CLOUD_UPGRADE_FEATURE.ALERTS);
+
+ // Then
+ expect(url).toBe(
+ "https://cloud.prowler.com/sign-up?utm_source=prowler-local-server&utm_content=alerts",
+ );
+ });
+
+ it("should attribute the plans and pricing destination", () => {
+ // Given / When
+ const url = getCloudUpgradeCompareUrl(
+ CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE,
+ );
+
+ // Then
+ expect(url).toBe(
+ "https://prowler.com/pricing?utm_source=prowler-local-server&utm_content=cross-provider-compliance",
+ );
+ });
+
+ it.each([
+ [CLOUD_UPGRADE_FEATURE.ADVANCED_SCHEDULING, "advanced-scheduling"],
+ [CLOUD_UPGRADE_FEATURE.ALERTS, "alerts"],
+ [CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS, "organization"],
+ [CLOUD_UPGRADE_FEATURE.CLI_IMPORT, "cli-import"],
+ [
+ CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE,
+ "cross-provider-compliance",
+ ],
+ [CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE, "findings"],
+ [CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI, "lighthouse-ai"],
+ [CLOUD_UPGRADE_FEATURE.GENERAL, "general"],
+ [CLOUD_UPGRADE_FEATURE.SCAN_CONFIGURATION, "scan-configuration"],
+ ])("should use the canonical content slug for %s", (feature, contentSlug) => {
+ // Given / When
+ const url = new URL(getCloudUpgradePrimaryUrl(feature));
+
+ // Then
+ expect(url.searchParams.get("utm_content")).toBe(contentSlug);
+ });
+});
diff --git a/ui/lib/cloud-upgrade.ts b/ui/lib/cloud-upgrade.ts
new file mode 100644
index 0000000000..a8993cdfbd
--- /dev/null
+++ b/ui/lib/cloud-upgrade.ts
@@ -0,0 +1,152 @@
+import {
+ CLOUD_UPGRADE_FEATURE,
+ type CloudUpgradeFeature,
+} from "@/types/cloud-upgrade";
+
+interface CloudUpgradeContent {
+ title: string;
+ description: string;
+ benefits: readonly [string, string, string, ...string[]];
+ primaryCta: string;
+}
+
+export const CLOUD_UPGRADE_SECONDARY_CTA = "View Plans & Pricing";
+export const CLOUD_UPGRADE_FOOTER_NOTE =
+ "Prowler Cloud opens in a new tab. Your Prowler Local Server remains unchanged.";
+
+const CLOUD_SIGN_UP_URL = "https://cloud.prowler.com/sign-up";
+const PRICING_URL = "https://prowler.com/pricing";
+const LOCAL_SERVER_UTM_SOURCE = "prowler-local-server";
+
+const CLOUD_UPGRADE_UTM_CONTENT = {
+ [CLOUD_UPGRADE_FEATURE.ADVANCED_SCHEDULING]: "advanced-scheduling",
+ [CLOUD_UPGRADE_FEATURE.ALERTS]: "alerts",
+ [CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS]: "organization",
+ [CLOUD_UPGRADE_FEATURE.CLI_IMPORT]: "cli-import",
+ [CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE]:
+ "cross-provider-compliance",
+ [CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE]: "findings",
+ [CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI]: "lighthouse-ai",
+ [CLOUD_UPGRADE_FEATURE.GENERAL]: "general",
+ [CLOUD_UPGRADE_FEATURE.SCAN_CONFIGURATION]: "scan-configuration",
+} as const satisfies Record<CloudUpgradeFeature, string>;
+
+export const CLOUD_UPGRADE_CONTENT = {
+ [CLOUD_UPGRADE_FEATURE.ADVANCED_SCHEDULING]: {
+ title: "Keep Every Provider Checked Automatically",
+ description:
+ "Run scans on the cadence you choose without maintaining scheduling infrastructure.",
+ benefits: [
+ "Choose daily, interval, weekly, or monthly scans",
+ "Set scan times in your preferred timezone",
+ "Manage schedules alongside scan history",
+ ],
+ primaryCta: "Schedule Scans in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.ALERTS]: {
+ title: "Turn Findings into Alerts",
+ description:
+ "Get notified when the findings you care about appear in a scan.",
+ benefits: [
+ "Get alerted on what matters most",
+ "Notify the right people after every scan",
+ "Manage alert rules from one place",
+ ],
+ primaryCta: "Create Alerts in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.AWS_ORGANIZATIONS]: {
+ title: "Add Your Entire AWS Organization",
+ description:
+ "Discover accounts and organizational units, then manage them from one place.",
+ benefits: [
+ "Discover accounts and organizational units automatically",
+ "Choose exactly which accounts to onboard",
+ "Apply schedules across the selected accounts",
+ ],
+ primaryCta: "Set Up AWS Organizations in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.CLI_IMPORT]: {
+ title: "Bring CLI Findings into One Cloud View",
+ description:
+ "Send Prowler CLI scan results to Prowler Cloud for centralized analysis and collaboration.",
+ benefits: [
+ "Push results directly with --push-to-cloud",
+ "Track CLI and managed scans in one place",
+ "Automate findings ingestion from CI/CD pipelines",
+ ],
+ primaryCta: "Import CLI Findings in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.CROSS_PROVIDER_COMPLIANCE]: {
+ title: "See Compliance Across Every Provider",
+ description:
+ "Replace separate scan reports with a consolidated compliance view.",
+ benefits: [
+ "Compare framework posture across providers",
+ "Find coverage gaps without switching scans",
+ "Generate a consolidated compliance report",
+ ],
+ primaryCta: "Consolidate Compliance in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.FINDING_TRIAGE]: {
+ title: "Coordinate Finding Remediation",
+ description:
+ "Add investigation notes and move findings through a shared remediation workflow.",
+ benefits: [
+ "Preserve investigation context on each finding",
+ "Track review and remediation status",
+ "Keep triage history with future scans",
+ ],
+ primaryCta: "Triage Findings in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.LIGHTHOUSE_AI]: {
+ title: "Use The Agent Cloud Defender",
+ description:
+ "Investigate and act on your security posture without operating an AI stack.",
+ benefits: [
+ "Start without provisioning or managing OpenAI API keys",
+ "Automate security workflows through the hosted remote MCP server",
+ "Keep Lighthouse actions grounded in your Prowler Cloud data",
+ ],
+ primaryCta: "Open Lighthouse AI in Prowler Cloud",
+ },
+ [CLOUD_UPGRADE_FEATURE.GENERAL]: {
+ title: "Scale Prowler Without Operating It",
+ description:
+ "Add managed automation and collaboration while Prowler operates the platform.",
+ benefits: [
+ "Onboard AWS Organizations and automate scans and alerts",
+ "Triage findings and consolidate compliance across providers",
+ "Investigate and remediate with Lighthouse AI and Agentic View",
+ "Use managed infrastructure, support, and backups",
+ ],
+ primaryCta: "Start a Prowler Cloud Trial",
+ },
+ [CLOUD_UPGRADE_FEATURE.SCAN_CONFIGURATION]: {
+ title: "Configure Every Scan Once",
+ description:
+ "Create reusable scan configurations instead of rebuilding options for each run.",
+ benefits: [
+ "Reduce noise by fine-tuning scan configurations",
+ "Apply consistent configurations to providers",
+ "Manage scan behavior from one place",
+ ],
+ primaryCta: "Configure Scans in Prowler Cloud",
+ },
+} as const satisfies Record<CloudUpgradeFeature, CloudUpgradeContent>;
+
+const buildCloudUpgradeUrl = (
+ baseUrl: string,
+ feature: CloudUpgradeFeature,
+) => {
+ const url = new URL(baseUrl);
+ url.searchParams.set("utm_source", LOCAL_SERVER_UTM_SOURCE);
+ url.searchParams.set("utm_content", CLOUD_UPGRADE_UTM_CONTENT[feature]);
+
+ return url.toString();
+};
+
+export const getCloudUpgradePrimaryUrl = (feature: CloudUpgradeFeature) =>
+ buildCloudUpgradeUrl(CLOUD_SIGN_UP_URL, feature);
+
+export const getCloudUpgradeCompareUrl = (feature: CloudUpgradeFeature) =>
+ buildCloudUpgradeUrl(PRICING_URL, feature);
diff --git a/ui/lib/compliance/asd-essential-eight.tsx b/ui/lib/compliance/asd-essential-eight.tsx
index 0ceaa393c3..b1fa4d7f9f 100644
--- a/ui/lib/compliance/asd-essential-eight.tsx
+++ b/ui/lib/compliance/asd-essential-eight.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import type { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import type { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import type { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import type { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
type ASDEssentialEightRequirement,
type AttributesData,
@@ -91,6 +91,7 @@ export const mapComplianceData = (
description: description,
status: status,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -150,6 +151,7 @@ export const toAccordionItems = (
type=""
name={control.label}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/aws-well-architected.tsx b/ui/lib/compliance/aws-well-architected.tsx
index ce1f95d5c7..012e237192 100644
--- a/ui/lib/compliance/aws-well-architected.tsx
+++ b/ui/lib/compliance/aws-well-architected.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
AWSWellArchitectedAttributesMetadata,
@@ -69,6 +69,7 @@ export const mapComplianceData = (
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -132,6 +133,7 @@ export const toAccordionItems = (
requirement.name
}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/c5.tsx b/ui/lib/compliance/c5.tsx
index 13be45fd8f..4839df3d66 100644
--- a/ui/lib/compliance/c5.tsx
+++ b/ui/lib/compliance/c5.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
C5AttributesMetadata,
@@ -72,6 +72,7 @@ export const mapComplianceData = (
description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
...getStatusCounters(finalStatus),
type: attrs.Type,
about_criteria: attrs.AboutCriteria,
@@ -101,6 +102,7 @@ const createRequirementItem = (
type={requirement.type as string}
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/ccc.tsx b/ui/lib/compliance/ccc.tsx
index 59df6a7c09..f2cede42ad 100644
--- a/ui/lib/compliance/ccc.tsx
+++ b/ui/lib/compliance/ccc.tsx
@@ -2,8 +2,8 @@ import { ClientAccordionContent } from "@/components/compliance/compliance-accor
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
CCCAttributesMetadata,
@@ -93,6 +93,7 @@ const createRequirement = (itemData: ProcessedItem): Requirement => {
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -179,6 +180,7 @@ const createRequirementAccordionItem = (
type=""
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/cis-controls.tsx b/ui/lib/compliance/cis-controls.tsx
new file mode 100644
index 0000000000..7a7f283fc6
--- /dev/null
+++ b/ui/lib/compliance/cis-controls.tsx
@@ -0,0 +1,143 @@
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
+import {
+ AttributesData,
+ CISControlsAttributesMetadata,
+ Framework,
+ Requirement,
+ REQUIREMENT_STATUS,
+ RequirementsData,
+ RequirementStatus,
+} from "@/types/compliance";
+
+import {
+ calculateFrameworkCounters,
+ createRequirementsMap,
+ findOrCreateCategory,
+ findOrCreateControl,
+ findOrCreateFramework,
+} from "./commons";
+
+const getStatusCounters = (status: RequirementStatus) => ({
+ pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
+ fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
+ manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
+});
+
+// Sort the 18 CIS Controls by their leading number ("1. ...", "2. ...", ...,
+// "18. ...") so the accordion always reads in canonical control order
+// regardless of how the API returns the sections.
+const sectionOrder = (section: string): number => {
+ const match = section.match(/^(\d+)/);
+ return match ? parseInt(match[1], 10) : Number.MAX_SAFE_INTEGER;
+};
+
+export const mapComplianceData = (
+ attributesData: AttributesData,
+ requirementsData: RequirementsData,
+): Framework[] => {
+ const attributes = attributesData?.data || [];
+ const requirementsMap = createRequirementsMap(requirementsData);
+ const frameworks: Framework[] = [];
+
+ for (const attributeItem of attributes) {
+ const id = attributeItem.id;
+ const metadataArray = attributeItem.attributes?.attributes
+ ?.metadata as unknown as CISControlsAttributesMetadata[];
+ const attrs = metadataArray?.[0];
+ if (!attrs) continue;
+
+ const requirementData = requirementsMap.get(id);
+ if (!requirementData) continue;
+
+ const frameworkName = attributeItem.attributes.framework;
+ // Group by Section (the top-level CIS Control). Function, AssetType and
+ // ImplementationGroups live inside the requirement so they show up on the
+ // detail drawer.
+ const categoryName = attrs.Section;
+ const requirementName = attributeItem.attributes.name || "";
+ const description = attributeItem.attributes.description;
+ const status = requirementData.attributes.status || "";
+ const checks = attributeItem.attributes.attributes.check_ids || [];
+
+ const framework = findOrCreateFramework(frameworks, frameworkName);
+ const category = findOrCreateCategory(framework.categories, categoryName);
+ // Flat 2-level structure: control → safeguards (no intermediate level).
+ const control = findOrCreateControl(category.controls, categoryName);
+
+ const finalStatus: RequirementStatus = status as RequirementStatus;
+ const requirement: Requirement = {
+ name: requirementName ? `${id} - ${requirementName}` : id,
+ description,
+ status: finalStatus,
+ check_ids: checks,
+ ...getStatusCounters(finalStatus),
+ function: attrs.Function ?? undefined,
+ asset_type: attrs.AssetType ?? undefined,
+ implementation_groups: attrs.ImplementationGroups ?? undefined,
+ };
+
+ control.requirements.push(requirement);
+ }
+
+ for (const framework of frameworks) {
+ framework.categories.sort(
+ (a, b) => sectionOrder(a.name) - sectionOrder(b.name),
+ );
+ }
+
+ calculateFrameworkCounters(frameworks);
+
+ return frameworks;
+};
+
+export const toAccordionItems = (
+ data: Framework[],
+ scanId: string | undefined,
+): AccordionItemProps[] => {
+ const safeId = scanId || "";
+
+ return data.flatMap((framework) =>
+ framework.categories.map((category) => ({
+ key: `${framework.name}-${category.name}`,
+ title: (
+ <ComplianceAccordionTitle
+ label={category.name}
+ pass={category.pass}
+ fail={category.fail}
+ manual={category.manual}
+ isParentLevel={true}
+ />
+ ),
+ content: "",
+ // Control → safeguards (flat, no intermediate level).
+ items: category.controls.flatMap((control) =>
+ control.requirements.map((requirement, reqIndex) => ({
+ key: `${framework.name}-${category.name}-req-${reqIndex}`,
+ title: (
+ <ComplianceAccordionRequirementTitle
+ type=""
+ name={requirement.name}
+ status={requirement.status as FindingStatus}
+ />
+ ),
+ content: (
+ <ClientAccordionContent
+ key={`content-${framework.name}-${category.name}-req-${reqIndex}`}
+ requirement={requirement}
+ scanId={safeId}
+ framework={framework.name}
+ disableFindings={
+ requirement.check_ids.length === 0 && requirement.manual === 0
+ }
+ />
+ ),
+ items: [],
+ })),
+ ),
+ })),
+ );
+};
diff --git a/ui/lib/compliance/cis.tsx b/ui/lib/compliance/cis.tsx
index 5bcc3d7b13..d52c89dc81 100644
--- a/ui/lib/compliance/cis.tsx
+++ b/ui/lib/compliance/cis.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
CISAttributesMetadata,
@@ -38,8 +38,11 @@ export const mapComplianceData = (
const attrs = metadataArray?.[0];
if (!attrs) continue;
- // Apply profile filter
- if (filter === "Level 1" && attrs.Profile !== "Level 1") {
+ // Apply profile filter.
+ // Most CIS benchmarks use "Level 1"/"Level 2" as the Profile, but some
+ // (e.g. M365) prefix it with the license tier: "E3 Level 1", "E5 Level 2".
+ // Match by suffix so the Level 1 filter works across all CIS variants.
+ if (filter === "Level 1" && !attrs.Profile?.endsWith("Level 1")) {
continue; // Skip Level 2 requirements when Level 1 is selected
}
@@ -80,6 +83,7 @@ export const mapComplianceData = (
description: attrs.Description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -138,6 +142,7 @@ export const toAccordionItems = (
type=""
name={control.label}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/commons.tsx b/ui/lib/compliance/commons.tsx
index dc96678e2c..24a7b8407c 100644
--- a/ui/lib/compliance/commons.tsx
+++ b/ui/lib/compliance/commons.tsx
@@ -13,6 +13,11 @@ import {
TopFailedResult,
} from "@/types/compliance";
+// Note shown when a requirement fails only because the applied scan config
+// does not satisfy its requirements, even though every finding passed.
+export const INVALID_CONFIG_NOTE =
+ "Marked as FAIL because the applied scan configuration does not meet this requirement, even though all findings passed.";
+
// Type for the internal map used in getTopFailedSections
interface FailedSectionData {
total: number;
diff --git a/ui/lib/compliance/compliance-mapper.ts b/ui/lib/compliance/compliance-mapper.ts
index bc0995ad87..289e16bc47 100644
--- a/ui/lib/compliance/compliance-mapper.ts
+++ b/ui/lib/compliance/compliance-mapper.ts
@@ -4,6 +4,7 @@ import { ASDEssentialEightCustomDetails } from "@/components/compliance/complian
import { AWSWellArchitectedCustomDetails } from "@/components/compliance/compliance-custom-details/aws-well-architected-details";
import { C5CustomDetails } from "@/components/compliance/compliance-custom-details/c5-details";
import { CCCCustomDetails } from "@/components/compliance/compliance-custom-details/ccc-details";
+import { CISControlsCustomDetails } from "@/components/compliance/compliance-custom-details/cis-controls-details";
import { CISCustomDetails } from "@/components/compliance/compliance-custom-details/cis-details";
import { CSACustomDetails } from "@/components/compliance/compliance-custom-details/csa-details";
import { DORACustomDetails } from "@/components/compliance/compliance-custom-details/dora-details";
@@ -14,7 +15,7 @@ import { KISACustomDetails } from "@/components/compliance/compliance-custom-det
import { MITRECustomDetails } from "@/components/compliance/compliance-custom-details/mitre-details";
import { OktaIDaaSStigCustomDetails } from "@/components/compliance/compliance-custom-details/okta-idaas-stig-details";
import { ThreatCustomDetails } from "@/components/compliance/compliance-custom-details/threat-details";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
import {
AttributesData,
CategoryData,
@@ -44,6 +45,10 @@ import {
mapComplianceData as mapCISComplianceData,
toAccordionItems as toCISAccordionItems,
} from "./cis";
+import {
+ mapComplianceData as mapCISControlsComplianceData,
+ toAccordionItems as toCISControlsAccordionItems,
+} from "./cis-controls";
import { calculateCategoryHeatmapData, getTopFailedSections } from "./commons";
import {
mapComplianceData as mapCSAComplianceData,
@@ -156,6 +161,20 @@ const getComplianceMappers = (): Record<string, ComplianceMapper> => ({
getDetailsComponent: (requirement: Requirement) =>
createElement(CISCustomDetails, { requirement }),
},
+ // CIS Controls v8.1 — universal framework keyed by the `framework` field of
+ // `prowler/compliance/cis_controls_8.1.json` ("CIS-Controls"). Distinct from
+ // the per-provider CIS Benchmarks (keyed "CIS"). Groups by Section (the 18
+ // CIS Controls) and surfaces Security Function / Asset Type / Implementation
+ // Groups in the requirement detail drawer.
+ "CIS-Controls": {
+ mapComplianceData: mapCISControlsComplianceData,
+ toAccordionItems: toCISControlsAccordionItems,
+ getTopFailedSections,
+ calculateCategoryHeatmapData: (data: Framework[]) =>
+ calculateCategoryHeatmapData(data),
+ getDetailsComponent: (requirement: Requirement) =>
+ createElement(CISControlsCustomDetails, { requirement }),
+ },
"AWS-Well-Architected-Framework-Security-Pillar": {
mapComplianceData: mapAWSWellArchitectedComplianceData,
toAccordionItems: toAWSWellArchitectedAccordionItems,
diff --git a/ui/lib/compliance/compliance-report-types.test.ts b/ui/lib/compliance/compliance-report-types.test.ts
index d8d41f08ec..0697a7fcce 100644
--- a/ui/lib/compliance/compliance-report-types.test.ts
+++ b/ui/lib/compliance/compliance-report-types.test.ts
@@ -39,6 +39,7 @@ describe("isOcsfSupported", () => {
it("returns true for universal frameworks shipping an OCSF artifact", () => {
expect(isOcsfSupported("dora_2022_2554")).toBe(true);
expect(isOcsfSupported("csa_ccm_4.0")).toBe(true);
+ expect(isOcsfSupported("cis_controls_8.1")).toBe(true);
});
it("returns false for legacy/per-provider frameworks without OCSF output", () => {
diff --git a/ui/lib/compliance/compliance-report-types.ts b/ui/lib/compliance/compliance-report-types.ts
index f8f23a67e1..39ae576e28 100644
--- a/ui/lib/compliance/compliance-report-types.ts
+++ b/ui/lib/compliance/compliance-report-types.ts
@@ -180,6 +180,7 @@ export const pickLatestCisPerProvider = (
const OCSF_SUPPORTED_COMPLIANCE_IDS: ReadonlySet<string> = new Set([
"dora_2022_2554",
"csa_ccm_4.0",
+ "cis_controls_8.1",
]);
export const isOcsfSupported = (complianceId: string | undefined): boolean =>
diff --git a/ui/lib/compliance/csa.tsx b/ui/lib/compliance/csa.tsx
index c4624baa43..3bb601de0c 100644
--- a/ui/lib/compliance/csa.tsx
+++ b/ui/lib/compliance/csa.tsx
@@ -2,8 +2,8 @@ import { ClientAccordionContent } from "@/components/compliance/compliance-accor
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
CSAAttributesMetadata,
@@ -78,6 +78,7 @@ export const mapComplianceData = (
description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
...getStatusCounters(finalStatus),
ccm_lite: attrs.CCMLite,
iaas: attrs.IaaS,
@@ -122,6 +123,7 @@ export const toAccordionItems = (
type=""
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/dora.tsx b/ui/lib/compliance/dora.tsx
index 052bb9deb3..8ac364f29f 100644
--- a/ui/lib/compliance/dora.tsx
+++ b/ui/lib/compliance/dora.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
DORAAttributesMetadata,
@@ -77,6 +77,7 @@ export const mapComplianceData = (
description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
...getStatusCounters(finalStatus),
pillar: attrs.Pillar,
article: attrs.Article,
@@ -133,6 +134,7 @@ export const toAccordionItems = (
type=""
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/ens.tsx b/ui/lib/compliance/ens.tsx
index 7d2ae154de..b1983d85da 100644
--- a/ui/lib/compliance/ens.tsx
+++ b/ui/lib/compliance/ens.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
ENSAttributesMetadata,
@@ -91,6 +91,7 @@ export const mapComplianceData = (
status: finalStatus,
type,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -158,6 +159,7 @@ export const toAccordionItems = (
type={requirement.type as string}
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/generic.tsx b/ui/lib/compliance/generic.tsx
index 279e573838..df8089fa44 100644
--- a/ui/lib/compliance/generic.tsx
+++ b/ui/lib/compliance/generic.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
Framework,
@@ -42,6 +42,7 @@ const createRequirement = (itemData: ProcessedItem): Requirement => {
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -163,6 +164,7 @@ const createRequirementAccordionItem = (
type=""
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
@@ -249,6 +251,7 @@ export const toAccordionItems = (
type=""
name={control.label}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/iso.tsx b/ui/lib/compliance/iso.tsx
index 9dc460b11b..e56c430efe 100644
--- a/ui/lib/compliance/iso.tsx
+++ b/ui/lib/compliance/iso.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
Framework,
@@ -67,6 +67,7 @@ export const mapComplianceData = (
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -116,6 +117,7 @@ export const toAccordionItems = (
type=""
name={(requirement.control_label as string) || requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/kisa.tsx b/ui/lib/compliance/kisa.tsx
index 467b17df2b..aa7b2d911a 100644
--- a/ui/lib/compliance/kisa.tsx
+++ b/ui/lib/compliance/kisa.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
Framework,
@@ -66,6 +66,7 @@ export const mapComplianceData = (
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -125,6 +126,7 @@ export const toAccordionItems = (
type=""
name={requirement.section as string}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/mitre.tsx b/ui/lib/compliance/mitre.tsx
index 1358a2c240..89facb476d 100644
--- a/ui/lib/compliance/mitre.tsx
+++ b/ui/lib/compliance/mitre.tsx
@@ -1,7 +1,7 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
CategoryData,
@@ -71,6 +71,7 @@ export const mapComplianceData = (
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -133,6 +134,7 @@ export const toAccordionItems = (
type=""
name={requirement.name}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/compliance/okta-idaas-stig.tsx b/ui/lib/compliance/okta-idaas-stig.tsx
index 5a00886406..8603c33711 100644
--- a/ui/lib/compliance/okta-idaas-stig.tsx
+++ b/ui/lib/compliance/okta-idaas-stig.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
Control,
diff --git a/ui/lib/compliance/score-utils.ts b/ui/lib/compliance/score-utils.ts
index 7c1aaf4275..e0ac7e5d4c 100644
--- a/ui/lib/compliance/score-utils.ts
+++ b/ui/lib/compliance/score-utils.ts
@@ -43,9 +43,9 @@ export function getScoreColor(score: number): ScoreColorVariant {
}
export function getScoreTextClass(score: number): string {
- if (score >= SCORE_THRESHOLDS.SUCCESS) return "text-success";
- if (score >= SCORE_THRESHOLDS.WARNING) return "text-warning";
- return "text-danger";
+ if (score >= SCORE_THRESHOLDS.SUCCESS) return "text-text-success-primary";
+ if (score >= SCORE_THRESHOLDS.WARNING) return "text-text-warning-primary";
+ return "text-text-error-primary";
}
export function getScoreLabel(score: number): string {
diff --git a/ui/lib/compliance/threat.tsx b/ui/lib/compliance/threat.tsx
index 08e4951a63..33afc192d6 100644
--- a/ui/lib/compliance/threat.tsx
+++ b/ui/lib/compliance/threat.tsx
@@ -1,8 +1,8 @@
import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
-import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
-import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion";
+import { FindingStatus } from "@/components/shadcn/table/status-finding-badge";
import {
AttributesData,
Framework,
@@ -78,6 +78,7 @@ export const mapComplianceData = (
description: description,
status: finalStatus,
check_ids: checks,
+ invalid_config: requirementData.attributes.invalid_config || false,
pass: finalStatus === REQUIREMENT_STATUS.PASS ? 1 : 0,
fail: finalStatus === REQUIREMENT_STATUS.FAIL ? 1 : 0,
manual: finalStatus === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
@@ -213,6 +214,7 @@ export const toAccordionItems = (
type=""
name={`${requirement.name} - ${requirement.title || requirement.description}`}
status={requirement.status as FindingStatus}
+ invalidConfig={requirement.invalid_config}
/>
),
content: (
diff --git a/ui/lib/env.test.ts b/ui/lib/env.test.ts
index 5824bbeab0..eaeab7e92d 100644
--- a/ui/lib/env.test.ts
+++ b/ui/lib/env.test.ts
@@ -44,3 +44,128 @@ describe("lib/env boot assertion", () => {
await expect(import("@/lib/env")).resolves.toBeDefined();
});
});
+
+describe("lib/env gated integration validation", () => {
+ // Clear every gated flag/config so ambient shell env cannot affect assertions,
+ // then satisfy the unconditional REQUIRED vars (they are checked first).
+ const GATED_ENV_VARS = [
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ "UI_SENTRY_ENVIRONMENT",
+ "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+ "UI_GOOGLE_TAG_MANAGER_ENABLED",
+ "UI_GOOGLE_TAG_MANAGER_ID",
+ "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+ "UI_POSTHOG_ENABLED",
+ "UI_POSTHOG_KEY",
+ "POSTHOG_KEY",
+ "UI_POSTHOG_HOST",
+ "POSTHOG_HOST",
+ "CLOUD_BILLING_ENABLED",
+ ] as const;
+
+ beforeEach(() => {
+ vi.resetModules();
+ for (const key of GATED_ENV_VARS) {
+ vi.stubEnv(key, undefined);
+ }
+ vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
+ vi.stubEnv("AUTH_URL", "http://localhost:3000");
+ vi.stubEnv("AUTH_SECRET", "secret");
+ vi.spyOn(console, "warn").mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ vi.unstubAllEnvs();
+ vi.restoreAllMocks();
+ });
+
+ it("throws when UI_SENTRY_ENABLED is true but the DSN is unset", async () => {
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+
+ await expect(import("@/lib/env")).rejects.toThrow("UI_SENTRY_DSN");
+ });
+
+ it("resolves when UI_SENTRY_ENABLED is true and the DSN is present", async () => {
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("does not throw when an integration is disabled and its config is unset", async () => {
+ // No enable flags set — the highest-value non-regression: a default
+ // deployment that never opted into any integration must still boot.
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("throws when UI_GOOGLE_TAG_MANAGER_ENABLED is true without an id", async () => {
+ vi.stubEnv("UI_GOOGLE_TAG_MANAGER_ENABLED", "true");
+
+ await expect(import("@/lib/env")).rejects.toThrow(
+ "UI_GOOGLE_TAG_MANAGER_ID",
+ );
+ });
+
+ it("throws on UI_POSTHOG_HOST when PostHog is enabled with only the key", async () => {
+ vi.stubEnv("UI_POSTHOG_ENABLED", "true");
+ vi.stubEnv("UI_POSTHOG_KEY", "phc_key");
+
+ await expect(import("@/lib/env")).rejects.toThrow("UI_POSTHOG_HOST");
+ });
+
+ it("resolves when PostHog is enabled with both key and host", async () => {
+ vi.stubEnv("UI_POSTHOG_ENABLED", "true");
+ vi.stubEnv("UI_POSTHOG_KEY", "phc_key");
+ vi.stubEnv("UI_POSTHOG_HOST", "https://eu.i.posthog.com");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("resolves when the legacy Sentry DSN is set without the enable flag", async () => {
+ // Legacy names stay backward compatible: they activate without the flag.
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("resolves when the legacy PostHog names are set without the enable flag", async () => {
+ vi.stubEnv("POSTHOG_KEY", "phc_key");
+ vi.stubEnv("POSTHOG_HOST", "https://eu.i.posthog.com");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("throws on a partial legacy PostHog config set without the enable flag", async () => {
+ vi.stubEnv("POSTHOG_KEY", "phc_key");
+
+ await expect(import("@/lib/env")).rejects.toThrow("POSTHOG_HOST");
+ });
+
+ it("throws when CLOUD_BILLING_ENABLED is metronome but PostHog is not enabled", async () => {
+ // metronome billing routes per tenant via the BILLING_SYSTEM_METRONOME
+ // PostHog flag, so PostHog must be enabled.
+ vi.stubEnv("CLOUD_BILLING_ENABLED", "metronome");
+
+ await expect(import("@/lib/env")).rejects.toThrow(
+ "PostHog is required for per-tenant billing routing",
+ );
+ });
+
+ it("resolves when CLOUD_BILLING_ENABLED is metronome and PostHog is enabled", async () => {
+ vi.stubEnv("CLOUD_BILLING_ENABLED", "metronome");
+ vi.stubEnv("UI_POSTHOG_ENABLED", "true");
+ vi.stubEnv("UI_POSTHOG_KEY", "phc_key");
+ vi.stubEnv("UI_POSTHOG_HOST", "https://eu.i.posthog.com");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+
+ it("resolves when CLOUD_BILLING_ENABLED is legacy without PostHog", async () => {
+ // legacy billing forces V1 and never touches PostHog.
+ vi.stubEnv("CLOUD_BILLING_ENABLED", "legacy");
+
+ await expect(import("@/lib/env")).resolves.toBeDefined();
+ });
+});
diff --git a/ui/lib/env.ts b/ui/lib/env.ts
index 33057e60d4..46b019d7df 100644
--- a/ui/lib/env.ts
+++ b/ui/lib/env.ts
@@ -1,4 +1,8 @@
-import { readEnv } from "@/lib/runtime-env";
+import {
+ assertGatedIntegrations,
+ warnGatedIntegrationsMisconfig,
+} from "@/lib/integrations";
+import { readBoolEnv, readEnv } from "@/lib/runtime-env";
// Boot-time required-env assertion so a misconfigured container fails fast
// with a clear message. A key with a deprecated legacy name is satisfied by
@@ -18,4 +22,20 @@ for (const { key, legacy } of REQUIRED) {
}
}
+assertGatedIntegrations();
+
+// `metronome` billing evaluates the BILLING_SYSTEM_METRONOME PostHog flag per
+// tenant, so PostHog must be enabled or every tenant would be misrouted to the
+// wrong billing system. Fail fast instead of degrading silently.
+if (
+ readEnv("CLOUD_BILLING_ENABLED") === "metronome" &&
+ !readBoolEnv("UI_POSTHOG_ENABLED")
+) {
+ throw new Error(
+ 'CLOUD_BILLING_ENABLED is "metronome" but UI_POSTHOG_ENABLED is not "true"; PostHog is required for per-tenant billing routing.',
+ );
+}
+
+warnGatedIntegrationsMisconfig();
+
export {};
diff --git a/ui/lib/external-urls.test.ts b/ui/lib/external-urls.test.ts
new file mode 100644
index 0000000000..0f82a4e0cd
--- /dev/null
+++ b/ui/lib/external-urls.test.ts
@@ -0,0 +1,130 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+import {
+ getAWSCredentialsTemplateLinks,
+ getAWSOrgDeploymentQuickLink,
+ PROWLER_CF_TEMPLATE_URL,
+} from "./external-urls";
+
+function getQuickCreateParams(link: string): URLSearchParams {
+ const hashQuery = new URL(link).hash.split("?")[1];
+ return new URLSearchParams(hashQuery);
+}
+
+describe("getAWSCredentialsTemplateLinks", () => {
+ it("should preserve dynamic values as single CloudFormation parameters", () => {
+ // Given
+ const externalId = "tenant&id";
+ const bucketName = "bucket¶m_DeployStackSet=false";
+
+ // When
+ const links = getAWSCredentialsTemplateLinks(
+ externalId,
+ bucketName,
+ "amazon_s3",
+ "123456789012",
+ );
+ const params = getQuickCreateParams(links.cloudformationQuickLink);
+
+ // Then
+ expect(params.get("param_ExternalId")).toBe(externalId);
+ expect(params.get("param_S3IntegrationBucketName")).toBe(bucketName);
+ expect(params.get("param_S3IntegrationBucketAccountId")).toBe(
+ "123456789012",
+ );
+ expect(params.get("param_DeployStackSet")).toBeNull();
+ });
+
+ it("should omit S3 integration parameters when the bucket account id is missing", () => {
+ // Given - the template requires S3IntegrationBucketAccountId whenever
+ // EnableS3Integration is true, so an incomplete link would fail CFN
+ // validation. This is reachable from the edit-credentials flow, where the
+ // account id can resolve to an empty string.
+ const externalId = "tenant-id";
+ const bucketName = "my-findings-bucket";
+
+ // When
+ const links = getAWSCredentialsTemplateLinks(
+ externalId,
+ bucketName,
+ "amazon_s3",
+ );
+ const params = getQuickCreateParams(links.cloudformationQuickLink);
+
+ // Then
+ expect(params.get("param_ExternalId")).toBe(externalId);
+ expect(params.get("param_EnableS3Integration")).toBeNull();
+ expect(params.get("param_S3IntegrationBucketName")).toBeNull();
+ expect(params.get("param_S3IntegrationBucketAccountId")).toBeNull();
+ });
+});
+
+describe("getAWSOrgDeploymentQuickLink", () => {
+ it("should include the one-step organization deployment parameters", () => {
+ // Given
+ const externalId = "tenant&id";
+ const organizationalUnitId = "ou-abcd-12345678";
+
+ // When
+ const link = getAWSOrgDeploymentQuickLink({
+ externalId,
+ organizationalUnitId,
+ deployFromDelegatedAdmin: true,
+ });
+ const params = getQuickCreateParams(link);
+
+ // Then
+ expect(params.get("templateURL")).toBe(PROWLER_CF_TEMPLATE_URL);
+ expect(params.get("param_ExternalId")).toBe(externalId);
+ expect(params.get("param_AWSOrganizationalUnitId")).toBe(
+ organizationalUnitId,
+ );
+ expect(params.get("param_EnableOrganizations")).toBe("true");
+ expect(params.get("param_DeployLocalRole")).toBe("true");
+ expect(params.get("param_DeployStackSet")).toBe("true");
+ expect(params.get("param_DeployFromDelegatedAdmin")).toBe("true");
+ });
+
+ it("should omit delegated administrator mode for management accounts", () => {
+ // Given
+ const organizationalUnitId = "r-abcd";
+
+ // When
+ const link = getAWSOrgDeploymentQuickLink({
+ externalId: "tenant-id",
+ organizationalUnitId,
+ });
+ const params = getQuickCreateParams(link);
+
+ // Then
+ expect(params.get("param_AWSOrganizationalUnitId")).toBe(
+ organizationalUnitId,
+ );
+ expect(params.get("param_DeployFromDelegatedAdmin")).toBeNull();
+ });
+});
+
+describe("Prowler CloudFormation template", () => {
+ it("should define every parameter used by the UI quick-create links", () => {
+ // Given
+ const template = readFileSync(
+ join(
+ process.cwd(),
+ "..",
+ "permissions/templates/cloudformation/prowler-scan-role.yml",
+ ),
+ "utf8",
+ );
+
+ // Then
+ expect(template).toContain(" EnableOrganizations:");
+ expect(template).toContain(" S3IntegrationBucketAccountId:");
+ expect(template).toContain(" DeployStackSet:");
+ expect(template).toContain(" DeployLocalRole:");
+ expect(template).toContain(" AWSOrganizationalUnitId:");
+ expect(template).toContain(" DeployFromDelegatedAdmin:");
+ });
+});
diff --git a/ui/lib/external-urls.ts b/ui/lib/external-urls.ts
index f56461e7a5..0ae17384a9 100644
--- a/ui/lib/external-urls.ts
+++ b/ui/lib/external-urls.ts
@@ -1,4 +1,4 @@
-import { IntegrationType } from "../types/integrations";
+import type { IntegrationType } from "../types/integrations";
// Documentation URLs
export const DOCS_URLS = {
@@ -6,24 +6,48 @@ export const DOCS_URLS = {
"https://docs.prowler.com/user-guide/tutorials/prowler-app#step-8:-analyze-the-findings",
FINDINGS_INGESTION:
"https://docs.prowler.com/user-guide/tutorials/prowler-app-import-findings",
+ FINDINGS_TRIAGE:
+ "https://docs.prowler.com/user-guide/tutorials/prowler-app-findings-triage",
AWS_ORGANIZATIONS:
"https://docs.prowler.com/user-guide/tutorials/prowler-cloud-aws-organizations",
ALERTS: "https://docs.prowler.com/user-guide/tutorials/prowler-app-alerts",
+ SCAN_CONFIGURATION:
+ "https://docs.prowler.com/user-guide/tutorials/prowler-app-scan-configuration",
ATTACK_PATHS_CUSTOM_QUERIES:
"https://docs.prowler.com/user-guide/tutorials/prowler-app-attack-paths#writing-custom-opencypher-queries",
} as const;
// CloudFormation template URL for the ProwlerScan role.
-// Also used (URL-encoded) as the templateURL param in cloudformationQuickLink
-// and cloudformationOrgQuickLink below — keep both in sync.
+// Also used (URL-encoded) as the templateURL param in the quick-create links
+// built by getAWSCredentialsTemplateLinks and getAWSOrgDeploymentQuickLink below.
export const PROWLER_CF_TEMPLATE_URL =
"https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml";
-// AWS Console URL for creating a new StackSet.
-// Hardcoded to us-east-1 — StackSets are typically managed from this region.
-// Users in AWS GovCloud or China partitions would need different URLs.
-export const STACKSET_CONSOLE_URL =
- "https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacksets/create";
+// Prowler Cloud billing/subscription management page.
+export const BILLING_URL = "https://cloud.prowler.com/billing";
+
+// Base URL for the CloudFormation "quick create stack" console flow.
+// Hardcoded to us-east-1 because the public template is hosted for that flow.
+const CF_QUICKCREATE_BASE_URL =
+ "https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate";
+
+export interface AWSOrgDeploymentQuickLinkParams {
+ externalId: string;
+ organizationalUnitId: string;
+ deployFromDelegatedAdmin?: boolean;
+}
+
+const buildCloudFormationQuickCreateLink = (
+ parameters: Record<string, string>,
+): string => {
+ const searchParams = new URLSearchParams({
+ templateURL: PROWLER_CF_TEMPLATE_URL,
+ stackName: "Prowler",
+ ...parameters,
+ });
+
+ return `${CF_QUICKCREATE_BASE_URL}?${searchParams.toString()}`;
+};
export const getProviderHelpText = (provider: string) => {
switch (provider) {
@@ -119,11 +143,11 @@ export const getAWSCredentialsTemplateLinks = (
externalId: string,
bucketName?: string,
integrationType?: IntegrationType,
+ bucketAccountId?: string,
): {
cloudformation: string;
terraform: string;
cloudformationQuickLink: string;
- cloudformationOrgQuickLink: string;
} => {
let links = {};
@@ -145,24 +169,53 @@ export const getAWSCredentialsTemplateLinks = (
};
}
- const encodedTemplateUrl = encodeURIComponent(PROWLER_CF_TEMPLATE_URL);
- const cfBaseUrl =
- "https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate";
- const s3Params = bucketName
- ? `¶m_EnableS3Integration=true¶m_S3IntegrationBucketName=${bucketName}`
- : "";
+ // The template requires S3IntegrationBucketAccountId (owner account of the
+ // bucket) whenever EnableS3Integration is true. Only enable S3 when both the
+ // bucket name and its account id are known, otherwise an incomplete link
+ // would fail stack validation on the quick-create flow (reachable from the
+ // edit-credentials flow, where the account id can resolve to an empty value).
+ const parameters: Record<string, string> = {
+ param_ExternalId: externalId,
+ };
+
+ if (bucketName && bucketAccountId) {
+ parameters.param_EnableS3Integration = "true";
+ parameters.param_S3IntegrationBucketName = bucketName;
+ parameters.param_S3IntegrationBucketAccountId = bucketAccountId;
+ }
return {
...(links as {
cloudformation: string;
terraform: string;
}),
- cloudformationQuickLink:
- `${cfBaseUrl}?templateURL=${encodedTemplateUrl}` +
- `&stackName=Prowler¶m_ExternalId=${externalId}${s3Params}`,
- cloudformationOrgQuickLink:
- `${cfBaseUrl}?templateURL=${encodedTemplateUrl}` +
- `&stackName=Prowler¶m_ExternalId=${externalId}` +
- `¶m_EnableOrganizations=true${s3Params}`,
+ cloudformationQuickLink: buildCloudFormationQuickCreateLink(parameters),
};
};
+
+// Builds the CloudFormation quick-create link that onboards an entire AWS
+// Organization in a single stack: it creates the ProwlerScan role in the
+// account launching the stack (DeployLocalRole) and a service-managed StackSet
+// that rolls the role out to the member accounts under the given OU/root
+// (DeployStackSet). By default the stack is launched from the management
+// account; set deployFromDelegatedAdmin when launching from a delegated
+// administrator account instead, where the local role lands in that account.
+export const getAWSOrgDeploymentQuickLink = ({
+ externalId,
+ organizationalUnitId,
+ deployFromDelegatedAdmin = false,
+}: AWSOrgDeploymentQuickLinkParams): string => {
+ const parameters: Record<string, string> = {
+ param_ExternalId: externalId,
+ param_EnableOrganizations: "true",
+ param_DeployLocalRole: "true",
+ param_DeployStackSet: "true",
+ param_AWSOrganizationalUnitId: organizationalUnitId,
+ };
+
+ if (deployFromDelegatedAdmin) {
+ parameters.param_DeployFromDelegatedAdmin = "true";
+ }
+
+ return buildCloudFormationQuickCreateLink(parameters);
+};
diff --git a/ui/lib/finding-detail.ts b/ui/lib/finding-detail.ts
index d1b506424a..73bf2e33aa 100644
--- a/ui/lib/finding-detail.ts
+++ b/ui/lib/finding-detail.ts
@@ -23,12 +23,12 @@ export function expandFindingWithRelationships(
const scan = scanDict[finding.relationships?.scan?.data?.id];
const resource =
resourceDict[finding.relationships?.resources?.data?.[0]?.id];
- const provider = providerDict[scan?.relationships?.provider?.data?.id];
+ const provider = providerDict[scan?.relationships?.provider?.data?.id ?? ""];
return {
...finding,
relationships: { ...finding.relationships, scan, resource, provider },
- } as FindingProps;
+ } as unknown as FindingProps;
}
export function findingToFindingResourceRow(
@@ -59,5 +59,6 @@ export function findingToFindingResourceRow(
mutedReason: finding.attributes.muted_reason,
firstSeenAt: finding.attributes.first_seen_at,
lastSeenAt: finding.attributes.updated_at,
+ triage: finding.triage,
};
}
diff --git a/ui/lib/finding-triage.test.ts b/ui/lib/finding-triage.test.ts
new file mode 100644
index 0000000000..a08eb29804
--- /dev/null
+++ b/ui/lib/finding-triage.test.ts
@@ -0,0 +1,222 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ FINDING_TRIAGE_STATUS,
+ type FindingTriageSummary,
+} from "@/types/findings-triage";
+
+import {
+ applyOptimisticFindingTriageRowsUpdate,
+ applyOptimisticFindingTriageRowUpdate,
+} from "./finding-triage";
+
+interface TestFindingRowAttributes {
+ muted: boolean;
+ muted_reason?: string;
+ status: string;
+}
+
+interface TestFindingRow {
+ id: string;
+ triage?: FindingTriageSummary;
+ attributes: TestFindingRowAttributes;
+}
+
+function makeTriageSummary(
+ overrides?: Partial<FindingTriageSummary>,
+): FindingTriageSummary {
+ return {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ label: "Under Review",
+ hasVisibleNote: false,
+ isMuted: false,
+ canEdit: true,
+ billingHref: "https://prowler.com/pricing",
+ ...overrides,
+ };
+}
+
+function makeFindingRow(overrides?: Partial<TestFindingRow>): TestFindingRow {
+ return {
+ id: "finding-1",
+ triage: makeTriageSummary(),
+ attributes: {
+ muted: false,
+ muted_reason: undefined,
+ status: "FAIL",
+ },
+ ...overrides,
+ };
+}
+
+describe("finding triage optimistic row updates", () => {
+ it("should patch matching finding row triage and muted attributes", () => {
+ // Given
+ const finding = makeFindingRow();
+
+ // When
+ const result = applyOptimisticFindingTriageRowUpdate(finding, {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ isMuted: false,
+ note: "Accepted by owner.",
+ });
+
+ // Then
+ expect(result).not.toBe(finding);
+ expect(result.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ label: "Risk Accepted",
+ hasVisibleNote: true,
+ notesCount: 1,
+ isMuted: true,
+ }),
+ );
+ expect(result.attributes).toEqual(
+ expect.objectContaining({
+ muted: true,
+ muted_reason: "Finding triage status changed to Risk Accepted.",
+ status: "FAIL",
+ }),
+ );
+ });
+
+ it("should leave non-matching rows unchanged when patching a list", () => {
+ // Given
+ const matchingFinding = makeFindingRow();
+ const otherFinding = makeFindingRow({
+ id: "finding-2",
+ triage: makeTriageSummary({
+ findingId: "finding-2",
+ findingUid: "uid-2",
+ triageId: "triage-2",
+ }),
+ });
+
+ // When
+ const result = applyOptimisticFindingTriageRowsUpdate(
+ [matchingFinding, otherFinding],
+ {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ isMuted: false,
+ },
+ );
+
+ // Then
+ expect(result[0]?.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ }),
+ );
+ expect(result[1]).toBe(otherFinding);
+ });
+
+ it("should preserve muted attributes when leaving a mutelist-shortcut status", () => {
+ // Given: a finding muted by a previous shortcut transition. The server
+ // never removes the mute rule when the status moves on, so the optimistic
+ // update must not unmute the row either.
+ const finding = makeFindingRow({
+ triage: makeTriageSummary({
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ label: "Risk Accepted",
+ isMuted: true,
+ }),
+ attributes: {
+ muted: true,
+ muted_reason: "Finding triage status changed to Risk Accepted.",
+ status: "FAIL",
+ },
+ });
+
+ // When
+ const result = applyOptimisticFindingTriageRowUpdate(finding, {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ previousStatus: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ isMuted: true,
+ });
+
+ // Then
+ expect(result.triage).toEqual(
+ expect.objectContaining({
+ status: FINDING_TRIAGE_STATUS.REMEDIATING,
+ label: "Remediating",
+ isMuted: true,
+ }),
+ );
+ expect(result.attributes).toEqual(
+ expect.objectContaining({
+ muted: true,
+ muted_reason: "Finding triage status changed to Risk Accepted.",
+ }),
+ );
+ });
+
+ it("should not overwrite muted_reason when an already muted finding enters a shortcut status", () => {
+ // Given: muted through some other channel (e.g. a mutelist rule).
+ const finding = makeFindingRow({
+ triage: makeTriageSummary({ isMuted: true }),
+ attributes: {
+ muted: true,
+ muted_reason: "Muted by mutelist rule.",
+ status: "FAIL",
+ },
+ });
+
+ // When: no new mute rule is created for already muted findings, so the
+ // optimistic reason must keep the original one.
+ const result = applyOptimisticFindingTriageRowUpdate(finding, {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: "triage-1",
+ notesCount: 0,
+ status: FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ previousStatus: FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ isMuted: true,
+ });
+
+ // Then
+ expect(result.attributes).toEqual(
+ expect.objectContaining({
+ muted: true,
+ muted_reason: "Muted by mutelist rule.",
+ }),
+ );
+ });
+
+ it("should leave rows without triage unchanged", () => {
+ // Given
+ const finding = makeFindingRow({ triage: undefined });
+
+ // When
+ const result = applyOptimisticFindingTriageRowUpdate(finding, {
+ findingId: "finding-1",
+ findingUid: "uid-1",
+ triageId: null,
+ notesCount: 0,
+ note: "No triage payload on this row.",
+ isMuted: false,
+ });
+
+ // Then
+ expect(result).toBe(finding);
+ });
+});
diff --git a/ui/lib/finding-triage.ts b/ui/lib/finding-triage.ts
new file mode 100644
index 0000000000..a7fefef66c
--- /dev/null
+++ b/ui/lib/finding-triage.ts
@@ -0,0 +1,93 @@
+import {
+ FINDING_TRIAGE_STATUS_LABELS,
+ type FindingTriageSummary,
+ isMutelistShortcutStatus,
+ type UpdateFindingTriageInput,
+} from "@/types/findings-triage";
+
+interface FindingTriageRowAttributes {
+ muted?: boolean;
+ muted_reason?: string;
+}
+
+export interface FindingTriageRow {
+ triage?: FindingTriageSummary;
+ attributes: FindingTriageRowAttributes;
+}
+
+export const shouldMarkFindingMutedForTriageUpdate = (
+ input: UpdateFindingTriageInput,
+): boolean => Boolean(input.status && isMutelistShortcutStatus(input.status));
+
+export const shouldRefreshAfterTriageUpdate = (
+ input: UpdateFindingTriageInput,
+): boolean =>
+ shouldMarkFindingMutedForTriageUpdate(input) && input.isMuted !== true;
+
+export const getOptimisticTriageMutedReason = (
+ status: NonNullable<UpdateFindingTriageInput["status"]>,
+): string =>
+ `Finding triage status changed to ${FINDING_TRIAGE_STATUS_LABELS[status]}.`;
+
+export const applyOptimisticTriageSummaryUpdate = (
+ triage: FindingTriageSummary,
+ input: UpdateFindingTriageInput,
+): FindingTriageSummary => {
+ const noteWasUpdated = Object.prototype.hasOwnProperty.call(input, "note");
+ const noteHasContent =
+ typeof input.note === "string" && input.note.length > 0;
+ const shouldMarkMuted = shouldMarkFindingMutedForTriageUpdate(input);
+
+ return {
+ ...triage,
+ ...(input.status
+ ? {
+ status: input.status,
+ label: FINDING_TRIAGE_STATUS_LABELS[input.status],
+ isMuted: shouldMarkMuted ? true : triage.isMuted,
+ }
+ : {}),
+ ...(noteWasUpdated
+ ? {
+ hasVisibleNote: noteHasContent,
+ notesCount: noteHasContent ? Math.max(triage.notesCount, 1) : 0,
+ }
+ : {}),
+ };
+};
+
+export const applyOptimisticFindingTriageRowUpdate = <
+ TRow extends FindingTriageRow,
+>(
+ finding: TRow,
+ input: UpdateFindingTriageInput,
+): TRow => {
+ if (!finding.triage || finding.triage.findingId !== input.findingId) {
+ return finding;
+ }
+
+ const shouldMarkMuted = shouldMarkFindingMutedForTriageUpdate(input);
+
+ return {
+ ...finding,
+ triage: applyOptimisticTriageSummaryUpdate(finding.triage, input),
+ attributes: {
+ ...finding.attributes,
+ muted: shouldMarkMuted ? true : finding.attributes.muted,
+ muted_reason:
+ shouldMarkMuted && input.isMuted !== true && input.status
+ ? getOptimisticTriageMutedReason(input.status)
+ : finding.attributes.muted_reason,
+ },
+ };
+};
+
+export const applyOptimisticFindingTriageRowsUpdate = <
+ TRow extends FindingTriageRow,
+>(
+ findings: TRow[],
+ input: UpdateFindingTriageInput,
+): TRow[] =>
+ findings.map((finding) =>
+ applyOptimisticFindingTriageRowUpdate(finding, input),
+ );
diff --git a/ui/lib/get-runtime-config.client.test.ts b/ui/lib/get-runtime-config.client.test.ts
index 553c3be421..d788a01132 100644
--- a/ui/lib/get-runtime-config.client.test.ts
+++ b/ui/lib/get-runtime-config.client.test.ts
@@ -93,20 +93,26 @@ describe("getRuntimeConfigClient", () => {
// When
const config = getRuntimeConfigClient();
- // Then - exactly the eight allowlisted keys, nothing else
+ // Then - exactly the allowlisted keys, nothing else
expect(Object.keys(config).sort()).toEqual(
[
"apiBaseUrl",
"apiDocsUrl",
+ "cloudBillingEnabled",
"googleTagManagerId",
"posthogHost",
"posthogKey",
"reoDevClientId",
"sentryDsn",
"sentryEnvironment",
+ "stripePublishableKey",
+ "stripePublishableKeyV2",
].sort(),
);
expect(config.apiBaseUrl).toBe("https://api.example.com/api/v1");
+ // cloudBillingEnabled is a boolean flag, so it defaults to false (not null)
+ // when absent from the island.
+ expect(config.cloudBillingEnabled).toBe(false);
expect(
(config as unknown as Record<string, unknown>).notAllowlisted,
).toBeUndefined();
diff --git a/ui/lib/get-runtime-config.client.ts b/ui/lib/get-runtime-config.client.ts
index c27378d6f9..e1bcd2bf1a 100644
--- a/ui/lib/get-runtime-config.client.ts
+++ b/ui/lib/get-runtime-config.client.ts
@@ -20,6 +20,9 @@ const pickConfig = (
posthogKey: parsed.posthogKey ?? null,
posthogHost: parsed.posthogHost ?? null,
reoDevClientId: parsed.reoDevClientId ?? null,
+ cloudBillingEnabled: parsed.cloudBillingEnabled ?? false,
+ stripePublishableKey: parsed.stripePublishableKey ?? null,
+ stripePublishableKeyV2: parsed.stripePublishableKeyV2 ?? null,
});
// Reads the <head> island once (memoized); all-null during SSR or if it's
diff --git a/ui/lib/helper-filters.test.ts b/ui/lib/helper-filters.test.ts
index 858a95e68f..c538e00e5c 100644
--- a/ui/lib/helper-filters.test.ts
+++ b/ui/lib/helper-filters.test.ts
@@ -1,14 +1,23 @@
import { describe, expect, it } from "vitest";
+import type { ProviderGroup } from "@/types/components";
import type { ScanEntity } from "@/types/scans";
import {
+ getProviderGroupDisplayValue,
getScanEntityLabel,
hasDateFilter,
hasDateOrScanFilter,
hasHistoricalFindingFilter,
} from "./helper-filters";
+const makeProviderGroup = (id: string, name: string): ProviderGroup =>
+ ({
+ type: "provider-groups",
+ id,
+ attributes: { name, inserted_at: "", updated_at: "" },
+ }) as ProviderGroup;
+
function makeScan(overrides: Partial<ScanEntity> = {}): ScanEntity {
return {
id: "scan-1",
@@ -25,6 +34,27 @@ function makeScan(overrides: Partial<ScanEntity> = {}): ScanEntity {
};
}
+describe("getProviderGroupDisplayValue", () => {
+ const groups = [
+ makeProviderGroup("g1", "Production"),
+ makeProviderGroup("g2", "Staging"),
+ ];
+
+ it("resolves the group name when the id matches", () => {
+ expect(getProviderGroupDisplayValue("g1", groups)).toBe("Production");
+ });
+
+ it("falls back to the raw id when the group is not found", () => {
+ expect(getProviderGroupDisplayValue("unknown", groups)).toBe("unknown");
+ });
+
+ it("falls back to the raw id when the group name is empty", () => {
+ expect(
+ getProviderGroupDisplayValue("g3", [makeProviderGroup("g3", "")]),
+ ).toBe("g3");
+ });
+});
+
describe("hasDateOrScanFilter", () => {
it("returns true for scan filters", () => {
expect(hasDateOrScanFilter({ "filter[scan__in]": "scan-1" })).toBe(true);
diff --git a/ui/lib/helper-filters.ts b/ui/lib/helper-filters.ts
index ae510bdc83..cfc1717f98 100644
--- a/ui/lib/helper-filters.ts
+++ b/ui/lib/helper-filters.ts
@@ -1,4 +1,5 @@
import { ProviderProps, ProvidersApiResponse, ScanProps } from "@/types";
+import { ProviderGroup } from "@/types/components";
import { FilterEntity } from "@/types/filters";
import {
getProviderDisplayName,
@@ -119,6 +120,19 @@ export function getScanEntityLabel(scan: ScanEntity): string {
return providerLabel || scanName;
}
+/**
+ * Resolves the display name for a provider group filter value, falling back to
+ * the raw id when the group can't be resolved. Shared by the findings and
+ * resources filter utils so their chips stay in sync.
+ */
+export function getProviderGroupDisplayValue(
+ groupId: string,
+ groups: ProviderGroup[],
+): string {
+ const group = groups.find((item) => item.id === groupId);
+ return group?.attributes.name || groupId;
+}
+
/**
* Creates a scan details mapping for filters from completed scans.
* Used to provide detailed information for scan filters in the UI.
diff --git a/ui/lib/helper.test.ts b/ui/lib/helper.test.ts
index f2de6e9145..f59dda487b 100644
--- a/ui/lib/helper.test.ts
+++ b/ui/lib/helper.test.ts
@@ -1,6 +1,10 @@
import { afterEach, describe, expect, it, vi } from "vitest";
-import { downloadScanZip, getErrorMessage } from "./helper";
+import {
+ downloadScanZip,
+ getErrorMessage,
+ permissionFormFields,
+} from "./helper";
vi.mock("@/actions/scans", () => ({
getComplianceCsv: vi.fn(),
@@ -135,3 +139,19 @@ describe("getErrorMessage", () => {
);
});
});
+
+describe("permissionFormFields", () => {
+ it("describes Unlimited Visibility as organization-wide", () => {
+ // Given
+ const field = permissionFormFields.find(
+ ({ field }) => field === "unlimited_visibility",
+ );
+
+ // When
+ const description = field?.description;
+
+ // Then
+ expect(description).toContain("organization-wide visibility");
+ expect(description).not.toContain("tenant-wide");
+ });
+});
diff --git a/ui/lib/helper.ts b/ui/lib/helper.ts
index 9674ea0d73..e6496c5050 100644
--- a/ui/lib/helper.ts
+++ b/ui/lib/helper.ts
@@ -6,7 +6,7 @@ import {
} from "@/actions/scans";
import { getTask } from "@/actions/task";
import { auth } from "@/auth.config";
-import { useToast } from "@/components/ui";
+import { useToast } from "@/components/shadcn";
import {
COMPLIANCE_REPORT_DISPLAY_NAMES,
type ComplianceReportType,
@@ -188,9 +188,14 @@ export const downloadScanZip = async (
};
/**
- * Generic function to download a file from base64 data
+ * Generic function to download a file from base64 data.
+ *
+ * Exported so feature-local wrappers (e.g. the cross-provider PDF download in
+ * app/(prowler)/compliance/_lib) reuse the base64→blob handling instead of
+ * duplicating it; those wrappers cannot live here because their server
+ * actions import the @/lib barrel, which would create a cycle.
*/
-const downloadFile = async (
+export const downloadFile = async (
result: ScanBinaryResult,
outputType: string,
successMessage: string,
@@ -383,21 +388,6 @@ export const checkTaskStatus = async (
export const wait = (ms: number) =>
new Promise((resolve) => setTimeout(resolve, ms));
-// Helper function to create dictionaries by type
-export function createDict(type: string, data: any) {
- const includedField = data?.included?.filter(
- (item: { type: string }) => item.type === type,
- );
-
- if (!includedField || includedField.length === 0) {
- return {};
- }
-
- return Object.fromEntries(
- includedField.map((item: { id: string }) => [item.id, item]),
- );
-}
-
export const parseStringify = (value: any) => JSON.parse(JSON.stringify(value));
export const convertFileToUrl = (file: File) => URL.createObjectURL(file);
@@ -448,7 +438,7 @@ export const permissionFormFields: PermissionInfo[] = [
field: "unlimited_visibility",
label: "Unlimited Visibility",
description:
- "Provides complete visibility across all the providers and its related resources",
+ "Grants organization-wide visibility across all providers, resources, findings, scans, and compliance results without granting admin actions.",
},
{
field: "manage_providers",
diff --git a/ui/lib/index.ts b/ui/lib/index.ts
index 6860785995..1714e64618 100644
--- a/ui/lib/index.ts
+++ b/ui/lib/index.ts
@@ -4,7 +4,6 @@ export * from "./findings-filters";
export * from "./findings-sort";
export * from "./helper";
export * from "./helper-filters";
-export * from "./menu-list";
export * from "./mute-rules";
export * from "./permissions";
export * from "./provider-helpers";
diff --git a/ui/lib/integrations.test.ts b/ui/lib/integrations.test.ts
new file mode 100644
index 0000000000..6565cf3a46
--- /dev/null
+++ b/ui/lib/integrations.test.ts
@@ -0,0 +1,265 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ assertGatedIntegrations,
+ readGatedEnv,
+ warnGatedIntegrationsMisconfig,
+} from "./integrations";
+
+// Every env var any gated integration reads. Cleared before each test so the
+// assertions never depend on ambient shell/CI env.
+const GATED_ENV_VARS = [
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ "UI_SENTRY_ENVIRONMENT",
+ "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+ "UI_GOOGLE_TAG_MANAGER_ENABLED",
+ "UI_GOOGLE_TAG_MANAGER_ID",
+ "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+ "UI_POSTHOG_ENABLED",
+ "UI_POSTHOG_KEY",
+ "POSTHOG_KEY",
+ "UI_POSTHOG_HOST",
+ "POSTHOG_HOST",
+] as const;
+
+beforeEach(() => {
+ for (const key of GATED_ENV_VARS) {
+ vi.stubEnv(key, undefined);
+ }
+});
+
+afterEach(() => {
+ vi.unstubAllEnvs();
+});
+
+describe("readGatedEnv", () => {
+ it("returns the primary value when the integration is enabled", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When / Then
+ expect(
+ readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ ).toBe("https://dsn.example");
+ });
+
+ it("falls back to the legacy value when enabled and the primary is unset", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When / Then
+ expect(
+ readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ ).toBe("https://legacy.example");
+ });
+
+ it("ignores the primary (new) value when disabled and no legacy is set", () => {
+ // Given - the new UI_* name only counts when the enable flag is "true"
+ vi.stubEnv("UI_SENTRY_ENABLED", "false");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When / Then
+ expect(
+ readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ ).toBeNull();
+ });
+
+ it("returns the legacy value when disabled (legacy ignores the enable flag)", () => {
+ // Given - legacy names stay backward compatible: they work without the flag
+ vi.stubEnv("UI_SENTRY_ENABLED", "false");
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When / Then
+ expect(
+ readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ ).toBe("https://legacy.example");
+ });
+
+ it("returns the legacy value when disabled even if the new value is also set", () => {
+ // Given - new value is ignored without the flag; legacy still activates
+ vi.stubEnv("UI_SENTRY_ENABLED", "false");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When / Then
+ expect(
+ readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ ).toBe("https://legacy.example");
+ });
+
+ it("returns null when the enable flag is unset and only the new name is set", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When / Then
+ expect(readGatedEnv("UI_SENTRY_ENABLED", "UI_SENTRY_DSN")).toBeNull();
+ });
+});
+
+describe("assertGatedIntegrations", () => {
+ it("does not throw when every integration is disabled (the default)", () => {
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("throws when Sentry is enabled but the DSN is unset", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).toThrow("UI_SENTRY_DSN");
+ });
+
+ it("does not throw when Sentry is enabled and the DSN is present", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("accepts the legacy DSN name when Sentry is enabled", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("does not require the optional Sentry environment when enabled", () => {
+ // Given - DSN present, UI_SENTRY_ENVIRONMENT intentionally unset
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("throws when GTM is enabled without an id", () => {
+ // Given
+ vi.stubEnv("UI_GOOGLE_TAG_MANAGER_ENABLED", "true");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).toThrow("UI_GOOGLE_TAG_MANAGER_ID");
+ });
+
+ it("requires BOTH UI_POSTHOG_KEY and UI_POSTHOG_HOST when PostHog is enabled", () => {
+ // Given - key set, host missing
+ vi.stubEnv("UI_POSTHOG_ENABLED", "true");
+ vi.stubEnv("UI_POSTHOG_KEY", "phc_key");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).toThrow("UI_POSTHOG_HOST");
+ });
+
+ it("does not throw when PostHog is enabled with both key and host", () => {
+ // Given
+ vi.stubEnv("UI_POSTHOG_ENABLED", "true");
+ vi.stubEnv("UI_POSTHOG_KEY", "phc_key");
+ vi.stubEnv("UI_POSTHOG_HOST", "https://eu.i.posthog.com");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("accepts the legacy Sentry DSN without the enable flag", () => {
+ // Given - backward compat: legacy presence activates without the flag
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("accepts the legacy PostHog names without the enable flag", () => {
+ // Given - both legacy names present, no UI_POSTHOG_ENABLED
+ vi.stubEnv("POSTHOG_KEY", "phc_key");
+ vi.stubEnv("POSTHOG_HOST", "https://eu.i.posthog.com");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).not.toThrow();
+ });
+
+ it("throws when a partial legacy PostHog config is set without the enable flag", () => {
+ // Given - one legacy name present; the full legacy set is then required
+ vi.stubEnv("POSTHOG_KEY", "phc_key");
+
+ // When / Then
+ expect(() => assertGatedIntegrations()).toThrow("POSTHOG_HOST");
+ });
+});
+
+describe("warnGatedIntegrationsMisconfig", () => {
+ it("warns when a config value is set but its enable flag is not 'true'", () => {
+ // Given
+ const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When
+ warnGatedIntegrationsMisconfig();
+
+ // Then
+ expect(warn).toHaveBeenCalledTimes(1);
+ expect(warn.mock.calls[0][0]).toContain("UI_SENTRY_ENABLED");
+ });
+
+ it("does not warn when the integration is enabled", () => {
+ // Given
+ const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+ vi.stubEnv("UI_SENTRY_DSN", "https://dsn.example");
+
+ // When
+ warnGatedIntegrationsMisconfig();
+
+ // Then
+ expect(warn).not.toHaveBeenCalled();
+ });
+
+ it("does not warn when nothing is configured", () => {
+ // Given
+ const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+ // When
+ warnGatedIntegrationsMisconfig();
+
+ // Then
+ expect(warn).not.toHaveBeenCalled();
+ });
+
+ it("does not warn when only a legacy name is set without the enable flag", () => {
+ // Given - legacy stays backward compatible, so it loads and is not a misconfig
+ const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+ vi.stubEnv("NEXT_PUBLIC_SENTRY_DSN", "https://legacy.example");
+
+ // When
+ warnGatedIntegrationsMisconfig();
+
+ // Then
+ expect(warn).not.toHaveBeenCalled();
+ });
+});
diff --git a/ui/lib/integrations.ts b/ui/lib/integrations.ts
new file mode 100644
index 0000000000..dca756cf2e
--- /dev/null
+++ b/ui/lib/integrations.ts
@@ -0,0 +1,135 @@
+import { readBoolEnv, readEnv } from "@/lib/runtime-env";
+
+// Single source of truth for the third-party integrations gated behind a
+// UI_*_ENABLED flag. The same map drives boot validation (lib/env.ts) and the
+// runtime-config gating (lib/runtime-config.ts) so the two cannot drift.
+//
+// Two activation paths, applied uniformly to every integration:
+// - New `UI_*` names count only when the enable flag is "true" (explicit
+// opt-in; default off ⇒ no third-party egress).
+// - Legacy names stay backward compatible: their presence activates the
+// integration regardless of the flag, matching the pre-enable-flag
+// behavior, so an existing deployment keeps working untouched. A partial
+// legacy config fails fast (all required legacy names must be set), just
+// like an enabled one.
+interface IntegrationEnvVar {
+ key: keyof NodeJS.ProcessEnv;
+ legacy?: keyof NodeJS.ProcessEnv;
+}
+
+interface GatedIntegration {
+ name: string;
+ enableKey: keyof NodeJS.ProcessEnv;
+ required: ReadonlyArray<IntegrationEnvVar>;
+ optional: ReadonlyArray<IntegrationEnvVar>;
+}
+
+export const GATED_INTEGRATIONS: Record<string, GatedIntegration> = {
+ sentry: {
+ name: "Sentry",
+ enableKey: "UI_SENTRY_ENABLED",
+ required: [{ key: "UI_SENTRY_DSN", legacy: "NEXT_PUBLIC_SENTRY_DSN" }],
+ optional: [
+ {
+ key: "UI_SENTRY_ENVIRONMENT",
+ legacy: "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+ },
+ ],
+ },
+ googleTagManager: {
+ name: "Google Tag Manager",
+ enableKey: "UI_GOOGLE_TAG_MANAGER_ENABLED",
+ required: [
+ {
+ key: "UI_GOOGLE_TAG_MANAGER_ID",
+ legacy: "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+ },
+ ],
+ optional: [],
+ },
+ posthog: {
+ name: "PostHog",
+ enableKey: "UI_POSTHOG_ENABLED",
+ required: [
+ { key: "UI_POSTHOG_KEY", legacy: "POSTHOG_KEY" },
+ { key: "UI_POSTHOG_HOST", legacy: "POSTHOG_HOST" },
+ ],
+ optional: [],
+ },
+} as const satisfies Record<string, GatedIntegration>;
+
+// Resolve a config value honoring the gate. The new `primary` (UI_*) name is
+// read only when the enable flag is "true"; the `legacy` name is read
+// regardless of the flag so a pre-existing deployment keeps working. When the
+// flag is "true" the new name wins, falling back to the legacy name.
+export function readGatedEnv(
+ enableKey: keyof NodeJS.ProcessEnv,
+ primary: keyof NodeJS.ProcessEnv,
+ legacy?: keyof NodeJS.ProcessEnv,
+): string | null {
+ const legacyValue = legacy ? readEnv(legacy) : null;
+ return readBoolEnv(enableKey)
+ ? (readEnv(primary) ?? legacyValue)
+ : legacyValue;
+}
+
+// True when every required var has a legacy name and all are set — the
+// backward-compatible activation path that works without the enable flag.
+function hasCompleteLegacyConfig(integration: GatedIntegration): boolean {
+ return (
+ integration.required.length > 0 &&
+ integration.required.every(({ legacy }) => legacy && readEnv(legacy))
+ );
+}
+
+// True when any required legacy name is set, i.e. the deployment is attempting
+// legacy activation (possibly half-configured).
+function hasAnyLegacyConfig(integration: GatedIntegration): boolean {
+ return integration.required.some(({ legacy }) => legacy && readEnv(legacy));
+}
+
+// Boot-time fail-fast for an incomplete required config. When the flag is
+// "true", each required var must resolve via its UI_* name or legacy fallback.
+// When the flag is not set but a legacy name is present, the deployment is on
+// the legacy path, so the full legacy set is required. Optional vars are never
+// checked.
+export function assertGatedIntegrations(): void {
+ for (const integration of Object.values(GATED_INTEGRATIONS)) {
+ if (readBoolEnv(integration.enableKey)) {
+ for (const { key, legacy } of integration.required) {
+ if (!readEnv(key, legacy)) {
+ throw new Error(
+ `Missing required env: ${key} (${integration.enableKey} is "true")`,
+ );
+ }
+ }
+ continue;
+ }
+ if (!hasAnyLegacyConfig(integration)) continue;
+ for (const { legacy } of integration.required) {
+ if (!legacy || !readEnv(legacy)) {
+ throw new Error(
+ `Missing required env: ${legacy ?? "legacy name"} (legacy ${integration.name} configuration is incomplete)`,
+ );
+ }
+ }
+ }
+}
+
+// Non-fatal nudge: a new UI_* value is set but the integration will not load
+// because its enable flag is not "true" and it is not activated through a
+// complete legacy config. Legacy-only deployments load and are not warned.
+export function warnGatedIntegrationsMisconfig(): void {
+ for (const integration of Object.values(GATED_INTEGRATIONS)) {
+ if (readBoolEnv(integration.enableKey)) continue;
+ if (hasCompleteLegacyConfig(integration)) continue;
+ for (const { key } of [...integration.required, ...integration.optional]) {
+ if (readEnv(key)) {
+ // eslint-disable-next-line no-console
+ console.warn(
+ `${key} is set but ${integration.enableKey} is not "true"; ${integration.name} will not load.`,
+ );
+ }
+ }
+ }
+}
diff --git a/ui/lib/lighthouse-routes.ts b/ui/lib/lighthouse-routes.ts
new file mode 100644
index 0000000000..ac61acd5a8
--- /dev/null
+++ b/ui/lib/lighthouse-routes.ts
@@ -0,0 +1,15 @@
+// Single source of truth for Lighthouse routes: server actions revalidate
+// these exact paths, so navigation hrefs and revalidatePath must not diverge.
+export const LIGHTHOUSE_ROUTE = {
+ CHAT: "/lighthouse",
+ SETTINGS: "/lighthouse/settings",
+} as const;
+
+export type LighthouseRoute =
+ (typeof LIGHTHOUSE_ROUTE)[keyof typeof LIGHTHOUSE_ROUTE];
+
+// Only the full-page chat owns the Lighthouse chat. Settings must coexist
+// with the side panel so users can configure it without losing the panel.
+export function isLighthouseChatRoute(pathname: string | null): boolean {
+ return pathname === LIGHTHOUSE_ROUTE.CHAT;
+}
diff --git a/ui/lib/lighthouse-v1/allowed-tools.test.ts b/ui/lib/lighthouse-v1/allowed-tools.test.ts
new file mode 100644
index 0000000000..7812a72282
--- /dev/null
+++ b/ui/lib/lighthouse-v1/allowed-tools.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+import { isAllowedTool } from "./allowed-tools";
+
+describe("isAllowedTool", () => {
+ it("should accept a whitelisted tool using the current namespace", () => {
+ // Given
+ const toolName = "prowler_search_security_findings";
+
+ // When
+ const result = isAllowedTool(toolName);
+
+ // Then
+ expect(result).toBe(true);
+ });
+
+ it("should accept a whitelisted tool using the legacy namespace", () => {
+ // Given
+ const toolName = "prowler_app_search_security_findings";
+
+ // When
+ const result = isAllowedTool(toolName);
+
+ // Then
+ expect(result).toBe(true);
+ });
+
+ it("should reject a non-whitelisted tool after normalizing the legacy namespace", () => {
+ // Given
+ const toolName = "prowler_app_delete_provider";
+
+ // When
+ const result = isAllowedTool(toolName);
+
+ // Then
+ expect(result).toBe(false);
+ });
+});
diff --git a/ui/lib/lighthouse-v1/allowed-tools.ts b/ui/lib/lighthouse-v1/allowed-tools.ts
new file mode 100644
index 0000000000..ebce1e40a4
--- /dev/null
+++ b/ui/lib/lighthouse-v1/allowed-tools.ts
@@ -0,0 +1,67 @@
+/**
+ * Tools explicitly allowed for the LLM to list and execute.
+ * Follows the principle of least privilege - only these tools are accessible.
+ * All other tools are blocked by default.
+ */
+const ALLOWED_TOOLS = new Set([
+ // === Prowler Hub Tools - read-only ===
+ "prowler_hub_list_checks",
+ "prowler_hub_semantic_search_checks",
+ "prowler_hub_get_check_details",
+ "prowler_hub_get_check_code",
+ "prowler_hub_get_check_fixer",
+ "prowler_hub_list_compliances",
+ "prowler_hub_semantic_search_compliances",
+ "prowler_hub_get_compliance_details",
+ "prowler_hub_list_providers",
+ "prowler_hub_get_provider_services",
+ // === Prowler Docs Tools - read-only ===
+ "prowler_docs_search",
+ "prowler_docs_get_document",
+ // === Prowler platform Tools - read-only ===
+ // Findings
+ "prowler_search_security_findings",
+ "prowler_get_finding_details",
+ "prowler_get_findings_overview",
+ // Finding Groups
+ "prowler_list_finding_groups",
+ "prowler_get_finding_group_details",
+ "prowler_list_finding_group_resources",
+ // Providers
+ "prowler_search_providers",
+ // Scans
+ "prowler_list_scans",
+ "prowler_get_scan",
+ // Muting
+ "prowler_get_mutelist",
+ "prowler_list_mute_rules",
+ "prowler_get_mute_rule",
+ // Compliance
+ "prowler_get_compliance_overview",
+ "prowler_get_compliance_framework_state_details",
+ // Resources
+ "prowler_list_resources",
+ "prowler_get_resource",
+ "prowler_get_resource_events",
+ "prowler_get_resources_overview",
+ // Attack Paths
+ "prowler_list_attack_paths_queries",
+ "prowler_list_attack_paths_scans",
+ "prowler_run_attack_paths_query",
+ "prowler_get_attack_paths_cartography_schema",
+]);
+
+/**
+ * Check if a tool is allowed for LLM access.
+ * Returns true only if the tool is explicitly in the whitelist.
+ *
+ * The Prowler platform tools were renamed from the `prowler_app_` prefix to
+ * `prowler_`. The legacy prefix is normalized here so tools served by
+ * an older MCP server (or a mismatched rollout) still resolve.
+ */
+export function isAllowedTool(toolName: string): boolean {
+ const normalized = toolName.startsWith("prowler_app_")
+ ? toolName.replace(/^prowler_app_/, "prowler_")
+ : toolName;
+ return ALLOWED_TOOLS.has(normalized);
+}
diff --git a/ui/lib/lighthouse/analyst-stream.ts b/ui/lib/lighthouse-v1/analyst-stream.ts
similarity index 97%
rename from ui/lib/lighthouse/analyst-stream.ts
rename to ui/lib/lighthouse-v1/analyst-stream.ts
index 13d5648ba0..e641f14c63 100644
--- a/ui/lib/lighthouse/analyst-stream.ts
+++ b/ui/lib/lighthouse-v1/analyst-stream.ts
@@ -11,8 +11,11 @@ import {
META_TOOLS,
SKILL_PREFIX,
STREAM_MESSAGE_ID,
-} from "@/lib/lighthouse/constants";
-import type { ChainOfThoughtData, StreamEvent } from "@/lib/lighthouse/types";
+} from "@/lib/lighthouse-v1/constants";
+import type {
+ ChainOfThoughtData,
+ StreamEvent,
+} from "@/lib/lighthouse-v1/types";
// Re-export for convenience
export { CHAIN_OF_THOUGHT_ACTIONS, ERROR_PREFIX, STREAM_MESSAGE_ID };
diff --git a/ui/lib/lighthouse/auth-context.ts b/ui/lib/lighthouse-v1/auth-context.ts
similarity index 100%
rename from ui/lib/lighthouse/auth-context.ts
rename to ui/lib/lighthouse-v1/auth-context.ts
diff --git a/ui/lib/lighthouse/constants.ts b/ui/lib/lighthouse-v1/constants.ts
similarity index 100%
rename from ui/lib/lighthouse/constants.ts
rename to ui/lib/lighthouse-v1/constants.ts
diff --git a/ui/lib/lighthouse/data.ts b/ui/lib/lighthouse-v1/data.ts
similarity index 100%
rename from ui/lib/lighthouse/data.ts
rename to ui/lib/lighthouse-v1/data.ts
diff --git a/ui/lib/lighthouse/llm-factory.ts b/ui/lib/lighthouse-v1/llm-factory.ts
similarity index 100%
rename from ui/lib/lighthouse/llm-factory.ts
rename to ui/lib/lighthouse-v1/llm-factory.ts
diff --git a/ui/lib/lighthouse/mcp-client.ts b/ui/lib/lighthouse-v1/mcp-client.ts
similarity index 93%
rename from ui/lib/lighthouse/mcp-client.ts
rename to ui/lib/lighthouse-v1/mcp-client.ts
index b6676f6434..588ff24ac8 100644
--- a/ui/lib/lighthouse/mcp-client.ts
+++ b/ui/lib/lighthouse-v1/mcp-client.ts
@@ -8,7 +8,7 @@ import {
captureMessage,
} from "@sentry/nextjs";
-import { getAuthContext } from "@/lib/lighthouse/auth-context";
+import { getAuthContext } from "@/lib/lighthouse-v1/auth-context";
import { SentryErrorSource, SentryErrorType } from "@/sentry";
/** Maximum number of retry attempts for MCP connection */
@@ -77,7 +77,7 @@ class MCPClientManager {
}
/**
- * Injects auth headers for Prowler App tools
+ * Injects auth headers for the core Prowler tools
*/
private handleBeforeToolCall = ({
name,
@@ -87,9 +87,15 @@ class MCPClientManager {
name: string;
args?: unknown;
}) => {
- // Only inject auth for Prowler App tools (user-specific data)
- // Prowler Hub and Prowler Docs tools don't require authentication
- if (!name.startsWith("prowler_app_")) {
+ // Only inject auth for the core Prowler tools (user-specific data), served
+ // under the bare `prowler_` prefix. Prowler Hub (`prowler_hub_`) and Prowler
+ // Docs (`prowler_docs_`) tools are public and need no authentication. The
+ // legacy `prowler_app_` prefix also starts with `prowler_`, so it is covered.
+ const needsAuth =
+ name.startsWith("prowler_") &&
+ !name.startsWith("prowler_hub_") &&
+ !name.startsWith("prowler_docs_");
+ if (!needsAuth) {
return { args };
}
diff --git a/ui/lib/lighthouse/skills/definitions/attack-path-custom-query.ts b/ui/lib/lighthouse-v1/skills/definitions/attack-path-custom-query.ts
similarity index 95%
rename from ui/lib/lighthouse/skills/definitions/attack-path-custom-query.ts
rename to ui/lib/lighthouse-v1/skills/definitions/attack-path-custom-query.ts
index 7bb2ed08a1..15a298fd2c 100644
--- a/ui/lib/lighthouse/skills/definitions/attack-path-custom-query.ts
+++ b/ui/lib/lighthouse-v1/skills/definitions/attack-path-custom-query.ts
@@ -15,9 +15,9 @@ This skill provides openCypher syntax guidance and Cartography schema knowledge
Follow these steps when the user asks you to write a custom openCypher query:
-1. **Find a completed scan**: Use \`prowler_app_list_attack_paths_scans\` (filter by \`state=['completed']\`) to find a scan for the user's provider. You need the \`scan_id\` for the next step.
+1. **Find a completed scan**: Use \`prowler_list_attack_paths_scans\` (filter by \`state=['completed']\`) to find a scan for the user's provider. You need the \`scan_id\` for the next step.
-2. **Fetch the Cartography schema**: Use \`prowler_app_get_attack_paths_cartography_schema\` with the \`scan_id\`. This returns the full schema markdown with all node labels, relationships, and properties for the scan's provider and Cartography version. If this tool fails, use the Cartography Schema Reference section below as a fallback (AWS only).
+2. **Fetch the Cartography schema**: Use \`prowler_get_attack_paths_cartography_schema\` with the \`scan_id\`. This returns the full schema markdown with all node labels, relationships, and properties for the scan's provider and Cartography version. If this tool fails, use the Cartography Schema Reference section below as a fallback (AWS only).
3. **Analyze the schema**: From \`schema_content\`, identify the node labels, properties, and relationships relevant to the user's request. Cross-reference with the Common openCypher Patterns section below.
diff --git a/ui/lib/lighthouse/skills/index.ts b/ui/lib/lighthouse-v1/skills/index.ts
similarity index 100%
rename from ui/lib/lighthouse/skills/index.ts
rename to ui/lib/lighthouse-v1/skills/index.ts
diff --git a/ui/lib/lighthouse/skills/registry.ts b/ui/lib/lighthouse-v1/skills/registry.ts
similarity index 100%
rename from ui/lib/lighthouse/skills/registry.ts
rename to ui/lib/lighthouse-v1/skills/registry.ts
diff --git a/ui/lib/lighthouse/skills/types.ts b/ui/lib/lighthouse-v1/skills/types.ts
similarity index 100%
rename from ui/lib/lighthouse/skills/types.ts
rename to ui/lib/lighthouse-v1/skills/types.ts
diff --git a/ui/lib/lighthouse/system-prompt.ts b/ui/lib/lighthouse-v1/system-prompt.ts
similarity index 97%
rename from ui/lib/lighthouse/system-prompt.ts
rename to ui/lib/lighthouse-v1/system-prompt.ts
index be3ec099e3..317aabf7ef 100644
--- a/ui/lib/lighthouse/system-prompt.ts
+++ b/ui/lib/lighthouse-v1/system-prompt.ts
@@ -3,7 +3,7 @@
*
* {{TOOL_LISTING}} placeholder will be replaced with dynamically generated tool list
*/
-import type { SkillMetadata } from "@/lib/lighthouse/skills/types";
+import type { SkillMetadata } from "@/lib/lighthouse-v1/skills/types";
export const LIGHTHOUSE_SYSTEM_PROMPT_TEMPLATE = `
## Introduction
@@ -13,7 +13,7 @@ You are an Autonomous Cloud Security Analyst, the best cloud security chatbot po
Your goal is to help users solve their cloud security problems effectively.
You have access to tools from multiple sources:
-- **Prowler App**: User's Prowler providers data, configurations and security overview
+- **Prowler Local Server**: User's Prowler providers data, configurations and security overview
- **Prowler Hub**: Generic automatic detections, remediations and compliance framework that are available for Prowler
- **Prowler Docs**: Documentation and knowledge base. Here you can find information about Prowler capabilities, configuration tutorials, guides, and more
@@ -59,7 +59,7 @@ You have access to THREE meta-tools to interact with the available tools and ski
- Use empty object {} for tools with no parameters
- You must always provide the toolName and toolInput keys in the JSON object
- Example: execute_tool({ "toolName": "prowler_hub_list_providers", "toolInput": {} })
- - Example: execute_tool({ "toolName": "prowler_app_search_security_findings", "toolInput": { "severity": ["critical", "high"], "status": ["FAIL"] } })
+ - Example: execute_tool({ "toolName": "prowler_search_security_findings", "toolInput": { "severity": ["critical", "high"], "status": ["FAIL"] } })
3. **load_skill** - Load specialized instructions for a complex task
- Use when you identify a matching skill from the skill catalog below
@@ -233,7 +233,7 @@ When providing proactive recommendations to secure users' cloud accounts, follow
## Sources and Domain Knowledge
- Prowler website: https://prowler.com/
-- Prowler App: https://cloud.prowler.com/
+- Prowler Cloud: https://cloud.prowler.com/
- Prowler GitHub repository: https://github.com/prowler-cloud/prowler
- Prowler Documentation: https://docs.prowler.com/
`;
diff --git a/ui/lib/lighthouse/tools/load-skill.ts b/ui/lib/lighthouse-v1/tools/load-skill.ts
similarity index 97%
rename from ui/lib/lighthouse/tools/load-skill.ts
rename to ui/lib/lighthouse-v1/tools/load-skill.ts
index 6c57d03ede..873b5f7373 100644
--- a/ui/lib/lighthouse/tools/load-skill.ts
+++ b/ui/lib/lighthouse-v1/tools/load-skill.ts
@@ -7,7 +7,7 @@ import { z } from "zod";
import {
getRegisteredSkillIds,
getSkillById,
-} from "@/lib/lighthouse/skills/index";
+} from "@/lib/lighthouse-v1/skills/index";
interface SkillLoadedResult {
found: true;
diff --git a/ui/lib/lighthouse/tools/meta-tool.ts b/ui/lib/lighthouse-v1/tools/meta-tool.ts
similarity index 95%
rename from ui/lib/lighthouse/tools/meta-tool.ts
rename to ui/lib/lighthouse-v1/tools/meta-tool.ts
index ae5576d906..f5c2cf7f75 100644
--- a/ui/lib/lighthouse/tools/meta-tool.ts
+++ b/ui/lib/lighthouse-v1/tools/meta-tool.ts
@@ -5,8 +5,8 @@ import { tool } from "@langchain/core/tools";
import { addBreadcrumb, captureException } from "@sentry/nextjs";
import { z } from "zod";
-import { getMCPTools, isMCPAvailable } from "@/lib/lighthouse/mcp-client";
-import { isAllowedTool } from "@/lib/lighthouse/workflow";
+import { isAllowedTool } from "@/lib/lighthouse-v1/allowed-tools";
+import { getMCPTools, isMCPAvailable } from "@/lib/lighthouse-v1/mcp-client";
/** Input type for describe_tool */
interface DescribeToolInput {
@@ -95,7 +95,7 @@ Use this to understand what parameters a tool requires before executing it.
Tool names are listed in your system prompt - use the exact name.
You must always provide the toolName key in the JSON object.
-Example: describe_tool({ "toolName": "prowler_app_search_security_findings" })
+Example: describe_tool({ "toolName": "prowler_search_security_findings" })
Returns:
- Full parameter schema with types and descriptions
@@ -203,7 +203,7 @@ export const executeTool = tool(
Provide the exact tool name and its input parameters as specified in the tool's schema.
You must always provide the toolName and toolInput keys in the JSON object.
-Example: execute_tool({ "toolName": "prowler_app_search_security_findings", "toolInput": {} })
+Example: execute_tool({ "toolName": "prowler_search_security_findings", "toolInput": {} })
All input to the tool must be provided in the toolInput key as a JSON object.
Example: execute_tool({ "toolName": "prowler_hub_list_compliances", "toolInput": { "provider": ["aws"] } })
diff --git a/ui/lib/lighthouse/types.ts b/ui/lib/lighthouse-v1/types.ts
similarity index 95%
rename from ui/lib/lighthouse/types.ts
rename to ui/lib/lighthouse-v1/types.ts
index d68ecdf0d7..98f1542cb5 100644
--- a/ui/lib/lighthouse/types.ts
+++ b/ui/lib/lighthouse-v1/types.ts
@@ -6,7 +6,7 @@
import type {
ChainOfThoughtAction,
StreamEventType,
-} from "@/lib/lighthouse/constants";
+} from "@/lib/lighthouse-v1/constants";
export interface ChainOfThoughtData {
action: ChainOfThoughtAction;
diff --git a/ui/lib/lighthouse/utils.ts b/ui/lib/lighthouse-v1/utils.ts
similarity index 96%
rename from ui/lib/lighthouse/utils.ts
rename to ui/lib/lighthouse-v1/utils.ts
index 5d0f865022..e0b0c2f144 100644
--- a/ui/lib/lighthouse/utils.ts
+++ b/ui/lib/lighthouse-v1/utils.ts
@@ -6,7 +6,7 @@ import {
} from "@langchain/core/messages";
import type { UIMessage } from "ai";
-import type { ModelParams } from "@/types/lighthouse";
+import type { ModelParams } from "@/types/lighthouse-v1";
// https://stackoverflow.com/questions/79081298/how-to-stream-langchain-langgraphs-final-generation
/**
diff --git a/ui/lib/lighthouse/validation.ts b/ui/lib/lighthouse-v1/validation.ts
similarity index 93%
rename from ui/lib/lighthouse/validation.ts
rename to ui/lib/lighthouse-v1/validation.ts
index f8160e2c43..6efb33c0fd 100644
--- a/ui/lib/lighthouse/validation.ts
+++ b/ui/lib/lighthouse-v1/validation.ts
@@ -1,10 +1,10 @@
-import type { LighthouseProvider } from "@/types/lighthouse";
+import type { LighthouseProvider } from "@/types/lighthouse-v1";
import {
baseUrlSchema,
bedrockCredentialsSchema,
openAICompatibleCredentialsSchema,
openAICredentialsSchema,
-} from "@/types/lighthouse/credentials";
+} from "@/types/lighthouse-v1/credentials";
/**
* Validate credentials based on provider type
diff --git a/ui/lib/lighthouse/workflow.ts b/ui/lib/lighthouse-v1/workflow.ts
similarity index 56%
rename from ui/lib/lighthouse/workflow.ts
rename to ui/lib/lighthouse-v1/workflow.ts
index 486574b1d3..77a6f4ad76 100644
--- a/ui/lib/lighthouse/workflow.ts
+++ b/ui/lib/lighthouse-v1/workflow.ts
@@ -3,24 +3,25 @@ import { createAgent } from "langchain";
import {
getProviderCredentials,
getTenantConfig,
-} from "@/actions/lighthouse/lighthouse";
-import { TOOLS_UNAVAILABLE_MESSAGE } from "@/lib/lighthouse/constants";
-import type { ProviderType } from "@/lib/lighthouse/llm-factory";
-import { createLLM } from "@/lib/lighthouse/llm-factory";
+} from "@/actions/lighthouse-v1/lighthouse";
+import { isAllowedTool } from "@/lib/lighthouse-v1/allowed-tools";
+import { TOOLS_UNAVAILABLE_MESSAGE } from "@/lib/lighthouse-v1/constants";
+import type { ProviderType } from "@/lib/lighthouse-v1/llm-factory";
+import { createLLM } from "@/lib/lighthouse-v1/llm-factory";
import {
getMCPTools,
initializeMCPClient,
isMCPAvailable,
-} from "@/lib/lighthouse/mcp-client";
-import { getAllSkillMetadata } from "@/lib/lighthouse/skills/index";
+} from "@/lib/lighthouse-v1/mcp-client";
+import { getAllSkillMetadata } from "@/lib/lighthouse-v1/skills/index";
import {
generateSkillCatalog,
generateUserDataSection,
LIGHTHOUSE_SYSTEM_PROMPT_TEMPLATE,
-} from "@/lib/lighthouse/system-prompt";
-import { loadSkill } from "@/lib/lighthouse/tools/load-skill";
-import { describeTool, executeTool } from "@/lib/lighthouse/tools/meta-tool";
-import { getModelParams } from "@/lib/lighthouse/utils";
+} from "@/lib/lighthouse-v1/system-prompt";
+import { loadSkill } from "@/lib/lighthouse-v1/tools/load-skill";
+import { describeTool, executeTool } from "@/lib/lighthouse-v1/tools/meta-tool";
+import { getModelParams } from "@/lib/lighthouse-v1/utils";
export interface RuntimeConfig {
model?: string;
@@ -42,67 +43,6 @@ function truncateDescription(desc: string | undefined, maxLen: number): string {
return cleaned.substring(0, maxLen) + "...";
}
-/**
- * Tools explicitly allowed for the LLM to list and execute.
- * Follows the principle of least privilege - only these tools are accessible.
- * All other tools are blocked by default.
- */
-const ALLOWED_TOOLS = new Set([
- // === Prowler Hub Tools - read-only ===
- "prowler_hub_list_checks",
- "prowler_hub_semantic_search_checks",
- "prowler_hub_get_check_details",
- "prowler_hub_get_check_code",
- "prowler_hub_get_check_fixer",
- "prowler_hub_list_compliances",
- "prowler_hub_semantic_search_compliances",
- "prowler_hub_get_compliance_details",
- "prowler_hub_list_providers",
- "prowler_hub_get_provider_services",
- // === Prowler Docs Tools - read-only ===
- "prowler_docs_search",
- "prowler_docs_get_document",
- // === Prowler App Tools - read-only ===
- // Findings
- "prowler_app_search_security_findings",
- "prowler_app_get_finding_details",
- "prowler_app_get_findings_overview",
- // Finding Groups
- "prowler_app_list_finding_groups",
- "prowler_app_get_finding_group_details",
- "prowler_app_list_finding_group_resources",
- // Providers
- "prowler_app_search_providers",
- // Scans
- "prowler_app_list_scans",
- "prowler_app_get_scan",
- // Muting
- "prowler_app_get_mutelist",
- "prowler_app_list_mute_rules",
- "prowler_app_get_mute_rule",
- // Compliance
- "prowler_app_get_compliance_overview",
- "prowler_app_get_compliance_framework_state_details",
- // Resources
- "prowler_app_list_resources",
- "prowler_app_get_resource",
- "prowler_app_get_resource_events",
- "prowler_app_get_resources_overview",
- // Attack Paths
- "prowler_app_list_attack_paths_queries",
- "prowler_app_list_attack_paths_scans",
- "prowler_app_run_attack_paths_query",
- "prowler_app_get_attack_paths_cartography_schema",
-]);
-
-/**
- * Check if a tool is allowed for LLM access.
- * Returns true only if the tool is explicitly in the whitelist.
- */
-export function isAllowedTool(toolName: string): boolean {
- return ALLOWED_TOOLS.has(toolName);
-}
-
/**
* Generate dynamic tool listing from MCP tools.
* Only includes tools that are explicitly whitelisted.
diff --git a/ui/lib/lighthouse/prompts.test.ts b/ui/lib/lighthouse/prompts.test.ts
new file mode 100644
index 0000000000..9855fc0e50
--- /dev/null
+++ b/ui/lib/lighthouse/prompts.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+
+import { buildFindingAnalysisPrompt } from "./prompts";
+
+describe("buildFindingAnalysisPrompt", () => {
+ it("should include the complete finding context", () => {
+ // Given / When
+ const prompt = buildFindingAnalysisPrompt({
+ findingId: "finding-1",
+ providerUid: "provider-1",
+ resourceUid: "resource-1",
+ checkId: "check-1",
+ severity: "critical",
+ status: "FAIL",
+ detail: "The resource is publicly accessible.",
+ risk: "Unauthorized access can expose sensitive data.",
+ });
+
+ // Then
+ expect(prompt).toBe(
+ `Get all the possible information from Prowler Application and from Prowler Hub to have the full context.
+
+Analyze this security finding and provide remediation guidance:
+
+- **Finding ID**: finding-1
+- **Provider UID**: provider-1
+- **Resource UID**: resource-1
+- **Check ID**: check-1
+- **Severity**: critical
+- **Status**: FAIL
+- **Detail**: The resource is publicly accessible.
+- **Risk**: Unauthorized access can expose sensitive data.`,
+ );
+ });
+});
diff --git a/ui/lib/lighthouse/prompts.ts b/ui/lib/lighthouse/prompts.ts
new file mode 100644
index 0000000000..2bef4a844e
--- /dev/null
+++ b/ui/lib/lighthouse/prompts.ts
@@ -0,0 +1,42 @@
+export interface FindingAnalysisPromptInput {
+ findingId: string | null | undefined;
+ providerUid: string | null | undefined;
+ resourceUid: string | null | undefined;
+ checkId: string | null | undefined;
+ severity: string | null | undefined;
+ status: string | null | undefined;
+ detail: string | null | undefined;
+ risk: string | null | undefined;
+}
+
+function getPromptValue(value: string | null | undefined): string {
+ return typeof value === "string" && value.trim().length > 0
+ ? value
+ : "unknown";
+}
+
+export function buildFindingAnalysisPrompt({
+ findingId,
+ providerUid,
+ resourceUid,
+ checkId,
+ severity,
+ status,
+ detail,
+ risk,
+}: FindingAnalysisPromptInput): string {
+ return [
+ "Get all the possible information from Prowler Application and from Prowler Hub to have the full context.",
+ "",
+ "Analyze this security finding and provide remediation guidance:",
+ "",
+ `- **Finding ID**: ${getPromptValue(findingId)}`,
+ `- **Provider UID**: ${getPromptValue(providerUid)}`,
+ `- **Resource UID**: ${getPromptValue(resourceUid)}`,
+ `- **Check ID**: ${getPromptValue(checkId)}`,
+ `- **Severity**: ${getPromptValue(severity)}`,
+ `- **Status**: ${getPromptValue(status)}`,
+ `- **Detail**: ${getPromptValue(detail)}`,
+ `- **Risk**: ${getPromptValue(risk)}`,
+ ].join("\n");
+}
diff --git a/ui/lib/markdown.ts b/ui/lib/markdown.ts
new file mode 100644
index 0000000000..88fbb533cb
--- /dev/null
+++ b/ui/lib/markdown.ts
@@ -0,0 +1,74 @@
+/**
+ * Escapes angle-bracket placeholders like <bucket_name> to HTML entities
+ * so they display correctly instead of being interpreted as HTML tags.
+ *
+ * This processes the text while preserving:
+ * - Content inside inline code (backticks)
+ * - Content inside code blocks (triple backticks)
+ *
+ * Shared by the Lighthouse v1 and v2 chat renderers.
+ */
+export function escapeAngleBracketPlaceholders(text: string): string {
+ // HTML tags to preserve (not escape)
+ const htmlTags = new Set([
+ "div",
+ "span",
+ "p",
+ "a",
+ "img",
+ "br",
+ "hr",
+ "ul",
+ "ol",
+ "li",
+ "table",
+ "tr",
+ "td",
+ "th",
+ "thead",
+ "tbody",
+ "h1",
+ "h2",
+ "h3",
+ "h4",
+ "h5",
+ "h6",
+ "pre",
+ "blockquote",
+ "strong",
+ "em",
+ "b",
+ "i",
+ "u",
+ "s",
+ "sub",
+ "sup",
+ "details",
+ "summary",
+ ]);
+
+ // Split by code blocks and inline code to preserve them.
+ // This regex captures: ```...``` blocks, `...` inline code, and everything else.
+ const parts = text.split(/(```[\s\S]*?```|`[^`]+`)/g);
+
+ return parts
+ .map((part) => {
+ // If it's a code block or inline code, leave it untouched.
+ // Shiki/syntax highlighter handles escaping inside code blocks.
+ if (part.startsWith("```") || part.startsWith("`")) {
+ return part;
+ }
+
+ // For regular text outside code, escape placeholders as HTML entities so
+ // they render as plain `<bucket_name>` text. Raw HTML parsing is disabled
+ // in both chat renderers, so entities are enough — and avoid the code-span
+ // styling that wrapping in backticks would force.
+ return part.replace(/<([a-zA-Z][a-zA-Z0-9_-]*)>/g, (match, tagName) => {
+ if (htmlTags.has(tagName.toLowerCase())) {
+ return match;
+ }
+ return `<${tagName}>`;
+ });
+ })
+ .join("");
+}
diff --git a/ui/lib/menu-list.test.ts b/ui/lib/menu-list.test.ts
deleted file mode 100644
index b06237a44a..0000000000
--- a/ui/lib/menu-list.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-
-import { getMenuList } from "./menu-list";
-
-const findMenu = (label: string) =>
- getMenuList({ pathname: "/alerts" })
- .flatMap((group) => group.menus)
- .find((menu) => menu.label === label);
-
-const findSubmenu = (label: string) =>
- getMenuList({ pathname: "/alerts" })
- .flatMap((group) => group.menus)
- .flatMap((menu) => menu.submenus ?? [])
- .find((submenu) => submenu.label === label);
-
-const findApiReference = (options: Parameters<typeof getMenuList>[0]) =>
- getMenuList(options)
- .flatMap((group) => group.menus)
- .flatMap((menu) => menu.submenus ?? [])
- .find((submenu) => submenu.label === "API reference");
-
-describe("getMenuList", () => {
- afterEach(() => {
- delete process.env.NEXT_PUBLIC_IS_CLOUD_ENV;
- });
-
- describe("API reference link", () => {
- it("should use the apiDocsUrl provided by the caller in OSS", () => {
- // Given / When — the caller resolves the runtime value (hydration-safe)
- const apiRef = findApiReference({
- pathname: "/",
- apiDocsUrl: "https://self-hosted.example/api/v1/docs",
- });
-
- // Then
- expect(apiRef?.href).toBe("https://self-hosted.example/api/v1/docs");
- });
-
- it("should default to an empty href when no apiDocsUrl is provided", () => {
- // Given / When — no island read here, so SSR and client agree
- const apiRef = findApiReference({ pathname: "/" });
-
- // Then
- expect(apiRef?.href).toBe("");
- });
-
- it("should use the Cloud docs URL and ignore apiDocsUrl when Cloud is enabled", () => {
- // Given
- process.env.NEXT_PUBLIC_IS_CLOUD_ENV = "true";
-
- // When
- const apiRef = findApiReference({
- pathname: "/",
- apiDocsUrl: "https://ignored.example/docs",
- });
-
- // Then
- expect(apiRef?.href).toBe("https://api.prowler.com/api/v1/docs");
- });
- });
-
- it("should show Alerts as disabled Cloud-only in OSS when Cloud is disabled", () => {
- // Given / When
- const alerts = findSubmenu("Alerts");
-
- // Then
- expect(alerts).toEqual(
- expect.objectContaining({
- href: "/alerts",
- disabled: true,
- cloudOnly: true,
- highlight: true,
- active: false,
- }),
- );
- });
-
- it("should show Alerts as new under Configuration when Cloud is enabled", () => {
- // Given
- process.env.NEXT_PUBLIC_IS_CLOUD_ENV = "true";
-
- // When
- const alerts = findSubmenu("Alerts");
-
- // Then
- expect(alerts).toEqual(
- expect.objectContaining({
- href: "/alerts",
- active: true,
- highlight: true,
- }),
- );
- });
-
- it("should remove the new highlight from Attack Paths", () => {
- // Given / When
- const attackPaths = findMenu("Attack Paths");
-
- // Then
- expect(attackPaths).toEqual(
- expect.not.objectContaining({ highlight: true }),
- );
- });
-});
diff --git a/ui/lib/menu-list.ts b/ui/lib/menu-list.ts
deleted file mode 100644
index 56b0e115c2..0000000000
--- a/ui/lib/menu-list.ts
+++ /dev/null
@@ -1,215 +0,0 @@
-import {
- BellRing,
- CloudCog,
- Cog,
- GitBranch,
- Mail,
- MessageCircleQuestion,
- Puzzle,
- Settings,
- ShieldCheck,
- SquareChartGantt,
- Tag,
- Timer,
- User,
- UserCog,
- Users,
- VolumeX,
- Warehouse,
-} from "lucide-react";
-
-import { ProwlerShort } from "@/components/icons";
-import {
- APIdocIcon,
- DocIcon,
- GithubIcon,
- LighthouseIcon,
- SupportIcon,
-} from "@/components/icons/Icons";
-import { GroupProps } from "@/types";
-
-interface MenuListOptions {
- pathname: string;
- // Passed in (not read here) so the island isn't read during SSR — that would
- // cause a hydration mismatch. See useRuntimeConfig.
- apiDocsUrl?: string | null;
-}
-
-export const getMenuList = ({
- pathname,
- apiDocsUrl = null,
-}: MenuListOptions): GroupProps[] => {
- const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
-
- return [
- {
- groupLabel: "",
- menus: [
- {
- href: "/",
- label: "Overview",
- icon: SquareChartGantt,
- active: pathname === "/",
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "/compliance",
- label: "Compliance",
- icon: ShieldCheck,
- active: pathname === "/compliance",
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "/lighthouse",
- label: "Lighthouse AI",
- icon: LighthouseIcon,
- active: pathname === "/lighthouse",
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "/attack-paths",
- label: "Attack Paths",
- icon: GitBranch,
- active: pathname.startsWith("/attack-paths"),
- },
- ],
- },
-
- {
- groupLabel: "",
- menus: [
- {
- href: "/findings?filter[muted]=false&filter[status__in]=FAIL",
- label: "Findings",
- icon: Tag,
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "/resources",
- label: "Resources",
- icon: Warehouse,
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "",
- label: "Configuration",
- icon: Settings,
- submenus: [
- { href: "/providers", label: "Providers", icon: CloudCog },
- {
- href: "/alerts",
- label: "Alerts",
- icon: BellRing,
- active: isCloudEnv && pathname.startsWith("/alerts"),
- highlight: true,
- disabled: !isCloudEnv,
- cloudOnly: !isCloudEnv,
- },
- {
- href: "/mutelist",
- label: "Mutelist",
- icon: VolumeX,
- active: pathname === "/mutelist",
- },
- { href: "/scans", label: "Scan Jobs", icon: Timer },
- { href: "/integrations", label: "Integrations", icon: Puzzle },
- { href: "/roles", label: "Roles", icon: UserCog },
- { href: "/lighthouse/config", label: "Lighthouse AI", icon: Cog },
- ],
- defaultOpen: true,
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "",
- label: "Organization",
- icon: Users,
- submenus: [
- { href: "/users", label: "Users", icon: User },
- { href: "/invitations", label: "Invitations", icon: Mail },
- ],
- defaultOpen: false,
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "",
- label: "Support & Help",
- icon: SupportIcon,
- submenus: [
- {
- href: "https://docs.prowler.com/",
- target: "_blank",
- label: "Documentation",
- icon: DocIcon,
- },
- {
- href: isCloudEnv
- ? "https://api.prowler.com/api/v1/docs"
- : (apiDocsUrl ?? ""),
- target: "_blank",
- label: "API reference",
- icon: APIdocIcon,
- },
- ...(isCloudEnv
- ? [
- {
- href: "https://customer.support.prowler.com/servicedesk/customer/portal/9/create/102",
- target: "_blank",
- label: "Support Desk",
- icon: MessageCircleQuestion,
- },
- ]
- : [
- {
- href: "https://github.com/prowler-cloud/prowler/issues",
- target: "_blank",
- label: "Community Support",
- icon: GithubIcon,
- },
- ]),
- ],
- defaultOpen: false,
- },
- ],
- },
- {
- groupLabel: "",
- menus: [
- {
- href: "https://hub.prowler.com/",
- label: "Prowler Hub",
- icon: ProwlerShort,
- target: "_blank",
- tooltip: "Looking for all available checks? learn more.",
- },
- ],
- },
- ];
-};
diff --git a/ui/lib/password-manager.ts b/ui/lib/password-manager.ts
new file mode 100644
index 0000000000..36ac7996b7
--- /dev/null
+++ b/ui/lib/password-manager.ts
@@ -0,0 +1,45 @@
+// 1Password marks autofilled fields with data-com-onepassword-filled and paints
+// a "filled" background highlight via styles injected outside the author cascade
+// (web component / adopted sheet), so CSS overrides can't win. Removing the
+// attribute makes its selector stop matching, restoring the design styles while
+// leaving autofill itself untouched.
+const ONEPASSWORD_FILLED_ATTR = "data-com-onepassword-filled";
+
+/**
+ * Ref callback for a form (or any container) that strips password-manager
+ * fill highlights from descendant inputs.
+ *
+ * Returns a cleanup function so it works as a React 19 ref-callback cleanup —
+ * no useEffect needed. Cheap by design: the observer is scoped to the container
+ * and filtered to a single attribute, so the browser only invokes it when the
+ * password manager toggles that attribute (once per fill), never per frame.
+ *
+ * @example
+ * <form ref={stripPasswordManagerHighlight}>…</form>
+ */
+export const stripPasswordManagerHighlight = (
+ container: HTMLElement | null,
+): (() => void) | void => {
+ if (!container) return;
+
+ // removeAttribute on an element without the attribute is a no-op and emits no
+ // mutation record, so re-firing the observer on our own removal can't loop.
+ const strip = (element: Element) =>
+ element.removeAttribute(ONEPASSWORD_FILLED_ATTR);
+
+ container.querySelectorAll(`[${ONEPASSWORD_FILLED_ATTR}]`).forEach(strip);
+
+ const observer = new MutationObserver((mutations) => {
+ for (const { target } of mutations) {
+ if (target instanceof Element) strip(target);
+ }
+ });
+
+ observer.observe(container, {
+ subtree: true,
+ attributes: true,
+ attributeFilter: [ONEPASSWORD_FILLED_ATTR],
+ });
+
+ return () => observer.disconnect();
+};
diff --git a/ui/lib/provider-credentials/build-credentials.ts b/ui/lib/provider-credentials/build-credentials.ts
index ae8c26e02c..cce5d6fe3d 100644
--- a/ui/lib/provider-credentials/build-credentials.ts
+++ b/ui/lib/provider-credentials/build-credentials.ts
@@ -1,5 +1,9 @@
import { filterEmptyValues, getFormValue } from "@/lib";
import { ProviderType } from "@/types";
+import {
+ isConfigurableProvider,
+ type KnownProviderType,
+} from "@/types/providers";
import { ProviderCredentialFields } from "./provider-credential-fields";
@@ -385,10 +389,6 @@ export const buildOracleCloudSecret = (
[ProviderCredentialFields.OCI_TENANCY]:
providerUid ||
getFormValue(formData, ProviderCredentialFields.OCI_TENANCY),
- [ProviderCredentialFields.OCI_REGION]: getFormValue(
- formData,
- ProviderCredentialFields.OCI_REGION,
- ),
[ProviderCredentialFields.OCI_PASS_PHRASE]: getFormValue(
formData,
ProviderCredentialFields.OCI_PASS_PHRASE,
@@ -462,7 +462,10 @@ export const buildSecretConfig = (
const isServiceAccount =
formData.get(ProviderCredentialFields.SERVICE_ACCOUNT_KEY) !== null;
- const secretBuilders = {
+ const secretBuilders: Record<
+ KnownProviderType,
+ () => { secretType: string; secret: unknown }
+ > = {
aws: () => ({
secretType: isRole ? "role" : "static",
secret: buildAWSSecret(formData, isRole),
@@ -533,10 +536,9 @@ export const buildSecretConfig = (
}),
};
- const builder = secretBuilders[providerType];
- if (!builder) {
+ if (!isConfigurableProvider(providerType)) {
throw new Error(`Unsupported provider type: ${providerType}`);
}
- return builder();
+ return secretBuilders[providerType]();
};
diff --git a/ui/lib/provider-filters.test.ts b/ui/lib/provider-filters.test.ts
new file mode 100644
index 0000000000..a2c90e896e
--- /dev/null
+++ b/ui/lib/provider-filters.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ appendSanitizedProviderInFilters,
+ appendSanitizedProviderTypeFilters,
+} from "./provider-filters";
+
+const PROVIDER_TYPE_IN = "filter[provider_type__in]";
+const PROVIDER_IN = "filter[provider__in]";
+
+const makeUrl = () => new URL("https://api.test/v1/providers");
+
+describe("appendSanitizedProviderTypeFilters", () => {
+ it("forwards a known provider type unchanged", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderTypeFilters(url, { [PROVIDER_TYPE_IN]: "aws" });
+ // Then
+ expect(url.searchParams.get(PROVIDER_TYPE_IN)).toBe("aws");
+ });
+
+ it("forwards a dynamic provider type verbatim (not dropped or replaced)", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderTypeFilters(url, { [PROVIDER_TYPE_IN]: "template" });
+ // Then
+ expect(url.searchParams.get(PROVIDER_TYPE_IN)).toBe("template");
+ });
+
+ it("injects no provider-type allowlist when nothing is selected", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderTypeFilters(url, {});
+ // Then
+ expect(url.searchParams.has(PROVIDER_TYPE_IN)).toBe(false);
+ });
+
+ it("keeps a mixed known + dynamic selection intact", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderTypeFilters(url, {
+ [PROVIDER_TYPE_IN]: "aws,template",
+ });
+ // Then
+ expect(url.searchParams.get(PROVIDER_TYPE_IN)).toBe("aws,template");
+ });
+
+ it("excludes the search filter by default", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderTypeFilters(url, {
+ "filter[search]": "prod",
+ [PROVIDER_TYPE_IN]: "template",
+ });
+ // Then
+ expect(url.searchParams.has("filter[search]")).toBe(false);
+ expect(url.searchParams.get(PROVIDER_TYPE_IN)).toBe("template");
+ });
+});
+
+describe("appendSanitizedProviderInFilters", () => {
+ it("forwards a dynamic provider id verbatim", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderInFilters(url, { [PROVIDER_IN]: "provider-uuid" });
+ // Then
+ expect(url.searchParams.get(PROVIDER_IN)).toBe("provider-uuid");
+ });
+
+ it("injects no provider allowlist when nothing is selected", () => {
+ // Given
+ const url = makeUrl();
+ // When
+ appendSanitizedProviderInFilters(url, {});
+ // Then
+ expect(url.searchParams.has(PROVIDER_IN)).toBe(false);
+ });
+});
diff --git a/ui/lib/provider-filters.ts b/ui/lib/provider-filters.ts
index 62edc5bb64..505b151ef6 100644
--- a/ui/lib/provider-filters.ts
+++ b/ui/lib/provider-filters.ts
@@ -1,116 +1,25 @@
-import { PROVIDER_TYPES, type ProviderType } from "@/types/providers";
-
export type ProviderFilterValue = string | string[] | undefined;
export type ProviderFilters = Record<string, ProviderFilterValue>;
interface AppendProviderFiltersOptions {
- ensuredInFilterKey?: string;
excludedKeys?: string[];
excludedKeyIncludes?: string[];
}
-type AppendSanitizedProviderTypeFiltersOptions = Omit<
- AppendProviderFiltersOptions,
- "ensuredInFilterKey"
->;
-
-const SUPPORTED_PROVIDER_TYPES_CSV = PROVIDER_TYPES.join(",");
export const PROVIDER_IN_FILTER_KEY = "filter[provider__in]";
export const PROVIDER_TYPE_IN_FILTER_KEY = "filter[provider_type__in]";
-const PROVIDER_TYPE_IN_KEYS = new Set([
- PROVIDER_TYPE_IN_FILTER_KEY,
- "provider_type__in",
-]);
-
-const PROVIDER_SINGLE_KEYS = new Set([
- "filter[provider_type]",
- "provider_type",
-]);
-
-const toCsvString = (value: unknown): string => {
- if (Array.isArray(value)) return value.join(",");
- if (typeof value === "string") return value;
- return "";
-};
-
-const isSupportedProviderType = (value: string): value is ProviderType =>
- (PROVIDER_TYPES as readonly string[]).includes(value);
-
-export const sanitizeProviderTypesCsv = (value?: unknown): string => {
- const rawValue = toCsvString(value);
- if (!rawValue.trim()) return SUPPORTED_PROVIDER_TYPES_CSV;
-
- const supportedProviderTypes = Array.from(
- new Set(
- rawValue
- .split(",")
- .map((providerType) => providerType.trim())
- .filter(isSupportedProviderType),
- ),
- );
-
- return supportedProviderTypes.length > 0
- ? supportedProviderTypes.join(",")
- : SUPPORTED_PROVIDER_TYPES_CSV;
-};
-
-export const sanitizeProviderType = (
- value?: unknown,
-): ProviderType | undefined => {
- const rawValue = toCsvString(value);
- if (!rawValue.trim()) return undefined;
-
- return rawValue
- .split(",")
- .map((providerType) => providerType.trim())
- .find(isSupportedProviderType);
-};
-
-export const sanitizeProviderFilters = (
- filters: ProviderFilters = {},
- ensuredInFilterKey?: string,
-): ProviderFilters => {
- const sanitizedFilters: ProviderFilters = { ...filters };
-
- Object.keys(sanitizedFilters).forEach((key) => {
- if (PROVIDER_TYPE_IN_KEYS.has(key)) {
- sanitizedFilters[key] = sanitizeProviderTypesCsv(sanitizedFilters[key]);
- return;
- }
-
- if (PROVIDER_SINGLE_KEYS.has(key)) {
- const providerType = sanitizeProviderType(sanitizedFilters[key]);
- if (providerType) {
- sanitizedFilters[key] = providerType;
- } else {
- delete sanitizedFilters[key];
- }
- }
- });
-
- if (ensuredInFilterKey) {
- sanitizedFilters[ensuredInFilterKey] = sanitizeProviderTypesCsv(
- sanitizedFilters[ensuredInFilterKey],
- );
- }
-
- return sanitizedFilters;
-};
-
export const appendSanitizedProviderFilters = (
url: URL,
filters: ProviderFilters = {},
{
- ensuredInFilterKey,
excludedKeys = ["filter[search]"],
excludedKeyIncludes = [],
}: AppendProviderFiltersOptions = {},
): void => {
- const sanitizedFilters = sanitizeProviderFilters(filters, ensuredInFilterKey);
const excludedKeysSet = new Set(excludedKeys);
- Object.entries(sanitizedFilters).forEach(([key, value]) => {
+ Object.entries(filters).forEach(([key, value]) => {
if (
value === undefined ||
excludedKeysSet.has(key) ||
@@ -123,22 +32,17 @@ export const appendSanitizedProviderFilters = (
});
};
+// Named aliases so call sites read by intent (provider-type vs provider-id
+// filters). Both forward to appendSanitizedProviderFilters unchanged: the UI no
+// longer forces a provider allowlist, so neither injects a default filter.
export const appendSanitizedProviderTypeFilters = (
url: URL,
filters: ProviderFilters = {},
- options: AppendSanitizedProviderTypeFiltersOptions = {},
-): void =>
- appendSanitizedProviderFilters(url, filters, {
- ...options,
- ensuredInFilterKey: PROVIDER_TYPE_IN_FILTER_KEY,
- });
+ options: AppendProviderFiltersOptions = {},
+): void => appendSanitizedProviderFilters(url, filters, options);
export const appendSanitizedProviderInFilters = (
url: URL,
filters: ProviderFilters = {},
- options: AppendSanitizedProviderTypeFiltersOptions = {},
-): void =>
- appendSanitizedProviderFilters(url, filters, {
- ...options,
- ensuredInFilterKey: PROVIDER_IN_FILTER_KEY,
- });
+ options: AppendProviderFiltersOptions = {},
+): void => appendSanitizedProviderFilters(url, filters, options);
diff --git a/ui/lib/provider-helpers.ts b/ui/lib/provider-helpers.ts
index eedda4f776..08f2bff8f8 100644
--- a/ui/lib/provider-helpers.ts
+++ b/ui/lib/provider-helpers.ts
@@ -46,7 +46,7 @@ export const createProviderDetailsMapping = (
return {
[uid]: {
- provider: provider?.attributes?.provider || "aws",
+ provider: provider?.attributes?.provider ?? "",
uid: uid,
alias: provider?.attributes?.alias ?? null,
},
@@ -65,7 +65,7 @@ export const createProviderDetailsMappingById = (
return {
[id]: {
- provider: provider?.attributes?.provider || "aws",
+ provider: provider?.attributes?.provider ?? "",
uid: provider?.attributes?.uid || "",
alias: provider?.attributes?.alias ?? null,
},
diff --git a/ui/lib/role-permissions.ts b/ui/lib/role-permissions.ts
new file mode 100644
index 0000000000..87b024ebee
--- /dev/null
+++ b/ui/lib/role-permissions.ts
@@ -0,0 +1,14 @@
+import { permissionFormFields } from "@/lib";
+
+const hiddenOutsideCloudFields = ["manage_billing", "manage_alerts"];
+
+export const getVisiblePermissionFormFields = (isCloudEnvironment: boolean) =>
+ permissionFormFields.filter(
+ (permission) =>
+ permission.field !== "unlimited_visibility" &&
+ (!hiddenOutsideCloudFields.includes(permission.field) ||
+ isCloudEnvironment),
+ );
+
+export const getUnlimitedVisibilityField = () =>
+ permissionFormFields.find(({ field }) => field === "unlimited_visibility");
diff --git a/ui/lib/runtime-config.shared.ts b/ui/lib/runtime-config.shared.ts
index 98a76f8c3a..6e820296d9 100644
--- a/ui/lib/runtime-config.shared.ts
+++ b/ui/lib/runtime-config.shared.ts
@@ -9,6 +9,9 @@ export interface RuntimePublicConfig {
posthogKey: string | null; // reserved
posthogHost: string | null; // reserved
reoDevClientId: string | null; // reserved
+ cloudBillingEnabled: boolean;
+ stripePublishableKey: string | null; // reserved
+ stripePublishableKeyV2: string | null; // reserved
}
export const RUNTIME_CONFIG_SCRIPT_ID = "__PROWLER_RUNTIME_CONFIG__";
@@ -23,4 +26,7 @@ export const EMPTY_RUNTIME_PUBLIC_CONFIG: RuntimePublicConfig = {
posthogKey: null,
posthogHost: null,
reoDevClientId: null,
+ cloudBillingEnabled: false,
+ stripePublishableKey: null,
+ stripePublishableKeyV2: null,
};
diff --git a/ui/lib/runtime-config.ts b/ui/lib/runtime-config.ts
index c799a6fced..f1ef52900b 100644
--- a/ui/lib/runtime-config.ts
+++ b/ui/lib/runtime-config.ts
@@ -2,29 +2,60 @@ import "server-only";
import { connection } from "next/server";
+import { readGatedEnv } from "@/lib/integrations";
import type { RuntimePublicConfig } from "@/lib/runtime-config.shared";
import { readEnv } from "@/lib/runtime-env";
// `connection()` forces a per-request runtime read (never build-snapshotted);
// only this allowlist reaches the client. Each migrated key falls back to its
-// deprecated NEXT_PUBLIC_* name during migration (see readEnv).
+// deprecated NEXT_PUBLIC_* name during migration (see readEnv). Gated
+// integrations (Sentry/GTM/PostHog) resolve to their value only when the
+// matching UI_*_ENABLED flag is "true", else null — boot validation
+// (lib/env.ts) guarantees the value is present whenever the flag is set.
export async function getRuntimePublicConfig(): Promise<RuntimePublicConfig> {
await connection();
return {
- sentryDsn: readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN"),
- sentryEnvironment: readEnv(
+ sentryDsn: readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+ ),
+ sentryEnvironment: readGatedEnv(
+ "UI_SENTRY_ENABLED",
"UI_SENTRY_ENVIRONMENT",
"NEXT_PUBLIC_SENTRY_ENVIRONMENT",
),
- googleTagManagerId: readEnv(
+ googleTagManagerId: readGatedEnv(
+ "UI_GOOGLE_TAG_MANAGER_ENABLED",
"UI_GOOGLE_TAG_MANAGER_ID",
"NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
),
apiBaseUrl: readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL"),
apiDocsUrl: readEnv("UI_API_DOCS_URL", "NEXT_PUBLIC_API_DOCS_URL"),
- posthogKey: readEnv("POSTHOG_KEY"),
- posthogHost: readEnv("POSTHOG_HOST"),
+ posthogKey: readGatedEnv(
+ "UI_POSTHOG_ENABLED",
+ "UI_POSTHOG_KEY",
+ "POSTHOG_KEY",
+ ),
+ posthogHost: readGatedEnv(
+ "UI_POSTHOG_ENABLED",
+ "UI_POSTHOG_HOST",
+ "POSTHOG_HOST",
+ ),
reoDevClientId: readEnv("REO_DEV_CLIENT_ID"),
+ // Install-level selector "legacy" | "metronome" | "false"; the client only
+ // needs on/off, so expose a derived boolean (the raw selector is read
+ // server-side for V1/V2 routing). Default (unset) is off.
+ cloudBillingEnabled:
+ (readEnv("CLOUD_BILLING_ENABLED") ?? "false") !== "false",
+ stripePublishableKey: readEnv(
+ "UI_CLOUD_STRIPE_PUBLISHABLE_KEY",
+ "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY",
+ ),
+ stripePublishableKeyV2: readEnv(
+ "UI_CLOUD_STRIPE_PUBLISHABLE_KEY_V2",
+ "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY_V2",
+ ),
};
}
diff --git a/ui/lib/runtime-env.test.ts b/ui/lib/runtime-env.test.ts
index b353b0ba11..7735622c89 100644
--- a/ui/lib/runtime-env.test.ts
+++ b/ui/lib/runtime-env.test.ts
@@ -1,6 +1,6 @@
import { afterEach, describe, expect, it, vi } from "vitest";
-import { readEnv } from "./runtime-env";
+import { readBoolEnv, readEnv } from "./runtime-env";
describe("readEnv", () => {
afterEach(() => {
@@ -73,3 +73,51 @@ describe("readEnv", () => {
expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBeNull();
});
});
+
+describe("readBoolEnv", () => {
+ afterEach(() => {
+ vi.unstubAllEnvs();
+ });
+
+ it('is true only for the exact string "true"', () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
+
+ // When / Then
+ expect(readBoolEnv("UI_SENTRY_ENABLED")).toBe(true);
+ });
+
+ it("trims surrounding whitespace before comparing", () => {
+ // Given - clean() does not trim a non-empty value, so readBoolEnv must
+ vi.stubEnv("UI_SENTRY_ENABLED", " true ");
+
+ // When / Then
+ expect(readBoolEnv("UI_SENTRY_ENABLED")).toBe(true);
+ });
+
+ it("is false when unset", () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", undefined);
+
+ // When / Then
+ expect(readBoolEnv("UI_SENTRY_ENABLED")).toBe(false);
+ });
+
+ it('is false for "false"', () => {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "false");
+
+ // When / Then
+ expect(readBoolEnv("UI_SENTRY_ENABLED")).toBe(false);
+ });
+
+ it('is false for other truthy-looking values ("TRUE", "1", "yes")', () => {
+ for (const value of ["TRUE", "1", "yes"]) {
+ // Given
+ vi.stubEnv("UI_SENTRY_ENABLED", value);
+
+ // When / Then
+ expect(readBoolEnv("UI_SENTRY_ENABLED")).toBe(false);
+ }
+ });
+});
diff --git a/ui/lib/runtime-env.ts b/ui/lib/runtime-env.ts
index 7426a2e357..430d4f298d 100644
--- a/ui/lib/runtime-env.ts
+++ b/ui/lib/runtime-env.ts
@@ -19,3 +19,8 @@ export function readEnv(
return clean(env[primary]) ?? (legacy ? clean(env[legacy]) : null);
}
+
+// Reads a runtime boolean flag.
+export function readBoolEnv(key: keyof NodeJS.ProcessEnv): boolean {
+ return (readEnv(key) ?? "").trim() === "true";
+}
diff --git a/ui/lib/ui-layout.ts b/ui/lib/ui-layout.ts
new file mode 100644
index 0000000000..8d37626acf
--- /dev/null
+++ b/ui/lib/ui-layout.ts
@@ -0,0 +1,34 @@
+// Global side panel geometry. The panel width is user-resizable and applied
+// as an inline style; MainLayout pushes <main> by exactly the same number of
+// pixels so the panel never covers the page. Below the `sm` breakpoint the
+// panel is a full-width overlay instead, where pushing would leave no page.
+export const SIDE_PANEL_MIN_WIDTH = 360;
+// Standard viewports keep this cap. Beyond 1920px, the effective maximum
+// scales to half the viewport so ultra-wide screens can use the extra room.
+export const SIDE_PANEL_MAX_WIDTH = 960;
+export const SIDE_PANEL_DEFAULT_WIDTH = 480;
+// Detail (finding/resource) content needs drawer-like room, so registering a
+// detail view widens the panel to at least this.
+export const SIDE_PANEL_DETAIL_MIN_WIDTH = 720;
+
+// Media query matching the breakpoint where the panel switches from
+// full-width overlay to fixed-width push panel (Tailwind `sm`).
+export const SIDE_PANEL_PUSH_MEDIA_QUERY = "(min-width: 640px)";
+
+export function getSidePanelMaxWidth(): number {
+ if (typeof window === "undefined") return SIDE_PANEL_MAX_WIDTH;
+ return Math.max(SIDE_PANEL_MAX_WIDTH, Math.floor(window.innerWidth * 0.5));
+}
+
+export function clampSidePanelWidth(width: number): number {
+ const viewportCap =
+ typeof window === "undefined"
+ ? SIDE_PANEL_MAX_WIDTH
+ : Math.floor(window.innerWidth * 0.85);
+ // Enforce the minimum LAST: on tiny viewports the cap can fall below it,
+ // and a sub-minimum panel would be unusable.
+ return Math.max(
+ Math.min(width, getSidePanelMaxWidth(), viewportCap),
+ SIDE_PANEL_MIN_WIDTH,
+ );
+}
diff --git a/ui/lib/utils.test.ts b/ui/lib/utils.test.ts
new file mode 100644
index 0000000000..28d11aecce
--- /dev/null
+++ b/ui/lib/utils.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+
+import { calculatePercentage, getOptionalText } from "@/lib/utils";
+
+describe("calculatePercentage", () => {
+ it("rounds the percentage to the nearest integer", () => {
+ expect(calculatePercentage(1, 3)).toBe(33);
+ expect(calculatePercentage(2, 3)).toBe(67);
+ });
+
+ it("returns 0 when the total is 0", () => {
+ expect(calculatePercentage(5, 0)).toBe(0);
+ });
+});
+
+describe("getOptionalText", () => {
+ it("returns the string when it has usable content", () => {
+ expect(getOptionalText("my-resource")).toBe("my-resource");
+ });
+
+ it("returns undefined for the '-' placeholder", () => {
+ expect(getOptionalText("-")).toBeUndefined();
+ });
+
+ it("returns undefined for empty or whitespace-only strings", () => {
+ expect(getOptionalText("")).toBeUndefined();
+ expect(getOptionalText(" ")).toBeUndefined();
+ });
+
+ it("returns undefined for non-string values", () => {
+ expect(getOptionalText(undefined)).toBeUndefined();
+ expect(getOptionalText(null)).toBeUndefined();
+ expect(getOptionalText(42)).toBeUndefined();
+ });
+});
diff --git a/ui/lib/utils.ts b/ui/lib/utils.ts
index 81db2280e6..7a37948ac7 100644
--- a/ui/lib/utils.ts
+++ b/ui/lib/utils.ts
@@ -17,3 +17,50 @@ export function calculatePercentage(value: number, total: number): number {
if (total === 0) return 0;
return Math.round((value / total) * 100);
}
+
+/**
+ * Normalizes a value into an optional display string.
+ * @param value - The value to normalize
+ * @returns The original string when it is non-empty and not the "-" placeholder, otherwise undefined
+ */
+export function getOptionalText(value: unknown): string | undefined {
+ return typeof value === "string" && value.trim().length > 0 && value !== "-"
+ ? value
+ : undefined;
+}
+
+interface IncludedApiItemRelationshipRef {
+ id: string;
+}
+
+interface IncludedApiItemRelationship {
+ data?: IncludedApiItemRelationshipRef;
+}
+
+interface IncludedApiItem {
+ id: string;
+ type: string;
+ attributes?: Record<string, unknown>;
+ relationships?: Record<string, IncludedApiItemRelationship>;
+}
+
+// Indexes a JSON:API `included` array by id for the requested resource type.
+export function createDict<T extends IncludedApiItem = IncludedApiItem>(
+ type: string,
+ data: { included?: unknown[] } | null | undefined,
+): Record<string, T> {
+ const includedField = data?.included?.filter(
+ (item): item is T =>
+ typeof item === "object" &&
+ item !== null &&
+ (item as IncludedApiItem).type === type,
+ );
+
+ if (!includedField || includedField.length === 0) {
+ return {};
+ }
+
+ return Object.fromEntries(
+ includedField.map((item): [string, T] => [item.id, item]),
+ );
+}
diff --git a/ui/lib/yaml.test.ts b/ui/lib/yaml.test.ts
new file mode 100644
index 0000000000..f5b9d2219a
--- /dev/null
+++ b/ui/lib/yaml.test.ts
@@ -0,0 +1,97 @@
+import { describe, expect, it } from "vitest";
+
+import { validateYaml } from "./yaml";
+
+// The Scan Configuration editor (like the Mutelist editor) validates only YAML
+// *syntax* on the client; the API validates the configuration values
+// (ranges/enums) on create/update. These cover the syntax check the editor and
+// `scanConfigurationFormSchema` rely on.
+describe("validateYaml", () => {
+ it("accepts a mapping with provider sections", () => {
+ // When
+ const result = validateYaml("aws:\n max_unused_access_keys_days: 45");
+
+ // Then
+ expect(result.isValid).toBe(true);
+ });
+
+ it("accepts a key with no value yet (the `aws:` typing state)", () => {
+ // When — `aws:` parses to { aws: null }, still a mapping
+ const result = validateYaml("aws:");
+
+ // Then
+ expect(result.isValid).toBe(true);
+ });
+
+ it("rejects malformed YAML with a syntax error", () => {
+ // When — unmatched bracket is invalid flow syntax
+ const result = validateYaml("aws: [1, 2");
+
+ // Then
+ expect(result.isValid).toBe(false);
+ expect(result.error).toBeTruthy();
+ });
+
+ it("rejects a top-level list (config must be a mapping)", () => {
+ // When
+ const result = validateYaml("- aws\n- azure");
+
+ // Then
+ expect(result.isValid).toBe(false);
+ });
+
+ it("rejects empty content", () => {
+ // When
+ const result = validateYaml("");
+
+ // Then
+ expect(result.isValid).toBe(false);
+ });
+
+ it("rejects a scalar (not a mapping)", () => {
+ // When — a bare word parses to the string "aws", not a mapping
+ const result = validateYaml("aws");
+
+ // Then
+ expect(result.isValid).toBe(false);
+ });
+
+ // Users author these documents by hand in the Mutelist and Scan Configuration
+ // editors, so anchors, aliases and merge keys are legitimate input the syntax
+ // check must keep accepting across js-yaml upgrades (4.3.0 rewrote merge-key
+ // handling for CVE-2026-59869).
+ it("accepts anchors, aliases and merge keys", () => {
+ // When
+ const result = validateYaml(
+ [
+ "defaults: &defaults",
+ " max_unused_access_keys_days: 45",
+ "aws:",
+ " <<: *defaults",
+ " max_console_access_days: 45",
+ ].join("\n"),
+ );
+
+ // Then
+ expect(result.isValid).toBe(true);
+ });
+
+ it("rejects a merge-key amplification document (CVE-2026-59869 shape)", () => {
+ // Given — each mapping merges the previous one and adds a distinct key, so
+ // merged-key copies grow quadratically (~45k total here). js-yaml 4.3.0
+ // fixes the CVE by capping that work (maxTotalMergeKeys) and rejecting the
+ // document; a vulnerable parser accepts it instead, turning the assertion
+ // below red without relying on timing or suite timeouts.
+ const chain = ["a0: &a0 { k0: 0 }"];
+ for (let i = 1; i < 300; i++) {
+ chain.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`);
+ }
+
+ // When
+ const result = validateYaml(chain.join("\n"));
+
+ // Then
+ expect(result.isValid).toBe(false);
+ expect(result.error).toMatch(/merge keys/i);
+ });
+});
diff --git a/ui/lib/yaml.ts b/ui/lib/yaml.ts
index 8061fad151..35146564c5 100644
--- a/ui/lib/yaml.ts
+++ b/ui/lib/yaml.ts
@@ -273,3 +273,40 @@ Mutelist:
- "*"
Tags:
- "Name=aws-controltower-VPC"`;
+
+export const defaultScanConfigurationYaml = `# Override Prowler's per-tenant defaults below.
+# Keep only the keys you want to change; the rest
+# use the built-in defaults from config.yaml.
+# Values are validated on save.
+
+aws:
+ mute_non_default_regions: false
+ max_unused_access_keys_days: 45
+ max_console_access_days: 45
+ max_unused_sagemaker_access_days: 90
+ max_security_group_rules: 50
+
+azure:
+ defender_attack_path_minimal_risk_level: "High"
+ php_latest_version: "8.2"
+ python_latest_version: "3.12"
+ java_latest_version: "17"
+ vm_backup_min_daily_retention_days: 7
+
+gcp:
+ mig_min_zones: 2
+ max_snapshot_age_days: 90
+ max_unused_account_days: 180
+ storage_min_retention_days: 90
+ secretmanager_max_rotation_days: 90
+
+kubernetes:
+ audit_log_maxbackup: 10
+ audit_log_maxsize: 100
+ audit_log_maxage: 30
+
+m365:
+ sign_in_frequency: 4
+ recommended_mailtips_large_audience_threshold: 25
+ audit_log_age: 90
+`;
diff --git a/ui/package.json b/ui/package.json
index 576b0bb723..d6fcf89c72 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -23,9 +23,9 @@
"test:browser": "vitest run --project browser",
"test:browser:watch": "vitest --project browser",
"test:coverage": "vitest run --coverage",
- "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config",
- "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --debug",
- "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --headed",
+ "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation",
+ "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation --debug",
+ "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation --headed",
"test:e2e:install": "playwright install",
"test:e2e:report": "playwright show-report",
"test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --ui",
@@ -42,7 +42,6 @@
"@codemirror/view": "6.40.0",
"@dagrejs/dagre": "3.0.0",
"@extractus/feed-extractor": "7.1.7",
- "@heroui/react": "2.8.4",
"@hookform/resolvers": "5.2.2",
"@langchain/aws": "1.3.7",
"@langchain/core": "1.1.45",
@@ -65,6 +64,7 @@
"@radix-ui/react-select": "2.2.5",
"@radix-ui/react-separator": "1.1.7",
"@radix-ui/react-slot": "1.2.3",
+ "@radix-ui/react-switch": "1.3.0",
"@radix-ui/react-tabs": "1.1.13",
"@radix-ui/react-toast": "1.2.14",
"@radix-ui/react-tooltip": "1.2.8",
@@ -73,7 +73,7 @@
"@react-aria/visually-hidden": "3.8.12",
"@react-stately/utils": "3.10.8",
"@react-types/shared": "3.26.0",
- "@sentry/nextjs": "10.27.0",
+ "@sentry/nextjs": "10.65.0",
"@tailwindcss/postcss": "4.1.18",
"@tailwindcss/typography": "0.5.16",
"@tanstack/react-table": "8.21.3",
@@ -81,6 +81,7 @@
"@uiw/react-codemirror": "4.25.8",
"@xyflow/react": "12.10.2",
"ai": "6.0.203",
+ "ajv": "8.18.0",
"class-variance-authority": "0.7.1",
"clsx": "2.1.1",
"cmdk": "1.1.1",
@@ -88,8 +89,8 @@
"date-fns": "4.1.0",
"driver.js": "1.4.0",
"framer-motion": "11.18.2",
- "import-in-the-middle": "2.0.0",
- "js-yaml": "4.1.1",
+ "import-in-the-middle": "3.3.1",
+ "js-yaml": "4.3.0",
"jwt-decode": "4.0.0",
"langchain": "1.4.0",
"lucide-react": "0.543.0",
@@ -113,7 +114,6 @@
"tailwindcss-animate": "1.0.7",
"topojson-client": "3.1.0",
"use-stick-to-bottom": "1.1.1",
- "vaul": "1.1.2",
"world-atlas": "2.0.2",
"zod": "4.4.3",
"zustand": "5.0.8"
diff --git a/ui/playwright.config.ts b/ui/playwright.config.ts
index b9730e0de6..2ae3247997 100644
--- a/ui/playwright.config.ts
+++ b/ui/playwright.config.ts
@@ -145,6 +145,16 @@ export default defineConfig({
testMatch: "invitations.spec.ts",
dependencies: ["admin.auth.setup"],
},
+ // This project validates the responsive application navigation shell
+ {
+ name: "navigation",
+ use: {
+ ...devices["Pixel 5"],
+ viewport: { width: 390, height: 844 },
+ },
+ testMatch: /navigation\/.*\.spec\.ts/,
+ dependencies: ["admin.auth.setup"],
+ },
],
webServer: {
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 6ca6ac4003..f15c1cc800 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -13,7 +13,7 @@ overrides:
'@react-aria/interactions>react': 19.2.7
lodash: 4.18.1
lodash-es: 4.18.1
- hono: 4.12.21
+ hono: 4.12.28
'@hono/node-server': 1.19.14
'@isaacs/brace-expansion': 5.0.1
fast-xml-parser: 5.8.0
@@ -21,6 +21,13 @@ overrides:
postcss: 8.5.14
esbuild: 0.28.1
rollup@>=4: 4.59.0
+ vite@>=7 <8: 7.3.5
+ ws@>=8 <9: 8.21.0
+ es-module-lexer: 2.3.0
+ '@babel/core': 7.29.7
+ browserslist: 4.28.2
+ caniuse-lite: 1.0.30001792
+ baseline-browser-mapping: 2.10.29
minimatch@<4: 3.1.4
minimatch@>=9 <10: 9.0.7
minimatch@>=10: 10.2.3
@@ -29,7 +36,7 @@ overrides:
qs: 6.15.2
express-rate-limit: 8.5.1
uuid: 11.1.1
- dompurify: 3.4.10
+ dompurify: 3.4.11
importers:
@@ -56,30 +63,27 @@ importers:
'@extractus/feed-extractor':
specifier: 7.1.7
version: 7.1.7
- '@heroui/react':
- specifier: 2.8.4
- version: 2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)
'@hookform/resolvers':
specifier: 5.2.2
version: 5.2.2(react-hook-form@7.62.0(react@19.2.7))
'@langchain/aws':
specifier: 1.3.7
- version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
+ version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
'@langchain/core':
specifier: 1.1.45
- version: 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ version: 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
'@langchain/mcp-adapters':
specifier: 1.1.3
- version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
+ version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
'@langchain/openai':
specifier: 1.4.5
- version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(ws@8.20.1)
+ version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(ws@8.21.0)
'@lezer/highlight':
specifier: 1.2.3
version: 1.2.3
'@next/third-parties':
specifier: 16.2.9
- version: 16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+ version: 16.2.9(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
'@radix-ui/react-alert-dialog':
specifier: 1.1.14
version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -125,6 +129,9 @@ importers:
'@radix-ui/react-slot':
specifier: 1.2.3
version: 1.2.3(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-switch':
+ specifier: 1.3.0
+ version: 1.3.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
'@radix-ui/react-tabs':
specifier: 1.1.13
version: 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -150,8 +157,8 @@ importers:
specifier: 3.26.0
version: 3.26.0(react@19.2.7)
'@sentry/nextjs':
- specifier: 10.27.0
- version: 10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
+ specifier: 10.65.0
+ version: 10.65.0(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
'@tailwindcss/postcss':
specifier: 4.1.18
version: 4.1.18
@@ -173,6 +180,9 @@ importers:
ai:
specifier: 6.0.203
version: 6.0.203(zod@4.4.3)
+ ajv:
+ specifier: 8.18.0
+ version: 8.18.0
class-variance-authority:
specifier: 0.7.1
version: 0.7.1
@@ -195,17 +205,17 @@ importers:
specifier: 11.18.2
version: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
import-in-the-middle:
- specifier: 2.0.0
- version: 2.0.0
+ specifier: 3.3.1
+ version: 3.3.1
js-yaml:
- specifier: 4.1.1
- version: 4.1.1
+ specifier: 4.3.0
+ version: 4.3.0
jwt-decode:
specifier: 4.0.0
version: 4.0.0
langchain:
specifier: 1.4.0
- version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))
+ version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))
lucide-react:
specifier: 0.543.0
version: 0.543.0(react@19.2.7)
@@ -220,13 +230,13 @@ importers:
version: 5.1.6
next:
specifier: 16.2.9
- version: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ version: 16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
next-auth:
specifier: 5.0.0-beta.30
- version: 5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+ version: 5.0.0-beta.30(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
next-themes:
specifier: 0.2.1
- version: 0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ version: 0.2.1(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
react:
specifier: 19.2.7
version: 19.2.7
@@ -269,9 +279,6 @@ importers:
use-stick-to-bottom:
specifier: 1.1.1
version: 1.1.1(react@19.2.7)
- vaul:
- specifier: 1.1.2
- version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
world-atlas:
specifier: 2.0.2
version: 2.0.2
@@ -329,13 +336,13 @@ importers:
version: 8.53.0(eslint@9.39.2(jiti@2.6.1))(typescript@5.5.4)
'@vitejs/plugin-react':
specifier: 5.1.2
- version: 5.1.2(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ version: 5.1.2(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
'@vitest/browser':
specifier: 4.1.8
- version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+ version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)
'@vitest/browser-playwright':
specifier: 4.1.8
- version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+ version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)
'@vitest/coverage-v8':
specifier: 4.1.8
version: 4.1.8(@vitest/browser@4.1.8)(vitest@4.1.8)
@@ -407,7 +414,7 @@ importers:
version: 5.5.4
vitest:
specifier: 4.1.8
- version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ version: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
vitest-browser-react:
specifier: 2.0.4
version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8)
@@ -449,11 +456,16 @@ packages:
'@antfu/install-pkg@1.1.0':
resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
- '@apm-js-collab/code-transformer@0.8.2':
- resolution: {integrity: sha512-YRjJjNq5KFSjDUoqu5pFUWrrsvGOxl6c3bu+uMFc9HNNptZ2rNU/TI2nLw4jnhQNtka972Ee2m3uqbvDQtPeCA==}
+ '@apm-js-collab/code-transformer-bundler-plugins@0.5.0':
+ resolution: {integrity: sha512-YxLBY5nGlurL7QeJLq6e5g0ouBpAp0pwgyA/5rHXEXwhiPLn9ZHbT+Y2LlP90GT872cSocfjWRYu/fnpuBudNQ==}
+ engines: {node: '>=18.0.0'}
- '@apm-js-collab/tracing-hooks@0.3.1':
- resolution: {integrity: sha512-Vu1CbmPURlN5fTboVuKMoJjbO5qcq9fA5YXpskx3dXe/zTBvjODFoerw+69rVBlRLrJpwPqSDqEuJDEKIrTldw==}
+ '@apm-js-collab/code-transformer@0.15.0':
+ resolution: {integrity: sha512-XmXYVs8CzJ1Aj79noVbn2weUO/XWtRyURpGqx7aU7DOXlUQhR0WKOQNF0okh7PCeY37vxf7kU3v57OAkEPm3ww==}
+ hasBin: true
+
+ '@apm-js-collab/tracing-hooks@0.10.1':
+ resolution: {integrity: sha512-w2OWXR7FWrKqSziuE9+QclaZrStxO/8+OwbXM635s/zs0Eez1Qo3ivSPdB2WsaPY/iznKTytONPx/PitD7IXcA==}
'@asamuzakjp/css-color@4.1.2':
resolution: {integrity: sha512-NfBUvBaYgKIuq6E/RBLY1m0IohzNHAYyaJGuTK79Z23uNwmz2jl1mPsC5ZxCCxylinKhT1Amn5oNTlx1wN8cQg==}
@@ -635,71 +647,62 @@ packages:
resolution: {integrity: sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==}
engines: {node: '>=18.0.0'}
- '@babel/code-frame@7.28.6':
- resolution: {integrity: sha512-JYgintcMjRiCvS8mMECzaEn+m3PfoQiyqukOMCCVQtoJGYJw8j/8LBJEiqkHLkfwCcs74E3pbAUFNg7d9VNJ+Q==}
+ '@babel/code-frame@7.29.7':
+ resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
engines: {node: '>=6.9.0'}
- '@babel/code-frame@7.29.0':
- resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+ '@babel/compat-data@7.29.7':
+ resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
engines: {node: '>=6.9.0'}
- '@babel/compat-data@7.28.6':
- resolution: {integrity: sha512-2lfu57JtzctfIrcGMz992hyLlByuzgIk58+hhGCxjKZ3rWI82NnVLjXcaTqkI2NvlcvOskZaiZ5kjUALo3Lpxg==}
+ '@babel/core@7.29.7':
+ resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
engines: {node: '>=6.9.0'}
- '@babel/core@7.28.6':
- resolution: {integrity: sha512-H3mcG6ZDLTlYfaSNi0iOKkigqMFvkTKlGUYlD8GW7nNOYRrevuA46iTypPyv+06V3fEmvvazfntkBU34L0azAw==}
+ '@babel/generator@7.29.7':
+ resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
engines: {node: '>=6.9.0'}
- '@babel/generator@7.28.6':
- resolution: {integrity: sha512-lOoVRwADj8hjf7al89tvQ2a1lf53Z+7tiXMgpZJL3maQPDxh0DgLMN62B2MKUOFcoodBHLMbDM6WAbKgNy5Suw==}
+ '@babel/helper-compilation-targets@7.29.7':
+ resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
engines: {node: '>=6.9.0'}
- '@babel/helper-compilation-targets@7.28.6':
- resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==}
+ '@babel/helper-globals@7.29.7':
+ resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
engines: {node: '>=6.9.0'}
- '@babel/helper-globals@7.28.0':
- resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+ '@babel/helper-module-imports@7.29.7':
+ resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
engines: {node: '>=6.9.0'}
- '@babel/helper-module-imports@7.28.6':
- resolution: {integrity: sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==}
- engines: {node: '>=6.9.0'}
-
- '@babel/helper-module-transforms@7.28.6':
- resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==}
+ '@babel/helper-module-transforms@7.29.7':
+ resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
engines: {node: '>=6.9.0'}
peerDependencies:
- '@babel/core': ^7.0.0
+ '@babel/core': 7.29.7
'@babel/helper-plugin-utils@7.28.6':
resolution: {integrity: sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==}
engines: {node: '>=6.9.0'}
- '@babel/helper-string-parser@7.27.1':
- resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+ '@babel/helper-string-parser@7.29.7':
+ resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
engines: {node: '>=6.9.0'}
- '@babel/helper-validator-identifier@7.28.5':
- resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+ '@babel/helper-validator-identifier@7.29.7':
+ resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
engines: {node: '>=6.9.0'}
- '@babel/helper-validator-option@7.27.1':
- resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
+ '@babel/helper-validator-option@7.29.7':
+ resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
engines: {node: '>=6.9.0'}
- '@babel/helpers@7.28.6':
- resolution: {integrity: sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==}
+ '@babel/helpers@7.29.7':
+ resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
engines: {node: '>=6.9.0'}
- '@babel/parser@7.28.6':
- resolution: {integrity: sha512-TeR9zWR18BvbfPmGbLampPMW+uW1NZnJlRuuHso8i87QZNq2JRF9i6RgxRqtEq+wQGsS19NNTWr2duhnE49mfQ==}
- engines: {node: '>=6.0.0'}
- hasBin: true
-
- '@babel/parser@7.29.3':
- resolution: {integrity: sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==}
+ '@babel/parser@7.29.7':
+ resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
engines: {node: '>=6.0.0'}
hasBin: true
@@ -707,32 +710,28 @@ packages:
resolution: {integrity: sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==}
engines: {node: '>=6.9.0'}
peerDependencies:
- '@babel/core': ^7.0.0-0
+ '@babel/core': 7.29.7
'@babel/plugin-transform-react-jsx-source@7.27.1':
resolution: {integrity: sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==}
engines: {node: '>=6.9.0'}
peerDependencies:
- '@babel/core': ^7.0.0-0
+ '@babel/core': 7.29.7
'@babel/runtime@7.28.6':
resolution: {integrity: sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==}
engines: {node: '>=6.9.0'}
- '@babel/template@7.28.6':
- resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
+ '@babel/template@7.29.7':
+ resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
engines: {node: '>=6.9.0'}
- '@babel/traverse@7.28.6':
- resolution: {integrity: sha512-fgWX62k02qtjqdSNTAGxmKYY/7FSL9WAS1o2Hu5+I5m9T0yxZzr4cnrfXQ/MX0rIifthCSs6FKTlzYbJcPtMNg==}
+ '@babel/traverse@7.29.7':
+ resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
engines: {node: '>=6.9.0'}
- '@babel/types@7.28.6':
- resolution: {integrity: sha512-0ZrskXVEHSWIqZM/sQZ4EV3jZJXRkio/WCxaqKZP1g//CEWEPSfeZFcms4XeKBCHU0ZKnIkdJeU/kF+eRp5lBg==}
- engines: {node: '>=6.9.0'}
-
- '@babel/types@7.29.0':
- resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
+ '@babel/types@7.29.7':
+ resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
engines: {node: '>=6.9.0'}
'@bcoe/v8-coverage@1.0.2':
@@ -757,6 +756,9 @@ packages:
'@codemirror/commands@6.10.3':
resolution: {integrity: sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==}
+ '@codemirror/commands@6.10.4':
+ resolution: {integrity: sha512-Ryk9y9T0FFVF0cUGhAknveAyUOl/A1qReTFi+qPKtOh2Z9F4AUBz3XOrYD4ZEgZirdugVzHvd/2/Wcwy5OliTg==}
+
'@codemirror/language@6.12.2':
resolution: {integrity: sha512-jEPmz2nGGDxhRTg3lTpzmIyGKxz3Gp3SJES4b0nAuE5SWQoKdT5GoQ69cwMmFd+wvFUhYirtDTr0/DRHpQAyWg==}
@@ -769,6 +771,9 @@ packages:
'@codemirror/state@6.6.0':
resolution: {integrity: sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==}
+ '@codemirror/state@6.7.1':
+ resolution: {integrity: sha512-9QzNDgE4EYDnAHfrTlR2lwiPciiOymLtwKK+8yHQzCc7GXhAP9xdEbEJFy2IWB1j9UGUl9BsgMmTo/ImA02T7A==}
+
'@codemirror/theme-one-dark@6.1.3':
resolution: {integrity: sha512-NzBdIvEJmx6fjeremiGp3t/okrLPYT0d9orIc7AFun8oZcRk58aejkqhv6spnz4MLAevrKNPMQYXEWMg4s+sKA==}
@@ -821,9 +826,6 @@ packages:
'@emnapi/runtime@1.10.0':
resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
- '@emnapi/runtime@1.8.1':
- resolution: {integrity: sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==}
-
'@emnapi/wasi-threads@1.1.0':
resolution: {integrity: sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==}
@@ -1049,579 +1051,11 @@ packages:
'@floating-ui/utils@0.2.10':
resolution: {integrity: sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ==}
- '@formatjs/ecma402-abstract@2.3.4':
- resolution: {integrity: sha512-qrycXDeaORzIqNhBOx0btnhpD1c+/qFIHAN9znofuMJX6QBwtbrmlpWfD4oiUUD2vJUOIYFA/gYtg2KAMGG7sA==}
-
- '@formatjs/fast-memoize@2.2.7':
- resolution: {integrity: sha512-Yabmi9nSvyOMrlSeGGWDiH7rf3a7sIwplbvo/dlz9WCIjzIQAfy1RMf4S0X3yG724n5Ghu2GmEl5NJIV6O9sZQ==}
-
- '@formatjs/icu-messageformat-parser@2.11.2':
- resolution: {integrity: sha512-AfiMi5NOSo2TQImsYAg8UYddsNJ/vUEv/HaNqiFjnI3ZFfWihUtD5QtuX6kHl8+H+d3qvnE/3HZrfzgdWpsLNA==}
-
- '@formatjs/icu-skeleton-parser@1.8.14':
- resolution: {integrity: sha512-i4q4V4qslThK4Ig8SxyD76cp3+QJ3sAqr7f6q9VVfeGtxG9OhiAk3y9XF6Q41OymsKzsGQ6OQQoJNY4/lI8TcQ==}
-
- '@formatjs/intl-localematcher@0.6.1':
- resolution: {integrity: sha512-ePEgLgVCqi2BBFnTMWPfIghu6FkbZnnBVhO2sSxvLfrdFw7wCHAHiDoM2h4NRgjbaY7+B7HgOLZGkK187pZTZg==}
-
- '@heroui/accordion@2.2.23':
- resolution: {integrity: sha512-eXokso461YdSkJ6t3fFxBq2xkxCcZPbXECwanNHaLZPBh1QMaVdtCEZZxVB4HeoMRmZchRHWbUrbiz/l+A9hZQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/alert@2.2.26':
- resolution: {integrity: sha512-ngyPzbRrW3ZNgwb6DlsvdCboDeHrncN4Q1bvdwFKIn2uHYRF2pEJgBhWuqpCVDaIwGhypGMXrBFFwIvdCNF+Zw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.19'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/aria-utils@2.2.23':
- resolution: {integrity: sha512-RF5vWZdBdQIGfQ5GgPt3XTsNDodLJ87criWUVt7qOox+lmJrSkYPmHgA1bEZxJdd3aCwLCJbcBGqP7vW3+OVCQ==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/autocomplete@2.3.28':
- resolution: {integrity: sha512-7z55VHlCG6Gh7IKypJdc7YIO45rR05nMAU0fu5D2ZbcsjBN1ie+ld2M57ypamK/DVD7TyauWvFZt55LcWN5ejQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/avatar@2.2.21':
- resolution: {integrity: sha512-oer+CuEAQpvhLzyBmO3eWhsdbWzcyIDn8fkPl4D2AMfpNP8ve82ysXEC+DLcoOEESS3ykkHsp4C0MPREgC3QgA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/badge@2.2.16':
- resolution: {integrity: sha512-gW0aVdic+5jwDhifIB8TWJ6170JOOzLn7Jkomj2IsN2G+oVrJ7XdJJGr2mYkoeNXAwYlYVyXTANV+zPSGKbx7A==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/breadcrumbs@2.2.21':
- resolution: {integrity: sha512-CB/RNyng37thY8eCbCsIHVV/hMdND4l+MapJOcCi6ffbKT0bebC+4ukcktcdZ/WucAn2qZdl4NfdyIuE0ZqjyQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/button@2.2.26':
- resolution: {integrity: sha512-Z4Kp7M444pgzKCUDTZX8Q5GnxOxqIJnAB58+8g5ETlA++Na+qqXwAXADmAPIrBB7uqoRUrsP7U/bpp5SiZYJ2A==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/calendar@2.2.26':
- resolution: {integrity: sha512-jCFc+JSl/yQqAVi5TladdYpiX0vf72Sy2vuCTN+HdcpH3SFkJgPLlbt6ib+pbAi14hGbUdJ+POmBC19URZ/g7g==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/card@2.2.24':
- resolution: {integrity: sha512-kv4xLJTNYSar3YjiziA71VSZbco0AQUiZAuyP9rZ8XSht8HxLQsVpM6ywFa+/SGTGAh5sIv0qCYCpm0m4BrSxw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/checkbox@2.3.26':
- resolution: {integrity: sha512-i3f6pYNclFN/+CHhgF1xWjBaHNEbb2HoZaM3Q2zLVTzDpBx0893Vu3iDkH6wwx71ze8N/Y0cqZWFxR5v+IQUKg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/chip@2.2.21':
- resolution: {integrity: sha512-vE1XbVL4U92RjuXZWnQgcPIFQ9amLEDCVTK5IbCF2MJ7Xr6ofDj6KTduauCCH1H40p9y1zk6+fioqvxDEoCgDw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/code@2.2.20':
- resolution: {integrity: sha512-Bd0fwvBv3K1NGjjlKxbHxCIXjQ0Ost6m3z5P295JZ5yf9RIub4ztLqYx2wS0cRJ7z/AjqF6YBQlhCMt76cuEsQ==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/date-input@2.3.26':
- resolution: {integrity: sha512-iF3YRZYSk37oEzVSop9hHd8VoNTJ3lIO06Oq/Lj64HGinuK06/PZrFhEWqKKZ472RctzLTmPbAjeXuhHh2mgMg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/date-picker@2.3.27':
- resolution: {integrity: sha512-FoiORJ6e8cXyoqBn5mvXaBUocW3NNXTV07ceJhqyu0GVS+jV0J0bPZBg4G8cz7BjaU+8cquHsFQanz73bViH3g==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/divider@2.2.19':
- resolution: {integrity: sha512-FHoXojco23o/A9GJU6K2iJ3uAvcV7AJ4ppAKIGaKS4weJnYOsh5f9NE2RL3NasmIjk3DLMERDjVVuPyDdJ+rpw==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/dom-animation@2.1.10':
- resolution: {integrity: sha512-dt+0xdVPbORwNvFT5pnqV2ULLlSgOJeqlg/DMo97s9RWeD6rD4VedNY90c8C9meqWqGegQYBQ9ztsfX32mGEPA==}
- peerDependencies:
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
-
- '@heroui/drawer@2.2.23':
- resolution: {integrity: sha512-43/Aoi7Qi4YXmVXXy43v2pyLmi4ZW32nXSnbU5xdKhMb0zFNThAH0/eJmHdtW8AUjei2W1wTmMpGn/WHCYVXOA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/dropdown@2.3.26':
- resolution: {integrity: sha512-ZuOawL7OnsC5qykYixADfaeSqZleFg4IwZnDN6cd17bXErxPnBYBVnQSnHRsyCUJm7gYiVcDXljNKwp/2reahg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/form@2.1.26':
- resolution: {integrity: sha512-vBlae4k59GjD36Ho8P8rL78W9djWPPejav0ocv0PjfqlEnmXLa1Wrel/3zTAOcFVI7uKBio3QdU78IIEPM82sw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18'
- react-dom: '>=18'
-
- '@heroui/framer-utils@2.1.22':
- resolution: {integrity: sha512-f5qlpdWToEp1re9e4Wje2/FCaGWRdkqs9U80qfjFHmZFaWHBGLBX1k8G5p7aw3lOaf+pqDcC2sIldNav57Xfpw==}
- peerDependencies:
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/image@2.2.16':
- resolution: {integrity: sha512-dy3c4qoCqNbJmOoDP2dyth+ennSNXoFOH0Wmd4i1TF5f20LCJSRZbEjqp9IiVetZuh+/yw+edzFMngmcqZdTNw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/input-otp@2.1.26':
- resolution: {integrity: sha512-eVVSOvwTiuVmq/hXWDYuq9ICR59R7TuWi55dDG/hd5WN6jIBJsNkmt7MmYVaSNNISyzi27hPEK43/bvK4eO9FA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18'
- react-dom: '>=18'
-
- '@heroui/input@2.4.27':
- resolution: {integrity: sha512-sLGw7r+BXyB1MllKNKmn0xLvSW0a1l+3gXefnUCXGSvI3bwrLvk3hUgbkVSJRnxSChU41yXaYDRcHL39t7yzuQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.19'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/kbd@2.2.21':
- resolution: {integrity: sha512-4AY0Q+jwDbY9ehhu0Vv68QIiSCnFEMPYpaPHVLNR/9rEJDN/BS+j4FyUfxjnyjD7EKa8CNs6Y7O0VnakUXGg+g==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/link@2.2.22':
- resolution: {integrity: sha512-INWjrLwlxSU5hN0qr1lCZ1GN9Tf3X8WMTUQnPmvbqbJkPgQjqfIcO2dJyUkV3X0PiSB9QbPMlfU4Sx+loFKq4g==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/listbox@2.3.25':
- resolution: {integrity: sha512-KaLLCpf7EPhDMamjJ7dBQK2SKo8Qrlh6lTLCbZrCAuUGiBooCc80zWJa55XiDiaZhfQC/TYeoe5MMnw4yr5xmw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/menu@2.2.25':
- resolution: {integrity: sha512-BxHD/5IvmvhzM78KVrEkkcQFie0WF2yXq7FXsGa17UHBji32D38JKgGCnJMMoko1H3cG4p5ihZjT7O7NH5rdvQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/modal@2.2.23':
- resolution: {integrity: sha512-IOvcyX9ugEmsHhtizxP/rVHGWCO+I0zWxwzcuA+BjX8jcWYrseiyoPMPsxsjSfX2tfBY4b2empT08BsWH1n+Wg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/navbar@2.2.24':
- resolution: {integrity: sha512-fRnHJR4QbANeTCVVg+VmvItSv51rYvkcvx4YrHYmUa8X3kWy5X+0dARqtLxuXv76Uc12+w23gb5T4eXQIBL+oQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/number-input@2.0.17':
- resolution: {integrity: sha512-6beiwciRA1qR/3nKYRSPSiKx77C8Hw9ejknBKByw6rXYE4J1jVNJTlTeuqqeIWG6yeNd3SiZGoSRc3uTMPZLlg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.19'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/pagination@2.2.23':
- resolution: {integrity: sha512-cXVijoCmTT+u5yfx8PUHKwwA9sJqVcifW9GdHYhQm6KG5um+iqal3tKtmFt+Z0KUTlSccfrM6MtlVm0HbJqR+g==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/popover@2.3.26':
- resolution: {integrity: sha512-m+FQmP648XRbwcRyzTPaYgbQIBJX05PtwbAp7DLbjd1SHQRJjx6wAj6uhVOTeJNXTTEy8JxwMXwh4IAJO/g3Jw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/progress@2.2.21':
- resolution: {integrity: sha512-f/PMOai00oV7+sArWabMfkoA80EskXgXHae4lsKhyRbeki8sKXQRpVwFY5/fINJOJu5mvVXQBwv2yKupx8rogg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/radio@2.3.26':
- resolution: {integrity: sha512-9dyKKMP79otqWg34DslO7lhrmoQncU0Po0PH2UhFhUTQMohMSXMPQhj+T+ffiYG2fmjdlYk0E2d7mZI8Hf7IeA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/react-rsc-utils@2.1.9':
- resolution: {integrity: sha512-e77OEjNCmQxE9/pnLDDb93qWkX58/CcgIqdNAczT/zUP+a48NxGq2A2WRimvc1uviwaNL2StriE2DmyZPyYW7Q==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/react-utils@2.1.13':
- resolution: {integrity: sha512-gJ89YL5UCilKLldJ4In0ZLzngg+tYiDuo1tQ7lf2aJB7SQMrZmEutsKrGCdvn/c2CSz5cRryo0H6JZCDsji3qg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/react@2.8.4':
- resolution: {integrity: sha512-qIrLbVY9vtwk1w4udnbuaE4X5JxbA2rEUgZGxshAao5TNHPsnVrd2NqGLJvSEqP9c7XA4N5c0PCtYJ7PeiM4Lg==}
- peerDependencies:
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/ripple@2.2.19':
- resolution: {integrity: sha512-nmeu1vDehmv+tn0kfo3fpeCZ9fyTp/DD9dF8qJeYhBD3CR7J/LPaGXvU6M1t8WwV7RFEA5pjmsmA3jHWjwdAJQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/scroll-shadow@2.3.17':
- resolution: {integrity: sha512-3h8SJNLjHt3CQmDWNnZ2MJTt0rXuJztV0KddZrwNlZgI54W6PeNe6JmVGX8xSHhrk72jsVz7FmSQNiPvqs8/qQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/select@2.4.27':
- resolution: {integrity: sha512-CgMqVWYWcdHNOnSeMMraXFBXFsToyxZ9sSwszG3YlhGwaaj0yZonquMYgl5vHCnFLkGXwggNczl+vdDErLEsbw==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/shared-icons@2.1.10':
- resolution: {integrity: sha512-ePo60GjEpM0SEyZBGOeySsLueNDCqLsVL79Fq+5BphzlrBAcaKY7kUp74964ImtkXvknTxAWzuuTr3kCRqj6jg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/shared-utils@2.1.11':
- resolution: {integrity: sha512-2zKVjCc9EMMk05peVpI1Q+vFf+dzqyVdf1DBCJ2SNQEUF7E+sRe1FvhHvPoye3TIFD/Fr6b3kZ6vzjxL9GxB6A==}
-
- '@heroui/skeleton@2.2.16':
- resolution: {integrity: sha512-rIerwmS5uiOpvJUT37iyuiXUJzesUE/HgSv4gH1tTxsrjgpkRRrgr/zANdbCd0wpSIi4PPNHWq51n0CMrQGUTg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/slider@2.4.23':
- resolution: {integrity: sha512-cohy9+wojimHQ/5AShj4Jt7aK1d8fGFP52l2gLELP02eo6CIpW8Ib213t3P1H86bMiBwRec5yi28zr8lHASftA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.19'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/snippet@2.2.27':
- resolution: {integrity: sha512-YCiZjurbK/++I8iDjmqJ/ROt+mdy5825Krc8gagdwUR7Z7jXBveFWjgvgkfg8EA/sJlDpMw9xIzubm5KUCEzfA==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/spacer@2.2.20':
- resolution: {integrity: sha512-rXqXcUvTxVQoob+VsG7AgalFwEC38S9zzyZ0sxy7cGUJEdfLjWG19g36lNdtV+LOk+Gj9FiyKvUGBFJiqrId6w==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/spinner@2.2.23':
- resolution: {integrity: sha512-qmQ/OanEvvtyG0gtuDP3UmjvBAESr++F1S05LRlY3w+TSzFUh6vfxviN9M/cBnJYg6QuwfmzlltqmDXnV8/fxw==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/switch@2.2.23':
- resolution: {integrity: sha512-7ZhLKmdFPZN/MMoSOVxX8VQVnx3EngZ1C3fARbQGiOoFXElP68VKagtQHCFSaWyjOeDQc6OdBe+FKDs3g47xrQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/system-rsc@2.3.19':
- resolution: {integrity: sha512-ocjro5dYmDhRsxNAB/316zO6eqfKVjFDbnYnc+wlcjZXpw49A+LhE13xlo7LI+W2AHWh5NHcpo3+2O3G6WQxHA==}
- peerDependencies:
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/system@2.4.22':
- resolution: {integrity: sha512-+RVuAxjS2QWyLdYTPxv0IfMjhsxa1GKRSwvpii13bOGEQclwwfaNL2MvBbTt1Mzu/LHaX7kyj0THbZnlOplZOA==}
- peerDependencies:
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/table@2.2.26':
- resolution: {integrity: sha512-Y0NaXdoKH7MlgkQN892d23o2KCRKuPLZ4bsdPJFBDOJ9yZWEKKsmQ4+k5YEOjKF34oPSX75XJAjvzqldBuRqcQ==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/tabs@2.2.23':
- resolution: {integrity: sha512-OIvWR0vOlaGS2Z0F38O3xx4E5VsNJtz/FCUTPuNjU6eTbvKvRtwj9kHq+uDSHWziHH3OrpnTHi9xuEGHyUh4kg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/theme@2.4.22':
- resolution: {integrity: sha512-naKFQBfp7YwhKGmh7rKCC5EBjV7kdozX21fyGHucDYa6GeFfIKVqXILgZ94HZlfp+LGJfV6U+BuKIflevf0Y+w==}
- peerDependencies:
- tailwindcss: '>=4.0.0'
-
- '@heroui/toast@2.0.16':
- resolution: {integrity: sha512-sG6sU7oN+8pd6pQZJREC+1y9iji+Zb/KtiOQrnAksRfW0KAZSxhgNnt6VP8KvbZ+TKkmphVjDcAwiWgH5m8Uqg==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/tooltip@2.2.23':
- resolution: {integrity: sha512-tV9qXMJQEzWOhS4Fq/efbRK138e/72BftFz8HaszuMILDBZjgQrzW3W7Gmu+nHI+fcQMqmToUuMq8bCdjp/h9A==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- framer-motion: '>=11.5.6 || >=12.0.0-alpha.1'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-accordion@2.2.17':
- resolution: {integrity: sha512-h3jGabUdqDXXThjN5C9UK2DPQAm5g9zm20jBDiyK6emmavGV7pO8k+2Guga48qx4cGDSq4+aA++0i2mqam1AKw==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-button@2.2.19':
- resolution: {integrity: sha512-+3f8zpswFHWs50pNmsHTCXGsIGWyZw/1/hINVPjB9RakjqLwYx9Sz0QCshsAJgGklVbOUkHGtrMwfsKnTeQ82Q==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-link@2.2.20':
- resolution: {integrity: sha512-lbMhpi5mP7wn3m8TDU2YW2oQ2psqgJodSznXha1k2H8XVsZkPhOPAogUhhR0cleah4Y+KCqXJWupqzmdfTsgyw==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-modal-overlay@2.2.18':
- resolution: {integrity: sha512-26Vf7uxMYGcs5eZxwZr+w/HaVlTHXTlGKkR5tudmsDGbVULfQW5zX428fYatjYoVfH2zMZWK91USYP/jUWVyxg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-multiselect@2.4.18':
- resolution: {integrity: sha512-b//0jJElrrxrqMuU1+W5H/P4xKzRsl5/uTFGclpdg8+mBlVtbfak32YhD9EEfFRDR7hHs116ezVmxjkEwry/GQ==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-aria-overlay@2.0.3':
- resolution: {integrity: sha512-R5cZh+Rg/X7iQpxNhWJkzsbthMVbxqyYkXx5ry0F2zy05viwnXKCSFQqbdKCU2f5QlEnv2oDd6KsK1AXCePG4g==}
- peerDependencies:
- react: '>=18'
- react-dom: '>=18'
-
- '@heroui/use-callback-ref@2.1.8':
- resolution: {integrity: sha512-D1JDo9YyFAprYpLID97xxQvf86NvyWLay30BeVVZT9kWmar6O9MbCRc7ACi7Ngko60beonj6+amTWkTm7QuY/Q==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-clipboard@2.1.9':
- resolution: {integrity: sha512-lkBq5RpXHiPvk1BXKJG8gMM0f7jRMIGnxAXDjAUzZyXKBuWLoM+XlaUWmZHtmkkjVFMX1L4vzA+vxi9rZbenEQ==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-data-scroll-overflow@2.2.12':
- resolution: {integrity: sha512-An+P5Tg8BtLpw5Ozi/og7s8cThduVMkCOvxMcl3izyYSFa826SIhAI99FyaS7Xb2zkwM/2ZMbK3W7DKt6w8fkg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-disclosure@2.2.16':
- resolution: {integrity: sha512-rcDQoPygbIevGqcl7Lge8hK6FQFyeMwdu4VHH6BBzRCOE39uW/DXuZbdD1B40bw3UBhSKjdvyBp6NjLrm6Ma0g==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-draggable@2.1.17':
- resolution: {integrity: sha512-1vsMYdny24HRSDWVVBulfzRuGdhbRGIeEzLQpqQYXhUVKzdTWZG8S84NotKoqsLdjAHHtuDQAGmKM2IODASVIA==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-form-reset@2.0.1':
- resolution: {integrity: sha512-6slKWiLtVfgZnVeHVkM9eXgjwI07u0CUaLt2kQpfKPqTSTGfbHgCYJFduijtThhTdKBhdH6HCmzTcnbVlAxBXw==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-image@2.1.12':
- resolution: {integrity: sha512-/W6Cu5VN6LcZzYgkxJSvCEjM5gy0OE6NtRRImUDYCbUFNS1gK/apmOnIWcNbKryAg5Scpdoeu+g1lKKP15nSOw==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-intersection-observer@2.2.14':
- resolution: {integrity: sha512-qYJeMk4cTsF+xIckRctazCgWQ4BVOpJu+bhhkB1NrN+MItx19Lcb7ksOqMdN5AiSf85HzDcAEPIQ9w9RBlt5sg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-is-mobile@2.2.12':
- resolution: {integrity: sha512-2UKa4v1xbvFwerWKoMTrg4q9ZfP9MVIVfCl1a7JuKQlXq3jcyV6z1as5bZ41pCsTOT+wUVOFnlr6rzzQwT9ZOA==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-is-mounted@2.1.8':
- resolution: {integrity: sha512-DO/Th1vD4Uy8KGhd17oGlNA4wtdg91dzga+VMpmt94gSZe1WjsangFwoUBxF2uhlzwensCX9voye3kerP/lskg==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-measure@2.1.8':
- resolution: {integrity: sha512-GjT9tIgluqYMZWfAX6+FFdRQBqyHeuqUMGzAXMTH9kBXHU0U5C5XU2c8WFORkNDoZIg1h13h1QdV+Vy4LE1dEA==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-pagination@2.2.17':
- resolution: {integrity: sha512-fZ5t2GwLMqDiidAuH+/FsCBw/rtwNc9eIqF2Tz3Qwa4FlfMyzE+4pg99zdlrWM/GP0T/b8VvCNEbsmjKIgrliA==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-resize@2.1.8':
- resolution: {integrity: sha512-htF3DND5GmrSiMGnzRbISeKcH+BqhQ/NcsP9sBTIl7ewvFaWiDhEDiUHdJxflmJGd/c5qZq2nYQM/uluaqIkKA==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-safe-layout-effect@2.1.8':
- resolution: {integrity: sha512-wbnZxVWCYqk10XRMu0veSOiVsEnLcmGUmJiapqgaz0fF8XcpSScmqjTSoWjHIEWaHjQZ6xr+oscD761D6QJN+Q==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-scroll-position@2.1.8':
- resolution: {integrity: sha512-NxanHKObxVfWaPpNRyBR8v7RfokxrzcHyTyQfbgQgAGYGHTMaOGkJGqF8kBzInc3zJi+F0zbX7Nb0QjUgsLNUQ==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/use-viewport-size@2.0.1':
- resolution: {integrity: sha512-blv8BEB/QdLePLWODPRzRS2eELJ2eyHbdOIADbL0KcfLzOUEg9EiuVk90hcSUDAFqYiJ3YZ5Z0up8sdPcR8Y7g==}
- peerDependencies:
- react: '>=18 || >=19.0.0-rc.0'
-
- '@heroui/user@2.2.21':
- resolution: {integrity: sha512-q0bT4BRJaXFtG/KipsHdLN9h8GW56ZhwaR+ug9QFa85Sw65ePeOfThfwGf/yoGFyFt20BY+5P101Ok0iIV756A==}
- peerDependencies:
- '@heroui/system': '>=2.4.18'
- '@heroui/theme': '>=2.4.17'
- react: '>=18 || >=19.0.0-rc.0'
- react-dom: '>=18 || >=19.0.0-rc.0'
-
'@hono/node-server@1.19.14':
resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
engines: {node: '>=18.14.1'}
peerDependencies:
- hono: 4.12.21
+ hono: 4.12.28
'@hookform/resolvers@5.2.2':
resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==}
@@ -1960,22 +1394,6 @@ packages:
'@types/node':
optional: true
- '@internationalized/date@3.10.0':
- resolution: {integrity: sha512-oxDR/NTEJ1k+UFVQElaNIk65E/Z83HK1z1WI3lQyhTtnNg4R5oVXaPzK3jcpKG8UHKDVuDQHzn+wsxSz8RP3aw==}
-
- '@internationalized/message@3.1.8':
- resolution: {integrity: sha512-Rwk3j/TlYZhn3HQ6PyXUV0XP9Uv42jqZGNegt0BXlxjE6G3+LwHjbQZAGHhCnCPdaA6Tvd3ma/7QzLlLkJxAWA==}
-
- '@internationalized/number@3.6.5':
- resolution: {integrity: sha512-6hY4Kl4HPBvtfS62asS/R22JzNNy8vi/Ssev7x6EobfCp+9QIB2hKvI2EtbdJ0VSQacxVNtqhE/NmF/NZ0gm6g==}
-
- '@internationalized/string@3.2.7':
- resolution: {integrity: sha512-D4OHBjrinH+PFZPvfCXvG28n2LSykWcJ7GIioQL+ok0LON15SdfoUssoHzzOUmVZLbRoREsQXVzA6r8JKsbP6A==}
-
- '@isaacs/cliui@8.0.2':
- resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
- engines: {node: '>=12'}
-
'@jridgewell/gen-mapping@0.3.13':
resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
@@ -2055,9 +1473,6 @@ packages:
'@langchain/protocol@0.0.15':
resolution: {integrity: sha512-MllvbpMjqHevUm+v94M422mH7XKN+wGCvJRBVROTWBotEDOATYB4Ktk2UheYP859y9o2LlhtPek5t1T9eyfAbQ==}
- '@lezer/common@1.5.1':
- resolution: {integrity: sha512-6YRVG9vBkaY7p1IVxL4s44n5nUnaNnGM2/AckNgYOnxTG2kWh1vR8BMxPseWPjRNpb5VtXnMpeYAEAADoRV1Iw==}
-
'@lezer/common@1.5.2':
resolution: {integrity: sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==}
@@ -2070,6 +1485,9 @@ packages:
'@marijn/find-cluster-break@1.0.2':
resolution: {integrity: sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==}
+ '@marijn/find-cluster-break@1.0.3':
+ resolution: {integrity: sha512-FY+MKLBoTsLNJF/eLWaOsXGdz6uh3Iu1axjPf6TUq92IYumcTcXWHoS747JARLkcdlJ/Waiaxc5wQfFO8jC6NA==}
+
'@mermaid-js/parser@1.1.1':
resolution: {integrity: sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==}
@@ -2187,196 +1605,48 @@ packages:
'@open-draft/until@2.1.0':
resolution: {integrity: sha512-U69T3ItWHvLwGg5eJ0n3I62nWuE6ilHlmz7zM0npLBRvPRd7e6NYmg54vvRtP5mZG7kZqZCFVdsTWo7BPtBujg==}
- '@opentelemetry/api-logs@0.208.0':
- resolution: {integrity: sha512-CjruKY9V6NMssL/T1kAFgzosF1v9o6oeN+aX5JB/C/xPNtmgIJqcXHG7fA82Ou1zCpWGl4lROQUKwUNE1pMCyg==}
+ '@opentelemetry/api-logs@0.220.0':
+ resolution: {integrity: sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==}
engines: {node: '>=8.0.0'}
- '@opentelemetry/api@1.9.0':
- resolution: {integrity: sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==}
+ '@opentelemetry/api@1.9.1':
+ resolution: {integrity: sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==}
engines: {node: '>=8.0.0'}
- '@opentelemetry/context-async-hooks@2.4.0':
- resolution: {integrity: sha512-jn0phJ+hU7ZuvaoZE/8/Euw3gvHJrn2yi+kXrymwObEPVPjtwCmkvXDRQCWli+fCTTF/aSOtXaLr7CLIvv3LQg==}
+ '@opentelemetry/core@2.9.0':
+ resolution: {integrity: sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==}
engines: {node: ^18.19.0 || >=20.6.0}
peerDependencies:
'@opentelemetry/api': '>=1.0.0 <1.10.0'
- '@opentelemetry/core@2.2.0':
- resolution: {integrity: sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': '>=1.0.0 <1.10.0'
-
- '@opentelemetry/core@2.4.0':
- resolution: {integrity: sha512-KtcyFHssTn5ZgDu6SXmUznS80OFs/wN7y6MyFRRcKU6TOw8hNcGxKvt8hsdaLJfhzUszNSjURetq5Qpkad14Gw==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': '>=1.0.0 <1.10.0'
-
- '@opentelemetry/instrumentation-amqplib@0.55.0':
- resolution: {integrity: sha512-5ULoU8p+tWcQw5PDYZn8rySptGSLZHNX/7srqo2TioPnAAcvTy6sQFQXsNPrAnyRRtYGMetXVyZUy5OaX1+IfA==}
+ '@opentelemetry/instrumentation@0.220.0':
+ resolution: {integrity: sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==}
engines: {node: ^18.19.0 || >=20.6.0}
peerDependencies:
'@opentelemetry/api': ^1.3.0
- '@opentelemetry/instrumentation-connect@0.52.0':
- resolution: {integrity: sha512-GXPxfNB5szMbV3I9b7kNWSmQBoBzw7MT0ui6iU/p+NIzVx3a06Ri2cdQO7tG9EKb4aKSLmfX9Cw5cKxXqX6Ohg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-dataloader@0.26.0':
- resolution: {integrity: sha512-P2BgnFfTOarZ5OKPmYfbXfDFjQ4P9WkQ1Jji7yH5/WwB6Wm/knynAoA1rxbjWcDlYupFkyT0M1j6XLzDzy0aCA==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-express@0.57.0':
- resolution: {integrity: sha512-HAdx/o58+8tSR5iW+ru4PHnEejyKrAy9fYFhlEI81o10nYxrGahnMAHWiSjhDC7UQSY3I4gjcPgSKQz4rm/asg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-fs@0.28.0':
- resolution: {integrity: sha512-FFvg8fq53RRXVBRHZViP+EMxMR03tqzEGpuq55lHNbVPyFklSVfQBN50syPhK5UYYwaStx0eyCtHtbRreusc5g==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-generic-pool@0.52.0':
- resolution: {integrity: sha512-ISkNcv5CM2IwvsMVL31Tl61/p2Zm2I2NAsYq5SSBgOsOndT0TjnptjufYVScCnD5ZLD1tpl4T3GEYULLYOdIdQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-graphql@0.56.0':
- resolution: {integrity: sha512-IPvNk8AFoVzTAM0Z399t34VDmGDgwT6rIqCUug8P9oAGerl2/PEIYMPOl/rerPGu+q8gSWdmbFSjgg7PDVRd3Q==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-hapi@0.55.0':
- resolution: {integrity: sha512-prqAkRf9e4eEpy4G3UcR32prKE8NLNlA90TdEU1UsghOTg0jUvs40Jz8LQWFEs5NbLbXHYGzB4CYVkCI8eWEVQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-http@0.208.0':
- resolution: {integrity: sha512-rhmK46DRWEbQQB77RxmVXGyjs6783crXCnFjYQj+4tDH/Kpv9Rbg3h2kaNyp5Vz2emF1f9HOQQvZoHzwMWOFZQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-ioredis@0.56.0':
- resolution: {integrity: sha512-XSWeqsd3rKSsT3WBz/JKJDcZD4QYElZEa0xVdX8f9dh4h4QgXhKRLorVsVkK3uXFbC2sZKAS2Ds+YolGwD83Dg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-kafkajs@0.18.0':
- resolution: {integrity: sha512-KCL/1HnZN5zkUMgPyOxfGjLjbXjpd4odDToy+7c+UsthIzVLFf99LnfIBE8YSSrYE4+uS7OwJMhvhg3tWjqMBg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-knex@0.53.0':
- resolution: {integrity: sha512-xngn5cH2mVXFmiT1XfQ1aHqq1m4xb5wvU6j9lSgLlihJ1bXzsO543cpDwjrZm2nMrlpddBf55w8+bfS4qDh60g==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-koa@0.57.0':
- resolution: {integrity: sha512-3JS8PU/D5E3q295mwloU2v7c7/m+DyCqdu62BIzWt+3u9utjxC9QS7v6WmUNuoDN3RM+Q+D1Gpj13ERo+m7CGg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.9.0
-
- '@opentelemetry/instrumentation-lru-memoizer@0.53.0':
- resolution: {integrity: sha512-LDwWz5cPkWWr0HBIuZUjslyvijljTwmwiItpMTHujaULZCxcYE9eU44Qf/pbVC8TulT0IhZi+RoGvHKXvNhysw==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-mongodb@0.61.0':
- resolution: {integrity: sha512-OV3i2DSoY5M/pmLk+68xr5RvkHU8DRB3DKMzYJdwDdcxeLs62tLbkmRyqJZsYf3Ht7j11rq35pHOWLuLzXL7pQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-mongoose@0.55.0':
- resolution: {integrity: sha512-5afj0HfF6aM6Nlqgu6/PPHFk8QBfIe3+zF9FGpX76jWPS0/dujoEYn82/XcLSaW5LPUDW8sni+YeK0vTBNri+w==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-mysql2@0.55.0':
- resolution: {integrity: sha512-0cs8whQG55aIi20gnK8B7cco6OK6N+enNhW0p5284MvqJ5EPi+I1YlWsWXgzv/V2HFirEejkvKiI4Iw21OqDWg==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-mysql@0.54.0':
- resolution: {integrity: sha512-bqC1YhnwAeWmRzy1/Xf9cDqxNG2d/JDkaxnqF5N6iJKN1eVWI+vg7NfDkf52/Nggp3tl1jcC++ptC61BD6738A==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-pg@0.61.0':
- resolution: {integrity: sha512-UeV7KeTnRSM7ECHa3YscoklhUtTQPs6V6qYpG283AB7xpnPGCUCUfECFT9jFg6/iZOQTt3FHkB1wGTJCNZEvPw==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-redis@0.57.0':
- resolution: {integrity: sha512-bCxTHQFXzrU3eU1LZnOZQ3s5LURxQPDlU3/upBzlWY77qOI1GZuGofazj3jtzjctMJeBEJhNwIFEgRPBX1kp/Q==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-tedious@0.27.0':
- resolution: {integrity: sha512-jRtyUJNZppPBjPae4ZjIQ2eqJbcRaRfJkr0lQLHFmOU/no5A6e9s1OHLd5XZyZoBJ/ymngZitanyRRA5cniseA==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/instrumentation-undici@0.19.0':
- resolution: {integrity: sha512-Pst/RhR61A2OoZQZkn6OLpdVpXp6qn3Y92wXa6umfJe9rV640r4bc6SWvw4pPN6DiQqPu2c8gnSSZPDtC6JlpQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.7.0
-
- '@opentelemetry/instrumentation@0.208.0':
- resolution: {integrity: sha512-Eju0L4qWcQS+oXxi6pgh7zvE2byogAkcsVv0OjHF/97iOz1N/aKE6etSGowYkie+YA1uo6DNwdSxaaNnLvcRlA==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.3.0
-
- '@opentelemetry/redis-common@0.38.2':
- resolution: {integrity: sha512-1BCcU93iwSRZvDAgwUxC/DV4T/406SkMfxGqu5ojc3AvNI+I9GhV7v0J1HljsczuuhcnFLYqD5VmwVXfCGHzxA==}
- engines: {node: ^18.19.0 || >=20.6.0}
-
- '@opentelemetry/resources@2.4.0':
- resolution: {integrity: sha512-RWvGLj2lMDZd7M/5tjkI/2VHMpXebLgPKvBUd9LRasEWR2xAynDwEYZuLvY9P2NGG73HF07jbbgWX2C9oavcQg==}
+ '@opentelemetry/resources@2.9.0':
+ resolution: {integrity: sha512-jyA5MBLQ+Dkl3+JsZkUoUvL7yHvU64kLsvpXKarWm6347Sl1t1bXFTFykUePNpT5WH5pm9a2Qtt03iIYQhZ1Fg==}
engines: {node: ^18.19.0 || >=20.6.0}
peerDependencies:
'@opentelemetry/api': '>=1.3.0 <1.10.0'
- '@opentelemetry/sdk-trace-base@2.4.0':
- resolution: {integrity: sha512-WH0xXkz/OHORDLKqaxcUZS0X+t1s7gGlumr2ebiEgNZQl2b0upK2cdoD0tatf7l8iP74woGJ/Kmxe82jdvcWRw==}
+ '@opentelemetry/sdk-trace-base@2.9.0':
+ resolution: {integrity: sha512-cp9zmTl62R8PJrpvFcmc8N2JQU/xfa0S+61q511Nji+QxCfZ8Ifvg7H27G8cANe4crg4RTrWsVvanHiXjSp6ag==}
engines: {node: ^18.19.0 || >=20.6.0}
peerDependencies:
'@opentelemetry/api': '>=1.3.0 <1.10.0'
- '@opentelemetry/semantic-conventions@1.39.0':
- resolution: {integrity: sha512-R5R9tb2AXs2IRLNKLBJDynhkfmx7mX0vi8NkhZb3gUkPWHn6HXk5J8iQ/dql0U3ApfWym4kXXmBDRGO+oeOfjg==}
+ '@opentelemetry/sdk-trace@2.9.0':
+ resolution: {integrity: sha512-sGA19HvtrrSKYsseHphluH6j3p6Xa3fqc7c7y8f/7mYWejc1lyDFcpSdD1kYa50HCLUeEo4zA5bW0pniaPszuw==}
+ engines: {node: ^18.19.0 || >=20.6.0}
+ peerDependencies:
+ '@opentelemetry/api': '>=1.3.0 <1.10.0'
+
+ '@opentelemetry/semantic-conventions@1.43.0':
+ resolution: {integrity: sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==}
engines: {node: '>=14'}
- '@opentelemetry/sql-common@0.41.2':
- resolution: {integrity: sha512-4mhWm3Z8z+i508zQJ7r6Xi7y4mmoJpdvH0fZPFRkWrdp5fq7hhZ2HhYokEOLkfqSMgPR4Z9EyB3DBkbKGOqZiQ==}
- engines: {node: ^18.19.0 || >=20.6.0}
- peerDependencies:
- '@opentelemetry/api': ^1.1.0
-
'@oxc-parser/binding-android-arm-eabi@0.121.0':
resolution: {integrity: sha512-n07FQcySwOlzap424/PLMtOkbS7xOu8nsJduKL8P3COGHKgKoDYXwoAHCbChfgFpHnviehrLWIPX0lKGtbEk/A==}
engines: {node: ^20.19.0 || >=22.12.0}
@@ -2618,10 +1888,6 @@ packages:
'@panva/hkdf@1.2.1':
resolution: {integrity: sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw==}
- '@pkgjs/parseargs@0.11.0':
- resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
- engines: {node: '>=14'}
-
'@pkgr/core@0.2.9':
resolution: {integrity: sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==}
engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -2634,11 +1900,6 @@ packages:
'@polka/url@1.0.0-next.29':
resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
- '@prisma/instrumentation@6.19.0':
- resolution: {integrity: sha512-QcuYy25pkXM8BJ37wVFBO7Zh34nyRV1GOb2n3lPkkbRYfl4hWl3PTcImP41P0KrzVXfa/45p6eVCos27x3exIg==}
- peerDependencies:
- '@opentelemetry/api': ^1.8
-
'@radix-ui/number@1.1.1':
resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
@@ -2648,6 +1909,9 @@ packages:
'@radix-ui/primitive@1.1.3':
resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
+ '@radix-ui/primitive@1.1.4':
+ resolution: {integrity: sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ==}
+
'@radix-ui/react-alert-dialog@1.1.14':
resolution: {integrity: sha512-IOZfZ3nPvN6lXpJTBCunFQPRSvK8MDgSc1FB85xnIpUKOw9en0dJj8JmCAxV7BiZdtYlUpmrQjoTFkVYtdoWzQ==}
peerDependencies:
@@ -2735,6 +1999,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-compose-refs@1.1.3':
+ resolution: {integrity: sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-context@1.1.2':
resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
peerDependencies:
@@ -2753,6 +2026,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-context@1.1.4':
+ resolution: {integrity: sha512-QwH4PO5urrbO+FaGd5Aglg+YJgWTyyuZ3g/6mKvsqraLkglDdckw9JafgL5McL5VEJ6EPNduPaT3ZE9BttDAqg==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-dialog@1.1.14':
resolution: {integrity: sha512-+CpweKjqpzTmwRwcYECQcNYbI8V9VSQt0SNFKeEBLgfucbsLssU6Ppq7wUdNXEGb573bMjFhVjKVll8rmV6zMw==}
peerDependencies:
@@ -2989,6 +2271,19 @@ packages:
'@types/react-dom':
optional: true
+ '@radix-ui/react-primitive@2.1.5':
+ resolution: {integrity: sha512-zifXeB8Y88qCYx8PLZ5oQb32KwZub+s925mMoZsBBq9KUQqWKkREubTfs6ASjRPPBe7Jt9O8OHH89+95VG+grA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
'@radix-ui/react-progress@1.1.7':
resolution: {integrity: sha512-vPdg/tF6YC/ynuBIJlk1mm7Le0VgW6ub6J2UWnTQ7/D23KXcPI1qy+0vBkgKgd38RCMJavBXpB83HPNFMTb0Fg==}
peerDependencies:
@@ -3098,6 +2393,28 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-slot@1.2.5':
+ resolution: {integrity: sha512-rCMO3QsIVKv5JTY5CVbo2MvO77SpEqqYc8AvRE7OWqRDOIqAKjsp+DrmnY9uc8NPdxB5E2z47HTYGeE2+NTptg==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
+ '@radix-ui/react-switch@1.3.0':
+ resolution: {integrity: sha512-GP1EZwhoZO/GGnhM1P5/2Vpm8iN8EnngyU0oezn2l78kN8tj25pyrvjIaT7azBhK615KSt+P2w39y57YV5jVkA==}
+ peerDependencies:
+ '@types/react': '*'
+ '@types/react-dom': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+ '@types/react-dom':
+ optional: true
+
'@radix-ui/react-tabs@1.1.13':
resolution: {integrity: sha512-7xdcatg7/U+7+Udyoj2zodtI9H/IIopqo+YOIcZOq1nJwXWBZ9p8xiu5llXlekDbZkca79a/fozEYQXIA4sW6A==}
peerDependencies:
@@ -3155,6 +2472,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-use-controllable-state@1.2.3':
+ resolution: {integrity: sha512-PLzC90MS+ReootmjC597dvopoelpZ8Q61HJkDXZSExitIq7PL55vHNnesAHwguHK0aPfBnpdNzQtv1uliaqQrA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-use-effect-event@0.0.2':
resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
peerDependencies:
@@ -3164,6 +2490,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-use-effect-event@0.0.3':
+ resolution: {integrity: sha512-6c8ZqvPTWILEKnyVkP53EGRCcpnJiKTC21sS/6R1GF5xKyHJJWQEPfkqlcgUkdRQivd6tb23abUwe4ngWmY0JA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-use-escape-keydown@1.1.1':
resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
peerDependencies:
@@ -3191,6 +2526,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-use-layout-effect@1.1.2':
+ resolution: {integrity: sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-use-previous@1.1.1':
resolution: {integrity: sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ==}
peerDependencies:
@@ -3200,6 +2544,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-use-previous@1.1.2':
+ resolution: {integrity: sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-use-rect@1.1.1':
resolution: {integrity: sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==}
peerDependencies:
@@ -3218,6 +2571,15 @@ packages:
'@types/react':
optional: true
+ '@radix-ui/react-use-size@1.1.2':
+ resolution: {integrity: sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w==}
+ peerDependencies:
+ '@types/react': '*'
+ react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+ peerDependenciesMeta:
+ '@types/react':
+ optional: true
+
'@radix-ui/react-visually-hidden@1.2.3':
resolution: {integrity: sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug==}
peerDependencies:
@@ -3234,213 +2596,12 @@ packages:
'@radix-ui/rect@1.1.1':
resolution: {integrity: sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==}
- '@react-aria/breadcrumbs@3.5.28':
- resolution: {integrity: sha512-6S3QelpajodEzN7bm49XXW5gGoZksK++cl191W0sexq/E5hZHAEA9+CFC8pL3px13ji7qHGqKAxOP4IUVBdVpQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/button@3.14.1':
- resolution: {integrity: sha512-Ug06unKEYVG3OF6zKmpVR7VfLzpj7eJVuFo3TCUxwFJG7DI28pZi2TaGWnhm7qjkxfl1oz0avQiHVfDC99gSuw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/calendar@3.9.1':
- resolution: {integrity: sha512-dCJliRIi3x3VmAZkJDNTZddq0+QoUX9NS7GgdqPPYcJIMbVPbyLWL61//0SrcCr3MuSRCoI1eQZ8PkQe/2PJZQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/checkbox@3.16.1':
- resolution: {integrity: sha512-YcG3QhuGIwqPHo4GVGVmwxPM5Ayq9CqYfZjla/KTfJILPquAJ12J7LSMpqS/Z5TlMNgIIqZ3ZdrYmjQlUY7eUg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/combobox@3.13.1':
- resolution: {integrity: sha512-3lt3TGfjadJsN+illC23hgfeQ/VqF04mxczoU+3znOZ+vTx9zov/YfUysAsaxc8hyjr65iydz+CEbyg4+i0y3A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/datepicker@3.15.1':
- resolution: {integrity: sha512-RfUOvsupON6E5ZELpBgb9qxsilkbqwzsZ78iqCDTVio+5kc5G9jVeHEIQOyHnavi/TmJoAnbmmVpEbE6M9lYJQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/dialog@3.5.29':
- resolution: {integrity: sha512-GtxB0oTwkSz/GiKMPN0lU4h/r+Cr04FFUonZU5s03YmDTtgVjTSjFPmsd7pkbt3qq0aEiQASx/vWdAkKLWjRHA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/focus@3.21.1':
- resolution: {integrity: sha512-hmH1IhHlcQ2lSIxmki1biWzMbGgnhdxJUM0MFfzc71Rv6YAzhlx4kX3GYn4VNcjCeb6cdPv4RZ5vunV4kgMZYQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/focus@3.21.3':
- resolution: {integrity: sha512-FsquWvjSCwC2/sBk4b+OqJyONETUIXQ2vM0YdPAuC+QFQh2DT6TIBo6dOZVSezlhudDla69xFBd6JvCFq1AbUw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/form@3.1.1':
- resolution: {integrity: sha512-PjZC25UgH5orit9p56Ymbbo288F3eaDd3JUvD8SG+xgx302HhlFAOYsQLLAb4k4H03bp0gWtlUEkfX6KYcE1Tw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/form@3.1.3':
- resolution: {integrity: sha512-HAKnPjMiqTxoGLVbfZyGYcZQ1uu6aSeCi9ODmtZuKM5DWZZnTUjDmM1i2L6IXvF+d1kjyApyJC7VTbKZ8AI77g==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/grid@3.14.6':
- resolution: {integrity: sha512-xagBKHNPu4Ovt/I5He7T/oIEq82MDMSrRi5Sw3oxSCwwtZpv+7eyKRSrFz9vrNUzNgWCcx5VHLE660bLdeVNDQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/i18n@3.12.12':
- resolution: {integrity: sha512-JN6p+Xc6Pu/qddGRoeYY6ARsrk2Oz7UiQc9nLEPOt3Ch+blJZKWwDjcpo/p6/wVZdD/2BgXS7El6q6+eMg7ibw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/i18n@3.12.13':
- resolution: {integrity: sha512-YTM2BPg0v1RvmP8keHenJBmlx8FXUKsdYIEX7x6QWRd1hKlcDwphfjzvt0InX9wiLiPHsT5EoBTpuUk8SXc0Mg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/i18n@3.12.14':
- resolution: {integrity: sha512-zYvs1FlLamFD49uneX3i5mPHrAsB3OjVpSWApTcPw8ydxOaphQDp/Q1aqrbcxlrQCcxZdXWHuvLlbkNR4+8jzw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/interactions@3.25.5':
- resolution: {integrity: sha512-EweYHOEvMwef/wsiEqV73KurX/OqnmbzKQa2fLxdULbec5+yDj6wVGaRHIzM4NiijIDe+bldEl5DG05CAKOAHA==}
- peerDependencies:
- react: 19.2.7
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-aria/interactions@3.26.0':
resolution: {integrity: sha512-AAEcHiltjfbmP1i9iaVw34Mb7kbkiHpYdqieWufldh4aplWgsF11YQZOfaCJW4QoR2ML4Zzoa9nfFwLXA52R7Q==}
peerDependencies:
react: 19.2.7
react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- '@react-aria/label@3.7.21':
- resolution: {integrity: sha512-8G+059/GZahgQbrhMcCcVcrjm7W+pfzrypH/Qkjo7C1yqPGt6geeFwWeOIbiUZoI0HD9t9QvQPryd6m46UC7Tg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/label@3.7.23':
- resolution: {integrity: sha512-dRkuCJfsyBHPTq3WOJVHNRvNyQL4cRRLELmjYfUX9/jQKIsUW2l71YnUHZTRCSn2ZjhdAcdwq96fNcQo0hncBQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/landmark@3.0.8':
- resolution: {integrity: sha512-xuY8kYxCrF9C0h0Pj2lZHoxCidNfQ/SrkYWXuiN+LuBTJGCmPVif93gt7TklQ0rKJ+pKJsUgh8AC0pgwI3QP7A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/link@3.8.7':
- resolution: {integrity: sha512-TOC6Hf/x3N0P8SLR1KD/dGiJ9PmwAq8H57RiwbFbdINnG/HIvIQr5MxGTjwBvOOWcJu9brgWL5HkQaZK7Q/4Yw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/listbox@3.14.8':
- resolution: {integrity: sha512-uRgbuD9afFv0PDhQ/VXCmAwlYctIyKRzxztkqp1p/1yz/tn/hs+bG9kew9AI02PtlRO1mSc+32O+mMDXDer8hA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/listbox@3.15.1':
- resolution: {integrity: sha512-81iDLFhmPXvLOtkI0SKzgrngfzwfR2o9oFDAYRfpYCOxgT7jjh8SaB4wCteJXRiMwymRGmgyTvD4yxWTluEeXA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/live-announcer@3.4.4':
- resolution: {integrity: sha512-PTTBIjNRnrdJOIRTDGNifY2d//kA7GUAwRFJNOEwSNG4FW+Bq9awqLiflw0JkpyB0VNIwou6lqKPHZVLsGWOXA==}
-
- '@react-aria/menu@3.19.1':
- resolution: {integrity: sha512-hRYFdOOj3fYyoh/tJGxY1CWY80geNb3BT3DMNHgGBVMvnZ0E6k3WoQH+QZkVnwSnNIQAIPQFcYWPyZeE+ElEhA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/menu@3.19.4':
- resolution: {integrity: sha512-0A0DUEkEvZynmaD3zktHavM+EmgZSR/ht+g1ExS2jXe73CegA+dbSRfPl9eIKcHxaRrWOV96qMj2pTf0yWTBDg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/numberfield@3.12.1':
- resolution: {integrity: sha512-3KjxGgWiF4GRvIyqrE3nCndkkEJ68v86y0nx89TpAjdzg7gCgdXgU2Lr4BhC/xImrmlqCusw0IBUMhsEq9EQWA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/overlays@3.29.0':
- resolution: {integrity: sha512-OmMcwrbBMcv4KWNAPxvMZw02Wcw+z3e5dOS+MOb4AfY4bOJUvw+9hB13cfECs5lNXjV/UHT+5w2WBs32jmTwTg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/overlays@3.31.0':
- resolution: {integrity: sha512-Vq41X1s8XheGIhGbbuqRJslJEX08qmMVX//dwuBaFX9T18mMR04tumKOMxp8Lz+vqwdGLvjNUYDMcgolL+AMjw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/progress@3.4.26':
- resolution: {integrity: sha512-EJBzbE0IjXrJ19ofSyNKDnqC70flUM0Z+9heMRPLi6Uz01o6Uuz9tjyzmoPnd9Q1jnTT7dCl7ydhdYTGsWFcUg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/radio@3.12.1':
- resolution: {integrity: sha512-feZdMJyNp+UX03seIX0W6gdUk8xayTY+U0Ct61eci6YXzyyZoL2PVh49ojkbyZ2UZA/eXeygpdF5sgQrKILHCA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/selection@3.25.1':
- resolution: {integrity: sha512-HG+k3rDjuhnXPdVyv9CKiebee2XNkFYeYZBxEGlK3/pFVBzndnc8BXNVrXSgtCHLs2d090JBVKl1k912BPbj0Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/selection@3.27.0':
- resolution: {integrity: sha512-4zgreuCu4QM4t2U7aF3mbMvIKCEkTEo6h6nGJvbyZALZ/eFtLTvUiV8/5CGDJRLGvgMvi3XxUeF9PZbpk5nMJg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/slider@3.8.1':
- resolution: {integrity: sha512-uPgwZQrcuqHaLU2prJtPEPIyN9ugZ7qGgi0SB2U8tvoODNVwuPvOaSsvR98Mn6jiAzMFNoWMydeIi+J1OjvWsQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/spinbutton@3.7.0':
- resolution: {integrity: sha512-FOyH94BZp+jNhUJuZqXSubQZDNQEJyW/J19/gwCxQvQvxAP79dhDFshh1UtrL4EjbjIflmaOes+sH/XEHUnJVA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-aria/ssr@3.9.10':
resolution: {integrity: sha512-hvTm77Pf+pMBhuBm760Li0BVIO38jv1IBws1xFm1NoL26PU+fe+FMW5+VZWyANR6nYL65joaJKZqOdTQMkO9IQ==}
engines: {node: '>= 12'}
@@ -3453,66 +2614,6 @@ packages:
peerDependencies:
react: 19.2.7
- '@react-aria/switch@3.7.7':
- resolution: {integrity: sha512-auV3g1qh+d/AZk7Idw2BOcYeXfCD9iDaiGmlcLJb9Eaz4nkq8vOkQxIXQFrn9Xhb+PfQzmQYKkt5N6P2ZNsw/g==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/table@3.17.7':
- resolution: {integrity: sha512-FxXryGTxePgh8plIxlOMwXdleGWjK52vsmbRoqz66lTIHMUMLTmmm+Y0V3lBOIoaW1rxvKcolYgS79ROnbDYBw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/tabs@3.10.7':
- resolution: {integrity: sha512-iA1M6H+N+9GggsEy/6MmxpMpeOocwYgFy2EoEl3it24RVccY6iZT4AweJq96s5IYga5PILpn7VVcpssvhkPgeA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/textfield@3.18.1':
- resolution: {integrity: sha512-8yCoirnQzbbQgdk5J5bqimEu3GhHZ9FXeMHez1OF+H+lpTwyTYQ9XgioEN3HKnVUBNEufG4lYkQMxTKJdq1v9g==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/textfield@3.18.3':
- resolution: {integrity: sha512-ehiSHOKuKCwPdxFe7wGE0QJlSeeJR4iJuH+OdsYVlZzYbl9J/uAdGbpsj/zPhNtBo1g/Td76U8TtTlYRZ8lUZw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/toast@3.0.7':
- resolution: {integrity: sha512-nuxPQ7wcSTg9UNMhXl9Uwyc5you/D1RfwymI3VDa5OGTZdJOmV2j94nyjBfMO2168EYMZjw+wEovvOZphs2Pbw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/toggle@3.12.3':
- resolution: {integrity: sha512-mciUbeVP99fRObnH5qLFrkKXX+5VKeV6BhFJlmz1eo3ltR/0xZKnUcycA2CGzmqtB70w09CAhr8NMEnpNH8dwQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/toolbar@3.0.0-beta.20':
- resolution: {integrity: sha512-Kxvqw+TpVOE/eSi8RAQ9xjBQ2uXe8KkRvlRNQWQsrzkZDkXhzqGfQuJnBmozFxqpzSLwaVqQajHFUSvPAScT8Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/tooltip@3.8.7':
- resolution: {integrity: sha512-Aj7DPJYGZ9/+2ZfhkvbN7YMeA5qu4oy4LVQiMCpqNwcFzvhTAVhN7J7cS6KjA64fhd1shKm3BZ693Ez6lSpqwg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/utils@3.30.1':
- resolution: {integrity: sha512-zETcbDd6Vf9GbLndO6RiWJadIZsBU2MMm23rBACXLmpRztkrIqPEb2RVdlLaq1+GklDx0Ii6PfveVjx+8S5U6A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-aria/utils@3.32.0':
resolution: {integrity: sha512-/7Rud06+HVBIlTwmwmJa2W8xVtgxgzm0+kLbuFooZRzKDON6hhozS1dOMR/YLMxyJOaYOTpImcP4vRR9gL1hEg==}
peerDependencies:
@@ -3524,161 +2625,9 @@ packages:
peerDependencies:
react: 19.2.7
- '@react-aria/visually-hidden@3.8.27':
- resolution: {integrity: sha512-hD1DbL3WnjPnCdlQjwe19bQVRAGJyN0Aaup+s7NNtvZUn7AjoEH78jo8TE+L8yM7z/OZUQF26laCfYqeIwWn4g==}
- peerDependencies:
- react: 19.2.7
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-aria/visually-hidden@3.8.29':
- resolution: {integrity: sha512-1joCP+MHBLd+YA6Gb08nMFfDBhOF0Kh1gR1SA8zoxEB5RMfQEEkufIB8k0GGwvHGSCK3gFyO8UAVsD0+rRYEyg==}
- peerDependencies:
- react: 19.2.7
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/calendar@3.8.4':
- resolution: {integrity: sha512-q9mq0ydOLS5vJoHLnYfSCS/vppfjbg0XHJlAoPR+w+WpYZF4wPP453SrlX9T1DbxCEYFTpcxcMk/O8SDW3miAw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/checkbox@3.7.1':
- resolution: {integrity: sha512-ezfKRJsDuRCLtNoNOi9JXCp6PjffZWLZ/vENW/gbRDL8i46RKC/HpfJrJhvTPmsLYazxPC99Me9iq3v0VoNCsw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/collections@3.12.7':
- resolution: {integrity: sha512-0kQc0mI986GOCQHvRy4L0JQiotIK/KmEhR9Mu/6V0GoSdqg5QeUe4kyoNWj3bl03uQXme80v0L2jLHt+fOHHjA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/collections@3.12.8':
- resolution: {integrity: sha512-AceJYLLXt1Y2XIcOPi6LEJSs4G/ubeYW3LqOCQbhfIgMaNqKfQMIfagDnPeJX9FVmPFSlgoCBxb1pTJW2vjCAQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/combobox@3.11.1':
- resolution: {integrity: sha512-ZZh+SaAmddoY+MeJr470oDYA0nGaJm4xoHCBapaBA0JNakGC/wTzF/IRz3tKQT2VYK4rumr1BJLZQydGp7zzeg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/datepicker@3.15.1':
- resolution: {integrity: sha512-t64iYPms9y+MEQgOAu0XUHccbEXWVUWBHJWnYvAmILCHY8ZAOeSPAT1g4v9nzyiApcflSNXgpsvbs9BBEsrWww==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-stately/flags@3.1.2':
resolution: {integrity: sha512-2HjFcZx1MyQXoPqcBGALwWWmgFVUk2TuKVIQxCbRq7fPyWXIl6VHcakCLurdtYC2Iks7zizvz0Idv48MQ38DWg==}
- '@react-stately/form@3.2.1':
- resolution: {integrity: sha512-btgOPXkwvd6fdWKoepy5Ue43o2932OSkQxozsR7US1ffFLcQc3SNlADHaRChIXSG8ffPo9t0/Sl4eRzaKu3RgQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/form@3.2.2':
- resolution: {integrity: sha512-soAheOd7oaTO6eNs6LXnfn0tTqvOoe3zN9FvtIhhrErKz9XPc5sUmh3QWwR45+zKbitOi1HOjfA/gifKhZcfWw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/grid@3.11.7':
- resolution: {integrity: sha512-SqzBSxUTFZKLZicfXDK+M0A3gh07AYK1pmU/otcq2cjZ0nSC4CceKijQ2GBZnl+YGcGHI1RgkhpLP6ZioMYctQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/list@3.13.0':
- resolution: {integrity: sha512-Panv8TmaY8lAl3R7CRhyUadhf2yid6VKsRDBCBB1FHQOOeL7lqIraz/oskvpabZincuaIUWqQhqYslC4a6dvuA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/list@3.13.2':
- resolution: {integrity: sha512-dGFALuQWNNOkv7W12qSsXLF4mJHLeWeK2hVvdyj4SI8Vxku+BOfaVKuW3sn3mNiixI1dM/7FY2ip4kK+kv27vw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/menu@3.9.7':
- resolution: {integrity: sha512-mfz1YoCgtje61AGxVdQaAFLlOXt9vV5dd1lQljYUPRafA/qu5Ursz4fNVlcavWW9GscebzFQErx+y0oSP7EUtQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/menu@3.9.9':
- resolution: {integrity: sha512-moW5JANxMxPilfR0SygpCWCZe7Ef09oadgzTZthRymNRv0PXVS9ad4wd1EkwuMvPH/n0uZLZE2s8hNyFDgyqPA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/numberfield@3.10.1':
- resolution: {integrity: sha512-lXABmcTneVvXYMGTgZvTCr4E+upOi7VRLL50ZzTMJqHwB/qlEQPAam3dmddQRwIsuCM3MEnL7bSZFFlSYAtkEw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/overlays@3.6.19':
- resolution: {integrity: sha512-swZXfDvxTYd7tKEpijEHBFFaEmbbnCvEhGlmrAz4K72cuRR9O5u+lcla8y1veGBbBSzrIdKNdBoIIJ+qQH+1TQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/overlays@3.6.21':
- resolution: {integrity: sha512-7f25H1PS2g+SNvuWPEW30pSGqYNHxesCP4w+1RcV/XV1oQI7oP5Ji2WfI0QsJEFc9wP/ZO1pyjHNKpfLI3O88g==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/radio@3.11.1':
- resolution: {integrity: sha512-ld9KWztI64gssg7zSZi9li21sG85Exb+wFPXtCim1TtpnEpmRtB05pXDDS3xkkIU/qOL4eMEnnLO7xlNm0CRIA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/select@3.9.0':
- resolution: {integrity: sha512-eNE33zVYpVdCPKRPGYyViN3LnEq82e1wjBIrs9T7Vo4EBnJeT57pqMZpalTPk7qsA+861t14Qrj7GnUd+YbEXw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/selection@3.20.7':
- resolution: {integrity: sha512-NkiRsNCfORBIHNF1bCavh4Vvj+Yd5NffE10iXtaFuhF249NlxLynJZmkcVCqNP9taC2pBIHX00+9tcBgxhG+mA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/slider@3.7.1':
- resolution: {integrity: sha512-J+G18m1bZBCNQSXhxGd4GNGDUVonv4Sg7fZL+uLhXUy1x71xeJfFdKaviVvZcggtl0/q5InW41PXho7EouMDEg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/table@3.15.0':
- resolution: {integrity: sha512-KbvkrVF3sb25IPwyte9JcG5/4J7TgjHSsw7D61d/T/oUFMYPYVeolW9/2y+6u48WPkDJE8HJsurme+HbTN0FQA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/tabs@3.8.5':
- resolution: {integrity: sha512-gdeI+NUH3hfqrxkJQSZkt+Zw4G2DrYJRloq/SGxu/9Bu5QD/U0psU2uqxQNtavW5qTChFK+D30rCPXpKlslWAA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/toast@3.1.2':
- resolution: {integrity: sha512-HiInm7bck32khFBHZThTQaAF6e6/qm57F4mYRWdTq8IVeGDzpkbUYibnLxRhk0UZ5ybc6me+nqqPkG/lVmM42Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/toggle@3.9.1':
- resolution: {integrity: sha512-L6yUdE8xZfQhw4aEFZduF8u4v0VrpYrwWEA4Tu/4qwGIPukH0wd2W21Zpw+vAiLOaDKnxel1nXX68MWnm4QXpw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/toggle@3.9.3':
- resolution: {integrity: sha512-G6aA/aTnid/6dQ9dxNEd7/JqzRmVkVYYpOAP+l02hepiuSmFwLu4nE98i4YFBQqFZ5b4l01gMrS90JGL7HrNmw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/tooltip@3.5.7':
- resolution: {integrity: sha512-GYh764BcYZz+Lclyutyir5I3elNo+vVNYzeNOKmPGZCE3p5B+/8lgZAHKxnRc9qmBlxvofnhMcuQxAPlBhoEkw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/tree@3.9.2':
- resolution: {integrity: sha512-jsT1WZZhb7GRmg1iqoib9bULsilIK5KhbE8WrcfIml8NYr4usP4DJMcIYfRuiRtPLhKtUvHSoZ5CMbinPp8PUQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-stately/tree@3.9.4':
- resolution: {integrity: sha512-Re1fdEiR0hHPcEda+7ecw+52lgGfFW0MAEDzFg9I6J/t8STQSP+1YC0VVVkv2xRrkLbKLPqggNKgmD8nggecnw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-stately/utils@3.10.8':
resolution: {integrity: sha512-SN3/h7SzRsusVQjQ4v10LaVsDc81jyyR0DD5HnsQitm/I5WDpaSr2nRHtyloPFU48jlql1XX/S04T2DLQM7Y3g==}
peerDependencies:
@@ -3689,182 +2638,11 @@ packages:
peerDependencies:
react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- '@react-stately/virtualizer@4.4.3':
- resolution: {integrity: sha512-kk6ZyMtOT51kZYGUjUhbgEdRBp/OR3WD+Vj9kFoCa1vbY+fGzbpcnjsvR2LDZuEq8W45ruOvdr1c7HRJG4gWxA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/accordion@3.0.0-alpha.26':
- resolution: {integrity: sha512-OXf/kXcD2vFlEnkcZy/GG+a/1xO9BN7Uh3/5/Ceuj9z2E/WwD55YwU3GFM5zzkZ4+DMkdowHnZX37XnmbyD3Mg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/breadcrumbs@3.7.16':
- resolution: {integrity: sha512-4J+7b9y6z8QGZqvsBSWQfebx6aIbc+1unQqnZCAlJl9EGzlI6SGdXRsURGkOUGJCV2GqY8bSocc8AZbRXpQ0XQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/button@3.14.0':
- resolution: {integrity: sha512-pXt1a+ElxiZyWpX0uznyjy5Z6EHhYxPcaXpccZXyn6coUo9jmCbgg14xR7Odo+JcbfaaISzZTDO7oGLVTcHnpA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/button@3.14.1':
- resolution: {integrity: sha512-D8C4IEwKB7zEtiWYVJ3WE/5HDcWlze9mLWQ5hfsBfpePyWCgO3bT/+wjb/7pJvcAocrkXo90QrMm85LcpBtrpg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/calendar@3.7.4':
- resolution: {integrity: sha512-MZDyXtvdHl8CKQGYBkjYwc4ABBq6Mb4Fu7k/4boQAmMQ5Rtz29ouBCJrAs0BpR14B8ZMGzoNIolxS5RLKBmFSA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/calendar@3.8.1':
- resolution: {integrity: sha512-B0UuitMP7YkArBAQldwSZSNL2WwazNGCG+lp6yEDj831NrH9e36/jcjv1rObQ9ZMS6uDX9LXu5C8V5RFwGQabA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/checkbox@3.10.1':
- resolution: {integrity: sha512-8ZqBoGBxtn6U/znpmyutGtBBaafUzcZnbuvYjwyRSONTrqQ0IhUq6jI/jbnE9r9SslIkbMB8IS1xRh2e63qmEQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/checkbox@3.10.2':
- resolution: {integrity: sha512-ktPkl6ZfIdGS1tIaGSU/2S5Agf2NvXI9qAgtdMDNva0oLyAZ4RLQb6WecPvofw1J7YKXu0VA5Mu7nlX+FM2weQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/combobox@3.13.8':
- resolution: {integrity: sha512-HGC3X9hmDRsjSZcFiflvJ7vbIgQ2gX/ZDxo1HVtvQqUDbgQCVakCcCdrB44aYgHFnyDiO6hyp7Y7jXtDBaEIIA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/datepicker@3.13.1':
- resolution: {integrity: sha512-ub+g5pS3WOo5P/3FRNsQSwvlb9CuLl2m6v6KBkRXc5xqKhFd7UjvVpL6Oi/1zwwfow4itvD1t7l1XxgCo7wZ6Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/datepicker@3.13.2':
- resolution: {integrity: sha512-+M6UZxJnejYY8kz0spbY/hP08QJ5rsZ3aNarRQQHc48xV2oelFLX5MhAqizfLEsvyfb0JYrhWoh4z1xZtAmYCg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/dialog@3.5.22':
- resolution: {integrity: sha512-smSvzOcqKE196rWk0oqJDnz+ox5JM5+OT0PmmJXiUD4q7P5g32O6W5Bg7hMIFUI9clBtngo8kLaX2iMg+GqAzg==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/form@3.7.15':
- resolution: {integrity: sha512-a7C1RXgMpHX9b1x/+h5YCOJL/2/Ojw9ErOJhLwUWzKUu5JWpQYf8JsXNsuMSndo4YBaiH/7bXFmg09cllHUmow==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/grid@3.3.5':
- resolution: {integrity: sha512-hG6J2KDfmOHitkWoCa/9DvY1nTO2wgMIApcFoqLv7AWJr9CzvVqo5tIhZZCXiT1AvU2kafJxu9e7sr5GxAT2YA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/grid@3.3.6':
- resolution: {integrity: sha512-vIZJlYTii2n1We9nAugXwM2wpcpsC6JigJFBd6vGhStRdRWRoU4yv1Gc98Usbx0FQ/J7GLVIgeG8+1VMTKBdxw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/link@3.6.4':
- resolution: {integrity: sha512-eLpIgOPf7GW4DpdMq8UqiRJkriend1kWglz5O9qU+/FM6COtvRnQkEeRhHICUaU2NZUvMRQ30KaGUo3eeZ6b+g==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/link@3.6.5':
- resolution: {integrity: sha512-+I2s3XWBEvLrzts0GnNeA84mUkwo+a7kLUWoaJkW0TOBDG7my95HFYxF9WnqKye7NgpOkCqz4s3oW96xPdIniQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/listbox@3.7.4':
- resolution: {integrity: sha512-p4YEpTl/VQGrqVE8GIfqTS5LkT5jtjDTbVeZgrkPnX/fiPhsfbTPiZ6g0FNap4+aOGJFGEEZUv2q4vx+rCORww==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/menu@3.10.4':
- resolution: {integrity: sha512-jCFVShLq3eASiuznenjoKBv3j0Jy2KQilAjBxdEp56WkZ5D338y/oY5zR6d25u9M0QslpI0DgwC8BwU7MCsPnw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/menu@3.10.5':
- resolution: {integrity: sha512-HBTrKll2hm0VKJNM4ubIv1L9MNo8JuOnm2G3M+wXvb6EYIyDNxxJkhjsqsGpUXJdAOSkacHBDcNh2HsZABNX4A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/numberfield@3.8.14':
- resolution: {integrity: sha512-tlGEHJyeQSMlUoO4g9ekoELGJcqsjc/+/FAxo6YQMhQSkuIdkUKZg3UEBKzif4hLw787u80e1D0SxPUi3KO2oA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/overlays@3.9.1':
- resolution: {integrity: sha512-UCG3TOu8FLk4j0Pr1nlhv0opcwMoqbGEOUvsSr6ITN6Qs2y0j+KYSYQ7a4+04m3dN//8+9Wjkkid8k+V1dV2CA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/overlays@3.9.2':
- resolution: {integrity: sha512-Q0cRPcBGzNGmC8dBuHyoPR7N3057KTS5g+vZfQ53k8WwmilXBtemFJPLsogJbspuewQ/QJ3o2HYsp2pne7/iNw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/progress@3.5.15':
- resolution: {integrity: sha512-3SYvEyRt7vq7w0sc6wBYmkPqLMZbhH8FI3Lrnn9r3y8+69/efRjVmmJvwjm1z+c6rukszc2gCjUGTsMPQxVk2w==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/radio@3.9.1':
- resolution: {integrity: sha512-DUCN3msm8QZ0MJrP55FmqMONaadYq6JTxihYFGMLP+NoKRnkxvXqNZ2PlkAOLGy3y4RHOnOF8O1LuJqFCCuxDw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/select@3.12.0':
- resolution: {integrity: sha512-tM3mEbQNotvCJs1gYRFyIeXmXrIBSBLGw7feCIaYSO45IyjCGv8NZwpQWjoKPaWo3GpbHfHMNlWlq3v5QQPIXw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@react-types/shared@3.26.0':
resolution: {integrity: sha512-6FuPqvhmjjlpEDLTiYx29IJCbCNWPlsyO+ZUmCUXzhUv2ttShOXfw8CmeHWHftT/b2KweAWuzqSlfeXPR76jpw==}
peerDependencies:
react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
- '@react-types/slider@3.8.2':
- resolution: {integrity: sha512-MQYZP76OEOYe7/yA2To+Dl0LNb0cKKnvh5JtvNvDnAvEprn1RuLiay8Oi/rTtXmc2KmBa4VdTcsXsmkbbkeN2Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/switch@3.5.15':
- resolution: {integrity: sha512-r/ouGWQmIeHyYSP1e5luET+oiR7N7cLrAlWsrAfYRWHxqXOSNQloQnZJ3PLHrKFT02fsrQhx2rHaK2LfKeyN3A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/table@3.13.3':
- resolution: {integrity: sha512-/kY/VlXN+8l9saySd6igcsDQ3x8pOVFJAWyMh6gOaOVN7HOJkTMIchmqS+ATa4nege8jZqcdzyGeAmv7mN655A==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/tabs@3.3.20':
- resolution: {integrity: sha512-Kjq4PypapdMOVPAQgaFIKH65Kr3YnRvaxBGd6RYizTsqYImQhXoGj6B4lBpjYy4KhfRd4dYS82frHqTGKmBYiA==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/textfield@3.12.5':
- resolution: {integrity: sha512-VXez8KIcop87EgIy00r+tb30xokA309TfJ32Qv5qOYB5SMqoHnb6SYvWL8Ih2PDqCo5eBiiGesSaWYrHnRIL8Q==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/textfield@3.12.6':
- resolution: {integrity: sha512-hpEVKE+M3uUkTjw2WrX1NrH/B3rqDJFUa+ViNK2eVranLY4ZwFqbqaYXSzHupOF3ecSjJJv2C103JrwFvx6TPQ==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
- '@react-types/tooltip@3.4.20':
- resolution: {integrity: sha512-tF1yThwvgSgW8Gu/CLL0p92AUldHR6szlwhwW+ewT318sQlfabMGO4xlCNFdxJYtqTpEXk2rlaVrBuaC//du0w==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
-
'@rolldown/pluginutils@1.0.0-beta.53':
resolution: {integrity: sha512-vENRlFU4YbrwVqNDZ7fLvy+JR1CRkyr01jhSiDpE1u6py3OMzQfztQU2jxykW3ALNxO4kSlqIDeYyD0Y9RcQeQ==}
@@ -4024,137 +2802,164 @@ packages:
cpu: [x64]
os: [win32]
- '@sentry-internal/browser-utils@10.27.0':
- resolution: {integrity: sha512-17tO6AXP+rmVQtLJ3ROQJF2UlFmvMWp7/8RDT5x9VM0w0tY31z8Twc0gw2KA7tcDxa5AaHDUbf9heOf+R6G6ow==}
+ '@sentry/babel-plugin-component-annotate@5.3.0':
+ resolution: {integrity: sha512-p4q8gn8wcFqZGP/s2MnJCAAd8fTikaU6A0mM97RDHQgStcrYiaS0Sc5zUNfb1V+UOLPuvdEdL6MwyxfzjYJQTA==}
+ engines: {node: '>= 18'}
+
+ '@sentry/browser-utils@10.65.0':
+ resolution: {integrity: sha512-4J0mkfNJAGUOkpg1ZggizyftFTn9N20b+Jl87UnWsDUkNG0Ic1l/FIzMPTVxXrAnhBGu0ULO0TFWMoQ5s3QtZw==}
engines: {node: '>=18'}
- '@sentry-internal/feedback@10.27.0':
- resolution: {integrity: sha512-UecsIDJcv7VBwycge/MDvgSRxzevDdcItE1i0KSwlPz00rVVxLY9kV28PJ4I2E7r6/cIaP9BkbWegCEcv09NuA==}
+ '@sentry/browser@10.65.0':
+ resolution: {integrity: sha512-XUDDsx0qxzeIlcOu1fDEqTcDl0eiOqghsgV+ReuuNP4jYjZ9kUQxE3rXWM5mlT1pBi4VaQ4FHqvQZZrRXy+oDw==}
engines: {node: '>=18'}
- '@sentry-internal/replay-canvas@10.27.0':
- resolution: {integrity: sha512-inhsRYSVBpu3BI1kZphXj6uB59baJpYdyHeIPCiTfdFNBE5tngNH0HS/aedZ1g9zICw290lwvpuyrWJqp4VBng==}
- engines: {node: '>=18'}
+ '@sentry/bundler-plugin-core@5.3.0':
+ resolution: {integrity: sha512-L5T60sWdAI3qWwdg3Ptwek/0TY59PERrxyqp4XMUkroayQvGd9r5dIW9Q1kSeXX9iJ442nXbFZKAOyCKV4Z13Q==}
+ engines: {node: '>= 18'}
- '@sentry-internal/replay@10.27.0':
- resolution: {integrity: sha512-tKSzHq1hNzB619Ssrqo25cqdQJ84R3xSSLsUWEnkGO/wcXJvpZy94gwdoS+KmH18BB1iRRRGtnMxZcUkiPSesw==}
- engines: {node: '>=18'}
+ '@sentry/bundler-plugins@10.65.0':
+ resolution: {integrity: sha512-AYgv31l4wY/CwYAD/2Og59RT+TNjvhatcLOrEe5tFOpi9VcPAQ4xfPZIM6fXYGawofT52p6LhUECNSfNkNnc7Q==}
+ engines: {node: '>= 18'}
+ peerDependencies:
+ rollup: 4.59.0
+ webpack: '>=5.0.0'
+ peerDependenciesMeta:
+ rollup:
+ optional: true
+ webpack:
+ optional: true
- '@sentry/babel-plugin-component-annotate@4.7.0':
- resolution: {integrity: sha512-MkyajDiO17/GaHHFgOmh05ZtOwF5hmm9KRjVgn9PXHIdpz+TFM5mkp1dABmR6Y75TyNU98Z1aOwPOgyaR5etJw==}
- engines: {node: '>= 14'}
-
- '@sentry/browser@10.27.0':
- resolution: {integrity: sha512-G8q362DdKp9y1b5qkQEmhTFzyWTOVB0ps1rflok0N6bVA75IEmSDX1pqJsNuY3qy14VsVHYVwQBJQsNltQLS0g==}
- engines: {node: '>=18'}
-
- '@sentry/bundler-plugin-core@4.7.0':
- resolution: {integrity: sha512-gFdEtiup/7qYhN3vp1v2f0WL9AG9OorWLtIpfSBYbWjtzklVNg1sizvNyZ8nEiwtnb25LzvvCUbOP1SyP6IodQ==}
- engines: {node: '>= 14'}
-
- '@sentry/cli-darwin@2.58.4':
- resolution: {integrity: sha512-kbTD+P4X8O+nsNwPxCywtj3q22ecyRHWff98rdcmtRrvwz8CKi/T4Jxn/fnn2i4VEchy08OWBuZAqaA5Kh2hRQ==}
+ '@sentry/cli-darwin@2.58.6':
+ resolution: {integrity: sha512-udAVvcyfNa0R+95GvPz/+43/N3TC0TYKdkQ7D7jhPSzbcMc7l2fxRNN5yB3UpCA5fWFnW4toeaqwDBhb/Wh3LA==}
engines: {node: '>=10'}
os: [darwin]
- '@sentry/cli-linux-arm64@2.58.4':
- resolution: {integrity: sha512-0g0KwsOozkLtzN8/0+oMZoOuQ0o7W6O+hx+ydVU1bktaMGKEJLMAWxOQNjsh1TcBbNIXVOKM/I8l0ROhaAb8Ig==}
+ '@sentry/cli-linux-arm64@2.58.6':
+ resolution: {integrity: sha512-q8mEcNNmeXMy5i+jWT30TVpH7LcP4HD21CD5XRSPAd/a912HF6EpK0ybf/1USO14WOhoXbAGi9txwaWabSe33g==}
engines: {node: '>=10'}
cpu: [arm64]
os: [linux, freebsd, android]
- '@sentry/cli-linux-arm@2.58.4':
- resolution: {integrity: sha512-rdQ8beTwnN48hv7iV7e7ZKucPec5NJkRdrrycMJMZlzGBPi56LqnclgsHySJ6Kfq506A2MNuQnKGaf/sBC9REA==}
+ '@sentry/cli-linux-arm@2.58.6':
+ resolution: {integrity: sha512-pD0LAt5PcUzAinBwvDqc66x9+2CabHEv486yP0gRjWO7SakbaxmfVq/EXd8VLq/Tzi39LAu422UYK1lpW3MILw==}
engines: {node: '>=10'}
cpu: [arm]
os: [linux, freebsd, android]
- '@sentry/cli-linux-i686@2.58.4':
- resolution: {integrity: sha512-NseoIQAFtkziHyjZNPTu1Gm1opeQHt7Wm1LbLrGWVIRvUOzlslO9/8i6wETUZ6TjlQxBVRgd3Q0lRBG2A8rFYA==}
+ '@sentry/cli-linux-i686@2.58.6':
+ resolution: {integrity: sha512-q8vNJi1eOV/4vxAFWBsEwLHoSYapaZHIf4j76KJGJXFKTkEbsjCOOsKbwUIBTQQhRgV4DFWh3ryfsPS/que4Kg==}
engines: {node: '>=10'}
cpu: [x86, ia32]
os: [linux, freebsd, android]
- '@sentry/cli-linux-x64@2.58.4':
- resolution: {integrity: sha512-d3Arz+OO/wJYTqCYlSN3Ktm+W8rynQ/IMtSZLK8nu0ryh5mJOh+9XlXY6oDXw4YlsM8qCRrNquR8iEI1Y/IH+Q==}
+ '@sentry/cli-linux-x64@2.58.6':
+ resolution: {integrity: sha512-DZu956Mhi3ZRjTBe1WdbGV46ldVbA8d2rgp/fh51GsI25zjBHah4wZnPTSzpc+YqxU6pJpg579B/r3jrIK530Q==}
engines: {node: '>=10'}
cpu: [x64]
os: [linux, freebsd, android]
- '@sentry/cli-win32-arm64@2.58.4':
- resolution: {integrity: sha512-bqYrF43+jXdDBh0f8HIJU3tbvlOFtGyRjHB8AoRuMQv9TEDUfENZyCelhdjA+KwDKYl48R1Yasb4EHNzsoO83w==}
+ '@sentry/cli-win32-arm64@2.58.6':
+ resolution: {integrity: sha512-nj0Ff/kmAB73EPDhR8B4O9r+NUHK5GkPCkGWC+kXVemqAJWL5jcJ5KdxG0l/S0z6RoEoltID8/43/B+TaMlT7A==}
engines: {node: '>=10'}
cpu: [arm64]
os: [win32]
- '@sentry/cli-win32-i686@2.58.4':
- resolution: {integrity: sha512-3triFD6jyvhVcXOmGyttf+deKZcC1tURdhnmDUIBkiDPJKGT/N5xa4qAtHJlAB/h8L9jgYih9bvJnvvFVM7yug==}
+ '@sentry/cli-win32-i686@2.58.6':
+ resolution: {integrity: sha512-WNZiDzPbgsEMQWq4avsQ391v/xWKJDIWWWo9GYl+N/w5qcYKkoDW7wQG7T9FasI6ENn68phChTOAPXXxbfAdOg==}
engines: {node: '>=10'}
cpu: [x86, ia32]
os: [win32]
- '@sentry/cli-win32-x64@2.58.4':
- resolution: {integrity: sha512-cSzN4PjM1RsCZ4pxMjI0VI7yNCkxiJ5jmWncyiwHXGiXrV1eXYdQ3n1LhUYLZ91CafyprR0OhDcE+RVZ26Qb5w==}
+ '@sentry/cli-win32-x64@2.58.6':
+ resolution: {integrity: sha512-R35WJ17oF4D2eqI1DR2sQQqr0fjRTt5xoP16WrTu91XM2lndRMFsnjh+/GttbxapLCBNlrjzia99MJ0PZHZpgA==}
engines: {node: '>=10'}
cpu: [x64]
os: [win32]
- '@sentry/cli@2.58.4':
- resolution: {integrity: sha512-ArDrpuS8JtDYEvwGleVE+FgR+qHaOp77IgdGSacz6SZy6Lv90uX0Nu4UrHCQJz8/xwIcNxSqnN22lq0dH4IqTg==}
+ '@sentry/cli@2.58.6':
+ resolution: {integrity: sha512-baBcNPLLfUi9WuL+Tpri9BFaAdvugZIKelC5X0tt0Zdy+K0K+PCVSrnNmwMWU/HyaF/SEv6b6UHnXIdqanBlcg==}
engines: {node: '>= 10'}
hasBin: true
- '@sentry/core@10.27.0':
- resolution: {integrity: sha512-Zc68kdH7tWTDtDbV1zWIbo3Jv0fHAU2NsF5aD2qamypKgfSIMSbWVxd22qZyDBkaX8gWIPm/0Sgx6aRXRBXrYQ==}
+ '@sentry/conventions@0.15.1':
+ resolution: {integrity: sha512-ZLP8bRdMON3prWE2tJyImuYscCxdcJeIPIhrOs/rgyFm3C1nCh1B6gdvPj3AZ5zW08oSFFCsq7T+tYEW3h8MNA==}
+ engines: {node: '>=14'}
+
+ '@sentry/core@10.65.0':
+ resolution: {integrity: sha512-3aqtmM5NgNGo45BNaaBzi0LPQZAw//NEL4HKS5fXm12pJMa4KEkze8DEKnkTEIrGnWaOJKamecHKlnNg/Mqf/Q==}
engines: {node: '>=18'}
- '@sentry/nextjs@10.27.0':
- resolution: {integrity: sha512-O3b7y4JgVyj70ucW7lfyFLSXTCvztu7qOdFzFl2LwIstzFIZzt6v7ICOhP3FEEC7Lxn5teNb6xVBDtu8vYr20g==}
+ '@sentry/feedback@10.65.0':
+ resolution: {integrity: sha512-ck8h7wgd3F3bYNk0v1OgohmyLBeXcKxqlfBJRtQq4k6KZUq+pXimOG7ckNguVMYjCo3PEfuG+ckKc21yqotKug==}
+ engines: {node: '>=18'}
+
+ '@sentry/nextjs@10.65.0':
+ resolution: {integrity: sha512-9gDKQAAXcWh210fMI/ZNCa7940HYt7dGjnJVP0Tk9ozUR57W4C9vXvHJDTYPJrFxYxTHw7lwxWGervk8a6Tf4g==}
engines: {node: '>=18'}
peerDependencies:
next: ^13.2.0 || ^14.0 || ^15.0.0-rc.0 || ^16.0.0-0
- '@sentry/node-core@10.27.0':
- resolution: {integrity: sha512-Dzo1I64Psb7AkpyKVUlR9KYbl4wcN84W4Wet3xjLmVKMgrCo2uAT70V4xIacmoMH5QLZAx0nGfRy9yRCd4nzBg==}
+ '@sentry/node-core@10.65.0':
+ resolution: {integrity: sha512-U01X9mPT+jZnsLPmPWfBU67Ka+t/Sdd9RGAuvGoKdrI6N47a/9PDkM9oCW+kj0fmZwogZHTgSnzJU5oi3pImgA==}
engines: {node: '>=18'}
peerDependencies:
'@opentelemetry/api': ^1.9.0
- '@opentelemetry/context-async-hooks': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/core': ^1.30.1 || ^2.1.0 || ^2.2.0
+ '@opentelemetry/core': ^1.30.1 || ^2.1.0
+ '@opentelemetry/exporter-trace-otlp-http': '>=0.57.0 <1'
'@opentelemetry/instrumentation': '>=0.57.1 <1'
- '@opentelemetry/resources': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/semantic-conventions': ^1.37.0
+ '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0
+ peerDependenciesMeta:
+ '@opentelemetry/api':
+ optional: true
+ '@opentelemetry/core':
+ optional: true
+ '@opentelemetry/exporter-trace-otlp-http':
+ optional: true
+ '@opentelemetry/instrumentation':
+ optional: true
+ '@opentelemetry/sdk-trace-base':
+ optional: true
- '@sentry/node@10.27.0':
- resolution: {integrity: sha512-1cQZ4+QqV9juW64Jku1SMSz+PoZV+J59lotz4oYFvCNYzex8hRAnDKvNiKW1IVg5mEEkz98mg1fvcUtiw7GTiQ==}
+ '@sentry/node@10.65.0':
+ resolution: {integrity: sha512-t35dcdyksysVch/m/XdLgGJqGKJhr9eMD30Ctn3TeQ8yMB0wNXySfjPR5Yg93fpjmfaHtzc6iYIXRAvgNVfrvA==}
engines: {node: '>=18'}
- '@sentry/opentelemetry@10.27.0':
- resolution: {integrity: sha512-z2vXoicuGiqlRlgL9HaYJgkin89ncMpNQy0Kje6RWyhpzLe8BRgUXlgjux7WrSrcbopDdC1OttSpZsJ/Wjk7fg==}
+ '@sentry/opentelemetry@10.65.0':
+ resolution: {integrity: sha512-8C6FPvm3XBvUrkM52dX3Gz0p2H0Ij8t4sahUA+GTiCz0WM0fnyPeQPGC/b6I4jamV9UXyCZRnE1UEEGCoD+c7A==}
engines: {node: '>=18'}
peerDependencies:
'@opentelemetry/api': ^1.9.0
- '@opentelemetry/context-async-hooks': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/core': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0 || ^2.2.0
- '@opentelemetry/semantic-conventions': ^1.37.0
+ '@opentelemetry/core': ^1.30.1 || ^2.1.0
+ '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0
- '@sentry/react@10.27.0':
- resolution: {integrity: sha512-xoIRBlO1IhLX/O9aQgVYW1F3Qhw8TdkOiZjh6mrPsnCpBLufsQ4aS1nDQi9miZuWeslW0s2zNy0ACBpICZR/sw==}
+ '@sentry/react@10.65.0':
+ resolution: {integrity: sha512-fvHxpuvid0wt9/1N3itcKDyKOjqmYHw3MBSt5Pki3Iz4CL2CmgQp9ZFv/CA7UhMnEvn2Gd+Qc2UKxujZWd8FLg==}
engines: {node: '>=18'}
peerDependencies:
react: ^16.14.0 || 17.x || 18.x || 19.x
- '@sentry/vercel-edge@10.27.0':
- resolution: {integrity: sha512-uBfpOnzSNSd2ITMTMeX5bV9Jlci9iMyI+iOPuW8c3oc+0dITTN0OpKLyNd6nfm50bM5h/1qFVQrph+oFTrtuGQ==}
+ '@sentry/replay-canvas@10.65.0':
+ resolution: {integrity: sha512-A7X3RVk1Gk+knK8Ip/2EjejckNCLgCfRZo6eGlsy6qyz904KBpYmys1a0o7QkzFRjhIndjHAfcVxwt6jSLJlrQ==}
engines: {node: '>=18'}
- '@sentry/webpack-plugin@4.7.0':
- resolution: {integrity: sha512-SQd+VIWVIpSzFlklIysiTHdRc3qf8g+grRto+1I4c7+/eTAIBDE6PSviKtnryjVVudz5dCrpvR2f0JhkLCts5Q==}
- engines: {node: '>= 14'}
+ '@sentry/replay@10.65.0':
+ resolution: {integrity: sha512-aW988CcQBNArbOMzOFOziipHz6uQyXSa4i5CPWsu+nhVPTJHafosi5Lv9n6NM/icDX5e23VdnX6mZd8SyJuo8A==}
+ engines: {node: '>=18'}
+
+ '@sentry/server-utils@10.65.0':
+ resolution: {integrity: sha512-80toEFD6s+0Le7jrYB6pHWLF703WSg0WyavAWqrBGWG8JkREHgedAxzFYgoY5GlMI756qk6Ea7UzhJTHd2zAXA==}
+ engines: {node: '>=18'}
+
+ '@sentry/vercel-edge@10.65.0':
+ resolution: {integrity: sha512-Z1sk2yBHrcsk/QMIzgMRTHitUN1zogzn5eQEc7umWmWwpP6zpDLMDxeeH2F1Cy2vzQFKa53PaWz7HXk4n617eg==}
+ engines: {node: '>=18'}
+
+ '@sentry/webpack-plugin@5.4.0':
+ resolution: {integrity: sha512-J3a0BvUZ75Qxy+v/Ap3Hx4ZEcSjlPHZ/jDtxdRhXQCyNeEb8xq0uUBTI9VLtGk2eNeNucOxOEJ5ngqdNjnEH/A==}
+ engines: {node: '>= 18'}
peerDependencies:
- webpack: '>=4.40.0'
+ webpack: '>=5.0.0'
'@shikijs/core@3.20.0':
resolution: {integrity: sha512-f2ED7HYV4JEk827mtMDwe/yQ25pRiXZmtHjWF8uzZKuKiEsJR7Ce1nuQ+HhV9FzDcbIo4ObBCD9GPTzNuy9S1g==}
@@ -4350,9 +3155,6 @@ packages:
'@swc/helpers@0.5.18':
resolution: {integrity: sha512-TXTnIcNJQEKwThMMqBXsZ4VGAza6bvN4pa41Rkqoio6QBKMvo+5lexeTMScGCIxtzgQJzElcvIltani+adC5PQ==}
- '@swc/helpers@0.5.21':
- resolution: {integrity: sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==}
-
'@tailwindcss/node@4.1.18':
resolution: {integrity: sha512-DoR7U1P7iYhw16qJ49fgXUlry1t4CpXeErJHnQ44JgTSKMaZUdf17cfn5mHchfJ4KRBZRFA/Coo+MUF5+gOaCQ==}
@@ -4457,19 +3259,10 @@ packages:
react: '>=16.8'
react-dom: '>=16.8'
- '@tanstack/react-virtual@3.11.3':
- resolution: {integrity: sha512-vCU+OTylXN3hdC8RKg68tPlBPjjxtzon7Ys46MgrSLE+JhSjSTPvoQifV6DQJeJmA8Q3KT6CphJbejupx85vFw==}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
- react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-
'@tanstack/table-core@8.21.3':
resolution: {integrity: sha512-ldZXEhOBb8Is7xLs01fR3YEc3DERiz5silj8tnGkFZytt1abEvl/GhUmCE0PMLaMPTa3Jk4HbKmRlHmu+gCftg==}
engines: {node: '>=12'}
- '@tanstack/virtual-core@3.11.3':
- resolution: {integrity: sha512-v2mrNSnMwnPJtcVqNvV0c5roGCBqeogN8jDtgtuHCphdwBasOZ17x8UV8qpHUh+u0MLfX43c0uUHKje0s+Zb0w==}
-
'@testing-library/dom@10.4.1':
resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
engines: {node: '>=18'}
@@ -4520,9 +3313,6 @@ packages:
'@types/chai@5.2.3':
resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
- '@types/connect@3.4.38':
- resolution: {integrity: sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==}
-
'@types/d3-array@3.2.2':
resolution: {integrity: sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==}
@@ -4658,18 +3448,9 @@ packages:
'@types/ms@2.1.0':
resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
- '@types/mysql@2.15.27':
- resolution: {integrity: sha512-YfWiV16IY0OeBfBCk8+hXKmdTKrKlwKN1MNKAPBu5JYxLwBEZl7QzeEpGnlZb3VMGJrrGmB84gXiH+ofs/TezA==}
-
'@types/node@24.10.8':
resolution: {integrity: sha512-r0bBaXu5Swb05doFYO2kTWHMovJnNVbCsII0fhesM8bNRlLhXIuckley4a2DaD+vOdmm5G+zGkQZAPZsF80+YQ==}
- '@types/pg-pool@2.0.6':
- resolution: {integrity: sha512-TaAUE5rq2VQYxab5Ts7WZhKNmuN78Q6PiFonTDdpbx8a1H0M1vhy3rhiMjl+e2iHmogyMw7jZF4FrE6eJUy5HQ==}
-
- '@types/pg@8.15.6':
- resolution: {integrity: sha512-NoaMtzhxOrubeL/7UZuNTrejB4MPAJ0RpxZqXQf2qXuVlTPuG6Y8p4u9dKRaue4yjmC7ZhzVO2/Yyyn25znrPQ==}
-
'@types/react-dom@19.2.3':
resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
peerDependencies:
@@ -4684,9 +3465,6 @@ packages:
'@types/statuses@2.0.6':
resolution: {integrity: sha512-xMAgYwceFhRA2zY+XbEA7mxYbA093wdiW8Vu6gZPGWy9cmOyU9XesH1tNcEWsKFd5Vzrqx5T3D38PWx1FIIXkA==}
- '@types/tedious@4.0.14':
- resolution: {integrity: sha512-KHPsfX/FoVbUGbyYvk1q9MMQHLPeRZhRJZdO45Q4YjvFkv4hMNghCWTvy7rdKessBsmtz4euWCWAB6/tVpI1Iw==}
-
'@types/topojson-client@3.1.5':
resolution: {integrity: sha512-C79rySTyPxnQNNguTZNI1Ct4D7IXgvyAs3p9HPecnl6mNrJ5+UhvGNYcZfpROYV2lMHI48kJPxwR+F9C6c7nmw==}
@@ -4798,7 +3576,7 @@ packages:
resolution: {integrity: sha512-EcA07pHJouywpzsoTUqNh5NwGayl2PPVEJKUSinGGSxFGYn+shYbqMGBg6FXDqgXum9Ou/ecb+411ssw8HImJQ==}
engines: {node: ^20.19.0 || >=22.12.0}
peerDependencies:
- vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+ vite: 7.3.5
'@vitest/browser-playwright@4.1.8':
resolution: {integrity: sha512-SR7FqgegaexEg73xvf3ArtygXegagMdXnL0EZMpxrWvvhQxvicD/E8p0ib0J91riPRtQUViyh67Xjw3NqvyhVg==}
@@ -4827,7 +3605,7 @@ packages:
resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
peerDependencies:
msw: ^2.4.9
- vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+ vite: 7.3.5
peerDependenciesMeta:
msw:
optional: true
@@ -4913,11 +3691,6 @@ packages:
resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
engines: {node: '>= 0.6'}
- acorn-import-attributes@1.9.5:
- resolution: {integrity: sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==}
- peerDependencies:
- acorn: ^8
-
acorn-import-phases@1.0.4:
resolution: {integrity: sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ==}
engines: {node: '>=10.13.0'}
@@ -4929,13 +3702,13 @@ packages:
peerDependencies:
acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
- acorn@8.15.0:
- resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+ acorn@8.16.0:
+ resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
engines: {node: '>=0.4.0'}
hasBin: true
- acorn@8.16.0:
- resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
+ acorn@8.17.0:
+ resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
engines: {node: '>=0.4.0'}
hasBin: true
@@ -4984,10 +3757,6 @@ packages:
resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
engines: {node: '>=8'}
- ansi-regex@6.2.2:
- resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
- engines: {node: '>=12'}
-
ansi-styles@4.3.0:
resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
engines: {node: '>=8'}
@@ -4996,14 +3765,6 @@ packages:
resolution: {integrity: sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==}
engines: {node: '>=10'}
- ansi-styles@6.2.3:
- resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
- engines: {node: '>=12'}
-
- anymatch@3.1.3:
- resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
- engines: {node: '>= 8'}
-
argparse@2.0.1:
resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
@@ -5056,6 +3817,10 @@ packages:
ast-v8-to-istanbul@1.0.3:
resolution: {integrity: sha512-jCMQ6ZylLPudp0CDfBmQBZUsrh1/8psbmu9ibeVWKuHWD0YrH9YABwlKu5kVEFoT0GCQQW9Z/SxfuEbbkGQCRg==}
+ astring@1.9.0:
+ resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==}
+ hasBin: true
+
async-function@1.0.0:
resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
engines: {node: '>= 0.4'}
@@ -5096,10 +3861,6 @@ packages:
bidi-js@1.0.3:
resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
- binary-extensions@2.3.0:
- resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
- engines: {node: '>=8'}
-
body-parser@2.2.2:
resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==}
engines: {node: '>=18'}
@@ -5118,11 +3879,6 @@ packages:
resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
engines: {node: '>=8'}
- browserslist@4.28.1:
- resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==}
- engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
- hasBin: true
-
browserslist@4.28.2:
resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
@@ -5181,16 +3937,12 @@ packages:
character-reference-invalid@2.0.1:
resolution: {integrity: sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==}
- chokidar@3.6.0:
- resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
- engines: {node: '>= 8.10.0'}
-
chrome-trace-event@1.0.4:
resolution: {integrity: sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==}
engines: {node: '>=6.0'}
- cjs-module-lexer@1.4.3:
- resolution: {integrity: sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==}
+ cjs-module-lexer@2.2.0:
+ resolution: {integrity: sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==}
class-variance-authority@0.7.1:
resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
@@ -5209,10 +3961,6 @@ packages:
resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
engines: {node: '>=12'}
- clsx@1.2.1:
- resolution: {integrity: sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg==}
- engines: {node: '>=6'}
-
clsx@2.1.1:
resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
engines: {node: '>=6'}
@@ -5236,9 +3984,6 @@ packages:
color-string@1.9.1:
resolution: {integrity: sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==}
- color2k@2.0.3:
- resolution: {integrity: sha512-zW190nQTIoXcGCaU08DvVNFTmQhUpnJfVuAKfWqUQkflXKpaDdpaYoM0iluLS9lgJNHyBF58KKA2FBEwkD7wog==}
-
color@4.2.3:
resolution: {integrity: sha512-1rXeuUUiGGrykh+CeBdu5Ie7OJwinCgQY0bc7GCRxy5xVHy+moaqkpL/jqQq0MtQOeYcrqEz4abc5f0KtU7W4A==}
engines: {node: '>=12.5.0'}
@@ -5260,9 +4005,6 @@ packages:
commondir@1.0.1:
resolution: {integrity: sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
- compute-scroll-into-view@3.1.1:
- resolution: {integrity: sha512-VRhuHOLoKYOy4UbilLbUzbYg93XLjv2PncJC50EuTWPA3gaja1UjBsUP/D/9/juV3vQFr6XBEzn9KCAHdUvOHw==}
-
concat-map@0.0.1:
resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
@@ -5305,6 +4047,9 @@ packages:
crelt@1.0.6:
resolution: {integrity: sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==}
+ crelt@1.0.7:
+ resolution: {integrity: sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA==}
+
cross-fetch@4.1.0:
resolution: {integrity: sha512-uKm5PU+MHTootlWEY+mZ4vvXoCn4fLQxT9dSc1sXVMSFkINTJVN8cAQROpwcKm8bJ/c7rgZVIBWzH5T78sNZZw==}
@@ -5540,10 +4285,6 @@ packages:
deep-is@0.1.4:
resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
- deepmerge@4.3.1:
- resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
- engines: {node: '>=0.10.0'}
-
define-data-property@1.1.4:
resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
engines: {node: '>= 0.4'}
@@ -5594,8 +4335,8 @@ packages:
dom-helpers@5.2.1:
resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
- dompurify@3.4.10:
- resolution: {integrity: sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==}
+ dompurify@3.4.11:
+ resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==}
dotenv-expand@12.0.3:
resolution: {integrity: sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==}
@@ -5605,6 +4346,10 @@ packages:
resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
engines: {node: '>=12'}
+ dotenv@17.4.2:
+ resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
+ engines: {node: '>=12'}
+
driver.js@1.4.0:
resolution: {integrity: sha512-Gm64jm6PmcU+si21sQhBrTAM1JvUrR0QhNmjkprNLxohOBzul9+pNHXgQaT9lW84gwg9GMLB3NZGuGolsz5uew==}
@@ -5612,15 +4357,9 @@ packages:
resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
engines: {node: '>= 0.4'}
- eastasianwidth@0.2.0:
- resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
-
ee-first@1.1.1:
resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
- electron-to-chromium@1.5.267:
- resolution: {integrity: sha512-0Drusm6MVRXSOJpGbaSVgcQsuB4hEkMpHXaVstcPmhu5LIedxs1xNK/nIxmQIU/RPC0+1/o0AVZfBTkTNJOdUw==}
-
electron-to-chromium@1.5.354:
resolution: {integrity: sha512-JaBHwWcfIdmSAfWM5l3uwjGd431j8YEMikZ+K/2nXVuBqJKyZ0f+2h4n4JY5AyNiZmnY9qQr2RU3v9DxDmHMNg==}
@@ -5638,6 +4377,10 @@ packages:
resolution: {integrity: sha512-xe9vQb5kReirPUxgQrXA3ihgbCqssmTiM7cOZ+Gzu+VeGWgpV98lLZvp0dl4yriyAePcewxGUs9UpKD8PET9KQ==}
engines: {node: '>=10.13.0'}
+ enhanced-resolve@5.24.2:
+ resolution: {integrity: sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==}
+ engines: {node: '>=10.13.0'}
+
entities@6.0.1:
resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
engines: {node: '>=0.12'}
@@ -5658,8 +4401,8 @@ packages:
resolution: {integrity: sha512-BrUQ0cPTB/IwXj23HtwHjS9n7O4h9FX94b4xc5zlTHxeLgTAdzYUDyy6KdExAl9lbN5rtfe44xpjpmj9grxs5w==}
engines: {node: '>= 0.4'}
- es-module-lexer@2.1.0:
- resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
+ es-module-lexer@2.3.0:
+ resolution: {integrity: sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==}
es-object-atoms@1.1.1:
resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
@@ -5829,10 +4572,6 @@ packages:
resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
engines: {node: '>=0.8.x'}
- eventsource-parser@3.0.6:
- resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
- engines: {node: '>=18.0.0'}
-
eventsource-parser@3.1.0:
resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
engines: {node: '>=18.0.0'}
@@ -5939,10 +4678,6 @@ packages:
resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
engines: {node: '>=16'}
- flat@5.0.2:
- resolution: {integrity: sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==}
- hasBin: true
-
flatted@3.4.2:
resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
@@ -5950,18 +4685,11 @@ packages:
resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
engines: {node: '>= 0.4'}
- foreground-child@3.3.1:
- resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
- engines: {node: '>=14'}
-
formatly@0.3.0:
resolution: {integrity: sha512-9XNj/o4wrRFyhSMJOvsuyMwy8aUfBaZ1VrqHVfohyXf0Sw0e+yfKG+xZaY3arGCOMdwFsqObtzVOc1gU9KiT9w==}
engines: {node: '>=18.3.0'}
hasBin: true
- forwarded-parse@2.1.2:
- resolution: {integrity: sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==}
-
forwarded@0.2.0:
resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
engines: {node: '>= 0.6'}
@@ -6053,10 +4781,9 @@ packages:
glob-to-regexp@0.4.1:
resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
- glob@10.5.0:
- resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
- deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
- hasBin: true
+ glob@13.0.6:
+ resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
+ engines: {node: 18 || 20 || >=22}
globals@14.0.0:
resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
@@ -6163,11 +4890,8 @@ packages:
hermes-parser@0.25.1:
resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
- hoist-non-react-statics@3.3.2:
- resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
-
- hono@4.12.21:
- resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
+ hono@4.12.28:
+ resolution: {integrity: sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==}
engines: {node: '>=16.9.0'}
html-encoding-sniffer@6.0.0:
@@ -6222,8 +4946,9 @@ packages:
resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
engines: {node: '>=6'}
- import-in-the-middle@2.0.0:
- resolution: {integrity: sha512-yNZhyQYqXpkT0AKq3F3KLasUSK4fHvebNH5hOsKQw2dhGSALvQ4U0BqUc5suziKvydO5u5hgN2hy1RJaho8U5A==}
+ import-in-the-middle@3.3.1:
+ resolution: {integrity: sha512-0rymlHSFLwZ0ixx8DaQkoIyZojJPY2a0K2nEYslhKJ6jIYO/m0IcCb7iQsFPmS7WmKwISZiIrv5Icstrw/CmqA==}
+ engines: {node: '>=18'}
imurmurhash@0.1.4:
resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
@@ -6239,12 +4964,6 @@ packages:
inline-style-parser@0.2.7:
resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
- input-otp@1.4.1:
- resolution: {integrity: sha512-+yvpmKYKHi9jIGngxagY9oWiiblPB7+nEO75F2l2o4vs+6vpPZZmUl4tBNYuTCvQjhvEIbdNeJu70bhfYP2nbw==}
- peerDependencies:
- react: ^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc
- react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc
-
internal-slot@1.1.0:
resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
engines: {node: '>= 0.4'}
@@ -6256,9 +4975,6 @@ packages:
resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==}
engines: {node: '>=12'}
- intl-messageformat@10.7.16:
- resolution: {integrity: sha512-UmdmHUmp5CIKKjSoE10la5yfU+AYJAaiYLsodbjL4lji83JNvgOQUjGaGhGrpFCb0Uh7sl7qfP1IyILa8Z40ug==}
-
ip-address@10.2.0:
resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
engines: {node: '>= 12'}
@@ -6288,10 +5004,6 @@ packages:
resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
engines: {node: '>= 0.4'}
- is-binary-path@2.1.0:
- resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
- engines: {node: '>=8'}
-
is-boolean-object@1.2.2:
resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
engines: {node: '>= 0.4'}
@@ -6432,9 +5144,6 @@ packages:
resolution: {integrity: sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
engines: {node: '>= 0.4'}
- jackspeak@3.4.3:
- resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
-
jest-worker@27.5.1:
resolution: {integrity: sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==}
engines: {node: '>= 10.13.0'}
@@ -6455,8 +5164,8 @@ packages:
js-tokens@4.0.0:
resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
- js-yaml@4.1.1:
- resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+ js-yaml@4.3.0:
+ resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
hasBin: true
jsdom@27.4.0:
@@ -6535,7 +5244,7 @@ packages:
'@opentelemetry/exporter-trace-otlp-proto': '*'
'@opentelemetry/sdk-trace-base': '*'
openai: '*'
- ws: '>=7'
+ ws: 8.21.0
peerDependenciesMeta:
'@opentelemetry/api':
optional: true
@@ -6669,9 +5378,6 @@ packages:
resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
hasBin: true
- lru-cache@10.4.3:
- resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
-
lru-cache@11.2.6:
resolution: {integrity: sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==}
engines: {node: 20 || >=22}
@@ -6696,10 +5402,6 @@ packages:
magic-string@0.30.21:
resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
- magic-string@0.30.8:
- resolution: {integrity: sha512-ISQTe55T2ao7XtlAStud6qwYPZjE4GK1S/BeVPus4jrq6JuOnQ00YKQC581RWhR122W7msZV263KzVeLoqidyQ==}
- engines: {node: '>=12'}
-
magicast@0.5.2:
resolution: {integrity: sha512-E3ZJh4J3S9KfwdjZhe2afj6R9lGIN5Pher1pF39UGrXRqq/VDaGVIGN13BjHd2u8B61hArAGOnso7nBOouW3TQ==}
@@ -6790,6 +5492,10 @@ packages:
resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
engines: {node: '>= 8'}
+ meriyah@6.1.4:
+ resolution: {integrity: sha512-Sz8FzjzI0kN13GK/6MVEsVzMZEPvOhnmmI1lU5+/1cGOiK3QUahntrNNtdVeihrO7t9JpoH75iMNXg6R6uWflQ==}
+ engines: {node: '>=18.0.0'}
+
mermaid@11.15.0:
resolution: {integrity: sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==}
@@ -6933,6 +5639,10 @@ packages:
resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
engines: {node: '>=4'}
+ minimatch@10.2.3:
+ resolution: {integrity: sha512-Rwi3pnapEqirPSbWbrZaa6N3nmqq4Xer/2XooiOKyV3q12ML06f7MOuc5DVH8ONZIFhwIYQ3yzPH4nt7iWHaTg==}
+ engines: {node: 18 || 20 || >=22}
+
minimatch@3.1.4:
resolution: {integrity: sha512-twmL+S8+7yIsE9wsqgzU3E8/LumN3M3QELrBZ20OdmQ9jB2JvW5oZtBEmft84k/Gs5CG9mqtWc6Y9vW+JEzGxw==}
@@ -6943,8 +5653,8 @@ packages:
minimist@1.2.8:
resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
- minipass@7.1.2:
- resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==}
+ minipass@7.1.3:
+ resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
engines: {node: '>=16 || 14 >=14.17'}
mlly@1.8.0:
@@ -7060,16 +5770,9 @@ packages:
encoding:
optional: true
- node-releases@2.0.27:
- resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
-
node-releases@2.0.44:
resolution: {integrity: sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==}
- normalize-path@3.0.0:
- resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
- engines: {node: '>=0.10.0'}
-
oauth4webapi@3.8.3:
resolution: {integrity: sha512-pQ5BsX3QRTgnt5HxgHwgunIRaDXBdkT23tf8dfzmtTIL2LTpdmxgbpbBm0VgFWAIDlezQvQCTgnVIUmHupXHxw==}
@@ -7121,7 +5824,7 @@ packages:
resolution: {integrity: sha512-0H5dEGFmmLv6KSd0W1w2nyL8WsLkX6yoLeQpU+dZAOuGcany5qkYQMmj35ZrKgb6yiyYqpUzFOpR8mZQkgqeEQ==}
hasBin: true
peerDependencies:
- ws: ^8.18.0
+ ws: 8.21.0
zod: ^3.25 || ^4.0
peerDependenciesMeta:
ws:
@@ -7179,9 +5882,6 @@ packages:
resolution: {integrity: sha512-AxTM2wDGORHGEkPCt8yqxOTMgpfbEHqF51f/5fJCmwFC3C/zNcGT63SymH2ttOAaiIws2zVg4+izQCjrakcwHg==}
engines: {node: '>=20'}
- package-json-from-dist@1.0.1:
- resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
-
package-manager-detector@1.6.0:
resolution: {integrity: sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==}
@@ -7220,9 +5920,9 @@ packages:
path-parse@1.0.7:
resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
- path-scurry@1.11.1:
- resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
- engines: {node: '>=16 || 14 >=14.18'}
+ path-scurry@2.0.2:
+ resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
+ engines: {node: 18 || 20 || >=22}
path-to-regexp@6.3.0:
resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
@@ -7233,17 +5933,6 @@ packages:
pathe@2.0.3:
resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
- pg-int8@1.0.1:
- resolution: {integrity: sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==}
- engines: {node: '>=4.0.0'}
-
- pg-protocol@1.11.0:
- resolution: {integrity: sha512-pfsxk2M9M3BuGgDOfuy37VNRRX3jmKgMjcvAcWqNDpZSf4cUmv8HSOl5ViRQFsfARFn0KuUQTgLxVMbNq5NW3g==}
-
- pg-types@2.2.0:
- resolution: {integrity: sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==}
- engines: {node: '>=4'}
-
picocolors@1.1.1:
resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
@@ -7255,6 +5944,10 @@ packages:
resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
engines: {node: '>=12'}
+ picomatch@4.0.5:
+ resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+ engines: {node: '>=12'}
+
pkce-challenge@5.0.1:
resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
engines: {node: '>=16.20.0'}
@@ -7294,22 +5987,6 @@ packages:
resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
engines: {node: ^10 || ^12 || >=14}
- postgres-array@2.0.0:
- resolution: {integrity: sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==}
- engines: {node: '>=4'}
-
- postgres-bytea@1.0.1:
- resolution: {integrity: sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==}
- engines: {node: '>=0.10.0'}
-
- postgres-date@1.0.7:
- resolution: {integrity: sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==}
- engines: {node: '>=0.10.0'}
-
- postgres-interval@1.2.0:
- resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==}
- engines: {node: '>=0.10.0'}
-
preact-render-to-string@6.5.11:
resolution: {integrity: sha512-ubnauqoGczeGISiOh6RjX0/cdaF8v/oDXIjO85XALCQjwQP+SB4RDXXtvZ6yTYSjG+PC1QRP2AhPgCEsM2EvUw==}
peerDependencies:
@@ -7512,12 +6189,6 @@ packages:
'@types/react':
optional: true
- react-textarea-autosize@8.5.9:
- resolution: {integrity: sha512-U1DGlIQN5AwgjTyOEnI1oCcMuEr1pv1qOtklB2l4nyMGbHzWrI0eFsYK0zos2YWqAolJyG0IWJaqWmWj5ETh0A==}
- engines: {node: '>=10'}
- peerDependencies:
- react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-
react-transition-group@4.4.5:
resolution: {integrity: sha512-pZcd1MCJoiKiBR2NRxeCRg13uCXbydPnmB4EOeRrY7480qNWO8IIgQG6zlDkm6uRMsURXPuKq0GWtiM59a5Q6g==}
peerDependencies:
@@ -7528,10 +6199,6 @@ packages:
resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
engines: {node: '>=0.10.0'}
- readdirp@3.6.0:
- resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
- engines: {node: '>=8.10.0'}
-
recharts-scale@0.4.5:
resolution: {integrity: sha512-kivNFO+0OcUNu7jQquLXAxz1FIwZj8nrj+YkOKc5694NbjCvcT6aSZiIzNzd2Kul4o4rTto8QVR9lMNtxD4G1w==}
@@ -7634,10 +6301,6 @@ packages:
resolve-pkg-maps@1.0.0:
resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
- resolve@1.22.8:
- resolution: {integrity: sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==}
- hasBin: true
-
resolve@2.0.0-next.5:
resolution: {integrity: sha512-U7WjGVG9sH8tvjW5SmGbQuui75FiyjAX72HX15DwBBwF9dNiQZRQAg9nnPhYy+TUnE0+VcrttuvNI8oSxZcocA==}
hasBin: true
@@ -7699,18 +6362,13 @@ packages:
resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==}
engines: {node: '>= 10.13.0'}
- scroll-into-view-if-needed@3.0.10:
- resolution: {integrity: sha512-t44QCeDKAPf1mtQH3fYpWz8IM/DyvHLjs8wUvvwMYxk5moOqCzrMSxK6HQVD0QVmVjXFavoFIPRVrMuJPKAvtg==}
+ semifies@1.0.0:
+ resolution: {integrity: sha512-xXR3KGeoxTNWPD4aBvL5NUpMTT7WMANr3EWnaS190QVkY52lqqcVRD7Q05UVbBhiWDGWMlJEUam9m7uFFGVScw==}
semver@6.3.1:
resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
hasBin: true
- semver@7.7.3:
- resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==}
- engines: {node: '>=10'}
- hasBin: true
-
semver@7.8.0:
resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==}
engines: {node: '>=10'}
@@ -7850,10 +6508,6 @@ packages:
resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
engines: {node: '>=8'}
- string-width@5.1.2:
- resolution: {integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==}
- engines: {node: '>=12'}
-
string.prototype.includes@2.0.1:
resolution: {integrity: sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
engines: {node: '>= 0.4'}
@@ -7884,10 +6538,6 @@ packages:
resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
engines: {node: '>=8'}
- strip-ansi@7.1.2:
- resolution: {integrity: sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==}
- engines: {node: '>=12'}
-
strip-indent@3.0.0:
resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
engines: {node: '>=8'}
@@ -7959,16 +6609,6 @@ packages:
tailwind-merge@3.3.1:
resolution: {integrity: sha512-gBXpgUm/3rp1lMZZrM/w7D8GKqshif0zAymAhbCyIt8KMe+0v9DQ7cdYLR4FHH/cKpdTXb+A/tKKU3eolfsI+g==}
- tailwind-variants@3.1.1:
- resolution: {integrity: sha512-ftLXe3krnqkMHsuBTEmaVUXYovXtPyTK7ckEfDRXS8PBZx0bAUas+A0jYxuKA5b8qg++wvQ3d2MQ7l/xeZxbZQ==}
- engines: {node: '>=16.x', pnpm: '>=7.x'}
- peerDependencies:
- tailwind-merge: '>=3.0.0'
- tailwindcss: '*'
- peerDependenciesMeta:
- tailwind-merge:
- optional: true
-
tailwindcss-animate@1.0.7:
resolution: {integrity: sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==}
peerDependencies:
@@ -7981,8 +6621,8 @@ packages:
resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
engines: {node: '>=6'}
- terser-webpack-plugin@5.6.0:
- resolution: {integrity: sha512-Eum+5ajkaOhf5KbM26osvv21kLD7BaGqQ1UA4Ami4arYwylmGUQTgHFpHDdmJod1q4QXa66p0to/FBKID+J1vA==}
+ terser-webpack-plugin@5.6.1:
+ resolution: {integrity: sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==}
engines: {node: '>= 10.13.0'}
peerDependencies:
'@minify-html/node': '*'
@@ -8024,8 +6664,8 @@ packages:
uglify-js:
optional: true
- terser@5.47.1:
- resolution: {integrity: sha512-tPbLXTI6ohPASb/1YViL428oEHu6/qv1OxqYnfaonVCFHqx4+wCd95pHrQWsL5X4pl90CTyW9piSAsS2L0VoMw==}
+ terser@5.49.0:
+ resolution: {integrity: sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==}
engines: {node: '>=10'}
hasBin: true
@@ -8046,14 +6686,14 @@ packages:
resolution: {integrity: sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==}
engines: {node: '>=18'}
- tinyglobby@0.2.15:
- resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
- engines: {node: '>=12.0.0'}
-
tinyglobby@0.2.16:
resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
engines: {node: '>=12.0.0'}
+ tinyglobby@0.2.17:
+ resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+ engines: {node: '>=12.0.0'}
+
tinyrainbow@3.1.0:
resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
engines: {node: '>=14.0.0'}
@@ -8081,10 +6721,6 @@ packages:
resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==}
engines: {node: '>=6'}
- tough-cookie@6.0.0:
- resolution: {integrity: sha512-kXuRi1mtaKMrsLUxz3sQYvVl37B0Ns6MzfrtV5DvJceE9bPyspOqk9xxv7XbZWcfLWbFmm997vl83qUWVJA64w==}
- engines: {node: '>=16'}
-
tough-cookie@6.0.1:
resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
engines: {node: '>=16'}
@@ -8194,9 +6830,6 @@ packages:
resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
engines: {node: '>= 0.8'}
- unplugin@1.0.1:
- resolution: {integrity: sha512-aqrHaVBWW1JVKBHmGo33T5TxeL0qWzfvjWokObHA9bYmN7eNDkwOxmLjhioHl9878qDFMAaT51XNroRyuz7WxA==}
-
until-async@3.0.2:
resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==}
@@ -8204,7 +6837,7 @@ packages:
resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
hasBin: true
peerDependencies:
- browserslist: '>= 4.21.0'
+ browserslist: 4.28.2
uri-js@4.4.1:
resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
@@ -8219,33 +6852,6 @@ packages:
'@types/react':
optional: true
- use-composed-ref@1.4.0:
- resolution: {integrity: sha512-djviaxuOOh7wkj0paeO1Q/4wMZ8Zrnag5H6yBvzN7AKKe8beOaED9SF5/ByLqsku8NP4zQqsvM2u3ew/tJK8/w==}
- peerDependencies:
- '@types/react': '*'
- react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
- peerDependenciesMeta:
- '@types/react':
- optional: true
-
- use-isomorphic-layout-effect@1.2.1:
- resolution: {integrity: sha512-tpZZ+EX0gaghDAiFR37hj5MgY6ZN55kLiPkJsKxBMZ6GZdOSPJXiOzPM984oPYZ5AnehYx5WQp1+ME8I/P/pRA==}
- peerDependencies:
- '@types/react': '*'
- react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
- peerDependenciesMeta:
- '@types/react':
- optional: true
-
- use-latest@1.3.0:
- resolution: {integrity: sha512-mhg3xdm9NaM8q+gLT8KryJPnRFOz1/5XPBhmDEVZK1webPzDjrPk7f/mbpeLqTgB9msytYWANxgALOCJKnLvcQ==}
- peerDependencies:
- '@types/react': '*'
- react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
- peerDependenciesMeta:
- '@types/react':
- optional: true
-
use-sidecar@1.1.3:
resolution: {integrity: sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==}
engines: {node: '>=10'}
@@ -8277,12 +6883,6 @@ packages:
resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
engines: {node: '>= 0.8'}
- vaul@1.1.2:
- resolution: {integrity: sha512-ZFkClGpWyI2WUQjdLJ/BaGuV6AVQiJ3uELGk3OYtP+B6yCO7Cmn9vPFXVJkRaGkOJu3m8bQMgtyzNHixULceQA==}
- peerDependencies:
- react: ^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc
- react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0.0 || ^19.0.0-rc
-
vfile-location@5.0.3:
resolution: {integrity: sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg==}
@@ -8295,8 +6895,8 @@ packages:
victory-vendor@36.9.2:
resolution: {integrity: sha512-PnpQQMuxlwYdocC8fIJqVXvkeViHYzotI+NJrCuav0ZYFoq912ZHBk3mCeuj+5/VpodOjPe1z0Fk2ihgzlXqjQ==}
- vite@7.3.2:
- resolution: {integrity: sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==}
+ vite@7.3.5:
+ resolution: {integrity: sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==}
engines: {node: ^20.19.0 || >=22.12.0}
hasBin: true
peerDependencies:
@@ -8365,7 +6965,7 @@ packages:
'@vitest/ui': 4.1.8
happy-dom: '*'
jsdom: '*'
- vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+ vite: 7.3.5
peerDependenciesMeta:
'@edge-runtime/vm':
optional: true
@@ -8401,8 +7001,8 @@ packages:
resolution: {integrity: sha512-3hu+tD8YzSLGuFYtPRb48vdhKMi0KQV5sn+uWr8+7dMEq/2G/dtLrdDinkLjqq5TIbIBjYJ4Ax/n3YiaW7QM8A==}
engines: {node: 20 || >=22}
- watchpack@2.5.1:
- resolution: {integrity: sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg==}
+ watchpack@2.5.2:
+ resolution: {integrity: sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==}
engines: {node: '>=10.13.0'}
web-namespaces@2.0.1:
@@ -8415,17 +7015,10 @@ packages:
resolution: {integrity: sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==}
engines: {node: '>=20'}
- webpack-sources@3.3.3:
- resolution: {integrity: sha512-yd1RBzSGanHkitROoPFd6qsrxt+oFhg/129YzheDGqeustzX0vTZJZsSsQjVQC4yzBQ56K55XU8gaNCtIzOnTg==}
+ webpack-sources@3.5.1:
+ resolution: {integrity: sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw==}
engines: {node: '>=10.13.0'}
- webpack-sources@3.4.1:
- resolution: {integrity: sha512-eACpxRN02yaawnt+uUNIF7Qje6A9zArxBbcAJjK1PK3S9Ycg5jIuJ8pW4q8EMnwNZCEGltcjkRx1QzOxOkKD8A==}
- engines: {node: '>=10.13.0'}
-
- webpack-virtual-modules@0.5.0:
- resolution: {integrity: sha512-kyDivFZ7ZM0BVOUteVbDFhlRt7Ah/CSPwJdi8hBpkK7QLumUqdLtVfm/PX/hkcnrvr0i77fO5+TjZ94Pe+C9iw==}
-
webpack@5.104.1:
resolution: {integrity: sha512-Qphch25abbMNtekmEGJmeRUhLDbe+QfiWTiqpKYkpCOWY64v9eyl+KRRLmqOFA2AvKPpc9DC6+u2n76tQLBoaA==}
engines: {node: '>=10.13.0'}
@@ -8488,27 +7081,11 @@ packages:
resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
engines: {node: '>=10'}
- wrap-ansi@8.1.0:
- resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
- engines: {node: '>=12'}
-
wrappy@1.0.2:
resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
- ws@8.19.0:
- resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==}
- engines: {node: '>=10.0.0'}
- peerDependencies:
- bufferutil: ^4.0.1
- utf-8-validate: '>=5.0.2'
- peerDependenciesMeta:
- bufferutil:
- optional: true
- utf-8-validate:
- optional: true
-
- ws@8.20.1:
- resolution: {integrity: sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==}
+ ws@8.21.0:
+ resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
engines: {node: '>=10.0.0'}
peerDependencies:
bufferutil: ^4.0.1
@@ -8530,10 +7107,6 @@ packages:
xmlchars@2.2.0:
resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
- xtend@4.0.2:
- resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
- engines: {node: '>=0.4'}
-
y18n@5.0.8:
resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
engines: {node: '>=10'}
@@ -8649,11 +7222,25 @@ snapshots:
package-manager-detector: 1.6.0
tinyexec: 1.1.2
- '@apm-js-collab/code-transformer@0.8.2': {}
-
- '@apm-js-collab/tracing-hooks@0.3.1':
+ '@apm-js-collab/code-transformer-bundler-plugins@0.5.0':
dependencies:
- '@apm-js-collab/code-transformer': 0.8.2
+ '@apm-js-collab/code-transformer': 0.15.0
+ es-module-lexer: 2.3.0
+ magic-string: 0.30.21
+ module-details-from-path: 1.0.4
+
+ '@apm-js-collab/code-transformer@0.15.0':
+ dependencies:
+ '@types/estree': 1.0.9
+ astring: 1.9.0
+ esquery: 1.7.0
+ meriyah: 6.1.4
+ semifies: 1.0.0
+ source-map: 0.6.1
+
+ '@apm-js-collab/tracing-hooks@0.10.1':
+ dependencies:
+ '@apm-js-collab/code-transformer': 0.15.0
debug: 4.4.3
module-details-from-path: 1.0.4
transitivePeerDependencies:
@@ -9197,31 +7784,25 @@ snapshots:
'@aws/lambda-invoke-store@0.2.4': {}
- '@babel/code-frame@7.28.6':
+ '@babel/code-frame@7.29.7':
dependencies:
- '@babel/helper-validator-identifier': 7.28.5
+ '@babel/helper-validator-identifier': 7.29.7
js-tokens: 4.0.0
picocolors: 1.1.1
- '@babel/code-frame@7.29.0':
- dependencies:
- '@babel/helper-validator-identifier': 7.28.5
- js-tokens: 4.0.0
- picocolors: 1.1.1
+ '@babel/compat-data@7.29.7': {}
- '@babel/compat-data@7.28.6': {}
-
- '@babel/core@7.28.6':
+ '@babel/core@7.29.7':
dependencies:
- '@babel/code-frame': 7.28.6
- '@babel/generator': 7.28.6
- '@babel/helper-compilation-targets': 7.28.6
- '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.6)
- '@babel/helpers': 7.28.6
- '@babel/parser': 7.28.6
- '@babel/template': 7.28.6
- '@babel/traverse': 7.28.6
- '@babel/types': 7.28.6
+ '@babel/code-frame': 7.29.7
+ '@babel/generator': 7.29.7
+ '@babel/helper-compilation-targets': 7.29.7
+ '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+ '@babel/helpers': 7.29.7
+ '@babel/parser': 7.29.7
+ '@babel/template': 7.29.7
+ '@babel/traverse': 7.29.7
+ '@babel/types': 7.29.7
'@jridgewell/remapping': 2.3.5
convert-source-map: 2.0.0
debug: 4.4.3
@@ -9231,100 +7812,91 @@ snapshots:
transitivePeerDependencies:
- supports-color
- '@babel/generator@7.28.6':
+ '@babel/generator@7.29.7':
dependencies:
- '@babel/parser': 7.29.3
- '@babel/types': 7.29.0
+ '@babel/parser': 7.29.7
+ '@babel/types': 7.29.7
'@jridgewell/gen-mapping': 0.3.13
'@jridgewell/trace-mapping': 0.3.31
jsesc: 3.1.0
- '@babel/helper-compilation-targets@7.28.6':
+ '@babel/helper-compilation-targets@7.29.7':
dependencies:
- '@babel/compat-data': 7.28.6
- '@babel/helper-validator-option': 7.27.1
- browserslist: 4.28.1
+ '@babel/compat-data': 7.29.7
+ '@babel/helper-validator-option': 7.29.7
+ browserslist: 4.28.2
lru-cache: 5.1.1
semver: 6.3.1
- '@babel/helper-globals@7.28.0': {}
+ '@babel/helper-globals@7.29.7': {}
- '@babel/helper-module-imports@7.28.6':
+ '@babel/helper-module-imports@7.29.7':
dependencies:
- '@babel/traverse': 7.28.6
- '@babel/types': 7.29.0
+ '@babel/traverse': 7.29.7
+ '@babel/types': 7.29.7
transitivePeerDependencies:
- supports-color
- '@babel/helper-module-transforms@7.28.6(@babel/core@7.28.6)':
+ '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
dependencies:
- '@babel/core': 7.28.6
- '@babel/helper-module-imports': 7.28.6
- '@babel/helper-validator-identifier': 7.28.5
- '@babel/traverse': 7.28.6
+ '@babel/core': 7.29.7
+ '@babel/helper-module-imports': 7.29.7
+ '@babel/helper-validator-identifier': 7.29.7
+ '@babel/traverse': 7.29.7
transitivePeerDependencies:
- supports-color
'@babel/helper-plugin-utils@7.28.6': {}
- '@babel/helper-string-parser@7.27.1': {}
+ '@babel/helper-string-parser@7.29.7': {}
- '@babel/helper-validator-identifier@7.28.5': {}
+ '@babel/helper-validator-identifier@7.29.7': {}
- '@babel/helper-validator-option@7.27.1': {}
+ '@babel/helper-validator-option@7.29.7': {}
- '@babel/helpers@7.28.6':
+ '@babel/helpers@7.29.7':
dependencies:
- '@babel/template': 7.28.6
- '@babel/types': 7.29.0
+ '@babel/template': 7.29.7
+ '@babel/types': 7.29.7
- '@babel/parser@7.28.6':
+ '@babel/parser@7.29.7':
dependencies:
- '@babel/types': 7.28.6
+ '@babel/types': 7.29.7
- '@babel/parser@7.29.3':
+ '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.29.7)':
dependencies:
- '@babel/types': 7.29.0
-
- '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.28.6)':
- dependencies:
- '@babel/core': 7.28.6
+ '@babel/core': 7.29.7
'@babel/helper-plugin-utils': 7.28.6
- '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.28.6)':
+ '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.29.7)':
dependencies:
- '@babel/core': 7.28.6
+ '@babel/core': 7.29.7
'@babel/helper-plugin-utils': 7.28.6
'@babel/runtime@7.28.6': {}
- '@babel/template@7.28.6':
+ '@babel/template@7.29.7':
dependencies:
- '@babel/code-frame': 7.28.6
- '@babel/parser': 7.29.3
- '@babel/types': 7.29.0
+ '@babel/code-frame': 7.29.7
+ '@babel/parser': 7.29.7
+ '@babel/types': 7.29.7
- '@babel/traverse@7.28.6':
+ '@babel/traverse@7.29.7':
dependencies:
- '@babel/code-frame': 7.28.6
- '@babel/generator': 7.28.6
- '@babel/helper-globals': 7.28.0
- '@babel/parser': 7.29.3
- '@babel/template': 7.28.6
- '@babel/types': 7.29.0
+ '@babel/code-frame': 7.29.7
+ '@babel/generator': 7.29.7
+ '@babel/helper-globals': 7.29.7
+ '@babel/parser': 7.29.7
+ '@babel/template': 7.29.7
+ '@babel/types': 7.29.7
debug: 4.4.3
transitivePeerDependencies:
- supports-color
- '@babel/types@7.28.6':
+ '@babel/types@7.29.7':
dependencies:
- '@babel/helper-string-parser': 7.27.1
- '@babel/helper-validator-identifier': 7.28.5
-
- '@babel/types@7.29.0':
- dependencies:
- '@babel/helper-string-parser': 7.27.1
- '@babel/helper-validator-identifier': 7.28.5
+ '@babel/helper-string-parser': 7.29.7
+ '@babel/helper-validator-identifier': 7.29.7
'@bcoe/v8-coverage@1.0.2': {}
@@ -9348,13 +7920,20 @@ snapshots:
'@codemirror/language': 6.12.2
'@codemirror/state': 6.6.0
'@codemirror/view': 6.40.0
- '@lezer/common': 1.5.1
+ '@lezer/common': 1.5.2
+
+ '@codemirror/commands@6.10.4':
+ dependencies:
+ '@codemirror/language': 6.12.2
+ '@codemirror/state': 6.7.1
+ '@codemirror/view': 6.40.0
+ '@lezer/common': 1.5.2
'@codemirror/language@6.12.2':
dependencies:
'@codemirror/state': 6.6.0
'@codemirror/view': 6.40.0
- '@lezer/common': 1.5.1
+ '@lezer/common': 1.5.2
'@lezer/highlight': 1.2.3
'@lezer/lr': 1.4.8
style-mod: 4.1.3
@@ -9363,18 +7942,22 @@ snapshots:
dependencies:
'@codemirror/state': 6.6.0
'@codemirror/view': 6.40.0
- crelt: 1.0.6
+ crelt: 1.0.7
'@codemirror/search@6.6.0':
dependencies:
'@codemirror/state': 6.6.0
'@codemirror/view': 6.40.0
- crelt: 1.0.6
+ crelt: 1.0.7
'@codemirror/state@6.6.0':
dependencies:
'@marijn/find-cluster-break': 1.0.2
+ '@codemirror/state@6.7.1':
+ dependencies:
+ '@marijn/find-cluster-break': 1.0.3
+
'@codemirror/theme-one-dark@6.1.3':
dependencies:
'@codemirror/language': 6.12.2
@@ -9430,11 +8013,6 @@ snapshots:
tslib: 2.8.1
optional: true
- '@emnapi/runtime@1.8.1':
- dependencies:
- tslib: 2.8.1
- optional: true
-
'@emnapi/wasi-threads@1.1.0':
dependencies:
tslib: 2.8.1
@@ -9549,7 +8127,7 @@ snapshots:
globals: 14.0.0
ignore: 5.3.2
import-fresh: 3.3.1
- js-yaml: 4.1.1
+ js-yaml: 4.3.0
minimatch: 3.1.4
strip-json-comments: 3.1.1
transitivePeerDependencies:
@@ -9592,1055 +8170,9 @@ snapshots:
'@floating-ui/utils@0.2.10': {}
- '@formatjs/ecma402-abstract@2.3.4':
+ '@hono/node-server@1.19.14(hono@4.12.28)':
dependencies:
- '@formatjs/fast-memoize': 2.2.7
- '@formatjs/intl-localematcher': 0.6.1
- decimal.js: 10.6.0
- tslib: 2.8.1
-
- '@formatjs/fast-memoize@2.2.7':
- dependencies:
- tslib: 2.8.1
-
- '@formatjs/icu-messageformat-parser@2.11.2':
- dependencies:
- '@formatjs/ecma402-abstract': 2.3.4
- '@formatjs/icu-skeleton-parser': 1.8.14
- tslib: 2.8.1
-
- '@formatjs/icu-skeleton-parser@1.8.14':
- dependencies:
- '@formatjs/ecma402-abstract': 2.3.4
- tslib: 2.8.1
-
- '@formatjs/intl-localematcher@0.6.1':
- dependencies:
- tslib: 2.8.1
-
- '@heroui/accordion@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-accordion': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tree': 3.9.2(react@19.2.7)
- '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/alert@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/aria-utils@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.7(react@19.2.7)
- '@react-types/overlays': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@heroui/theme'
- - framer-motion
-
- '@heroui/autocomplete@2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/combobox': 3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/combobox': 3.11.1(react@19.2.7)
- '@react-types/combobox': 3.13.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@types/react'
-
- '@heroui/avatar@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-image': 2.1.12(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/badge@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/breadcrumbs@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/breadcrumbs': 3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/button@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/calendar@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@internationalized/date': 3.10.0
- '@react-aria/calendar': 3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/calendar': 3.8.4(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/calendar': 3.7.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- scroll-into-view-if-needed: 3.0.10
-
- '@heroui/card@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/checkbox@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/checkbox': 3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/checkbox': 3.7.1(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- '@react-types/checkbox': 3.10.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/chip@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/code@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/date-input@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@internationalized/date': 3.10.0
- '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/datepicker': 3.15.1(react@19.2.7)
- '@react-types/datepicker': 3.13.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/date-picker@2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@internationalized/date': 3.10.0
- '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/datepicker': 3.15.1(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/datepicker': 3.13.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/divider@2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/dom-animation@2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))':
- dependencies:
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-
- '@heroui/drawer@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/dropdown@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/menu': 3.9.7(react@19.2.7)
- '@react-types/menu': 3.10.4(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/form@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-stately/form': 3.2.1(react@19.2.7)
- '@react-types/form': 3.7.15(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/framer-utils@2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-measure': 2.1.8(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@heroui/theme'
-
- '@heroui/image@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-image': 2.1.12(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/input-otp@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-form-reset': 2.0.1(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.1(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/textfield': 3.12.5(react@19.2.7)
- input-otp: 1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/input@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/textfield': 3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/textfield': 3.12.5(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- react-textarea-autosize: 8.5.9(@types/react@19.2.17)(react@19.2.7)
- transitivePeerDependencies:
- - '@types/react'
-
- '@heroui/kbd@2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/link@2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-link': 2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/link': 3.6.4(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/listbox@2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/list': 3.13.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/menu@2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tree': 3.9.2(react@19.2.7)
- '@react-types/menu': 3.10.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/modal@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-aria-modal-overlay': 2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-disclosure': 2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-draggable': 2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-viewport-size': 2.0.1(react@19.2.7)
- '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/overlays': 3.6.19(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/navbar@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-resize': 2.1.8(react@19.2.7)
- '@heroui/use-scroll-position': 2.1.8(react@19.2.7)
- '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/number-input@2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/numberfield': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/numberfield': 3.10.1(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/numberfield': 3.8.14(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/pagination@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-intersection-observer': 2.2.14(react@19.2.7)
- '@heroui/use-pagination': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- scroll-into-view-if-needed: 3.0.10
-
- '@heroui/popover@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/overlays': 3.6.19(react@19.2.7)
- '@react-types/overlays': 3.9.1(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/progress@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
- '@react-aria/progress': 3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/progress': 3.5.15(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/radio@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/radio': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/radio': 3.11.1(react@19.2.7)
- '@react-types/radio': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/react-rsc-utils@2.1.9(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/react-utils@2.1.13(react@19.2.7)':
- dependencies:
- '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- react: 19.2.7
-
- '@heroui/react@2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)':
- dependencies:
- '@heroui/accordion': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/alert': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/autocomplete': 2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/badge': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/breadcrumbs': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/card': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/chip': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/code': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/date-picker': 2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/drawer': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/dropdown': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/image': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/input-otp': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/kbd': 2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/link': 2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/navbar': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/number-input': 2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/pagination': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/progress': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/radio': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/select': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/skeleton': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/slider': 2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/snippet': 2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/switch': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/table': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/tabs': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/toast': 2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/user': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@types/react'
- - tailwindcss
-
- '@heroui/ripple@2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/scroll-shadow@2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-data-scroll-overflow': 2.2.12(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/select@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-aria-multiselect': 2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-form-reset': 2.0.1(react@19.2.7)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/shared-icons@2.1.10(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/shared-utils@2.1.11': {}
-
- '@heroui/skeleton@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/slider@2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/slider': 3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/slider': 3.7.1(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/snippet@2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-clipboard': 2.1.9(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/spacer@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/spinner@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - framer-motion
-
- '@heroui/switch@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/switch': 3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/system-rsc@2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)':
- dependencies:
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-types/shared': 3.26.0(react@19.2.7)
- clsx: 1.2.1
- react: 19.2.7
-
- '@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@heroui/theme'
-
- '@heroui/table@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/table': 3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/table': 3.15.0(react@19.2.7)
- '@react-stately/virtualizer': 4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/grid': 3.3.5(react@19.2.7)
- '@react-types/table': 3.13.3(react@19.2.7)
- '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/tabs@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/tabs': 3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tabs': 3.8.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- scroll-into-view-if-needed: 3.0.10
-
- '@heroui/theme@2.4.22(tailwindcss@4.1.18)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- clsx: 1.2.1
- color: 4.2.3
- color2k: 2.0.3
- deepmerge: 4.3.1
- flat: 5.0.2
- tailwind-merge: 3.3.1
- tailwind-variants: 3.1.1(tailwind-merge@3.3.1)(tailwindcss@4.1.18)
- tailwindcss: 4.1.18
-
- '@heroui/toast@2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-icons': 2.1.10(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/toast': 3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toast': 3.1.2(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/tooltip@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
- '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/tooltip': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tooltip': 3.5.7(react@19.2.7)
- '@react-types/overlays': 3.9.1(react@19.2.7)
- '@react-types/tooltip': 3.4.20(react@19.2.7)
- framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/use-aria-accordion@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tree': 3.9.2(react@19.2.7)
- '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-aria-button@2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-aria-link@2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/link': 3.6.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-aria-modal-overlay@2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/overlays': 3.6.19(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/use-aria-multiselect@2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.1(react@19.2.7)
- '@react-stately/list': 3.13.0(react@19.2.7)
- '@react-stately/menu': 3.9.7(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/overlays': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/use-aria-overlay@2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@heroui/use-callback-ref@2.1.8(react@19.2.7)':
- dependencies:
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- react: 19.2.7
-
- '@heroui/use-clipboard@2.1.9(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-data-scroll-overflow@2.2.12(react@19.2.7)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- react: 19.2.7
-
- '@heroui/use-disclosure@2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-draggable@2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-form-reset@2.0.1(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-image@2.1.12(react@19.2.7)':
- dependencies:
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
- react: 19.2.7
-
- '@heroui/use-intersection-observer@2.2.14(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-is-mobile@2.2.12(react@19.2.7)':
- dependencies:
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- react: 19.2.7
-
- '@heroui/use-is-mounted@2.1.8(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-measure@2.1.8(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-pagination@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/shared-utils': 2.1.11
- '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- transitivePeerDependencies:
- - react-dom
-
- '@heroui/use-resize@2.1.8(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-safe-layout-effect@2.1.8(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-scroll-position@2.1.8(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/use-viewport-size@2.0.1(react@19.2.7)':
- dependencies:
- react: 19.2.7
-
- '@heroui/user@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/react-utils': 2.1.13(react@19.2.7)
- '@heroui/shared-utils': 2.1.11
- '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@hono/node-server@1.19.14(hono@4.12.21)':
- dependencies:
- hono: 4.12.21
+ hono: 4.12.28
'@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.7))':
dependencies:
@@ -10820,7 +8352,7 @@ snapshots:
'@img/sharp-wasm32@0.33.5':
dependencies:
- '@emnapi/runtime': 1.8.1
+ '@emnapi/runtime': 1.10.0
optional: true
'@img/sharp-wasm32@0.34.5':
@@ -10870,32 +8402,6 @@ snapshots:
optionalDependencies:
'@types/node': 24.10.8
- '@internationalized/date@3.10.0':
- dependencies:
- '@swc/helpers': 0.5.21
-
- '@internationalized/message@3.1.8':
- dependencies:
- '@swc/helpers': 0.5.21
- intl-messageformat: 10.7.16
-
- '@internationalized/number@3.6.5':
- dependencies:
- '@swc/helpers': 0.5.21
-
- '@internationalized/string@3.2.7':
- dependencies:
- '@swc/helpers': 0.5.21
-
- '@isaacs/cliui@8.0.2':
- dependencies:
- string-width: 5.1.2
- string-width-cjs: string-width@4.2.3
- strip-ansi: 7.1.2
- strip-ansi-cjs: strip-ansi@6.0.1
- wrap-ansi: 8.1.0
- wrap-ansi-cjs: wrap-ansi@7.0.0
-
'@jridgewell/gen-mapping@0.3.13':
dependencies:
'@jridgewell/sourcemap-codec': 1.5.5
@@ -10920,17 +8426,17 @@ snapshots:
'@jridgewell/resolve-uri': 3.1.2
'@jridgewell/sourcemap-codec': 1.5.5
- '@langchain/aws@1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))':
+ '@langchain/aws@1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))':
dependencies:
'@aws-sdk/client-bedrock-agent-runtime': 3.1045.0
'@aws-sdk/client-bedrock-runtime': 3.1045.0
'@aws-sdk/client-kendra': 3.1045.0
'@aws-sdk/credential-provider-node': 3.972.39
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
transitivePeerDependencies:
- aws-crt
- '@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)':
+ '@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)':
dependencies:
'@cfworker/json-schema': 4.1.1
'@standard-schema/spec': 1.1.0
@@ -10938,7 +8444,7 @@ snapshots:
camelcase: 6.3.0
decamelize: 1.2.0
js-tiktoken: 1.0.21
- langsmith: 0.6.3(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
mustache: 4.2.0
p-queue: 6.6.2
zod: 4.4.3
@@ -10949,14 +8455,14 @@ snapshots:
- openai
- ws
- '@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))':
+ '@langchain/langgraph-checkpoint@1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))':
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
uuid: 11.1.1
- '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)':
+ '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)':
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
'@langchain/protocol': 0.0.15
'@types/json-schema': 7.0.15
p-queue: 9.2.0
@@ -10972,11 +8478,11 @@ snapshots:
- openai
- ws
- '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
+ '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
- '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
- '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+ '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
+ '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)
'@langchain/protocol': 0.0.15
'@standard-schema/spec': 1.1.0
uuid: 11.1.1
@@ -10994,10 +8500,10 @@ snapshots:
- vue
- ws
- '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
+ '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
- '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+ '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
'@modelcontextprotocol/sdk': 1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)
debug: 4.4.3
zod: 4.4.3
@@ -11007,48 +8513,48 @@ snapshots:
- '@cfworker/json-schema'
- supports-color
- '@langchain/openai@1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(ws@8.20.1)':
+ '@langchain/openai@1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(ws@8.21.0)':
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
js-tiktoken: 1.0.21
- openai: 6.37.0(ws@8.20.1)(zod@4.4.3)
+ openai: 6.37.0(ws@8.21.0)(zod@4.4.3)
zod: 4.4.3
transitivePeerDependencies:
- ws
'@langchain/protocol@0.0.15': {}
- '@lezer/common@1.5.1': {}
-
'@lezer/common@1.5.2': {}
'@lezer/highlight@1.2.3':
dependencies:
- '@lezer/common': 1.5.1
+ '@lezer/common': 1.5.2
'@lezer/lr@1.4.8':
dependencies:
- '@lezer/common': 1.5.1
+ '@lezer/common': 1.5.2
'@marijn/find-cluster-break@1.0.2': {}
+ '@marijn/find-cluster-break@1.0.3': {}
+
'@mermaid-js/parser@1.1.1':
dependencies:
'@chevrotain/types': 11.1.2
'@modelcontextprotocol/sdk@1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)':
dependencies:
- '@hono/node-server': 1.19.14(hono@4.12.21)
+ '@hono/node-server': 1.19.14(hono@4.12.28)
ajv: 8.18.0
ajv-formats: 3.0.1(ajv@8.18.0)
content-type: 1.0.5
cors: 2.8.5
cross-spawn: 7.0.6
eventsource: 3.0.7
- eventsource-parser: 3.0.6
+ eventsource-parser: 3.1.0
express: 5.2.1
express-rate-limit: 8.5.1(express@5.2.1)
- hono: 4.12.21
+ hono: 4.12.28
jose: 6.1.3
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
@@ -11108,9 +8614,9 @@ snapshots:
'@next/swc-win32-x64-msvc@16.2.9':
optional: true
- '@next/third-parties@16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
+ '@next/third-parties@16.2.9(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
dependencies:
- next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ next: 16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
react: 19.2.7
third-party-capital: 1.0.20
@@ -11139,241 +8645,48 @@ snapshots:
'@open-draft/until@2.1.0': {}
- '@opentelemetry/api-logs@0.208.0':
+ '@opentelemetry/api-logs@0.220.0':
dependencies:
- '@opentelemetry/api': 1.9.0
+ '@opentelemetry/api': 1.9.1
- '@opentelemetry/api@1.9.0': {}
+ '@opentelemetry/api@1.9.1': {}
- '@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0)':
+ '@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1)':
dependencies:
- '@opentelemetry/api': 1.9.0
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/semantic-conventions': 1.43.0
- '@opentelemetry/core@2.2.0(@opentelemetry/api@1.9.0)':
+ '@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1)':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/semantic-conventions': 1.39.0
-
- '@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/semantic-conventions': 1.39.0
-
- '@opentelemetry/instrumentation-amqplib@0.55.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-connect@0.52.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@types/connect': 3.4.38
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-dataloader@0.26.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-express@0.57.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-fs@0.28.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-generic-pool@0.52.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-graphql@0.56.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-hapi@0.55.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-http@0.208.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.2.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- forwarded-parse: 2.1.2
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-ioredis@0.56.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/redis-common': 0.38.2
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-kafkajs@0.18.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-knex@0.53.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-koa@0.57.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-lru-memoizer@0.53.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-mongodb@0.61.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-mongoose@0.55.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-mysql2@0.55.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@opentelemetry/sql-common': 0.41.2(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-mysql@0.54.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@types/mysql': 2.15.27
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-pg@0.61.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@opentelemetry/sql-common': 0.41.2(@opentelemetry/api@1.9.0)
- '@types/pg': 8.15.6
- '@types/pg-pool': 2.0.6
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-redis@0.57.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/redis-common': 0.38.2
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-tedious@0.27.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@types/tedious': 4.0.14
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation-undici@0.19.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- transitivePeerDependencies:
- - supports-color
-
- '@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/api-logs': 0.208.0
- import-in-the-middle: 2.0.0
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/api-logs': 0.220.0
+ import-in-the-middle: 3.3.1
require-in-the-middle: 8.0.1
transitivePeerDependencies:
- supports-color
- '@opentelemetry/redis-common@0.38.2': {}
-
- '@opentelemetry/resources@2.4.0(@opentelemetry/api@1.9.0)':
+ '@opentelemetry/resources@2.9.0(@opentelemetry/api@1.9.1)':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/core': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/semantic-conventions': 1.43.0
- '@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0)':
+ '@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1)':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/resources': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/core': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/resources': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/sdk-trace': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/semantic-conventions': 1.43.0
- '@opentelemetry/semantic-conventions@1.39.0': {}
-
- '@opentelemetry/sql-common@0.41.2(@opentelemetry/api@1.9.0)':
+ '@opentelemetry/sdk-trace@2.9.0(@opentelemetry/api@1.9.1)':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/core': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/resources': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/semantic-conventions': 1.43.0
+
+ '@opentelemetry/semantic-conventions@1.43.0': {}
'@oxc-parser/binding-android-arm-eabi@0.121.0':
optional: true
@@ -11509,9 +8822,6 @@ snapshots:
'@panva/hkdf@1.2.1': {}
- '@pkgjs/parseargs@0.11.0':
- optional: true
-
'@pkgr/core@0.2.9': {}
'@playwright/test@1.56.1':
@@ -11520,19 +8830,14 @@ snapshots:
'@polka/url@1.0.0-next.29': {}
- '@prisma/instrumentation@6.19.0(@opentelemetry/api@1.9.0)':
- dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- transitivePeerDependencies:
- - supports-color
-
'@radix-ui/number@1.1.1': {}
'@radix-ui/primitive@1.1.2': {}
'@radix-ui/primitive@1.1.3': {}
+ '@radix-ui/primitive@1.1.4': {}
+
'@radix-ui/react-alert-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@radix-ui/primitive': 1.1.2
@@ -11619,6 +8924,12 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-compose-refs@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.7)':
dependencies:
react: 19.2.7
@@ -11631,6 +8942,12 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-context@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@radix-ui/primitive': 1.1.2
@@ -11876,6 +9193,15 @@ snapshots:
'@types/react': 19.2.17
'@types/react-dom': 19.2.3(@types/react@19.2.17)
+ '@radix-ui/react-primitive@2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+ dependencies:
+ '@radix-ui/react-slot': 1.2.5(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ react-dom: 19.2.7(react@19.2.7)
+ optionalDependencies:
+ '@types/react': 19.2.17
+ '@types/react-dom': 19.2.3(@types/react@19.2.17)
+
'@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
@@ -12007,6 +9333,28 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-slot@1.2.5(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
+ '@radix-ui/react-switch@1.3.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+ dependencies:
+ '@radix-ui/primitive': 1.1.4
+ '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-primitive': 2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ react-dom: 19.2.7(react@19.2.7)
+ optionalDependencies:
+ '@types/react': 19.2.17
+ '@types/react-dom': 19.2.3(@types/react@19.2.17)
+
'@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@radix-ui/primitive': 1.1.3
@@ -12077,6 +9425,14 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-use-controllable-state@1.2.3(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.7)':
dependencies:
'@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
@@ -12084,6 +9440,13 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-use-effect-event@0.0.3(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.17)(react@19.2.7)':
dependencies:
'@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
@@ -12104,12 +9467,24 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-use-layout-effect@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-use-previous@1.1.1(@types/react@19.2.17)(react@19.2.7)':
dependencies:
react: 19.2.7
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-use-previous@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-use-rect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
dependencies:
'@radix-ui/rect': 1.1.1
@@ -12124,6 +9499,13 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
+ '@radix-ui/react-use-size@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+ dependencies:
+ '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ react: 19.2.7
+ optionalDependencies:
+ '@types/react': 19.2.17
+
'@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -12135,222 +9517,6 @@ snapshots:
'@radix-ui/rect@1.1.1': {}
- '@react-aria/breadcrumbs@3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/link': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/button@3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/toolbar': 3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/calendar@3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/live-announcer': 3.4.4
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/calendar': 3.8.4(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/calendar': 3.7.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/checkbox@3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/checkbox': 3.7.1(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- '@react-types/checkbox': 3.10.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/combobox@3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/listbox': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/live-announcer': 3.4.4
- '@react-aria/menu': 3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/combobox': 3.11.1(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/combobox': 3.13.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/datepicker@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@internationalized/number': 3.6.5
- '@internationalized/string': 3.2.7
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/datepicker': 3.15.1(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/calendar': 3.8.1(react@19.2.7)
- '@react-types/datepicker': 3.13.2(react@19.2.7)
- '@react-types/dialog': 3.5.22(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/dialog@3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/dialog': 3.5.22(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/focus@3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- clsx: 2.1.1
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/focus@3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- clsx: 2.1.1
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/form@3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/form@3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/grid@3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/live-announcer': 3.4.4
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/grid': 3.11.7(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-types/checkbox': 3.10.2(react@19.2.7)
- '@react-types/grid': 3.3.6(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/i18n@3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@internationalized/message': 3.1.8
- '@internationalized/number': 3.6.5
- '@internationalized/string': 3.2.7
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/i18n@3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@internationalized/message': 3.1.8
- '@internationalized/number': 3.6.5
- '@internationalized/string': 3.2.7
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/i18n@3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@internationalized/message': 3.1.8
- '@internationalized/number': 3.6.5
- '@internationalized/string': 3.2.7
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/interactions@3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/flags': 3.1.2
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
'@react-aria/interactions@3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@react-aria/ssr': 3.9.10(react@19.2.7)
@@ -12361,233 +9527,6 @@ snapshots:
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
- '@react-aria/label@3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/label@3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/landmark@3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- use-sync-external-store: 1.6.0(react@19.2.7)
-
- '@react-aria/link@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/link': 3.6.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/listbox@3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/list': 3.13.0(react@19.2.7)
- '@react-types/listbox': 3.7.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/listbox@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/list': 3.13.2(react@19.2.7)
- '@react-types/listbox': 3.7.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/live-announcer@3.4.4':
- dependencies:
- '@swc/helpers': 0.5.21
-
- '@react-aria/menu@3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/menu': 3.9.9(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/tree': 3.9.2(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/menu': 3.10.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/menu@3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/menu': 3.9.9(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/tree': 3.9.4(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/menu': 3.10.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/numberfield@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/numberfield': 3.10.1(react@19.2.7)
- '@react-types/button': 3.14.0(react@19.2.7)
- '@react-types/numberfield': 3.8.14(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/overlays@3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/overlays': 3.6.19(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/overlays@3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/progress@3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/progress': 3.5.15(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/radio@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/radio': 3.11.1(react@19.2.7)
- '@react-types/radio': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/selection@3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/selection@3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/slider@3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/slider': 3.7.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/slider': 3.8.2(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/spinbutton@3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/live-announcer': 3.4.4
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
'@react-aria/ssr@3.9.10(react@19.2.7)':
dependencies:
'@swc/helpers': 0.5.18
@@ -12598,133 +9537,6 @@ snapshots:
'@swc/helpers': 0.5.18
react: 19.2.7
- '@react-aria/switch@3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toggle': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/switch': 3.5.15(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/table@3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/grid': 3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/live-announcer': 3.4.4
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/flags': 3.1.2
- '@react-stately/table': 3.15.0(react@19.2.7)
- '@react-types/checkbox': 3.10.2(react@19.2.7)
- '@react-types/grid': 3.3.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/table': 3.13.3(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/tabs@3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tabs': 3.8.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/tabs': 3.3.20(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/textfield@3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/textfield': 3.12.5(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/textfield@3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/textfield': 3.12.6(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/toast@3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/landmark': 3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toast': 3.1.2(react@19.2.7)
- '@react-types/button': 3.14.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/toggle@3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/toggle': 3.9.3(react@19.2.7)
- '@react-types/checkbox': 3.10.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/toolbar@3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/tooltip@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-stately/tooltip': 3.5.7(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/tooltip': 3.4.20(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/utils@3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/ssr': 3.9.10(react@19.2.7)
- '@react-stately/flags': 3.1.2
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- clsx: 2.1.1
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
'@react-aria/utils@3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
dependencies:
'@react-aria/ssr': 3.9.10(react@19.2.7)
@@ -12746,265 +9558,10 @@ snapshots:
transitivePeerDependencies:
- react-dom
- '@react-aria/visually-hidden@3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.18
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-aria/visually-hidden@3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-stately/calendar@3.8.4(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/calendar': 3.7.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/checkbox@3.7.1(react@19.2.7)':
- dependencies:
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/checkbox': 3.10.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/collections@3.12.7(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/collections@3.12.8(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/combobox@3.11.1(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/list': 3.13.2(react@19.2.7)
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-stately/select': 3.9.0(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/combobox': 3.13.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/datepicker@3.15.1(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@internationalized/string': 3.2.7
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/datepicker': 3.13.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
'@react-stately/flags@3.1.2':
dependencies:
'@swc/helpers': 0.5.18
- '@react-stately/form@3.2.1(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/form@3.2.2(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/grid@3.11.7(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-types/grid': 3.3.6(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/list@3.13.0(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/list@3.13.2(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/menu@3.9.7(react@19.2.7)':
- dependencies:
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-types/menu': 3.10.4(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/menu@3.9.9(react@19.2.7)':
- dependencies:
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-types/menu': 3.10.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/numberfield@3.10.1(react@19.2.7)':
- dependencies:
- '@internationalized/number': 3.6.5
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/numberfield': 3.8.14(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/overlays@3.6.19(react@19.2.7)':
- dependencies:
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/overlays@3.6.21(react@19.2.7)':
- dependencies:
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/radio@3.11.1(react@19.2.7)':
- dependencies:
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/radio': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/select@3.9.0(react@19.2.7)':
- dependencies:
- '@react-stately/form': 3.2.2(react@19.2.7)
- '@react-stately/list': 3.13.2(react@19.2.7)
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/select': 3.12.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/selection@3.20.7(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/slider@3.7.1(react@19.2.7)':
- dependencies:
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/slider': 3.8.2(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/table@3.15.0(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/flags': 3.1.2
- '@react-stately/grid': 3.11.7(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/grid': 3.3.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/table': 3.13.3(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/tabs@3.8.5(react@19.2.7)':
- dependencies:
- '@react-stately/list': 3.13.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@react-types/tabs': 3.3.20(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/toast@3.1.2(react@19.2.7)':
- dependencies:
- '@swc/helpers': 0.5.21
- react: 19.2.7
- use-sync-external-store: 1.6.0(react@19.2.7)
-
- '@react-stately/toggle@3.9.1(react@19.2.7)':
- dependencies:
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/checkbox': 3.10.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/toggle@3.9.3(react@19.2.7)':
- dependencies:
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/checkbox': 3.10.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/tooltip@3.5.7(react@19.2.7)':
- dependencies:
- '@react-stately/overlays': 3.6.21(react@19.2.7)
- '@react-types/tooltip': 3.4.20(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/tree@3.9.2(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/utils': 3.10.8(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
- '@react-stately/tree@3.9.4(react@19.2.7)':
- dependencies:
- '@react-stately/collections': 3.12.8(react@19.2.7)
- '@react-stately/selection': 3.20.7(react@19.2.7)
- '@react-stately/utils': 3.11.0(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
-
'@react-stately/utils@3.10.8(react@19.2.7)':
dependencies:
'@swc/helpers': 0.5.18
@@ -13015,197 +9572,10 @@ snapshots:
'@swc/helpers': 0.5.18
react: 19.2.7
- '@react-stately/virtualizer@4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- '@swc/helpers': 0.5.21
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
- '@react-types/accordion@3.0.0-alpha.26(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/breadcrumbs@3.7.16(react@19.2.7)':
- dependencies:
- '@react-types/link': 3.6.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/button@3.14.0(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/button@3.14.1(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/calendar@3.7.4(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/calendar@3.8.1(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/checkbox@3.10.1(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/checkbox@3.10.2(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/combobox@3.13.8(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/datepicker@3.13.1(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-types/calendar': 3.8.1(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/datepicker@3.13.2(react@19.2.7)':
- dependencies:
- '@internationalized/date': 3.10.0
- '@react-types/calendar': 3.8.1(react@19.2.7)
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/dialog@3.5.22(react@19.2.7)':
- dependencies:
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/form@3.7.15(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/grid@3.3.5(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/grid@3.3.6(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/link@3.6.4(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/link@3.6.5(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/listbox@3.7.4(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/menu@3.10.4(react@19.2.7)':
- dependencies:
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/menu@3.10.5(react@19.2.7)':
- dependencies:
- '@react-types/overlays': 3.9.2(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/numberfield@3.8.14(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/overlays@3.9.1(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/overlays@3.9.2(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/progress@3.5.15(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/radio@3.9.1(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/select@3.12.0(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
'@react-types/shared@3.26.0(react@19.2.7)':
dependencies:
react: 19.2.7
- '@react-types/slider@3.8.2(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/switch@3.5.15(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/table@3.13.3(react@19.2.7)':
- dependencies:
- '@react-types/grid': 3.3.5(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/tabs@3.3.20(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/textfield@3.12.5(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/textfield@3.12.6(react@19.2.7)':
- dependencies:
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
- '@react-types/tooltip@3.4.20(react@19.2.7)':
- dependencies:
- '@react-types/overlays': 3.9.1(react@19.2.7)
- '@react-types/shared': 3.26.0(react@19.2.7)
- react: 19.2.7
-
'@rolldown/pluginutils@1.0.0-beta.53': {}
'@rollup/plugin-commonjs@28.0.1(rollup@4.59.0)':
@@ -13303,73 +9673,76 @@ snapshots:
'@rollup/rollup-win32-x64-msvc@4.59.0':
optional: true
- '@sentry-internal/browser-utils@10.27.0':
- dependencies:
- '@sentry/core': 10.27.0
+ '@sentry/babel-plugin-component-annotate@5.3.0': {}
- '@sentry-internal/feedback@10.27.0':
+ '@sentry/browser-utils@10.65.0':
dependencies:
- '@sentry/core': 10.27.0
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
- '@sentry-internal/replay-canvas@10.27.0':
+ '@sentry/browser@10.65.0':
dependencies:
- '@sentry-internal/replay': 10.27.0
- '@sentry/core': 10.27.0
+ '@sentry/browser-utils': 10.65.0
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
+ '@sentry/feedback': 10.65.0
+ '@sentry/replay': 10.65.0
+ '@sentry/replay-canvas': 10.65.0
- '@sentry-internal/replay@10.27.0':
+ '@sentry/bundler-plugin-core@5.3.0':
dependencies:
- '@sentry-internal/browser-utils': 10.27.0
- '@sentry/core': 10.27.0
-
- '@sentry/babel-plugin-component-annotate@4.7.0': {}
-
- '@sentry/browser@10.27.0':
- dependencies:
- '@sentry-internal/browser-utils': 10.27.0
- '@sentry-internal/feedback': 10.27.0
- '@sentry-internal/replay': 10.27.0
- '@sentry-internal/replay-canvas': 10.27.0
- '@sentry/core': 10.27.0
-
- '@sentry/bundler-plugin-core@4.7.0':
- dependencies:
- '@babel/core': 7.28.6
- '@sentry/babel-plugin-component-annotate': 4.7.0
- '@sentry/cli': 2.58.4
+ '@babel/core': 7.29.7
+ '@sentry/babel-plugin-component-annotate': 5.3.0
+ '@sentry/cli': 2.58.6
dotenv: 16.6.1
find-up: 5.0.0
- glob: 10.5.0
- magic-string: 0.30.8
- unplugin: 1.0.1
+ glob: 13.0.6
+ magic-string: 0.30.21
transitivePeerDependencies:
- encoding
- supports-color
- '@sentry/cli-darwin@2.58.4':
+ '@sentry/bundler-plugins@10.65.0(rollup@4.59.0)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+ dependencies:
+ '@babel/core': 7.29.7
+ '@sentry/cli': 2.58.6
+ '@sentry/core': 10.65.0
+ dotenv: 17.4.2
+ find-up: 5.0.0
+ glob: 13.0.6
+ magic-string: 0.30.21
+ optionalDependencies:
+ rollup: 4.59.0
+ webpack: 5.104.1(lightningcss@1.30.2)(postcss@8.5.14)
+ transitivePeerDependencies:
+ - encoding
+ - supports-color
+
+ '@sentry/cli-darwin@2.58.6':
optional: true
- '@sentry/cli-linux-arm64@2.58.4':
+ '@sentry/cli-linux-arm64@2.58.6':
optional: true
- '@sentry/cli-linux-arm@2.58.4':
+ '@sentry/cli-linux-arm@2.58.6':
optional: true
- '@sentry/cli-linux-i686@2.58.4':
+ '@sentry/cli-linux-i686@2.58.6':
optional: true
- '@sentry/cli-linux-x64@2.58.4':
+ '@sentry/cli-linux-x64@2.58.6':
optional: true
- '@sentry/cli-win32-arm64@2.58.4':
+ '@sentry/cli-win32-arm64@2.58.6':
optional: true
- '@sentry/cli-win32-i686@2.58.4':
+ '@sentry/cli-win32-i686@2.58.6':
optional: true
- '@sentry/cli-win32-x64@2.58.4':
+ '@sentry/cli-win32-x64@2.58.6':
optional: true
- '@sentry/cli@2.58.4':
+ '@sentry/cli@2.58.6':
dependencies:
https-proxy-agent: 5.0.1
node-fetch: 2.7.0
@@ -13377,132 +9750,129 @@ snapshots:
proxy-from-env: 1.1.0
which: 2.0.2
optionalDependencies:
- '@sentry/cli-darwin': 2.58.4
- '@sentry/cli-linux-arm': 2.58.4
- '@sentry/cli-linux-arm64': 2.58.4
- '@sentry/cli-linux-i686': 2.58.4
- '@sentry/cli-linux-x64': 2.58.4
- '@sentry/cli-win32-arm64': 2.58.4
- '@sentry/cli-win32-i686': 2.58.4
- '@sentry/cli-win32-x64': 2.58.4
+ '@sentry/cli-darwin': 2.58.6
+ '@sentry/cli-linux-arm': 2.58.6
+ '@sentry/cli-linux-arm64': 2.58.6
+ '@sentry/cli-linux-i686': 2.58.6
+ '@sentry/cli-linux-x64': 2.58.6
+ '@sentry/cli-win32-arm64': 2.58.6
+ '@sentry/cli-win32-i686': 2.58.6
+ '@sentry/cli-win32-x64': 2.58.6
transitivePeerDependencies:
- encoding
- supports-color
- '@sentry/core@10.27.0': {}
+ '@sentry/conventions@0.15.1': {}
- '@sentry/nextjs@10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+ '@sentry/core@10.65.0':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/semantic-conventions': 1.39.0
+ '@sentry/conventions': 0.15.1
+
+ '@sentry/feedback@10.65.0':
+ dependencies:
+ '@sentry/core': 10.65.0
+
+ '@sentry/nextjs@10.65.0(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+ dependencies:
+ '@opentelemetry/api': 1.9.1
'@rollup/plugin-commonjs': 28.0.1(rollup@4.59.0)
- '@sentry-internal/browser-utils': 10.27.0
- '@sentry/bundler-plugin-core': 4.7.0
- '@sentry/core': 10.27.0
- '@sentry/node': 10.27.0
- '@sentry/opentelemetry': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
- '@sentry/react': 10.27.0(react@19.2.7)
- '@sentry/vercel-edge': 10.27.0
- '@sentry/webpack-plugin': 4.7.0(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
- next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- resolve: 1.22.8
+ '@sentry/browser-utils': 10.65.0
+ '@sentry/bundler-plugin-core': 5.3.0
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
+ '@sentry/node': 10.65.0(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))
+ '@sentry/opentelemetry': 10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))
+ '@sentry/react': 10.65.0(react@19.2.7)
+ '@sentry/vercel-edge': 10.65.0
+ '@sentry/webpack-plugin': 5.4.0(rollup@4.59.0)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
+ next: 16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
rollup: 4.59.0
stacktrace-parser: 0.1.11
transitivePeerDependencies:
- - '@opentelemetry/context-async-hooks'
- '@opentelemetry/core'
+ - '@opentelemetry/exporter-trace-otlp-http'
- '@opentelemetry/sdk-trace-base'
- encoding
- react
- supports-color
- webpack
- '@sentry/node-core@10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@opentelemetry/resources@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)':
+ '@sentry/node-core@10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))':
dependencies:
- '@apm-js-collab/tracing-hooks': 0.3.1
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/context-async-hooks': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/resources': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/sdk-trace-base': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@sentry/core': 10.27.0
- '@sentry/opentelemetry': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
- import-in-the-middle: 2.0.0
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
+ '@sentry/opentelemetry': 10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))
+ import-in-the-middle: 3.3.1
+ optionalDependencies:
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/core': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/instrumentation': 0.220.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/sdk-trace-base': 2.9.0(@opentelemetry/api@1.9.1)
+
+ '@sentry/node@10.65.0(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))':
+ dependencies:
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/instrumentation': 0.220.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/sdk-trace-base': 2.9.0(@opentelemetry/api@1.9.1)
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
+ '@sentry/node-core': 10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))
+ '@sentry/opentelemetry': 10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))
+ '@sentry/server-utils': 10.65.0
+ import-in-the-middle: 3.3.1
transitivePeerDependencies:
+ - '@opentelemetry/core'
+ - '@opentelemetry/exporter-trace-otlp-http'
- supports-color
- '@sentry/node@10.27.0':
+ '@sentry/opentelemetry@10.65.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.9.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/context-async-hooks': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-amqplib': 0.55.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-connect': 0.52.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-dataloader': 0.26.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-express': 0.57.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-fs': 0.28.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-generic-pool': 0.52.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-graphql': 0.56.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-hapi': 0.55.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-http': 0.208.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-ioredis': 0.56.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-kafkajs': 0.18.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-knex': 0.53.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-koa': 0.57.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-lru-memoizer': 0.53.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-mongodb': 0.61.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-mongoose': 0.55.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-mysql': 0.54.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-mysql2': 0.55.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-pg': 0.61.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-redis': 0.57.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-tedious': 0.27.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/instrumentation-undici': 0.19.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/resources': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/sdk-trace-base': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@prisma/instrumentation': 6.19.0(@opentelemetry/api@1.9.0)
- '@sentry/core': 10.27.0
- '@sentry/node-core': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.208.0(@opentelemetry/api@1.9.0))(@opentelemetry/resources@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
- '@sentry/opentelemetry': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
- import-in-the-middle: 2.0.0
- minimatch: 9.0.7
- transitivePeerDependencies:
- - supports-color
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/core': 2.9.0(@opentelemetry/api@1.9.1)
+ '@opentelemetry/sdk-trace-base': 2.9.0(@opentelemetry/api@1.9.1)
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
- '@sentry/opentelemetry@10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)':
+ '@sentry/react@10.65.0(react@19.2.7)':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/context-async-hooks': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/core': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/sdk-trace-base': 2.4.0(@opentelemetry/api@1.9.0)
- '@opentelemetry/semantic-conventions': 1.39.0
- '@sentry/core': 10.27.0
-
- '@sentry/react@10.27.0(react@19.2.7)':
- dependencies:
- '@sentry/browser': 10.27.0
- '@sentry/core': 10.27.0
- hoist-non-react-statics: 3.3.2
+ '@sentry/browser': 10.65.0
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
react: 19.2.7
- '@sentry/vercel-edge@10.27.0':
+ '@sentry/replay-canvas@10.65.0':
dependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/resources': 2.4.0(@opentelemetry/api@1.9.0)
- '@sentry/core': 10.27.0
+ '@sentry/core': 10.65.0
+ '@sentry/replay': 10.65.0
- '@sentry/webpack-plugin@4.7.0(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+ '@sentry/replay@10.65.0':
dependencies:
- '@sentry/bundler-plugin-core': 4.7.0
- unplugin: 1.0.1
- uuid: 11.1.1
+ '@sentry/browser-utils': 10.65.0
+ '@sentry/core': 10.65.0
+
+ '@sentry/server-utils@10.65.0':
+ dependencies:
+ '@apm-js-collab/code-transformer': 0.15.0
+ '@apm-js-collab/code-transformer-bundler-plugins': 0.5.0
+ '@apm-js-collab/tracing-hooks': 0.10.1
+ '@sentry/conventions': 0.15.1
+ '@sentry/core': 10.65.0
+ magic-string: 0.30.21
+ transitivePeerDependencies:
+ - supports-color
+
+ '@sentry/vercel-edge@10.65.0':
+ dependencies:
+ '@opentelemetry/api': 1.9.1
+ '@sentry/core': 10.65.0
+
+ '@sentry/webpack-plugin@5.4.0(rollup@4.59.0)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+ dependencies:
+ '@sentry/bundler-plugins': 10.65.0(rollup@4.59.0)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
webpack: 5.104.1(lightningcss@1.30.2)(postcss@8.5.14)
transitivePeerDependencies:
- encoding
+ - rollup
- supports-color
'@shikijs/core@3.20.0':
@@ -13754,10 +10124,6 @@ snapshots:
dependencies:
tslib: 2.8.1
- '@swc/helpers@0.5.21':
- dependencies:
- tslib: 2.8.1
-
'@tailwindcss/node@4.1.18':
dependencies:
'@jridgewell/remapping': 2.3.5
@@ -13841,19 +10207,11 @@ snapshots:
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
- '@tanstack/react-virtual@3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
- dependencies:
- '@tanstack/virtual-core': 3.11.3
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
'@tanstack/table-core@8.21.3': {}
- '@tanstack/virtual-core@3.11.3': {}
-
'@testing-library/dom@10.4.1':
dependencies:
- '@babel/code-frame': 7.29.0
+ '@babel/code-frame': 7.29.7
'@babel/runtime': 7.28.6
'@types/aria-query': 5.0.4
aria-query: 5.3.0
@@ -13894,34 +10252,30 @@ snapshots:
'@types/babel__core@7.20.5':
dependencies:
- '@babel/parser': 7.28.6
- '@babel/types': 7.28.6
+ '@babel/parser': 7.29.7
+ '@babel/types': 7.29.7
'@types/babel__generator': 7.27.0
'@types/babel__template': 7.4.4
'@types/babel__traverse': 7.28.0
'@types/babel__generator@7.27.0':
dependencies:
- '@babel/types': 7.29.0
+ '@babel/types': 7.29.7
'@types/babel__template@7.4.4':
dependencies:
- '@babel/parser': 7.29.3
- '@babel/types': 7.29.0
+ '@babel/parser': 7.29.7
+ '@babel/types': 7.29.7
'@types/babel__traverse@7.28.0':
dependencies:
- '@babel/types': 7.29.0
+ '@babel/types': 7.29.7
'@types/chai@5.2.3':
dependencies:
'@types/deep-eql': 4.0.2
assertion-error: 2.0.1
- '@types/connect@3.4.38':
- dependencies:
- '@types/node': 24.10.8
-
'@types/d3-array@3.2.2': {}
'@types/d3-axis@3.0.6':
@@ -14081,24 +10435,10 @@ snapshots:
'@types/ms@2.1.0': {}
- '@types/mysql@2.15.27':
- dependencies:
- '@types/node': 24.10.8
-
'@types/node@24.10.8':
dependencies:
undici-types: 7.16.0
- '@types/pg-pool@2.0.6':
- dependencies:
- '@types/pg': 8.15.6
-
- '@types/pg@8.15.6':
- dependencies:
- '@types/node': 24.10.8
- pg-protocol: 1.11.0
- pg-types: 2.2.0
-
'@types/react-dom@19.2.3(@types/react@19.2.17)':
dependencies:
'@types/react': 19.2.17
@@ -14113,10 +10453,6 @@ snapshots:
'@types/statuses@2.0.6': {}
- '@types/tedious@4.0.14':
- dependencies:
- '@types/node': 24.10.8
-
'@types/topojson-client@3.1.5':
dependencies:
'@types/geojson': 7946.0.16
@@ -14201,8 +10537,8 @@ snapshots:
'@typescript-eslint/visitor-keys': 8.53.0
debug: 4.4.3
minimatch: 9.0.7
- semver: 7.7.3
- tinyglobby: 0.2.15
+ semver: 7.8.0
+ tinyglobby: 0.2.16
ts-api-utils: 2.4.0(typescript@5.5.4)
typescript: 5.5.4
transitivePeerDependencies:
@@ -14260,42 +10596,42 @@ snapshots:
'@vercel/oidc@3.2.0': {}
- '@vitejs/plugin-react@5.1.2(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
+ '@vitejs/plugin-react@5.1.2(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))':
dependencies:
- '@babel/core': 7.28.6
- '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.6)
- '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.28.6)
+ '@babel/core': 7.29.7
+ '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.7)
+ '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.29.7)
'@rolldown/pluginutils': 1.0.0-beta.53
'@types/babel__core': 7.20.5
react-refresh: 0.18.0
- vite: 7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)
+ vite: 7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0)
transitivePeerDependencies:
- supports-color
- '@vitest/browser-playwright@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)':
+ '@vitest/browser-playwright@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)':
dependencies:
- '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
- '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)
+ '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
playwright: 1.56.1
tinyrainbow: 3.1.0
- vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
transitivePeerDependencies:
- bufferutil
- msw
- utf-8-validate
- vite
- '@vitest/browser@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)':
+ '@vitest/browser@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)':
dependencies:
'@blazediff/core': 1.9.1
- '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
'@vitest/utils': 4.1.8
magic-string: 0.30.21
pngjs: 7.0.0
sirv: 3.0.2
tinyrainbow: 3.1.0
- vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
- ws: 8.20.1
+ vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
+ ws: 8.21.0
transitivePeerDependencies:
- bufferutil
- msw
@@ -14314,9 +10650,9 @@ snapshots:
obug: 2.1.1
std-env: 4.1.0
tinyrainbow: 3.1.0
- vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
optionalDependencies:
- '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+ '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)
'@vitest/expect@4.1.8':
dependencies:
@@ -14327,14 +10663,14 @@ snapshots:
chai: 6.2.2
tinyrainbow: 3.1.0
- '@vitest/mocker@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
+ '@vitest/mocker@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))':
dependencies:
'@vitest/spy': 4.1.8
estree-walker: 3.0.3
magic-string: 0.30.21
optionalDependencies:
msw: 2.13.4(@types/node@24.10.8)(typescript@5.5.4)
- vite: 7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)
+ vite: 7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0)
'@vitest/pretty-format@4.1.8':
dependencies:
@@ -14468,22 +10804,18 @@ snapshots:
mime-types: 3.0.2
negotiator: 1.0.0
- acorn-import-attributes@1.9.5(acorn@8.15.0):
+ acorn-import-phases@1.0.4(acorn@8.17.0):
dependencies:
- acorn: 8.15.0
+ acorn: 8.17.0
- acorn-import-phases@1.0.4(acorn@8.16.0):
+ acorn-jsx@5.3.2(acorn@8.16.0):
dependencies:
acorn: 8.16.0
- acorn-jsx@5.3.2(acorn@8.15.0):
- dependencies:
- acorn: 8.15.0
-
- acorn@8.15.0: {}
-
acorn@8.16.0: {}
+ acorn@8.17.0: {}
+
agent-base@6.0.2:
dependencies:
debug: 4.4.3
@@ -14497,7 +10829,7 @@ snapshots:
'@ai-sdk/gateway': 3.0.129(zod@4.4.3)
'@ai-sdk/provider': 3.0.10
'@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
- '@opentelemetry/api': 1.9.0
+ '@opentelemetry/api': 1.9.1
zod: 4.4.3
ajv-formats@2.1.1(ajv@8.18.0):
@@ -14529,21 +10861,12 @@ snapshots:
ansi-regex@5.0.1: {}
- ansi-regex@6.2.2: {}
-
ansi-styles@4.3.0:
dependencies:
color-convert: 2.0.1
ansi-styles@5.2.0: {}
- ansi-styles@6.2.3: {}
-
- anymatch@3.1.3:
- dependencies:
- normalize-path: 3.0.0
- picomatch: 2.3.2
-
argparse@2.0.1: {}
aria-hidden@1.2.6:
@@ -14623,6 +10946,8 @@ snapshots:
estree-walker: 3.0.3
js-tokens: 10.0.0
+ astring@1.9.0: {}
+
async-function@1.0.0: {}
available-typed-arrays@1.0.7:
@@ -14635,7 +10960,7 @@ snapshots:
babel-plugin-react-compiler@1.0.0:
dependencies:
- '@babel/types': 7.28.6
+ '@babel/types': 7.29.7
bail@2.0.2: {}
@@ -14651,8 +10976,6 @@ snapshots:
dependencies:
require-from-string: 2.0.2
- binary-extensions@2.3.0: {}
-
body-parser@2.2.2:
dependencies:
bytes: 3.1.2
@@ -14682,14 +11005,6 @@ snapshots:
dependencies:
fill-range: 7.1.1
- browserslist@4.28.1:
- dependencies:
- baseline-browser-mapping: 2.10.29
- caniuse-lite: 1.0.30001792
- electron-to-chromium: 1.5.267
- node-releases: 2.0.27
- update-browserslist-db: 1.2.3(browserslist@4.28.1)
-
browserslist@4.28.2:
dependencies:
baseline-browser-mapping: 2.10.29
@@ -14742,21 +11057,9 @@ snapshots:
character-reference-invalid@2.0.1: {}
- chokidar@3.6.0:
- dependencies:
- anymatch: 3.1.3
- braces: 3.0.3
- glob-parent: 5.1.2
- is-binary-path: 2.1.0
- is-glob: 4.0.3
- normalize-path: 3.0.0
- readdirp: 3.6.0
- optionalDependencies:
- fsevents: 2.3.3
-
chrome-trace-event@1.0.4: {}
- cjs-module-lexer@1.4.3: {}
+ cjs-module-lexer@2.2.0: {}
class-variance-authority@0.7.1:
dependencies:
@@ -14774,16 +11077,14 @@ snapshots:
strip-ansi: 6.0.1
wrap-ansi: 7.0.0
- clsx@1.2.1: {}
-
clsx@2.1.1: {}
cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
dependencies:
- '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+ '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
'@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
'@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
- '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ '@radix-ui/react-primitive': 2.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
transitivePeerDependencies:
@@ -14793,7 +11094,7 @@ snapshots:
codemirror@6.0.2:
dependencies:
'@codemirror/autocomplete': 6.20.1
- '@codemirror/commands': 6.10.3
+ '@codemirror/commands': 6.10.4
'@codemirror/language': 6.12.2
'@codemirror/lint': 6.9.5
'@codemirror/search': 6.6.0
@@ -14811,8 +11112,6 @@ snapshots:
color-name: 1.1.4
simple-swizzle: 0.2.4
- color2k@2.0.3: {}
-
color@4.2.3:
dependencies:
color-convert: 2.0.1
@@ -14828,8 +11127,6 @@ snapshots:
commondir@1.0.1: {}
- compute-scroll-into-view@3.1.1: {}
-
concat-map@0.0.1: {}
confbox@0.1.8: {}
@@ -14861,6 +11158,8 @@ snapshots:
crelt@1.0.6: {}
+ crelt@1.0.7: {}
+
cross-fetch@4.1.0:
dependencies:
node-fetch: 2.7.0
@@ -15122,8 +11421,6 @@ snapshots:
deep-is@0.1.4: {}
- deepmerge@4.3.1: {}
-
define-data-property@1.1.4:
dependencies:
es-define-property: 1.0.1
@@ -15169,7 +11466,7 @@ snapshots:
'@babel/runtime': 7.28.6
csstype: 3.2.3
- dompurify@3.4.10:
+ dompurify@3.4.11:
optionalDependencies:
'@types/trusted-types': 2.0.7
@@ -15179,6 +11476,8 @@ snapshots:
dotenv@16.6.1: {}
+ dotenv@17.4.2: {}
+
driver.js@1.4.0: {}
dunder-proto@1.0.1:
@@ -15187,12 +11486,8 @@ snapshots:
es-errors: 1.3.0
gopd: 1.2.0
- eastasianwidth@0.2.0: {}
-
ee-first@1.1.1: {}
- electron-to-chromium@1.5.267: {}
-
electron-to-chromium@1.5.354: {}
emoji-regex@8.0.0: {}
@@ -15206,6 +11501,11 @@ snapshots:
graceful-fs: 4.2.11
tapable: 2.3.3
+ enhanced-resolve@5.24.2:
+ dependencies:
+ graceful-fs: 4.2.11
+ tapable: 2.3.3
+
entities@6.0.1: {}
es-abstract@1.24.1:
@@ -15288,7 +11588,7 @@ snapshots:
iterator.prototype: 1.1.5
safe-array-concat: 1.1.3
- es-module-lexer@2.1.0: {}
+ es-module-lexer@2.3.0: {}
es-object-atoms@1.1.1:
dependencies:
@@ -15385,8 +11685,8 @@ snapshots:
eslint-plugin-react-hooks@7.0.1(eslint@9.39.2(jiti@2.6.1)):
dependencies:
- '@babel/core': 7.28.6
- '@babel/parser': 7.28.6
+ '@babel/core': 7.29.7
+ '@babel/parser': 7.29.7
eslint: 9.39.2(jiti@2.6.1)
hermes-parser: 0.25.1
zod: 4.4.3
@@ -15457,7 +11757,7 @@ snapshots:
'@humanfs/node': 0.16.7
'@humanwhocodes/module-importer': 1.0.1
'@humanwhocodes/retry': 0.4.3
- '@types/estree': 1.0.8
+ '@types/estree': 1.0.9
ajv: 6.14.0
chalk: 4.1.2
cross-spawn: 7.0.6
@@ -15487,8 +11787,8 @@ snapshots:
espree@10.4.0:
dependencies:
- acorn: 8.15.0
- acorn-jsx: 5.3.2(acorn@8.15.0)
+ acorn: 8.16.0
+ acorn-jsx: 5.3.2(acorn@8.16.0)
eslint-visitor-keys: 4.2.1
esquery@1.7.0:
@@ -15521,8 +11821,6 @@ snapshots:
events@3.3.0: {}
- eventsource-parser@3.0.6: {}
-
eventsource-parser@3.1.0: {}
eventsource@3.0.7:
@@ -15637,6 +11935,10 @@ snapshots:
optionalDependencies:
picomatch: 4.0.4
+ fdir@6.5.0(picomatch@4.0.5):
+ optionalDependencies:
+ picomatch: 4.0.5
+
file-entry-cache@8.0.0:
dependencies:
flat-cache: 4.0.1
@@ -15666,25 +11968,16 @@ snapshots:
flatted: 3.4.2
keyv: 4.5.4
- flat@5.0.2: {}
-
flatted@3.4.2: {}
for-each@0.3.5:
dependencies:
is-callable: 1.2.7
- foreground-child@3.3.1:
- dependencies:
- cross-spawn: 7.0.6
- signal-exit: 4.1.0
-
formatly@0.3.0:
dependencies:
fd-package-json: 2.0.0
- forwarded-parse@2.1.2: {}
-
forwarded@0.2.0: {}
framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
@@ -15767,14 +12060,11 @@ snapshots:
glob-to-regexp@0.4.1: {}
- glob@10.5.0:
+ glob@13.0.6:
dependencies:
- foreground-child: 3.3.1
- jackspeak: 3.4.3
- minimatch: 9.0.7
- minipass: 7.1.2
- package-json-from-dist: 1.0.1
- path-scurry: 1.11.1
+ minimatch: 10.2.3
+ minipass: 7.1.3
+ path-scurry: 2.0.2
globals@14.0.0: {}
@@ -15948,11 +12238,7 @@ snapshots:
dependencies:
hermes-estree: 0.25.1
- hoist-non-react-statics@3.3.2:
- dependencies:
- react-is: 16.13.1
-
- hono@4.12.21: {}
+ hono@4.12.28: {}
html-encoding-sniffer@6.0.0:
dependencies:
@@ -16014,11 +12300,10 @@ snapshots:
parent-module: 1.0.1
resolve-from: 4.0.0
- import-in-the-middle@2.0.0:
+ import-in-the-middle@3.3.1:
dependencies:
- acorn: 8.15.0
- acorn-import-attributes: 1.9.5(acorn@8.15.0)
- cjs-module-lexer: 1.4.3
+ cjs-module-lexer: 2.2.0
+ es-module-lexer: 2.3.0
module-details-from-path: 1.0.4
imurmurhash@0.1.4: {}
@@ -16029,11 +12314,6 @@ snapshots:
inline-style-parser@0.2.7: {}
- input-otp@1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
- dependencies:
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
-
internal-slot@1.1.0:
dependencies:
es-errors: 1.3.0
@@ -16044,13 +12324,6 @@ snapshots:
internmap@2.0.3: {}
- intl-messageformat@10.7.16:
- dependencies:
- '@formatjs/ecma402-abstract': 2.3.4
- '@formatjs/fast-memoize': 2.2.7
- '@formatjs/icu-messageformat-parser': 2.11.2
- tslib: 2.8.1
-
ip-address@10.2.0: {}
ipaddr.js@1.9.1: {}
@@ -16082,10 +12355,6 @@ snapshots:
dependencies:
has-bigints: 1.1.0
- is-binary-path@2.1.0:
- dependencies:
- binary-extensions: 2.3.0
-
is-boolean-object@1.2.2:
dependencies:
call-bound: 1.0.4
@@ -16222,12 +12491,6 @@ snapshots:
has-symbols: 1.1.0
set-function-name: 2.0.2
- jackspeak@3.4.3:
- dependencies:
- '@isaacs/cliui': 8.0.2
- optionalDependencies:
- '@pkgjs/parseargs': 0.11.0
-
jest-worker@27.5.1:
dependencies:
'@types/node': 24.10.8
@@ -16246,7 +12509,7 @@ snapshots:
js-tokens@4.0.0: {}
- js-yaml@4.1.1:
+ js-yaml@4.3.0:
dependencies:
argparse: 2.0.1
@@ -16265,12 +12528,12 @@ snapshots:
parse5: 8.0.0
saxes: 6.0.0
symbol-tree: 3.2.4
- tough-cookie: 6.0.0
+ tough-cookie: 6.0.1
w3c-xmlserializer: 5.0.0
webidl-conversions: 8.0.1
whatwg-mimetype: 4.0.0
whatwg-url: 15.1.0
- ws: 8.19.0
+ ws: 8.21.0
xml-name-validator: 5.0.0
transitivePeerDependencies:
- '@noble/hashes'
@@ -16336,12 +12599,12 @@ snapshots:
- '@emnapi/core'
- '@emnapi/runtime'
- langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3)):
+ langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3)):
dependencies:
- '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
- '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
- '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
- langsmith: 0.6.3(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
+ '@langchain/core': 1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
+ '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.21.0)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+ '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))
+ langsmith: 0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0)
zod: 4.4.3
transitivePeerDependencies:
- '@opentelemetry/api'
@@ -16355,14 +12618,14 @@ snapshots:
- ws
- zod-to-json-schema
- langsmith@0.6.3(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1):
+ langsmith@0.6.3(@opentelemetry/api@1.9.1)(@opentelemetry/sdk-trace-base@2.9.0(@opentelemetry/api@1.9.1))(openai@6.37.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0):
dependencies:
p-queue: 6.6.2
optionalDependencies:
- '@opentelemetry/api': 1.9.0
- '@opentelemetry/sdk-trace-base': 2.4.0(@opentelemetry/api@1.9.0)
- openai: 6.37.0(ws@8.20.1)(zod@4.4.3)
- ws: 8.20.1
+ '@opentelemetry/api': 1.9.1
+ '@opentelemetry/sdk-trace-base': 2.9.0(@opentelemetry/api@1.9.1)
+ openai: 6.37.0(ws@8.21.0)(zod@4.4.3)
+ ws: 8.21.0
language-subtag-registry@0.3.23: {}
@@ -16450,8 +12713,6 @@ snapshots:
dependencies:
js-tokens: 4.0.0
- lru-cache@10.4.3: {}
-
lru-cache@11.2.6: {}
lru-cache@5.1.1:
@@ -16472,14 +12733,10 @@ snapshots:
dependencies:
'@jridgewell/sourcemap-codec': 1.5.5
- magic-string@0.30.8:
- dependencies:
- '@jridgewell/sourcemap-codec': 1.5.5
-
magicast@0.5.2:
dependencies:
- '@babel/parser': 7.29.3
- '@babel/types': 7.29.0
+ '@babel/parser': 7.29.7
+ '@babel/types': 7.29.7
source-map-js: 1.2.1
make-dir@4.0.0:
@@ -16669,6 +12926,8 @@ snapshots:
merge2@1.4.1: {}
+ meriyah@6.1.4: {}
+
mermaid@11.15.0:
dependencies:
'@braintree/sanitize-url': 7.1.1
@@ -16683,7 +12942,7 @@ snapshots:
d3-sankey: 0.12.3
dagre-d3-es: 7.0.14
dayjs: 1.11.19
- dompurify: 3.4.10
+ dompurify: 3.4.11
es-toolkit: 1.46.1
katex: 0.16.27
khroma: 2.1.0
@@ -16945,6 +13204,10 @@ snapshots:
min-indent@1.0.1: {}
+ minimatch@10.2.3:
+ dependencies:
+ brace-expansion: 5.0.6
+
minimatch@3.1.4:
dependencies:
brace-expansion: 1.1.13
@@ -16955,7 +13218,7 @@ snapshots:
minimist@1.2.8: {}
- minipass@7.1.2: {}
+ minipass@7.1.3: {}
mlly@1.8.0:
dependencies:
@@ -17017,19 +13280,19 @@ snapshots:
neo-async@2.6.2: {}
- next-auth@5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
+ next-auth@5.0.0-beta.30(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
dependencies:
'@auth/core': 0.41.0
- next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ next: 16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
react: 19.2.7
- next-themes@0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+ next-themes@0.2.1(next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
dependencies:
- next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+ next: 16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
- next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+ next@16.2.9(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
dependencies:
'@next/env': 16.2.9
'@swc/helpers': 0.5.15
@@ -17038,7 +13301,7 @@ snapshots:
postcss: 8.5.14
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
- styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.7)
+ styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.7)
optionalDependencies:
'@next/swc-darwin-arm64': 16.2.9
'@next/swc-darwin-x64': 16.2.9
@@ -17048,7 +13311,7 @@ snapshots:
'@next/swc-linux-x64-musl': 16.2.9
'@next/swc-win32-arm64-msvc': 16.2.9
'@next/swc-win32-x64-msvc': 16.2.9
- '@opentelemetry/api': 1.9.0
+ '@opentelemetry/api': 1.9.1
'@playwright/test': 1.56.1
babel-plugin-react-compiler: 1.0.0
sharp: 0.34.5
@@ -17060,12 +13323,8 @@ snapshots:
dependencies:
whatwg-url: 5.0.0
- node-releases@2.0.27: {}
-
node-releases@2.0.44: {}
- normalize-path@3.0.0: {}
-
oauth4webapi@3.8.3: {}
object-assign@4.1.1: {}
@@ -17122,9 +13381,9 @@ snapshots:
regex: 6.1.0
regex-recursion: 6.0.2
- openai@6.37.0(ws@8.20.1)(zod@4.4.3):
+ openai@6.37.0(ws@8.21.0)(zod@4.4.3):
optionalDependencies:
- ws: 8.20.1
+ ws: 8.21.0
zod: 4.4.3
optionator@0.9.4:
@@ -17228,8 +13487,6 @@ snapshots:
p-timeout@7.0.1: {}
- package-json-from-dist@1.0.1: {}
-
package-manager-detector@1.6.0: {}
parent-module@1.0.1:
@@ -17266,10 +13523,10 @@ snapshots:
path-parse@1.0.7: {}
- path-scurry@1.11.1:
+ path-scurry@2.0.2:
dependencies:
- lru-cache: 10.4.3
- minipass: 7.1.2
+ lru-cache: 11.2.6
+ minipass: 7.1.3
path-to-regexp@6.3.0: {}
@@ -17277,24 +13534,14 @@ snapshots:
pathe@2.0.3: {}
- pg-int8@1.0.1: {}
-
- pg-protocol@1.11.0: {}
-
- pg-types@2.2.0:
- dependencies:
- pg-int8: 1.0.1
- postgres-array: 2.0.0
- postgres-bytea: 1.0.1
- postgres-date: 1.0.7
- postgres-interval: 1.2.0
-
picocolors@1.1.1: {}
picomatch@2.3.2: {}
picomatch@4.0.4: {}
+ picomatch@4.0.5: {}
+
pkce-challenge@5.0.1: {}
pkg-types@1.3.1:
@@ -17333,16 +13580,6 @@ snapshots:
picocolors: 1.1.1
source-map-js: 1.2.1
- postgres-array@2.0.0: {}
-
- postgres-bytea@1.0.1: {}
-
- postgres-date@1.0.7: {}
-
- postgres-interval@1.2.0:
- dependencies:
- xtend: 4.0.2
-
preact-render-to-string@6.5.11(preact@10.24.3):
dependencies:
preact: 10.24.3
@@ -17484,15 +13721,6 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
- react-textarea-autosize@8.5.9(@types/react@19.2.17)(react@19.2.7):
- dependencies:
- '@babel/runtime': 7.28.6
- react: 19.2.7
- use-composed-ref: 1.4.0(@types/react@19.2.17)(react@19.2.7)
- use-latest: 1.3.0(@types/react@19.2.17)(react@19.2.7)
- transitivePeerDependencies:
- - '@types/react'
-
react-transition-group@4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
dependencies:
'@babel/runtime': 7.28.6
@@ -17504,10 +13732,6 @@ snapshots:
react@19.2.7: {}
- readdirp@3.6.0:
- dependencies:
- picomatch: 2.3.2
-
recharts-scale@0.4.5:
dependencies:
decimal.js-light: 2.5.1
@@ -17662,12 +13886,6 @@ snapshots:
resolve-pkg-maps@1.0.0: {}
- resolve@1.22.8:
- dependencies:
- is-core-module: 2.16.1
- path-parse: 1.0.7
- supports-preserve-symlinks-flag: 1.0.0
-
resolve@2.0.0-next.5:
dependencies:
is-core-module: 2.16.1
@@ -17772,14 +13990,10 @@ snapshots:
ajv-formats: 2.1.1(ajv@8.18.0)
ajv-keywords: 5.1.0(ajv@8.18.0)
- scroll-into-view-if-needed@3.0.10:
- dependencies:
- compute-scroll-into-view: 3.1.1
+ semifies@1.0.0: {}
semver@6.3.1: {}
- semver@7.7.3: {}
-
semver@7.8.0: {}
send@1.2.1:
@@ -17839,7 +14053,7 @@ snapshots:
dependencies:
color: 4.2.3
detect-libc: 2.1.2
- semver: 7.7.3
+ semver: 7.8.0
optionalDependencies:
'@img/sharp-darwin-arm64': 0.33.5
'@img/sharp-darwin-x64': 0.33.5
@@ -17962,9 +14176,9 @@ snapshots:
detect-newline: 4.0.1
git-hooks-list: 4.2.1
is-plain-obj: 4.1.0
- semver: 7.7.3
+ semver: 7.8.0
sort-object-keys: 2.1.0
- tinyglobby: 0.2.15
+ tinyglobby: 0.2.16
source-map-js@1.2.1: {}
@@ -18031,12 +14245,6 @@ snapshots:
is-fullwidth-code-point: 3.0.0
strip-ansi: 6.0.1
- string-width@5.1.2:
- dependencies:
- eastasianwidth: 0.2.0
- emoji-regex: 9.2.2
- strip-ansi: 7.1.2
-
string.prototype.includes@2.0.1:
dependencies:
call-bind: 1.0.8
@@ -18096,10 +14304,6 @@ snapshots:
dependencies:
ansi-regex: 5.0.1
- strip-ansi@7.1.2:
- dependencies:
- ansi-regex: 6.2.2
-
strip-indent@3.0.0:
dependencies:
min-indent: 1.0.1
@@ -18120,12 +14324,12 @@ snapshots:
dependencies:
inline-style-parser: 0.2.7
- styled-jsx@5.1.6(@babel/core@7.28.6)(react@19.2.7):
+ styled-jsx@5.1.6(@babel/core@7.29.7)(react@19.2.7):
dependencies:
client-only: 0.0.1
react: 19.2.7
optionalDependencies:
- '@babel/core': 7.28.6
+ '@babel/core': 7.29.7
stylis@4.3.6: {}
@@ -18155,12 +14359,6 @@ snapshots:
tailwind-merge@3.3.1: {}
- tailwind-variants@3.1.1(tailwind-merge@3.3.1)(tailwindcss@4.1.18):
- dependencies:
- tailwindcss: 4.1.18
- optionalDependencies:
- tailwind-merge: 3.3.1
-
tailwindcss-animate@1.0.7(tailwindcss@4.1.18):
dependencies:
tailwindcss: 4.1.18
@@ -18169,21 +14367,21 @@ snapshots:
tapable@2.3.3: {}
- terser-webpack-plugin@5.6.0(lightningcss@1.30.2)(postcss@8.5.14)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14)):
+ terser-webpack-plugin@5.6.1(lightningcss@1.30.2)(postcss@8.5.14)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14)):
dependencies:
'@jridgewell/trace-mapping': 0.3.31
jest-worker: 27.5.1
schema-utils: 4.3.3
- terser: 5.47.1
+ terser: 5.49.0
webpack: 5.104.1(lightningcss@1.30.2)(postcss@8.5.14)
optionalDependencies:
lightningcss: 1.30.2
postcss: 8.5.14
- terser@5.47.1:
+ terser@5.49.0:
dependencies:
'@jridgewell/source-map': 0.3.11
- acorn: 8.16.0
+ acorn: 8.17.0
commander: 2.20.3
source-map-support: 0.5.21
@@ -18197,16 +14395,16 @@ snapshots:
tinyexec@1.1.2: {}
- tinyglobby@0.2.15:
- dependencies:
- fdir: 6.5.0(picomatch@4.0.4)
- picomatch: 4.0.4
-
tinyglobby@0.2.16:
dependencies:
fdir: 6.5.0(picomatch@4.0.4)
picomatch: 4.0.4
+ tinyglobby@0.2.17:
+ dependencies:
+ fdir: 6.5.0(picomatch@4.0.5)
+ picomatch: 4.0.5
+
tinyrainbow@3.1.0: {}
tldts-core@7.0.19: {}
@@ -18227,10 +14425,6 @@ snapshots:
totalist@3.0.1: {}
- tough-cookie@6.0.0:
- dependencies:
- tldts: 7.0.19
-
tough-cookie@6.0.1:
dependencies:
tldts: 7.0.19
@@ -18362,21 +14556,8 @@ snapshots:
unpipe@1.0.0: {}
- unplugin@1.0.1:
- dependencies:
- acorn: 8.16.0
- chokidar: 3.6.0
- webpack-sources: 3.3.3
- webpack-virtual-modules: 0.5.0
-
until-async@3.0.2: {}
- update-browserslist-db@1.2.3(browserslist@4.28.1):
- dependencies:
- browserslist: 4.28.1
- escalade: 3.2.0
- picocolors: 1.1.1
-
update-browserslist-db@1.2.3(browserslist@4.28.2):
dependencies:
browserslist: 4.28.2
@@ -18394,25 +14575,6 @@ snapshots:
optionalDependencies:
'@types/react': 19.2.17
- use-composed-ref@1.4.0(@types/react@19.2.17)(react@19.2.7):
- dependencies:
- react: 19.2.7
- optionalDependencies:
- '@types/react': 19.2.17
-
- use-isomorphic-layout-effect@1.2.1(@types/react@19.2.17)(react@19.2.7):
- dependencies:
- react: 19.2.7
- optionalDependencies:
- '@types/react': 19.2.17
-
- use-latest@1.3.0(@types/react@19.2.17)(react@19.2.7):
- dependencies:
- react: 19.2.7
- use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.17)(react@19.2.7)
- optionalDependencies:
- '@types/react': 19.2.17
-
use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.7):
dependencies:
detect-node-es: 1.1.0
@@ -18435,15 +14597,6 @@ snapshots:
vary@1.1.2: {}
- vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
- dependencies:
- '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
- react: 19.2.7
- react-dom: 19.2.7(react@19.2.7)
- transitivePeerDependencies:
- - '@types/react'
- - '@types/react-dom'
-
vfile-location@5.0.3:
dependencies:
'@types/unist': 3.0.3
@@ -18476,41 +14629,41 @@ snapshots:
d3-time: 3.1.0
d3-timer: 3.0.1
- vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0):
+ vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0):
dependencies:
esbuild: 0.28.1
- fdir: 6.5.0(picomatch@4.0.4)
- picomatch: 4.0.4
+ fdir: 6.5.0(picomatch@4.0.5)
+ picomatch: 4.0.5
postcss: 8.5.14
rollup: 4.59.0
- tinyglobby: 0.2.16
+ tinyglobby: 0.2.17
optionalDependencies:
'@types/node': 24.10.8
fsevents: 2.3.3
jiti: 2.6.1
lightningcss: 1.30.2
- terser: 5.47.1
+ terser: 5.49.0
yaml: 2.9.0
vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8):
dependencies:
react: 19.2.7
react-dom: 19.2.7(react@19.2.7)
- vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
optionalDependencies:
'@types/react': 19.2.17
'@types/react-dom': 19.2.3(@types/react@19.2.17)
- vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)):
+ vitest@4.1.8(@opentelemetry/api@1.9.1)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0)):
dependencies:
'@vitest/expect': 4.1.8
- '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+ '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))
'@vitest/pretty-format': 4.1.8
'@vitest/runner': 4.1.8
'@vitest/snapshot': 4.1.8
'@vitest/spy': 4.1.8
'@vitest/utils': 4.1.8
- es-module-lexer: 2.1.0
+ es-module-lexer: 2.3.0
expect-type: 1.3.0
magic-string: 0.30.21
obug: 2.1.1
@@ -18521,12 +14674,12 @@ snapshots:
tinyexec: 1.1.2
tinyglobby: 0.2.16
tinyrainbow: 3.1.0
- vite: 7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)
+ vite: 7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0)
why-is-node-running: 2.3.0
optionalDependencies:
- '@opentelemetry/api': 1.9.0
+ '@opentelemetry/api': 1.9.1
'@types/node': 24.10.8
- '@vitest/browser-playwright': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+ '@vitest/browser-playwright': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.5(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.49.0)(yaml@2.9.0))(vitest@4.1.8)
'@vitest/coverage-v8': 4.1.8(@vitest/browser@4.1.8)(vitest@4.1.8)
jsdom: 27.4.0
transitivePeerDependencies:
@@ -18540,9 +14693,8 @@ snapshots:
walk-up-path@4.0.0: {}
- watchpack@2.5.1:
+ watchpack@2.5.2:
dependencies:
- glob-to-regexp: 0.4.1
graceful-fs: 4.2.11
web-namespaces@2.0.1: {}
@@ -18551,11 +14703,7 @@ snapshots:
webidl-conversions@8.0.1: {}
- webpack-sources@3.3.3: {}
-
- webpack-sources@3.4.1: {}
-
- webpack-virtual-modules@0.5.0: {}
+ webpack-sources@3.5.1: {}
webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14):
dependencies:
@@ -18565,12 +14713,12 @@ snapshots:
'@webassemblyjs/ast': 1.14.1
'@webassemblyjs/wasm-edit': 1.14.1
'@webassemblyjs/wasm-parser': 1.14.1
- acorn: 8.16.0
- acorn-import-phases: 1.0.4(acorn@8.16.0)
+ acorn: 8.17.0
+ acorn-import-phases: 1.0.4(acorn@8.17.0)
browserslist: 4.28.2
chrome-trace-event: 1.0.4
- enhanced-resolve: 5.21.2
- es-module-lexer: 2.1.0
+ enhanced-resolve: 5.24.2
+ es-module-lexer: 2.3.0
eslint-scope: 5.1.1
events: 3.3.0
glob-to-regexp: 0.4.1
@@ -18581,9 +14729,9 @@ snapshots:
neo-async: 2.6.2
schema-utils: 4.3.3
tapable: 2.3.3
- terser-webpack-plugin: 5.6.0(lightningcss@1.30.2)(postcss@8.5.14)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
- watchpack: 2.5.1
- webpack-sources: 3.4.1
+ terser-webpack-plugin: 5.6.1(lightningcss@1.30.2)(postcss@8.5.14)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
+ watchpack: 2.5.2
+ webpack-sources: 3.5.1
transitivePeerDependencies:
- '@minify-html/node'
- '@swc/core'
@@ -18672,17 +14820,9 @@ snapshots:
string-width: 4.2.3
strip-ansi: 6.0.1
- wrap-ansi@8.1.0:
- dependencies:
- ansi-styles: 6.2.3
- string-width: 5.1.2
- strip-ansi: 7.1.2
-
wrappy@1.0.2: {}
- ws@8.19.0: {}
-
- ws@8.20.1: {}
+ ws@8.21.0: {}
xml-name-validator@5.0.0: {}
@@ -18690,8 +14830,6 @@ snapshots:
xmlchars@2.2.0: {}
- xtend@4.0.2: {}
-
y18n@5.0.8: {}
yallist@3.1.1: {}
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index 3db3cc19e3..0a942af944 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -6,10 +6,6 @@ packages: []
# Refuse to install on Node/pnpm outside the `engines` block in package.json.
engineStrict: true
-# Hoist the HeroUI family so its legacy peer-dep pattern resolves.
-publicHoistPattern:
- - "*@heroui/*"
-
# Default `pnpm add` to exact versions — matches package.json convention.
saveExact: true
@@ -23,7 +19,13 @@ overrides:
"@react-aria/interactions>react": "19.2.7"
"lodash": "4.18.1"
"lodash-es": "4.18.1"
- "hono": "4.12.21"
+ # GHSA-88fw-hqm2-52qc (CORS reflects any Origin with credentials) + 4 moderate
+ # advisories (serve-static path traversal, Lambda Set-Cookie merge, body-limit
+ # bypass, Lambda@Edge repeated-header loss), all fixed in 4.12.25, plus
+ # CVE-2026-59896 (hono/jsx SSR context leak across concurrent requests; in NVD
+ # but not yet in the npm audit feed), fixed in 4.12.27. Not 4.12.29: it is
+ # still inside StepSecurity's 7-day npm cooldown gate.
+ "hono": "4.12.28"
"@hono/node-server": "1.19.14"
"@isaacs/brace-expansion": "5.0.1"
"fast-xml-parser": "5.8.0"
@@ -31,6 +33,29 @@ overrides:
"postcss": "8.5.14"
"esbuild": "0.28.1"
"rollup@>=4": "4.59.0"
+ # GHSA-fx2h-pf6j-xcff (server.fs.deny bypass on Windows alternate paths, high) +
+ # GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure). Dev-only tooling
+ # (vitest/@vitejs/plugin-react); consumers allow ^7 but never resolve past 7.3.2
+ # without a nudge.
+ "vite@>=7 <8": "7.3.5"
+ # GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments, high) +
+ # GHSA-58qx-3vcg-4xpx (uninitialized memory disclosure), both fixed in 8.21.0.
+ # Not 8.21.1: it is still inside StepSecurity's 7-day npm cooldown gate.
+ "ws@>=8 <9": "8.21.0"
+ # Pulled by @sentry/server-utils bundler plugins (^2.1.0). Pinned because the
+ # latest 2.3.1 is still inside StepSecurity's 7-day npm cooldown gate; safe to
+ # drop this pin after 2026-07-20.
+ "es-module-lexer": "2.3.0"
+ # GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL comment, low),
+ # fixed in 7.29.1. An override instead of `pnpm update` so the rest of the
+ # babel/browserslist subtree keeps its existing lockfile resolutions.
+ "@babel/core": "7.29.7"
+ # Ephemeral cooldown pins: the @babel/helper-compilation-targets refresh pulls
+ # browserslist-ecosystem releases newer than StepSecurity's 7-day npm cooldown.
+ # Safe to drop after 2026-07-20.
+ "browserslist": "4.28.2"
+ "caniuse-lite": "1.0.30001792"
+ "baseline-browser-mapping": "2.10.29"
"minimatch@<4": "3.1.4"
"minimatch@>=9 <10": "9.0.7"
"minimatch@>=10": "10.2.3"
@@ -46,9 +71,9 @@ overrides:
# but the override unifies the tree on a patched version.
"uuid": "11.1.1"
# GHSA-vxr8-fq34-vvx9 (+ several related XSS sanitization bypasses): DOMPurify < 3.4.9,
- # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Pinned to 3.4.10
- # (fixes all open advisories; 3.4.11 is < 24h old and blocked by minimumReleaseAge).
- "dompurify": "3.4.10"
+ # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Bumped to 3.4.11
+ # for GHSA-cmwh-pvxp-8882 (permanent ALLOWED_ATTR pollution via setConfig()).
+ "dompurify": "3.4.11"
# --- Level 1: Minimum Release Age ---
# Packages must be published for at least 1 day before they can be installed.
@@ -71,8 +96,6 @@ allowBuilds:
"@sentry/cli": true
# esbuild: Go binary. Downloads the pre-compiled binary matching the current platform/architecture.
esbuild: true
- # @heroui/shared-utils: Demi pattern — detects React/Next.js version at install time and copies the compatible bundle (React 18 vs 19).
- "@heroui/shared-utils": true
# unrs-resolver: Rust module resolver (NAPI-RS). Verifies the correct native binding is available for the platform.
unrs-resolver: true
# msw: Copies mockServiceWorker.js into the directories listed in package.json's `msw.workerDirectory` (here: `public/`) so the runtime worker stays in sync with the installed msw version. Pure file copy — no native binary, no network access. Required for vitest browser tests to intercept fetches via the service worker.
diff --git a/ui/proxy.ts b/ui/proxy.ts
index d3bb8eb20e..8784fd260f 100644
--- a/ui/proxy.ts
+++ b/ui/proxy.ts
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
import type { NextAuthRequest } from "next-auth";
import { auth } from "@/auth.config";
+import { readEnv } from "@/lib/runtime-env";
const publicRoutes = [
"/sign-in",
@@ -23,6 +24,8 @@ export default auth((req: NextAuthRequest) => {
const user = req.auth?.user;
const sessionError = req.auth?.error;
+ const cloudBillingEnabled =
+ (readEnv("CLOUD_BILLING_ENABLED") ?? "false") !== "false";
// If there's a session error (e.g., RefreshAccessTokenError), redirect to login with error info
if (sessionError && !isPublicRoute(pathname)) {
@@ -38,13 +41,16 @@ export default auth((req: NextAuthRequest) => {
return NextResponse.redirect(signInUrl);
}
+ if (
+ pathname.startsWith("/billing") &&
+ (!cloudBillingEnabled || user?.permissions?.manage_billing !== true)
+ ) {
+ return NextResponse.redirect(new URL("/profile", req.url));
+ }
+
if (user?.permissions) {
const permissions = user.permissions;
- if (pathname.startsWith("/billing") && !permissions.manage_billing) {
- return NextResponse.redirect(new URL("/profile", req.url));
- }
-
if (
pathname.startsWith("/integrations") &&
!permissions.manage_integrations
diff --git a/ui/public/logos/prowler-cloud-dark.svg b/ui/public/logos/prowler-cloud-dark.svg
new file mode 100644
index 0000000000..9f3a725746
--- /dev/null
+++ b/ui/public/logos/prowler-cloud-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="63.14" viewBox="0 0 200 63.14"><defs><linearGradient id="lh" x1="0" y1="0" x2="1" y2="0.14"><stop offset="0" stop-color="#2EE59B"></stop><stop offset="1" stop-color="#62DFF0"></stop></linearGradient></defs><g transform="scale(0.1621179084)"><path d="M1169.38,132.04c20.76-12.21,34.44-34.9,34.44-59.79,0-38.18-31.06-69.25-69.25-69.25l-216.9.23v145.17h-64.8V3h-79.95s-47.14,95.97-47.14,95.97V3h-52.09s-47.14,95.97-47.14,95.97V3h-53.48v69.6C560.37,30.64,521.34,0,475.28,0c-42.63,0-79.24,26.25-94.54,63.43-4.35-34.03-33.48-60.43-68.67-60.43h-100.01v47.43C202.9,22.91,176.91,3,146.35,3H0s46.34,46.33,46.34,46.33v151.64h53.47v-76.68l17.21,17.21h29.33c30.56,0,56.54-19.91,65.71-47.43v106.91h53.48v-81.51l76.01,81.51h69.62l-64.29-68.94c11.14-6.56,20.22-16.15,26.26-27.46,1.27,55.26,46.58,99.82,102.14,99.82,46.06,0,85.09-30.64,97.81-72.6v69.18h60.88l38.34-78.06v78.06h60.88l66.2-134.78v135.69h95.41l22.86-22.86v22.86h95.05l21.84-21.84v20.93h53.48v-81.5l76.01,81.5h69.62l-64.29-68.94ZM146.35,88.02h-46.54v-31.54h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77ZM312.07,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.08,15.77-15.77,15.77ZM475.28,150.92c-26.86,0-48.72-21.86-48.72-48.72s21.86-48.72,48.72-48.72,48.72,21.86,48.72,48.72-21.86,48.72-48.72,48.72ZM1034.56,148.41h-63.41v-20.35h42.91v-50.88h-42.91v-20.46h63.41v91.69ZM1134.57,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77Z" fill="#ffffff"></path></g><text x="200" y="59.14" text-anchor="end" font-family="ProwlerInter, Inter, sans-serif" font-weight="600" font-size="19" letter-spacing="0.7" fill="url(#lh)">CLOUD</text></svg>
diff --git a/ui/public/logos/prowler-cloud-light.svg b/ui/public/logos/prowler-cloud-light.svg
new file mode 100644
index 0000000000..b1a72167b6
--- /dev/null
+++ b/ui/public/logos/prowler-cloud-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="63.14" viewBox="0 0 200 63.14"><defs><linearGradient id="lh" x1="0" y1="0" x2="1" y2="0.14"><stop offset="0" stop-color="#2EE59B"></stop><stop offset="1" stop-color="#62DFF0"></stop></linearGradient></defs><g transform="scale(0.1621179084)"><path d="M1169.38,132.04c20.76-12.21,34.44-34.9,34.44-59.79,0-38.18-31.06-69.25-69.25-69.25l-216.9.23v145.17h-64.8V3h-79.95s-47.14,95.97-47.14,95.97V3h-52.09s-47.14,95.97-47.14,95.97V3h-53.48v69.6C560.37,30.64,521.34,0,475.28,0c-42.63,0-79.24,26.25-94.54,63.43-4.35-34.03-33.48-60.43-68.67-60.43h-100.01v47.43C202.9,22.91,176.91,3,146.35,3H0s46.34,46.33,46.34,46.33v151.64h53.47v-76.68l17.21,17.21h29.33c30.56,0,56.54-19.91,65.71-47.43v106.91h53.48v-81.51l76.01,81.51h69.62l-64.29-68.94c11.14-6.56,20.22-16.15,26.26-27.46,1.27,55.26,46.58,99.82,102.14,99.82,46.06,0,85.09-30.64,97.81-72.6v69.18h60.88l38.34-78.06v78.06h60.88l66.2-134.78v135.69h95.41l22.86-22.86v22.86h95.05l21.84-21.84v20.93h53.48v-81.5l76.01,81.5h69.62l-64.29-68.94ZM146.35,88.02h-46.54v-31.54h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77ZM312.07,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.08,15.77-15.77,15.77ZM475.28,150.92c-26.86,0-48.72-21.86-48.72-48.72s21.86-48.72,48.72-48.72,48.72,21.86,48.72,48.72-21.86,48.72-48.72,48.72ZM1034.56,148.41h-63.41v-20.35h42.91v-50.88h-42.91v-20.46h63.41v91.69ZM1134.57,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77Z" fill="#0C0A09"></path></g><text x="200" y="59.14" text-anchor="end" font-family="ProwlerInter, Inter, sans-serif" font-weight="600" font-size="19" letter-spacing="0.7" fill="url(#lh)">CLOUD</text></svg>
diff --git a/ui/public/logos/prowler-local-server-dark.svg b/ui/public/logos/prowler-local-server-dark.svg
new file mode 100644
index 0000000000..7232e06f8c
--- /dev/null
+++ b/ui/public/logos/prowler-local-server-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="63.14" viewBox="0 0 200 63.14"><defs><linearGradient id="lh" x1="0" y1="0" x2="1" y2="0.14"><stop offset="0" stop-color="#2EE59B"></stop><stop offset="1" stop-color="#62DFF0"></stop></linearGradient></defs><g transform="scale(0.1621179084)"><path d="M1169.38,132.04c20.76-12.21,34.44-34.9,34.44-59.79,0-38.18-31.06-69.25-69.25-69.25l-216.9.23v145.17h-64.8V3h-79.95s-47.14,95.97-47.14,95.97V3h-52.09s-47.14,95.97-47.14,95.97V3h-53.48v69.6C560.37,30.64,521.34,0,475.28,0c-42.63,0-79.24,26.25-94.54,63.43-4.35-34.03-33.48-60.43-68.67-60.43h-100.01v47.43C202.9,22.91,176.91,3,146.35,3H0s46.34,46.33,46.34,46.33v151.64h53.47v-76.68l17.21,17.21h29.33c30.56,0,56.54-19.91,65.71-47.43v106.91h53.48v-81.51l76.01,81.51h69.62l-64.29-68.94c11.14-6.56,20.22-16.15,26.26-27.46,1.27,55.26,46.58,99.82,102.14,99.82,46.06,0,85.09-30.64,97.81-72.6v69.18h60.88l38.34-78.06v78.06h60.88l66.2-134.78v135.69h95.41l22.86-22.86v22.86h95.05l21.84-21.84v20.93h53.48v-81.5l76.01,81.5h69.62l-64.29-68.94ZM146.35,88.02h-46.54v-31.54h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77ZM312.07,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.08,15.77-15.77,15.77ZM475.28,150.92c-26.86,0-48.72-21.86-48.72-48.72s21.86-48.72,48.72-48.72,48.72,21.86,48.72,48.72-21.86,48.72-48.72,48.72ZM1034.56,148.41h-63.41v-20.35h42.91v-50.88h-42.91v-20.46h63.41v91.69ZM1134.57,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77Z" fill="#ffffff"></path></g><text x="200" y="59.14" text-anchor="end" font-family="ProwlerInter, Inter, sans-serif" font-weight="600" font-size="19" letter-spacing="0.7" fill="url(#lh)">LOCAL SERVER</text></svg>
diff --git a/ui/public/logos/prowler-local-server-light.svg b/ui/public/logos/prowler-local-server-light.svg
new file mode 100644
index 0000000000..f06e400601
--- /dev/null
+++ b/ui/public/logos/prowler-local-server-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="63.14" viewBox="0 0 200 63.14"><defs><linearGradient id="lh" x1="0" y1="0" x2="1" y2="0.14"><stop offset="0" stop-color="#2EE59B"></stop><stop offset="1" stop-color="#62DFF0"></stop></linearGradient></defs><g transform="scale(0.1621179084)"><path d="M1169.38,132.04c20.76-12.21,34.44-34.9,34.44-59.79,0-38.18-31.06-69.25-69.25-69.25l-216.9.23v145.17h-64.8V3h-79.95s-47.14,95.97-47.14,95.97V3h-52.09s-47.14,95.97-47.14,95.97V3h-53.48v69.6C560.37,30.64,521.34,0,475.28,0c-42.63,0-79.24,26.25-94.54,63.43-4.35-34.03-33.48-60.43-68.67-60.43h-100.01v47.43C202.9,22.91,176.91,3,146.35,3H0s46.34,46.33,46.34,46.33v151.64h53.47v-76.68l17.21,17.21h29.33c30.56,0,56.54-19.91,65.71-47.43v106.91h53.48v-81.51l76.01,81.51h69.62l-64.29-68.94c11.14-6.56,20.22-16.15,26.26-27.46,1.27,55.26,46.58,99.82,102.14,99.82,46.06,0,85.09-30.64,97.81-72.6v69.18h60.88l38.34-78.06v78.06h60.88l66.2-134.78v135.69h95.41l22.86-22.86v22.86h95.05l21.84-21.84v20.93h53.48v-81.5l76.01,81.5h69.62l-64.29-68.94ZM146.35,88.02h-46.54v-31.54h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77ZM312.07,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.08,15.77-15.77,15.77ZM475.28,150.92c-26.86,0-48.72-21.86-48.72-48.72s21.86-48.72,48.72-48.72,48.72,21.86,48.72,48.72-21.86,48.72-48.72,48.72ZM1034.56,148.41h-63.41v-20.35h42.91v-50.88h-42.91v-20.46h63.41v91.69ZM1134.57,88.02l-46.54-.18v-31.36h46.54c8.7,0,15.77,7.07,15.77,15.77s-7.07,15.77-15.77,15.77Z" fill="#0C0A09"></path></g><text x="200" y="59.14" text-anchor="end" font-family="ProwlerInter, Inter, sans-serif" font-weight="600" font-size="19" letter-spacing="0.7" fill="url(#lh)">LOCAL SERVER</text></svg>
diff --git a/ui/sentry/sentry.edge.config.test.ts b/ui/sentry/sentry.edge.config.test.ts
index 918e686eb0..f831c045ea 100644
--- a/ui/sentry/sentry.edge.config.test.ts
+++ b/ui/sentry/sentry.edge.config.test.ts
@@ -20,6 +20,7 @@ describe("sentry.edge.config", () => {
it("should initialize with the resolved environment and reduced edge sampling", async () => {
// Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
@@ -36,7 +37,18 @@ describe("sentry.edge.config", () => {
});
it("should not initialize when the DSN is absent", async () => {
- // Given no DSN
+ // Given no DSN (and no enable flag)
+
+ // When
+ await import("./sentry.edge.config");
+
+ // Then
+ expect(initMock).not.toHaveBeenCalled();
+ });
+
+ it("should not initialize when UI_SENTRY_ENABLED is unset even if a DSN is set", async () => {
+ // Given - DSN configured but the enable flag is not "true"
+ vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
// When
await import("./sentry.edge.config");
@@ -46,7 +58,8 @@ describe("sentry.edge.config", () => {
});
it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
- // Given - DSN set but environment unset
+ // Given - enabled with a DSN but environment unset
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
// When
diff --git a/ui/sentry/sentry.edge.config.ts b/ui/sentry/sentry.edge.config.ts
index 933c97822a..f4f10d0566 100644
--- a/ui/sentry/sentry.edge.config.ts
+++ b/ui/sentry/sentry.edge.config.ts
@@ -1,9 +1,14 @@
import * as Sentry from "@sentry/nextjs";
-import { readEnv } from "@/lib/runtime-env";
+import { readGatedEnv } from "@/lib/integrations";
-const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
-const sentryEnvironment = readEnv(
+const sentryDsn = readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+);
+const sentryEnvironment = readGatedEnv(
+ "UI_SENTRY_ENABLED",
"UI_SENTRY_ENVIRONMENT",
"NEXT_PUBLIC_SENTRY_ENVIRONMENT",
);
diff --git a/ui/sentry/sentry.server.config.test.ts b/ui/sentry/sentry.server.config.test.ts
index a3d75cc856..a77e7ff5e1 100644
--- a/ui/sentry/sentry.server.config.test.ts
+++ b/ui/sentry/sentry.server.config.test.ts
@@ -21,6 +21,7 @@ describe("sentry.server.config", () => {
it("should initialize with the resolved environment and production sampling", async () => {
// Given
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
@@ -38,7 +39,18 @@ describe("sentry.server.config", () => {
});
it("should not initialize when the DSN is absent", async () => {
- // Given no DSN
+ // Given no DSN (and no enable flag)
+
+ // When
+ await import("./sentry.server.config");
+
+ // Then
+ expect(initMock).not.toHaveBeenCalled();
+ });
+
+ it("should not initialize when UI_SENTRY_ENABLED is unset even if a DSN is set", async () => {
+ // Given - DSN configured but the enable flag is not "true"
+ vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
// When
await import("./sentry.server.config");
@@ -48,7 +60,8 @@ describe("sentry.server.config", () => {
});
it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
- // Given - DSN set but environment unset
+ // Given - enabled with a DSN but environment unset
+ vi.stubEnv("UI_SENTRY_ENABLED", "true");
vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
// When
diff --git a/ui/sentry/sentry.server.config.ts b/ui/sentry/sentry.server.config.ts
index 361365f2ec..3a3ac491da 100644
--- a/ui/sentry/sentry.server.config.ts
+++ b/ui/sentry/sentry.server.config.ts
@@ -1,9 +1,14 @@
import * as Sentry from "@sentry/nextjs";
-import { readEnv } from "@/lib/runtime-env";
+import { readGatedEnv } from "@/lib/integrations";
-const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
-const sentryEnvironment = readEnv(
+const sentryDsn = readGatedEnv(
+ "UI_SENTRY_ENABLED",
+ "UI_SENTRY_DSN",
+ "NEXT_PUBLIC_SENTRY_DSN",
+);
+const sentryEnvironment = readGatedEnv(
+ "UI_SENTRY_ENABLED",
"UI_SENTRY_ENVIRONMENT",
"NEXT_PUBLIC_SENTRY_ENVIRONMENT",
);
diff --git a/ui/store/__tests__/side-panel.test.ts b/ui/store/__tests__/side-panel.test.ts
new file mode 100644
index 0000000000..0f1fb1b36e
--- /dev/null
+++ b/ui/store/__tests__/side-panel.test.ts
@@ -0,0 +1,346 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+ SIDE_PANEL_DEFAULT_WIDTH,
+ SIDE_PANEL_DETAIL_MIN_WIDTH,
+ SIDE_PANEL_MAX_WIDTH,
+ SIDE_PANEL_MIN_WIDTH,
+} from "@/lib/ui-layout";
+import { SIDE_PANEL_TAB, useSidePanelStore } from "@/store/side-panel";
+
+describe("useSidePanelStore", () => {
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ beforeEach(() => {
+ localStorage.clear();
+ useSidePanelStore.setState({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ hasBeenOpened: false,
+ width: SIDE_PANEL_DEFAULT_WIDTH,
+ isResizing: false,
+ contextTab: null,
+ contextOwnerToken: 0,
+ contextOutlet: null,
+ hasSeenAiTriggerHint: false,
+ });
+ });
+
+ it("opens the panel on the requested tab and latches hasBeenOpened", () => {
+ // When
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // Then
+ const state = useSidePanelStore.getState();
+ expect(state.isOpen).toBe(true);
+ expect(state.selectedTab).toBe(SIDE_PANEL_TAB.AI_CHAT);
+ expect(state.hasBeenOpened).toBe(true);
+ });
+
+ it("reopens on the last selected tab when no tab is given", () => {
+ // Given
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+ useSidePanelStore.getState().closePanel();
+
+ // When
+ useSidePanelStore.getState().openPanel();
+
+ // Then
+ expect(useSidePanelStore.getState().selectedTab).toBe(
+ SIDE_PANEL_TAB.AI_CHAT,
+ );
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+ });
+
+ it("keeps content latched as mounted after closing", () => {
+ // Given
+ useSidePanelStore.getState().openPanel();
+
+ // When
+ useSidePanelStore.getState().closePanel();
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ expect(useSidePanelStore.getState().hasBeenOpened).toBe(true);
+ });
+
+ it("ignores a tab-scoped close for a tab that is not showing", () => {
+ // Given
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // When: a stale closer targets a different tab id
+ useSidePanelStore.getState().closePanel(SIDE_PANEL_TAB.CONTEXT);
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+
+ // When: the close targets the showing tab
+ useSidePanelStore.getState().closePanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // Then
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("toggles open and closed", () => {
+ // When / Then
+ useSidePanelStore.getState().togglePanel();
+ expect(useSidePanelStore.getState().isOpen).toBe(true);
+ expect(useSidePanelStore.getState().hasBeenOpened).toBe(true);
+
+ useSidePanelStore.getState().togglePanel();
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("registering a context tab opens the panel on it", () => {
+ // When
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // Then
+ const state = useSidePanelStore.getState();
+ expect(state.isOpen).toBe(true);
+ expect(state.selectedTab).toBe(SIDE_PANEL_TAB.CONTEXT);
+ expect(state.contextTab?.label).toBe("Details");
+ });
+
+ it("closing the panel asks the context owner to close its detail view", () => {
+ // Given
+ const onRequestClose = vi.fn();
+ useSidePanelStore
+ .getState()
+ .registerContextTab({ label: "Details", onRequestClose });
+
+ // When: the user dismisses the panel (X button / Escape)
+ useSidePanelStore.getState().closePanel();
+
+ // Then: the owning table is told to clear its selection
+ expect(onRequestClose).toHaveBeenCalledTimes(1);
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("asks the context owner to close even while the AI tab is showing", () => {
+ // Given: details registered, user switched to the AI tab
+ const onRequestClose = vi.fn();
+ useSidePanelStore
+ .getState()
+ .registerContextTab({ label: "Details", onRequestClose });
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // When
+ useSidePanelStore.getState().closePanel();
+
+ // Then: dismissing the panel dismisses the detail view it hosts
+ expect(onRequestClose).toHaveBeenCalledTimes(1);
+ });
+
+ it("unregistering the showing context tab closes the panel and falls back to AI", () => {
+ // Given
+ const token = useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // When
+ useSidePanelStore.getState().unregisterContextTab(token);
+
+ // Then
+ const state = useSidePanelStore.getState();
+ expect(state.contextTab).toBeNull();
+ expect(state.isOpen).toBe(false);
+ expect(state.selectedTab).toBe(SIDE_PANEL_TAB.AI_CHAT);
+ });
+
+ it("unregistering while the AI tab is showing keeps the panel open", () => {
+ // Given: details registered but the user is chatting
+ const token = useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // When
+ useSidePanelStore.getState().unregisterContextTab(token);
+
+ // Then: the chat survives; only the Details tab disappears
+ const state = useSidePanelStore.getState();
+ expect(state.contextTab).toBeNull();
+ expect(state.isOpen).toBe(true);
+ expect(state.selectedTab).toBe(SIDE_PANEL_TAB.AI_CHAT);
+ });
+
+ it("replacing the context tab asks the previous owner to close itself", () => {
+ // Given: finding A's detail view owns the context tab
+ const closeA = vi.fn();
+ useSidePanelStore
+ .getState()
+ .registerContextTab({ label: "Details", onRequestClose: closeA });
+
+ // When: finding B's detail view registers
+ const closeB = vi.fn();
+ useSidePanelStore
+ .getState()
+ .registerContextTab({ label: "Details", onRequestClose: closeB });
+
+ // Then: A is told to close; B stays untouched as the new owner
+ expect(closeA).toHaveBeenCalledTimes(1);
+ expect(closeB).not.toHaveBeenCalled();
+ expect(useSidePanelStore.getState().contextTab?.onRequestClose).toBe(
+ closeB,
+ );
+ });
+
+ it("ignores an unregister from a replaced (stale) owner", () => {
+ // Given: A registered, then B took over the context tab
+ const tokenA = useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+ const tokenB = useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // When: A unmounts late and unregisters with its stale token
+ useSidePanelStore.getState().unregisterContextTab(tokenA);
+
+ // Then: B's registration survives
+ const state = useSidePanelStore.getState();
+ expect(state.contextTab).not.toBeNull();
+ expect(state.contextOwnerToken).toBe(tokenB);
+ expect(state.isOpen).toBe(true);
+
+ // When: the current owner unregisters
+ useSidePanelStore.getState().unregisterContextTab(tokenB);
+
+ // Then
+ expect(useSidePanelStore.getState().contextTab).toBeNull();
+ expect(useSidePanelStore.getState().isOpen).toBe(false);
+ });
+
+ it("clamps resize widths to the allowed range", () => {
+ // When: dragging far past both limits (jsdom viewport is 1024px wide)
+ useSidePanelStore.getState().setWidth(100);
+ expect(useSidePanelStore.getState().width).toBe(SIDE_PANEL_MIN_WIDTH);
+
+ useSidePanelStore.getState().setWidth(5000);
+ // Then: capped at 85% of the viewport
+ expect(useSidePanelStore.getState().width).toBe(
+ Math.floor(window.innerWidth * 0.85),
+ );
+ });
+
+ it("allows the panel to grow to half the viewport on ultra-wide screens", () => {
+ // Given: a viewport wider than the standard 1920px maximum threshold
+ vi.stubGlobal("innerWidth", 2560);
+
+ // When
+ useSidePanelStore.getState().setWidth(5000);
+
+ // Then
+ expect(useSidePanelStore.getState().width).toBe(1280);
+ });
+
+ it("keeps the standard maximum on screens up to 1920px wide", () => {
+ // Given
+ vi.stubGlobal("innerWidth", 1920);
+
+ // When
+ useSidePanelStore.getState().setWidth(5000);
+
+ // Then
+ expect(useSidePanelStore.getState().width).toBe(SIDE_PANEL_MAX_WIDTH);
+ });
+
+ it("widens to detail room when a context tab registers, keeping wider user choices", () => {
+ // When: registering with the default (chat) width
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // Then
+ expect(useSidePanelStore.getState().width).toBe(
+ SIDE_PANEL_DETAIL_MIN_WIDTH,
+ );
+
+ // Given: the user resized wider than the detail minimum
+ useSidePanelStore.getState().setWidth(800);
+
+ // When
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // Then: the wider choice is respected
+ expect(useSidePanelStore.getState().width).toBe(800);
+ });
+
+ it("persists only the selected tab and width, never open state nor the context tab", () => {
+ // When: the context tab is the one selected
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // Then: a transient context selection is persisted as the AI tab
+ const persisted = JSON.parse(
+ localStorage.getItem("side-panel-store") ?? "{}",
+ );
+ expect(persisted.state).toEqual({
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ width: SIDE_PANEL_DETAIL_MIN_WIDTH,
+ hasSeenAiTriggerHint: false,
+ });
+ expect(persisted.state.isOpen).toBeUndefined();
+ expect(persisted.state.contextTab).toBeUndefined();
+ });
+
+ it("retires the AI trigger hint when the AI chat opens by any entry point", () => {
+ // When: the trigger (or the Overview banner) opens the AI chat
+ useSidePanelStore.getState().openPanel(SIDE_PANEL_TAB.AI_CHAT);
+
+ // Then
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(true);
+ });
+
+ it("retires the AI trigger hint when ⌘. toggles the panel open on the AI tab", () => {
+ // Given: the AI tab is the remembered selection
+ expect(useSidePanelStore.getState().selectedTab).toBe(
+ SIDE_PANEL_TAB.AI_CHAT,
+ );
+
+ // When
+ useSidePanelStore.getState().togglePanel();
+
+ // Then
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(true);
+ });
+
+ it("keeps the AI trigger hint while only a detail view opens the panel", () => {
+ // When: a detail view registers (panel opens on the context tab)
+ useSidePanelStore.getState().registerContextTab({
+ label: "Details",
+ onRequestClose: vi.fn(),
+ });
+
+ // Then: the user has not discovered the AI entry point yet
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(false);
+ });
+
+ it("marks and persists the AI trigger hint as seen on dismissal", () => {
+ // When
+ useSidePanelStore.getState().markAiTriggerHintSeen();
+
+ // Then
+ expect(useSidePanelStore.getState().hasSeenAiTriggerHint).toBe(true);
+ const persisted = JSON.parse(
+ localStorage.getItem("side-panel-store") ?? "{}",
+ );
+ expect(persisted.state.hasSeenAiTriggerHint).toBe(true);
+ });
+});
diff --git a/ui/store/cloud-upgrade/store.ts b/ui/store/cloud-upgrade/store.ts
new file mode 100644
index 0000000000..8136dbb8b4
--- /dev/null
+++ b/ui/store/cloud-upgrade/store.ts
@@ -0,0 +1,29 @@
+import { create } from "zustand";
+
+import type { CloudUpgradeFeature } from "@/types/cloud-upgrade";
+
+interface CloudUpgradeStoreState {
+ activeFeature: CloudUpgradeFeature | null;
+ returnFocusElement: HTMLElement | null;
+ openCloudUpgrade: (
+ feature: CloudUpgradeFeature,
+ returnFocusElement?: HTMLElement,
+ ) => void;
+ closeCloudUpgrade: () => void;
+}
+
+// Upgrade prompts are ephemeral and shared so only one modal can be open.
+export const useCloudUpgradeStore = create<CloudUpgradeStoreState>((set) => ({
+ activeFeature: null,
+ returnFocusElement: null,
+ openCloudUpgrade: (activeFeature, requestedReturnFocusElement) =>
+ set({
+ activeFeature,
+ returnFocusElement:
+ requestedReturnFocusElement ??
+ (document.activeElement instanceof HTMLElement
+ ? document.activeElement
+ : null),
+ }),
+ closeCloudUpgrade: () => set({ activeFeature: null }),
+}));
diff --git a/ui/store/index.ts b/ui/store/index.ts
index d02b02187b..1c181a35c7 100644
--- a/ui/store/index.ts
+++ b/ui/store/index.ts
@@ -1,3 +1,4 @@
+export * from "./cloud-upgrade/store";
export * from "./organizations/store";
export * from "./provider-wizard/store";
export * from "./scans/store";
diff --git a/ui/store/side-panel.ts b/ui/store/side-panel.ts
new file mode 100644
index 0000000000..50efd8ac8e
--- /dev/null
+++ b/ui/store/side-panel.ts
@@ -0,0 +1,162 @@
+import { create } from "zustand";
+import { persist } from "zustand/middleware";
+
+import {
+ clampSidePanelWidth,
+ SIDE_PANEL_DEFAULT_WIDTH,
+ SIDE_PANEL_DETAIL_MIN_WIDTH,
+} from "@/lib/ui-layout";
+
+export const SIDE_PANEL_TAB = {
+ AI_CHAT: "ai-chat",
+ // Dynamic tab registered by the page currently showing a detail view
+ // (finding/resource). Never persisted and never in the static registry.
+ CONTEXT: "context",
+} as const;
+
+export type SidePanelTabId =
+ (typeof SIDE_PANEL_TAB)[keyof typeof SIDE_PANEL_TAB];
+
+interface SidePanelContextTab {
+ label: string;
+ // Called when the panel is dismissed so the owning table can clear its
+ // selection (the owner controls `open`; the panel never owns detail state).
+ onRequestClose: () => void;
+}
+
+interface SidePanelState {
+ isOpen: boolean;
+ selectedTab: SidePanelTabId;
+ // Lazy-mount latch: panel content mounts on first open and then stays
+ // mounted (hidden) so scroll position and composer drafts survive closes.
+ hasBeenOpened: boolean;
+ // User-resizable width in px (persisted); MainLayout pushes by this amount.
+ width: number;
+ isResizing: boolean;
+ contextTab: SidePanelContextTab | null;
+ // Token of the current context-tab owner (0 = none): several detail views
+ // can be mounted at once, but only the owner portals content and only the
+ // owner's unregister takes effect.
+ contextOwnerToken: number;
+ // Portal target the context owner renders its detail content into.
+ contextOutlet: HTMLElement | null;
+ // One-time discovery callout on the navbar trigger (persisted): true once
+ // the user dismissed it or reached the AI chat panel by any entry point.
+ hasSeenAiTriggerHint: boolean;
+ openPanel: (tab?: SidePanelTabId) => void;
+ closePanel: (tab?: SidePanelTabId) => void;
+ togglePanel: () => void;
+ setWidth: (width: number) => void;
+ setIsResizing: (isResizing: boolean) => void;
+ registerContextTab: (tab: SidePanelContextTab) => number;
+ unregisterContextTab: (token: number) => void;
+ setContextOutlet: (element: HTMLElement | null) => void;
+ markAiTriggerHintSeen: () => void;
+}
+
+// Monotonic so a recycled token can never let a stale detail view unregister
+// (or portal over) a later registrant.
+let contextTabTokenCounter = 0;
+
+export const useSidePanelStore = create<SidePanelState>()(
+ persist(
+ (set, get) => ({
+ isOpen: false,
+ selectedTab: SIDE_PANEL_TAB.AI_CHAT,
+ hasBeenOpened: false,
+ width: SIDE_PANEL_DEFAULT_WIDTH,
+ isResizing: false,
+ contextTab: null,
+ contextOwnerToken: 0,
+ contextOutlet: null,
+ hasSeenAiTriggerHint: false,
+ openPanel: (tab) => {
+ const selectedTab = tab ?? get().selectedTab;
+ set({
+ isOpen: true,
+ hasBeenOpened: true,
+ selectedTab,
+ // Reaching the AI chat by any entry point retires the discovery
+ // callout: the user no longer needs to be pointed at the trigger.
+ ...(selectedTab === SIDE_PANEL_TAB.AI_CHAT
+ ? { hasSeenAiTriggerHint: true }
+ : {}),
+ });
+ },
+ // Tab-scoped close only applies while that tab is showing, so a stale
+ // closer never hides a panel someone else switched to another tab.
+ closePanel: (tab) => {
+ const { selectedTab, contextTab } = get();
+ if (tab && tab !== selectedTab) return;
+ set({ isOpen: false });
+ // Dismissing the panel dismisses the detail view it hosts.
+ contextTab?.onRequestClose();
+ },
+ togglePanel: () => {
+ const { isOpen } = get();
+ if (isOpen) {
+ get().closePanel();
+ return;
+ }
+ set({
+ isOpen: true,
+ hasBeenOpened: true,
+ ...(get().selectedTab === SIDE_PANEL_TAB.AI_CHAT
+ ? { hasSeenAiTriggerHint: true }
+ : {}),
+ });
+ },
+ setWidth: (width) => set({ width: clampSidePanelWidth(width) }),
+ setIsResizing: (isResizing) => set({ isResizing }),
+ registerContextTab: (tab) => {
+ // A new detail view takes over the single context tab: ask the
+ // previous owner to close itself so it clears its own selection.
+ get().contextTab?.onRequestClose();
+ const token = ++contextTabTokenCounter;
+ set((state) => ({
+ contextTab: tab,
+ contextOwnerToken: token,
+ selectedTab: SIDE_PANEL_TAB.CONTEXT,
+ isOpen: true,
+ hasBeenOpened: true,
+ // Detail content needs drawer-like room; never shrink a wider
+ // user-chosen width.
+ width: clampSidePanelWidth(
+ Math.max(state.width, SIDE_PANEL_DETAIL_MIN_WIDTH),
+ ),
+ }));
+ return token;
+ },
+ unregisterContextTab: (token) => {
+ // Only the current owner may unregister: a replaced detail view
+ // unmounting later must not tear down its successor.
+ if (token !== get().contextOwnerToken) return;
+ set((state) => ({
+ contextTab: null,
+ contextOwnerToken: 0,
+ // When the detail tab was showing, its content is gone: close the
+ // panel and leave the AI tab as the next default.
+ ...(state.selectedTab === SIDE_PANEL_TAB.CONTEXT
+ ? { isOpen: false, selectedTab: SIDE_PANEL_TAB.AI_CHAT }
+ : {}),
+ }));
+ },
+ setContextOutlet: (element) => set({ contextOutlet: element }),
+ markAiTriggerHintSeen: () => set({ hasSeenAiTriggerHint: true }),
+ }),
+ {
+ name: "side-panel-store",
+ // Only the last-used tab, width, and the one-time hint persist; the
+ // panel never auto-reopens and a context tab cannot exist on a fresh
+ // load.
+ partialize: (state) => ({
+ selectedTab:
+ state.selectedTab === SIDE_PANEL_TAB.CONTEXT
+ ? SIDE_PANEL_TAB.AI_CHAT
+ : state.selectedTab,
+ width: state.width,
+ hasSeenAiTriggerHint: state.hasSeenAiTriggerHint,
+ }),
+ },
+ ),
+);
diff --git a/ui/store/task-watcher/store.test.ts b/ui/store/task-watcher/store.test.ts
new file mode 100644
index 0000000000..d1fbdb6188
--- /dev/null
+++ b/ui/store/task-watcher/store.test.ts
@@ -0,0 +1,257 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { pollMock } = vi.hoisted(() => ({
+ pollMock: vi.fn(),
+}));
+
+vi.mock("@/actions/task/poll", () => ({
+ pollTaskUntilSettled: pollMock,
+}));
+
+import {
+ registerTaskKindHandler,
+ resumePendingTasks,
+ TASK_WATCHER_STATUS,
+ trackAndPollTask,
+ useTaskWatcherStore,
+} from "./store";
+
+const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+describe("task watcher store", () => {
+ const onReady = vi.fn();
+ const onError = vi.fn();
+
+ beforeEach(() => {
+ vi.clearAllMocks();
+ localStorage.clear();
+ Object.defineProperty(navigator, "locks", {
+ configurable: true,
+ value: undefined,
+ });
+ useTaskWatcherStore.setState({ tasks: {} });
+ registerTaskKindHandler("test-kind", { onReady, onError });
+ });
+
+ it("tracks a task, polls it to completion and fires onReady once", async () => {
+ pollMock.mockResolvedValue({ ok: true, state: "completed" });
+
+ await trackAndPollTask({
+ taskId: "task-1",
+ kind: "test-kind",
+ meta: { complianceId: "csa_ccm_4.0" },
+ });
+
+ const task = useTaskWatcherStore.getState().tasks["task-1"];
+ expect(task?.status).toBe(TASK_WATCHER_STATUS.READY);
+ expect(onReady).toHaveBeenCalledTimes(1);
+ expect(onReady.mock.calls[0][0].meta.complianceId).toBe("csa_ccm_4.0");
+ expect(onError).not.toHaveBeenCalled();
+ });
+
+ it("replaces settled results of the same kind when tracking new work", async () => {
+ // Given
+ pollMock.mockResolvedValue({ ok: true, state: "completed" });
+ useTaskWatcherStore.setState({
+ tasks: {
+ "previous-task": {
+ taskId: "previous-task",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.READY,
+ meta: {},
+ startedAt: Date.now() - 1000,
+ },
+ },
+ });
+
+ // When
+ await trackAndPollTask({
+ taskId: "replacement-task",
+ kind: "test-kind",
+ meta: {},
+ });
+
+ // Then
+ expect(
+ useTaskWatcherStore.getState().tasks["previous-task"],
+ ).toBeUndefined();
+ expect(
+ useTaskWatcherStore.getState().tasks["replacement-task"]?.status,
+ ).toBe(TASK_WATCHER_STATUS.READY);
+ });
+
+ it("marks the task as error when the backend task fails", async () => {
+ pollMock.mockResolvedValue({ ok: true, state: "failed" });
+
+ await trackAndPollTask({
+ taskId: "task-2",
+ kind: "test-kind",
+ meta: {},
+ });
+
+ expect(useTaskWatcherStore.getState().tasks["task-2"]).toBeUndefined();
+ expect(onError).toHaveBeenCalledTimes(1);
+ expect(onReady).not.toHaveBeenCalled();
+ });
+
+ it("settles the task as error when polling itself throws", async () => {
+ pollMock.mockRejectedValue(new Error("network down"));
+
+ await trackAndPollTask({ taskId: "task-7", kind: "test-kind", meta: {} });
+
+ expect(useTaskWatcherStore.getState().tasks["task-7"]).toBeUndefined();
+ expect(onError).toHaveBeenCalledTimes(1);
+ expect(onReady).not.toHaveBeenCalled();
+ });
+
+ it("keeps polling through transient timeouts until the ceiling", async () => {
+ pollMock
+ .mockResolvedValueOnce({ ok: false, error: "Task timeout" })
+ .mockResolvedValueOnce({ ok: true, state: "completed" });
+
+ await trackAndPollTask({ taskId: "task-3", kind: "test-kind", meta: {} });
+
+ expect(pollMock).toHaveBeenCalledTimes(2);
+ expect(useTaskWatcherStore.getState().tasks["task-3"]?.status).toBe(
+ TASK_WATCHER_STATUS.READY,
+ );
+ });
+
+ it("does not start a second poll loop for an already-pending task", async () => {
+ let resolvePoll: (value: unknown) => void = () => {};
+ pollMock.mockImplementation(
+ () => new Promise((resolve) => (resolvePoll = resolve)),
+ );
+
+ const first = trackAndPollTask({
+ taskId: "task-4",
+ kind: "test-kind",
+ meta: {},
+ });
+ const second = trackAndPollTask({
+ taskId: "task-4",
+ kind: "test-kind",
+ meta: {},
+ });
+
+ await vi.waitFor(() => expect(pollMock).toHaveBeenCalledTimes(1));
+ resolvePoll({ ok: true, state: "completed" });
+ await Promise.all([first, second]);
+ await flush();
+
+ expect(pollMock).toHaveBeenCalledTimes(1);
+ expect(onReady).toHaveBeenCalledTimes(1);
+ });
+
+ it("does not poll or notify after another tab settles the same task", async () => {
+ // Given
+ pollMock.mockResolvedValue({ ok: true, state: "completed" });
+ useTaskWatcherStore.setState({
+ tasks: {
+ "shared-task": {
+ taskId: "shared-task",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.PENDING,
+ meta: {},
+ startedAt: Date.now(),
+ },
+ },
+ });
+ const requestLock = vi.fn(
+ async (_name: string, callback: () => Promise<void>) => {
+ useTaskWatcherStore
+ .getState()
+ .resolveTask("shared-task", TASK_WATCHER_STATUS.READY);
+ await callback();
+ },
+ );
+ Object.defineProperty(navigator, "locks", {
+ configurable: true,
+ value: { request: requestLock },
+ });
+
+ // When
+ await resumePendingTasks();
+
+ // Then
+ expect(requestLock).toHaveBeenCalledTimes(1);
+ expect(pollMock).not.toHaveBeenCalled();
+ expect(onReady).not.toHaveBeenCalled();
+ });
+
+ it("resumes persisted pending tasks on watcher mount", async () => {
+ pollMock.mockResolvedValue({ ok: true, state: "completed" });
+ useTaskWatcherStore.setState({
+ tasks: {
+ "task-5": {
+ taskId: "task-5",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.PENDING,
+ meta: {},
+ startedAt: Date.now(),
+ },
+ },
+ });
+
+ await resumePendingTasks();
+
+ expect(useTaskWatcherStore.getState().tasks["task-5"]?.status).toBe(
+ TASK_WATCHER_STATUS.READY,
+ );
+ expect(onReady).toHaveBeenCalledTimes(1);
+ });
+
+ it("discards settled tasks before resuming persisted work", async () => {
+ // Given
+ pollMock.mockResolvedValue({ ok: true, state: "completed" });
+ useTaskWatcherStore.setState({
+ tasks: {
+ "old-ready-task": {
+ taskId: "old-ready-task",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.READY,
+ meta: {},
+ startedAt: Date.now() - 1000,
+ },
+ "pending-task": {
+ taskId: "pending-task",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.PENDING,
+ meta: {},
+ startedAt: Date.now(),
+ },
+ },
+ });
+
+ // When
+ await resumePendingTasks();
+
+ // Then
+ expect(
+ useTaskWatcherStore.getState().tasks["old-ready-task"],
+ ).toBeUndefined();
+ expect(useTaskWatcherStore.getState().tasks["pending-task"]?.status).toBe(
+ TASK_WATCHER_STATUS.READY,
+ );
+ });
+
+ it("expires stale persisted tasks instead of polling them", async () => {
+ useTaskWatcherStore.setState({
+ tasks: {
+ "task-6": {
+ taskId: "task-6",
+ kind: "test-kind",
+ status: TASK_WATCHER_STATUS.PENDING,
+ meta: {},
+ startedAt: Date.now() - 60 * 60 * 1000,
+ },
+ },
+ });
+
+ await resumePendingTasks();
+
+ expect(pollMock).not.toHaveBeenCalled();
+ expect(useTaskWatcherStore.getState().tasks["task-6"]).toBeUndefined();
+ expect(onError).toHaveBeenCalledTimes(1);
+ });
+});
diff --git a/ui/store/task-watcher/store.ts b/ui/store/task-watcher/store.ts
new file mode 100644
index 0000000000..b979907456
--- /dev/null
+++ b/ui/store/task-watcher/store.ts
@@ -0,0 +1,256 @@
+import { create } from "zustand";
+import { persist } from "zustand/middleware";
+
+import { pollTaskUntilSettled } from "@/actions/task/poll";
+
+// Generic background-task watcher: any feature that dispatches a backend
+// task (report generation, integration tests, exports…) can track it here
+// under a `kind` and get its completion handler fired even after the user
+// navigates away. State persists to localStorage so a hard reload resumes
+// in-flight tasks via `resumePendingTasks` (mounted once in the app layout
+// through `TaskPollingWatcher`).
+
+export const TASK_WATCHER_STATUS = {
+ PENDING: "pending",
+ READY: "ready",
+ ERROR: "error",
+} as const;
+
+export type TaskWatcherStatus =
+ (typeof TASK_WATCHER_STATUS)[keyof typeof TASK_WATCHER_STATUS];
+
+export interface WatchedTask {
+ taskId: string;
+ kind: string;
+ status: TaskWatcherStatus;
+ /** Small serializable context the kind handler needs (ids, filenames…).
+ * Never store sensitive values: this persists to localStorage. */
+ meta: Record<string, string>;
+ startedAt: number;
+ error?: string;
+}
+
+export interface TaskKindHandler {
+ onReady: (task: WatchedTask) => void;
+ onError: (task: WatchedTask) => void;
+}
+
+interface TaskWatcherState {
+ tasks: Record<string, WatchedTask>;
+ upsertTask: (task: WatchedTask) => void;
+ resolveTask: (
+ taskId: string,
+ status: TaskWatcherStatus,
+ error?: string,
+ ) => void;
+ dismissTask: (taskId: string) => void;
+}
+
+/** Tasks pending longer than this are considered lost on resume. */
+const STALE_TASK_MS = 30 * 60 * 1000;
+/** Poll rounds per task; each server round is itself 10 × 2s. */
+const MAX_POLL_ROUNDS = 15;
+
+const handlers = new Map<string, TaskKindHandler>();
+
+/** Registers the completion handler for a task kind. Kinds are registered at
+ * module scope by `task-kind-registrations`, so they exist before any task
+ * can settle. */
+export const registerTaskKindHandler = (
+ kind: string,
+ handler: TaskKindHandler,
+): void => {
+ handlers.set(kind, handler);
+};
+
+export const useTaskWatcherStore = create<TaskWatcherState>()(
+ persist(
+ (set) => ({
+ tasks: {},
+ upsertTask: (task) =>
+ set((state) => ({ tasks: { ...state.tasks, [task.taskId]: task } })),
+ resolveTask: (taskId, status, error) =>
+ set((state) => {
+ const task = state.tasks[taskId];
+ if (!task) return state;
+ return {
+ tasks: { ...state.tasks, [taskId]: { ...task, status, error } },
+ };
+ }),
+ dismissTask: (taskId) =>
+ set((state) => {
+ const { [taskId]: _dismissed, ...rest } = state.tasks;
+ return { tasks: rest };
+ }),
+ }),
+ {
+ name: "task-watcher",
+ partialize: (state) => ({ tasks: state.tasks }),
+ },
+ ),
+);
+
+// In-memory only: poll loops alive in THIS tab. Never persisted, so a reload
+// naturally re-enters through resumePendingTasks without double-polling.
+const activePolls = new Set<string>();
+
+const settleTask = (
+ taskId: string,
+ status: TaskWatcherStatus,
+ error?: string,
+) => {
+ const store = useTaskWatcherStore.getState();
+ const currentTask = store.tasks[taskId];
+ if (!currentTask || currentTask.status !== TASK_WATCHER_STATUS.PENDING) {
+ return;
+ }
+
+ store.resolveTask(taskId, status, error);
+ const task = useTaskWatcherStore.getState().tasks[taskId];
+ if (!task) return;
+
+ const handler = handlers.get(task.kind);
+ if (handler) {
+ if (status === TASK_WATCHER_STATUS.READY) handler.onReady(task);
+ else handler.onError(task);
+ }
+
+ // Error details have no durable consumer after the handler surfaces them.
+ // Ready tasks stay available so feature UI can expose their result.
+ if (status === TASK_WATCHER_STATUS.ERROR) {
+ store.dismissTask(taskId);
+ }
+};
+
+const runPollLoop = async (taskId: string): Promise<void> => {
+ for (let round = 0; round < MAX_POLL_ROUNDS; round++) {
+ const result = await pollTaskUntilSettled(taskId);
+
+ if (result.ok) {
+ if (result.state === "completed") {
+ settleTask(taskId, TASK_WATCHER_STATUS.READY);
+ } else {
+ settleTask(
+ taskId,
+ TASK_WATCHER_STATUS.ERROR,
+ `Task ended in state "${result.state}".`,
+ );
+ }
+ return;
+ }
+
+ // "Task timeout" just means this server round expired while the task
+ // is still running — keep polling. Real errors settle immediately.
+ if (result.error !== "Task timeout") {
+ settleTask(taskId, TASK_WATCHER_STATUS.ERROR, result.error);
+ return;
+ }
+ }
+
+ settleTask(
+ taskId,
+ TASK_WATCHER_STATUS.ERROR,
+ "The task is taking too long. Try again later.",
+ );
+};
+
+const pollUntilDone = async (taskId: string): Promise<void> => {
+ if (activePolls.has(taskId)) return;
+ activePolls.add(taskId);
+
+ try {
+ const runIfPending = async () => {
+ // A different tab may have completed the task while this one waited for
+ // the cross-tab lock. Refresh persisted state before polling or notifying.
+ await useTaskWatcherStore.persist.rehydrate();
+ const task = useTaskWatcherStore.getState().tasks[taskId];
+ if (task?.status !== TASK_WATCHER_STATUS.PENDING) return;
+ await runPollLoop(taskId);
+ };
+
+ if (typeof navigator !== "undefined" && navigator.locks) {
+ await navigator.locks.request(`task-watcher:${taskId}`, runIfPending);
+ } else {
+ await runIfPending();
+ }
+ } catch {
+ // A thrown poll (e.g. the server-action RPC failing on a network drop)
+ // must still settle the task, or it stays PENDING in the persisted
+ // store and blocks the UI until the staleness ceiling.
+ settleTask(
+ taskId,
+ TASK_WATCHER_STATUS.ERROR,
+ "Tracking the task failed unexpectedly. Try again later.",
+ );
+ } finally {
+ activePolls.delete(taskId);
+ }
+};
+
+/** Track a freshly dispatched backend task and poll it to completion. The
+ * poll loop lives at module scope (fired from the click handler), so it
+ * survives client-side navigation without any effect subscriptions. */
+export const trackAndPollTask = async ({
+ taskId,
+ kind,
+ meta,
+}: {
+ taskId: string;
+ kind: string;
+ meta: Record<string, string>;
+}): Promise<void> => {
+ const existing = useTaskWatcherStore.getState().tasks[taskId];
+ if (existing?.status === TASK_WATCHER_STATUS.PENDING) {
+ return pollUntilDone(taskId);
+ }
+
+ const store = useTaskWatcherStore.getState();
+ Object.values(store.tasks)
+ .filter(
+ (task) =>
+ task.kind === kind && task.status !== TASK_WATCHER_STATUS.PENDING,
+ )
+ .forEach((task) => store.dismissTask(task.taskId));
+
+ store.upsertTask({
+ taskId,
+ kind,
+ status: TASK_WATCHER_STATUS.PENDING,
+ meta,
+ startedAt: Date.now(),
+ });
+
+ return pollUntilDone(taskId);
+};
+
+/** Resume polling every persisted pending task after a hard reload; tasks
+ * pending longer than the staleness ceiling are settled as errors without
+ * hitting the API. Called once on app mount by `TaskPollingWatcher`. */
+export const resumePendingTasks = async (): Promise<void> => {
+ const store = useTaskWatcherStore.getState();
+ const persistedTasks = Object.values(store.tasks);
+ const pending = persistedTasks.filter(
+ (task) => task.status === TASK_WATCHER_STATUS.PENDING,
+ );
+
+ // Settled entries already surfaced in the previous browser session. The
+ // server-rendered feature UI resolves durable results again on reload, so
+ // keeping these records would only grow localStorage forever.
+ persistedTasks
+ .filter((task) => task.status !== TASK_WATCHER_STATUS.PENDING)
+ .forEach((task) => store.dismissTask(task.taskId));
+
+ await Promise.all(
+ pending.map((task) => {
+ if (Date.now() - task.startedAt > STALE_TASK_MS) {
+ settleTask(
+ task.taskId,
+ TASK_WATCHER_STATUS.ERROR,
+ "The task expired before it could be tracked to completion.",
+ );
+ return Promise.resolve();
+ }
+ return pollUntilDone(task.taskId);
+ }),
+ );
+};
diff --git a/ui/styles/globals.css b/ui/styles/globals.css
index 56d8dc1d9e..2b4b4abfc6 100644
--- a/ui/styles/globals.css
+++ b/ui/styles/globals.css
@@ -1,13 +1,85 @@
@import "tailwindcss";
-/* All @import rules must precede @config/@source — a late @import is invalid
+/* All @import rules must precede @plugin/@source — a late @import is invalid
* per the CSS spec and lightningcss (Tailwind v4) silently drops it. */
@import "./tours.css";
-
-@config "../tailwind.config.js";
+@plugin "tailwindcss-animate";
+@plugin "@tailwindcss/typography";
@source "../node_modules/streamdown/dist/*.js";
@custom-variant dark (&:where(.dark, .dark *));
+/* Pushed page/panel content resolves responsive variants against its marked
+ * width container. Everything else — notably body portals and fixed overlays
+ * — keeps normal viewport media queries, so body never becomes a containing
+ * block for fixed positioning. Widths match Tailwind's defaults. */
+@custom-variant sm {
+ @media (width >= 40rem) {
+ &:where(:not([data-responsive-container] *)) {
+ @slot;
+ }
+ }
+ @container (width >= 40rem) {
+ &:where([data-responsive-container] *) {
+ @slot;
+ }
+ }
+}
+@custom-variant md {
+ @media (width >= 48rem) {
+ &:where(:not([data-responsive-container] *)) {
+ @slot;
+ }
+ }
+ @container (width >= 48rem) {
+ &:where([data-responsive-container] *) {
+ @slot;
+ }
+ }
+}
+@custom-variant lg {
+ @media (width >= 64rem) {
+ &:where(:not([data-responsive-container] *)) {
+ @slot;
+ }
+ }
+ @container (width >= 64rem) {
+ &:where([data-responsive-container] *) {
+ @slot;
+ }
+ }
+}
+@custom-variant xl {
+ @media (width >= 80rem) {
+ &:where(:not([data-responsive-container] *)) {
+ @slot;
+ }
+ }
+ @container (width >= 80rem) {
+ &:where([data-responsive-container] *) {
+ @slot;
+ }
+ }
+}
+@custom-variant 2xl {
+ @media (width >= 96rem) {
+ &:where(:not([data-responsive-container] *)) {
+ @slot;
+ }
+ }
+ @container (width >= 96rem) {
+ &:where([data-responsive-container] *) {
+ @slot;
+ }
+ }
+}
+
+/* Fonts are provided by next/font as CSS variables on <html>; `inline` avoids
+ * emitting a circular --font-sans: var(--font-sans) declaration on :root. */
+@theme inline {
+ --font-sans: var(--font-sans);
+ --font-mono: var(--font-mono);
+}
+
/* ===== LIGHT THEME (ROOT) ===== */
:root {
/* Button Colors */
@@ -86,8 +158,36 @@
--shadow-progress-glow:
0 0 10px var(--bg-button-primary), 0 0 5px var(--bg-button-primary);
+ /* App sidebar */
+ --bg-sidebar-active: rgba(255, 255, 255, 0.78);
+ --bg-sidebar-hover: rgba(255, 255, 255, 0.55);
+ --bg-sidebar-subitem-active: rgba(16, 185, 129, 0.1);
+ --bg-sidebar-toggle: rgba(255, 255, 255, 0.4);
+ --border-sidebar-active: rgba(15, 23, 42, 0.09);
+ --border-sidebar-hover: rgba(15, 23, 42, 0.06);
+ --border-sidebar-guide: rgba(15, 23, 42, 0.12);
+ --border-sidebar-toggle: rgba(15, 23, 42, 0.08);
+ --sidebar-active-bar: var(--color-emerald-400);
+ --sidebar-active-icon: var(--color-emerald-600);
+ --shadow-sidebar-active: 0 8px 24px rgba(15, 23, 42, 0.06);
+ --gradient-sidebar-halo: radial-gradient(
+ circle,
+ rgba(46, 229, 155, 0.14) 0%,
+ rgba(98, 223, 240, 0.06) 42%,
+ transparent 72%
+ );
+
/* Lighthouse AI */
--gradient-lighthouse: linear-gradient(96deg, #2ee59b 3.55%, #62dff0 98.85%);
+
+ /* Cloud feature badge */
+ --gradient-feature-cloud: linear-gradient(
+ 112deg,
+ rgb(46, 229, 155) 3.5%,
+ rgb(98, 223, 240) 98.8%
+ );
+ --bg-feature-new: var(--color-emerald-500);
+ --text-feature-new: var(--color-white);
}
/* ===== DARK THEME =====
@@ -166,6 +266,25 @@
/* Progress Bar */
--shadow-progress-glow:
0 0 10px var(--bg-button-primary), 0 0 5px var(--bg-button-primary);
+
+ /* App sidebar */
+ --bg-sidebar-active: rgba(255, 255, 255, 0.06);
+ --bg-sidebar-hover: rgba(255, 255, 255, 0.045);
+ --bg-sidebar-subitem-active: rgba(46, 229, 155, 0.09);
+ --bg-sidebar-toggle: rgba(255, 255, 255, 0.025);
+ --border-sidebar-active: rgba(255, 255, 255, 0.11);
+ --border-sidebar-hover: rgba(255, 255, 255, 0.07);
+ --border-sidebar-guide: rgba(255, 255, 255, 0.1);
+ --border-sidebar-toggle: rgba(255, 255, 255, 0.08);
+ --sidebar-active-bar: var(--color-emerald-300);
+ --sidebar-active-icon: var(--color-emerald-300);
+ --shadow-sidebar-active: 0 10px 28px rgba(0, 0, 0, 0.22);
+ --gradient-sidebar-halo: radial-gradient(
+ circle,
+ rgba(46, 229, 155, 0.16) 0%,
+ rgba(98, 223, 240, 0.07) 40%,
+ transparent 72%
+ );
}
/* ===== TAILWIND THEME MAPPINGS ===== */
@@ -235,9 +354,78 @@
--color-bg-warning-secondary: var(--bg-warning-secondary);
--color-bg-fail: var(--bg-fail-primary);
--color-bg-fail-secondary: var(--bg-fail-secondary);
+ --color-bg-feature-new: var(--bg-feature-new);
+ --color-text-feature-new: var(--text-feature-new);
+
+ /* App sidebar */
+ --color-bg-sidebar-active: var(--bg-sidebar-active);
+ --color-bg-sidebar-hover: var(--bg-sidebar-hover);
+ --color-bg-sidebar-subitem-active: var(--bg-sidebar-subitem-active);
+ --color-bg-sidebar-toggle: var(--bg-sidebar-toggle);
+ --color-border-sidebar-active: var(--border-sidebar-active);
+ --color-border-sidebar-hover: var(--border-sidebar-hover);
+ --color-border-sidebar-guide: var(--border-sidebar-guide);
+ --color-border-sidebar-toggle: var(--border-sidebar-toggle);
+ --color-sidebar-active-bar: var(--sidebar-active-bar);
+ --color-sidebar-active-icon: var(--sidebar-active-icon);
/* Shadows */
--shadow-progress-glow: var(--shadow-progress-glow);
+ --shadow-sidebar-active: var(--shadow-sidebar-active);
+
+ /* Background images */
+ --background-image-feature-cloud: var(--gradient-feature-cloud);
+
+ /* Breakpoints */
+ --breakpoint-3xl: 1920px;
+
+ /* Animations */
+ --animate-fade-in: fade-in 200ms ease-out forwards;
+ --animate-collapsible-down: collapsible-down 0.2s ease-out;
+ --animate-collapsible-up: collapsible-up 0.2s ease-out;
+
+ @keyframes fade-in {
+ from {
+ opacity: 0;
+ }
+ to {
+ opacity: 1;
+ }
+ }
+
+ @keyframes collapsible-down {
+ from {
+ height: 0;
+ }
+ to {
+ height: var(--radix-collapsible-content-height);
+ }
+ }
+
+ @keyframes collapsible-up {
+ from {
+ height: var(--radix-collapsible-content-height);
+ }
+ to {
+ height: 0;
+ }
+ }
+}
+
+/* Used from plain CSS (`.animate-download-icon`), so it must always be
+ * emitted — keep it outside @theme. */
+@keyframes dropArrow {
+ 0% {
+ transform: translateY(-8px);
+ opacity: 0;
+ }
+ 50% {
+ opacity: 1;
+ }
+ 100% {
+ transform: translateY(0);
+ opacity: 1;
+ }
}
/* ===== CONTAINER UTILITY ===== */
@@ -248,6 +436,17 @@
/* ===== COMPONENT LAYER ===== */
@layer components {
+ .app-sidebar-halo {
+ position: absolute;
+ top: -8rem;
+ left: -9rem;
+ width: 26rem;
+ height: 26rem;
+ pointer-events: none;
+ background: var(--gradient-sidebar-halo);
+ filter: blur(28px);
+ }
+
button:not(:disabled),
[role="button"]:not(:disabled) {
cursor: pointer;
@@ -312,6 +511,112 @@
.lighthouse-markdown p + ol {
margin-top: 0.25rem;
}
+
+ .lighthouse-markdown table {
+ min-width: 100%;
+ width: max-content;
+ }
+
+ .lighthouse-markdown [data-streamdown="mermaid-block"] {
+ max-width: 100%;
+ min-width: 0;
+ }
+
+ .lighthouse-markdown
+ [data-streamdown="mermaid-block"]
+ > div:first-child
+ .fixed {
+ padding: 1rem !important;
+ background: transparent !important;
+ backdrop-filter: none !important;
+ }
+
+ .lighthouse-markdown
+ [data-streamdown="mermaid-block"]
+ > div:first-child
+ .fixed
+ > [role="presentation"] {
+ box-sizing: border-box;
+ width: 100% !important;
+ height: 100% !important;
+ overflow: hidden;
+ border: 1px solid var(--border-neutral-tertiary);
+ border-radius: 0.75rem;
+ background: var(--bg-neutral-tertiary);
+ backdrop-filter: blur(46px);
+ }
+
+ /* !important beats the inline max-width px that mermaid sets on the svg.
+ Scoped to the inline chart (last child): streamdown renders its
+ fullscreen overlay inside the controls row and sizes it itself. */
+ .lighthouse-markdown [data-streamdown="mermaid-block"] > div:last-child svg {
+ max-width: 100% !important;
+ height: auto;
+ }
+
+ /* Streamdown's fullscreen [&>div]:h-full can stretch the floating
+ pan/zoom controls; keep the pills content-sized and inside the chart. */
+ .lighthouse-markdown
+ [data-streamdown="mermaid-block"]
+ div:has(> div[role="application"])
+ > div:not([role="application"]) {
+ height: auto !important;
+ }
+
+ .lighthouse-markdown
+ [data-streamdown="mermaid-block"]
+ > div:last-child
+ > div:not([role="application"]) {
+ bottom: 0 !important;
+ flex-direction: row !important;
+ }
+
+ .lighthouse-markdown
+ [data-streamdown="mermaid-block"]
+ > div:first-child
+ .fixed
+ [role="presentation"]
+ > div
+ > div:not([role="application"]) {
+ bottom: 3rem !important;
+ }
+
+ /* Lighthouse overview banner animated gradient layers */
+ .lighthouse-banner-gradient-neutral {
+ background: radial-gradient(
+ circle at center,
+ var(--bg-neutral-tertiary) 0,
+ transparent 50%
+ )
+ no-repeat;
+ }
+
+ .lighthouse-banner-gradient-primary {
+ background: radial-gradient(
+ circle at center,
+ var(--bg-button-primary) 0,
+ transparent 50%
+ )
+ no-repeat;
+ }
+
+ .lighthouse-banner-gradient-primary-hover {
+ background: radial-gradient(
+ circle at center,
+ var(--bg-button-primary-hover) 0,
+ transparent 50%
+ )
+ no-repeat;
+ }
+
+ .lighthouse-banner-gradient-primary-press {
+ background: radial-gradient(
+ circle at center,
+ var(--bg-button-primary-press) 0,
+ transparent 50%
+ )
+ no-repeat;
+ }
}
/* ===== UTILITY LAYER ===== */
@@ -401,11 +706,6 @@
background-color: rgb(100 116 139 / 0.7);
}
- .checkbox-update {
- margin-right: 0.5rem;
- background-color: var(--background);
- }
-
/* Download icon animation */
.animate-download-icon polyline,
.animate-download-icon line {
@@ -419,10 +719,31 @@
@layer base {
/* Global base styles */
body {
- @apply bg-background text-foreground;
+ @apply bg-bg-neutral-primary text-text-neutral-primary;
}
}
+/* Neutralize the browser's native autofill highlight (Chromium/WebKit paint a
+ forced blue/yellow background on :autofill). box-shadow inset masks it; the
+ long transition stops the native color from flashing before the mask lands.
+ Kept UNLAYERED + !important: the mask is a box-shadow and collides with
+ shadcn's focus:ring (also a box-shadow, in @layer utilities) — a layered
+ rule can't win that, so this sits outside the cascade layers. */
+input:autofill,
+input:autofill:hover,
+input:autofill:focus,
+input:autofill:active,
+input:-webkit-autofill,
+input:-webkit-autofill:hover,
+input:-webkit-autofill:focus,
+input:-webkit-autofill:active {
+ -webkit-text-fill-color: var(--text-neutral-secondary) !important;
+ -webkit-box-shadow: 0 0 0 1000px var(--bg-input-primary) inset !important;
+ box-shadow: 0 0 0 1000px var(--bg-input-primary) inset !important;
+ caret-color: var(--text-neutral-secondary);
+ transition: background-color 5000s ease-in-out 0s;
+}
+
/* Override vaul's injected user-select: none to allow text selection in drawers */
@media (hover: hover) and (pointer: fine) {
[data-vaul-drawer][data-vaul-drawer] {
diff --git a/ui/tailwind.config.js b/ui/tailwind.config.js
deleted file mode 100644
index 2be6f0132b..0000000000
--- a/ui/tailwind.config.js
+++ /dev/null
@@ -1,196 +0,0 @@
-const { heroui } = require("@heroui/theme");
-
-/** @type {import('tailwindcss').Config} */
-module.exports = {
- darkMode: ["class"],
- content: [
- "./components/**/*.{ts,jsx,tsx}",
- "./app/**/*.{ts,jsx,tsx}",
- "./node_modules/@heroui/theme/dist/**/*.{js,ts,jsx,tsx}",
- "!./docs/**/*",
- ],
- prefix: "",
- theme: {
- container: {
- center: true,
- padding: "2rem",
- screens: {
- "2xl": "1400px",
- },
- },
- extend: {
- fontFamily: {
- sans: ["var(--font-sans)"],
- mono: ["var(--font-geist-mono)"],
- },
- colors: {
- prowler: {
- theme: {
- pale: "#f3fcff",
- green: "#8ce112",
- purple: "#5001d0",
- orange: "#f69000",
- yellow: "#ffdf16",
- },
- blue: {
- 800: "#1e293bff",
- 400: "#1A202C",
- },
- grey: {
- medium: "#353a4d",
- light: "#868994",
- 600: "#64748b",
- },
- green: {
- DEFAULT: "#9FD655",
- medium: "#09BF3D",
- },
- black: {
- DEFAULT: "#000",
- 900: "#18181A",
- },
- white: {
- DEFAULT: "#FFF",
- 900: "#18181A",
- },
- },
- system: {
- success: {
- DEFAULT: "#09BF3D",
- medium: "#3CEC6D",
- light: "#B5FDC8",
- lighter: "#D9FFE3",
- },
- error: {
- DEFAULT: "#E11D48",
- medium: "#FB718F",
- light: "#FECDD8",
- lighter: "#FFE4EA",
- },
- info: {
- DEFAULT: "#7C3AED",
- medium: "#B48BFA",
- light: "#E5D6FE",
- lighter: "#F1E9FE",
- },
- warning: {
- DEFAULT: "#FBBF24",
- medium: "#FDDD8A",
- light: "#feefc7",
- lighter: "#FFF9EB",
- },
- severity: {
- critical: "#AC1954",
- high: "#F31260",
- medium: "#FA7315",
- low: "#fcd34d",
- },
- },
- danger: "#E11D48",
- action: "#9FD655",
- },
- animation: {
- "fade-in": "fade-in 200ms ease-out 0s 1 normal forwards running",
- "fade-out": "fade-out 200ms ease-in 0s 1 normal forwards running",
- expand: "expand 400ms linear 0s 1 normal forwards running",
- "slide-in": "slide-in 400ms linear 0s 1 normal forwards running",
- "slide-out": "slide-out 400ms linear 0s 1 normal forwards running",
- collapse: "collapse 400ms linear 0s 1 normal forwards running",
- },
- keyframes: {
- "accordion-down": {
- from: { height: "0" },
- to: { height: "var(--radix-accordion-content-height)" },
- },
- "accordion-up": {
- from: { height: "var(--radix-accordion-content-height)" },
- to: { height: "0" },
- },
- "collapsible-down": {
- from: { height: "0" },
- to: { height: "var(--radix-collapsible-content-height)" },
- },
- "collapsible-up": {
- from: { height: "var(--radix-collapsible-content-height)" },
- to: { height: "0" },
- },
- advance: { from: { width: 0 }, to: { width: "100%" } },
- "fade-in": { from: { opacity: 0 }, to: { opacity: 1 } },
- "fade-out": { from: { opacity: 1 }, to: { opacity: 0 } },
- "slide-in": {
- from: { transform: "translateX(100%)" },
- to: { transform: "translateX(0)" },
- },
- "slide-out": {
- from: { transform: "translateX(0)" },
- to: { transform: "translateX(100%)" },
- },
- woosh: {
- "0, 10%": { left: 0, right: "100%" },
- "40%, 60%": { left: 0, right: 0 },
- "90%, 100%": { left: "100%", right: 0 },
- },
- lineAnim: {
- "0%": { left: "-40%" },
- "50%": { left: "20%", width: "80%" },
- "100%": { left: "100%", width: "100%" },
- },
- dropArrow: {
- "0%": { transform: "translateY(-8px)", opacity: "0" },
- "50%": { opacity: "1" },
- "100%": { transform: "translateY(0)", opacity: "1" },
- },
- first: {
- "0%": { transform: "rotate(0deg)" },
- "100%": { transform: "rotate(360deg)" },
- },
- second: {
- "0%": { transform: "rotate(0deg)" },
- "100%": { transform: "rotate(360deg)" },
- },
- third: {
- "0%": { transform: "rotate(0deg)" },
- "100%": { transform: "rotate(360deg)" },
- },
- },
- animation: {
- "collapsible-down": "collapsible-down 0.2s ease-out",
- "collapsible-up": "collapsible-up 0.2s ease-out",
- "drop-arrow": "dropArrow 0.6s ease-out infinite",
- first: "first 20s linear infinite",
- second: "second 30s linear infinite",
- third: "third 25s linear infinite",
- },
- screens: {
- "3xl": "1920px", // Add breakpoint to optimize layouts for large screens.
- },
- },
- },
- plugins: [
- require("tailwindcss-animate"),
- require("@tailwindcss/typography"),
- heroui({
- themes: {
- dark: {
- colors: {
- primary: {
- DEFAULT: "#6ee7b7",
- foreground: "#000000",
- },
- focus: "#6ee7b7",
- background: "#000000",
- foreground: "#ffffff",
- },
- },
- light: {
- colors: {
- primary: {
- DEFAULT: "#6ee7b7",
- foreground: "#000000",
- },
- },
- },
- },
- }),
- ],
-};
diff --git a/ui/tests/navigation/navigation-page.ts b/ui/tests/navigation/navigation-page.ts
new file mode 100644
index 0000000000..44c6655ad9
--- /dev/null
+++ b/ui/tests/navigation/navigation-page.ts
@@ -0,0 +1,62 @@
+import { expect, type Locator, type Page } from "@playwright/test";
+
+import { BasePage } from "../base-page";
+
+export class NavigationPage extends BasePage {
+ readonly appSidebar: Locator;
+ readonly closeMenuButton: Locator;
+ readonly openMenuButton: Locator;
+
+ constructor(page: Page) {
+ super(page);
+ this.appSidebar = page.getByRole("dialog", { name: "App sidebar" });
+ this.closeMenuButton = page.getByRole("button", { name: "Close menu" });
+ this.openMenuButton = page.getByRole("button", { name: "Open menu" });
+ }
+
+ async goto(): Promise<void> {
+ await super.goto("/");
+ }
+
+ async verifyPageLoaded(): Promise<void> {
+ await expect(this.openMenuButton).toBeVisible();
+ }
+
+ async openMobileSidebar(): Promise<void> {
+ await this.openMenuButton.click();
+ await expect(this.appSidebar).toBeVisible();
+ await expect(this.openMenuButton).toBeHidden();
+ await this.appSidebar.evaluate(async (element) => {
+ await Promise.all(
+ element
+ .getAnimations()
+ .map((animation) => animation.finished.catch(() => undefined)),
+ );
+ });
+ }
+
+ async verifyMobileSidebarFitsViewport(): Promise<void> {
+ const viewport = this.page.viewportSize();
+ const sidebarBox = await this.appSidebar.boundingBox();
+ const closeButtonBox = await this.closeMenuButton.boundingBox();
+
+ expect(viewport).not.toBeNull();
+ expect(sidebarBox).not.toBeNull();
+ expect(closeButtonBox).not.toBeNull();
+
+ if (!viewport || !sidebarBox || !closeButtonBox) return;
+
+ for (const box of [sidebarBox, closeButtonBox]) {
+ expect(box.x).toBeGreaterThanOrEqual(0);
+ expect(box.y).toBeGreaterThanOrEqual(0);
+ expect(box.x + box.width).toBeLessThanOrEqual(viewport.width);
+ expect(box.y + box.height).toBeLessThanOrEqual(viewport.height);
+ }
+
+ const bodyWidth = await this.page.locator("body").evaluate((element) => ({
+ clientWidth: element.clientWidth,
+ scrollWidth: element.scrollWidth,
+ }));
+ expect(bodyWidth.scrollWidth).toBeLessThanOrEqual(bodyWidth.clientWidth);
+ }
+}
diff --git a/ui/tests/navigation/navigation.md b/ui/tests/navigation/navigation.md
new file mode 100644
index 0000000000..f888789ded
--- /dev/null
+++ b/ui/tests/navigation/navigation.md
@@ -0,0 +1,36 @@
+### E2E Tests: App Navigation
+
+**Suite ID:** `NAV-E2E`
+**Feature:** Responsive application sidebar.
+
+---
+
+## Test Case: `NAV-E2E-001` - Mobile sidebar fits viewport
+
+**Priority:** `high`
+**Tags:** @e2e, @navigation
+
+**Preconditions:**
+
+- Admin user authentication state exists
+- Chromium mobile viewport is 390 x 844 CSS pixels
+
+### Flow Steps
+
+1. Navigate to Overview
+2. Open mobile application menu
+3. Wait for drawer animation to finish
+4. Measure drawer, close control, viewport, and document width
+
+### Expected Result
+
+- Drawer stays inside viewport
+- Close control stays visible inside viewport
+- Open-menu control is hidden while drawer is open
+- Page has no horizontal overflow
+
+### Key Verification Points
+
+- Drawer uses accessible name "App sidebar"
+- Drawer and close control edges do not exceed viewport edges
+- Body scroll width does not exceed client width
diff --git a/ui/tests/navigation/navigation.spec.ts b/ui/tests/navigation/navigation.spec.ts
new file mode 100644
index 0000000000..69de1d02d8
--- /dev/null
+++ b/ui/tests/navigation/navigation.spec.ts
@@ -0,0 +1,22 @@
+import { test } from "@playwright/test";
+
+import { NavigationPage } from "./navigation-page";
+
+test.describe("App navigation", () => {
+ test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+ test(
+ "keeps the mobile sidebar and close control inside the viewport",
+ {
+ tag: ["@e2e", "@navigation", "@high", "@NAV-E2E-001"],
+ },
+ async ({ page }) => {
+ const navigationPage = new NavigationPage(page);
+
+ await navigationPage.goto();
+ await navigationPage.verifyPageLoaded();
+ await navigationPage.openMobileSidebar();
+ await navigationPage.verifyMobileSidebarFitsViewport();
+ },
+ );
+});
diff --git a/ui/tests/providers/providers-page.ts b/ui/tests/providers/providers-page.ts
index f618c59d97..59103220c0 100644
--- a/ui/tests/providers/providers-page.ts
+++ b/ui/tests/providers/providers-page.ts
@@ -224,7 +224,6 @@ export interface OCIProviderCredential {
userId?: string;
fingerprint?: string;
keyContent?: string;
- region?: string;
}
// AlibabaCloud credential options
@@ -366,7 +365,6 @@ export class ProvidersPage extends BasePage {
readonly ociUserIdInput: Locator;
readonly ociFingerprintInput: Locator;
readonly ociKeyContentInput: Locator;
- readonly ociRegionInput: Locator;
// AlibabaCloud provider form elements
readonly alibabacloudAccountIdInput: Locator;
@@ -510,7 +508,6 @@ export class ProvidersPage extends BasePage {
this.ociKeyContentInput = page.getByRole("textbox", {
name: /Private Key Content/i,
});
- this.ociRegionInput = page.getByRole("textbox", { name: /Region/i });
// AlibabaCloud provider form inputs
this.alibabacloudAccountIdInput = page.getByRole("textbox", {
@@ -1300,9 +1297,6 @@ export class ProvidersPage extends BasePage {
if (credentials.keyContent) {
await this.ociKeyContentInput.fill(credentials.keyContent);
}
- if (credentials.region) {
- await this.ociRegionInput.fill(credentials.region);
- }
}
async verifyOCICredentialsPageLoaded(): Promise<void> {
@@ -1313,7 +1307,6 @@ export class ProvidersPage extends BasePage {
await expect(this.ociUserIdInput).toBeVisible();
await expect(this.ociFingerprintInput).toBeVisible();
await expect(this.ociKeyContentInput).toBeVisible();
- await expect(this.ociRegionInput).toBeVisible();
}
async verifyOCIUpdateCredentialsPageLoaded(): Promise<void> {
@@ -1324,7 +1317,6 @@ export class ProvidersPage extends BasePage {
await expect(this.ociUserIdInput).toBeVisible();
await expect(this.ociFingerprintInput).toBeVisible();
await expect(this.ociKeyContentInput).toBeVisible();
- await expect(this.ociRegionInput).toBeVisible();
}
async selectAlibabaCloudProvider(): Promise<void> {
diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md
index e8139b2b3d..a2914c2cde 100644
--- a/ui/tests/providers/providers.md
+++ b/ui/tests/providers/providers.md
@@ -667,7 +667,7 @@
**Preconditions:**
- Admin user authentication required (admin.auth.setup setup)
-- Environment variables configured: E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT, E2E_OCI_REGION
+- Environment variables configured: E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT
- Remove any existing provider with the same Tenancy ID before starting the test
- This test must be run serially and never in parallel with other tests, as it requires the Tenancy ID not to be already registered beforehand.
@@ -678,7 +678,7 @@
3. Select OCI provider type
4. Fill provider details (tenancy ID and alias)
5. Verify OCI credentials page is loaded
-6. Fill OCI credentials (user ID, fingerprint, key content, region)
+6. Fill OCI credentials (user ID, fingerprint, key content)
7. Confirm provider connection without launching a scan
8. Verify return to Providers page
9. Verify provider exists in Providers table
@@ -696,7 +696,7 @@
- Connect account page displays OCI option
- Provider details form accepts tenancy ID and alias
- OCI credentials page loads
-- Credentials form accepts all required fields (user ID, fingerprint, key content, region)
+- Credentials form accepts all required fields (user ID, fingerprint, key content)
- Launch step appears
- Successful return to Providers page after closing the launch step
- Provider exists in Providers table (verified by tenancy ID)
@@ -726,7 +726,7 @@
**Preconditions:**
- Admin user authentication required (admin.auth.setup setup)
-- Environment variables configured: E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT, E2E_OCI_REGION
+- Environment variables configured: E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT
- An OCI provider with the specified Tenancy ID must already exist (run PROVIDER-E2E-012 first)
- This test must be run serially and never in parallel with other tests
@@ -738,7 +738,7 @@
4. Click "Update Credentials" option
5. Verify update credentials page is loaded
6. Verify OCI credentials form fields are visible (confirms providerUid is loaded)
-7. Fill OCI credentials (user ID, fingerprint, key content, region)
+7. Fill OCI credentials (user ID, fingerprint, key content)
8. Click Next to submit
9. Verify successful navigation to test connection page
@@ -756,7 +756,7 @@
- OCI provider row is visible in providers table
- Row actions dropdown opens and displays "Update Credentials" option
- Update credentials page URL contains correct parameters
-- OCI credentials form displays all fields (tenancy ID, user ID, fingerprint, key content, region)
+- OCI credentials form displays all required fields (tenancy ID, user ID, fingerprint, key content)
- Form submission succeeds (no silent failures due to missing provider UID)
- Successful redirect to test connection page
diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts
index 4dc8f010ed..b461808c65 100644
--- a/ui/tests/providers/providers.spec.ts
+++ b/ui/tests/providers/providers.spec.ts
@@ -1029,12 +1029,11 @@ test.describe("Add Provider", () => {
const userId = process.env.E2E_OCI_USER_ID ?? "";
const fingerprint = process.env.E2E_OCI_FINGERPRINT ?? "";
const keyContent = process.env.E2E_OCI_KEY_CONTENT ?? "";
- const region = process.env.E2E_OCI_REGION ?? "";
// Setup before each test
test.beforeEach(async ({ page }) => {
test.skip(
- !tenancyId || !userId || !fingerprint || !keyContent || !region,
+ !tenancyId || !userId || !fingerprint || !keyContent,
"OCI E2E env vars are not set",
);
providersPage = new ProvidersPage(page);
@@ -1071,7 +1070,6 @@ test.describe("Add Provider", () => {
userId: userId,
fingerprint: fingerprint,
keyContent: keyContent,
- region: region,
};
// Navigate to providers page
@@ -1516,12 +1514,11 @@ test.describe("Update Provider Credentials", () => {
const userId = process.env.E2E_OCI_USER_ID ?? "";
const fingerprint = process.env.E2E_OCI_FINGERPRINT ?? "";
const keyContent = process.env.E2E_OCI_KEY_CONTENT ?? "";
- const region = process.env.E2E_OCI_REGION ?? "";
// Setup before each test
test.beforeEach(async ({ page }) => {
test.skip(
- !tenancyId || !userId || !fingerprint || !keyContent || !region,
+ !tenancyId || !userId || !fingerprint || !keyContent,
"OCI E2E env vars are not set",
);
providersPage = new ProvidersPage(page);
@@ -1543,7 +1540,6 @@ test.describe("Update Provider Credentials", () => {
userId: userId,
fingerprint: fingerprint,
keyContent: keyContent,
- region: region,
};
// Navigate to providers page
diff --git a/ui/tests/runtime-config/runtime-config-page.ts b/ui/tests/runtime-config/runtime-config-page.ts
index 28c9ad6065..430033eba4 100644
--- a/ui/tests/runtime-config/runtime-config-page.ts
+++ b/ui/tests/runtime-config/runtime-config-page.ts
@@ -19,6 +19,9 @@ export const RUNTIME_CONFIG_KEYS = [
"posthogKey",
"posthogHost",
"reoDevClientId",
+ "cloudBillingEnabled",
+ "stripePublishableKey",
+ "stripePublishableKeyV2",
] as const satisfies ReadonlyArray<keyof RuntimePublicConfig>;
/**
diff --git a/ui/tests/runtime-config/runtime-config.md b/ui/tests/runtime-config/runtime-config.md
index 18aedaa1b3..ddc21457c6 100644
--- a/ui/tests/runtime-config/runtime-config.md
+++ b/ui/tests/runtime-config/runtime-config.md
@@ -2,7 +2,9 @@
**Suite ID:** `RUNTIME-CONFIG-E2E`
**Feature:** Runtime resolution of public client config via an inert JSON data
-island injected into `<head>` (Sentry, GTM, API base/docs URL, reserved keys).
+island injected into `<head>` (Sentry, GTM, API base/docs URL, and reserved keys). Each third-party integration
+resolves to a value only when its `UI_*_ENABLED` flag is `"true"`, so a disabled
+integration is exposed as `null`.
---
@@ -40,7 +42,7 @@ island injected into `<head>` (Sentry, GTM, API base/docs URL, reserved keys).
**Preconditions:**
-- UI server running. `UI_SENTRY_DSN` may be set or unset.
+- UI server running. Sentry may be enabled (`UI_SENTRY_ENABLED=true` with `UI_SENTRY_DSN`) or off.
### Flow Steps
@@ -68,7 +70,7 @@ island injected into `<head>` (Sentry, GTM, API base/docs URL, reserved keys).
**Preconditions:**
-- UI server running with `UI_SENTRY_DSN` and `UI_GOOGLE_TAG_MANAGER_ID` unset (the Enterprise default; the test skips when either is configured).
+- UI server running with Sentry and Google Tag Manager disabled — their `UI_SENTRY_ENABLED` and `UI_GOOGLE_TAG_MANAGER_ENABLED` flags unset, the Enterprise default — so the island exposes both as `null` (the test skips when either is enabled and configured).
### Flow Steps
diff --git a/ui/tests/sign-in-base/sign-in-base-page.ts b/ui/tests/sign-in-base/sign-in-base-page.ts
index d94fd57eb3..7499f0e1f1 100644
--- a/ui/tests/sign-in-base/sign-in-base-page.ts
+++ b/ui/tests/sign-in-base/sign-in-base-page.ts
@@ -68,9 +68,9 @@ export class SignInPage extends BasePage {
this.backButton = page.getByRole("button", { name: "Back" });
// UI elements - title is a <p> element, not a heading
- this.logo = page.locator('svg[width="300"]');
+ this.logo = page.getByRole("img", { name: /Prowler/ });
// Use text matching with exact=true to avoid matching other elements
- this.pageTitle = page.getByText("Sign in", { exact: true });
+ this.pageTitle = page.getByText("Welcome back", { exact: true });
// Error messages - form validation errors appear as <p> with specific classes
this.errorMessages = page.locator(
@@ -160,7 +160,7 @@ export class SignInPage extends BasePage {
await expect(this.page).toHaveTitle(/Prowler/);
await expect(this.logo).toBeVisible();
await expect(this.pageTitle).toBeVisible();
- await expect(this.pageTitle).toHaveText("Sign in");
+ await expect(this.pageTitle).toHaveText("Welcome back");
}
async verifyFormElements(): Promise<void> {
@@ -215,7 +215,7 @@ export class SignInPage extends BasePage {
}
async verifyNormalModeActive(): Promise<void> {
- await expect(this.pageTitle).toHaveText("Sign in");
+ await expect(this.pageTitle).toHaveText("Welcome back");
await expect(this.passwordInput).toBeVisible();
}
diff --git a/ui/towncrier.toml b/ui/towncrier.toml
new file mode 100644
index 0000000000..528e6129ec
--- /dev/null
+++ b/ui/towncrier.toml
@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true
diff --git a/ui/types/cloud-upgrade.ts b/ui/types/cloud-upgrade.ts
new file mode 100644
index 0000000000..8da89babf8
--- /dev/null
+++ b/ui/types/cloud-upgrade.ts
@@ -0,0 +1,14 @@
+export const CLOUD_UPGRADE_FEATURE = {
+ ADVANCED_SCHEDULING: "advanced_scheduling",
+ ALERTS: "alerts",
+ AWS_ORGANIZATIONS: "aws_organizations",
+ CLI_IMPORT: "cli_import",
+ CROSS_PROVIDER_COMPLIANCE: "cross_provider_compliance",
+ FINDING_TRIAGE: "finding_triage",
+ LIGHTHOUSE_AI: "lighthouse_ai",
+ GENERAL: "general",
+ SCAN_CONFIGURATION: "scan_configuration",
+} as const;
+
+export type CloudUpgradeFeature =
+ (typeof CLOUD_UPGRADE_FEATURE)[keyof typeof CLOUD_UPGRADE_FEATURE];
diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts
index 3a46375a75..203ee77c54 100644
--- a/ui/types/compliance.ts
+++ b/ui/types/compliance.ts
@@ -1,3 +1,5 @@
+import type { ProviderType } from "./providers";
+
export const REQUIREMENT_STATUS = {
PASS: "PASS",
FAIL: "FAIL",
@@ -41,11 +43,17 @@ export interface Requirement {
fail: number;
manual: number;
check_ids: string[];
+ // True when the FAIL is caused solely by an invalid scan config.
+ invalid_config?: boolean;
// This is to allow any key to be added to the requirement object
// because each compliance has different keys
[key: string]: string | string[] | number | boolean | object[] | undefined;
}
+/** Check id → provider types it belongs to, for provider-labeled check
+ * lists in the cross-provider view (a check can exist in several). */
+export type CheckProviderTypesMap = Partial<Record<string, ProviderType[]>>;
+
export interface Control {
label: string;
pass: number;
@@ -125,7 +133,7 @@ export interface ISO27001AttributesMetadata {
export interface CISAttributesMetadata {
Section: string;
SubSection: string | null;
- Profile: string; // "Level 1" or "Level 2"
+ Profile: string; // "Level 1"/"Level 2" (M365 prefixes the tier: "E3 Level 1", "E5 Level 2")
AssessmentStatus: string; // "Manual" or "Automated"
Description: string;
RationaleStatement: string;
@@ -395,6 +403,19 @@ export interface DORARequirement extends Requirement {
article_title: DORAAttributesMetadata["ArticleTitle"];
}
+export interface CISControlsAttributesMetadata {
+ Section: string;
+ Function: string | null;
+ AssetType: string | null;
+ ImplementationGroups: string[] | null;
+}
+
+export interface CISControlsRequirement extends Requirement {
+ function?: string;
+ asset_type?: string;
+ implementation_groups?: string[];
+}
+
export interface AttributesItemData {
type: "compliance-requirements-attributes";
id: string;
@@ -419,6 +440,7 @@ export interface AttributesItemData {
| ASDEssentialEightAttributesMetadata[]
| OktaIDaaSStigAttributesMetadata[]
| DORAAttributesMetadata[]
+ | CISControlsAttributesMetadata[]
| GenericAttributesMetadata[];
check_ids: string[];
// MITRE structure
@@ -440,6 +462,8 @@ export interface RequirementItemData {
version: string;
description: string;
status: RequirementStatus;
+ // True when the FAIL is caused solely by an invalid scan config.
+ invalid_config?: boolean;
// For Threat compliance:
passed_findings?: number;
total_findings?: number;
diff --git a/ui/types/components.ts b/ui/types/components.ts
index 8488d0822b..ef9bc2541a 100644
--- a/ui/types/components.ts
+++ b/ui/types/components.ts
@@ -1,8 +1,10 @@
import { LucideIcon } from "lucide-react";
-import { MouseEvent, SVGProps } from "react";
+import { SVGProps } from "react";
import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
+import type { FindingTriageSummary } from "./findings-triage";
+
export type IconSvgProps = SVGProps<SVGSVGElement> & {
size?: number;
};
@@ -14,43 +16,6 @@ export type IconProps = {
export type IconComponent = LucideIcon | React.FC<IconSvgProps>;
-export type SubmenuProps = {
- href: string;
- target?: string;
- label: string;
- active?: boolean;
- icon: IconComponent;
- disabled?: boolean;
- highlight?: boolean;
- cloudOnly?: boolean;
- onClick?: (event: MouseEvent<HTMLAnchorElement>) => void;
-};
-
-export type MenuProps = {
- href: string;
- label: string;
- active?: boolean;
- icon: IconComponent;
- submenus?: SubmenuProps[];
- defaultOpen?: boolean;
- target?: string;
- tooltip?: string;
- highlight?: boolean;
-};
-
-export type GroupProps = {
- groupLabel: string;
- menus: MenuProps[];
-};
-
-export interface CollapseMenuButtonProps {
- icon: IconComponent;
- label: string;
- submenus: SubmenuProps[];
- defaultOpen: boolean;
- isOpen: boolean | undefined;
-}
-
export const NEXT_UI_VARIANTS = {
SOLID: "solid",
FADED: "faded",
@@ -315,7 +280,6 @@ export type OCICredentials = {
[ProviderCredentialFields.OCI_FINGERPRINT]: string;
[ProviderCredentialFields.OCI_KEY_CONTENT]: string;
[ProviderCredentialFields.OCI_TENANCY]: string;
- [ProviderCredentialFields.OCI_REGION]: string;
[ProviderCredentialFields.OCI_PASS_PHRASE]?: string;
[ProviderCredentialFields.PROVIDER_ID]: string;
};
@@ -612,6 +576,7 @@ export interface FindingsResponse {
export interface FindingProps {
type: "findings";
id: string;
+ triage?: FindingTriageSummary;
attributes: {
uid: string;
delta: FindingDelta;
diff --git a/ui/types/env.d.ts b/ui/types/env.d.ts
index bfb995d5d1..c4ec4d85a3 100644
--- a/ui/types/env.d.ts
+++ b/ui/types/env.d.ts
@@ -15,12 +15,12 @@ declare global {
NEXT_PUBLIC_API_DOCS_URL?: string;
UI_API_DOCS_URL?: string;
- // GTM
+ UI_GOOGLE_TAG_MANAGER_ENABLED?: "true" | "false";
/** @deprecated use UI_GOOGLE_TAG_MANAGER_ID */
NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID?: string;
UI_GOOGLE_TAG_MANAGER_ID?: string;
- // SENTRY
+ UI_SENTRY_ENABLED?: "true" | "false";
/** @deprecated use UI_SENTRY_DSN */
NEXT_PUBLIC_SENTRY_DSN?: string;
UI_SENTRY_DSN?: string;
@@ -28,6 +28,17 @@ declare global {
NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string;
UI_SENTRY_ENVIRONMENT?: string;
+ CLOUD_BILLING_ENABLED?: "legacy" | "metronome" | "false";
+
+ // Cloud-only Stripe publishable keys (public; shipped to the browser).
+ // V1 = legacy billing, V2 = metronome.
+ /** @deprecated use UI_CLOUD_STRIPE_PUBLISHABLE_KEY */
+ NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY?: string;
+ UI_CLOUD_STRIPE_PUBLISHABLE_KEY?: string;
+ /** @deprecated use UI_CLOUD_STRIPE_PUBLISHABLE_KEY_V2 */
+ NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY_V2?: string;
+ UI_CLOUD_STRIPE_PUBLISHABLE_KEY_V2?: string;
+
// Build-time public config
NEXT_PUBLIC_IS_CLOUD_ENV?: "true" | "false";
NEXT_PUBLIC_PROWLER_RELEASE_VERSION?: string;
@@ -44,9 +55,14 @@ declare global {
SENTRY_PROJECT?: string;
SENTRY_AUTH_TOKEN?: string;
- // TODO Reserved runtime public config (registered now; no UI consumer yet)
+ UI_POSTHOG_ENABLED?: "true" | "false";
+ /** @deprecated use UI_POSTHOG_KEY */
POSTHOG_KEY?: string;
+ UI_POSTHOG_KEY?: string;
+ /** @deprecated use UI_POSTHOG_HOST */
POSTHOG_HOST?: string;
+ UI_POSTHOG_HOST?: string;
+ // TODO Reserved runtime public config (registered now; no UI consumer yet)
REO_DEV_CLIENT_ID?: string;
// Social OAuth
@@ -127,7 +143,6 @@ declare global {
E2E_OCI_USER_ID?: string;
E2E_OCI_FINGERPRINT?: string;
E2E_OCI_KEY_CONTENT?: string;
- E2E_OCI_REGION?: string;
// E2E Alibaba Cloud
E2E_ALIBABACLOUD_ACCOUNT_ID?: string;
diff --git a/ui/types/filters.ts b/ui/types/filters.ts
index e011a70030..4e6acd0143 100644
--- a/ui/types/filters.ts
+++ b/ui/types/filters.ts
@@ -29,32 +29,44 @@ export interface CustomDropdownFilterProps {
onFilterChange: (key: string, values: string[]) => void;
}
-export enum FilterType {
- SCAN = "scan__in",
- PROVIDER = "provider__in",
- PROVIDER_ID = "provider_id__in",
- PROVIDER_UID = "provider_uid__in",
- PROVIDER_TYPE = "provider_type__in",
- REGION = "region__in",
- SERVICE = "service__in",
- RESOURCE_TYPE = "resource_type__in",
- SEVERITY = "severity__in",
- STATUS = "status__in",
+/**
+ * Filter field names — the inner part of a `filter[...]` URL param key, and the
+ * `key` values used to build `FilterOption` dropdown configs. Single source of
+ * truth for the `FilterParam` template; per-view modules compose their own field
+ * set from these plus their own extras.
+ */
+export const FILTER_FIELD = {
+ // core — provider scope + shared resource dimensions (used across views)
+ PROVIDER_TYPE: "provider_type__in",
+ PROVIDER_ID: "provider_id__in",
+ PROVIDER_UID: "provider_uid__in",
+ PROVIDER_GROUPS: "provider_groups__in",
+ REGION: "region__in",
+ SERVICE: "service__in",
+ // view dimensions — dropdown configs (mostly findings; `provider__in` is the
+ // providers-list type filter)
+ PROVIDER: "provider__in",
+ SCAN: "scan__in",
+ RESOURCE_TYPE: "resource_type__in",
+ SEVERITY: "severity__in",
+ STATUS: "status__in",
// The API only registers `delta` (exact, singular). `delta__in` is silently
// dropped, so the dropdown, URL, and backend must all use `delta`.
- DELTA = "delta",
- CATEGORY = "category__in",
- RESOURCE_GROUPS = "resource_groups__in",
-}
+ DELTA: "delta",
+ CATEGORY: "category__in",
+ RESOURCE_GROUPS: "resource_groups__in",
+} as const;
+
+export type FilterField = (typeof FILTER_FIELD)[keyof typeof FILTER_FIELD];
/**
* Filter keys the account selectors accept: a provider id (`provider__in` /
* `provider_id__in`) or the cloud account uid (`provider_uid__in`).
*/
-export type AccountFilterKey =
- | FilterType.PROVIDER
- | FilterType.PROVIDER_ID
- | FilterType.PROVIDER_UID;
+export type AccountFilterKey = (typeof FILTER_FIELD)[
+ | "PROVIDER"
+ | "PROVIDER_ID"
+ | "PROVIDER_UID"];
/**
* Controls the filter dispatch behavior of DataTableFilterCustom.
@@ -70,25 +82,9 @@ export type DataTableFilterMode =
(typeof DATA_TABLE_FILTER_MODE)[keyof typeof DATA_TABLE_FILTER_MODE];
/**
- * Exhaustive union of all URL filter param keys used in Findings filters.
- * Use this instead of `string` to ensure FILTER_KEY_LABELS and other
- * param-keyed records stay in sync with the actual filter surface.
+ * URL filter param key template — wraps a field name in `filter[...]`.
+ * Parameterize with a view's own field union (e.g. `FilterParam<FindingsFilterField>`)
+ * so each view's param-keyed records stay in sync with the filters it supports.
*/
-export type FilterParam =
- | "filter[provider_type__in]"
- | "filter[provider_id__in]"
- | "filter[severity__in]"
- | "filter[status__in]"
- | "filter[delta__in]"
- | "filter[delta]"
- | "filter[region__in]"
- | "filter[service__in]"
- | "filter[resource_type__in]"
- | "filter[category__in]"
- | "filter[resource_groups__in]"
- | "filter[scan]"
- | "filter[scan__in]"
- | "filter[scan_id]"
- | "filter[scan_id__in]"
- | "filter[inserted_at]"
- | "filter[muted]";
+export type FilterParam<Field extends string = FilterField> =
+ `filter[${Field}]`;
diff --git a/ui/types/findings-table.ts b/ui/types/findings-table.ts
index fe65e2a1a1..75f3e605bd 100644
--- a/ui/types/findings-table.ts
+++ b/ui/types/findings-table.ts
@@ -1,4 +1,5 @@
import { FindingStatus, Severity } from "./components";
+import type { FindingTriageSummary } from "./findings-triage";
import { ProviderType } from "./providers";
export const FINDINGS_ROW_TYPE = {
@@ -66,6 +67,7 @@ export interface FindingResourceRow {
mutedReason?: string;
firstSeenAt: string | null;
lastSeenAt: string | null;
+ triage?: FindingTriageSummary;
}
export type FindingsTableRow = FindingGroupRow | FindingResourceRow;
diff --git a/ui/types/findings-triage.ts b/ui/types/findings-triage.ts
new file mode 100644
index 0000000000..c0a9c9ef02
--- /dev/null
+++ b/ui/types/findings-triage.ts
@@ -0,0 +1,121 @@
+export const FINDING_TRIAGE_STATUS = {
+ OPEN: "open",
+ UNDER_REVIEW: "under_review",
+ REMEDIATING: "remediating",
+ RESOLVED: "resolved",
+ RISK_ACCEPTED: "risk_accepted",
+ FALSE_POSITIVE: "false_positive",
+ REOPENED: "reopened",
+} as const;
+
+export type FindingTriageStatus =
+ (typeof FINDING_TRIAGE_STATUS)[keyof typeof FINDING_TRIAGE_STATUS];
+
+export const FINDING_TRIAGE_STATUS_LABELS = {
+ [FINDING_TRIAGE_STATUS.OPEN]: "Open",
+ [FINDING_TRIAGE_STATUS.UNDER_REVIEW]: "Under Review",
+ [FINDING_TRIAGE_STATUS.REMEDIATING]: "Remediating",
+ [FINDING_TRIAGE_STATUS.RESOLVED]: "Resolved",
+ [FINDING_TRIAGE_STATUS.RISK_ACCEPTED]: "Risk Accepted",
+ [FINDING_TRIAGE_STATUS.FALSE_POSITIVE]: "False Positive",
+ [FINDING_TRIAGE_STATUS.REOPENED]: "Reopened",
+} as const satisfies Record<FindingTriageStatus, string>;
+
+export const FINDING_TRIAGE_MANUAL_STATUS_VALUES = [
+ FINDING_TRIAGE_STATUS.OPEN,
+ FINDING_TRIAGE_STATUS.UNDER_REVIEW,
+ FINDING_TRIAGE_STATUS.REMEDIATING,
+ FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+] as const;
+
+export type FindingTriageManualStatus =
+ (typeof FINDING_TRIAGE_MANUAL_STATUS_VALUES)[number];
+
+export const FINDING_TRIAGE_AUTOMATION_STATUS_VALUES = [
+ FINDING_TRIAGE_STATUS.RESOLVED,
+ FINDING_TRIAGE_STATUS.REOPENED,
+] as const;
+
+export const FINDING_TRIAGE_MUTELIST_SHORTCUT_STATUS_VALUES = [
+ FINDING_TRIAGE_STATUS.RISK_ACCEPTED,
+ FINDING_TRIAGE_STATUS.FALSE_POSITIVE,
+] as const;
+
+export const isManualStatus = (
+ status: unknown,
+): status is FindingTriageManualStatus => {
+ return FINDING_TRIAGE_MANUAL_STATUS_VALUES.some((value) => value === status);
+};
+
+export const isMutelistShortcutStatus = (status: unknown): boolean => {
+ return FINDING_TRIAGE_MUTELIST_SHORTCUT_STATUS_VALUES.some(
+ (value) => value === status,
+ );
+};
+
+export const getFindingTriageMuteInfoCopy = (status: FindingTriageStatus) =>
+ `Changing triage to ${FINDING_TRIAGE_STATUS_LABELS[status]} will mute the finding`;
+
+// Only RESOLVED locks manual edits: automation owns the transition out of it
+// (REOPENED on a failing rescan), while REOPENED invites human re-triage.
+export const isTriageStatusLocked = (status: FindingTriageStatus): boolean =>
+ status === FINDING_TRIAGE_STATUS.RESOLVED;
+
+export const FINDING_TRIAGE_RESOLVED_LOCKED_COPY =
+ "Triage status is managed automatically once the finding is resolved." as const;
+
+export const FINDING_TRIAGE_DISABLED_REASON = {
+ CLOUD_ONLY: "cloud_only",
+ FORBIDDEN: "forbidden",
+ LOADING: "loading",
+} as const;
+
+export type FindingTriageDisabledReason =
+ (typeof FINDING_TRIAGE_DISABLED_REASON)[keyof typeof FINDING_TRIAGE_DISABLED_REASON];
+
+export const FINDING_TRIAGE_ORIGIN = {
+ TABLE: "table",
+ MODAL: "modal",
+} as const;
+
+export const FINDING_TRIAGE_NOTE_MAX_LENGTH = 500 as const;
+export const FINDING_TRIAGE_BILLING_HREF =
+ "https://prowler.com/pricing" as const;
+
+export interface FindingTriageSummary {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ status: FindingTriageStatus;
+ label: string;
+ hasVisibleNote: boolean;
+ isMuted: boolean;
+ canEdit: boolean;
+ disabledReason?: FindingTriageDisabledReason;
+ billingHref: string;
+}
+
+export interface FindingTriageDetail extends FindingTriageSummary {
+ noteId: string | null;
+ noteBody: string;
+ maxNoteLength: typeof FINDING_TRIAGE_NOTE_MAX_LENGTH;
+}
+
+export interface UpdateFindingTriageInput {
+ findingId: string;
+ findingUid: string;
+ triageId: string | null;
+ notesCount: number;
+ noteId?: string | null;
+ status?: FindingTriageManualStatus;
+ previousStatus?: FindingTriageStatus;
+ isMuted?: boolean;
+ note?: string;
+}
+
+export interface FindingTriageLoadedNote {
+ noteId: string;
+ noteBody: string;
+}
diff --git a/ui/types/formSchemas.test.ts b/ui/types/formSchemas.test.ts
index e4fa3ea663..211ee35e55 100644
--- a/ui/types/formSchemas.test.ts
+++ b/ui/types/formSchemas.test.ts
@@ -150,3 +150,93 @@ describe("addCredentialsFormSchema - okta", () => {
);
});
});
+
+describe("addCredentialsFormSchema - kubernetes", () => {
+ const BASE_KUBERNETES_VALUES = {
+ [ProviderCredentialFields.PROVIDER_ID]: "provider-kubernetes-1",
+ [ProviderCredentialFields.PROVIDER_TYPE]: "kubernetes",
+ } as const;
+
+ it("accepts kubeconfig content without exec authentication", () => {
+ const schema = addCredentialsFormSchema("kubernetes");
+
+ const result = schema.safeParse({
+ ...BASE_KUBERNETES_VALUES,
+ [ProviderCredentialFields.KUBECONFIG_CONTENT]: `apiVersion: v1
+kind: Config
+users:
+ - name: test-user
+ user:
+ token: test-token`,
+ });
+
+ expect(result.success).toBe(true);
+ });
+
+ it("reports kubeconfig exec authentication on kubeconfig_content field", () => {
+ const schema = addCredentialsFormSchema("kubernetes");
+
+ const result = schema.safeParse({
+ ...BASE_KUBERNETES_VALUES,
+ [ProviderCredentialFields.KUBECONFIG_CONTENT]: `apiVersion: v1
+kind: Config
+users:
+ - name: test-user
+ user:
+ exec:
+ apiVersion: client.authentication.k8s.io/v1
+ command: kubectl`,
+ });
+
+ expect(result.success).toBe(false);
+ if (result.success) return;
+
+ expect(result.error.issues).toContainEqual(
+ expect.objectContaining({
+ path: [ProviderCredentialFields.KUBECONFIG_CONTENT],
+ }),
+ );
+ });
+
+ it("accepts malformed kubeconfig content for backend validation", () => {
+ const schema = addCredentialsFormSchema("kubernetes");
+
+ const result = schema.safeParse({
+ ...BASE_KUBERNETES_VALUES,
+ [ProviderCredentialFields.KUBECONFIG_CONTENT]: "apiVersion: [",
+ });
+
+ expect(result.success).toBe(true);
+ });
+
+ it("accepts non-mapping kubeconfig content for backend validation", () => {
+ const schema = addCredentialsFormSchema("kubernetes");
+
+ const result = schema.safeParse({
+ ...BASE_KUBERNETES_VALUES,
+ [ProviderCredentialFields.KUBECONFIG_CONTENT]: "[]",
+ });
+
+ expect(result.success).toBe(true);
+ });
+});
+
+describe("addCredentialsFormSchema - oraclecloud", () => {
+ const BASE_OCI_VALUES = {
+ [ProviderCredentialFields.PROVIDER_ID]: "provider-oci-1",
+ [ProviderCredentialFields.PROVIDER_TYPE]: "oraclecloud",
+ [ProviderCredentialFields.OCI_USER]: "ocid1.user.oc1..example",
+ [ProviderCredentialFields.OCI_FINGERPRINT]: "aa:bb:cc:dd",
+ [ProviderCredentialFields.OCI_KEY_CONTENT]:
+ "-----BEGIN PRIVATE KEY-----\nMIIEvQ...\n-----END PRIVATE KEY-----",
+ [ProviderCredentialFields.OCI_TENANCY]: "ocid1.tenancy.oc1..example",
+ } as const;
+
+ it("accepts OCI API key credentials without region", () => {
+ const schema = addCredentialsFormSchema("oraclecloud");
+
+ const result = schema.safeParse(BASE_OCI_VALUES);
+
+ expect(result.success).toBe(true);
+ });
+});
diff --git a/ui/types/formSchemas.ts b/ui/types/formSchemas.ts
index d585a138c9..0e13f67814 100644
--- a/ui/types/formSchemas.ts
+++ b/ui/types/formSchemas.ts
@@ -1,3 +1,4 @@
+import yaml from "js-yaml";
import { z } from "zod";
import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
@@ -5,7 +6,37 @@ import { validateMutelistYaml, validateYaml } from "@/lib/yaml";
import { PROVIDER_TYPES, ProviderType } from "./providers";
-export const addRoleFormSchema = z.object({
+export const KUBECONFIG_EXEC_AUTHENTICATION_ERROR =
+ "Kubernetes kubeconfig exec authentication is not supported in Prowler Cloud for security reasons.";
+
+const isRecord = (value: unknown): value is Record<string, unknown> => {
+ return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+
+export const kubeconfigContainsExecAuthentication = (
+ value: string,
+): boolean => {
+ try {
+ const parsed = yaml.load(value);
+
+ if (!isRecord(parsed) || !Array.isArray(parsed.users)) {
+ return false;
+ }
+
+ return parsed.users.some((userEntry) => {
+ if (!isRecord(userEntry) || !isRecord(userEntry.user)) {
+ return false;
+ }
+
+ return "exec" in userEntry.user;
+ });
+ } catch {
+ return false;
+ }
+};
+
+// Create and edit share the same shape, so a single schema backs both flows.
+export const roleFormSchema = z.object({
name: z.string().min(1, "Name is required"),
manage_users: z.boolean().default(false),
manage_account: z.boolean().default(false),
@@ -18,18 +49,7 @@ export const addRoleFormSchema = z.object({
groups: z.array(z.string()).optional(),
});
-export const editRoleFormSchema = z.object({
- name: z.string().min(1, "Name is required"),
- manage_users: z.boolean().default(false),
- manage_account: z.boolean().default(false),
- manage_billing: z.boolean().default(false),
- manage_providers: z.boolean().default(false),
- manage_integrations: z.boolean().default(false),
- manage_scans: z.boolean().default(false),
- manage_alerts: z.boolean().default(false),
- unlimited_visibility: z.boolean().default(false),
- groups: z.array(z.string()).optional(),
-});
+export type RoleFormValues = z.input<typeof roleFormSchema>;
export const onDemandScanFormSchema = () =>
z.object({
@@ -207,7 +227,13 @@ export const addCredentialsFormSchema = (
? {
[ProviderCredentialFields.KUBECONFIG_CONTENT]: z
.string()
- .min(1, "Kubeconfig Content is required"),
+ .min(1, "Kubeconfig Content is required")
+ .refine(
+ (value) => !kubeconfigContainsExecAuthentication(value),
+ {
+ error: KUBECONFIG_EXEC_AUTHENTICATION_ERROR,
+ },
+ ),
}
: providerType === "m365"
? {
@@ -262,9 +288,6 @@ export const addCredentialsFormSchema = (
[ProviderCredentialFields.OCI_TENANCY]: z
.string()
.min(1, "Tenancy OCID is required"),
- [ProviderCredentialFields.OCI_REGION]: z
- .string()
- .min(1, "Region is required"),
[ProviderCredentialFields.OCI_PASS_PHRASE]: z
.union([z.string(), z.literal("")])
.optional(),
@@ -722,3 +745,30 @@ export const mutedFindingsConfigFormSchema = z.object({
}),
id: z.string().optional(),
});
+
+// Mirrors the Mutelist contract: the client only validates YAML *syntax* (that
+// it parses to a mapping). The actual configuration validation (ranges, enums)
+// is performed by the API on create/update and surfaced inline — see
+// `validate_configuration` in the backend serializer.
+export const scanConfigurationFormSchema = z.object({
+ name: z
+ .string()
+ .trim()
+ .min(3, { message: "Name must be at least 3 characters" })
+ .max(100, { message: "Name must be at most 100 characters" }),
+ configuration: z
+ .string()
+ .trim()
+ .min(1, { error: "Configuration is required" })
+ .superRefine((val, ctx) => {
+ const yamlValidation = validateYaml(val);
+ if (!yamlValidation.isValid) {
+ ctx.addIssue({
+ code: "custom",
+ message: `Invalid YAML format: ${yamlValidation.error}`,
+ });
+ }
+ }),
+ provider_ids: z.array(z.uuid()).optional().default([]),
+ id: z.string().optional(),
+});
diff --git a/ui/types/index.ts b/ui/types/index.ts
index 7f7a035b47..eb22b7eccc 100644
--- a/ui/types/index.ts
+++ b/ui/types/index.ts
@@ -1,7 +1,9 @@
export * from "./authFormSchema";
+export * from "./cloud-upgrade";
export * from "./components";
export * from "./filters";
export * from "./findings-table";
+export * from "./findings-triage";
export * from "./formSchemas";
export * from "./organizations";
export * from "./processors";
diff --git a/ui/types/integrations.ts b/ui/types/integrations.ts
index 63b1e37bff..b84869af1c 100644
--- a/ui/types/integrations.ts
+++ b/ui/types/integrations.ts
@@ -64,6 +64,8 @@ export interface JiraDispatchResponse {
message?: string;
issue_url?: string;
issue_key?: string;
+ created_count?: number;
+ failed_count?: number;
} | null;
task_args: Record<string, unknown> | null;
metadata: Record<string, unknown> | null;
@@ -200,6 +202,14 @@ const baseS3IntegrationSchema = z.object({
integration_type: z.literal("amazon_s3"),
bucket_name: z.string().min(1, "Bucket name is required"),
output_directory: z.string().min(1, "Output directory is required"),
+ // UI-only field used to prefill the S3IntegrationBucketAccountId parameter of
+ // the CloudFormation quick-create link. Not sent to the backend.
+ bucket_account_id: z
+ .string()
+ .optional()
+ .refine((value) => !value || /^\d{12}$/.test(value), {
+ error: "Must be a valid 12-digit AWS Account ID",
+ }),
providers: z.array(z.string()).optional(),
enabled: z.boolean().optional(),
...awsCredentialFields,
diff --git a/ui/types/jsonapi.ts b/ui/types/jsonapi.ts
new file mode 100644
index 0000000000..144f0575e9
--- /dev/null
+++ b/ui/types/jsonapi.ts
@@ -0,0 +1,17 @@
+// Generic JSON:API v1.1 shells shared by feature adapters; feature code
+// models its attribute payloads and reuses these instead of re-declaring them.
+export interface JsonApiResource<TAttributes> {
+ id: string;
+ type: string;
+ attributes: TAttributes;
+ meta?: Record<string, unknown>;
+}
+
+export interface JsonApiDocument<TData> {
+ data?: TData;
+ meta?: Record<string, unknown>;
+ links?: Record<string, string | null>;
+ error?: string;
+ errors?: unknown[];
+ status?: number;
+}
diff --git a/ui/types/lighthouse/credentials.ts b/ui/types/lighthouse-v1/credentials.ts
similarity index 100%
rename from ui/types/lighthouse/credentials.ts
rename to ui/types/lighthouse-v1/credentials.ts
diff --git a/ui/types/lighthouse/index.ts b/ui/types/lighthouse-v1/index.ts
similarity index 100%
rename from ui/types/lighthouse/index.ts
rename to ui/types/lighthouse-v1/index.ts
diff --git a/ui/types/lighthouse/lighthouse-providers.ts b/ui/types/lighthouse-v1/lighthouse-providers.ts
similarity index 100%
rename from ui/types/lighthouse/lighthouse-providers.ts
rename to ui/types/lighthouse-v1/lighthouse-providers.ts
diff --git a/ui/types/lighthouse/model-params.ts b/ui/types/lighthouse-v1/model-params.ts
similarity index 100%
rename from ui/types/lighthouse/model-params.ts
rename to ui/types/lighthouse-v1/model-params.ts
diff --git a/ui/types/providers-table.ts b/ui/types/providers-table.ts
index 4612c358da..1ff71ac082 100644
--- a/ui/types/providers-table.ts
+++ b/ui/types/providers-table.ts
@@ -1,4 +1,4 @@
-import { MetaDataProps } from "./components";
+import { MetaDataProps, ProviderGroup } from "./components";
import { FilterOption } from "./filters";
import {
OrganizationResource,
@@ -86,6 +86,7 @@ export interface ProvidersAccountsViewData {
filters: FilterOption[];
metadata?: MetaDataProps;
providers: ProviderProps[];
+ providerGroups: ProviderGroup[];
rows: ProvidersTableRow[];
}
diff --git a/ui/types/providers.test.ts b/ui/types/providers.test.ts
new file mode 100644
index 0000000000..988be74c65
--- /dev/null
+++ b/ui/types/providers.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+
+import {
+ getProviderDisplayName,
+ humanizeProviderId,
+ isConfigurableProvider,
+ isKnownProviderType,
+} from "./providers";
+
+describe("humanizeProviderId", () => {
+ it("capitalizes a single-word id", () => {
+ expect(humanizeProviderId("template")).toBe("Template");
+ });
+
+ it("splits on hyphens and capitalizes each word", () => {
+ expect(humanizeProviderId("local-template")).toBe("Local Template");
+ });
+
+ it("splits on underscores", () => {
+ expect(humanizeProviderId("foo_bar")).toBe("Foo Bar");
+ });
+
+ it("collapses repeated separators and trims empties", () => {
+ expect(humanizeProviderId("a--b__c")).toBe("A B C");
+ });
+
+ it("returns an empty string for an empty id", () => {
+ expect(humanizeProviderId("")).toBe("");
+ });
+});
+
+describe("getProviderDisplayName", () => {
+ it("returns the configured label for a known provider", () => {
+ expect(getProviderDisplayName("aws")).toBe("AWS");
+ expect(getProviderDisplayName("gcp")).toBe("Google Cloud");
+ });
+
+ it("is case-insensitive for known providers", () => {
+ expect(getProviderDisplayName("AWS")).toBe("AWS");
+ });
+
+ it("humanizes an unknown/dynamic provider id", () => {
+ expect(getProviderDisplayName("template")).toBe("Template");
+ expect(getProviderDisplayName("local-template")).toBe("Local Template");
+ });
+
+ it("normalizes case for an unknown/dynamic provider id", () => {
+ expect(getProviderDisplayName("AWS_THING")).toBe("Aws Thing");
+ expect(getProviderDisplayName("Local-Template")).toBe("Local Template");
+ });
+});
+
+describe("isKnownProviderType / isConfigurableProvider", () => {
+ it("accepts a known provider", () => {
+ expect(isKnownProviderType("aws")).toBe(true);
+ expect(isConfigurableProvider("aws")).toBe(true);
+ });
+
+ it("rejects a dynamic/unknown provider", () => {
+ expect(isKnownProviderType("template")).toBe(false);
+ expect(isConfigurableProvider("template")).toBe(false);
+ });
+
+ it("rejects an empty provider value", () => {
+ expect(isKnownProviderType("")).toBe(false);
+ expect(isConfigurableProvider("")).toBe(false);
+ });
+});
diff --git a/ui/types/providers.ts b/ui/types/providers.ts
index ff5f3742bf..def1f9f004 100644
--- a/ui/types/providers.ts
+++ b/ui/types/providers.ts
@@ -19,9 +19,23 @@ export const PROVIDER_TYPES = [
"okta",
] as const;
-export type ProviderType = (typeof PROVIDER_TYPES)[number];
+/** The closed set of provider types this UI build ships bespoke assets for. */
+export type KnownProviderType = (typeof PROVIDER_TYPES)[number];
-export const PROVIDER_DISPLAY_NAMES: Record<ProviderType, string> = {
+// Autocomplete for predefined + open for dynamic providers
+export type ProviderType = KnownProviderType | (string & {});
+
+/** Type guard: narrows an arbitrary provider value to the known set. */
+export const isKnownProviderType = (
+ provider: string,
+): provider is KnownProviderType =>
+ (PROVIDER_TYPES as readonly string[]).includes(provider);
+
+export const isConfigurableProvider = (
+ provider: string,
+): provider is KnownProviderType => isKnownProviderType(provider);
+
+export const PROVIDER_DISPLAY_NAMES: Record<KnownProviderType, string> = {
aws: "AWS",
azure: "Azure",
gcp: "Google Cloud",
@@ -40,11 +54,24 @@ export const PROVIDER_DISPLAY_NAMES: Record<ProviderType, string> = {
okta: "Okta",
};
+/**
+ * Turns a raw provider id into a human-readable label: splits on `-`/`_` and
+ * capitalizes each word (e.g. `template` → "Template", `local-template` →
+ * "Local Template"). Used as the display fallback for dynamic providers
+ */
+export function humanizeProviderId(id: string): string {
+ return id
+ .split(/[-_]+/)
+ .filter(Boolean)
+ .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+ .join(" ");
+}
+
export function getProviderDisplayName(providerId: string): string {
- return (
- PROVIDER_DISPLAY_NAMES[providerId.toLowerCase() as ProviderType] ||
- providerId
- );
+ const normalized = providerId.toLowerCase();
+ return isKnownProviderType(normalized)
+ ? PROVIDER_DISPLAY_NAMES[normalized]
+ : humanizeProviderId(normalized);
}
export interface ProviderProps {
@@ -52,6 +79,7 @@ export interface ProviderProps {
type: "providers";
attributes: {
provider: ProviderType;
+ is_dynamic: boolean;
uid: string;
alias: string;
status: "completed" | "pending" | "cancelled";
diff --git a/ui/types/scan-configurations.ts b/ui/types/scan-configurations.ts
new file mode 100644
index 0000000000..fd8be386c3
--- /dev/null
+++ b/ui/types/scan-configurations.ts
@@ -0,0 +1,68 @@
+export interface ScanConfigurationAttributes {
+ inserted_at: string;
+ updated_at: string;
+ name: string;
+ configuration: string | Record<string, unknown>;
+ providers: string[];
+}
+
+export interface ScanConfigurationData {
+ type: "scan-configurations";
+ id: string;
+ attributes: ScanConfigurationAttributes;
+}
+
+export const SCAN_CONFIGURATION_LIST_STATUS = {
+ AVAILABLE: "available",
+ UNAVAILABLE: "unavailable",
+} as const;
+
+export type ScanConfigurationListStatus =
+ (typeof SCAN_CONFIGURATION_LIST_STATUS)[keyof typeof SCAN_CONFIGURATION_LIST_STATUS];
+
+export interface ScanConfigurationListState {
+ status: ScanConfigurationListStatus;
+ data: ScanConfigurationData[];
+}
+
+export interface ScanConfigurationListResponse {
+ data: ScanConfigurationData[];
+}
+
+export interface ScanConfigurationErrors {
+ name?: string;
+ configuration?: string;
+ provider_ids?: string;
+ general?: string;
+}
+
+export interface ScanConfigurationRequestAttributes {
+ name: string;
+ configuration: Record<string, unknown>;
+ provider_ids: string[];
+}
+
+export interface ScanConfigurationRequestData {
+ type: "scan-configurations";
+ id?: string;
+ attributes: ScanConfigurationRequestAttributes;
+}
+
+export interface ScanConfigurationRequestBody {
+ data: ScanConfigurationRequestData;
+}
+
+export type ScanConfigurationActionState = {
+ errors?: ScanConfigurationErrors;
+ success?: string;
+ data?: ScanConfigurationData;
+} | null;
+
+export interface DeleteScanConfigurationErrors {
+ general?: string;
+}
+
+export type DeleteScanConfigurationActionState = {
+ errors?: DeleteScanConfigurationErrors;
+ success?: string;
+} | null;
diff --git a/ui/types/server-actions.ts b/ui/types/server-actions.ts
index e69de29bb2..db03907d16 100644
--- a/ui/types/server-actions.ts
+++ b/ui/types/server-actions.ts
@@ -0,0 +1,17 @@
+export interface ServerActionSuccess<TData> {
+ data: TData;
+ meta?: Record<string, unknown>;
+ links?: Record<string, string | null>;
+ status?: number;
+}
+
+export interface ServerActionFailure {
+ error: string;
+ errors?: unknown[];
+ status?: number;
+}
+
+// Discriminate with `"error" in result` / `"data" in result`.
+export type ServerActionResult<TData> =
+ | ServerActionSuccess<TData>
+ | ServerActionFailure;
diff --git a/ui/vitest.config.ts b/ui/vitest.config.ts
index 89d17ba692..6ebd471a27 100644
--- a/ui/vitest.config.ts
+++ b/ui/vitest.config.ts
@@ -105,17 +105,6 @@ export default defineConfig(() => {
"next-themes",
// App component lib
- "@heroui/react",
- "@heroui/accordion",
- "@heroui/breadcrumbs",
- "@heroui/card",
- "@heroui/chip",
- "@heroui/divider",
- "@heroui/input",
- "@heroui/switch",
- "@heroui/theme",
- "@heroui/tooltip",
- "@heroui/use-clipboard",
"@iconify/react",
// Radix
@@ -132,6 +121,7 @@ export default defineConfig(() => {
"@radix-ui/react-scroll-area",
"@radix-ui/react-select",
"@radix-ui/react-separator",
+ "@radix-ui/react-switch",
"@radix-ui/react-tabs",
"@radix-ui/react-toast",
"@radix-ui/react-tooltip",
@@ -153,7 +143,6 @@ export default defineConfig(() => {
"clsx",
"tailwind-merge",
"class-variance-authority",
- "tailwind-variants",
// App-level deps the page (or its children) pull in
"@tanstack/react-table",
@@ -161,7 +150,6 @@ export default defineConfig(() => {
"@react-aria/visually-hidden",
"modern-screenshot",
"framer-motion",
- "vaul",
"cmdk",
"react-markdown",
"jwt-decode",
diff --git a/ui/vitest.setup.ts b/ui/vitest.setup.ts
index 631cfd7a41..796e3ea900 100644
--- a/ui/vitest.setup.ts
+++ b/ui/vitest.setup.ts
@@ -71,3 +71,13 @@ if (!Range.prototype.getClientRects) {
if (!Range.prototype.getBoundingClientRect) {
Range.prototype.getBoundingClientRect = () => emptyRect;
}
+
+class MockResizeObserver implements ResizeObserver {
+ observe() {}
+ unobserve() {}
+ disconnect() {}
+}
+
+if (!globalThis.ResizeObserver) {
+ globalThis.ResizeObserver = MockResizeObserver;
+}
diff --git a/util/update_aws_services_regions.py b/util/update_aws_services_regions.py
index 4fc5fc2b8f..40be038723 100644
--- a/util/update_aws_services_regions.py
+++ b/util/update_aws_services_regions.py
@@ -100,3 +100,4 @@ parsed_matrix_regions_aws = f"{os.path.dirname(os.path.realpath(__name__))}/prow
logging.info(f"Writing {parsed_matrix_regions_aws}")
with open(parsed_matrix_regions_aws, "w") as outfile:
json.dump(regions_by_service, outfile, indent=2, sort_keys=True)
+ outfile.write("\n")
diff --git a/uv.lock b/uv.lock
index efd7008d20..0167a7264f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1795,19 +1795,6 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/84/d0/205d54408c08b13550c733c4b85429e7ead111c7f0014309637425520a9a/deprecated-1.3.1-py2.py3-none-any.whl", hash = "sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f", size = 11298, upload-time = "2025-10-30T08:19:00.758Z" },
]
-[[package]]
-name = "detect-secrets"
-version = "1.5.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
- { name = "pyyaml" },
- { name = "requests" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/69/67/382a863fff94eae5a0cf05542179169a1c49a4c8784a9480621e2066ca7d/detect_secrets-1.5.0.tar.gz", hash = "sha256:6bb46dcc553c10df51475641bb30fd69d25645cc12339e46c824c1e0c388898a", size = 97351, upload-time = "2024-05-06T17:46:19.721Z" }
-wheels = [
- { url = "https://files.pythonhosted.org/packages/4e/5e/4f5fe4b89fde1dc3ed0eb51bd4ce4c0bca406246673d370ea2ad0c58d747/detect_secrets-1.5.0-py3-none-any.whl", hash = "sha256:e24e7b9b5a35048c313e983f76c4bd09dad89f045ff059e354f9943bf45aa060", size = 120341, upload-time = "2024-05-06T17:46:16.628Z" },
-]
-
[[package]]
name = "dill"
version = "0.4.1"
@@ -2469,6 +2456,19 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/72/eb/698dc17e4beb315f83a47d47be128b8a63303dc8b7e7c31110410e10a68b/keystoneauth1-5.14.0-py3-none-any.whl", hash = "sha256:f8c503a95fdd83b5b72736657e4ffbb53d4b28b01763f23013f0294ed8a0e4b9", size = 343268, upload-time = "2026-05-13T09:09:24.573Z" },
]
+[[package]]
+name = "kingfisher-bin"
+version = "1.104.0"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/1e/2b/324212f1baf482a7d4b66a2edf33073336735b67bb6b04a38d18fd9e67fb/kingfisher_bin-1.104.0-py3-none-macosx_10_9_x86_64.whl", hash = "sha256:8e3840e67004a971fef80aba240ee5c3c5f7a3a343a6d1083a2751aaf866d5d3", size = 14057606, upload-time = "2026-06-22T03:03:01.419Z" },
+ { url = "https://files.pythonhosted.org/packages/21/0a/cbf964da5102657cb9be4a59db7c9f7807ef88f9419673b7486daba785d3/kingfisher_bin-1.104.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b838313411fa2166a318a45aec2cfcc238e2f30f5292e309ca1129a73180c851", size = 12468386, upload-time = "2026-06-22T03:03:03.951Z" },
+ { url = "https://files.pythonhosted.org/packages/0b/a0/cc7ef0ac28f147cdfc9d80e4239fff11c1329831c6f57510c929e848753c/kingfisher_bin-1.104.0-py3-none-manylinux_2_17_aarch64.musllinux_1_2_aarch64.whl", hash = "sha256:0a94abbf2154ef8a3b4845cc0240e2321cdc19e0f5c7f585ea5252e76b242f68", size = 13943188, upload-time = "2026-06-22T03:03:06.378Z" },
+ { url = "https://files.pythonhosted.org/packages/17/79/827cfd7787885798a00b5ab905bdc866ef6f8deeff0f708679b06bc9baaa/kingfisher_bin-1.104.0-py3-none-manylinux_2_17_x86_64.musllinux_1_2_x86_64.whl", hash = "sha256:f381274b946f7f68ed72911770fff72024f2192c6e2e2158f2a7fbfda8c482fb", size = 14757594, upload-time = "2026-06-22T03:03:08.66Z" },
+ { url = "https://files.pythonhosted.org/packages/da/93/b0061fc69cd10382f647f9266823f213fd0b3f168f8b5bd9151a2370abb1/kingfisher_bin-1.104.0-py3-none-win_amd64.whl", hash = "sha256:f228d0dd61a738673b1c536e965a5661a83b1ee6ca64186a46ba6ea81ab4fd0b", size = 27697957, upload-time = "2026-06-22T03:03:11.268Z" },
+ { url = "https://files.pythonhosted.org/packages/a5/fb/f062665b4eb3f77e799cb6335e56bc2945aea83787888a6c1ab329858d0a/kingfisher_bin-1.104.0-py3-none-win_arm64.whl", hash = "sha256:a7774d9d11815ca946bd80b8c9df0f1d39c36cb5a21def3323b99d148dc63065", size = 26063704, upload-time = "2026-06-22T03:03:14.08Z" },
+]
+
[[package]]
name = "kubernetes"
version = "32.0.1"
@@ -3553,7 +3553,7 @@ wheels = [
[[package]]
name = "prowler"
-version = "5.32.0"
+version = "5.36.0"
source = { editable = "." }
dependencies = [
{ name = "alibabacloud-actiontrail20200706" },
@@ -3605,12 +3605,12 @@ dependencies = [
{ name = "dash" },
{ name = "dash-bootstrap-components" },
{ name = "defusedxml" },
- { name = "detect-secrets" },
{ name = "dulwich" },
{ name = "google-api-python-client" },
{ name = "google-auth-httplib2" },
{ name = "h2" },
{ name = "jsonschema" },
+ { name = "kingfisher-bin" },
{ name = "kubernetes" },
{ name = "linode-api4" },
{ name = "markdown" },
@@ -3714,12 +3714,12 @@ requires-dist = [
{ name = "dash", specifier = "==3.1.1" },
{ name = "dash-bootstrap-components", specifier = "==2.0.3" },
{ name = "defusedxml", specifier = "==0.7.1" },
- { name = "detect-secrets", specifier = "==1.5.0" },
{ name = "dulwich", specifier = "==1.2.5" },
{ name = "google-api-python-client", specifier = "==2.163.0" },
{ name = "google-auth-httplib2", specifier = "==0.2.0" },
{ name = "h2", specifier = "==4.3.0" },
{ name = "jsonschema", specifier = "==4.23.0" },
+ { name = "kingfisher-bin", specifier = "==1.104.0" },
{ name = "kubernetes", specifier = "==32.0.1" },
{ name = "linode-api4", specifier = "==5.45.0" },
{ name = "markdown", specifier = "==3.10.2" },
+ 
@@ -62,7 +62,7 @@ Review findings during scan execution in the following sections:
- **Compliance** – Displays compliance insights based on security frameworks.
-> For detailed usage instructions, refer to the [Prowler App Guide](/user-guide/tutorials/prowler-app).
+> For detailed usage instructions, refer to the [Prowler Cloud guide](/user-guide/tutorials/prowler-app), which also applies to Prowler Local Server.
+
+## What's New
+
+The Agentic Cloud Defender does more than answer questions, it helps teams **find and remediate what actually matters**, cutting through the noise to focus on the risk that counts. Prowler Cloud sharpens Lighthouse AI with the following improvements over the open-source version:
+
+
+
+### Side Panel
+
+You do not have to switch to the full chat view to reach Lighthouse AI. A side panel is available on every page of Prowler Cloud. While collapsed it stays out of the way; open it from any dashboard, findings list, or configuration screen to ask questions without leaving what you are working on. Open it using the Lighthouse AI button, circled in red in the image below.
+
+
+
+Once open, the panel slides in alongside your current page and shares the same agent, tools, and persistent chat sessions as the full Chat View, so a conversation started in the panel can be reopened and continued later from either place.
+
+
+
+- **Available everywhere:** Summon the assistant from any page while you keep working in the normal view.
+- **Context-aware help:** Ask about the findings, resources, or compliance data you are currently looking at.
+- **Continuous sessions:** Conversations opened in the side panel are saved alongside the rest of your chat history.
+
+### Tool Usage
+
+Lighthouse AI on Prowler Cloud renders the agent's work as it happens, so responses are easier to follow and to trust. Tool calls and reasoning steps appear in the order they occur within the conversation.
+
+- **Ordered steps:** Tool calls and reasoning are shown in sequence, reflecting how the agent reached its answer.
+- **Tool visibility:** The data tools invoked to retrieve findings and other Prowler information are displayed as the agent uses them.
+- **Thought process:** The agent's reasoning is presented alongside its actions, and can be expanded to review the full chain of steps.
+
+
+
+## Configuration
+
+Configure Lighthouse AI on Prowler Cloud from **Configuration** → **Lighthouse AI**:
+
+1. Click the desired provider (OpenAI, Amazon Bedrock, or OpenAI Compatible).
+2. Enter the required credentials.
+3. Click **Save**. The connection is validated automatically before the provider becomes available.
+
+
+
+### Business Context
+
+At the top of the configuration page, the optional **Business Context** field lets teams add environment priorities, compliance requirements, and ownership details, so responses align with organizational needs.
+
+Lighthouse AI on Prowler Cloud supports OpenAI, Amazon Bedrock, and OpenAI-compatible providers, with GPT-5.5 as the default. For per-provider setup and how to switch the default provider or model, see [Using Multiple LLM Providers](/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm).
+
+## Capabilities
+
+Lighthouse AI works through the [Prowler MCP Server](/getting-started/products/prowler-mcp), which gives the agent a growing catalog of tools to explore and act on your security data. These actions run inside Prowler and never modify your cloud resources. Everything the agent can do maps to one of the following capability areas.
+
+### Findings and Finding Groups
+
+- Search and filter security findings across every connected provider by severity, status, region, service, check, date range, and muted state.
+- Retrieve full finding details, including remediation guidance, check metadata, and affected resources.
+- Summarize findings with aggregate statistics and trends.
+- Browse finding groups aggregated by check and drill down into the specific resources each group affects.
+
+### Resources
+
+- List and filter cloud resources by provider, region, service, resource type, and tags.
+- Inspect a resource's configuration, metadata, and related findings.
+- Review the timeline of cloud API actions performed on a resource (AWS CloudTrail), including who did what and when.
+- Get an aggregate overview of the resources Prowler has discovered.
+
+### Compliance
+
+- Review high-level compliance status across all frameworks, with pass/fail statistics per framework.
+- Get a requirement-level breakdown for a specific framework, including failed requirements and their associated findings.
+
+### Attack Paths
+
+- List Attack Paths scans and discover the queries available for each completed scan.
+- Run graph-based queries to reveal privilege-escalation chains and exploitable misconfigurations.
+- Retrieve the Cartography graph schema to build accurate custom queries.
+
+### Scans and Providers
+
+- List, inspect, and rename security scans across providers.
+- Trigger manual scans and schedule automated daily scans for continuous monitoring.
+- Search connected providers and check their connection status, connect new providers, or remove existing ones.
+
+### Muting
+
+- Manage the mutelist for pattern-based bulk muting.
+- Create, update, list, and delete finding-specific mute rules, each with a documented reason and audit trail.
+
+### Security Check Catalog and Documentation
+
+- Browse and search the Prowler Hub catalog of security checks and compliance frameworks, including check code and automated fixers.
+- Search and retrieve official Prowler documentation to answer how-to and product questions.
+
+For the complete list of underlying tools, see the [Prowler MCP Tools Reference](/getting-started/basic-usage/prowler-mcp-tools).
+
+## FAQ
+
+**Which LLM providers are supported?**
+
+OpenAI (GPT models, including the default GPT-5.5), Amazon Bedrock (Claude, Llama, Titan, and others), and any OpenAI-compatible service such as OpenRouter.
+
+**Can Lighthouse AI change my cloud environment?**
+
+No. Lighthouse AI cannot modify the resources in your connected cloud providers (AWS, Azure, GCP, and others). It has read-only access to that environment and no tools to change it, even when the connected cloud credentials would allow it.
+
+**Can Lighthouse AI change my Prowler Cloud environment?**
+
+Yes. Lighthouse AI can take action within Prowler Cloud itself, such as connecting or removing providers, triggering and scheduling scans, and managing mute rules and the mutelist. See [Capabilities](#capabilities) for the full list of what it can do. These actions only affect your Prowler Cloud workspace, never the resources in your cloud providers.
+
+## Looking for the Open Source Version?
+
+Lighthouse AI is also available in the open-source Prowler Local Server. For its capabilities, FAQs, and limitations, see the open-source documentation.
+
+
+
-
+
### Detailed Remediation Guidance
@@ -36,7 +41,7 @@ Get tailored step-by-step instructions for fixing security issues:
- Commands or console steps to implement fixes
- Alternative approaches with different solutions
-
+
### Enhanced Context and Analysis
@@ -46,9 +51,9 @@ Lighthouse AI can provide additional context to help you understand the findings
- Provide risk assessments based on your environment and context
- Connect related findings to show broader security patterns
-
+
-
+
## Important Notes
diff --git a/docs/getting-started/products/prowler-mcp.mdx b/docs/getting-started/products/prowler-mcp.mdx
index 762b088326..93159b2e7d 100644
--- a/docs/getting-started/products/prowler-mcp.mdx
+++ b/docs/getting-started/products/prowler-mcp.mdx
@@ -8,6 +8,31 @@ title: "Overview"
**Preview Feature**: This MCP server is currently under active development. Features and functionality may change. We welcome your feedback—please report any issues on [GitHub](https://github.com/prowler-cloud/prowler/issues) or join our [Slack community](https://goto.prowler.com/slack) to discuss and share your thoughts.